STO vs OFF2 on SINAMICS G120: Safety Integrated Explained

Overview

The SINAMICS G120 modular drive family includes the CU240E-2 F Control Unit, a fail-safe variant that supports the Safety Integrated Extended Functions defined in IEC 61800-5-2:2016. Two of the most frequently confused stop behaviors on this platform are the standard OFF2 command and the Safe Torque Off (STO) function. Both ultimately remove torque from the motor, both can be wired to a digital input, and both can be triggered by a normally-closed emergency-stop contact. They are not equivalent.

OFF2 is a functional stop command inherited from the legacy drive command set; it cancels the IGBT gate pulses and lets the motor coast. STO is a certified, two-channel, fault-tolerant safety function that performs the same physical action through two independent shutdown paths and a self-diagnostic mechanism that detects when one path has failed. In the happy path the motor behavior is identical. The difference becomes visible the moment a single fault occurs: a wire shorts to 24 V, a contact welds closed, a transistor fails short, or an external source backfeeds into a broken cable. With OFF2 the drive may continue to produce torque in that faulted state. With STO the diagnostic coverage forces a safe state and the operator is notified.

This distinction is not paperwork. It is the reason a stop command wired to DI0 with a single wire from an E-stop button cannot meet Category 3 / PL d per ISO 13849-1:2015 or SIL 2 per IEC 61508:2010, while the same E-stop button wired with two channels to F-DI0 and F-DI1 of a CU240E-2 F, configured as STO, can reach SIL 3 / PL e / Category 4.

Stop Function Taxonomy on SINAMICS G120

SINAMICS G120 separates its stop and safety behaviors into three classes. The first three rows are functional commands defined in the generic drive standard IEC 61800-2. They are part of the PROFIdrive command set and are not subject to functional-safety certification. The remaining rows are Safety Integrated functions defined in IEC 61800-5-2:2016 and are subject to the full functional-safety lifecycle.

STO Architecture: How Two-Channel Safety Works

STO on the CU240E-2 F is implemented through two independent shutdown paths. The two F-DI signals are sampled by separate fail-safe input processors, debounced, and compared for discrepancy. The two gate-driver enable lines are ANDed with the diagnostic result before reaching the IGBT module.

Both processors must agree that the safety request is active before the pulses are inhibited. The agreement check is the discrepancy time, and the diagnostic check that one channel has not stuck is performed by cross-circuit detection and by the dynamic forced checking procedure.

OFF2 Architecture: Standard Single-Channel Stop

OFF2 is the legacy drive-level stop. It is invoked by either a control word bit (STW1.1 in PROFIdrive) from the PLC or a standard digital input configured via p0701..p0705 on the CU240E-2. The reaction is immediate pulse inhibit on the single signal path. There is no second channel, no discrepancy monitoring, no cross-circuit detection, and no test requirement.

If the wiring from the E-stop button to DI0 breaks, or the contact welds closed, OFF2 may not be invoked. The drive will not detect the fault. In a single-fault scenario, OFF2 cannot meet any functional-safety requirement.

Two-Channel vs One-Channel Wiring

The core architectural difference is redundancy. STO requires two independent signal paths from the safety sensor (E-stop, light curtain, guard-door interlock) to the two fail-safe digital inputs of the drive. The two wires are run separately; they are not shorted together at the sensor. Each is monitored, and the drive expects to see the same state on both at all times.

If one wire shorts to 24 V (active signal level), the second wire must still carry the de-energize state for the drive to enter STO. If one wire breaks, the second wire must still drive the safety state. The drive periodically executes a dynamic test where it briefly toggles one channel to verify the other responds. This is the forced checking procedure described in IEC 61800-5-2:2016 Section 4.2.2.2.

This is fundamentally different from a single-wire design where the drive has no way of knowing whether the wire is broken, shorted, or whether the contact in the E-stop has welded. The single-wire design provides a single point of failure; the two-wire design provides fault tolerance with diagnostic coverage.

Cross-Circuit and Discrepancy Detection

Two specific failure modes are targeted by the two-channel architecture:

1. Cross-circuit. A short between the two signal wires. If a wire breaks and shorts to the other wire, both signals show the same level permanently. The drive detects the cross-circuit during the test stop when one channel is forced and the other is expected to follow.
2. Discrepancy. One channel changes state, the other does not follow within p9650. This is caused by a welded contact, a broken wire, a failed input stage, or a backfeed from an external source. The drive declares fault F01611 or F01612, latches the safety state, and forces torque removal.

In both cases, the safety function remains active (torque remains removed) and the drive refuses to restart without an explicit safety acknowledgment. The operator is forced to investigate the cause.

Standards Mapping: SIL, PL, Category

The functional-safety properties of STO on the CU240E-2 F are documented in the Siemens Safety Integrated Function Manual, which is part of the SINAMICS G120 documentation set. The relevant standards are:

• IEC 61800-5-2:2016 — defines the STO function, its behavior, and required test intervals.
• IEC 61508:2010 — functional safety of E/E/PE safety-related systems. The PFHd (probability of dangerous failure per hour) for the CU240E-2 F STO function is published in the safety manual.
• ISO 13849-1:2015 — Performance Level (PL a–e) and Category (1–4) framework. The CU240E-2 F with STO can achieve PL e / Category 4 when wired with two channels and a properly qualified safety sensor.

