Rockwell Automation Allen-Bradley PowerFlex 7000 Series User manual

PowerFlex 7000 Series
Safe Torque Off
Bulletin Numbers 7000A, 7000, 7000L
User Manual Original Instructions

2Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
PowerFlex 7000 Series Safe Torque Off User Manual
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize
themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to
be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be
impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use
or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software
described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is
prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may
lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or
economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may
be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach
dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc
Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements
for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 3
Table of Contents
Preface
About This Publication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Download Firmware, AOP, EDS, and Other Files . . . . . . . . . . . . . . . . . . . . 5
Summary of Changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Abbreviations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Chapter 1
General Description What Is the PowerFlex 7000 Drive Safe Torque Off Option? . . . . . . . . . . 7
Safety Standards Applied To Safe Torque Off Option . . . . . . . . . . . . . . . . 8
Chapter 2
Safety Concept Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Safety Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Important Safety Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Safety Cat. 3 Performance Definition . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Stop Category Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Performance Level and Safety Integrity Level (SIL) CL3. . . . . . . . . . 10
Functional Proof Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
PFD and PFH Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Safety Parameter Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Safe State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Safety Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Considerations for Safety Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Contact Information if Safety Option Failure Occurs . . . . . . . . . . . . . . . 12
Chapter 3
Operation, Installation, and
Wiring
PowerFlex 7000 Drive Safe Torque Off Operation . . . . . . . . . . . . . . . . . . 13
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Drive Input Isolation Device Interlock . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Product Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Parameter Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Commissioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Verify Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Chapter 4
System Components STO System Components Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Optical Interface Boards 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Replace Optical Interface Board 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Optical Interface Base Board Safety. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Replace Optical Interface Base Board Safety. . . . . . . . . . . . . . . . . . . . 28
Optical Interface Base Board Safety Test Points . . . . . . . . . . . . . . . . 29

4Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Appendix A
Specifications Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
General Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Certifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
CE Conformity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Machinery Directive (2006/42/EC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
EMC Directive (2014/30/EC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Appendix B
Spare Parts and Preventative
Maintenance
Spare Parts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Preventative Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Appendix C
History of Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 5
Preface
About This Publication This manual explains how PowerFlex® 7000 drives with Safe Torque Off option
can be used in Safety Integrity Level (SIL) CL3, Performance Level [PLe], or
Category 3 (Cat. 3) applications. It describes the safety requirements, including
PFD and PFH values and application verification information, and provides
information on installing, configuring, and preventative maintenance of the
Safe Torque Off option.
Use this manual if you are responsible for designing, installing, configuring, or
troubleshooting safety applications that use the PowerFlex 7000 drive with
Safe Torque Off option.
We recommend that you have a basic understanding of the electrical circuitry
and familiarity with these products. You must also be trained and experienced
in the creation, operation, and maintenance of safety systems.
Download Firmware, AOP,
EDS, and Other Files
Download firmware, associated files (such as AOP, EDS, and DTM), and access
product release notes from the Product Compatibility and Download Center at
rok.auto/pcdc.
Summary of Changes This publication contains the following new or updated information. This list
includes substantive updates only and is not intended to reflect all changes.
Topic Page
Updated standard number that STO satisfies 7
Updated all safety standards applied to STO 8
Updated safety standard number 10
Updated machinery directive standards 32
Updated EMC directive number and standard 32
Updated EU Declaration of Conformity 33
Added History of Changes appendix 37

6Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Additional Resources These documents contain additional information concerning related products
from Rockwell Automation.
You can view or download publications at rok.auto/literature.
Abbreviations
Resource Description
HMI Interface Board Software Updater and Firmware Download Procedure,
publication 7000-QS002 Provides the procedure to update the HMI board software.
PowerFlex 7000 Medium Voltage AC Drive (Firmware Version 11.xxx) - ForGe
Control, publication 7000-TD002 Provides complete parameter listing for all PowerFlex 7000 medium voltage drives.
PowerFlex 7000 Medium Voltage AC Drive (ForGe Control) - Troubleshooting
Guide, publication 7000-TG002 Provides fault and warning messages, spare parts, and fault and warning codes for all PowerFlex 7000 medium voltage drives.
PowerFlex 7000 Medium Voltage AC Drive (A Frame) - ForGe Control,
publication 7000A-UM200
Provides detailed information on hardware replacement, overview, control and power
component definition, maintenance and specifications for air-cooled medium voltage
variable frequency drives.
PowerFlex 7000 HMI Offering with Enhanced Functionality,
publication 7000-UM201 Provides detailed information to configure, set up, operate, update and troubleshoot the
PowerFlex 7000 HMI Interface Board.
PowerFlex 7000 Medium Voltage AC Drive (B Frame) - ForGe Control,
publication 7000-UM202
Provides detailed information on hardware replacement, overview, control and power
component definition, maintenance and specifications for air-cooled medium voltage
variable frequency drives.
PowerFlex 7000 Medium Voltage AC Drive (C Frame) - ForGe Control,
publication 7000L-UM301
Provides detailed information on hardware replacement, overview, control and power
component definition, maintenance and specifications for liquid-cooled medium voltage
variable frequency drives.
EtherNet/IP Network Devices User Manual, ENET-UM006 Describes how to configure and use EtherNet/IP devices to communicate on the EtherNet/IP
network.
Ethernet Reference Manual, ENET-RM002 Describes basic Ethernet concepts, infrastructure components, and infrastructure features.
System Security Design Guidelines Reference Manual, SECURE-RM001 Provides guidance on how to conduct security assessments, implement Rockwell Automation products in a secure system, harden the control system, manage user access,
and dispose of equipment.
Industrial Components Preventive Maintenance, Enclosures, and Contact
Ratings Specifications, publication IC-TD002 Provides a quick reference tool for Allen-Bradley industrial automation controls and
assemblies.
Safety Guidelines for the Application, Installation, and Maintenance of
Solid-state Control, publication SGI-1.1
Designed to harmonize with NEMA Standards Publication No. ICS 1.1-1987 and provides
general guidelines for the application, installation, and maintenance of solid-state control in
the form of individual devices or packaged assemblies incorporating solid-state
components.
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines for installing a Rockwell Automation industrial system.
Product Certifications website, rok.auto/certifications. Provides declarations of conformity, certificates, and other certification details.
Abbreviation Description
DCavg Diagnostic Coverage (Average)
DIC Drive Input Contactor
DPM Drive Processor Module
ForGe Fourth Generation Control
MTTFdMean Time to Dangerous Failure
OIB2 Optical Interface Board (Rev. 2)
OIBBS Optical Interface Base Board Safety
PFD Probability of Failure on Demand
PFH Probability of a Dangerous Failure occurring per
Hour
PSD Power Structure Diagnostic
PWM Pulse Width Modulation
SCR Silicon Controlled Rectifier
SGCT Symmetrical Gate Commutated Thyristor
SPS Self-powered SGCT (Power Supply)
STO Safe Torque Off
STORK Safe Torque Off Retrofit

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 7
Chapter 1
General Description
The Safe Torque Off option is intended to be applied as a component in a
safety control system. Components in the system must be chosen and applied
appropriately to achieve the desired level of operational safety.
What Is the PowerFlex 7000
Drive Safe Torque Off
Option?
The PowerFlex™ 7000 Drive Safe Torque Off option:
• Is designed to help safely remove power from the gate firing circuits of
the drive’s power devices (SGCTs). This helps prevent the drive’s power
devices from switching in the pattern necessary to generate AC power to
the motor.
• Satisfies the STO definition in IEC 61800-5-2:2016.
• Can be used in combination with other safety devices to satisfy the
requirements of IEC 61508, IEC 61800-5-2 SIL 3, ISO 13849-1 PLe, and
Cat. 3 for Safe Torque Off (STO).
IMPORTANT This option is suitable for performing mechanical work on the
drive system or affected area of a machine only. It does not
provide electrical safety.
This option should not be used as a control for starting and/or
stopping the drive.
ATTENTION: Electrical Shock Hazard. Verify that all sources of AC and DC
power are de-energized and locked out or tagged out in accordance with the
requirements of ANSI/NFPA 70E, Part II.
ATTENTION: In safe-off mode, hazardous voltages may still be present at
the motor. To avoid an electric shock hazard, disconnect power to the motor
and verify that the voltage is zero before performing any work on the motor.
ATTENTION: There is a residual risk associated with four or more failures of
SCGTs within the drive that would cause torque to be developed even when
the PowerFlex 7000 Drive Safe Torque Option has controlled the drive
outputs to the off state. In this case, the drive may provide energy until the
published response time of 1000 ms has expired.
ATTENTION: Removal of power generation from the drive to the motor does
not ensure the motor will not rotate. Mechanical braking may be necessary
in order to prevent motor rotation. In the absence of motor braking, the
motor may continue to rotate or may start to rotate based on the inertia of
the load, stored energy in the load, or external forces.

8Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Chapter 1 General Description
Safety Standards Applied
To Safe Torque Off Option
The Safe Torque Off option satisfies applicable requirements in the following
standards related to functional and machinery safety.
• IEC 61508-1 to 7: 2010
• IEC 61800-5-2:2016
• IEC 61800-3:2017
• IEC 61800-5-1:2007 + A1:2016
• IEC 62061:2005 + A1:2012 + A2:2015
• ISO 13849-1:2015
• IEC 60204-1:2016
• EN 60204-11: 2000

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 9
Chapter 2
Safety Concept
Introduction This section describes the safety performance level concept and how the
PowerFlex™ 7000 drives can meet the requirements for SIL CL3, Cat. 3, or PLe
applications.
Safety Certification The PowerFlex 7000 drive safety option is certified for use in safety
applications up to and including SIL 3 according to IEC 61800-5-2, IEC 61508,
and IEC 62061, PLe, and Cat. 3 according to ISO 13849-1. Safety requirements
are based on the standards current at the time of certification.
The TÜV Rheinland group has approved the PowerFlex 7000 drive safety
option for use in safety-related applications where the de-energized state is
considered to be the safe state. All of the examples in this manual are based on
achieving de-energization as the safe state for typical Machine Safety and
Emergency Shutdown (ESD) systems.
Important Safety Considerations
The system user is responsible for:
• the set-up, safety rating, and validation of any sensors or actuators
connected to the system.
• completing a system-level risk assessment and reassessing the system
any time a change is made.
• certification of the system to the desired safety performance level.
• project management and proof testing.
• programming the application software and the safety option
configurations in accordance with the information in this manual.
• access control to the system.
• analyzing all configuration settings and choosing the proper setting to
achieve the required safety rating.
IMPORTANT When applying Functional Safety, restrict access to qualified,
authorized personnel who are trained and experienced.
IMPORTANT This safety function may be used where power removal is
required to prevent unexpected start-up.
ATTENTION: The drive should never be considered in a safe state unless the
safety function is active.

10 Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Chapter 2 Safety Concept
Safety Cat. 3 Performance Definition
To achieve Safety Cat. 3 according to ISO 13849-1:2015, the safety-related parts
have to be designed such that:
• the safety-related parts of machine control systems and/or their
protective equipment, as well as their components, shall be designed,
constructed, selected, assembled, and combined in accordance with
relevant standards so that they can withstand expected conditions.
• basic safety principles shall be applied.
• a single fault in any of its parts does not lead to a loss of safety function.
• the average diagnostic coverage of the safety-related parts of the control
system shall be medium.
• the mean time to dangerous failure of each of the redundant channels
shall be high.
• measures against common cause failure shall be applied.
Stop Category Definitions
The selection of a stop category for each stop function must be determined by a
risk assessment.
• Stop Category 0 is achieved with immediate removal of power to the
actuator, resulting in an uncontrolled coast to stop. Safe Torque Off
accomplishes a Stop Category 0 stop.
• Stop Category 1 is achieved with power available to the machine
actuators to achieve the stop. Power is removed from the actuators when
the stop is achieved.
Performance Level and Safety Integrity Level (SIL) CL3
For safety-related control systems, Performance Level (PL), according to ISO
13849-1, and SIL levels, according to IEC 61508 and IEC 62061, include a rating
of the system’s ability to perform its safety functions. All of the safety-related
components of the control system must be included in both a risk assessment
and the determination of the achieved levels.
Refer to the ISO 13849-1, IEC 61508, and IEC 62061 standards for complete
information on requirements for PL and SIL determination.
ATTENTION: When designing your system, consider how personnel will exit
the machine if the door locks while they are in the machine. Additional
safeguarding devices may be required for your specific application.
IMPORTANT When designing the machine application, timing and distance
should be considered for a coast to stop (Stop Category 0 or Safe
Torque Off). For more information regarding stop categories,
refer to IEC 60204-1.

