SINAMICS S210 Delayed Emergency Stop SS1 to STO Safety Function

Overview

The Siemens SIMATIC MLFB 6AG1067-1AA33-0AA0 demo case bundles a SINAMICS S210 single-axis servo drive together with a delayed emergency stop. The delay is not an accidental hardware timing artifact; it is the intentional, configured behavior of an SS1 (Safe Stop 1) safety function that hands off to STO (Safe Torque Off) after a parameterizable waiting period. The demo case uses that mechanism to (a) bring the motor to a controlled standstill within the SS1 window, (b) suppress nuisance trips caused by short noise pulses on the E-Stop input, and (c) display the active safe state on the S210's front-panel LEDs. The wiring diagram for the E-Stop switch and the safety function description are shipped with the documentation referenced in the Siemens Industry Online Support entry 109743134, chapter 9.

This reference explains the underlying safety functions per IEC 61800-5-2, the state transitions inside the delayed E-Stop, the wiring of the hardware E-Stop loop, the parameterization in SINAMICS Startdrive, the LED pattern that visualizes each state, and the field verification procedure used during commissioning.

Identifying the Demo Case Hardware

Order number 6AG1067-1AA33-0AA0 decodes as a SIMATIC / SINAMICS demo case in the 6AG1 (SIPLUS / Industry Demo) prefix range. The case is delivered pre-wired and ready for bench demonstrations of the SINAMICS S210 servo drive system. The relevant components are:

Safety Function Fundamentals per IEC 61800-5-2

The delayed E-Stop behavior is a textbook application of the safety stop functions defined in IEC 61800-5-2:2016, clause 4.2:

• STO (Safe Torque Off) – the drive no longer supplies energy to the motor that can produce torque. The power section is electronically isolated. STO is the safe state of the drive and corresponds to stop category 0 in EN 60204-1.
• SS1 (Safe Stop 1) – initiate motor deceleration, monitor the deceleration (time-controlled or ramp-monitored), and after a defined delay transition to STO. SS1 corresponds to stop category 1 in EN 60204-1.
• SS2 (Safe Stop 2) – controlled stop with SOS retained; the motor remains under closed-loop control.
• SOS (Safe Operating Stop) – the motor is held in position with active closed-loop control.

SS1 comes in two variants per IEC 61800-5-2:

On the S210 demo case, the SS1-t variant is implemented, which is the simplest and most common configuration when the only purpose of the delay is to absorb noise and to provide a controlled shutdown before torque removal.

Why a Delayed E-Stop Exists

A pure, immediate STO wired to a hard E-Stop button is correct but is often too aggressive in installations with:

• Vertical or suspended loads that would drop on STO;
• Inertia that needs an orderly ramp down to prevent mechanical shock;
• E-Stop contacts that may bounce or pick up noise from electromagnetic interference.

The delayed E-Stop in the demo case adds a debounce / safety window at the input. As Siemens technical support for the S210 confirms: the delay is provided to avoid unnecessary system failure due to noise in the input signal. The drive enters SS1 immediately on the rising edge of the E-Stop request, but the SS1 delay time is typically long enough to ignore transients. If the input returns to a safe "release" state within the window, the drive cancels SS1 and returns to normal operation. If the input is still active when the window expires, the drive drops into STO.

Delayed Emergency Stop State Machine

The following state diagram captures the transitions executed inside the S210 safety logic when the E-Stop is operated:

State transition summary:

1. RUN → SS1 active: rising edge on the E-Stop input, the drive safety logic requests SS1. The drive's ramp generator decelerates the motor along the configured OFF3 ramp (e.g. p1135, p1136).
2. SS1 active → RUN: if the E-Stop is released (de-bounced) before the SS1 delay expires, the safety request is withdrawn and normal operation resumes.
3. SS1 active → STO active: when the SS1 delay time (p9652) expires with the request still active, the safety logic activates STO. The drive's power output stages are inhibited.
4. SS1 active → Fault: if the safety monitoring detects a violation (speed above expected band, missing cross-check between processor channels, etc.), the drive latches a safety fault and requires a deliberate reset.

Wiring the E-Stop to the S210

The S210 receives safety requests through two redundant, short-circuit-tolerant digital inputs on the X1 connector block, often labelled DI 0+ / DI 0- and DI 1+ / DI 1- (or SGE0 and SGE1 in parameter lists). The E-Stop is wired as a two-channel normally-closed contact:

Key wiring rules:

• Each channel of the E-Stop must use its own dedicated wire pair; do not share return conductors between the two channels.
• Route the safety cables separately from motor and line-side power cables (typically ≥ 200 mm clearance) to avoid capacitive cross-coupling.
• Use shielded cable grounded at one end if cable length exceeds 30 m.
• Confirm the input debounce filter in the safety parameter set (e.g. p9650 / p9651) matches the mechanical bounce time of the contact.

