Trapped Key Interlocking

This entry is part 3 of 7 in the series Guards and Guard­ing

Many machine design­ers think of inter­locks as exclus­ively elec­tric­al devices; a switch is attached to a mov­able mech­an­ic­al guard, and the switch is con­nec­ted to the con­trol sys­tem. Trapped Key Inter­lock­ing is a way to inter­lock guards that is equally effect­ive, and often more appro­pri­ate in dif­fi­cult envir­on­ment­al con­di­tions. Con­tin­ue read­ing “Trapped Key Inter­lock­ing”

Five reasons you should attend our Free Safety Talks

Reason #1 – Free Safety Talks

You can’t argue with Free Stuff! Last week we partnered with Schmersal Canada and Frank­lin Empire to put on three days of Free Safety Talks. We had full houses in all three loc­a­tions, Wind­sor, Lon­don and Cam­bridge, with nearly 60 people par­ti­cip­at­ing.

We had two great presenters who helped people under­stand Pre-Start Health and Safety Reviews (PSRs) [1], CSA Z432-2016 [2], Inter­lock­ing Devices [3] and Fault Mask­ing [4].

Mr Vashi at Franklin Empire Cambridge
Mr Vashi at Frank­lin Empire Cam­bridge

Frank­lin Empire provided us with some great facil­it­ies and break­fast to keep our minds work­ing. Thanks, Frank­lin Empire and Ben Reid who organ­ized all of the regis­tra­tions!

Mr Nix discussing injury rates in machine modes of operation
Mr Nix dis­cuss­ing injury rates in machine modes of oper­a­tion

Reason #2 – Understanding Interlocking Devices

A portrait of Mr Kartik Vashi
Mr Kartik Vashi, CFSE

Mr Kartik Vashi, CFSE, dis­cussed the ISO Inter­lock­ing Device stand­ard, ISO 14119. This stand­ard provides read­ers with guid­ance in the selec­tion and applic­a­tion of inter­lock­ing devices, includ­ing the four types of inter­lock­ing devices and the vari­ous cod­ing options for each type. Did you know that ISO 14119 is also dir­ectly ref­er­enced in CSA Z432-16 [2]? That means this stand­ard is applic­able to machinery built and used in Canada as of 2016. If you don’t know what I’m talk­ing about, you can con­tact Mr Vashi to get more inform­a­tion.

ISO 14119 Fig 2 showing some aspects of different types of interlocking devices.
ISO 14119 Fig 2 show­ing some aspects of dif­fer­ent types of inter­lock­ing devices [3]

Reason #3 – Understanding Fault Masking

Mr Vashi also talked about fault mask­ing, an import­ant and often mis­un­der­stood situ­ation that can occur when inter­lock­ing devices or oth­er elec­tromech­an­ic­al devices, like emer­gency stop but­tons, are daisy-chained into a single safety relay or safety input on a safety PLC. Mr Vashi drew from ISO/TR 24119 to help explain this phe­nomen­on. If you don’t under­stand the impact that daisy-chain­ing inter­lock­ing devices can have on the reli­ab­il­ity of your inter­lock­ing sys­tems, Mr Vashi can help you get a handle on this top­ic.

A part of ISO 24119 Fig 2 showing one method of daisy-chaining interlocking devices.
A part of ISO 24119 Fig 2 show­ing one com­mon meth­od of daisy-chain­ing inter­lock­ing devices [4]

Reason # 4 – Pre-Start Health and Safety Reviews

Portrait of Doug Nix, C.E.T.
Mr Doug Nix, C.E.T.

Mr Nix opened his present­a­tion with a dis­cus­sion of some com­monly asked ques­tions about Pre-Start Health and Safety Reviews (PSRs). There are many ways that people become con­fused about the WHY, WHAT, WHEN, WHERE, WHO and HOW of PSRs, and Mr Nix covered them all. This unique-to-Ontario pro­cess requires an employ­er to have machines, equip­ment, rack­ing and pro­cesses reviewed by a Pro­fes­sion­al Engin­eer or anoth­er Qual­i­fied Per­son when cer­tain cir­cum­stances exist (see O. Reg. 851, Sec­tion 7 Table). If you are con­fused by the PSR require­ments, con­tact Mr Nix for help with your ques­tions.

