Drive Controlled Pump
Parker Hannifin Corporation
Hydraulics Group
DCP Manual innen A4 UK.indd 06.11.17
28
Manual
STO Functional description
Safe Torque Off SIL3/PLe
General Information
This equipment if used incorrectly is potentially
dangerous. Therefore under no circumstances
should it be used before these instructions
have been read and understood by the end
user who should be appropriately qualified to
operate the equipment.
This section provides general information about Safe
Torque Off (STO).
Two safety functions can be implemented with the AC30V:
STO and Safe Stop 1 (SS1). In order to meet all aspects
of STO and SS1, an external safety control unit should
be used.
To implement Safe Stop 1 (SS1), the external safety con-
trol unit causes the drive to decelerate to rest. Once at
rest, it invokes STO in the AC30V.
Please refer to EN61800-5-2:2007 para 4.2.2.3 for the
formal definitions.
It is the user’s responsibility to:
1. Risk assess the machine.
2. Design, implement and assess an appropriate solu-
tion for each application to meet all relevant safety re-
quirements.
STO is an electronic inhibit intended for use
during normal operation of the machine. It is not
intended for use during machine maintenance,
repair, replacement or other similar activities.
For these activities recognised electrical power
isolation devices and lock-off procedures
should be used. The AC30V STO function is a
factory-fitted and factory-tested feature.
STO is a means of preventing an AC30V drive from de-
livering rotational force to its connected electric motor.
Please refer to EN61800-5-2:2007 para 4.2.2.2 for the
formal definition.
To ensure a high degree of safety, two independent STO
control channels are implemented in hardware. The STO
circuit in the AC30V is designed such that a fault in one
control channel will not affect the other channel’s ability
to prevent the drive from starting, i.e. the STO function of
the AC30V drive is tolerant to any single fault. It may not
be tolerant to an accumulation of faults. This is in keep-
ing with its declared safety ratings.
STO always overrides any attempt to start the drive. If one
or both STO control inputs is requesting the STO function,
the drive will not start, even if for example, the drive’s soft-
ware malfunctions and tries to cause the motor to turn.
The STO function is implemented in hardware; it over-
rides all software activities. The only software involve-
ment is to report STO status to the user via a Graphical
Keypad (GKP), serial communications link or user termi-
nal as defined by the drive configuration.
The declared sil/pl capability of this sto product
can be achieved only when the two sto user
inputs are driven independently. They must
not both be driven from a common source;
otherwise the single fault detection will be
completely inoperative.
Use of the product in this “common source”
condition invalidates the sto product specifica-
tion and is entirely at the user’s own risk.