Functional Safety Testing for Motor Drives: STO, SS1/SS2 & Fault Reaction Time

Why Functional Safety Testing Is a Separate Discipline From Performance Testing

Most motor testing validates what a drive system does — torque, efficiency, thermal performance. Functional safety testing validates what it does when something goes wrong: does the system reach and hold a safe state within a defined time, with a quantified probability of failing to do so. For motors and drives used in machinery, robotics, and any application under IEC 61800-5-2 or the machinery safety framework (ISO 13849, IEC 62061), this is a distinct, certification-relevant test category with its own methodology.

What Functional Safety Testing Actually Verifies

• Safe Torque Off (STO) response: The most common safety function — verifying that when STO is triggered, the drive removes torque-producing energy from the motor within the specified time, and that residual torque during the transition stays within safe limits
• Safe Stop functions (SS1/SS2): Controlled stop functions that bring the motor to standstill via a monitored deceleration ramp before removing power (SS1) or holding position afterward (SS2) — each with defined timing and monitoring requirements distinct from STO’s immediate torque removal
• Safely-Limited Speed/Position (SLS/SLP): Functions that allow reduced-speed or limited-range operation (for maintenance access, collaborative operation) while monitoring that the actual state stays within the safe limit, triggering a safety reaction if exceeded
• Diagnostic coverage and fault reaction time: Safety-rated systems require quantified diagnostic coverage of internal faults and a bounded fault reaction time — testing needs to inject representative fault conditions and measure actual detection and reaction time against the certified value

Core Test Items for Motor/Drive Functional Safety

1. STO Trigger-to-Torque-Removal Timing

With the motor under load, the STO input is triggered and the bench measures actual time to torque removal and any residual torque or motion during the transition, verifying performance against the certified response time and residual-motion limits.

Key metrics: Time from STO trigger to torque removal, peak residual torque/displacement during transition.

2. SS1/SS2 Controlled Stop Verification

The bench triggers the safe stop function under various initial speed/load conditions, verifying the monitored deceleration ramp is followed correctly and STO or position-holding engages at the correct point per the function’s definition.

Key metrics: Deceleration ramp conformance, timing of STO engagement relative to standstill detection.

3. SLS/SLP Limit Monitoring and Reaction

The bench drives the motor toward and past the configured safe speed or position limit, verifying the safety function correctly detects the limit violation and triggers the defined safety reaction (typically STO) within the required reaction time.

Key metrics: Detection accuracy at the limit boundary, reaction time from limit violation to safety response.

4. Fault Injection and Diagnostic Coverage Verification

Representative internal faults (sensor failure modes, power stage faults, encoder signal loss) are injected to verify the safety system’s diagnostic function detects them and triggers the correct safety reaction within the certified fault reaction time — directly validating the diagnostic coverage assumption behind the system’s safety integrity level.

Key metrics: Fault detection rate across injected fault set, reaction time per fault type.

5. Safety Function Independence Verification

Where the safety function is required to be independent of the standard motor control path (a common architecture requirement), testing verifies the safety reaction still functions correctly even when the standard control path is faulted or unresponsive.

Key metrics: Safety function success rate with standard control path deliberately disabled/faulted.

What This Means for Test Bench Selection

Functional safety testing needs precise, independent timing measurement (not relying on the drive’s own reported values), the ability to apply realistic load and speed conditions while triggering safety functions, and a fault injection capability separate from normal test sequencing — a specialized capability layered on top of conventional performance testing, required for any motor/drive system being certified under IEC 61800-5-2, ISO 13849, or IEC 62061.

If your team needs functional safety validation for motor/drive systems alongside performance testing, talk to our engineering team about configuring test sequences for your target safety integrity level.