Reason #5 – Understanding the changes to CSA Z432

CSA Z432 [2] was updated in 2016 with many changes. This much-needed update came after 12 years exper­i­ence with the 2004 edi­tion and many changes in machinery safety tech­no­logy. Mr Nix briefly explored the many changes that were brought to Cana­dian machine build­ers in the new edi­tion, includ­ing the many new ref­er­ences to ISO and IEC stand­ards. These new ref­er­ences will help European machine build­ers get their products accep­ted in Cana­dian mar­kets. Both Mr Vashi and Mr Nix sit on the CSA Tech­nic­al Com­mit­tee respons­ible for CSA Z432.

Reason #6 – Hot Questions

We like to over-deliv­er, so here’s the bonus reas­on!

We had some great ques­tions posed by our attendees, two of which we are answer­ing in video posts this week. If you have ever con­sidered using a pro­gram­mable safety sys­tem for lock­out, our first video explains why this is not yet a pos­sib­il­ity. Mr Nix gets into some of the reli­ab­il­ity con­sid­er­a­tions behind the O.Reg. 851 Sec­tions 75 and 76 and CSA Z460 require­ments.

Mr Nix pos­ted a second video dis­cuss­ing ISO 13849 – 1 [5] Cat­egory 2 archi­tec­ture require­ments and par­tic­u­larly Test­ing Inter­vals. This video explains why it is not pos­sible to meet the test­ing require­ments using a purely elec­tromech­an­ic­al design solu­tion.

Edit: 16-May-18

A case in the UK illus­trates the dangers of bypassing inter­lock­ing sys­tems. A work­er was killed by a con­vey­or sys­tem in a pre-cast con­crete plant when he was work­ing in an area nor­mally pro­tec­ted by a key-exchange sys­tem. Here’s the link to the art­icle on Allow­ing work­ers into the danger zone of a machine without oth­er effect­ive risk reduc­tion meas­ures may be a death sen­tence.


[1]     Ontario Reg­u­la­tion 851, Indus­tri­al Estab­lish­ments

[2]     Safe­guard­ing of Machinery. CSA Z432. 2016.

[3]     Safety of machinery – Inter­lock­ing devices asso­ci­ated with guards – Prin­ciples for design and selec­tion. ISO 14119. 2013.

[4]     Safety of machinery – Eval­u­ation of fault mask­ing seri­al con­nec­tion of inter­lock­ing devices asso­ci­ated with guards with poten­tial free con­tacts. ISO/TR 24119. 2015.

[5]     Con­trol of haz­ard­ous energy – Lock­out and oth­er meth­ods. CSA Z460. 2013.

[6]     Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design. ISO 13849 – 1. 2015.

Digiprove sealCopy­right secured by Digi­prove © 2018
Acknow­ledge­ments: Kartik Vashi, ISO, Frank­lin Empire, S more…
Some Rights Reserved

Safe Drive Control including Safe Torque Off (STO)

This entry is part 12 of 14 in the series Emer­gency Stop

Ed. Note: This art­icle was revised 25-Jul-17 to include inform­a­tion on safe stand­still.

Safe Drive Control including STO

Variable Frequency Drive for conveyor speed control
Vari­able Fre­quency Drive for con­vey­or speed con­trol [1]
Motor drives are every­where. From DC vari­able speed drives and index­ing drives, through AC Vari­able Fre­quency drives, servo drives and step­per motor drives, the cap­ab­il­it­ies and the flex­ib­il­ity of these elec­tron­ic sys­tems has giv­en machine design­ers unpre­ced­en­ted cap­ab­il­it­ies when com­pared to basic relay or con­tact­or-based motor starters. We now have the cap­ab­il­ity to con­trol mech­an­isms using motors in ways that would have been hard to ima­gine at the begin­ning of the indus­tri­al revolu­tion. Along with these con­trol cap­ab­il­it­ies come safety-related func­tions like Safe Torque Off (STO).

