anfoss iC7 Series Air Cooled and Liquid Cooled System Modules

Specifications

• Functional Safety Standards and Performance: Compliant with industry standards for functional safety
• Technical Data: Specific technical data available in the product documentation
• Operating Conditions: Detailed operating conditions provided in the user manual
• Cable Specifications: Information on compatible cables and specifications

Product Usage Instructions

Safety
Before operating the iC7 Series Functional Safety system, familiarize yourself with the safety symbols, ensure qualified personnel are handling functional safety aspects, and consider general safety precautions.

Installation
Follow the installation instructions provided for system modules with +BEF2 to set up the system correctly.

Configuration Tools
Use the provided configuration tools to ensure system security, prepare for a PC connection, and utilize MyDrive Insight for configuration.

Commissioning
Prior to commissioning, perform safety checks, conduct commissioning tests, complete a checklist, and validate safety functions like STO and Safe Stop 1 Time-controlled (SS1-t). Generate a commissioning report for documentation.

Operation and Maintenance
Regularly conduct functional tests, utilize diagnostics when needed, follow specific guidelines for high-altitude installations and drive replacements.

Troubleshooting
Refer to the status LEDs for system status, address instances of STO function and feedback outputs, recover from safety function faults, and consult the event list for troubleshooting.

FAQ
Q: Where can I find additional resources for installing and operating the iC7 products?
A: Additional safety guides, installation guides, operating guides, and application guides are available to assist with understanding features and proper usage of the iC7 products.

Introduction

Purpose of this Operating Guide
This operating guide provides information on the functional safety features of the iC7 drives and is targeted at users already familiar with the Danfoss iC7 series. It is intended as a supplement to the drive-specific guides.
The guide includes instructions on how to verify that the built-in functional safety features are active, and about configuring the safety features.

Additional Resources
Additional resources are available to help understand the features, and safely install and operate the iC7 products:

• Safety guides, which provide important safety information related to installing iC7 drives.
• Installation guides, which cover the mechanical and electrical installation of drives, or functional extension options.
• Operating guides, which include instructions for control options, and other components for the drive.
• Application guides, which provide instructions on setting up the drive for a specific end use. Application guides for application software packages also provide an overview of the parameters and value ranges for operating the drives, configuration examples with recommended parameter settings, and troubleshooting steps.
• Facts Worth Knowing about AC Drives, available for download on www.danfoss.com
• Other supplemental publications, drawings, and guides are available at www.danfoss.com.
  Latest versions of Danfoss product guides are available for download at https://www.danfoss.com/en/service-and-support/documentation/

 Abbreviations
Table 1: Abbreviations Related to Functional Safety

Abbreviation	Reference	Description
FIT	–	Failure in time. 1 FIT corresponds to a failure per 1E9 hours of operation.
HFT	EN IEC 61508-4	Hardware fault tolerance: HFT = n means that n+1 faults could cause a loss of the safety function.
MTTFd	EN ISO 13849-1	Mean time to failure – dangerous. Unit: Years. Years are divided into Low, Medium, and High.
PFH	EN IEC 61508-4	Probability of dangerous failures per hour. Consider this value if the safety device is operated in high de- mand or continuous mode of operation, where the frequency of demands for operation made on a safety-related system is greater than 1 per year.
PFD	EN IEC 61508-4	Average probability of failure on demand, value used for low de-mand operation.
PL	EN ISO 13849-1	Discrete level used to specify the ability of safety-related parts of control systems to perform a safety function under foreseeable conditions. Levels divided into a to e.

Abbreviation	Reference	Description
PLr	EN ISO 13849-1	Required performance level (the required performance level for a particular safety function).
SIL	EN IEC 61508-4	Safety Integrity Level
STO	EN IEC 61800-5-2	Safe Torque Off
SS1	EN IEC 61800-5-2	Safe Stop 1

Version History

This guide is regularly reviewed and updated. All suggestions for improvement are welcome.
The original language of this guide is English.
Table 2: Version History

Version	Remarks	Hardware and software versions
AQ477043679710, version 0102	First release. The information in this version is valid for iC7-Automation air-cooled system modules, iC7-Hybrid liquid-cooled system modules, and iC7-Marine liquid-cooled system modules.	136B4311 (Advanced safety unit): Board version 0.4.2 (revision B) or later, firmware version 3.1.0 or later. 139Z9478 (Safety interface board): Board version 0.03.01 (revision C) or later, firmware version 3.1.0 or later 139Z9493 (Driver board): revision H or later. 139Z9617 (Driver board): revision B or later. 70CVB02084 (Driver board): revision F.1 or later. 139Z9562 (Measurement board): revision E or later. 70CVB02078 (Measurement board): revision F or later.

Safety

 Safety Symbols
The following symbols are used in Danfoss documentation.

• DANGER
  Indicates a hazardous situation which, if not avoided, will result in death or serious injury.
• WARNING
  Indicates a hazardous situation which, if not avoided, could result in death or serious injury.
• CAUTION
  Indicates a hazardous situation which, if not avoided, could result in minor or moderate injury.
• NOTICE
• Indicates information considered important, but not hazard-related (for example, messages relating to property damage).
• The guide also includes ISO warning symbols related to hot surfaces and burn hazard, high voltage and electrical shock, and referring to the instructions.
• ISO warning symbol for hot surfaces and burn hazard
• ISO warning symbol for high voltage and electrical shock
• ISO action symbol for referring to the instructions

Qualified Personnel for Working with Functional Safety

• Only qualified personnel can install, configure, commission, maintain, and decommission functional safety features and functions.
• Qualified personnel for working with functional safety features are qualified electrical engineers, or persons who have received training from qualified electrical engineers, and are suitably experienced to operate devices, systems, plants, and machinery in accordance with the general standards and guidelines for safety technology.

Furthermore, they must:

• Be familiar with the basic regulations concerning health and safety/accident prevention.
• Have read and understood the safety guidelines given in this guide.
• Have a good knowledge of the generic and specialist standards applicable to the specific application.
• Installers and system integrators of systems incorporating power drive systems (safety-related) are responsible for:
• Hazard and risk analysis of the application.
• The overall safety of the application.
• Identifying safety functions required and allocating SIL or PL to each of the functions, other subsystems, and the validity of signals and commands from them.

Designing appropriate safety-related control systems, such as hardware, software, and parameterization.

General Safety Considerations
When installing or operating the AC drive, pay attention to the safety information given in the instructions. For more information about safety guidelines for installation, see the product-specific safety guide that is included in the drive shipment. For more information about safety guidelines for operating the drive, see the product-specific guides.

