Safety Torque Off wiring with optocouplers

[frusciante89]

Hello all
I'm implementing two independent Safe-Torque-Off style command channels on a motor controller board, each derived from the same external E-Stop switch, and I'd like a sanity check- I have a feeling I might be overengineering this

The setup: the E-Stop drives two separate signal paths (STO1_INPUT / STO2_INPUT). Each path goes through its own photorelay (K8, K10 — TLP3640A) purely for galvanic isolation between the external E-Stop wiring and the board's own logic. The photorelay outputs (SIGNAL1_OUT / SIGNAL2_OUT) are logic-level signals at 3.3V that get sent onward to whatever they're actually commanding downstream.

What I added on top of the basic isolation, and my reasoning for each part (this is the part I'm least sure about):

• R178 / R182 (10kΩ pulldowns directly on the SIGNAL_OUT nodes): to guarantee a defined logic-low level when the optocoupler isn't engaged (E-Stop tripped / relay open), rather than letting that node float.
• D48 / D49 (1N4148): tapped off the same SIGNAL_OUT node, feeding a monitoring path back to the MCU. My reasoning: if the MCU's input pin were ever accidentally configured as an output (firmware bug, reset-state misconfiguration, whatever), the diode stops that pin from being able to drive back into the actual safety signal.
  
• R177 / R181 (1kΩ, in series before the MCU pin) and R179 / R183 (10kΩ pulldowns on the MCU-facing side of the diode): the 10k is a pulldown for the MCU input pin itself, and the 1k is current-limiting in series.
  

So each channel ends up with: isolation relay → local pulldown on the real signal → diode → second pulldown + series resistor → MCU monitor pin.

Also, is there any specific ceritfication needed for this part? I've chosen TLP3640 because it's EN IEC 60747-5-5 and UL 1577 / cUL certfied. Is that sufficient?

My question:
- does this actually make sense as a monitoring tap, or is having two separate pulldowns (one on each side of the diode) redundant / overcomplicated?
- Is the diode's blocking-direction reasoning sound, and is this a standard way to give an MCU visibility into a safety signal without letting the MCU pin influence it?
- Any obvious simplification I'm missing, or is this level of protection actually appropriate for a signal like this?

[nctnico]

If the estop is a switch, then why put optocouplers in series? That only complicates things.

IMHO the best way is to keep things simple. What isn't there, can't break. I'd design the system so that an open contact or open wire counts as the estop being activated.

[frusciante89]

I've added the optocoupler to add galvanic isolation instead of connecting it directly to the estop contacts

[NorthGuy]

What is connected SIGNAL1_IN and SIGNAL2_IN?

[bookaboo]

The shared ground means you are not actually isolated, though it does give transient protection.

Dual E-Stops are usually wired with 2 seperate potentials, simplest example would be 0V and 5V. The idea being that if a cable gets crushed or shorted it's much less likely to look like a valid circuit. Just having 5V supply means you could short the whole cable and leave yourself with no stop function .


The application and intention matters greatly here. For a personal project , or something with no dangerous outcome, rolling your own circuit is fine. But if you intend to meet functional safety certification (IEC 61800-5-2 / ISO 13849-1) .... that's a whole other universe.

[nctnico]

The shared ground means you are not actually isolated, though it does give transient protection.

I didn't catch that but if you have a shared ground, using optocouplers is meaningless. Transient protection can also be achieved by using TVS diodes and having some capacitance at the inputs. For slow signals I like to use VDRs as they also have a significant capacitance. In the end there is also a limit to what an LED in an optocoupler can handle where it comes to transients. A 1500W TVS diode can probably deal with a lot more energy.

[frusciante89]

What is connected SIGNAL1_IN and SIGNAL2_IN?

Those are MCU outputs, one controlling the enable of a DRV83xx gate driver, and one controlling the enable of a TPS48100 Back-to-Back MOSFET High Side Driver, which are in series with the bus voltage. When TPS48100 is not active, the bus voltage goes down.

[frusciante89]

The shared ground means you are not actually isolated, though it does give transient protection.

Dual E-Stops are usually wired with 2 seperate potentials, simplest example would be 0V and 5V. The idea being that if a cable gets crushed or shorted it's much less likely to look like a valid circuit. Just having 5V supply means you could short the whole cable and leave yourself with no stop function .