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 11
Chapter 2 Safety Concept
Functional Proof Tests The functional safety standards require that functional proof tests be
performed on the equipment used in the system. Proof tests are performed at
user-defined intervals and are dependent upon the Probability of Failure on
Demand (PFD) and Probability of a Dangerous Failure occurring per Hour
(PFH) values.
PFD and PFH Definitions Safety-related systems can be classified as operating in either a Low Demand
mode, or in a High Demand/Continuous mode.
• Low Demand mode: where the frequency of demands for operation
made on a safety-related system is no greater than one per year or no
greater than twice the proof-test frequency.
• High Demand/Continuous mode: where the frequency of demands for
operation made on a safety-related system is greater than once per year
or greater than twice the proof test interval.
The SIL value for a low demand safety-related system is directly related to
order-of-magnitude ranges of its average probability of failure to satisfactorily
perform its safety function on demand or, simply, average PFD. The SIL value
for a High Demand/continuous mode safety-related system is directly related
to the PFH.
Safety Parameter Data PFH calculations are based on the equations from Part 6 of IEC 61508. MTTFd
and DCavg values are based on ISO 13849-1.
This table provides data for a 12-year mission time only if the safety function is
demanded at least once every 6 months, and demonstrates the worst-case
effect of various drive configuration changes on the data.
IMPORTANT Your specific application determines the time frame for the proof
test interval.
Table 1 - Reliability Data for 12-year Mission Time Test
Attribute Value(1)
(1) STO data for all medium voltage drive frames.
PFH 2.26 E-8 1/hour
SIL CL 3
PL e
Category 3
MTTFd803 years
DCavg 90%
HFT 1
PTI (Proof Test Interval) 12

12 Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Chapter 2 Safety Concept
Safe State The Safe State encompasses all operation that occurs outside of the other
monitoring and stopping behavior of the drive as defined as part of the normal
operation without the Safe Torque Off Option.
If a Functional Safety System Fault is detected, the safety option goes to the
Safe State. This includes faults related to integrity of hardware or firmware.
Safety Reaction Time The safety reaction time is the amount of time from a safety-related event as
input to the system until the system is in the Safe State.
The safety reaction time from an input signal condition that triggers a safe
torque off to safe state reached is 1000 ms (maximum).
Considerations for Safety
Ratings
The achievable safety rating of an application using the safety option installed
in PowerFlex 7000 drives is dependent upon many external factors.
For applications that rely on the immediate removal of power to the actuator,
resulting in an uncontrolled coast to stop, a safety rating up to and including
SIL CL3, PLe, and Cat. 3 can be achieved.
Contact Information if
Safety Option Failure
Occurs
If you experience a failure with any safety-certified device, contact your local
Rockwell Automation distributor. With this contact, you can:
• return the components to Rockwell Automation so the failure is
appropriately logged for the catalog number affected and a record is
made of the failure.
• request a failure analysis (if necessary) to determine the probable cause
of the failure.
IMPORTANT An input signal condition that is present for less than the reaction
time may not result in the safety function being performed. A
request of the safety function for less than the reaction time may
result in the detection of a fault.

