-

How to setup an axis to achieve SIL3 compliance

 

Version Number

Description

1.0

Initial draft



1.   Supported Components

Component Name

Version

iC9200 series

≥ 2024.3

iCube Engineer

≥ 2024.3

SGD7S-xxxDA0xxxxF91 (SERVOPACK)

≥ V8.24

SGD7S-OSB01A, SGD7S-OSB02A (ASM7)

≥ V009

SGDV-OFA01A, SGDV-OFB04A (Feedback option card)


JZDP-Z00x-000 (ext. Encoder)

 

Resolver (ext. Encoder)

 

JZDP-H00x-xxx or JZDP-J00x-xxx (Serial converter)

 

 

Contents

1.     Supported Components
2.     Safety Precautions
3.     Scope
4.     Hardware setup
5.     Advanced Safety Module Parameter Setup
6.     iCube Engineer
7.     Example


2.   Safety Precautions

There is a risk of unstable operation, machine damage, or injury.
The entire process of defining the safety system is carried out in the planning phase. In addition to risk assessment, the planning contains the detailed definition of all system components, the definition of the system parameters and the detailed installation and wiring of the components.

WARNING!

Engineers designing a mechanical system using the safety functions of the safety module must have complete knowledge of the relative safety standards and a full understanding of the safety functions of the safety module.
When creating a safety design for a mechanical system using the safety functions of the safety module, always perform risk assessment of the system in accordance with DIN EN ISO 12100-1 and EN ISO 14121 to identify residual risks.
Improper use may result in injury or damage to the product.

DANGER!

Conducting the planning thoroughly aids in avoiding failures.
Failures in safety-oriented machines can lead to permanent injuries and death.
For more details on general safety precautions and the planning of safety-oriented control systems please refer to the ASM7 product manual (SIEP YEUOS7S 01B ASM7)

3.   Scope

This application note outlines the design and implementation of a safety-oriented drive system that meets the requirements of Safety Integrity Level 3 (SIL3) according to IEC 61508. The system is based on a servo-driven axis equipped with dual independent encoder systems to ensure reliable and safe position feedback.
The primary encoder is integrated within the servo motor, while a secondary encoder is directly mounted at the load. This configuration enables continuous position monitoring and fault detection, thereby enhancing the overall safety and redundancy of the system. This application note covers the rationale behind the dual-encoder approach, system architecture, component selection, parameterization, and programming methods to achieve SIL3 compliance.
This document aims to provide practical guidance and best practices for implementing the dual-encoder system, focusing on achieving robust and fail-safe operation through careful configuration and software integration.

4.   Hardware setup

Wiring

Precautions

Do not change any wiring while power is being supplied. There is a risk of electric shock or injury.
Connect the power supplies to the specified SERVOPACK terminals. Detailed information on this can be found in the manual SIEP S800002 30 (Σ-7-Series AC Servo Drive Σ-7S SERVOPACK with 400V-Input Power and EtherCAT (CoE) Communications References FT/EX Specification for Advanced Safety Module).
Whenever possible, use the cables specified by Yaskawa. If you use any other cables, confirm the rated current and application environment of your model and use the wiring materials specified by Yaskawa or equivalent materials. Securely tighten cable connector screws and lock mechanisms. Insufficient tightening may result in cable connectors falling off during operation.

Overview

The safety module is an optional module that can be connected to SGD7S-xxxDA0x8xxF91 SERVOPACKs. It supports Basic Safety Functions and Advanced Safety Functions (refer to the product manual for more detail on safety features)
The safety module uses the stop functions defined by IEC61800-5-2, which is achieved by using the HWBB function installed in the SERVOPACK. It is equipped with up to 16 different safety functions to provide machine safety. These functions reduce risks during usage of the machine by protecting people from hazardous operations of movable machine parts. The stopping function that is defined in functional safety standards can be achieved with 5 safety stop functions:

There is an example at the end of this Application Note, where the user can see how to setup a specific stopping method for a configured safety function.
An example of system configuration is shown below.

Image

Figure 1: configuration diagram

If the SERVOPACK does not have a built-in brake control (SGD7S-xxx xxx x 800 F91) please use an external brake relay. More information can be found in the manual. A wiring example for SERVOPACKs without built-in Servomotor brake control is provided below.

Image

Figure 2: SERVOPACK without Built-in Servomotor Brake Control

SERVOPACKs with built-in brake control (SGD7S-xxx xxx x 826 F91) contain a brake relay. The wiring is different because of the built-in brake relays. The following figure shows a wiring example.