NOTICE

COMMISSIONING TEST

• After installing the safety functions, perform a commissioning test.
• A successful commissioning test is required after the initial installation, and after each change to the installation or application involving functional safety.
• If the commissioning test fails, safe operation cannot be guaranteed.

WARNING

RISK OF ELECTRIC SHOCK

• The STO safety function does not provide electrical safety. The STO function itself is not sufficient to implement the Emergency-Off function as defined by IEC 60204-1:2018. Using the STO function to implement
• Emergency-Off may lead to death or personal injury.
• Emergency-Off requires measures of electrical isolation, for example, by switching off mains via an extra contactor.

 Functional Safety

Functional Safety Options
Functional safety option +BEF2 includes Safe Torque Off (STO) and Safe Stop 1 time-controlled (SS1-t) safety functions. Drives with +BEF2
also include an advanced safety unit, which enables configuring functional safety parameters using MyDrive® Insight.

Functional Safety System Description

• An additional advanced safety unit is used to implement safety functions in accordance with the standard EN IEC 61800-5-2 in iC7 system modules with +BEF2.
• The advanced safety unit handles the safe I/O and the monitoring of active safety functions. The advanced safety unit does not handle the controls of the AC drive. The AC drive can be controlled, for example, with the drive application, or the external process control system.
• The advanced safety unit can be controlled with the digital I/Os and over safe fieldbus, where applicable.
• Figure 1 describes the system architecture of drives with the functional safety units.

Gray areas in the illustration indicate that the component is related to functional safety.

System Modules with Different Safety Functions

Overview
System modules with STO and SS1-t (+BEF2) provide the following safety functions:

• Safe Torque Off (STO).
• Safe Stop 1 time-controlled (SS1-t): the motor decelerates within a specified deceleration time. STO is activated at the end of a deceleration time.

Both safety functions are designed and approved suitable for the requirements of:

• Category 3 in EN ISO 13849-1
• Performance Level “e” in EN ISO 13849-1
• SIL 3 in IEC 61508 and EN 61800-5-2
• The system modules are fitted with a dual-channel, galvanically isolated input, and an STO feedback signal for diagnostic purposes.
• A safety function is active if 1 or both of the safety inputs are not connected to a +24 V signal. The drive is not able to go to the RUN state.
• For more information, see Table 14.
• All control inputs and outputs are galvanically isolated from supply voltage (PELV) and other high-voltage terminals, unless otherwise specified.

Safe Torque Off (STO)

NOTICE

• Select and apply the components in the safety control system appropriately to achieve the required level of operational safety. Before integrating and using STO in an installation, carry out a thorough risk analysis on the installation to determine whether the STO functionality and safety levels are appropriate and sufficient.
• The Safe Torque Off (STO) function is a component in a safety control system. STO prevents the unit from generating the power required to rotate the motor.
• The iC7 drives are available with:
• Safe Torque Off (STO), as defined by EN IEC 61800-5-2:2017
• Stop category 0, as defined in EN IEC 60204-1:2018.
• The STO function is available for iC7 drives with functional safety plus code +BEF2. Specific hardware revisions are listed in the appendix of the functional safety certificate.

STO Activation

The STO function is activated by 1 of the following reasons:

• An external request.
• A violation of another safety function.
• A fault detected by the internal diagnostics.
• The Safe Stop 1 (SS1-t) function activates the STO function when an application-specific time delay has passed (time monitoring).
• Use the STO function to stop the drive in a situation where a safety function is required. In normal operating mode when STO is not required, use the standard stop function instead.

Configuring Restart and Acknowledgment Behavior

• Safety functions can be set up to require an acknowledgment to safety-related events. These events include the power-up of the device, or the disengagement of a safety function.

The configuration options are:

• Direct restart: Transitioning to the operational state does not require any action.
• Nonsafe Acknowledge required: Acknowledgment through a selected non-safe input is required.
• Safe Acknowledge required: Acknowledgment through a selected safe input is required.
• IMPORTANT: If the problem persists and the device stays in error mode, contact Danfoss.

NOTICE
The prevention of unintended restart after STO deactivation does not fulfill a SIL 2 or SIL 3 requirement. This applies when configuring manual restart using the parameter 7.3.1 Safe Torque Off Response.

• If unintended restart is critical to the installation, this has to be controlled by the use of STO, both after STO activation and at normal startup scenarios, for example after normal power cycle.

CAUTION
The default restart behavior is set to Manual. Before switching to Automatic, ensure that requirements of EN ISO 12100:2011 paragraph 6.3.3.2.5 are fulfilled.

1. Reapply 24 V DC supply to safe inputs.
2. Give a reset signal via fieldbus, digital I/O, or the control panel.
   Set the STO function to Warning by setting the value of parameter 7.3.1 Safe Torque Off Response from the default value Fault (manual reset) to Warning (automatic reset). Warning means that STO is terminated and normal operation is resumed, when the 24 V DC is applied to safe inputs. No reset signal is required.

STO Properties

For flexible adaptation to the safety system, the safe inputs contain the following properties:

• Galvanic isolation of terminals: The functional safety I/O terminal blocks on the control board have separate, galvanically isolated inputs to allow, for example, interchanging of the polarities of the safe input terminals as shown in Figure 6 and Figure 7.
• Test pulse filtering: Several control modules test their safe outputs using Test Pulse Pattern (on/off tests) to identify faults due to either short- or cross-circuiting. When interconnecting the safe input of the drive with a safe output of the control module, the drive responds to the test signals. A signal change during a test pulse pattern is configured with parameter Stable Signal Time (range 1– 5000 ms). Test pulses of the length configured in parameter Stable Signal Time are ignored on the safe input lines. It is also possible to filter short pulses, which could lead to safety functions being activated incorrectly. See 4.2 General Functional Safety Parameters for more information on parameter Stable Signal Time.

NOTICE

• The stable signal time extends the safety function response time. The safety function is activated after the response time has expired.
• If the signal to the safety input is not stable, the drive responds with a fault.
  
• Asynchronous input tolerance: The input signals at the safe input terminals are not always synchronous. If the discrepancy between the 2 signals is longer than 500 ms, the drive indicates an IO failure as described in Table 14. This feature does not delay theactivation of the safety function.
  

 STO Feedback
STO feedback is a single-channel feedback signal which can be used for status information. It can help to achieve better safety capability on system level, for example, in retrofit cases, where diagnostic feedback to the safety system is required.

CAUTION
The feedback signal is not designed to be a part of the safety function, and it does not have a Safety Integrity Level.

