The Evidence Trail Behind a Safe Stop: Commissioning STO and SS1 After a Bosch Drive Retrofit

Retrofitting a Bosch drive onto an existing machine usually brings safety functions that were not previously present as monitored functions. Where a contactor once dropped the motor, Safe Torque Off now disables the output stage under software and hardware supervision, and Safe Stop 1 adds a controlled deceleration ahead of it. Both carry a claimed performance level. Neither is worth anything without evidence.

Start with the design basis, not the terminals

Commissioning begins before the first cable is landed. The risk assessment should already establish the required performance level under EN ISO 13849-1 or the required SIL under IEC 62061, the stop category in accordance with BS EN 60204-1, and whether SS1 is needed to meet the stopping time demanded by the hazard. If an emergency stop is involved, ISO 13850 and stop category 1 apply.

The same assessment should set out the reaction time budget \u2014 detection, processing, and the mechanical rundown of the axis \u2014 because that budget is what the functional test will later be measured against. A safety function commissioned without a stated budget cannot be validated, only demonstrated.

Wiring verification

• Dual-channel connection to the drive's safe inputs, with cross-fault monitoring active rather than defeated.
• Compatibility between the test pulses of the upstream safety relay and the safe input characteristics of the drive. Incompatible pulse schemes produce sporadic demand faults, and the informal remedy is usually to disable the check.
• Physical segregation of safety circuits from power and from standard I/O; no shared terminals, no borrowed cores.
• Terminal torque verified and marked; screens bonded at the correct point; cores ferruled and identified.
• Clear labelling of the safety circuit at every enclosure, so that the next electrician does not have to trace it.

Note also what STO does not do: it provides no holding torque. Any suspended load, vertical axis or brake-dependent arrangement must be assessed on that basis, and the brake circuit commissioned as part of the same exercise.

Parameter verification

The safety function must be enabled and configured deliberately, and the resulting set captured. Confirm the assignment of safe inputs, the SS1 deceleration ramp, the delay between the ramp completing and STO engaging, the brake control and release sequencing, and the diagnostic reporting presented to the operator.

Export the parameter file, record the firmware version, and store both with the commissioning pack. A parameter set that exists only inside the drive is not a record; it is a liability the day a board is replaced.

The functional test

Test with the motor uncoupled, or with the load secured and the hazard eliminated. For each function, and for each channel individually:

1. Apply the demand and confirm the output stage is disabled within the measured response time.
2. Confirm no torque is produced at the motor terminals.
3. Confirm the diagnostic status reported by the drive matches the demand.
4. Confirm the drive will not start while the demand is present, and that restart requires a deliberate reset.
5. For SS1, confirm the axis follows the defined deceleration and that STO engages only after the delay, then compare the measured stopping time against the risk assessment budget.
6. Introduce a single-channel demand to prove cross-fault detection operates as designed.

Record the instrument used, its calibration status, the measured times, the date, and the name of the person who witnessed the test.

The paperwork that survives an audit

A commissioning pack that holds up three years later typically contains:

• the risk assessment and the PL or SIL determination;
• an as-built schematic and terminal schedule for the safety circuit;
• the parameter record with firmware version and backup file;
• the functional test record with measured response times;
• a validation statement referencing EN ISO 13849-2, signed and dated;
• a defined proof-test interval and method, entered into the maintenance schedule.

The last item is the one most often missing. PUWER 1998 requires work equipment to be maintained in an efficient state and inspected where deterioration could give rise to risk, with records kept. A safety function whose proof test exists only in someone's memory does not satisfy that duty. Insurers and engineering inspection bodies increasingly ask for exactly this documentation after a claim, and the absence of a test record is difficult to argue around.

Mistakes that convert a function into an assumption

• Using STO as a routine production stop, so the contactor and brake wear accelerate and the function is exercised far beyond its design intent.
• Treating STO as isolation. The DC link remains charged; lock-off procedures must still be followed.
• Linking out the second channel during commissioning and never restoring it.
• Setting the SS1 delay shorter than the machine's actual stopping time, so STO engages while the axis is still moving and the brake absorbs the residual energy.
• Setting the delay far longer than necessary, adding seconds to every stop and inviting operators to work around the system.
• Failing to repeat the test after a firmware update, board replacement or wiring change \u2014 all of which invalidate the earlier evidence.

Closing the loop

A safety function is a claim about behaviour under fault. Commissioning is the process of turning that claim into measured fact, and the documentation is what carries the fact forward to the next auditor, the next maintenance engineer and the next insurance review. The wiring takes an afternoon; the evidence is what makes the afternoon count.