Automation Fundamentals
Limits, Faults and Independent Stops
Understand why commanding zero motion and detecting end travel are not the same as protection.
You need to size or verify a real system using “Limits, Faults and Independent Stops”, with units, duty and limits that match the application.
Separate normal position limiting, end-of-travel sensing, fault detection, controlled stopping, safe torque removal, mechanical hard stops, protective interruption and verified maintenance isolation.
- Select or check first
- Define the required outcome, operating conditions and exact component or system boundary before choosing a part or method.
- Controlling assumption
- Sensors, controller logic, actuator limits, timing, fault response and environmental conditions are defined together.
- Top risk
- A hard stop is not permission to ignore stopping distance. Impact energy can damage the frame, actuator, coupling, bearing, sensor or panel even if travel is physically contained. A hard stop must be structurally designed for its declared event and inspection policy.
- Proof
- Check the exact manufacturer data, units and limits, then verify the result by calculation, measurement or a controlled acceptance test.
Start with the basics Optional foundation before “Limits, Faults and Independent Stops”
Automation-and-control basics
An automatic system measures a condition, decides what it means and commands an actuator while checking whether the expected result actually happened.
- Sensor
- A sensor converts a physical condition into a signal. Its range, uncertainty, response time, environment and failure behaviour matter as much as its nominal output.
- Controller
- A controller reads inputs, applies logic or a control law and issues outputs. Software cannot correct missing measurements, inadequate hardware authority or unsafe architecture.
- Actuator
- An actuator turns a command into physical action, such as motor torque, valve position or switching. Its real limits depend on load, supply, drive and duty.
- Feedback
- Feedback compares measured behaviour with the desired state so error can be corrected. Open-loop command assumes the action occurred; closed-loop control checks it.
- Fault and safe state
- A fault is an abnormal condition that may invalidate control. The safe response must be defined from the hazard and may require independent hardware, not only software.
How to use this article: Trace one complete chain—physical condition, sensor, signal conditioning, controller, drive, actuator and feedback—then ask how each link can fail.
On this page
Setting a speed command to zero is a normal-control request, not proof that hazardous motion has ended. Software limits, travel sensors, drive faults, emergency stops, safe torque removal, brakes, mechanical stops and maintenance isolation solve different problems. A safe machine identifies the hazardous event, detects it with appropriate integrity, reaches a defined state within the available distance, contains stored or external energy, and verifies the result.
Travel protection is layered because failures are different
Diagram description
The diagram is conceptual. It does not show safety integrity, contact logic, braking, energy isolation, structural capacity or the distance needed to stop a particular mechanism.
| Function | Purpose | What it does not prove |
|---|---|---|
| Software travel limit | Prevents ordinary commands beyond a coordinate | Sensor, software and drive are healthy |
| End-of-travel detector | Reports approach to a boundary | Motion has stopped or power is isolated |
| Controlled stop | Decelerates using available actuator torque | Torque cannot return after a fault unless followed by another function |
| Safe Torque Off (STO) | Prevents the drive from producing motor torque when correctly applied | Shaft is stationary, electrically isolated or held against gravity |
| Mechanical brake | Holds or stops within declared duty | Electrical isolation or safe release logic |
| Hard stop | Physically bounds travel | Repeated impacts are harmless or the structure survives every fault |
| Energy isolation/lockout | Controls hazardous energy for servicing | Normal production motion control |
First stopping-distance estimate
d_stop ≈ v t_response + v²/(2a)
This simplified estimate assumes initial speed v and constant positive deceleration magnitude a after a total response delay. Real design must include sensor, logic, network, drive and brake delays; jerk; load and gravity; wind; friction range; actuator saturation; backlash; compliance; brake wear; and tolerances. The protective detector must trigger early enough that the worst credible case stays clear of the hard stop or other hazard.
- d_stop
- estimated distance from hazardous-event onset to rest, metres or degrees
- v
- speed at detection, metres per second or degrees per second
- t_response
- total delay before effective deceleration, seconds
- a
- achieved deceleration magnitude in matching distance units per second squared
Limiting, detecting, interrupting and verifying are different actions
Diagram description
The pictured components illustrate functions rather than a wiring design or installation sequence. Actual ratings, fault energy, protective coordination, disconnection, grounding and safe work procedures are application-specific.