Table 3: Instances of STO Feedback for Systems with Modular Control

State	Feedback state(1)	Additional information
Standard function	De-energized	The motor is running and no safety function is active. STO feedback is de-energized.
STO state is reached	Energized	STO is requested, and a safe state is reached. STO state is reached and connection to all power units is established. STO output is de-energized.
Configuration needed	De-energized	Safe inputs must have a validated configuration to ensure that all power units have reached a safe input state. The connected power units are a part of the con- figuration, and without a validated configuration, the safe input cannot assume to have a connection to all power units established.
Software update	De-energized	During software update, the state of the safe output is not reliable. STO output is de-energized.

State	Feedback state(1)	Additional information
Bootloader and startup	De-energized	The bootloader does not communicate and does not know the state of the STO output on the power units. At startup, the communication is not yet established and the safe input card does not know the state of the safe output on the power units.
Internal failure	De-energized	Indicates a severe issue, for example in the STO cir- cuitry. It cannot be assumed that the Safety IO knows that all STO outputs are de-energized.
Internal fatal failure	De-energized	Triggered when a fatal internal issue has occurred, for example, a CPU or RAM fault. The operation cannot be guaranteed, and it cannot be assumed that the safe outputs can be de-energized.

1. Energized: STO_FB+ ⇨ STO_FB- circuit closed = current flow = logical “0” with low side driver configuration. De-energized: STO_FB+ ⇨ STO_FB- circuit open = no current flow = logical “1” with low side driver configuration.
   

Figure 4: STO Feedback Example with an External Safety Device for System Modules
It can also be used as a digital output for providing a status signal. In this case, the load could be a digital input of a PLC.
STO and STO feedback are activated when 1 or both safe input channels are de-energized.

Parameters for Safety Functions

Overview
Functional safety configuration is done in MyDrive® Insight, in Setup & Service > Functional safety > Safety configuration. Changing parameters related to functional safety requires logging in as an admin.
Parameters related to application software, for example, automatic/manual restart behavior after STO deactivation, are included in parameter group Functional Safety. Factory default values and other preset values are not valid for safety applications as such, and all parameter values must be checked to ensure that the configuration is suitable for the application. For more information on setting parameters, refer to application software documentation.
IMPORTANT: After initial startup and the modification of the configuration or functional safety parameters, a commissioning test must be performed to verify the functionality of individual safety functions. For more information, see

Commissioning Test for Safety Function STO and 7.5 Commissioning Test for Safety Function Safe Stop 1 Time-controlled (SS1-t).
The configuration of functional safety features must be done according to the safety system installation and wiring, and consists of the following steps:

1.  General parameter configuration
   2. Failure configuration
   3. System module pairing
   4. STO configuration
   5. SS1-t configuration
   6. Saving to device
   7. Verifying parameters
   8. Validating the configuration
   9. Generating a commissioning report

 General Functional Safety Parameters
Table 4: General Functional Safety Parameters

Parameter name(1)	Selections	Default value	Description
Stable Signal Time (A)	1–5000 ms	10	Delay until a signal change to Low is detected stable. This parameter specifies a de- lay in addition to the time specified for input signal inter- pretation in the drive.
Acknowledge input for IO fail- ures (B)	Not selected	Not selected	Specifies the safe digital input, which can be associated to the acknowledgment of the IO fail- ures.
	Safe Input (X33)

Parameter name(1)	Selections	Default value	Description
Triggering edge for IO failure acknowledge (C)	Rising edge	Rising edge	Specifies the edge for the ac- knowledgment of the IO fail- ures.
	Falling edge
Restart behavior for release of IO Failure (D)	Nonsafe Acknowledge re- quired	Nonsafe Acknowledge re- quired	Specifies the restart behavior for IO failure.
	Safe Acknowledge required
Acknowledge input for startup (E)	Not selected	Not selected	Specifies the safe digital in- put, which can be associated to the acknowledgment of the startup.
	Safe Input (X33)
Triggering edge for startup ac- knowledge (F)	Rising edge	Rising edge	Specifies the edge for the ac- knowledgment of the IO fail- ures.
	Falling edge
Manual startup acknowledge (G)	Direct restart	Direct restart	Specifies the restart behavior for startup acknowledge.
	Nonsafe Acknowledge re- quired
	Safe Acknowledge required

Parameters are identified with letters in the Safety configuration section in MyDrive® Insight. The letter is given in parentheses after the parameter name for each parameter in this table.

Failure Configuration
Table 5: Failure Configuration Parameters

Parameter name(1)	Selections	Default value	Description
IO Fault mapping (A)	STO	STO	Mapping of fault instance to IO.
	First instance of SS1

Parameters are identified with letters in the Safety configuration section in MyDrive® Insight. The letter is given in parentheses after the parameter name for each parameter in this
table.

Pairing Control Units and Power Units
Prerequisite: Control units and power units must be paired to make the system fully functional. Pairing the units establishes safe internal communication between the units. The pairing may need to be done before starting parameterization. By default, the pairing of the units for new drives is done at the factory.

NOTICE
A factory reset also resets the pairing.

After performing a factory reset, the control units and power units must be paired again to make the system fully functional. The pairing is done in MyDrive® Insight.

1. In MyDrive® Insight, navigate to Setup & Service > Functional safety > Safety configuration > System module pairing.
2. Select Pair all to pair a single unit or multiple units.
   The pairing view shows the control units and power units connected to a system module.

Safe Torque Off (STO)
The Safe Torque Off (STO) safety function allows the drive output to be disabled so that the drive cannot generate torque to the motor shaft.
STO corresponds to an uncontrolled stop in accordance with stop category 0 of IEC 60204-1. The events that can activate the STO function are:

• An external request.
• A violation of another safety function.
• A fault detected by the internal diagnostics.

NOTICE
The drive always initiates in a safe state, which is cleared automatically after the startup is completed.

• When parameter Restart behavior for release of STO is configured to require an acknowledgment, acknowledgment is required also when the device is powered up, and not only when a safety function has been disengaged.

Table 6: STO Parameters

Parameter name(1)	Selections	Default value	Description
Activation configuration (A)	De-energized (Function always on)	Safe Input (X33)	Specifies the safe digital input, which can be associated to the activation of the safety func- tion.
	Safe Input (X33)
	Energized (Function always off)
Restart behavior for release of STO (B)	Direct restart	Direct restart	Specifies the restart behavior for STO.
	Nonsafe Acknowledge re- quired
	Safe Acknowledge required
Digital input assignment for STO restart acknowledge (C)	Not selected	Not selected	Specifies the safe digital input, which can be associated to the STO restart acknowledgment.
	Safe Input (X33)
Triggering edge for STO restart acknowledge (D)	Rising edge	Rising edge	Specifies the change on the safe digital input, which is as- sociated to the STO restart ac- knowledgment.
	Falling edge

1. Parameters are identified with letters in the Safety configuration section in MyDrive® Insight. The letter is given in parentheses after the parameter name for each parameter in this table.