The application and intention matters greatly here. For a personal project , or something with no dangerous outcome, rolling your own circuit is fine. But if you intend to meet functional safety certification (IEC 61800-5-2 / ISO 13849-1) .... that's a whole other universe.

Yes the idea here is to eventually go for functional safety certification. As this is new territory for me, is there a reference design you would suggest to look at?

[gspeed]

you could at least actually write the posts by yourself 

[frusciante89]

I did write it myself! There's a Claude pass to harmonise english, but I can assure you it's my design (and my mistakes)

[frusciante89]

The shared ground means you are not actually isolated, though it does give transient protection.

I didn't catch that but if you have a shared ground, using optocouplers is meaningless. Transient protection can also be achieved by using TVS diodes and having some capacitance at the inputs. For slow signals I like to use VDRs as they also have a significant capacitance. In the end there is also a limit to what an LED in an optocoupler can handle where it comes to transients. A 1500W TVS diode can probably deal with a lot more energy.

That's a good poit on the shared ground. However, how can I achieve ground isolation in this case? I need to feed the Estop with a voltage, which will have to be referenced to my board GND. And on the secondary of the optocoupler, I need to GND reference to be able to monitor via the MCU. Do you see any other way of isolating them?

[voltsandjolts]

...if you intend to meet functional safety certification (IEC 61800-5-2 / ISO 13849-1) .... that's a whole other universe.

Yes the idea here is to eventually go for functional safety certification. As this is new territory for me, is there a reference design you would suggest to look at?

Mistake #1 is using the word 'eventually'.
Functional safety needs to be considered in detail at an early stage of the design.
Functional safety and electronics beginners are in general not a successful mix.

[Ian.M]

If you *really* need isolation, you'll need an isolated DC-DC converter module (or roll your own as part of your PSU) to power each E-stop loop.  Then you'll need isolated monitoring for the isolated power.   The rabbit hole keeps getting deeper and deeper, so don't add any extra features not required by the standard you are following!

[bookaboo]

The shared ground means you are not actually isolated, though it does give transient protection.

Dual E-Stops are usually wired with 2 seperate potentials, simplest example would be 0V and 5V. The idea being that if a cable gets crushed or shorted it's much less likely to look like a valid circuit. Just having 5V supply means you could short the whole cable and leave yourself with no stop function .


The application and intention matters greatly here. For a personal project , or something with no dangerous outcome, rolling your own circuit is fine. But if you intend to meet functional safety certification (IEC 61800-5-2 / ISO 13849-1) .... that's a whole other universe.

Yes the idea here is to eventually go for functional safety certification. As this is new territory for me, is there a reference design you would suggest to look at?

I wouldn't , functional safety is a huge project to take on.  Every time I have considered it on a project we have ended up just buying an off the shelf solution. The engineering is one thing, attaining the certifications is another. Even if you have the experience and the time to produce a complaint design (no small feat), you still need to budget €50-100k in external compliance testing.

 

[nctnico]

The shared ground means you are not actually isolated, though it does give transient protection.

Dual E-Stops are usually wired with 2 seperate potentials, simplest example would be 0V and 5V. The idea being that if a cable gets crushed or shorted it's much less likely to look like a valid circuit. Just having 5V supply means you could short the whole cable and leave yourself with no stop function .


The application and intention matters greatly here. For a personal project , or something with no dangerous outcome, rolling your own circuit is fine. But if you intend to meet functional safety certification (IEC 61800-5-2 / ISO 13849-1) .... that's a whole other universe.

Yes the idea here is to eventually go for functional safety certification. As this is new territory for me, is there a reference design you would suggest to look at?

I wouldn't , functional safety is a huge project to take on.  Every time I have considered it on a project we have ended up just buying an off the shelf solution. The engineering is one thing, attaining the certifications is another. Even if you have the experience and the time to produce a complaint design (no small feat), you still need to budget €50-100k in external compliance testing.

I agree with this. Safety relays which power down machinery are a standard product. It makes no sense to roll your own. I'd also make the safety relay cut mains to the motor drive.

[frusciante89]

I though about this a bit more today, and I think the usage of a safety relay might be the best way to go here. I've sketched a diagram of how I would implement it. The green area is my PCB.

The relay is a PILZ PNOZ series. This should also solve the galvanic isolation issues we were discussing above.
In addition, if a cable gets crushed or shorted, the safety relay should catch the fault (periodic pulses are sent to check the health of the connections).