Parameterization in SINAMICS Startdrive

All safety functions on the S210 are configured through the SINAMICS Startdrive commissioning tool (part of TIA Portal) or directly through the drive's Web server / HMI. The relevant parameter group is S_Safety / p96xx:

Procedure to set the SS1 delay time on the demo case:

1. Connect Startdrive to the S210 via PROFINET or service interface.
2. Open the safety view; authenticate with the safety password (p9761).
3. Navigate to Safety Integrated > Stop functions > SS1.
4. Set p9652 to the desired SS1 delay. Siemens technical support uses 2 000 ms as an illustrative value for the demo case.
5. Verify the OFF3 ramp in p1135 is suitable for the connected load (vertical axis requires a brake and a holding torque check).
6. Accept the parameter change with Copy RAM to ROM and restart the safety commissioning to compute checksums (p9798 / p9898).

LED Status Behavior

The S210 demo case has an LED panel on the operator plate. The SS1/STO progression is visible on the safety LED:

The "delayed E-Stop" is therefore observable in two ways: the SAFE LED turns yellow before it turns red, and the E-Stop LED is yellow while the SS1 window is open. Operators on the shop floor can read the difference between "the button is currently requested" and "the drive is in the safe state".

Verification and Acceptance Test

After configuring the delayed E-Stop, run a structured acceptance test. The test confirms the response time, the LED behavior, the noise immunity, and the ability to recover.

1. Pre-test: ensure the motor is unloaded or that the load is mechanically safe. Confirm a working E-Stop reset path.
2. Press the E-Stop: SAFE LED goes yellow, drive begins OFF3 ramp. Record the time between E-Stop actuation and the SAFE LED turning red. Expect (p9652) ± 5 %.
3. Release during the delay: twist-release the E-Stop before p9652 expires. SAFE LED returns to off, RDY LED returns to steady green within 1 s.
4. Release after STO: with SAFE LED red, release the E-Stop and acknowledge. RDY LED returns to green. The drive will not re-enable the power section until the controller re-issues the Enable command (no automatic re-enable after STO).
5. Noise test: generate 1 ms – 50 ms transients on the SGE0 input. The drive must not latch STO if the transient is shorter than p9651 (debounce).
6. Cross-check test: open only one of the two SGE channels. The drive must raise a safety fault after p9650 (discrepancy time) elapses.
7. Document: print or export the parameter report from Startdrive and archive it together with the operator checklist. Safety-relevant parameter changes require a signed acceptance protocol.

Troubleshooting Matrix

Comparison: Immediate STO vs. Delayed SS1 E-Stop

Field Notes and Best Practices

• Always size the SS1 delay longer than the worst-case contact bounce of the E-Stop button. Industrial twist-release E-Stops typically bounce 5 ms – 20 ms; 50 ms is a safe debounce and 2 000 ms is a common SS1 delay for demonstration purposes.
• Keep SS1 delay shorter than the time a human operator expects the system to react. Values above 5 s in interactive applications are perceived as a fault.
• For vertical loads, keep the drive's closed-loop torque enabled during SS1 and add a safe-brake-control sequence (SBC) so the holding brake engages only after STO is reached.
• Log the safety parameter set. The drive stores the checksum (p9798, p9898) which the acceptance test must compare against the engineering record.
• Use Startdrive's safety trace to capture p9649 / p9650 / p9651 / p9652 / r9772 in real time when a sporadic fault is reported.
• Treat the demo case as a teaching tool, not a reference installation. The wiring and parameters of 6AG1067-1AA33-0AA0 are designed for clarity, not for a particular safety category. Production machinery must be re-engineered to its own risk assessment and EN ISO 13849-1 / IEC 62061 target.

Related Standards and Documentation

• Siemens Industry Online Support entry 109743134 — SINAMICS S210 demo case documentation, chapter 9 contains the E-Stop wiring and safety function description.
• SINAMICS S210 product page — drive family, firmware, and safety options.
• TIA Portal / Startdrive — engineering and commissioning tool.
• IEC 61800-5-2:2016 — Adjustable speed electrical power drive systems, Part 5-2: Safety requirements, Functional.
• EN ISO 13849-1:2023 — Safety of machinery, safety-related parts of control systems.
• EN 60204-1:2018 — Safety of machinery, electrical equipment of machines, stop categories.

Frequently Asked Questions