Safe Stop 1 Time-controlled (SS1-t)
Safe Stop 1 time-controlled (SS1-t) safety function triggers the deceleration to 0 speed in a controlled manner and activates the Safe
Torque Off (STO) safety function after a specified time.

The features of the safety function are:

• The safety function Safe Stop 1 corresponds to a category 1 stop (controlled braking) in accordance with EN IEC 60204-1.
• The motor becomes torque-free and removes hazardous movements.
• The SS1-t function operates with the time monitoring mode and activates the STO function when an application-specific time delay has passed.
• It is possible to configure 2 separate SS1 function instances with individual parameter sets.

NOTICE

• Remember to configure parameters 7.4.1 Safe Stop 1 Response and 7.4.3 Safe Deceleration Ramp in parameter group 7.4 SS1 SS2.
• With the default settings for parameters in group 7.4 SS1 SS2, STO is activated after the timer Maximum time is expired without any ramping down of the motor when activating the SS1 function.
• Parameters are identified with letters in the Safety configuration section in MyDrive® Insight. The letter is given in parentheses after the parameter name for each parameter in Table 7.

Table 7: SS1 Parameters

Parameter name	Selections	Default value	Description
SS1 Instance 1
Activation configuration (A)	De-energized (Function always on)	Energized (Function always on)	Specifies the safe digital input, which can be associated to the activation of the safety func- tion.
	Safe Input (X33)
	Energized (Function always off)
Maximum time (B)	2–3600000 ms	2 ms	The maximum time of the stop procedure.
Delay before monitoring (C)(1)	1–60000 ms	1 ms	The time to ignore the decel- eration after the activation of SS1.
Delay to detect limited state (D)(1)	1–60000 ms	1 ms	The time the speed has to be within the limits before acti- vating the final state (early ac- tivation).
Deceleration limit (E)(1)	1/500 Revolutions / (s*s)	0	The limit for the deceleration. a_SS1 = 0 means “No decelera- tion monitoring”.
Limit for the Speed (F)(1)	2^-16 Revolutions / s	1	The limit within the speed is accepted as 0.

Parameter name	Selections	Default value	Description
SS1 Instance 2
Activation configuration (A)	De-energized (Function always on)	Energized (Function always off)	Specifies the safe digital input, which can be associated to the activation of the safety func- tion.
	Safe Input (X33)
	Energized (Function always off)
Maximum time (B)	2–3600000 ms	2 ms	The maximum time of the stop procedure.
Delay before monitoring (C)(1)	1–60000 ms	1 ms	The time to ignore the decel- eration after the activation of SS1.
Delay to detect limited state (D)(1)	1–60000 ms	1 ms	The time the speed has to be within the limits before acti- vating the final state (early ac- tivation).
Deceleration limit (E)(1)	1/500 Revolutions / (s*s)	0	The limit for the deceleration. a_SS1 = 0 means “No decelera- tion monitoring”.
Limit for the Speed (F)(1)	2^-16 Revolutions / s	1	The limit within the speed is accepted as 0.

1. Parameters C–F cannot be configured for SS1-t.

CAUTION
The SS1 delay function does not monitor the stopping of the drive. The time relevant for safety allows the drive to stop before Safe Torque Off is activated, and ensures that the system is stopped before Safe Torque Off is activated.
If a fault occurs, the drive does not come to a stop. It coasts after the time delay regardless of the speed of the drive.
Using SS1 delay may result in the motor still spinning when Safe Torque Off is activated.

• The risk analysis for the machine must indicate that this behavior can be tolerated.
• An interlock may be required.

Saving to Device
After configuring the safety parameters for the application, save them to the device.

1. In MyDrive® Insight, navigate to Setup & Service > Functional safety > Safety configuration > Save to device.
2. Click Accept.
   Ü The parameters are verified and the status is updated from Ready to Verify.

Validating and Generating a Commissioning Report
For drives with functional safety option +BEF2, a commissioning report can be generated using MyDrive® Insight. The commissioning
report describes the values set for the safety-related parameters in the drive.

1. In MyDrive® Insight, go to Device > Setup & Service > Functional safety > Validate report.
2. Go to Device > Setup & Service > Functional safety > Commissioning Report to see the commissioning report.
   • After commissioning all safety functions, click the download icon on the upper right corner to download the report as
   • PDF file. It is recommended to save a copy of the commissioning report to an external location.
3. Store the acceptance test reports in the logbook of the machine.
   The report must include:
   • description of the safety application.
   •  A description and revisions of safety components that are used in the safety application.
     A list of all safety functions that are used in the safety application.
     A list of all safety-related parameters and their values. Listing parameters and values not related to safety is also recommended.
     Documentation of startup activities, with references to failure reports and resolution of the failures.
   • The test results for each safety function, all safety parameter values including the CRC value of the safety configuration, dates of the tests, and confirmation by the test personnel.
4. Validate the commissioning report.
   • Check that the hardware and configuration information is correct and that the software versions of safety-related components and subsystems are correct.
   • Check that the information of the commissioned module matches the information in the commissioning plan and commissioning report.
   • IMPORTANT: After each change or maintenance to the system, new acceptance test reports must be stored in the logbook of the machine.

Installation

Installation for System Modules with +BEF2
Prerequisite: For motor connection, AC mains connection, and control wiring, follow the instructions for safe installation in the documentation shipped with the drive.
All wiring related to functional safety must be done on terminal block X33. See Figure 5 for the location of the terminals.

Figure 5: Functional Safety Terminals in the Modular Control Unit
Table 8: Functional Safety I/O Terminal (X33) Functions in System Modules

Numbering	Terminal name	Function
41A(1)	24 V	+ 24 V DC Output
41B(1)	24 V	+ 24 V DC Output
42	S.INA+	+ Safe Input Channel A
43	S.INB+	+ Safe Input Channel B
44	S.FB+	+ STO Feedback
45A(1)	GND	0 V/GND
45B(1)	GND	0 V/GND
46	S.INA-

Numbering	Terminal name	Function
47	S.INB-	– Safe Input Channel B
48	S.FB-	– STO Feedback

Terminals 41A, 41B, 45A, and 45B have double pins to make connections easier.
Due to the galvanic isolation of the safe inputs, various connections and different polarities are possible in the wiring.
See Figure 6 and Figure 7 for connection examples.
Setups with the same voltage level on both channels (+24 V) are supported as well as setups with different voltage levels (+24 V and GND).

NOTICE
DANGEROUS VOLTAGE LEVEL

• To avoid stacking and drifting of voltages to a dangerous level, GND PELV of the drive and the external safety device must be interconnected.

