The elements used to implement safe torque off include:

• STO_1 safe subsystem: Set VCC = 0 V, on demand
  • Input: STO_1
  • Output: VCC

  On demand, the VCC input supply of all 6 isolated gate drivers ISO5852S (or ISO5452) is set to 0 V, which set the output of the six ISO5852S (or ISO5452) gate driver to 0 V, hence all six IGBTs turn off. Refer to Section 4.4.3.

• STO_2 safe subsystem: Set P24V = 0 V, on demand
  • Input: STO_2
  • Output: P24V

  On demand, the 24-V input supply P24V to the TIDA-00199 fly-buck converter is disabled. Then the isolated supply voltages of TIDA-00199 (VCC2, VEE2) of all 6 isolated gate drivers ISO5852S (or ISO5452) will decay to 0 V, which set the output of the ISO5852S (or ISO5452) gate driver to 0 V or high-impedance. With the external pull-down resistors, the six IGBTs will turn off. Refer to Section 4.4.4.

• Diagnostic coverage: MCU (SIL 1) software periodically disable the two load switches TPS22919 and TPS27S100 through logic low diagnostic pulse and check if the output of corresponding switches goes low. If a single fault is detected by the diagnostics software, the MCU will continuously drive the diagnostic signals MCU_Diag_Cntrl_Out1 and MCU_Diag_Cntrl_Out2 low, which will move the system to the safe state, where no force producing power is available at the motor. Refer to Section 4.4.5.
• STO_FB: The STO_1 and STO_2 safe subsystem outputs are combined into a single logic feedback STO_FB. STO_FB is active low and indicates the drive state, either normal operation or safe state. The STO_FB signal can be used as monitor to validate the drive status. Refer to Section 4.4.6.