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 13
Chapter 3
Operation, Installation, and Wiring
PowerFlex 7000 Drive Safe
Torque Off Operation
The PowerFlex™ 7000 Drive Safe Torque Off option disables the rectifier and
inverter SGCTs by removing the power supply to the fiber optic transmitters
that command the devices to turn on, and disabling the gating signals to those
fiber optic transmitters. The system satisfies the requirements of SIL3 for safe
turn off of torque. Figure 1 shows the block diagram of the STO option in the
PowerFlex 7000 drive.
The Safe Torque Off option is intended to be part of the safety related control
system of a machine. Before installation, a risk assessment should be
performed that compares the Safe Torque Off option specifications and all
foreseeable operational and environmental characteristics of the machine to
which it is to be fitted.
A safety analysis of the machine section controlled by the drive is required to
determine how often the safety function should be tested for proper operation
during the life of the machine.
The STO option is available in two types. The 24STO option is installed during
manufacturing of the drive and is intended for new drives. The 24STORK
retrofit option is intended for existing drives and is located on the LV Door
(see STO System Components Location on page 23) and must be installed by
Rockwell Automation.
ATTENTION: The following information is merely a guide for proper
installation. Rockwell Automation, Inc. cannot assume responsibility for the
compliance or the noncompliance to any code, national, local or otherwise
for the proper installation of this equipment. A hazard of personal injury
and/or equipment damage exists if codes are ignored during installation.
IMPORTANT The Safe Torque Off option does not eliminate dangerous
voltages at the drive output. Input power to the drive must be
turned off and safety procedures followed before performing any
electrical work on the drive or motor.
ATTENTION: There is a residual risk associated with four or more failures of
SCGTs within the drive that would cause torque to be developed even when
the PowerFlex 7000 Drive Safe Torque Option has controlled the drive
outputs to the off state. In this case, the drive may provide energy until the
published response time of 1000 ms has expired.
ATTENTION: By itself, the PowerFlex 7000 Drives Safe Torque Off option
initiates a coast-to-stop action. Additional protective measures will need to
be applied when an application requires a different stopping action.
IMPORTANT The status of the MV drive input device must be configured and
connected correctly to the safety system to prevent faults being
generated. For the system test function to work correctly on an
SPS drive, follow the recommended circuit as shown in Drive
Input Isolation Device Interlock on page 16.

14 Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Chapter 3 Operation, Installation, and Wiring
Figure 1 - Drive Safe Torque Off Block Diagram
Figure 2 - Example of PowerFlex 7000 Drive, Safe Torque Off Connection, Dual Channel
Circuit Status
Circuit shown with guard door closed and system ready for normal drive
operation.
Medium Voltage Source
Drive Input Isolation Device
STO Command and Reset
(Customer Safety Circuit)
M
MSR127
Safety Relay
700S-CF
Safety Control Relay
Rectifier InverterDC Link
GuardMaster
Trojan
Gate
STO Reset
D-1200
D-1201
D-1202
D-1203
D-1204
S12
S11
S22
S21
S34
PowerFlex 7000

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 15
Chapter 3 Operation, Installation, and Wiring
Operating Principle
The drive implements a dual channel system interface using an Allen-Bradley™
Minotaur™ MSR127 safety relay unit. Opening the gate door will switch the
input circuits to the safety relay (Figure 2). The output circuits of the safety
relay will signal each OIBBS (one for the rectifier bridge and one for the
inverter bridge) to go to the safe state. Each OIBBS will signal the drive control
to immediately initiate a shutdown causing the power devices to quench the
current in the DC link. After the requested demand for the safety function, the
gating signals are inhibited and the fiber transmitters power is removed.
1000 ms after the requested demand for the safety function, the STO active
light on the door illuminates, indicating the system is in the safe state. The
drive status on the PanelView™ 1000 will show ‘not ready’ and parameter P699
‘Drive Not Ready 2’ bit 3 will be asserted. To restart the drive, close the gate
door, and press the STO reset button followed by a valid start command to the
drive (Figure 2).
Fault Detection
A single fault detected on the Allen-Bradley Minotaur MSR127 safety input
circuits will result in the lock-out of the system at the next operation and will
not cause loss of the safety function.
Single faults detected on the other system components (for example, OIBBS,
power structure) will result in the demand for the safety function and a lock-
out of the system until the faults are corrected and a drive reset is executed.
Application Considerations
When the hazard analysis for the overall machine determines the need for
external mechanical brakes or other stopping means, the external means shall
be activated after the removal of power for Stop Category 0.
Safe Torque Off Demand
Motor Rotational Power
Safe State Reached
Safe Torque Off ON –
motor coasts to a stop
Safe State
is reached
(1 s delay)
Motor Power is returned when
the safety demand has ended
and motor is restarted
ATTENTION: It is possible to configure the MSR127 for an automatic reset.
This must only be done if a system level risk analysis has been done to deem
this method acceptable for the application.
IMPORTANT The outputs that switch the STO active light On (on the drive door)
are only for indication and are not safety related outputs.