A Safety actuator
Figure 6: STO Connection Example for System Modules with +BEF2 Using Same Polarity

Figure 7: STO Connection Example for System Modules with +BEF2 Using Different Polarities
A Safety actuator

Configuration Tools

Overview

• MyDrive® Insight is a platform-independent software tool for the commissioning, engineering, and monitoring drives. MyDrive® Insight is also used to configure the parameters of the drive.
• MyDrive® Insight is the only tool to set up the standard safety-related functions and features of iC7 drives. Advanced safety functions and safe fieldbuses require MyDrive® Insight.
• For detailed information on MyDrive® Insight features, see the online help in MyDrive® Insight.

 System Configuration Security
iC7 drives are equipped with mandatory and configurable security features that prevent unauthorized access to the drive, ensure secure connectivity to the drive, and protect the drive against unauthorized software modifications.
For more details on the security features included in the application software, refer to application software documentation.
Configurable security features can be adjusted according to application requirements. The parameters related to safety are password-protected.

Preparing for a PC Connection
Use these instructions to connect the drive or several drives to a PC with an RJ45 cable.

1. Connect an RJ45 cable to the PC.
   To connect several drives at the same time, use an Ethernet switch between the PC and the control unit.
   
   1. Ethernet switch
      Figure 8: Connecting the Drive to a PC
2. Connect the cable coming from the PC or from the Ethernet switch to the Ethernet port X0 on the control unit of the drive.
3.  See the Application Guide for information on the next steps.

MyDrive Insight

Installing MyDrive® Insight

1. To install the tool, go to https://suite.mydrive.danfoss.com/content/tools.
2.  Install MyDrive® Insight.
   For more information on how to use the tool, see the online help in MyDrive® Insight.
3.  Use MyDrive® Insight to connect the drive to a PC.

Backing up and Restoring Parameters
The parameter backup and restore functionality in MyDrive® Insight can be used to back up and restore all or part of the drive parameters.

1.  Log into MyDrive® Insight® as admin.
2. Go to Device > Setup & Service > Parameters > Live.
3.  Click Create backup/Restore on the menu bar.
   What to do next: For more information, see the MyDrive® Insight documentation.

 Performing a Factory Reset
The factory reset can be performed separately for each parameter group, or for all settings.

1. In MyDrive® Insight, go to Device > Setup & Service > Restore > Select Restore Content.
   • To reset all settings, select All Settings.
   • To reset only the functional safety settings, select Functional Safety Configuration Variables.
   • After performing a factory reset, all parameters are in a Not commissioned state and their values are restored to default values.
   • A factory reset also resets the user name and password to their defaults. Parameters must be configured again or alternatively, restored from a backup.

NOTICE

• After performing a factory reset, all parameters have to be checked and set again.
• Parameters for safety functions that are not used must also be checked. For example, parameters must also be checked for SS1 functions, even if only STO function is used and vice versa.

Updating Software

Prerequisite

NOTICE

• The drive must not be running during the update process.
• Updating software related to functional safety requires logging into MyDrive® Insight with the default admin account in the drive.
• Do not power down or restart the devices during a software update. Creating a backup of the current parameters before updating any software is highly recommended, in case parameters need to be restored after the software update is completed. For instructions, see

Backing up and Restoring Parameters.

1. Log into MyDrive® Insight as admin.
2. 2. In MyDrive® Insight, go to Device > Setup & Service > Software update.
3. To update software, select the file to be updated in the drive.
4. If relevant, select Allow devices to restart to allow the devices to restart after the update is finished. This selection is optional.
5. Check the installed version, available version, and status.
6. Click Update.
7. Check the alert message and click Yes/No.
8. Click Done to acknowledge and finish the update.
9. Verify that the software update has been successful.
   • Go to Device info > Extended device information and verify the firmware version.
   • Run the commissioning test.
     A commissioning test is required after each modification of the installation of an application that involves safety functions. For more information, see 7.2 Commissioning Test.
     What to do next: For more information, see the MyDrive® Insight documentation.

Troubleshooting the software update

1. Restart the device.
2. Check that the device is in normal state and there are no errors.
3. Check the software package version and compatibility, and retry the software update.
   If the problem persists and the device stays in error mode, contact Danfoss.

Commissioning

Commissioning Safety
When commissioning or recommissioning the system, observe the following:

• Secure the site in accordance with regulations, for example barriers or warning signs. Only qualified personnel can commission or recommission the system.
• Check the documentation of the machine control system for detailed information and specifications.
• Make sure that no personal injury or material damage can occur during the commissioning or recommissioning, even it the plant or machine moves unintentionally.
• Before starting the commissioning, read all safety guidelines and precautions in the drive-specific documentation.
• Observe applicable laws and legislation when running a system without safety or with reduced safety.
• Be aware that the commissioning report focuses on iC7 functional safety and is not necessarily sufficient for the testing and  documenting of all safety functions in the system or machine.

Commissioning Test
The commissioning test for systems with safety functions is focused on validating the functionality of safety functions configured in the drive system. The test objective is to verify proper configuration of the defined safety functions and to examine the response of specific monitoring functions to the explicit inputs of values outside  tolerance limits. The tests must cover all drive-specific safety functions running in the final setup.

A commissioning test is required:

• After the configuration of each machine
• After any changes to the drive safety configuration
• After changes to the machine (as per applicable standards and regulations)
• After the exchange of the complete drive, or any safety-related hardware or software.
• During and after the commissioning:
• Document each individual step of the test.
• Note the checksum of the drive safety configuration in records.
• Do not release the system unless the system has successfully passed all individual steps of the test.
• Restart the drive and check that the motor runs normally.

NOTICE
COMMISSIONING TEST
After installing the safety functions, perform a commissioning test.
A successful commissioning test is required after the initial installation, and after each change to the installation or application involving functional safety.
If the commissioning test fails, safe operation cannot be guaranteed.

Commissioning Checklist
The system integrator/machine manufacturer must perform a commissioning test of the iC7 safety functions to verify and document the correctness of the safety configuration. The system integrator/machine manufacturer hereby proves to have tested the effectiveness and the completeness of the safety functions used. The commissioning tests must be performed based on the risk analysis. All applicable standards and regulations must be adhered to.

Before the commissioning test

• Check that the machine is properly wired.
• All safety equipment, such as protective door monitoring devices, light barriers, or emergency stop switches are connected and ready for operation.
• All motor parameters and command parameters are correctly set on the drive.