Image

Figure 3: SERVOPACK with Built-in Servomotor Brake Control

The power supply for the holding brake is not provided by Yaskawa. Select a power supply based on the holding brake specifications.
If you use a 24 V brake, install a separate power supply for the 24 V DC power supply from other power supplies, such as the one for the I/O signals of the CN1 connector. If the power supply is shared, the I/O signals may malfunction.

The external encoder, which is mounted directly to the load, enhances the system to reach the requirements of safety integrity. It is possible to use this system also as a fully closed loop control. We will not discuss this setup in this Application Note however, since the safety requirements are met without closing the control loop at the load and using the external encoder solely for monitoring purposes in order to reach SIL3.

Wiring Concept

Image

Figure 4: system wiring concept rotary motor

*1 Feedback Option Card type depends on connected device:

- Yaskawa Encoder Sigma-7: SGDV-OFA01A

- Resolver: SGDV-OFB04A

*2 Connector CN21 is only available on SGD7S-OSB02A

Limitations

Use of the Test Without Motor Function

The test without motor function of the SERVOPACK cannot be used together with the safety functions of the safety module.
When using the safety functions, disable the test without motor function of the SERVOPACK being used.

Setting the Communication Channel for the USB Connection

The communication channel for the USB connection in SERVOPACK parameter Pn010 (Axis Address Selection for UART/USB Communications) must always be set to "0001h" for the period of communication with the Advanced Safety Module Parameter Editor.
This is the default value for the parameter Pn010. However, if it is not possible to establish communication via USB, the correct setting of this parameter should be checked in any case.

Device Combination

Due to the safety functions, the safety module can be used with limited models of SERVOPACK, servomotors, and serial converters. For details, refer to the ASM7 product manual (SIEP YEUOS7S 01B ASM7)
Please make sure, the firmware version of the SERVOPACK and the advanced safety module are compatible with each other.

SERVOPACK v8.22 ⮫     ASM7 v8

SERVOPACK v8.24 ⮫     ASM7 v9

Basic Settings Required Before Starting Operation

The test without motor function of the SERVOPACK cannot be used together with the safety functions of the safety module.
When using the safety functions, disable the test without motor function of the SERVOPACK being used.
To disable it, set the following SERVOPACK parameter:
Pn00C.0 (Function Selection for Test without a motor) -> 0: Disable tests without a motor.
Clear the Safety Module Confirmation Alarm (A.EC0).
To execute this feature, the Digital Operator (JUSP-OP05A-1-E) or the Advanced Safety Module Parameter Editor (PC configuration tool) is needed.
Determine the configuration of the motor and encoder to be used, then install and wire.

Image

Figure 5: Motor Configuration

Image

Figure 6: Encoder Configuration

As seen in the Figures above, to reach SIL3, the system will need an external encoder. The user can decide if a fully-closed loop control should be used or not. See the table below to determine the configuration and reachable safety integrity levels.

Servomotor

External encoder usage

Reachable SIL

Use

Safety application

Fully-closed control loop

Without fully-closed control loop

Rotary Servomotors or Direct Drive motors

No

No

No

No

2

Yes

Yes

Yes

No

3

Yes

Yes

No

Yes

3

 

Servomotor

External encoder usage

Reachable SIL

Use

Safety application

Linear Servomotors

No

No

2

Yes

Yes

3

 

Following SERVOPACK parameters need to be set accordingly to the configured motor type:
Note: For safety integrity level 3 the allowed speed range is from -6000 to +6000 rpm.
Further information on the related parameters can be found in the following manual:
Σ-7-Series AC Servo Drive Σ-7S SERVOPACK with 400V-Input Power and EtherCAT (CoE) Communications References FT/EX Specification for Advanced Safety Module Product Manual
SIEP S800002 30
Follow the steps below to create Safety-related Module Parameters (a so-called Safe Container) and download them to the safety module.
After downloading the Safe Container to the safety module, if a Safety-related Servo Parameter Unmatch Alarm (A.EC1) has appeared, there are unmatched parameters in the Safety-related Servo Parameters.
To check the unmatched parameters, Fn042 (Safety-related Servo Parameter Confirmation) or the Advanced Safety Module Parameter Editor (PC configuration tool) is available.

5.   Advanced Safety Module Parameter Setup

The safety-related module parameters are used to set the safety functions and are only used for the safety module.
Following safety related parameters need to be set accordingly to the application. Enable the ‘Expert Mode’ to see the parameter number and name as a table format. The standard mode view can also be used to set up the safety module parameters.