The exact PFHd value must be confirmed from the safety manual shipped with the firmware version in use. The achievable level depends on the connected sensor architecture and the wiring method (single-channel vs two-channel with or without cross-fault detection).

CU240E-2 F Parameter Configuration

1. Enable Safety Integrated Extended Functions: p9601 = 1.
2. Confirm the F-DI assignment. F-DI0..F-DI3 on the CU240E-2 F are physically separate terminals from standard DI0..DI5; verify with the terminal diagram in the operating instructions.
3. Set the discrepancy time p9650. Siemens recommends 100 ms for typical E-stop applications. The value must exceed the worst-case contact bounce plus propagation through any intermediate safety relay.
4. Set the filter time p9651 (typical 1 ms) to debounce the input.
5. Set p9660 (forced checking procedure timer) to 8 h default. After 8 h without a dynamic test of the STO path, the drive requests a test stop.
6. Assign the F-DIs to the safety group: p10002[0] = 0 (F-DI0 to group 1), p10002[1] = 1 (F-DI1 to group 1).
7. Power-cycle the drive to activate the safety parameters. The drive will report a safety-parameters-changed warning until the cycle is complete.

; Commissioning example: STO extended, two-channel, 8 h test interval
p9601 = 1          ; SI enable extended functions
p9650 = 100        ; SI STO/SS1 discrepancy time, ms
p9651 = 1          ; SI STO/SS1 filter, ms
p9652 = 1          ; SI STO enable (extended)
p9660 = 8          ; SI forced checking procedure timer, h
p10002[0] = 0      ; F-DI0 assigned to STO group 1
p10002[1] = 1      ; F-DI1 assigned to STO group 1
; After write: power cycle required, then run acceptance test

Periodic Test / Forced Checking Procedure

IEC 61800-5-2:2016 Section 6.2 requires that STO be exercised periodically so that dangerous, undetected faults are exposed. The CU240E-2 F implements this as the forced checking procedure (in IEC terminology) or test stop. The drive expects the operator to:

1. Trigger the safety function (operate the E-stop or open the safety loop).
2. Verify the drive removes torque.
3. Release the safety function.
4. Verify the drive re-enables the pulses only after a deliberate restart acknowledgment.

If the operator does not trigger the safety function within p9660, the drive requests the test stop via alarm A01695. If the test is still not performed, the drive escalates to fault F01695 and latches the safe state. The latched state can only be cleared after a successful test stop and a safety acknowledgment.

The interval is application-dependent. The default 8 h is suitable for typical industrial machinery. For low-demand applications the interval can be extended up to 8760 h (one year) per IEC 61800-5-2:2016 Table D.1, but only if a manual test is performed and documented at least once per year.

Fault Reactions and Acknowledgment

A safety fault is not the same as a standard drive fault. Standard drive faults (F-class faults in the 0xxx range) are cleared with a normal fault acknowledgment. Safety faults (F016xx range) require:

1. The cause to be removed.
2. A safety acknowledgment via one of: p3981 = 0 at the drive; a digital input mapped via p10006 (SI STO acknowledgment); the PROFIsafe control word bit S_STW1.7 on a PROFINET-connected F-CPU; or the Startdrive / STARTER commissioning tool during initial acceptance.

A standard drive fault clear (p3981 = 1 or a PLC fault reset) will not clear a safety fault. The drive remains in the safe state and the safety stack remains latched.

Commissioning Checklist

Verification and Acceptance Test

The acceptance test is mandatory. Per IEC 61800-5-2:2016 and ISO 13849-1:2015, a safety function cannot be put into service without a documented acceptance test. The test must verify, at minimum:

1. The safety sensor triggers the safety function on demand.
2. The drive removes torque within the required reaction time (typ. < 5 ms for STO on the CU240E-2 F).
3. The drive remains in the safe state while the safety request is active.
4. The drive does not auto-restart; a deliberate restart acknowledgment is required.
5. A single fault in the wiring (open circuit, short circuit, cross-circuit) is detected and forces the safe state.
6. The discrepancy fault is generated when one channel is forced to a different state than the other.

The acceptance protocol must include the achieved PFHd, PL, SIL, Category, mission time, and the date of the next scheduled periodic test.

Diagnostic Output

The drive exposes a number of read-only parameters useful for diagnostics:

• r9771 — SI common diagnostics (bit field; bit 0 = STO active).
• r9780 — SI status word.
• r9794 — SI cross-check status.
• r10051 — SI F-DI diagnostics (bit per F-DI).

A supervisory PLC should read r9771.0 over cyclic PROFIdrive and verify it matches the commanded state. Mismatch indicates either a sensor fault, a wiring fault, or a safety stack fault.

Interaction with PROFIsafe

When the SINAMICS G120 is connected to a SIMATIC F-CPU over PROFINET with PROFIsafe, the F-DI configuration may be replaced by PROFIsafe control bits. STO is then commanded via S_STW1.0 in the PROFIsafe telegram. The two-channel property is maintained by the PROFIsafe protocol itself, which uses a 24-bit CRC for each telegram. The acceptance test must cover the PROFIsafe bus and the upstream sensor wiring separately.

Common Misconceptions

Quick-Reference Decision Tree

Field Notes and Practical Cautions