STO1 and STO2 will then have to be routed via a custom ciurcit in my PCB, and that will be my own design (which at some point will have to be certified). Is this a more sensible approach?

[nctnico]

The question is: how are the motors being turned off? What is the mechanism behind that? In your schematic you are adding a safety relay but your circuit is still in the safety related path.

[frusciante89]

The logic is the following:
- STO1 is in series with the MCU signal that enables the gate driver
- STO2 is in series with the MCU signal that enables the hot swap controller. This is a high side back back FET controller that provides VBUS to the BLDC mosfets.

Note 1: I've added STO2 as there might still be energy stored in the bulk capacitance even after the gate drivers have been deactivated. I don't want this stored energy to recirculate and continue powering the motor.
Note 2: I'm not cutting power at the input as I want to keep the MCU alive for monitoring and logging

[nctnico]

I wouldn't do it that way. Earlier this year I installed a VFD. It has enough hold over capacitance to take the motor to a controlled stop after the power is cut. I set the whole system up so that when the stop switch is hit or when the motor overheats, the mains power is cut. I think you should follow a similar route. With the mains power cut, there is no longer a supply of energy so there is no way to keep the motors spinning. I'm not an expert on safety relays, but cutting power to prevent worse seems like the most logical thing to do. Whatever you want to implement functionally, is secondary to that.

IMHO you should look into the actual requirements for designing safe machinery before doing any electronics design work. Get the overall architecture right before (start) creating the design.

[tooki]

The relay is a PILZ PNOZ series. This should also solve the galvanic isolation issues we were discussing above.
In addition, if a cable gets crushed or shorted, the safety relay should catch the fault (periodic pulses are sent to check the health of the connections).

Correct. It detects a short between them, but also, both e-stop switch channels must open and close for it to enable the output: if one channel opens and closes, but the other stayed closed, this is considered a sensor/switch fault, and the output stays off.

STO1 and STO2 will then have to be routed via a custom ciurcit in my PCB, and that will be my own design (which at some point will have to be certified). Is this a more sensible approach?

Not really. That essentially circumvents much of the safety relay’s function, because it’s not actually switching the motor power. A safety system needs to rely on components and system design that are designed to fail safe (that is, that if any part fails, the machine itself fails into a safe (nonhazardous) state)*. For example, in your design, the optocoupler or the gate driver could fail to an unsafe state (where the e-stop button is pressed but has no effect). What happens if the MCU crashes? (Can the PWM generators keep running independently even if your code has crashed or hit a bug?)

On the other hand, if you just route power to the BLDC driver through the safety relay, it doesn’t matter what else goes wrong: if you press the e-stop button, the motor WILL stop, even if (for example) your MCU has gotten into a state where the motor drive signals are being generated when they shouldn’t, and the gate driver’s enable line somehow got shorted to the enabled state.

Safety relays are designed with all sorts of redundancy and self-monitoring inside, so that if anything goes wrong, it shuts down the output. But that only works if it is physically capable of removing power to the hazard-generating parts (like the motor). So if you put anything in between, those things need to be equally designed for safety.

For example: If the motor currents are significantly less than the maximum of the safety relay’s outputs, you can use them directly, but it’s more common to use one (or more) of those outputs to control an external relay or contactor with force-guided contacts (or multiple in series, just like the internal force-guided relays inside the safety relay you show).

Force-guided contacts means that all the contacts in a relay or contactor (which are always single-throw in force-guided types) always move together by having a rigid mechanical linkage, and not individually-flexing double-throw contacts like in a regular relay.

Suppose you use two relays with force-guided contacts in series, so that you have two relays that must close for the motor to operate. If any contact were to weld closed, then when that relay is de-energized, the welded contact would prevent the other contacts in that relay from moving: the normally-open main contacts would remain closed, but also, the normally-closed auxiliary monitoring contact would stay open, breaking the “start” circuit that needs to be closed in order for the safety relay to allow the machine to start. This effectively prevents a failed (welded) relay from eroding a layer of safety: if one relay fails, the machine is disabled. The machine cannot be turned on until the failed relay is replaced.

An ordinary relay’s monitoring contact could close, even if one of the main contacts is welded, telling the safety relay an incorrect state. That means the safety redundancy of two relays in series is pointless, since the machine remains fully functional even if one relay has failed. If the second relay fails, the machine now has no way of stopping when the e-stop is pressed.

