Accelnet Plus Micro Modules User Guide
16-01687 Rev 03
Copley Controls
Page 94 of 139
STO
A
RCHITECTURE AND
F
UNCTION
The STO function in AEV & APV is suitable for use in safety loops up to SIL 3 and/or Cat. 3 PL e
performance. Because Cat. 3 PL e performance requires that the safety function continues to
operate even in the event of two failures, the STO circuit has a built-in diagnostic capability. This
architecture is shown in the system block diagram below. The dotted red outline represents the
components in the drive that implement the safety function.
AEV-APV
STO
S
AFETY
C
ONTROL
-N
O
P
INS
In the Safe State, the drive will not produce torque or force in the motor. The STO function
achieves and maintains a safe state by disabling the ability of the attached motor to produce
torque/force. This halts any drive induced acceleration already in process and prevents initiation
of motion. The expectation is that an inability of the motor to produce torque/force translates
into a reduction of risk of hazardous motion for the larger system.
The STO circuit concept involves disabling the ability of the motor drive output stages to produce
current. The output stage consists of one subset of high side output MOSFETs that switch motor
terminals to the positive rail of the DC bus (+HV), and a second subset of low side output devices
that switch motor terminals to negative rail of the DC bus (HVCOM). The STO circuit architecture
is derived from the fact that current flow in the motor, and therefore torque/force production,
requires both subsets to function. STO Channel 2 disables the drive by removing power from the
MOSFET gate drivers. STO Channel 1 uses the Enable input of the drivers to disable all of them.
Either of the two channels by itself is therefore sufficient to prevent the initiation of motion or
halt drive induced acceleration when the STO function is activated
Each STO channel receives an input in the form of a voltage applied to STO-IN1 (+,-) and STO-
IN2 (+,-). Both STO inputs must be simultaneously energized in order for torque/force to be
produced. To achieve the rated SIL and PL capability, both STO inputs must be held
simultaneously de-energized by the larger system when the STO function is activated. In a
typical machine application, each STO input is driven by a voltage from a SELV or PELV power
supply and switched through a safety relay. By definition, the output of a SELV or PELV rated
power supply is a maximum of +60 Vdc in a fault condition. Therefore a constraint on the larger
system is that the power supply used to energize the STO inputs must be an SELV or PELV type.
Channel 2
2k
2k
2k
2k
STO 2
STO 1
3 AE V, APV
Channel 1
CPU
STO1 TN
STO2 TN
SD
Vcc
I
O
SD
Vcc
I
O
V
Vaux
1 Vdc
5 Vdc
