STO (Safe Torque Off)

This topic describes the Safe Torque Off drive option for Functional Safety 2 or 3.

Description

STO turns off the drive output stage that powers the motor. STO function corresponds to an uncontrolled stop according to IEC 60204-1, stop category 0.

Important Notes

No Brake Power! Serious injury could result when a suspended load is not properly blocked. The drive cannot hold a vertical load when STO is active. Add a safe mechanical blocking (for instance, a motor holding brake). Configure Safe Brake Control SBC (➜ # 1, SBC (Safe Brake Control)).

It is not possible to perform a controlled stop according to IEC 60204-1 category 1, if STO function is active as standalone function. If controlled stop category 1 is necessary, you should use the SS1-t function (➜ # 1, SS1-t (Safe Stop 1)) respectively SS1-r function (➜ # 1, SS1-r (Safe Stop 1)).

Function Input/Output Variables

Inputs

• STO Activate can be activated by:

  • FSoE
  • SS1
  • a fault reaction
  • safe digital inputs (must be mapped)

• STO Restart Acknowledge is used for manual restart. The signal can be activated by:

  • FSoE
  • safe digital inputs (must be mapped)

Outputs

• STO Active is the logical status of the STO function.
• STO Restart Request is used for manual restart. The signal can be evaluated by using FSoE or safe digital outputs (must be mapped).

Number of instances

One instance per axis.

Activation

Activation by FSoE	For a drive profile overview, see FSoE (➜ # 1, FSoE). For setup and handling, see the AKD2G EtherCAT Manual.
Activation by safe digital inputs	To review the enclosure and wiring instructions, see Enclosure, wiring (➜ # 1, Enclosure, wiring). To see technical data for the safe inputs, see Technical Data (➜ # 1, Technical Data). For notes on activation by safe inputs, see Activation by Safety Digital Inputs (➜ # 1, Activation By Safe Digital Inputs).

Activation with configurable time after SS1

Refer to SS1-t function (➜ # 1, SS1-t (Safe Stop 1)) SS1-r function (➜ # 1, SS1-r (Safe Stop 1)).

Restart

Restart can be set to either Automatic or Manual (STO Restart Mode, AXIS#.SAFEPARAM.STO.RESTARTACKMODE (➜ # 1, AXIS#.SAFEPARAM.STO​.RESTARTACKMODE)).

Automatic Restart	A restart request signal will be sent to the safety control, when STO is required. With STO restart acknowledge, STO will be deactivated and the axis can be enabled for restart.
Manual Restart	The axis restarts when STO is deactivated and the axis is enabled.

Timing

Timing for activation by SS1-t: Refer to SS1-t function (➜ # 1, SS1-t (Safe Stop 1)) SS1-t/r function (➜ # 1, SS1-r (Safe Stop 1)).

Timing for activation by FSoE: Refer to the AKD2G EtherCAT Manual.

Related Parameters

Safety Parameters

Name	Variables	Default	Parameter
Function Activation	-	1 (Ready for activation)	(➜ # 1, AXIS#.SAFEPARAM.STO​.FUNCTIONACTIVATION)
Safe Input	-	Axis 1 – 5 (Safe Dual 1) Axis 2 – 6 (Safe Dual 2)	(➜ # 1, AXIS#.SAFEPARAM.STO​.SAFEINPUT)
FSoE	-	0 (Not used)	(➜ # 1, AXIS#.SAFEPARAM.STO.FSOE)

Diagnostic Parameters

Name	Variables	Default	Parameter
Function Actual Active Status	-	-	(➜ # 1, AXIS#.SAFE.STO.ACTIVE)
Reportfault	-	-	(➜ # 1, AXIS#.SAFE.STO.REPORTFAULT)

When using manual restart, map the Restart Request Source to a safe output, see (➜ # 1, Parameters Editor).

State diagram

STO is active when its internal state is in the "Active" composite state "STO (2)" or "Acknowledge Pending (3)".

Setup in WorkBench

Select the drive and open the Safety Parameterization view (➜ # 1, Parameters Editor).

Choose the axis. Select the Category. Select the STO function. The instance number is not applicable for STO.

Note: If you want to have one dual input (e.g. SIN1/SIN2) activate STO for both axis 1 and axis 2, then you must set the activation parameter for both axes to the same input.

Fault Reaction/ Failure Messages

If dual channel mode is selected, the AKD2G observes to see if the two inputs are in a different state for longer than 100 ms. If the two inputs are in different states for more than 100 ms, an I/O failure activates SS1_1 and then the axis torque is switched off by STO.

An I/O failure warning is issued when the AKD2G is disabled or a fault when the AKD2G is enabled and AXIS#.SAFE.STO.REPORTFAULT (➜ # 1, AXIS#.SAFE.STO.REPORTFAULT) is set to 1.

Safety Diagnostic for the Safe I/O view in WorkBench

The WorkBench Safe I/O view shows the current status on the safe inputs and the logical status of the STO function for every axis.

Safety Properties

Refer to (➜ # 1, Safety Properties Overview).