General Device Parameters:

Pc070 - FSoE Hardware Address
If the FSoE Address is set to 0000h the FSoE functionality is switched off.
Pc09E - Limit Violation Deactivation Delay Time (LVDDT)
The Limit Violation Deactivation Delay Time (LVDDT) is a global parameter. If a "Limit Violation" is detected in a safety function, the SERVOPACK is set to the safe state by the safety module in accordance with your parameterization. If the Limit Violation is cleared, i.e. no longer present, the LVDDT time delays the time before the safety module leaves this safety function and thus the safe state. A constant state change of outputs is thus avoided.
PcF37 - Encoder Filter (samples)
This parameter defines the depth of the FIR Filter for the calculation of the internal acceleration value. If the SLA function is used, the setting of this parameter is mandatory.
If a value of 15 is used, the calculated value is very precise, but the calculation will take roughly 100ms. Smaller values will increase the calculation time, but the calculated acceleration is less precise, which might cause the SLA function to detect a higher acceleration than the actual acceleration.

Safety Related Servo Parameters:

Pc050 - Motor Setting Switch
This parameter describes the type and direction of the motor set in the SERVOPACK. This setting influences the position calculation in the SERVOPACK, and the position values sent to the safety module via the serial communication.
The corresponding SERVOPACK parameter for Pc050.1 (Motor direction) is Pn000.0 (Direction Selection).

Pc051 - Function Setting Switch
Test without motor is not possible with the safety module!
The corresponding SERVOPACK parameter for Pc051.0 (Selection of Test without motor) is Pn00C.0 (Function Selection for Test without a Motor).
Pc05A - External Encoder Setting Switch
The corresponding SERVOPACK parameters are Pn002.3 (External Encoder Usage) and Pn00E.3 (External encoder monitor usage).
Pc05C - Encoder Number of Pulses (External Encoder)
This parameter depends on the connected external encoder.
The corresponding SERVOPACK parameters are Pn002.3 (External Encoder Usage), Pn00E.0 (Resolution calculating method of an external encoder), Pn00E.3 (External encoder monitor usage) and Pn23E (Number of External Encoder Pulses).

Basic Application

External Encoder Type

Value

Number of External Encoder Pulses

Rotary Application

JZDP-Z001-000

131072

Pn23E = 131072

JZDP-Z002-000

1048576

Pn23E = 1048576

Resolver Absolute

16384

Pn23E = 16384

Resolver Incremental

Linear Application

JZDP-H/Jxxx-xxx

0

 


Pc060 - Encoder Data Format Configuration 1 (Motor Encoder)
This parameter depends on the connected servomotor.


Motor Type

Motor/Encoder Type, Serial

Converter Type

Value

Rotary Motor

SGM7x-xxxxx

24

Linear Motor

JZDP-Hxxx-xxx

8

JZDP-Jxxx-xxx

12

 

Pc062 - Motor Max. Speed (Motor Encoder)
Linear Motor: Max speed depends on Motor parameter (stored in serial converter) and SERVOPACK Pn385 (Maximum Motor Speed).
Pc063 - Linear Scale Pitch, Mantissa Part (Motor Encoder)
The corresponding SERVOPACK parameter is Pn282 (Linear Encoder Pitch).


Motor Type

Motor Encoder (Manufacturer, Model)

Linear Scale Pitch (Motor Encoder)

External Encoder Scale Pitch

Pc063 (Mantissa)

Pc065.0-1 (Exponent)

Value

Rotary Motor

-

0 (00h)

0 (00h)

0

Pn282 = 0

Linear Motor

Heidenhain LIDA48

2 (02h)

10 (0Ah)

2*1010

Pn282 = 2000

Heidenhain LIF48

4 (04h)

9 (09h)

4*1010

Pn282 = 400

Renishaw PLC RGH22B

2 (02h)

10 (0Ah)

2*1010

Pn282 = 2000

Note:    Linear Scale Pitch (fm) = Mantissa * 10Exponent

Linear Scale Pitch (fm) = Pc063 * 10Pc065.0-1

Pc065 - Linear Scale Pitch, Exponent and Linear Encoder Resolution (Motor Encoder)
See description of Pc063.
The corresponding SERVOPACK parameter is Pn282 (Linear Encoder Pitch).
Pc066 - Encoder Number of Pulses (Motor Encoder)
This parameter depends on the connected servomotor.