Since we are con­trolling machinery, safety is always a con­cern. In the 1990’s when I star­ted design­ing machinery with motor drives, deal­ing with safety con­cerns usu­ally meant adding a suit­ably rated con­tact­or upstream of the drive so that you could inter­rupt power to the drive in case some­thing went wrong. With early servo drives, inter­rupt­ing the sup­ply power often meant los­ing pos­i­tion data or worse. Pla­cing con­tact­ors between the drive and the motor solved this prob­lem, but inter­rupt­ing the sup­ply power would some­times cause the drive stage of the servo con­trol­ler to blow up if the switch-off happened with the motor run­ning and under high load. Motor drive man­u­fac­tur­ers respon­ded by provid­ing con­tact­ors and oth­er com­pon­ents built into their drives, cre­at­ing a fea­ture called Safe Torque Off (STO).

STO describes a state where “The drive is reli­ably torque-free” [2]. The func­tions dis­cussed in this art­icle are described in detail in IEC 61800 – 5-2 [3]. The func­tions are also lis­ted in [10, Table 5.2]. Note that only Safe Torque Off and Safe Stop 1 can be used for emer­gency stop func­tions. Safe Torque Off, Safe Stop 1 and Safe Stop 2 can be used for safety-related stop func­tions ini­ti­ated by a safe­guard­ing device. This dis­tinc­tion, between emer­gency stop func­tions and safe­guard­ing func­tions, is an import­ant one.

If you have been a read­er of this blog for a while, you may recall that I have dis­cussed stop cat­egor­ies before. This art­icle expands on those con­cepts with the focus on motor drives and their stop­ping func­tions spe­cific­ally. I’ve also talked about Emer­gency Stop extens­ively. You might be inter­ested in read­ing more about the e-stop func­tion, start­ing with the post “Emer­gency Stop – What’s so con­fus­ing about that?”

Safe Torque Off (STO)

Accord­ing to Siemens, “The STO func­tion is the most com­mon and basic drive-integ­rated safety func­tion. It ensures that no torque-gen­er­at­ing energy can con­tin­ue to act upon a motor and pre­vents unin­ten­tion­al start­ing.” Risk assess­ment of the machinery can identi­fy the need for an STO func­tion. The devices used for this applic­a­tion are described in IEC 60204 – 1 in clause 5.4 [4]. The design fea­tures for pre­ven­tion of unex­pec­ted start­ing are covered in more detail in EN 1037 [5] or ISO 14118 [6]. If you are inter­ested in these stand­ards, ISO 14118 is in the pro­cess of being revised. A new ver­sion should be avail­able with­in 12 – 18 months.

The STO func­tion oper­ates as shown in Fig.1. The blue line rep­res­ents the drive speed/velocity, V, on the y-axis, with time, t, on the x-axis. The orange arrow and the dot­ted line show the ini­ti­ation of the stop­ping func­tion.

Graph showing motor drive output over time when the STO function is activated.
Fig­ure 1 – Safe Torque Off func­tion [1]
At the begin­ning of the stop­ping pro­cess (orange arrow and dot­ted line), the drive gate pulses are imme­di­ately shut off, remov­ing torque from the motor (i.e., zero torque). The speed of the driv­en equip­ment will drop at a rate determ­ined by the sys­tem fric­tion and iner­tia until stand­still is achieved. The zero torque con­di­tion is main­tained until the safety func­tion per­mits restart­ing (area out­lined with yellow/black zebra stripe). Note that drive stand­still may occur if the fric­tion and iner­tia of the sys­tem per­mit, but it is pos­sible that the driv­en equip­ment may coast for some time. You may be able to move the driv­en equip­ment by hand or grav­ity with the drive in the STO mode.

STO is an uncon­trolled stop­ping mode [4, 3.56]:

uncon­trolled stop
stop­ping of machine motion by remov­ing elec­tric­al power to the machine actu­at­ors
NOTE This defin­i­tion does not imply any oth­er state of oth­er (for example, non-elec­tric­al) stop­ping devices, for example, mech­an­ic­al or hydraul­ic brakes that are out­side the scope of this stand­ard.

The defin­i­tion above is import­ant. Uncon­trolled stops are the most com­mon form of stop­ping used in machines of all types and is required as a basic func­tion for all machines. There are vari­ous ways of achiev­ing STO, includ­ing the use of a dis­con­nect­ing device, emer­gency stop sys­tems, and gate inter­lock­ing sys­tems that remove power from machine actu­at­ors.

