Safe Torque Off (Sto) - Emerson E300 Series Design Manual

Safety Product Mechanical
information information installation
Figure 4-40 Surge suppression for analog and bipolar inputs and outputs
Surge suppression devices are available as rail-mounting modules, e.g. from Phoenix Contact:
Unipolar TT-UKK5-D/24 DC
Bipolar TT-UKK5-D/24 AC
These devices are not suitable for encoder signals or fast digital data networks because the capacitance of the diodes adversely affects the signal.
Most encoders have galvanic isolation of the signal circuit from the motor frame, in which case no precautions are required. For data networks, follow
the specific recommendations for the particular network.
4.18

Safe Torque Off (STO)

The E300 Advanced Elevator drive has a single channel Safe Torque Off (STO)
4.18.1 Single channel Safe Torque Off (STO)
The Safe Torque Off (STO) function provides a means for preventing the drive from generating torque in the motor, with a very high level of integrity.
It is suitable for incorporation into a safety system for a machine. It is also suitable for use as a conventional drive enable input.
The safety function is active when the Safe Torque Off (STO) input is in the logic-low state as specified in the control terminal specification. The
function is defined according to EN 61800-5-2 and IEC 61800-5-2 as follows. In these standards a drive offering safety-related functions is referred to
as a PDSSR)):
'Power, that can cause rotation or motion in the case of a linear motor), is not applied to the motor. The PDS(SR) will not provide energy to the motor
which can generate torque (or force in the case of a linear motor)'.
This safety function corresponds to an uncontrolled stop in accordance with stop category 0 of IEC 60204-1.
The Safe Torque Off (STO) function makes use of the special property of an inverter drive with an induction motor, which is that torque cannot be
generated without the continuous correct active behavior of the inverter circuit. All credible faults in the inverter power circuit cause a loss of torque
generation.
The Safe Torque Off (STO) function is fail-safe, so when the Safe Torque Off (STO) input is disconnected the drive will not operate the motor, even if
a combination of components within the drive has failed. Most component failures are revealed by the drive failing to operate. Safe Torque Off (STO)
is also independent of the drive firmware. This meets the requirements of the following standards, for the prevention of operation of the motor.
Data as verified by TÜV Rheinland:
According to EN ISO 13849-1:
PL = e
Category = 4
MTTF = High
D
DC = High
av
Mission Time and Proof Test Interval = 20 years
The calculated MTTF for the complete Safe Torque Off (STO) function is:
D
STO1 2574 yr
According to EN 61800-5-2:
SIL = 3
-11 -1
PFH = 4.21 x 10 h
The Safe Torque Off (STO) input also meets the requirements of EN 81/2 as part of a system for preventing unwanted operation of the motor in an
Elevator application.
Safe Torque Off (STO) can be used to eliminate electro-mechanical contactors, including special safety contactors, which would otherwise be
required for safety applications.
The function can be used in safety-related machines or systems which have been designed according to IEC 62061 or IEC 61508, or other standards
which are compatible with IEC 61508, since the analysis and the integrity metrics used in EN 61800-5-2 are the same.
104
Electrical Getting
User Menu A Commissioning
installation started
Signal from plant
0V
Advanced
Diagnostics Optimization CT MODBUS RTU Technical Data
Parameters
Signal to drive
2 x 15V zener diode
e.g. 2xBZW50-15
0V
E300 Design Guide
Issue Number: 1