Safe Torque Off (STO)
What is Safe Torque Off?
Planar Motor System is equipped with a Safe Torque Off (STO) safety feature that is intended to de-energize the system in the event of an accident or emergency upon request.
Unlike simply de-activating or stopping the XBot motion through a control command, STO removes the system’s ability to energize the coils in Flyway(s), ensuring a fail-safe stop.
Such a safety feature is commonly used in machinery safety systems as a quick and reliable way to bring equipment to a non-hazardous state while still allowing fast restart once safe conditions are restored.
Safety Specification
Parameter | Value |
|---|---|
Safety function | Safe Torque Off (STO) |
STO input voltage | 24 VDC ± 15% (nominal), 30 VDC maximum |
STO input logic level | Low 0-4 VDC (STO engaged) High 20.5-27.5 VDC (STO not engaged) |
Operating temperature range | -40 °C to 60 °C ambient |
Systematic capability (IEC 61508) | SIL 2 capable |
Hardware Redundancy | HFT=1 |
Performance level (ISO 13849) | Category 3 PLd |
Typical response time | <500 ms |
Type | Type A device (High Demand application) |
Diagnostics Test Interval (DTI) | 100 ms (10 Hz) |
Mission time | 20 years |
Proof Test Interval (PTI) | 1 year |
Total Failures (λ) | 1.26E-07 |
Safe diagnosed failures (λSD) per channel | 0.00E+00 |
Safe undiagnosed failures (λSU) per channel | 8.53E-08 |
Dangerous diagnosed failures (λDD) per channel | 3.64E-08 |
Dangerous undiagnosed failures (λDU) per channel | 4.04E-09 |
Probability of Failure on Demand average (PFDavg ) per channel | 1.80E-05 |
Probability of Dangerous Failure per Hour (PFH ) | 4.04E-10 |
Implementation
The safety feature is actuated by connecting the STO+ and STO- pins of single-ended Flyway Power cable to a safety switch (i.e. safety relay, E-Stop button, etc) as seen in the diagram below.
Schematic for STO implementation
The STO+ signal can be connected to safety switches or digital outputs to enable or disable the Flyway motor power under specific circumstances. If the STO+ signal is set to low, the power stage is disabled. If the STO+ signal is set to high, the system can energize and operate normally. For instance, a positively driven switching off relay can be used disable the motor power when the safety circuit is opened.
Triggering the STO will de-energize all subsequent Flyways in the power daisy chain.
Refer to Power Cable PC-050, PC-100 for the pin assignments of STO+ and STO- in Flyway power cables.
Refer to Electrical Setup for detailed electrical wiring instructions.
Refer to E-Stop: Quick Stop and STO Implementation for advanced STO implementations, including quick-stop functionality.
All safety circuits should be designed and implemented according to the relevant SIL / PL standards. This document provides instruction on how to integrate the STO signal into the safety circuit, but does not determine auxiliary safety devices.
Operation Modes
This section is provided as a reference for customers to understand the operating modes and conditions of Safe Torque Off (STO) safety feature in Planar Motor System.
STO under normal operating condition
When STO is requested by a user, the system will de-energize and all XBots on the system will fall/land. This is considered “normal operating condition” of STO. The following figure represents the expected behavior when STO is requested/triggered under normal operating condition. The following errors will be seen when you click on a Flyway in the Planar Motor Tool (PMT) when a system is in safe state.
PMT error/status message during normal STO operating condition
The system can be re-energized by resetting the STO trigger (i.e. STO circuit is closed). Once the trigger is reset, the system can be activated to resume operation.
STO under abnormal operating condition
STO can be activated due to an abnormal condition in a Flyway(s) (i.e. hardware faults, component failure, etc.) which has been detected by the internal diagnostics. This is considered “abnormal operating condition” of STO. The following figure represents the expected behavior when STO is requested/triggered under abnormal operating condition. The following errors will be seen when you click on a Flyway in the Planar Motor Tool (PMT) when a system is in safe state.
PMT error/status message during abnormal STO operating condition
The system will also report the following error log from Diagnostic info.
Diagnostic info during abnormal STO operating condition
In this situation, the following procedures for handling STO under abnormal operating conditions are recommended:
Power cycle the Flyway and activate again to see the error still exists.
If the error persists, send an email to support@planarmotor.com or contact your direct support engineer.
In a rare event, there is a possibility that a fault occurs in the Flyway’s STO circuit that goes undetected by the internal diagnostics. As per our Internal FMEDA analysis and tests, this causes the system to be permanently stuck in a safe state, even when the safety circuit is closed. The same error message from the figure referenced above will be displayed. In this situation, the following procedures are recommending.
Power cycle the Flyway and activate again to see the error still exists.
Probe the STO+ and STO- pins of the power cable to ensure that the issue is not caused by a defective cable/pin contact.
If the error persists, send an email to support@planarmotor.com or contact your direct support engineer.
Maintenance
To ensure that the safety function operates as intended over the product lifespan, it is recommended that the STO safety function is proof tested at least once a year by the operator.
Proof testing can be conducted by simply triggering STO and checking if the system behaves as described in “STO under Normal Operating Condition”.
For any issues, troubleshooting, or modification requests, please send an e-mail to support@planarmotor.com or contact your direct support engineer.