Motor Type

Motor/Encoder Type, Serial Converter Type

Value

Rotary Motor

SGM7J-xxxxx

16777216

SGM7A-xxxxx

16777216

SGM7G-xxxxx

16777216

Linear Motor

JZDP-Hxxx-xxx

0

JZDP-Jxxx-xxx

0

 

Pc068 - Encoder Information (Motor Encoder)

Digit

Name

Range

Default

0

Encoder hardware type

0 = Incremental

1 = Absolute

0

1

Reverse mode

0 = Normal

1 = Reverse

0

2

Encoder data format

0 = Linear

1 = Rotary

1

3

Motor Encoder usage

0 = Absolute (multi-turn)

1 = Incremental

2 = Absolute (single-turn)

0


Encoder hardware type: This parameter depends on the connected servomotor.
Reverse mode: The value for all 400 V rotary servomotors and all the linear servomotors is "Normal".
Encoder data format: This parameter depends on the connected servomotor.
Motor Encoder usage: The corresponding SERVOPACK parameter for PC068.3 (Motor Encoder usage) is Pn002.2 (Absolute Encoder Usage).

6.   iCube Engineer

This chapter describes the steps to be taken to setup the project in the ‘iCube Engineer’ software. Be aware that the following instructions are solely regarding the hardware setup of the safety part for one Axis. Safety functions of the Advanced Safety Module, motion and other logic is not described in this Application Note.

 

Add controller and setup IP-Address

Create a new project and add a safety controller to the Plant. A template can also be used to start the project from. If a controller is added manually, the user must define a password for the safety related area of the project. If the template was used, there is already a password predefined (‘safety’).
Please make sure the configured IP-Address of the project matches the IP-Address of the physical controller.

Image

Figure 7: adding safety controller to the PLANT

Add SERVOPACK

There are several ways to add a SERVOPACK to the EtherCAT network.
  1. Scan the network ⮫ right-click on the EtherCAT node in the ‘PLANT’ area of the project and select ‘EtherCAT bus scan’
  2. Add to Device List ⮫ double-click on the EtherCAT node in the ‘PLANT’ area of the project and go to the ‘Device List’ tab. Click on ‘Select type here’ and choose the correct SERVOPACK to add it to the network.
  3. Drag and drop from catalog ⮫ Find the correct SERVOPACK in the ‘COMPONENTS’ area of the project and add it to the network by dragging it onto the EtherCAT node in the ‘PLANT’.

Image

Figure 8: different ways to add a SERVOPACK

Add ASM7

If the network scan was performed in the pervious step and the Advanced Safety Module was installed to the SERVOPACK correctly, the ASM should be added to the project already.
Otherwise, please add it manually. This can be also done in several ways.
  1. Add to module list ⮫ double-click on the servo node in the ‘PLANT’ area of the project and go to the ‘Module List’ tab. Click on ‘Select type here’ and choose the correct ‘Safety Drive’
  2. Drag and drop from catalog ⮫ Find the correct module in the ‘COMPONENTS’ area of the project and add it to the network by dragging it onto the servo node in the ‘PLANT’.

Image

Figure 9: different ways to add the ASM

Create In-Output Variables for ASM7

When there is a safety device present in the project, at least one in- and output must be connected to a variable. In this case we must create (safety PLC) variables and connect them to the respective in- and outputs. At this point there should be an Error displayed to the user which indicates there are no variables connected to the in- and outputs of the ASM7.
To do this, please open the ‘Safety PLC’ node in the ‘PLANT’, go to the ‘Data List’ tab and create variables in the ‘Variable (Safety PLC)’ column.

Image

Figure 10: create safety variables

After that, please connect the variables to the safety module by opening the process data item list and selecting the respective instance.

Image

Figure 11: connecting variable to process data item

Alternatively, variables can be created automatically. To do this, please open the ‘Safety Drive’ node in the ‘PLANT’ and go to the ‘Data List’ tab. Now right click on the instance you want to create a variable for and choose ‘Add Variable (Safety PLC)’.

Image

Figure 12: creating and connecting variables automatically

Create device diagnostic variables

This step is optional. For better debugging possibilities the user can create device specific or summarizing (for all safety nodes) diagnostic variables. This can be done in the settings tab of the ‘Safety PLC’ node.

Image

Figure 13: creating diagnostic variables

7.   Example

In this chapter we will create a project from scratch with the following hardware:

In this test setup we are not using any gearboxes. The external encoder is directly mounted to the motor shaft via a fixed coupling. So, they are facing each other. Because of this, the external encoder direction is reverse to the motor direction. Also, the external encoder is used for safety purposes only, we will not use it for a fully closed loop. We will setup one safety function (safely limited speed SLS). In case of a limit violation of the safely limited speed, we will trigger a controlled stop according to IEC 60204-1 (stop category 1) and we will monitor the deceleration operation using the ramp-monitored Safe Stop 1 function. For more information on these functions please refer to the former mentioned manual of the advanced safety module.