The embod­i­ment of the uncon­trolled stop concept is Stop Cat­egory 0 [4, 9.2.2]:

stop cat­egory 0 — stop­ping by imme­di­ate remov­al of power to the machine actu­at­ors (i.e., and uncon­trolled stop, see 3.56)

Stop cat­egory 0 is only appro­pri­ate where the machinery has little iner­tia, or where mech­an­ic­al fric­tion is high enough that the stop­ping time is short. It may also be used in cases where the machinery has very high iner­tia, but only for nor­mal stop­ping when coast­ing time is not a factor, not for safety stop­ping func­tions where the time to a no-motion state is crit­ic­al.

There are a few oth­er stop­ping modes that are often con­fused with STO:

  • Safe Stop 1
  • Safe Stop 2
  • Safe Oper­at­ing Stop
  • Safe Stand­still

Let’s explore the dif­fer­ences.

Safe Stop 1 (SS1)

If a defined stop­ping time is needed, a con­trolled stop­ping func­tion will be required fol­lowed by entry into STO. This stop­ping func­tion is called “Safe Stop 1” (SS1).

SS1 is dir­ectly related to Stop Cat­egory 1 [4, 9.2.2]. As described in [4], Stop Cat­egory 1 func­tions as fol­lows:

stop cat­egory 1 — a con­trolled stop (see 3.11) with power avail­able to the machine actu­at­ors to achieve the stop and then remov­al of power when the stop is achieved;

A “con­trolled stop” is defined in [4, 3.11]:

con­trolled stop
stop­ping of machine motion with elec­tric­al power to the machine actu­at­or main­tained dur­ing the stop­ping pro­cess

Once the con­trolled stop is com­pleted, i.e., machine motion has stopped, the drive may then be placed into STO (or cat­egory 0 stop). The stop­ping pro­cess is shown in Fig. 2 [7].

Graph showing the reduction of drive speed over time following the beginning of a controlled stopping process.
Fig­ure 2 – Safe Stop 1

The stop­ping pro­cess starts where the orange arrow and dot­ted line are shown. As com­pared to Fig. 1 where the decel­er­a­tion curve is gentle and expo­nen­tial, the act­ive stop­ping peri­od in Fig. 2 is a lin­ear curve from oper­at­ing speed to zero speed. At the blue dot­ted line, the drive enters and stays in STO. The yellow/black zebra striped area of the curve out­lines the com­plete stop­ping func­tion. This stop­ping meth­od is typ­ic­al of many types of machinery, par­tic­u­larly those with servo-driv­en mech­an­isms.

Safe Stop 2 (SS2)

In some cases, the risk assess­ment may show that remov­ing power com­pletely from a mech­an­ism will increase the risk. An example might be a ver­tic­al axis where the motor drive is used to main­tain the pos­i­tion of the tool­ing. Remov­ing power from the drive with the tool raised would res­ult in the tool­ing crash­ing to the bot­tom of the axis in an uncon­trolled way. Not the desired way to achieve any type of stop!

There are vari­ous to pre­vent this kind of occur­rence, but I’m going to lim­it the dis­cus­sion here to the Safe Stop 2 func­tion.

Let’s start with the defin­i­tion [4, 3.11]:

con­trolled stop
stop­ping of machine motion with elec­tric­al power to the machine actu­at­or main­tained dur­ing the stop­ping pro­cess

Wait! The defin­i­tion of a con­trolled stop is exactly the same as a stop cat­egory 1, so what is the dif­fer­ence? For that we need to look to [4, 9.2.2]:

stop cat­egory 2 — a con­trolled stop with power left avail­able to the machine actu­at­ors.

Emer­gency Stop func­tions can­not use Stop Cat­egory 2 [4,]. If you have tool­ing where Stop Cat­egory 2 is the most appro­pri­ate stop­ping func­tion under nor­mal con­di­tions, you will have to add an anoth­er means to pre­vent the axis from fall­ing dur­ing the emer­gency stop. The addi­tion­al means could be a spring-set brake that is held released by the emer­gency stop sys­tem and is applied when the e-stop sys­tem removes power from the tool­ing. There are many ways to achieve auto­mat­ic load-hold­ing besides brakes, but remem­ber, whatever you choose it must be effect­ive in power loss con­di­tions.

