0
\$\begingroup\$

I try to implement a STO (Safe-Torque Off) mechanism for a motor controller and for me it is not clear what is really necessary according IEC61800-5-2. It needs somehow two safety path, such that when one triggers, the motor gets no current anymore.

Motor drivers normally come with a enable/disable pin, that turns off the gate voltages when triggered and activates a STO. So from my understanding, this can be used for one STO path only, right? Or would it be possible to for example have two uC and a AND gate to trigger the enable/disable pin? If another STO mechanism is necessary, the first thing that comes to my mind is to supply the gate driver over a high-side PMOS and in STO case, turn it off. Is this a good choice? I would prevent the use of a relay to cut of the motor power, since I use only +48VDC in my case and I need to switch 40A, such that nearly a contactor is necessary. A third possibility would be to turn of the PWM, but I doubt this goes as a STO mechanism.

When I use now the enable/disable Pin aswell as the PMOS power switch as two STO path, do I really need two Microcontrollers to trigger the switches or would it be possible to take two GPIO pins, where one needs to be high and the other needs to be low to trigger both STO path? Do you have more ideas, how a STO could be implemented with only one microcontroller?

Here I found an implementation according to TI: https://www.ti.com/lit/an/slyt780/slyt780.pdf?ts=1623358487385&ref_url=https%253A%252F%252Fwww.google.ch%252F

\$\endgroup\$

1 Answer 1

0
\$\begingroup\$

When I use now the enable/disable Pin aswell as the PMOS power switch as two STO path, do I really need two Microcontrollers to trigger the switches or would it be possible to take two GPIO pins, where one needs to be high and the other needs to be low to trigger both STO path?

The Enable is not a safety function, only STO1 and STO2 are. To disconnect switches, a safety MCU has to be used, not an usual MCU.

You first toggle ENABLE to low, the drive has to coast to standstill (there is no feedback that this task has accomplished) at the same time a delayed safety relay is triggered. Upon a set time, the safety relay cuts off the power with use of the contactor or power relay - two of them in series for SIL3 category.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.