Table 9: Commissioning Checklist for System Modules

Check type	Task	Approved
Mechanical installation	Check that the units have been installed according to the documentation included in the shipment.	☐
	Check that the operating conditions are within the allowed range.	☐
	Check that the packaging materials and tools have been removed from the installation area.	☐
Electrical installation	Check that the appropriate supply (input power) fuses are installed.	☐
	24 V DC power supply is properly connected and secured with strain relief, and the polarity of the supply voltage connection is correct.	☐
	I/O wiring is appropriately clamped, marked, tightened, and protected.	☐
Functional safety commissioning	Check that the system is in an operational state when the safety function is required.	☐
	Make sure that the acknowledgment method has been configured appro- priately for the application (for example, manual or automatic acknowledg- ment).	☐
	Activate the safety function by requesting it.	☐
	Verify that the system functions as desired.	☐

Commissioning Test for Safety Function STO
Table 10: Commissioning Test for STO

Test procedure		Approved
1	Power on the INU.	☐
2	Make sure that the other STO function parameters are configured correctly.	☐
3	Check that no safety faults are present.	☐
4	Make sure that the motor runs and stops freely.	☐
5	Remove the 24 V DC voltage supply to STO input terminals using the safety device while the system mod- ule drives the motor (that is, the mains supply is not interrupted).	☐
6	Make sure that the drive STO is activated immediately after the STO request.	☐
7	If STO feedback is used, check the state of the STO feedback to verify that STO is activated. See Figure 4.	☐
8	Verify that the motor coasts. It may take a long time for the motor to stop.	☐

Test procedure		Approved
9	If a control panel is mounted, check if STO activated is shown on the control panel.	☐
	If the control panel is not mounted, check if STO activated is listed in the event log.
10	Reapply 24 V DC to STO inputs.	☐
11	If the fault is configured to direct restart: By deactivating the fault, the motor becomes operational and runs within the original speed range. If automatic acknowledgment is not used: Set an acknowledgment (for example, with an acknowledg- ment button). The acknowledgment is configured in the safety parameters.	☐
12	Check that there are no unwanted errors in the drive.	☐
13	Ensure that the motor becomes operational and runs within the original speed range.	☐

 Commissioning Test for Safety Function Safe Stop 1 Time-controlled (SS1-t)
Table 11: Commissioning Test for STO Applications using Safe Stop 1 Time-controlled (SS1-t)

Test procedure		Approved
1	Power on the INU.	☐
2	Make sure that the SS1-t function parameters are configured correctly.	☐
3	Check that no safety faults are present.
4	Make sure that the motor runs and stops freely.	☐
5	Request the SS1-t function by de-energizing the inputs assigned to it.	☐
6	Verify that the motor ramps down according to the configured maximum time. The configured time is also shown in the commissioning report.	☐
7	If a control panel is mounted, check if STO activated is shown on the control panel.	☐
	If the control panel is not mounted, check if STO activated is listed in the event log.
8	If STO feedback is used, check the state of the STO feedback to verify that STO is activated. See Figure 4.	☐
9	Energize the inputs that are assigned to the STO function, or deactivate the STO request via fieldbus.	☐
10	If the fault is configured to direct restart: By deactivating the fault the motor becomes operational and runs within the original speed range. If automatic acknowledgment is not used: Set an acknowledgment (for example, with an acknowledg- ment button). The acknowledgment is configured in safety parameters.	☐
11	Ensure that the motor becomes operational and runs within the original speed range.	☐

Validating and Generating a Commissioning Report
For drives with functional safety option +BEF2, a commissioning report can be generated using MyDrive® Insight. The commissioning report describes the values set for the safety-related parameters in the drive.

1. In MyDrive® Insight, go to Device > Setup & Service > Functional safety > Validate report.
2. Go to Device > Setup & Service > Functional safety > Commissioning Report to see the commissioning report.
   • After commissioning all safety functions, click the download icon on the upper right corner to download the report as a PDF file. It is recommended to save a copy of the commissioning report to an external location.
3. Store the acceptance test reports in the logbook of the machine.
   The report must include:
   • A description of the safety application.
   • A description and revisions of safety components that are used in the safety application.
   • A list of all safety functions that are used in the safety application.
   • A list of all safety-related parameters and their values. Listing parameters and values not related to safety is also recommended.
   • Documentation of startup activities, with references to failure reports and resolution of the failures.
   • The test results for each safety function, all safety parameter values including the CRC value of the safety configuration, dates of the tests, and confirmation by the test personnel.
4. Validate the commissioning report.
   • Check that the hardware and configuration information is correct and that the software versions of safety-related components and subsystems are correct.
   • Check that the information of the commissioned module matches the information in the commissioning plan and commissioning report.
   • IMPORTANT: After each change or maintenance to the system, new acceptance test reports must be stored in the logbook of the machine.

Operation and Maintenance

Overview of Functional Tests
Safety functions in the drive do not require scheduled functional tests or proof testing. Refer to application-specific standards and requirements for scheduled functional and proof testing. Drive safety system mission time is 20 years. After 20 years, the whole unit must be replaced.

WARNING
COMPONENT FAILURE IN FUNCTIONS RELATED TO SAFETY

• If a component failure occurs in functions related to safety, the drive must be replaced by authorized personnel.
• It is not allowed to modify or repair the safety circuitry in any way.

 Diagnostics

• The iC7 drives include many diagnostic functions to ensure the integrity of safety functions. Diagnostics are, for example, temperature monitoring, internal voltage monitoring, and safety function monitoring. The drive issues functional safety-related fault codes if any are present. For safety-related fault codes, see 9.4 Event List.
• The Diagnostic Test Interval (DTI) depends on the safety function and the diagnostic function. The maximum DTI and Fault Reaction Time (FRT) for each safety function are listed in 10.1 Functional Safety Standards and Performance.
• If functional safety-related diagnostics detects a failure, the relevant safety functions are always set to a safe state.
  Multiple undetected hardware failures may lead to a mode where an external STO request does not lead to the de-energizing of the motor. The PFH/PFD and MTTF values stated in 10.1 Functional Safety Standards and Performance reflect the probability of this fault. Any other STO-related, internal failures lead directly to an unrequested activation of the STO function, or affect only 1 of the 2 redundant STO channels.

Installation and Maintenance in High Altitudes

• If the drive is used in high altitudes, additional measures must be taken to ensure the integrity of the safety system. Since the safety system includes controllers which are affected by cosmic radiation, it must be taken into account that the cosmic ray flux is higher in high altitudes. The higher the flux of cosmic rays is, the higher is the risk of Soft Error Rate (SER) affected to the controllers.
• To mitigate this issue, the safety system controller software must be updated at certain intervals depending on the altitude of the installation. The software update rewrites the Read Only Memory (ROM) of the safety system and also forces the Random Access Memory (RAM) to be reinitialized. This process resets any undetected failures in the memory which might be caused by cosmic rays.
• Because SER affects the PFD and PFH values of the drive, the performance of the safety system is affected by high altitude. PFD and PFH values are given for different altitudes and the given values assume that the safety system software is updated according to Table 12.

