Emerson Digitax ST User Manual Download Page 42

Page: 42 / 210

Digitax ST User Guide

Issue: 5

4.17 Safe Torque Off

The Safe Torque Off function provides a means for preventing the drive
from generating torque in the motor, with a very high level of integrity. It
is suitable for incorporation into a safety system for a machine. It is also
suitable for use as a conventional drive enable input.
The Safe Torque Off function makes use of the special property of an
inverter drive with an induction motor, which is that torque cannot be
generated without the continuous correct active behavior of the inverter
circuit. All credible faults in the inverter power circuit cause a loss of
torque generation.
The Safe Torque Off function is fail-safe, so when the Safe Torque off
input is disconnected the drive will not operate the motor, even if a
combination of components within the drive has failed. Most component
failures are revealed by the drive failing to operate. Safe Torque Off is
also independent of the drive firmware. This meets the requirements of
the following standards, for the prevention of operation of the motor.

EN 61800-5-2:2007 SIL 3 (PFH

≤

-8

)

EN ISO 13849-1:2006 PL e (MTTF

>10

yr)

EN954-1:1997 Category 3 (This standard is withdrawn and
should not be used for new designs, information provided for legacy
applications only).
On drives with date code P04 and later the Safe Torque Off input also
meets the requirements (of EN 81-1 clause 12.7.3 b) as part of a system
for preventing unwanted operation of the motor in a lift (elevator).

Independent approval has been given by IFA.

Independent approval of concept has been given by TÜV. Please

consult the separate guide for lift applications for further information.
Safe Torque Off can be used to eliminate electro-mechanical contactors,
including special safety contactors, which would otherwise be required
for safety applications.

Note On Response Time Of Safe Torque Off, And Use With Safety
Controllers With Self-testing Outputs (Drives With Date Code P04
And Later).

Safe Torque Off Has Been Designed To Have A Response Time Of
Greater Than 1 Ms, So That It Is Compatible With Safety Controllers
Whose Outputs Are Subject To A Dynamic Test With A Pulse Width Not
Exceeding 1ms.
For Applications Where A Fast-acting Disable Function Is Required,
section 12.22.10

Fast Disable

on page 172

Note On The Use Of Servo Motors, Other Permanent-magnet
Motors, Reluctance Motors And Salient-pole Induction Motors

When The Drive Is Disabled Through Safe Torque Off, A Possible
(Although Highly Unlikely) Failure Mode Is For Two Power Devices In
The Inverter Circuit To Conduct Incorrectly.
This Fault Cannot Produce A Steady Rotating Torque In Any Ac Motor. It
Produces No Torque In A Conventional Induction Motor With A Cage
Rotor. If The Rotor Has Permanent Magnets And/or Saliency, Then A
Transient Alignment Torque May Occur. The Motor May Briefly Try To
Rotate By Up To 180° Electrical, For A Permanent Magnet Motor, Or 90°
Electrical, For A Salient Pole Induction Motor Or Reluctance Motor. This
Possible Failure Mode Must Be Allowed For In The Machine Design.

With Safe Torque Off There Are No Single Faults In The Drive Which
Can Permit The Motor To Be Driven. Therefore It Is Not Necessary To
Have A Second Channel To Interrupt The Power Connection, Nor A
Fault Detection Circuit.
It Is Important To Note That A Single Short-circuit From The Safe Torque
Off Input To A Dc Supply Of Approxi24 V Would Cause The
Drive To Be Enabled. This Can Be Excluded Under En Iso 13849-2 By
The Use Of Protected Wiring. The Wiring Can Be Protected By Either Of
The Following Methods:
•

By Placing the wiring in a segregated cable duct or other enclosure.

or
•

By providing the wiring with a grounded shield in a positive-logic
grounded control circuit. The shield is provided to avoid a hazard
from an electrical fault. It may be grounded by any convenient
method; no special EMC precautions are required.

If the use of protected wiring is not acceptable, so that the possibility of
this short circuit occurring is anticipated, then a relay must be used to
monitor the state of the Safe Torque Off input, together with a single
safety contactor to prevent operation of the motor after a fault.
For more information regarding the Safe Torque Off input, please see
the

Safe Torque Off Engineering Guide

available for download from

http://www.emersonindustrial.com/en-EN/controltechniques/downloads/
userguidesandsoftware/Pages/downloads.aspx.

The design of safety-related control systems must only be
done by personnel with the required training and experience.
The Safe Torque Off function will only ensure the safety of a
machine if it is correctly incorporated into a complete safety
system. The system must be subject to a risk assessment to
confirm that the residual risk of an unsafe event is at an
acceptable level for the application.

WARNING

Safe Torque Off inhibits the operation of the drive, this
includes inhibiting braking. If the drive is required to provide
both braking and Safe Torque Off in the same operation (e.g.
for emergency stop) then a safety timer relay or similar device
must be used to ensure that the drive is disabled a suitable
time after braking. The braking function in the drive is
provided by an electronic circuit which is not fail-safe. If
braking is a safety requirement, it must be supplemented by
an independent fail-safe braking mechanism.

Safe Torque Off does not provide electrical isolation.
The supply to the drive must be disconnected by an approved
isolation device before gaining access to power connections.

Low voltage DC operation

With low voltage DC operation there is a reduction in the level
of safety of the Safe Torque Off function. There exist certain
unlikely faults which might permit the drive to produce some
limited motor torque when disabled, but only if the DC supply
has its negative pole connected to ground.
To prevent a loss of the safety function in the event of such a
fault, one of the following methods can be used:
1. Monitor the state of Pr

8.09

. This parameter value

should match the state of the enable input. If it does not
match then there is a fault and further operation must be
prevented.

2. Connect the positive pole of the DC supply to ground.
3. Connect neither pole of the DC supply to ground. Use a

ground fault detection circuit to prevent further operation
in the event of a ground fault in the DC circuit. If the
detection circuit requires the supply to be biased relative
to ground, ensure that the bias is negative, i.e. both DC
rails are negative relative to ground.

Note that in lift (elevator) applications designed to meet
EN 81-1 with the use of one contactor or no contactors,
method 1 is normally implemented as part of the standard lift
safety control system.

WARNING