Safe Torque Off (STO)

Safe Torque Off (STO) is a drive safety function defined by IEC 61800-5-2. When STO is active, the drive cannot deliver the energy needed to generate torque in the motor — the motor cannot actively drive the load and cannot start unexpectedly due to a faulty control command, a microcontroller fault, a communication error, or any other failure of the standard control path.

siliXcon controllers provide an STO-equivalent behaviour by design of their powering architecture. This behaviour is not certified — no SIL (IEC 61508 / IEC 62061) or PL (EN ISO 13849-1) level is claimed. A manufacturer's declaration describing this capability is available for download:

Download: Manufacturer's Declaration — Safe Torque Off capability (PDF)

info

STO is not a galvanic disconnection. Hazardous voltage remains present on the DC bus, the power terminals, and inside the controller. STO does not replace the main disconnect device, service disconnection, or lockout/tagout procedures.

Principle of operation

The relevant hardware variants are those without the internal fuse (see Controller powering). In these variants, the complete supply of the control electronics enters the controller exclusively through the KEY pin:

1. The KEY input feeds the internal electronic power switch (commanded by the POWER input).
2. The switched KEY voltage is the only input of the internal SMPS.
3. The SMPS generates all internal rails, including the gate-drive supply of the power-stage gate drivers.

When the KEY supply is interrupted, the gate-drive supply collapses. The power MOSFETs are N-channel enhancement devices — without a positive gate-source voltage they cannot conduct, regardless of the state of the microcontroller, the firmware, or any communication interface. All six switches of the three-phase bridge go to a high-impedance state, the motor phases are effectively disconnected from the DC bus, and no torque can be generated. A spinning motor then coasts freely to a standstill (stop category 0 according to EN/IEC 60204-1).

Interrupting the KEY supply simultaneously removes power from the control logic, so PWM generation stops as well; however, the torque removal does not depend on it — it is guaranteed by the loss of gate-drive power alone.

Internal fuse variants

Controller variants with the internal fuse are internally supplied from the BATT+ terminal. Interrupting the external KEY wiring does not remove the internal supply, and the described behaviour does not apply. Only variants without the internal fuse are covered.

Conditions and limitations

Field weakening must be disabled

The STO-equivalent behaviour is only valid when field weakening is disabled.

With field weakening enabled, the motor may operate above its base speed, where the motor back-EMF exceeds the DC-bus voltage. If gate drive is removed in this region, the machine does not become torque-free: its back-EMF rectifies through the MOSFET body diodes into the DC bus. This uncontrolled generation produces braking torque and pumps energy into the DC-link capacitors, which can raise the DC-bus voltage above the controller and battery ratings. Field weakening and STO are therefore mutually exclusive — applications relying on the STO behaviour must keep field weakening disabled.

Power-semiconductor failure (worst case)

Removing the gate-drive supply cannot mitigate a failed (shorted) power MOSFET. If one or more transistors fail short, motor phases can become short-circuited, which produces braking torque (and, with a rotating permanent magnet motor, a pulsating torque). This is the recognized worst-case failure mode of any STO implementation — IEC 61800-5-2 explicitly notes that STO cannot prevent torque resulting from simultaneous power-semiconductor failures. The machine risk assessment must take this residual risk into account.

Other limitations

• STO does not brake the motor and does not hold position. If coasting is hazardous, an additional measure (mechanical brake, safe brake control) is required.
• The reaction time is given by the discharge of the internal supply rails after KEY interruption and has not been formally characterized.
• The function is single-channel and without diagnostics; it does not by itself fulfil the architectural requirements of any SIL/PL level.

Certified installation option

Although the controller itself is not certified, a certifiable safety function can be built around it: route the KEY supply through a certified safety relay or safety contactor (with forcibly guided / mirror contacts, driven by a certified safety controller or e-stop circuit).

• The safety-rated element performing the energy removal is then the certified relay, for which validated safety data (B10d, PFH, PL/SIL capability) exist.
• The controller acts as the actuator that inherently cannot produce torque without its KEY supply.
• The machine integrator can then assess and certify the complete safety function (sensor → safety logic → relay → controller KEY path) according to EN ISO 13849-1 or IEC 62061.

siliXcon can provide the technical documentation of the powering architecture needed for such an assessment.

DC-link overvoltage when disconnecting under load

Interrupting the battery current path while phase current is flowing (opening the safety relay of the main battery circuit, a blown fuse, or a battery connector disconnected under load) causes a voltage overshoot on the DC link. The energy stored in the motor inductance has nowhere to go: it freewheels through the MOSFET body diodes into the DC-link capacitors and charges them above the battery voltage.

tip

This is one more reason to prefer interrupting the KEY signal path (a few hundred mA) over interrupting the main battery circuit under load: the KEY interruption removes torque without dumping the motor energy into the DC link.

For a balanced three-phase current of amplitude $I$ and synchronous inductance $L$ (per phase, dq frame), the stored magnetic energy is:

$$W_L = \frac{3}{4} \cdot L \cdot I^2$$

After disconnection this energy transfers to the DC-link capacitance $C$, so the peak DC-link voltage follows from the energy balance $\frac{1}{2} C V_{peak}^2 = \frac{1}{2} C V_{DC}^2 + W_L$:

$$V_{peak} = \sqrt{V_{DC}^2 + \frac{3}{2} \cdot \frac{L \cdot I^2}{C}}$$

The calculation is a worst case in the sense that all magnetic energy is transferred to the capacitors without losses. It neglects any additional energy delivered by the still-rotating machine during the transient — at high speed (especially in field weakening, see above) the real overshoot can be higher.

Interactive calculator

Enter the DC-link capacitance of the controller (plus any external capacitance), the controller current limit iref, and the motor inductance (use the larger of Ld / Lq obtained from motor identification):

Battery voltage [V]

DC-link voltage just before disconnection

DC-link capacitance [µF]

Internal + external capacitance

Phase current I [A]

Worst case: controller current limit (iref)

Motor inductance L [µH]

Larger of Ld / Lq from motor identification

Max. controller voltage [V]

Absolute maximum DC voltage rating

Stored magnetic energy W = ¾·L·I²	1.3 J
Voltage rise ΔV	16.8 V
Peak DC-link voltage	88.8 V

OK — peak voltage stays below the controller maximum

warning

If the resulting peak voltage exceeds the maximum allowed controller voltage, the disconnection under full current can destroy the controller (and other devices on the DC bus). Increase the DC-link capacitance, lower the current limit, or make sure the battery path cannot open under load.