| Stage | Engineering question | Evidence |
|---|---|---|
| Normal limiting | What current, speed, force or position is allowed? | Performance across tolerance and duty |
| Fault detection | Which abnormal states are recognized, including sensor disagreement? | Threshold, coverage, diagnostic interval and injected faults |
| Decision | Which state is commanded and by what safety-related logic? | Risk-based architecture and validated software/configuration |
| Interruption or stop | Can the final element remove/limit energy under the prospective fault? | Ratings, coordination and measured stop/clearing behavior |
| Containment | What happens to gravity, springs, pressure, inertia or back-drive? | Brake, restraint, guard and structural verification |
| Isolation and verification | How does an authorized person establish a safe work condition? | Documented energy-control procedure and verified zero-energy state |
Safe Torque Off removes commanded torque—not every hazard
Rockwell Automation's drive documentation states that STO disables the motor-power switching path so the drive cannot produce torque, while warning that an external mechanical force can still rotate the shaft. A suspended or wind-loaded mechanism may therefore need a brake, counterbalance, restraint or another safety function. STO is also not the same as electrical disconnection for servicing; hazardous supply and stored voltage may remain.
| Shared dependency | Why it matters | Design question |
|---|---|---|
| One position sensor | Normal loop and limit can fail from the same lost signal | Is an independent device or diverse measurement required? |
| One controller/task | A software or execution fault may defeat command and stop | What integrity and separation does the risk assessment require? |
| One power supply | A supply fault may remove sensing but leave stored motion energy | What is the de-energized behavior and diagnostic coverage? |
| One cable route | Mechanical damage can defeat several channels together | Are routing, protection and diagnostics adequate? |
| One mechanical coupling | Sensor can indicate safe position after load disconnects | Does protection measure the hazardous part itself? |
| One environmental exposure | Water, heat or lightning may affect multiple layers | Are diversity, enclosure and surge measures justified? |
Servicing requires isolation and verification
OSHA's hazardous-energy rule requires an energy-control procedure for covered servicing: identify and isolate energy sources, apply lockout or tagout as applicable, make stored or residual energy safe, and have an authorized employee verify isolation before work. A screen showing “stopped,” an LED, an open control contact or an STO status bit is not by itself verified isolation. Applicable law and procedure depend on jurisdiction and work; trained personnel must follow the site's approved method.
| Test | Record |
|---|---|
| Maximum-speed limit approach | Detector point, response delay, deceleration and final clearance |
| Maximum load, minimum friction and adverse direction | Worst stopping distance and brake/drive margin |
| Sensor stuck, disconnected and contradictory | Diagnostic time and resulting safe state |
| Controller/network interruption | Final-element behavior without normal communication |
| Loss and restoration of power | No unexpected restart; known holding and recovery state |
| Hard-stop or restraint inspection | Damage criteria and post-event release authorization |
| Maintenance isolation drill | All energy sources and stored-energy controls verified |
For the difference between an ordinary command and measured result, read Open-Loop Commands Versus Real Feedback. Electrical overcurrent protection is developed in Inside a Miniature Circuit Breaker and What a Circuit Breaker Cannot Protect.
Selection boundary and evidence to keep with the decision
Treat “Limits, Faults and Independent Stops” as a selection problem, not only a definition. Record the required result, alternatives considered, the controlling assumption and the condition that would change the choice.
Keep evidence proportional to consequence: Check the exact manufacturer data, units and limits, then verify the result by calculation, measurement or a controlled acceptance test. Revisit the decision when the load, environment, duty, interface, regulation or maintenance plan changes.
One-minute questions
Questions to answer before you apply this lesson
What should I select or check first for Limits, Faults and Independent Stops?
Define the required outcome, operating conditions and exact component or system boundary before choosing a part or method.
Which assumption can change the conclusion?
Sensors, controller logic, actuator limits, timing, fault response and environmental conditions are defined together.
What can go wrong if I copy the example directly?
A hard stop is not permission to ignore stopping distance. Impact energy can damage the frame, actuator, coupling, bearing, sensor or panel even if travel is physically contained. A hard stop must be structurally designed for its declared event and inspection policy.
How do I verify the result in the real system?
Check the exact manufacturer data, units and limits, then verify the result by calculation, measurement or a controlled acceptance test.
Sources and further reading
- The Control of Hazardous Energy (Lockout/Tagout), 29 CFR 1910.147U.S. Occupational Safety and Health Administration · 2026-10-13Official regulation reviewed for energy-control procedures, stored-energy control and verification of isolation before covered servicing.
- Safe Stop Functional SafetyRockwell Automation · 2026-10-13Manufacturer safety documentation reviewed for STO function, declared certification context and explicit limitations involving external mechanical force and residual rotation.
- Safety Application Requirements for Safe StopRockwell Automation · 2026-10-13Manufacturer guidance reviewed for stop categories, coast-to-stop timing and distance, and risk-based PL/SIL application requirements.