Safe Stop standard, definition for drives, VFDs

Status
Not open for further replies.

El Papa

Member
Hi. I am wondering what the definition, general guidelines and the official standard is for drive, VFD safe-stop function. I know many VFDs come with the safe-stop function in the configured drive, but if the drive doesn't have it, is it simply just to make sure the drive comes to a halt before the drive loses power? If I have a 15 HP motor controlled by a VFD, is it considered a safe-stop function if when the E-Stop is engaged that the drive comes to a quick halt, without the VFD losing power?.. Is there a standard I can read that tells specific requirements of a drive safe-stop function? Thanks in advance.
 

Jraef

Moderator, OTD
Staff member
Location
San Francisco Bay Area, CA, USA
Occupation
Electrical Engineer
This may be a translation issue, but here it is referred to as "Safe Torque Off" now, Safe Stop was an earlier term that was used somewhat indiscriminately by marketing types and it became confusing. One reason for the confusion is evident in your question, namely, can I accomplish this without the feature? The answer is not black and white, hence the change in defined terms, at least over here.

STO is a specific defined term relating to the standards for machine safety systems defined (somewhat ironically as you will see) by mostly IEC standards, many of which became part of ISO standards. The chief one for machinery is EN ISO 13849. Here in the US we don't absolutely require that machinery meet these standards, but they can be used to satisfy our safety regulations. The irony is in the fact that you are in Sweden, where you WOULD need to be paying heed to them...

STO means that specific FEATURE in a drive has been designed, tested and CERTIFIED to be a validated part of a Safey Integration Level (SIL) of the machine, based on a Performance Level (PL) of the systems within it. So if for example your machine is determined to require SIL 2, PLd, you can use STO in a VFD to attain that by simply having a Safety Relay (also a defined term) tied to the STO input of the drive. If something triggers that safety relay and thus the STO input on the VFD, the VFD output transistors are immediately disabled, ignoring all other functions and internal commands so there is immediately no output energy from the VFD. This is of course barring any internal component failure, which is where the problems arose in the past, because that vetting process was not well defined at first. Now, in order to attain that PL at that SIL, the entire scope of component failure inside if the drive is tested extensively by third party testing agencies to attain that certification. Without that, marketing terms are meaningless from a safety regulation standpoint.

The reason why the answer to "Can I do this without it?" is not black and white, is because IF you need to attain a particular SIL and PL, but you have a VFD that is not certified for STO, you can usually still get there by using external components. Usually that involves having at least one "Safety Contactor" (another specifically defined term) on the output side of the VFD, sometimes you need even two in series for the highest levels (which might even be true using STO).

The REASON getting there with STO is advantageous, and in fact the reason it exists, is because of the potential damage that can happen to VFDs if you must power it down and lock it out every time someone must perform a routine process task (NOT repairs), such as inserting or retrieving materials, cleaning out swarf, changing bits, etc. Every time you power up a VFD there is something called a "pre-charge" circuit that limits the capacitor charging current inrush and prevents that from damaging the other parts. Those pre-charge components are typically designed for a few thousand operations, as in once per day for 10 years. If you start powering a VFD down and back up every 15 minutes, you exceed their design life in 2-3 years and when that part fails, the rest of the VFD fails shortly thereafter and users get upset. By using STO, normal repetitious tasks can be done safely by eliminating the possibility of energy getting to the motor when a person has their hands in a dangerous area. So a typical application is on a punch press that an operator feeds material into. There would be higher levels of power down if someone accidentally lets their fingers linger on the material and trips a light curtain, that's not what STO is for, but if every 15 minutes or so an operator needs to stop and clear out punch blanks, they allow the machine to stop normally, then engage a safety interlock, often with a key, that removes drive energy from the motor via STO while they have their hands in there removing material.

That's why it's not called "Safe Stop" any longer, because although it WILL eventually cause the motor to stop, that may or may NOT be the safest way to stop it. If the VFD is being used to brake a motor, disabling the transistors eliminates that and on something with a flywheel, that is not necessarily safe. So they changed the term to Safe Torque Off. You STOP the motor first, THEN disable the transistors while performing routine tasks.
 
Last edited:
Status
Not open for further replies.
Top