16 Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Chapter 3 Operation, Installation, and Wiring
Wiring Wiring to the safety components in the drive must be in accordance with the
following steps and must be carried out by competent personnel.
Important points to remember about control wiring:
• Always use tinned copper wire.
• Wire with an insulation rating of 600V or greater is recommended.
• Control wires should be separated from power wires by at least
0.3 meters (1 foot).
• Safety input wiring must be protected against external damage by cable
ducting, conduit, armored cable, or other means.
• Shielded cable is required.
• Refer to the Power and Control Wiring section of the applicable
PowerFlex 7000 User Manual
Drive Input Isolation Device
Interlock
The STO option requires both an interlock to open the drive input isolation
device and a feedback monitoring status to indicate the drive input isolation
device status.
Refer to the electrical drawings to show the proper interlocking based on the
type of input device used in the application. In all cases, the interlock connects
to the emergency stop input of the input device.
Table 2 - Safe Torque Off Option Terminal Block Specifications
Wire Size Range Wire Type Strip Length
Maximum Minimum
5.2 mm2(10 AWG) 0.3 mm2(22 AWG) Single or Multi-conductor cable 10 mm (0.39 in.)
Table 3 - VFD6 Terminal Description
Terminal Name Description
D-1200 S12 Safety Input N.C. (Ch 1)
D-1201 S11 (via OIBBS)
D-1202 S22 (via OIBBS) Safety Input N.C. (Ch 2)
D-1203 S21
D-1204 S34 Reset
D-1200 D-1201 D-1202 D-1203 D-1204
IMPORTANT The term “Drive Input Isolation Device” refers to an electrically
held contactor or a circuit breaker with an undervoltage trip
circuit used as the drive input device.
ATTENTION: Interlocking to a drive input isolation device must be done in
accordance with the recommendations in this manual and the system’s
electrical drawings.
ATTENTION: Do not use mechanically held input contactors as a drive input
isolation device. The safety system must be able to open the drive input
isolation device if a failure of the drive’s power structure is detected.

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 17
Chapter 3 Operation, Installation, and Wiring
Based on the type of input device that is upstream of the PowerFlex 7000, there
are requirements that must be met to insure proper operation of the STO
option. Table 4 shows the required feedback contacts from the drive input
isolation device based on the input device option. For more details, see
publication7000-AT002 and 7000-AT003.
When using an Allen-Bradley Bulletin 1512 starter or if the starter is built into
the drive, a relay is added (CNT_AUX_RLY) and wired for the STO option to
generate the proper logic required to meet the feedback requirements. The
following shows the circuit used when the Allen-Bradley starter is external (see
Electrical Drawings).
Figure 3 - Allen-Bradley Drive Input Starter Circuitry Requirements for Safe Torque Off
When a customer’s drive input starter/disconnect is used, the circuit shown in
Figure 4 for the feedback to the STO system is used. This is in addition to the
interlocking already needed for the drive.
Table 4 - Feedback Contacts Based on Input Device
Input Option
Auxiliary Contacts Required by
Drive without STO Option
Auxiliary Contacts Required by
Drive with STO Option Notes
Starter/Circuit
Breaker
Isolation
Switch
Starter/Circuit
Breaker
Isolation
Switch
Internal/External
Starter
(Allen-Bradley 1512
with IntelliVAC™)(1)
(1) Additional relay for STO is mounted in the LV starter cabinet.
1 NO, 1 NC 3 NO, 1 NC 1 NO, 2 NC 3 NO, 2 NC
Remaining spare
contacts on
contactor are 1 NO
and 1 NC for light or
aux relay options
External Starter
(Customer
Supplied) 1 NO 1 NO 2 NO, 1 NC 1 NO, 1 NC
Circuit Breaker
(Allen-Bradley or
Customer
Supplied)
1 pretrip, 1 NO N/A 1 pretrip, 1 NO, 1
NC N/A
STO requires UV
relay to trip circuit
breaker in addition
to existing control
method from DIC
relay
Drive Input
Starter Feedback
Control
Supply