As shown in Fig. 3, the oper­a­tion of Safe Stop 2 dif­fers from Safe Stop 1 in that, instead of enter­ing into STO when motion stops, the sys­tem enters Safe Oper­at­ing Stop (SOS) [8], not STO. SOS is a Stop Cat­egory 2 func­tion. Full torque remains avail­able from the motor to hold the tool­ing in pos­i­tion. Safe stand­still is mon­itored by the drive or oth­er means.

Graph showing speed reduction to zero, followed by entry into stop category 2.
Fig­ure 3 — Safe Stop 2

Depend­ing on the ISO 13849 – 1 PLr, or the IEC 62061 SILr needed for the applic­a­tion, the drive may not have high enough reli­ab­il­ity on its own. In this case, a second chan­nel may be required to ensure that safe stand­still mon­it­or­ing is adequately reli­able. This can be achieved by adding anoth­er means of stand­still detec­tion, like a second encoder, or a stand­still mon­it­or­ing device. An example cir­cuit dia­gram show­ing this type of mon­it­or­ing can be found in Fig. 4 [10, Fig. 8.37], show­ing a safety PLC and drive used to provide an “inch­ing” or “jog” func­tion.

Circuit diagram for a safe inching mode using a motor drive. Taken from Fig 8.37 in BGIA Report 2/2008e
Fig­ure 4 — Safely lim­ited speed for inch­ing mode – PLd, Cat. 3 [10]
In Fig. 4, the encoders are labelled G1 and G2. Both encoders are con­nec­ted to the safety PLC to provide two-chan­nel feed­back required for Cat­egory 3 archi­tec­ture. G1 is also con­nec­ted to the motor drive for pos­i­tion and velo­city feed­back as needed for the applic­a­tion. Note that this par­tic­u­lar drive also has a con­tact­or upstream, Q1, to provide one chan­nel of the two required for Cat­egory 3. The second chan­nel would be provided by the pulse block­ing input on the drive. For more on how this cir­cuit func­tions and how the func­tion­al safety ana­lys­is is com­pleted, see [10].

Safe Operating Stop (SOS)

Dur­ing a safe oper­at­ing stop (SOS), the motor is brought to a spe­cif­ic pos­i­tion and held there by the drive. Full torque is avail­able to keep the tool­ing in pos­i­tion. The stop is mon­itored safely by the drive. The func­tion is shown in Fig­ure 4 [9].

A graph showing a drive maintaining position following a stop
Fig­ure 5 — Safe Oper­at­ing Stop

In Fig. 5, the y-axis, s, rep­res­ents the pos­i­tion of the tool­ing, NOT the velo­city, while the x-axis rep­res­ents time, t. The start of the pos­i­tion hold­ing func­tion is shown by the orange arrow and dashed line. The peri­od fol­low­ing the green dashed line is the SOS peri­od.

SOS can­not be used for the emer­gency stop func­tion. Under cer­tain con­di­tions it may be used when guard inter­locks are opened, i.e., the guard door on a CNC lathe is opened so that the oper­at­or can place a new work­piece.

There a quite a few addi­tion­al “safe” drive func­tions. For more on these func­tions and how to imple­ment them, see [2] and applic­a­tion data from your favour­ite drive man­u­fac­turer. Ref­er­ence is also provided in [9, Table 5.2].

Safe Standstill

Safe stand­still is a con­di­tion where motion has stopped and is being mon­itored by a safety-rated device whose out­put sig­nals are used to con­trol the release of guard lock­ing devices. Safe stand­still is not the same as zero-speed because zero-speed can be achieved without the use of safety-rated con­trol com­pon­ents and design, while safe stand­still requires both suit­able com­pon­ents and design.

There are vari­ous ways to achieve safe stand­still. Here are three approaches [12]:

