E-Stop to an STO?

I have 2 PF525 drives where the client wants to use the STO function. I have very little experience with this function, but I need to make it work. My understanding is that the STO inputs on the drive run to an external safety relay and are hooked onto the NO contacts. I assume that I put the E-Stop on the coil side of the SR, however, that doesn't seem to make too much sense. Why would you add an unnecessary relay when you could just run through the E-Stop and be done with it?.

Also to add some more information, the drives are going to be ran over ethernet.

Safety relays are often smart with internal tests of short circuits and similar, that is potentially one reason.
Another reason is that maybe its described like that in the manual and if the manufacturer suggest it then you wont have to defend your other choice if/when shizzles hits the fan.

Functional safety of machinery is a huge topic, far beyond just how e-stop pushbuttons are wired to motor drives.

Decades ago we did largely what you described: an e-stop button with a pull or push-to-reset mechanism, wired to an Enable pin on a drive logic board.

But what if there was a short to +24V somewhere in the wiring, so the e-stop press didn't do anything ? What about a cross between the two circuits that pass through the button (if we used two channels at all). What if you pressed the button and the drive didn't stop as required; there was no way to tell that something was wrong with the circuit or the button. And after an emergency stop event, the machinery could start up automatically without a manual human action taken to reset the system, not just the mushroom-head button.

Safety relays are built to address those kinds of issues, with dual channels and short-circuit and cross-circuit detection and feedback monitoring and manual reset inputs.

Taking a step back, I can't tell if you're describing a "safety relay" like a Guardmaster 440R, or a "safety contactor" or "force-guided relay" like a 700S-CF contactor or 700-HPS ice cube style.

If you're working with STO for the first time, it's worth the effort to discuss the safety aspects of the application with your client as part of the overall risk analysis of the machine system.

Ken described it great. Here are a few extra i try to talk to people about.
Anything other than a simple device you will have (Input , logic ,output) like Ken said channel to channel shorts, cross wiring, shorts to 24VDC. These are a few of the things you need to worry about.

The STO removes the firing signal to the drive output, so the drive free wheels to a stop. This could be an issue if you have a saw or other hazardous motion that free wheel stopping coupld cause an issue. Several applications I've done used a stop command to drive the motor to standatill then opened the STO.

You can open yourself up to a whole new market with safety.

JeffKiper said:

The STO removes the firing signal to the drive output, so the drive free wheels to a stop. This could be an issue if you have a saw or other hazardous motion that free wheel stopping coupld cause an issue. Several applications I've done used a stop command to drive the motor to standatill then opened the STO.

Click to expand...

This is why I find the whole safety thing around drives to be a bit wooly. According to the Siemens documentation, STO is in effect the only safety function available and doesn't really cover it. Some drives have SS1 (Safe Stop 1) function, which is as you said using the drive to stop, then applying STO. But according the graphs in the manuals, it is not a safety function until the point where STO is applied.
In effect, nobody will ever actually notice the difference on most machines, but I've worked with some fans and centrifuges that can take several long minutes to stop naturally.

Don't poopoo VFD STO.
It is basically the same as using contactors to cut power to the motor. In either case the motor will run to a standstill by its own inertia.
If that is acceptable must be considered in the risk assessment.

A VFD STO can achieve a quite high performance level. I use Siemens G120 and with its integrated STO you can achieve PL=d or PL=e.
It will take redundant contactors to achieve PL=d or PL=e.

Check the VFD documentation, as to what can actually be achieved and how to implement it.

edit: And yes, +1 what Ken wrote about using a safety relay.

JesperMP said:

Don't poopoo VFD STO.
It is basically the same as using contactors to cut power to the motor. In either case the motor will run to a standstill by its own inertia.
If that is acceptable must be considered in the risk assessment.

A VFD STO can achieve a quite high performance level. I use Siemens G120 and with its integrated STO you can achieve PL=d or PL=e.
It will take redundant contactors to achieve PL=d or PL=e.

Check the VFD documentation, as to what can actually be achieved and how to implement it.

edit: And yes, +1 what Ken wrote about using a safety relay.

Click to expand...

It’s the way of the now and the future for that matter. STO gives me the flexibility to add my own braking system as well instead of relying on controls to do it, which is a bit touchy in a safety system.

There are machines that can be damaged by abrupt stopping, but that’s only half of the equation. You have to look at it from the worst case scenario. What’s the worst thing that could happen here and what do you want the emergency stop response to be? Have your customer answer that and then you can plan appropriately if you want to use anything in conjunction with STO. Most of the time, STO is going to do the job just fine.

JTCat said:

There are machines that can be damaged by abrupt stopping,

Click to expand...

In my case it was actually infrastructure... the tower on which the winch I was working on couldn't handle the shock of an immediate stop at full load. To this day I don't know how the people designing that place were not taken to court. :/

You must also understand, and make clear to operators, that STO is NOT the same as LO/TO requirements and cannot be used as such.

STO is there on VFDs and Servo drives because there is slight incremental harm done to power electronics when you remove power from them. There are components inside that have finite lifespans, usually measured in a few thousand on-off cycles. If a VFD is only powered off once it a great while, you may never live to see them fail. But if power is cycled multiple times per day as part of a safe operation, such as an operator loading components into a machine, or to remove something jamming a conveyor, then you can consume the life of these components in a very short time. So the INTENDED use of STO is to allow a Safety Monitoring system (Safety Relay or Safety PLC) to enable the operator to perform NORMAL operational tasks that require that the motor be disabled from being able to move, but without having to actually remove power from the input of the VFD. There is NO other valid use for STO.