18 Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Chapter 3 Operation, Installation, and Wiring
Figure 4 - Customer-supplied Drive Input Starter Circuitry Requirements for Safe
Torque Off
When a drive input circuit breaker is used as the drive input isolation device,
only a NC contact is needed for the STO option (Table 4). Figure 5 shows the
connection requirements of this contact.
Figure 5 - Drive Input Circuit Breaker Circuitry Requirements for Safe Torque Off
A dry contact is supplied that must be inserted to either the emergency stop
input of the starter (in the case of an internal/external Allen-Bradley or
customer-supplied starter) or the undervoltage dropout circuit if the drive
input isolation device is a circuit breaker. The terminal points are DI-14A and
DI-1.
In all cases, Figure 6 shows the dependency of the feedback status with
medium voltage applied and the requirements when the interlock contact trips
the drive input isolation device.
Figure 6 - Timing Diagram
Drive Input
Starter Feedback
Control
Supply
Drive Input Circuit
Breaker Feedback
Control
Supply
Drive Input Isolation
Device Feedback
(wire 509A)
MV Applied
Interlock contact to
input device
(wire DI-14A)
2 cycles max.
1 s max.
0.5 s max.

Rockwell Automation Publication 7000-UM203D-EN-P - September 2020 19
Chapter 3 Operation, Installation, and Wiring
Product Compatibility The STO option is not compatible with these PowerFlex 7000 configurations:
• 18 Pulse SCR rectifiers
• SGCT redundant devices (for example, N+1, N-1 configurations)
• Parallel drives
• Use of bypass contactor (for example, synchronous transfer, separately
controlled bypass contactor)
• Mechanically-held drive input contactors (for example, option 3950_)
• Versions of the drive firmware prior to 10.002
• Versions of the drive hardware prior to ForGe control
The STO option does not allow for:
• Automatic restart if medium voltage is interrupted for long enough to
discharge the gate driver power supplies on an SPS rectifier.
• More than a 200 ms ride through capability of the input starter control
with an IntelliVAC contactor control module (see 1503-UM053).
Parameter Setup All PowerFlex drive parameters related to the STO option are in the functional
safety group. Functional Safety Mode is the only writable parameter, and must
match the hardware installed (for other drive configuration parameters, see
Table 5). If this parameter is enabled, there must be OIBBS and OIB2s installed
to run the drive. The access mode must be at least advanced to change this
parameter (see publication 7000-UM201).
Figure 7 - Functional Safety Mode

20 Rockwell Automation Publication 7000-UM203D-EN-P - September 2020
Chapter 3 Operation, Installation, and Wiring
SPS Jumper Settings
See Figure 12 for SPS jumper location on the OIBBS.
1. Ensure the SPS jumper on the rectifier OIBBS is installed if the drive is
installed with an SPS rectifier.
2. Ensure the SPS jumper on the inverter OIBBS is not installed.
Commissioning Follow the commissioning procedure in the user manual pertaining to the
drive frame size (see Additional Resources on page 6).
Verify Operation Test the safety function for proper operation after initial installation of the
drive or STO retrofit kit. Retest the safety function at the intervals determined
by the safety analysis described on page 13. Perform these procedures after the
drive commissioning procedure is complete.
Verify the interlocking of the drive input isolation device and the ability of the
STO system to open this device.
Table 5 - Parameter Settings
Group Parameter Name Status
Drive Hardware Group
Number of Devices (P145/P146)NumberofinstalledOIB2s
Rectifier Type (P153) 6 PWM
Bypass Contactor (Hardware Options 1 – P141) Unchecked
Redundant Devices (Hardware Options 1 – P141) Unchecked
SPS Drive (Hardware Options 2– P274) Must match SPS jumper on
rectifier OIBBS
Parallel Drive Group Drives in System (P745) Set to 1
Powerup Config (P717) Single
Feature Select Group Synchronous Transfer (Special Features – P99) Unchecked
IMPORTANT When using the System Test mode with the STO option and an SPS
rectifier, follow input device interlock requirements.
IMPORTANT The input component of the STO system in the drive is an Allen-
Bradley Minotaur MSR127 Safety Relay. Perform an STO functional
test at least once every six months to maintain the safety rating.
Table 6 - Power Up
Complete? Description
Upon power up of the drive, ensure there is no fault code 657 or code 689 (i.e., Rec
InpCtrctrClsd or Inv InpCtctrClsd).
Reset any faults in the drive, and put the system in the normal running state (i.e., reset the
STO active state).