The number that matters is stopping time: the interval from pressing the emergency stop until hazardous conveyor motion and stored-energy effects reach a safe state. For this cabinet, the normal design choice is to keep the separate 230 V AC supply and its 24 V DC control system energized while the emergency-stop function removes the source of hazardous motion. Disconnect control power only when the risk assessment identifies a hazard that remains energized through that supply.
Common fixes that miss the hazard
| Attempted fix | Why it can fail | Required decision |
|---|---|---|
| Disconnect the 230 V AC control-power feeder | It removes diagnostics, communications, input feedback, and controlled reset capability without necessarily shortening the mechanical stopping time. | Trace every 24 V DC load and determine whether any load can create hazardous motion, release a brake, or energize another hazard. |
| Assume two series contactors are automatically sufficient | Redundancy alone does not establish the required reliability. Common-cause failures, welded contacts, incorrect feedback logic, and unsuitable contactor placement remain possible. | Derive the safety function and required architecture from the machine risk assessment. |
| Assume removing 400 V AC stops the VFD immediately | A VFD contains a rectifier, DC-link energy storage, an inverter, and control electronics. Opening its incoming supply does not instantly remove stored energy or guarantee a defined stopping ramp. | Measure the complete stop and identify how torque and braking are removed. |
| Treat NC auxiliary feedback as the stopping function | Feedback detects contactor state; it does not remove energy. A welded or mechanically failed device must cause a detected fault and inhibit restart. | Validate both the shutdown path and the monitored-reset behavior. |
| Use the emergency stop for maintenance access | An emergency stop can leave electrical energy, DC-link voltage, gravity, inertia, and unexpected-restart hazards present. | Use guarding for normal operation and lockout/tagout for servicing. |
Energy and stopping mechanism
This is energy and timing, not PLC logic. Opening contactors carrying the conveyor's 400 V AC supply stops new energy entering the interrupted circuit, but the rotating load retains kinetic energy and the VFD retains electrical energy in its DC link. The conveyor continues moving until friction, a controlled deceleration function, or a mechanical brake dissipates that energy.
The statement that the VFD has an implemented brake is not specific enough for a safety decision. Identify whether this means a VFD deceleration function, a braking resistor, DC-injection braking, or a separate mechanical holding brake. Each behaves differently after main power is removed. A holding brake may be sized primarily to hold a stationary load rather than arrest the full moving inertia, and its release circuit may depend on the 24 V DC supply.
First determine where the two contactors sit. If they interrupt the VFD input, DC-link energy remains after they open. If they interrupt the motor circuit, confirm that the VFD and contactors permit output switching under the applicable operating conditions; opening a loaded VFD output can stress the equipment and may not produce the intended stop. Read the drive manual for its supported safety and stopping functions rather than inferring them from the power diagram.
Safety-function decision inputs
Define the function in operational terms: pressing any emergency-stop device must bring the conveyor to a safe state, prevent hazardous restart, detect relevant switching failures, and retain that state until a deliberate reset. The required fault tolerance comes from the risk assessment, including access to the chain, load movement, trapping or crushing points, run-down distance, gravity, and the consequence of a dropped or released load.
| Quantity or limit | Where to read or measure it | Why it matters |
|---|---|---|
| Emergency-stop reaction time | Timestamp the input transition at the FDI channel and the commanded transition at the FDQ channel |
Separates control-system delay from drive and mechanical stopping time. |
| Mechanical stopping time and distance | Measure at the conveyor under the highest credible speed and load | Determines whether a person can reach the hazard before motion stops. |
| DC-link discharge state | Use the VFD's indicated status and the discharge instructions in its manual | Main contactors opening does not prove that internal voltage is absent. |
| Contactor state | Monitor positively linked auxiliary contacts where specified by the selected devices | Detects failure to open and blocks reset or restart. |
| Brake type and capacity | Read the drive and brake documentation; compare with the moving load and inertia | Distinguishes controlled stopping from holding after the stop. |
| Loads supplied by 24 V DC | Trace the cabinet schematics and field wiring | Reveals valves, brake-release circuits, outputs, or actuators that could preserve a hazard. |
Check the applicable editions and machine scope of EN619, 60204, and 13849-1/2 during the assessment. These documents guide the design and validation process; the presence of two contactors does not by itself demonstrate conformity.