Table 12: PFD and PFH Values, Altitude, and Safety Software Update Interval 

Altitude	Safety software update interval	Average probability of dangerous failures on demand (PFDavg)	Average frequency of dangerous failures per hour (1/h) (PFH)
Sea level	No need for maintenance up- dates for altitude reasons	1.8*10–4	3.5*10–9
1000 m (3300 ft)	5 years	1.8*10–4	3.5*10–9
2000 m (6600 ft)	4 years	1.8*10–4	3.8*10–9

Altitude	Safety software update interval	Average probability of dangerous failures on demand (PFDavg)	Average frequency of dangerous failures per hour (1/h) (PFH)
3000 m (9800 ft)	3 years	1.9*10–4	5.5*10–9
4000 m (13100 ft)	2 years	2.1*10–4	8.5*10–9

The values given in Table 12 assume that all maintenance procedures are followed accordingly.

 Drive Replacement
If an internal fault leads to a permanent defect, the drive must be replaced. The safety system modules are not repairable.
After the faulty drive has been replaced, it must be commissioned. Refer to the product-specific guides for details and instructions for commissioning the drive, and also follow the procedures described in chapter Commissioning.

Troubleshooting

 Status LEDs

Table 13: Status LEDs

LED	Color	Status	Meaning
Ready	White	Off	Check if: The drive is powered off.         The drive is not ready.
		Blinking	The drive is starting up.
		Steady	There are no active faults, and the drive is ready to operate.
Warning	Orange	Off	There is no warning.
		Steady	The drive is not ready to run. Check if: Safety configuration is needed. STO active or STO acknowledge is needed. IO Failure or IO Failure acknowledge needed. STO response is configured as fault (with application).
Fault	Red	Off	There are no active faults and the drive is ready to operate.
		Steady	The drive is in a faulty state. The fault condition may have been triggered due to 1 of the following reasons: Power unit and control connection failure Hardware or software errors in the drive

 Instances of the STO Function and STO Feedback Output

Table 14: Instances of STO Feedback for Systems with Modular Control

State	Feedback state(1)	Additional information
Standard function	De-energized	The motor is running and no safety function is active. STO feedback is de-energized.
STO state is reached	Energized	STO is requested, and a safe state is reached. STO state is reached and connection to all power units is established. STO output is de-energized.
Configuration needed	De-energized	Safe inputs must have a validated configuration to ensure that all power units have reached a safe input state. The connected power units are a part of the con- figuration, and without a validated configuration, the safe input cannot assume to have a connection to all power units established.
Software update	De-energized	During software update, the state of the safe output is not reliable. STO output is de-energized.

State	Feedback state(1)	Additional information
Bootloader and startup	De-energized	The bootloader does not communicate and does not know the state of the STO output on the power units. At startup, the communication is not yet established and the safe input card does not know the state of the safe output on the power units.
Internal failure	De-energized	Indicates a severe issue, for example in the STO cir- cuitry. It cannot be assumed that the Safety IO knows that all STO outputs are de-energized.
Internal fatal failure	De-energized	Triggered when a fatal internal issue has occurred, for example, a CPU or RAM fault. The operation cannot be guaranteed, and it cannot be assumed that the safe outputs can be de-energized.

Energized: STO_FB+ ⇨ STO_FB- circuit closed = current flow = logical “0” with low side driver configuration. De-energized: STO_FB+ ⇨ STO_FB- circuit open = no current flow = logical “1” with low side driver configuration.

Safety Function Fault Recovery
A fault in a safety circuit can lead to safe state or fail-safe state activation. STO activation is determined by the event list in MyDrive®  Insight and on the control panel.
With a fail-safe state, STO is activated, and a relevant fault code is shown. Reset the fault before performing normal operation.

1. Check the reason for the event in the MyDrive® Insight event log.
2. Refer to 9.4 Event List for instructions on how to repair the cause of the fault.
3. Reset the fault.

• If the fault is configured to direct restart: By deactivating the Emergency Stop button, the motor becomes operational and runs within the original speed range.
• If the drive stays in a non-operating state after removing the fault, check the event log in MyDrive® Insight.
• If safe or non-safe acknowledgment is required, perform the acknowledgment via a configured channel by sending an acknowledgment signal via fieldbus, digital I/O, or the control panel.
  The acknowledgment is configured in safety parameters.
  If a failure in the safety system or a safety function prevents fault recovery, contact a local Danfoss representative. Provide the commissioning report of the safety parameter configuration. For more information, see the MyDrive® Insight documentation.

Event List
Table 15: Group 0x54FE

Number	Name	Cause	Solution
4628	STO activated.	Safe Torque Off has been activated.	If STO is activated unintentionally, check the following: input cabling external activation external test pulse timing relevant safety parameters

Table 16: Group 0x61FF

Number	Name	Cause	Solution
4608	Internal failure	An internal failure was detected in the safety system.	Restart the system. If the problem persists, contact Danfoss customer support.
4609	IO failure detected	An IO Failure was detected in the safety system. See event details for more infor- mation.	Check the safety IO circuit connections. If an external test pulse is used, ensure that the timing is within specification. See 3.3.5 STO Properties.
4611	SS1	Safe Stop 1, instance 1 has been activated.	If SS1 is activated unintentionally, check the following: input cabling external activation external test pulse timing relevant safety parameters
4612	SS1	Safe Stop 1, instance 2 has been activated.	If SS1 is activated unintentionally, check the following: input cabling external activation external test pulse timing relevant safety parameters
4613	Warning detected	Detected a non-critical failure. The opera- tion can continue.	Check event logs and messages in the user interface for additional information.
4614	Startup acknowledgment needed	Startup acknowledgment is needed.	Depending on the configuration, the ac- knowledgment can be given via: Safe input MyDrive® Insight Fieldbus interface Control panel
4615	Configuration mismatch	The detected safety system differs from the commissioned system.	The detected safety system differs from the commissioned system. If a power unit is replaced, recommission the system.

