The Safe torque off function 167MaintenanceAfter the operation of the circuit is validated at start-up, the STO function shall bemaintained by periodic proof testing. In high demand mode of operation, the maximumproof test interval is 20 years. In low demand mode of operation, the maximum proof testinterval is 5 or 2 years; see section Safety data (page 168). It is assumed that alldangerous failures of the STO circuit are detected by the proof test. To perform the prooftest, do the Acceptance test procedure (page 164).Note: See also the Recommendation of Use CNB/M/11.050 (published by the Europeanco-ordination of Notified Bodies) concerning dual-channel safety-related systems withelectromechanical outputs:• When the safety integrity requirement for the safety function is SIL 3 or PL e (cat. 3 or4), the proof test for the function must be performed at least every month.• When the safety integrity requirement for the safety function is SIL 2 (HFT = 1) or PL d(cat. 3), the proof test for the function must be performed at least every 12 months.The STO function of the drive does not contain any electromechanical components.In addition to proof testing, it is a good practice to check the operation of the function whenother maintenance procedures are carried out on the machinery.Include the Safe torque off operation test described above in the routine maintenanceprogram of the machinery that the inverter runs.If any wiring or component change is needed after start up, or the parameters are restored,follow the test given in section Acceptance test procedure (page 164).Use only ABB approved spare parts.Record all maintenance and proof test activities in the machine logbook. CompetenceThe maintenance and proof test activities of the safety function must be carried out by acompetent person with adequate expertise and knowledge of the safety function as well asfunctional safety, as required by IEC 61508-1 clause 6.Fault tracingThe indications given during the normal operation of the Safe torque off function areselected by inverter parameter 31.22.The diagnostics of the Safe torque off function cross-compare the status of the two STOchannels. In case the channels are not in the same state, a fault reaction function isperformed and the inverter trips on an “STO hardware failure” fault. An attempt to use theSTO in a non-redundant manner, for example activating only one channel, will trigger thesame reaction.See the inverter firmware manual for the indications generated by the inverter, and fordetails on directing fault and warning indications to an output on the control unit forexternal diagnostics.Any failures of the Safe torque off function must be reported to ABB.