FYI, contactors are basically heavy-duty relays, but for the purposes of safety design, what’s special about them is that they break each circuit in two places, not just one, and have much larger gaps between open contacts (and between channels) than regular relays do. They’re basically always used for high-current switching, but miniature contactors exist for higher-reliability switching of smaller loads.


Also, the safety relay has a separate logic output for sending the output relay state to the MCU for monitoring.



* as opposed to the colloquial use of “fail safe” to mean “doesn’t fail”, “has redundancy”, or “does something extra”.

[frusciante89]

I agree, we need to cut power: but isn't it what the hot swap controller is doing in my diagram? I'm using a TPS4800 with 2 back to back fets.
This unit is placed between the output of the Input protection block (+48VDC, named VBAT in the TI diagram) and the 3-phase BLDC supply

[tooki]

If it’s actually safety-relevant, that won’t cut it; when power semiconductors fail, they often fail short. But even if the hot swap controller hasn’t failed, what about the optocoupler that controls it? If it fails short, then it becomes “nonexistent” to the safety design: it fails unsafe.

That’s the reason why safety interlock and e-stop systems must use designs that revert to a safe state if anything fails, using both active and passive methods to cause that reversion, and redundant parts to ensure that no single failure can compromise the safety. Did you understand the example I gave you? (I mean really understand it at its core.)


Perhaps you can share more about the project, since right now, we are operating under the assumption that anything that has an e-stop is significantly hazardous to human safety. In reality, the level of safety design depends entirely on the risk in question. A cordless drill with a 500W motor poses entirely different hazards, if something goes wrong, than a 500W table saw, for example, which is why the saw likely has an e-stop button, while the drill does not. And both of those are more hazardous than, say, a 1000W vacuum cleaner. (If the vacuum’s switch fails, you’re not in direct contact with the motor, for instance.)

So please tell us as much as you can about what you’re building. It could be that your design is fine. Or it could be that it needs to be designed with a professional machine safety engineer. (I actually plan to get some machine safety design training next year.)

[frusciante89]

Hi guys,
I spent some days reviewing material and also purchased the standard that relates to this type of application, which is the EN 61800-5-2:2017.
A bit more details on my application: it's a BLDC controller, powering a 500W/48V motor. The final application is not defined yet, as this it's just the control board: could be a robot, could be a rover, could be a azimuth/elevation system.

The power system takes the 48VDC, filters it with ~1000uF of capacitance and controls 6 IGBTs via a Texas Instrument gate driver (DRV-83xx series). I also have an electromagnetic brake control circuit that is of the active-released type (when I power it, it releases and it permits motion).

Also, the type of stop I'm looking for it's a Safety Torque Off (STO) - also defined as Cat0 STOP in IEC60204-1:

4.2.3.2 Safe torque off (STO)
This function prevents force-producing power from being provided to the motor
This safety sub-function corresponds to an uncontrolled stop in accordance with stop category 0 of IEC 60204-1.
NOTE 1 This safety sub-function can be used where power removal is required to prevent an unexpected start-up according to ISO 14118.

In EN 61800-5-2:2017, I found the attached diagrams for a STO example application:



There are 2 STO signals (coming from the safety relay), STO-A and STO-B. Then there's a STO-FB feedback signal I suppose is read-back by the safety relay (need to double check if Pilz-type relay provide this reading, and which V it is).


The STO system is broken down into two sub-units:


The first one is as below. Optocouplers seem to be used all over the place. The two chanells A and B are acting on separate IGBTs: STO-A on the high-side gate drives and STO-B inhibits all 3 low-side gate drives. This from my understanding should guarantee a 1oo2/HFT=1 (a single fault has to not defeat the function)


The second one, the PS/VM, deals with the power section, and is shown below. Not clear if this is optional or needed to achieve the desired safety level.

[nctnico]

I still think you will do yourself a big favour by just cutting the 48V to the motor drive by using an (electro mechanical) contactor when the safety relay switches off. Otherwise you'll have to certify the drive you are designing. I'm quite sure that will be hard and very costly. Likely every change to the firmware means re-certification making it almost impossible to implement new features economically.

[frusciante89]

How could that be done? Are you saying within the PCB footprint?
For context, the size of the PCB is at the moment 70mm diam, with a 15mm hole in the middle.