So DO NOT think of STO as an E-Stop, because that requires OTHER considerations of what constitutes an "Emergency" and how the VFD needs to react to that, possibly differently under different scenarios. Can it be used as part of an E-stop? Sure, but it shouldn't be "the" E-stop.

jraef said:

You must also understand, and make clear to operators, that STO is NOT the same as LO/TO requirements and cannot be used as such.

Click to expand...

Once you have gotten into doing safety there is a Document ANSI Z244.1 that outlines LOTO and Alternative methods. Full blown LOTO and STO are 2 completely different things. You will learn when to apply each. Your local OSHA inspector may interpret these reference manuals different than you. Make sure you have all of your relevant documentation printed off and highlighted. I have had several inspectors not agree at first then change their mind after I showed them the data and where it was stated to be accepted.

I had a customer that had an automatic drilling station. that used stepper motors. Every time you powered down the system you had to home all the stations. We changed them to Servo with STO so we could open the door and change the drill bits. This changed the customers changeover time from 30 minutes to 5 minutes. The customer was happy as can be. We invited OSHA in to do an inspection and the inspector said it had to have a lock on it if there is a lockout point. So we shipped that machine to the manufacturing plant in the next state and the inspector was happy with the design.

The STO function primarily removes the need to remove all power from the drive in a controlled or safety stop. Wiring the STO through the dry contacts of a "Safety relay" force-guided relay is an accepted means of using the STO function. This inhibits the motor restart until the safety relay is reset. And as stated by others, this is NOT a substitute for LOTO.

******-thread, but...

This is fantastic information.

Thank you all

jakeparsons03 said:

Why would you add an unnecessary relay when you could just run through the E-Stop and be done with it?.

Click to expand...

The safety relay has dual contacts, and dual monitoring. It sees both contacts close, and monitors that both contacts act the same way. If they don't within a few mS the relay faults. Relays use the concept of redundancy. A contact failing has (fake info) 1-in 2,000,000 chance of failing. The chance of two contacts failing at the same time is extremely tiny.

The reset on a safety relay automatically stops you from holding down the reset button to make the line run as well. I think I've seen some that will still function that way though.

Manufacturers have created these devices with these features for us. We shouldn't be taking estops straight to STOs in this day and age. They spent a lot of money testing, and designing that device with approved usages in their manuals.

https://literature.rockwellautomation.com/idc/groups/literature/documents/um/440r-um013_-en-p.pdf

page 45 starts showing examples for applications. All of them use the safety relay to fire a safety contactor. The safety contactor contacts should go to the STO.

In our risk assessment, we would test the circuit thoroughly and document it. This would involve me and my electrician going to every safety device, taking one wire off of each dual contact and testing. We would also have every safety device pulled into sistema, which helps cross reference all of the devices you are using in the safety circuit, and what your maximum safety rating can be with those devices. Its free. https://www.dguv.de/ifa/praxishilfen/practical-solutions-machine-safety/software-sistema/index.jsp

ISO 12100:2010 specifies basic terminology, principles and a methodology for achieving safety in the design of machinery. It specifies principles of risk assessment and risk reduction to help designers in achieving this objective. These principles are based on knowledge and experience of the design, use, incidents, accidents and risks associated with machinery. Procedures are described for identifying hazards and estimating and evaluating risks during relevant phases of the machine life cycle, and for the elimination of hazards or sufficient risk reduction. Guidance is given on the documentation and verification of the risk assessment and risk reduction process. This costs around $220.
https://www.iso.org/standard/51528.html


ISO 14121-1:2007 establishes general principles intended to be used to meet the risk reduction objectives established in ISO 12100-1:2003, Clause 5. These principles of risk assessment bring together knowledge and experience of the design, use, incidents, accidents and harm related to machinery in order to assess the risks posed during the relevant phases of the life cycle of a machine. This costs $97.
https://www.iso.org/standard/38479.html

With your current question that started this post. You shouldn't be designing safety alone. Hopefully you don't wing it, you go to your boss, and you ask for help. The above is to help educate you. It shall not encourage you to complete this task alone. Don't do it. Be Ethical when facing a deadline.

I totally agree with everything said so far, each situation is differerent. But it's worth mentioning that there are situations where you can connect an estop button directly to the STO inputs.

For example:

https://literature.rockwellautomation.com/idc/groups/literature/documents/um/20c-um001_-en-p.pdf

Example 1 - Drive Safe Torque Off Connections with Coast-to-Stop Action
and Emergency Stop Operation, Dual Channel, without External Relay

Fault Detection – A redundant (two) set of double break contacts on the Trojan
gate interlock are designed to ensure that at least one signal is sent to the Safe
Torque Off option board when the gate is opened. A single fault detected on the
safety input circuits will result in the lock-out of the system to a safe state (off ) at
the next operation and will not cause loss of the safety function.
Each of the inputs on the Safe Torque Off option board independently monitors
the status of the safety circuit and the status of the other input on the board.

jraef said:

So DO NOT think of STO as an E-Stop, because that requires OTHER considerations of what constitutes an "Emergency" and how the VFD needs to react to that, possibly differently under different scenarios. Can it be used as part of an E-stop? Sure, but it shouldn't be "the" E-stop.

Click to expand...

We just commissioned a couple machines at our plant where we implemented both SS1 and STO. First time I've ever done it that way, but it works. The E-Stop buttons activate SS1, and then we have another button on the machine that when depressed, it fires STO. Also, any general machine "fault" condition will fire STO. We use Rexroth drives.