Skip to main content

Safety architecture (WD-001)

Circuit​

  • -K1 — dual-channel monitored safety relay in the cabinet: Schneider XPSUAF13AP (Harmony Preventa XPSU, PL e / Cat 4, SIL 3, 24 V AC/DC). Replaces the discontinued XPSAF5130 (Schneider FAQ000192032).
  • E-stop chain: -S1 (cabinet) + -S2 (operator station), dual N/C, in series on both channels. Reset -S3 (N/O momentary). Add a cockpit E-stop if man-rated.
  • Safe outputs ch1 / ch2 distributed to all three AX5801 cards:
    • -A1 (pitch): direct in cabinet (W501)
    • -A2 (yaw): W502 → DS1 → W503 → DS2 → W504
    • -A3 (roll): via -XB1 → W505 → DS3 → W506
  • EDM feedback: series loop through all three AX5801 feedback contacts back to -K1.
  • All W5xx cables: yellow marker sleeves.

Why AX5801 STO instead of an upstream contactor​

  1. Standard AX5000 has no certified safety input; a software stop is not a safety function under IEC 60204-1 / ISO 13849.
  2. AX5801 is certified STO per IEC 61800-5-2 with PFH/PL figures usable in the ISO 13849 calculation.
  3. Contactor-only = Category 0 stop → the gimbal coasts with stored rotational energy. STO enables Category 1 (controlled deceleration, then torque removal).
  4. A contactor upstream of the slip rings would kill rotating-side 24 V → drives go dark, no diagnostics during the event that matters most.
  5. Repeated hard power-cycling stresses DC-link precharge and slip ring contacts.
  6. STO is two low-power 24 V conductors — fits the existing capsule slip rings with per-axis granularity.

Man-rated caveat​

danger

If a person rides inside, the full safety concept (stop categories, brake redundancy, slip-ring failure modes, single-fault tolerance) requires formal ISO 13849-2 / IEC 62061 assessment and sign-off by a qualified functional-safety engineer. Recommended architecture then = Option C: STO + independent upstream contactor (-K2 drop-out). Holding brakes must engage on power or slip-ring loss.