Advanced Safety Module Parameter Editor

First, we will create a project in the ‘YASKAWA Advanced Safety Module Parameter Editor’ to setup the ASM7 card properly.
Initially, when creating a new project, the user is asked which module type is being used. Since we have a ‘OSB01A (FSoE only)’ card installed to the SERVOPACK; we will choose this type. A description for the project can also be added.

Image

Figure 14: choose ASM7 Module Type

Next, we will setup the parameters by the parameter groups.

General Device Parameters

When the parameters are setup correctly, we can ‘check and commit’ them by clicking on the respective button and then ‘Confirm’ if everything is okay. This procedure needs to be done for all the following parameter groups as well.

Image

Figure 15: general device parameters

Image

Figure 16: compare and confirm parameters

Motor and Encoder Parameters

Now, we can setup the parameters regarding the motor and external encoder we are using.

Image

Figure 17: motor and encoder parameters

User Unit & Encoder Parameters

Nothing needs to be done here.

Slot 1 Parameters

Safety Function                              ⮫SLS
Activation Input                             ⮫Virtual Input 0
Output Signal Type                       ⮫Virtual Output 0
Output Signal Behaviour               ⮫TRUE during operation
Waiting Time t1 (ms)                     ⮫20
Monitoring Time t2 (ms)               ⮫1500
Speed Limit s1 (degrees/s)            ⮫10000
Speed Limit s2 (degrees/s)            ⮫360

Image

Figure 18: safety function parameters Slot 1

Slot 2 Parameters

Make sure that the Slot 1 parameters have been checked and committed before moving on to the Slot 2 parameters.

Safety Function                            ⮫SS1 -r
Activation Input                           ⮫Limit Violation Slot 1
Output Signal Type                      ⮫Virtual Output 1
Output Signal Behaviour              ⮫TRUE during operation
Waiting Time t1 (ms)                    ⮫10
Monitoring Time t2 (ms)              ⮫5000
Speed Limit s1 (degrees/s)           ⮫360
Speed Limit s2 (degrees/s)           ⮫0

Image
Figure 19: safety function parameters Slot 2

Download safe container

After successfully checking and committing all parameters, we can now download the container file to the advanced safety module. But before we do that, we need to calculate a checksum for validation and export a safe container. Don’t forget to safe the project to your PC first.
Please refer to the product manual of the advanced safety module for a detailed description of the download process.

SERVOPACK Parameters

We also need to change the respective parameters on the SERVOPACK itself. To do that, we connect to the SERVOPACK via Sigma Win+ and make the following changes.
Additionally, we should make sure that the following Parameters, which are not related to safety and the ASM7, are setup correctly. These are so called forced parameters. This means that the iCube controller needs these to be setup in a specific value in order to work properly. You can use the “write to ROM” function in iCube Engineer to make sure these parameters are written correctly.

Create a Project in iCube Engineer

In chapter 6 it is described how to setup the hardware configuration in iCube Engineer. For this example, we will also include PLCopen conform function blocks to control the axis. For the sake of simplicity, we will just use the following motion function blocks in this example. The user can always add more motion and/or logic to the program if wanted.

Image

Figure 17: PLCopen motion function blocks

Now, the application is setup and ready to go. We can download and start the project on the controller. In case of an Error on the SERVOPACK, please execute the ‘MC_Reset’ FB.
To turn on the power to the axis, enable the ‘MC_Power’ FB.
The ‘MC_ReadStatus’ FB indicates the current status of the axis.
We didn’t change any of the user units within iCube Engineer, so the velocity, acceleration and deceleration inputs correspond directly to rotations per second, respectively rotations per second2.
So, when we set the velocity input to 1, the motor will turn with one revolution per second, as soon as we set the execute input to TRUE.
To stop the axis, execute the ‘MC_Stop’ FB.
We could think of the SLS safety function as a maintenance mode where the motor must operate within a safe speed. So, when the user requests the maintenance mode, we would have to make sure to reduce the speed of the motor to a max. speed of 360 degrees per second. As soon as this safe speed is reached, we would activate the safety function ‘SLS’ via the virtual input 0 of the ASM7 card, the safety module will monitor the speed of the motor and stop it safely when it exceeds 360 degrees per second. We can monitor this state via the virtual output 0. In case of a violation of this safely limited speed operation, the Safe Stop operation, which we setup in the second slot of the ASM7, will be activated and the motor will have to be stopped within 5 seconds, otherwise the power to the motor will be shut off.


 

This help information is valid for iCube Engineer Online Help 2025.6

Copyright © 2025 YASKAWA EUROPE GmbH and © 2025 YASKAWA America, Inc.