  1. Rota­tion sensors
    Sensors includ­ing prox­im­ity sensors, resolv­ers, and encoders can be used to mon­it­or the motion of the drive com­pon­ents. A safe stand­still mon­it­or­ing device is used to when stand­still has occurred.  When a machine has an unstable rest pos­i­tion, a prox­im­ity sensor should be used to ensure the machine is in a safe con­di­tion before the guard lock­ing devices are released.
  2. Back EMF mon­it­or­ing
    Back elec­tro­mot­ive force or Back EMF is the voltage cre­ated in an elec­tric motor due to the rota­tion of the arma­ture in the mag­net­ic field in the motor. This voltage opposes the applied voltage and is approx­im­ately pro­por­tion­al to the rota­tion­al speed of the motor. Back EMF remains after the sup­ply voltage has been removed, allow­ing mon­it­or­ing devices to indir­ectly meas­ure motor speed and stand­still.
  3. Failsafe timer
    Failsafe timers are time delay relays designed for use in safety func­tions. Failsafe timers can be used when the stop­ping per­form­ance of the machinery is con­sist­ent and known.
    Fol­low­ing remov­al of power from the drive motor, the time delay starts. At the end of the time delay, the relay releases the guard lock­ing devices.
    Reg­u­lar time delay relays can­not be used for this pur­pose, only fail-safe relays designed to be used in safety func­tions can be used, along with suit­able safety sys­tems design tech­niques like ISO 13849 or IEC 62061.


As you can see, there are sig­ni­fic­ant dif­fer­ences between STO, SS1, SS2, SOS and Safe Stand­still. While these func­tions may be used togeth­er to achieve a par­tic­u­lar safety func­tion, some are func­tions of the imple­ment­a­tion of the motor drive, e.g., STO. Some are a func­tion of the design of the motor drive itself, e.g., STO, SS1, SS2, and SOS, or the design of con­trols extern­al to the motor drive, e.g., safe stand­still. The sim­il­ar­it­ies between these vari­ous func­tions can make it easy to con­fuse them. Care needs to be taken to ensure that the cor­rect tech­nic­al approach is used when real­ising the safety func­tion required by the risk assess­ment.


[1]    “Vari­able Fre­quency Drives – Indus­tri­al Wiki – odesie by Tech Trans­fer”,, 2017. [Online]. Avail­able: [Accessed: 19- Jun- 2017].

[2] “Safe Torque Off (STO) – Safety Integ­rated – Siemens”,, 2017. [Online]. Avail­able: [Accessed: 19- Jun- 2017].

[3]      Adjustable speed elec­tric­al power drive sys­tems – Part 5 – 2: Safety require­ments – Func­tion­al. IEC Stand­ard 61800 – 5-2. 2nd Ed. 2016.

[4]     Safety of machinery — Elec­tric­al equip­ment of machines — Part 1: Gen­er­al require­ments. IEC Stand­ard 60204 – 1. 2006.

[5]     Safety of machinery — Pre­ven­tion of unex­pec­ted start-up. EN Stand­ard 1037+A1. 2008.

[6]     Safety of machinery — Pre­ven­tion of unex­pec­ted start-up. ISO Stand­ard 14118. 2000.

[7]     “Safe Stop 1 (SS1) – Safety Integ­rated – Siemens”,, 2017. [Online]. Avail­able: [Accessed: 19- Jun- 2017].

[8]     “Safe Stop 2 (SS2) – Safety Integ­rated – Siemens”,, 2017. [Online]. Avail­able: [Accessed: 19- Jun- 2017].

[9]     “Safe Oper­at­ing Stop (SOS) – Safety Integ­rated – Siemens”,, 2017. [Online]. Avail­able: [Accessed: 19- Jun- 2017].

[10]     M. Hauke, M. Schae­fer, R. Apfeld, T. Boe­mer, M. Huelke, T. Borowski, K. Bülles­bach, M. Dorra, H. Foer­mer-Schae­fer, W. Grigulewitsch, K. Hei­mann, B. Köhler, M. Krauß, W. Küh­lem, O. Loh­maier, K. Mef­fert, J. Pil­ger, G. Reuß, U. Schuster, T. Seifen and H. Zil­li­gen, “Func­tion­al safety of machine con­trols – Applic­a­tion of EN ISO 13849 – Report 2/2008e”, BGIA – Insti­tute for Occu­pa­tion­al Safety and Health of the Ger­man Social Acci­dent Insur­ance, Sankt Augustin, 2017.

[11]     “Gloss­ary”,, 2017. [Online]. Avail­able: [Accessed: 10- Jan-2018].

[12]     Schmersal Tech Briefs: Safe Speed & Stand­still Mon­it­or­ing. Schmersal USA, 2017.


Spe­cial thanks go out to two of my reg­u­lar read­ers for sug­gest­ing this post: Matt Ernst and con­trols­girl, who com­ments fre­quently. Thanks for the ideas and the ques­tions that sparked this post!