6 Safe Torque Off (STO)
The Safe Torque Off (STO) function is a component in a
safety control system. STO prevents the unit from
generating the energy that is required to rotate the motor,
thus ensuring safety in emergency situations.
The STO function is designed and approved suitable for
the requirements of:
•
IEC/EN 61508: 2010 SIL2
•
IEC/EN 61800-5-2: 2007 SIL2
•
IEC/EN 62061: 2012 SILCL of SIL2
•
EN ISO 13849-1: 2008 Category 3 PL d
To achieve the required level of operational safety, select
and apply the components in the safety control system
appropriately. Before using STO, carry out a thorough risk
analysis on the installation to determine whether the STO
function and safety levels are appropriate and sufficient.
The STO function in the frequency converter is controlled
via control terminals 37 and 38. When STO is activated, the
power supply on the high side and low side of the IGBT
gate driving circuits is cut off.
shows the STO
architecture.
shows STO statuses based on
whether terminals 37 and 38 are energized.
24 V
17 V
IGBT
+UDC
X3
IGBT
PELV
X3
X3
24 V
voltage
source
high-side
gate driving
circuit
diagnostic
circuit
low-side
gate driving
circuit
12
38
37
55
130BE463.12
Illustration 6.1 STO Architecture
Terminal 37
Terminal 38
Torque
Warning or
alarm
Energized
1)
Energized
Yes
2)
No warnings or
alarms.
De-energized
3)
De-energized
No
Warning/alarm
68: Safe Torque
Off.
De-energized
Energized
No
Alarm 188: STO
Function Fault.
Energized
De-energized
No
Alarm 188: STO
Function Fault.
Table 6.1 STO Status
1) Voltage range is 24 V
±
5 V, with terminal 55 as the reference
terminal.
2) Torque is present only when the frequency converter is operating.
3) Open circuit, or the voltage within the range of 0 V
±
1.5 V, with
terminal 55 as the reference terminal.
Test pulse filtering
For safety devices that generate test pulses on the STO
control lines: If the pulse signals stay at low level (
≤
1.8 V)
for no longer than 5 ms, they are ignored, as shown in
Time
5 ms max.
Debounce time
Time
STO valid
STO invalid
Voltage
T37/38
Test pulse
STO demanded
STO request
state
130BE587.12
Illustration 6.2 Test Pulse Filtering
Asynchronous input tolerance
The input signals at the 2 terminals are not always
synchronous. If the discrepancy between the 2 signals is
longer than 12 ms, the STO fault alarm (
alarm 188, STO
Function Fault
) occurs.
Valid signals
To activate STO, the 2 signals must both be at low level for
at least 80 ms. To terminate STO, the 2 signals must both
be at high level for at least 20 ms. Refer to
chapter 9.6 Control Input/Output and Control Data
for the
voltage levels and input current of STO terminals.
Safe Torque Off (STO)
Operating Guide
MG07A402
Danfoss A/S © 10/2017 All rights reserved.
37
6
6
