Safe stop functions: SS1, SS2, and SOS
What are SS1, SS2, and SOS?
SS1 (Safe Stop 1), SS2 (Safe Stop 2), and SOS (Safe Operating Stop) are drive-integrated safety functions in accordance with IEC 61800-5-2 that go beyond STO: They enable controlled, monitored deceleration and safe holding at a standstill — without external safety logic.
Why is this important?
STO (stop category 0) removes the torque immediately — the motor coasts to a halt uncontrollably. This is insufficient for many applications:
- Mechanical stress — an immediate torque reduction at high speeds can damage workpieces or break tools.
- Safety distances — uncontrolled coasting increases the braking distance and requires greater safety distances to hazardous areas.
- Position loss — after STO, the axis loses its reference and must be re-referenced
- Gravity-loaded axes — a vertical axis requires controlled deceleration before the brakes are applied.
SS1 and SS2 solve these problems through monitored deceleration within the safety function. SOS actively maintains the position at a standstill.
How does it work?
SS1 — Stop category 1 (controlled stop, then de-energized): The drive brakes in a controlled manner, then STO is activated. Two variants are available:
- SS1-t (time-monitored): After the configurable time t_SS1 has elapsed, STO is activated—regardless of whether the motor is already at a standstill. No encoder feedback required.
- SS1-r (ramp monitored): The deceleration is monitored against a configured minimum deceleration rate a_SS1. STO is only activated if the speed remains below the standstill threshold n_Zero_SS1 for a duration of t_L_SS1. Requires encoder feedback.
SS2 — Stop category 2 (controlled stop, then active hold): Identical to SS1 in the braking phase, but instead of activating STO, the drive switches to SOS. The motor remains energized and holds its position in the closed control loop. The position reference is retained — immediate restart without reference run is possible.
SOS — Safe Operating Stop (standstill monitoring): The motor remains energized. The safety monitoring system continuously checks that the position remains within a window s_Zero_SOS around the reference point and that the speed is below n_Zero_SOS. If this is violated, STO is activated.
| Function | deceleration | final state | Motor energized | Maintain position |
|---|---|---|---|---|
| STO | None (coasting) | Powerless | No | No |
| SS1 | Monitored ramp | STO (+SBC) | No | No |
| SS2 | Monitored ramp | SOS | Yes | Yes |
| SOS | — (already at a standstill) | Active holding | Yes | Yes |
How does SOMANET implement this?
All three functions are implemented on the SOMANET Safe Motion Module (SMM) and can be activated via FSoE or secure digital inputs. SS1-t achieves SIL 3 / PLe without encoder feedback. SS1-r, SS2, and SOS require encoder feedback and achieve SIL 2–3 / PLd–e depending on the encoder configuration.
The parameters are configured via the Object Dictionary: SS1 via 0x6650–0x6657 (command, times, delay rate, standstill threshold value), SS2 via 0x6670–0x6677, SOS via 0x6668–0x666C. If the monitoring limits are violated, STO+SBC is always triggered as a fallback reaction.
Further links:
