STO (Safe Torque Off)

Safe Torque Off description for drive option Functional Safety 1.

STO is suited for SIL 2 according to IEC 62061 and PLd / Cat.3 according to ISO 13849-1. STO is a type A subsystem according to IEC 61508.

STO turns off the drive output stage that powers the motor. STO function corresponds to an uncontrolled stop according to IEC 60204-1, category 0.

Important Notes

The safety properties given in this documentation refers to the device AKD2G with functional safety option 1. The user has to determine the safety properties of the safety chain.

Vertical load could fall!

Serious injury could result when a suspended load is not properly blocked. The drive cannot hold a vertical load when STO is active.

Add a safe mechanical blocking (for instance, a motor-holding brake).

Activation

The digital STO inputs (channel A and B) must be connected to the output of a safety device, which at least meets the requirements of PLd, Cat. 3 according to ISO 13849. Technical data of the safe inputs (see "Technical Data").

If one of the STO inputs goes open-circuit or 0 V, then power supply to the motor stops within 3.5 ms. The motor will lose all torque and coast to a stop.

If the drive detects that the two STO inputs are in a different state for longer than 100 ms, then a simultaneity fault F9005 occurs (see "Fault Reaction / Failure Messages").

Review the enclosure and wiring instructions (see "Enclosure, wiring").

Wiring example STO single axis, SIL2/PLd, Emergency Stop

Note: AXIS#.SAFE.STO.REPORTFAULT should be set to 1 if STO is activated by a switch.

Wiring example STO dual axis, SIL2/PLd, Safety Control

Restart

Example for Axis 1.

	AXIS1.SAFE.STO. REPORTFAULT = 1	AXIS1.SAFE.STO. REPORTFAULT = 0
Example 1: Axis 1 was disabled, STO is activated	Message W9000 Restart: deactivate STO enable axis 1	Restart: deactivate STO enable axis 1
Example 2: Axis 1 was enabled, STO is activated	Messages W9000 and F9000 Restart: disable axis 1 deactivate STO clear fault enable axis 1	Restart: deactivate STO
Example 3: Axis 1 was disabled, STO is activated faulty	Message F9005 Restart: check wiring remedy the cause deactivate STO clear fault enable axis 1	Message F9005 Restart: check wiring remedy the cause deactivate STO clear fault enable axis 1

AXIS1.SAFE.STO.
REPORTFAULT = 1

AXIS1.SAFE.STO.
REPORTFAULT = 0

Example 1:
Axis 1 was disabled, STO is activated

Message W9000

Restart:

deactivate STO
enable axis 1

Restart:

deactivate STO
enable axis 1

Example 2:
Axis 1 was enabled, STO is activated

Messages W9000 and F9000

Restart:

disable axis 1
deactivate STO
clear fault
enable axis 1

Restart:

deactivate STO

Example 3:
Axis 1 was disabled, STO is activated faulty

Message F9005

Restart:

check wiring
remedy the cause
deactivate STO
clear fault
enable axis 1

Message F9005

Restart:

check wiring
remedy the cause
deactivate STO
clear fault
enable axis 1

Timing

Example for axis 1.

Timing	max	Remarks
t1		STO channel A enabled (0 V)
t1 to t2	2 ms	STO enable delay (response time)
t2		STO active
t3		STO channel B enabled (0 V)
t1 to t3	100 ms	accepted delay between dual channel edges
t4		STO channel B disabled (+24 V)
t5		STO channel A disabled (+24 V)
t4 to t5	100 ms	accepted delay between dual channel edges
t5 to t6	2 ms	STO release delay
t6		STO release
t6 to t7		Zero if AXIS#.SAFE.STO.REPORTFAULT=0 Until 'no fault' if AXIS#.SAFE.STO.REPORTFAULT=1
t7		Power section released.

Safety Diagnostic view in WorkBench

The WorkBench view "Safety Diagnostic" shows the current status on the safe inputs (AXIS#.SAFE.STO.A / AXIS#.SAFE.STO.B) and the logical status of the STO function for every axis.

Fault Reaction / Failure Messages

With the dual-channel control of the STO (SIL2/PLd Cat.3) safety function, the switch-off paths STO-A-A# and STO-B-A# are switched separately by two outputs of a safety controller.

W9000 and F9000 are conditioned by the value of AXIS#.SAFE.STO.REPORTFAULT.

AXIS#.SAFE.STO.REPORTFAULT set to 1 (default)

STO-A-A#	STO-B-A#	ENABLE	Drive Message	Motor Torque	Safe State
0 V	0 V	0 V	W9000	No	Yes
0 V	0 V	+24 V	F9000	No	Yes
+24 V	+24 V	0 V	-	No	No
+24 V	+24 V	+24 V	-	Yes	No
+24 V	0 V	0 V	F9005*	No	Yes
+24 V	0 V	+24 V	F9005*	No	Yes
0 V	+24 V	0 V	F9005*	No	Yes
0 V	+24 V	+24 V	F9005*	No	Yes

* different status of STO-A/B for more than 100 ms
A#: A1 for axis 1 or A2 for axis 2.

AXIS#.SAFE.STO.REPORTFAULT set to 0

STO-A-A#	STO-B-A#	ENABLE	Drive Message	Motor Torque	Safe State
0 V	0 V	0 V	W9000	No	Yes
0 V	0 V	+24 V	W9000	No	Yes
+24 V	+24 V	0 V	-	No	No
+24 V	+24 V	+24 V	-	Yes	No
+24 V	0 V	0 V	F9005*	No	Yes
+24 V	0 V	+24 V	F9005*	No	Yes
0 V	+24 V	0 V	F9005*	No	Yes
0 V	+24 V	+24 V	F9005*	No	Yes

* different status of STO-A/B for more than 100 ms
A#: A1 for axis 1 or A2 for axis 2.