Hardwired vs. Networked Functional Safety: What You Need to Know

Functional safety protects people, equipment, and facilities when something goes wrong: a malfunction, a miswired sensor, an operator who accidentally reaches into the wrong place at the wrong time. Every automation system designer eventually has to answer the same question: how do we get the machine to a safe state, reliably, every single time?

Before we get into hardware it’s critical to understand that none of this starts with selecting a VFD or a safety relay. It starts with a risk assessment based on ISO 12100. The risk assessment process is outside the scope of this article but this blog article by TÜV SÜD is a great resource to learn more. This assessment will tell you the required Performance Level or SIL for each safety function. Once the required Performance Level or SIL is known, the hardware selection follows.

<h2>Hardwired E-Stops and Stop Categories</h2>

Hardwired E-stop circuits are the oldest and still most common way to enforce safety on machinery with moving parts. A safety relay or safety PLC monitors a chain of contacts. This might include E-stop pushbuttons, light curtain outputs, guard door switches all wired in series. When that chain opens, a stop is triggered.

IEC 60204-1 defines three stop categories, and your hardware selection will depend on the stop category you need:

<h3>Category 0: Uncontrolled Stop</h3>

Power to the actuators is removed immediately, with no attempt to control how quickly the machine comes to rest.

<h3>Category 1: Controlled Stop, Then Power Removal</h3>

The actuators stay powered long enough to execute a controlled deceleration, and power is removed only once standstill is confirmed.

<h3>Category 2: Controlled Stop, Power Retained</h3>

Same controlled deceleration, but power stays available after standstill.

Hardwired E-stops remain the right call in plenty of applications. Examples include simple machines, low I/O counts, situations where the extra wiring isn't a real cost driver. But network-based safety is increasingly offering a better ROI and the reasons go far beyond just lesser wires.

<h2>Safe Torque Off (STO): The Foundation</h2>

Safe Torque Off, defined in IEC 61800-5-2, is the base safety function available on modern VFDs. Here's what it does at the hardware level: STO removes 24VDC power from the motor control drivers. Without being powered, no pulses reach the semiconductor switches (IGBTs) of the VFD. STO bypasses the drive's software or firmware-based stop logic entirely. This is the fundamental difference between a normal deceleration command vs how STO works. The flow of current in the semiconductor switches and in the motor is interrupted and as a result the motor does not develop a driving torque. This is why STO is trusted to eliminate unintended restarts from software faults, and why it's safe to work on a motor with STO engaged even if the VFDs control board is still powered and running.

Hardwired STO circuits come in single-channel and dual-channel (redundant) configurations. In a dual-channel setup, STO1 and STO2 are two independent paths that can each interrupt the torque-producing signal on their own. This prevents a single failed channel from compromising the safety function.

The NORDAC LINK, NORDAC ON, and NORDAC PRO all offer dual-channel setups. NORDAC FLEX is only available with a single-channel setup.

It’s critical to note that STO doesn't decelerate the load to a stop or standstill. It just removes the VFD's ability to produce torque. The motor then coasts to rest under whatever friction and inertia the system has. No braking energy gets dissipated in the drive or a mechanical brake, which is some applications is genuinely desirable for controlling maintenance costs over the life of the equipment. But this also means stopping time and distance are uncontrolled and load-dependent, and that must be accounted for in the risk assessment.

Let’s explore other safety functions from IEC 61800-5-2.

<h2>Beyond STO: The Rest of the IEC 61800-5-2 Toolkit</h2>

According to IEC 61800-5-2, a much broader set of advanced safety functions (beyond STO) are defined. A quick overview is shown in Fig 4. Carrying out such safety functions can be a complex design endeavor without networked functional safety protocols available right at the VFD level. This includes use of safety relays, safety timer relays, safety speed monitoring relays, independent verification of speeds, etc.

But, the ability to use functional safety over industrial ethernet directly at the VFD now makes it much more practical to incorporate advanced safety functions allowing system complexity to remain low. The SK 302P and SK 312P from the NORDAC ON and the SK 382P-FDS from the NORDAC LINK product families can realize these advanced safety functions seamlessly.

<h2>SS1-t</h2><h3>Safe Stop 1 - Time Controlled</h3>

The “SS1-t” stop function triggers deceleration of motor with a time-controlled execution of the STO function. This corresponds to the controlled stopping according to stop category 1 defined in IEC 60204-1. Whether or not the motor is physically at standstill is not verified prior to execution of STO function.

<h2>SS1-r</h2><h3>Safe Stop 1 - Ramp Monitored</h3>

This function is similar to “SS1-t”, but the ramp is monitored. The “SS1-r” stop function triggers the deceleration of the motor with monitoring of the delay ramp. Exceeding this ramp triggers a fault response (example STO). The behavior corresponds to the controlled stopping according to stop category 1 defined in IEC 60204-1. STO function is executed once the speed drops below a defined limit value.

<h2>SLS: Safe Limited Speed</h2>

The “SLS” monitoring function prevents the motor from exceeding a pre-defined speed for a pre-defined direction of rotation.

<h2>SSM: Safe Speed Monitor</h2>

Continuously monitors the speed for it to stay below a safe threshold and issues a warning or triggers a stop if it doesn't.

<h2>SMS: Safe Maximum Speed</h2>

Similar idea, focused specifically on an absolute maximum speed limit monitored continuously

<h2>SOS: Safe Operating Stop</h2>

Monitors that the motor stays within a pre-defined position window at standstill, while control power and holding torque remains available. If limits are exceeded a fault response (example STO) will be triggered.

Functional Safety Over Ethernet and the "Black Channel" Concept

FSoE (Fail-safe over EtherCAT), PROFIsafe (typically riding on PROFINET), and CIP Safety (typically on EtherNet/IP) all let safety data and standard control data share the same physical network.

This works because of a principle called the "black channel," governed under IEC 61784-3 where the underlying network (cabling, switches, standard communication stack) is treated as inherently unreliable and non-safety rated. Instead, a safety application layer sitting on top handles detection and isolation of communication errors such as corruption, delay, message loss, insertion, repetition. This is done through sequence numbers, connection IDs that verify sender and receiver, timestamps, and CRCs.

Simply put each safety protocol shares the black channel principle and fundamental error model but differ in their specific implementation of the safety frame structure.

The benefits go well beyond fewer wires. Diagnostics improve a lot, for example, instead of a contact that's either open or closed, you get precise data and location down to the specific device and channel. Safety zones can be reconfigured in software instead of physically rewired: moving a light curtain three cells downstream on a hardwired system means re-pulling the safety chain and re-validating the wiring; on FSoE or PROFIsafe, it's a reassignment in the engineering tool of which drives that curtain's fault reaction maps to. You also get access to the full IEC 61800-5-2 function set described above (SLS, SSM, SMS, SOS) directly through the network, which mostly isn't practical to replicate with discrete hardwired safety relays. All of this amounts to a system with a smaller physical footprint and a faster recovery after a safety event because you know exactly what tripped and where.

Here's a quick comparison of networked vs hardwired safety circuits:

In Conclusion

None of this discourse changes the starting point: a formal risk assessment per ISO 12100, done early in system design, before any hardware gets selected. That assessment identifies the hazards, evaluates the risk each one poses, and determines the required Performance Level (ISO 13849-1) or SIL (IEC 61508/62061) for every individual safety function on the machine. Everything downstream (single-channel vs. dual-channel STO, whether you need SLS or just STO, whether hardwired or networked safety makes sense) follows from that number. Risk assessment drives the design. The hardware selection is just where that decision shows up.