Number	Name	Cause	Solution
4616	No valid safety parameters available	The safety parameters are invalid or not present in the device.	Check the safety configuration in My- Drive® Insight. Make sure that all configu- ration steps are successfully verified and validated. Recommissioning of the safe module is re- quired.
4633	Software update on safety module	Advanced safety unit is in a software up- date state.	The device stays in a safe state until the software update is successfully finished.
4634	Factory reset	Factory reset action triggered by the user.	After the factory reset has been per- formed, the safety configuration must be recreated.
4635	Safety configuration changed	Safety parametrization action triggered by the user.	The safety configuration has been changed. Ensure that the configuration is correct before continuing. Major safety configuration changes may require a system restart.
4636	IO failure acknowledgment needed	Due to the configuration, IO acknowledge is needed.	If enabled, the safety function may require an acknowledgment to continue opera- tion after a signal failure has been cleared.
4637	STO acknowledgment needed	Due to the configuration, STO acknowl- edge is needed.	If enabled, the safety function may re- quire an acknowledgment to continue operation after a STO condition has been cleared.
4650	Parameter dependency checks failed	Check of the safety parameters failed.	Ensure that the safety configuration is valid. The possible errors may be related to: input signal mapping output signal mapping timing parameters
4651	Parameter range check	The value of a parameter is out of the al- lowed range. The variable ID is provided as detail.	Make sure that the value of the given vari- able is set in the allowed range.

Number	Name	Cause	Solution
4652	Parameterization step failed	An attempt to change safety parameters failed.	Check if there is any detailed information in MyDrive® Insight. Make sure that the requested safety para- meter change is valid. Check that the drive system does not have any unrelated special conditions, such as software update or drive commissioning, active. Try restarting the drive system. If the problem persists, contact Danfoss customer support.
4730	Information	Additional information from the advanced safety unit. See details.	The safety module has raised an indica- tion that needs to be informed to the user. Further details can be found via the My- Drive® Insight event details.

Specifications

 Functional Safety Standards and Performance
All safety functions in the iC7 system modules meet the requirements of the standards listed in this chapter.
Table 17: Functional Safety Standards and Performance

Directive or Standard		Version
European Union directives	Machinery Directive (2006/42/EC)	EN ISO 13849-1:2015, EN ISO 13849-2:2012
		EN IEC 61800-5-2:2007
	EMC Directive (2014/30/EU)	EN IEC 61800-3:2018 – second environ- ment
		EN IEC 61326-3-1:2017
	Low Voltage Directive (2014/35/EU)	EN IEC 61800-5-1:2017
Safety standards	Safety of Machinery	EN ISO 13849-1:2015, IEC 60204-1:2018
	Functional Safety	IEC 61508-1:2010, IEC 61508-2:2010, EN IEC 61800-5-2:2017
Safety function		EN IEC 61800-5-2:2017 Safe Torque Off (STO)
		IEC 60204-1:2018 Stop Category 0
Safety performance	IEC 61508:2010
	Safety Integrity Level	SIL 3
	Hardware Fault Tolerance (HFT)	1
	Subsystem Classification	Type B
	Average probability of dangerous failures on demand (PFDavg)(1)(2)	< 2.5*10-4
	Average frequency of dangerous failures per hour (1/h) (PFH)(1)(2)	< 2.5*10-8
	Proof Test Interval (T1)	20 years
	Mission Time (TM)	20 years
	ISO 13849-1:2015
	Category	Cat 3
	Performance Level (PL)	PLe
	Mean time to dangerous failure (MTTFd)	≥ 100 years
	Diagnostic Coverage (DCavg)	>90%
Reaction time	Fault Reaction Time (FRT)	< 200 ms
Response time	Response time (from input to safe state)	< 100 ms

1. At sea level
2. Proof tests can only be performed at Danfoss facilities when drive is refurbished.

Technical Data
Table 18: 24 V Digital Input for Safe Input for System Modules (+BEF2)

Function	Data
Input type	Single-ended/floating
Logic	Active Low: STO function is activated due to: An external request A violation of another safety function A fault detected by the internal diagnostics Active High: STO function is inactive.
Voltage level	0–24 V DC
Voltage level, logic 0 PNP	<5 V
Voltage level, logic 1 PNP	>11 V
Maximum voltage on input @ functional	30 V
Maximum voltage on input @ safe state	60 V
Input current	8 mA > Ic > 2 mA @ 24 V
Equivalent input resistance	3 kΩ < Ri < 12 kΩ @ 24 V
Isolation	Functional
Reverse polarity protection	Yes
Maximum input current off-state	< 2 mA

Table 19: 24 V Digital Outputs for STO Feedback

Function	Data
Output type	Sink/source
Voltage rating	24 V DC open collector/60 V maximum
Current rating	50 mA
Isolation	Yes
Overload protection	Yes
Reverse polarity protection	Yes

Function	Data
ON state voltage	>17.4 V
Off state leakage current	0.1 mA

Table 20: Auxiliary Voltages

Function		Data
24 V output, functional safety (X33)	Output voltage	24 V ±15%
	Maximum load	100 mA

Operating Conditions
Table 21: Operating Conditions for Functional Safety

Function	Data
Operating temperature	According to the AC drive specifications.
Storage temperature	-40 °C…+80 °C (-40 °F…+176 °F)
Air humidity	According to the AC drive specifications (non-condensing).
Operating altitude	According to the AC drive specifications.
Environmental conditions	The product must be installed in an environment corresponding to EN IEC 61800-5-1:2017 PD2 – non-condensing. For PD2 condensing environments, the product must be installed in IP54/NEMA 12 cabi- net as per EN IEC 60529 AMD 2:2013 , or similar.

 Cable Specifications
Table 22: Cable Sizing for Connectors X31, X32

Wire type	Cross-section [mm2 (AWG)]	Stripping length [mm (in)]
Solid	0.5–1.5 (24–16)	10 (0.4)
Flexible	0.5–1.5 (24–16)	10 (0.4)
Flexible with ferrule w/o plastic sleeve	0.5–1.5 (24–16)	10 (0.4)
Flexible with ferrule w plastic sleeve	0.5 (24)	10 (0.4)

Danfoss Drives Oy Runsorintie 7 FIN-65380 Vaasa drives.danfoss.com

Any information, including, but not limited to information on selection of product, its application or use, product design, weight, dimensions, capacity or any other technical data in product manuals, catalog descriptions, advertisements, etc. and whether made available in writing, orally, electronically, online or via download, shall be considered informative, and is only binding if and to the extent, explicit reference is made in a quotation or order confirmation. Danfoss cannot accept any responsibility for possible errors in catalogs, brochures, videos and other material. Danfoss reserves the right to alter its products without notice. This also applies to products ordered but not delivered provided that such alterations can be made without changes to form, fit or function of the product. All trademarks in this material are property of Danfoss A/S or Danfoss group companies. Danfoss and the Danfoss logo are trademarks of Danfoss A/S. All rights reserved.

Documents / Resources

Danfoss iC7 Series Air Cooled and Liquid Cooled System Modules [pdf] User Guide iC7 Series Air Cooled and Liquid Cooled System Modules, iC7 Series, Air Cooled and Liquid Cooled System Modules, Liquid Cooled System Modules, Cooled System Modules, System Modules

References

• User Manual