Power-separation procedure
- Mark every energy path on the schematic: the 400 V AC path, the separate 230 V AC feeder, the 24 V DC distribution, the VFD DC link, brake circuits, and mechanical stored energy.
- List every device powered from 24 V DC. Classify each as diagnostic/control only or capable of causing motion, releasing stored energy, defeating guarding, or energizing another hazardous output.
- Define the required stop behavior from the risk assessment. Include the safe state, maximum acceptable stopping distance, restart inhibition, and response to a welded contactor or broken feedback wire.
- Identify whether the 400 V AC contactors are on the VFD line side or motor side. Verify their ratings, switching duty, coordination, and permitted placement against the contactor and VFD documentation.
- Determine whether the installed VFD provides a documented safety function such as STO. Use it only if the exact drive supports it and the complete function, wiring, diagnostics, and reset architecture meet the risk-assessment requirement.
- Keep the 230 V AC and 24 V DC control supply energized when its loads are nonhazardous. This preserves PROFIBUS communications, diagnostics, contactor monitoring, and controlled reset.
- If a 24 V DC load can sustain a hazard, isolate that hazardous branch through the required safety architecture instead of unnecessarily blacking out every control load.
- Configure restart so releasing the emergency-stop button cannot restart the conveyor. Require a deliberate reset followed by a separate start command, with all monitored devices in their expected safe states.
Measured verification
Test the function with the conveyor at the highest credible operating speed and load defined by the assessment. Record the emergency-stop input transition, output command, contactor opening, end of motor torque, and final cessation of motion. The measured stopping distance must remain inside the protective-distance assumption used for guards and access points.
Repeat the test for each emergency-stop device and each relevant operating mode. Introduce one detectable fault at a time using the validation method for the selected architecture: prevent one contactor from changing state, interrupt a feedback path, remove communications, and cycle control power. A detected discrepancy must prevent reset or restart rather than disappear when the operator releases the button.
With the 230 V AC supply left on, verify that the PLC or safety controller retains useful diagnostics, both contactor states are visible, communications remain available, and no 24 V DC output can initiate hazardous motion. Confirm that restoring 400 V AC after an interruption cannot produce an automatic restart.
Recurring integration pitfalls
- Placing contactors without establishing whether they switch the VFD input or output.
- Using ordinary output logic, SCADA commands, or network communications as the safety action.
- Monitoring two contactors through feedback that cannot distinguish their individual states.
- Removing control power and thereby hiding a welded contact, broken wire, or drive diagnostic.
- Calling a drive-controlled ramp or holding brake an emergency stop without measuring its behavior after power removal.
- Validating an unloaded conveyor while the worst stopping time occurs with the maximum credible load.
- Allowing emergency-stop reset, safety-system reset, and machine start to occur through one action.
FAQ
Why does the 24 V DC supply normally stay on during an emergency stop?
It keeps diagnostics, PROFIBUS communication, contactor feedback, and reset logic available. Leave it energized when the traced 24 V DC loads cannot create or maintain a hazard.
Why does opening the 400 V AC contactors not prove the conveyor is safe?
The VFD DC link and the moving conveyor retain energy after the contactors open. Measure stopping time and distance, identify the braking method, and verify that no stored-energy effect remains hazardous.
When should conveyor E-stop design be escalated to official support?
Stop commissioning when the contactor location, brake function, VFD stopping behavior, required safety architecture, or measured stopping distance cannot be validated from the machine documentation and risk assessment. Contact the VFD and safety-component manufacturers through their official support channels for approved switching arrangements and function data. Use a qualified machine-safety engineer when the required risk reduction or validation method remains unresolved.