What this page solves

Pitch control is one of the most safety-critical control loops in a modern wind turbine. By commanding the blade pitch angle, it limits aerodynamic torque, controls power output, prevents overspeed and provides a primary braking mechanism that protects blades, hub and gearbox under gusts, grid faults and emergency stops.

This page focuses on the electronic building blocks that make a pitch control system safe and reliable: servo and gate drivers for the pitch actuators, absolute encoder interfaces such as EnDat and BiSS, redundant MCU architectures with cross-checking, safety comparators for overspeed and limit monitoring, and the Safe Torque Off (STO) path that physically removes torque from the motor when required.

In scope on this page:

• Servo and gate driver chains for electric or electro-hydraulic pitch actuators
• Absolute encoder interfaces (EnDat / BiSS) and cable integrity monitoring
• Redundant MCUs, cross-checks and voting logic for safety-related control
• Safety comparators for overspeed, angle and rate limits
• Safe Torque Off (STO) paths from safety logic to motor drive hardware

Out of scope and covered by sibling pages:

• Yaw control and nacelle alignment (see “Yaw Control System”)
• DFIG / PMSG converters and grid-side current or voltage control loops
• Nacelle-level SCADA gateways, TSN networking and substation protocols
• Pitch UPS / backup power system sizing, charging and health monitoring
• Blade load and structural health monitoring (strain, vibration, ice detection)

Functional role & system boundaries

The pitch control system sits between high-level turbine supervision and the pitch actuators mounted in the hub. It receives commanded pitch angles and operating modes, observes shaft speed, wind conditions and safety chain inputs, and produces safe torque commands that drive the pitch motors or hydraulic actuators, while continuously checking that motion stays within predefined limits.

Main inputs to the pitch loop:

• Absolute rotor blade position from EnDat / BiSS encoders mounted in the hub
• Pitch angle targets, rate limits and operating modes from the nacelle controller or SCADA
• Safety chain signals such as emergency stop, overspeed alarms and storm or ice detection flags

Main outputs from the pitch loop:

• Gate drive and current-limit commands to BLDC or PMSM pitch motors
• Control of brake release and hydraulic valves where electro-hydraulic pitch is used
• Status, health and fault information reported back to the nacelle controller and SCADA

System boundaries and responsibilities:

• The pitch controller treats the nacelle controller as the source of setpoints and operating modes. It does not implement farm-level dispatch, grid-code compliance or SCADA protocols; those live in the nacelle controller and SCADA gateway.
• DFIG or PMSG converters handle generator current and voltage control. Pitch control cooperates with them by limiting aerodynamic torque and overspeed, but does not implement current or voltage loops, PLLs or crowbar logic.
• Pitch UPS and backup supplies guarantee that the actuators can still feather the blades when the main grid or auxiliary power fails. This page only assumes a health and remaining-range signal from the UPS; detailed battery and charger design is handled on the “Pitch UPS / Backup PSU” page.
• Blade load and structural health monitoring systems provide additional alarms that may request derating or full feather commands. The sensing details reside on the “Blade Load & SHM” page; the pitch loop treats them as safety inputs.

Safety-critical architecture (redundant MCUs and STO path)

The pitch control unit is a safety-related subsystem. Its architecture must tolerate single faults in controllers, sensors and power stages without allowing dangerous blade motion or overspeed. This section outlines redundant MCU topologies, cross-check and voting concepts, and the Safe Torque Off (STO) hardware path that disconnects the motor drive independently of software.

Redundant MCU topologies:

• Dual-channel architectures where two MCUs independently process encoder and command data, then compare pitch angle, rate and limits before issuing motion or STO requests.
• Lockstep or multi-core devices that detect internal hardware faults, combined with a second, independent MCU for diversity and higher diagnostic coverage.
• Three-channel (2oo3) topologies for higher safety levels, where voting logic masks one faulty controller while still guaranteeing safe decisions.

Cross-check, heartbeat and voting logic:

• Numeric cross-checks compare independently computed pitch position, speed and overspeed thresholds between channels and flag discrepancies beyond a tight tolerance.
• Time-based cross-checks and watchdogs ensure each channel refreshes its output within a defined control period; stale outputs are treated as faults.
• Heartbeat signals confirm that communication between MCUs and safety logic is timely; missing or invalid heartbeats trigger a transition to a safe state.
• Voting logic in three-channel systems resolves conflicting decisions while maintaining priority for safe outcomes over availability.

STO hardware path and safety comparators:

• The STO path is a hardware chain from safety logic to the motor drive that removes torque by disabling gate drivers or opening contactors, without relying on firmware execution.
• Safety comparators monitor overspeed, angle windows and pitch rate profiles using analogue or digitised signals; violations assert STO or inhibit further motion.
• Solid-state relays, MOSFETs or safety contactors implement the physical cut-off of gate drive and power rails. Their state is monitored to detect welded contacts or unexpected conduction.

STO test intervals and fault logging:

• Periodic STO tests verify that safety signals can still disable the drive and that measured motor current drops as expected during test cycles.
• Safety comparators are checked using controlled reference levels to detect drift or internal failures; failed tests force the system into a degraded or shutdown state.
• All STO activations, test results, watchdog timeouts and comparator faults are logged with timestamps so that turbine operators can analyse root causes and plan maintenance.

Typical fail-safe scenarios handled by this architecture:

• Encoder disagreement between channels or redundant sensors beyond the allowed angle difference.
• Pitch rate exceeding the expected profile, indicating mechanical decoupling or uncontrolled motion.
• Motor driver output remaining stale or frozen while commands change, detected by watchdog and feedback monitoring.
• MCU watchdog timeout or loss of internal heartbeat, treated as a loss of control authority.
• Communication loss with the nacelle controller, leading to a controlled transition to feather or a safe parked position rather than continued operation on old commands.

Absolute encoder interface (EnDat / BiSS) front-end

Reliable blade position feedback is essential for safe pitch control. Absolute encoders with EnDat or BiSS interfaces provide multi-turn angle information, diagnostics and safety-related data that remain valid after power cycling or mechanical slip, unlike simple incremental encoders that depend on homing routines.

Protocol families and safety variants:

• EnDat 2.1 and 2.2 support absolute position, parameter access and diagnostics, with 2.2 offering higher data rates and more flexible frame structures.
• BiSS-C provides an open, high-speed serial channel for position data and status, widely used in industrial encoders.
• BiSS Safety extends BiSS-C with safety frames carrying redundant data, counters and CRC to help meet safety integrity requirements.

Differential physical layer and line protection:

• EnDat and BiSS links typically use RS-485 or RS-422 differential transceivers to drive long, shielded cables between the hub and pitch controller.
• Transceiver selection must account for common-mode range, required data rate and ESD or surge robustness in the nacelle environment.
• Proper termination and biasing are needed to avoid reflections and undefined logic levels when the line is idle or open.

Timing, cycle time and real-time constraints:

• The encoder interface must support a cycle time that fits comfortably within the pitch control loop period, typically allowing multiple encoder updates per control cycle.
• Frame length, serial clock frequency and line delays determine the achievable update rate; these parameters must be matched to the number of blades and encoder channels on the bus.

Supply monitoring and cable fault detection:

• Encoder supply voltage and current are monitored to detect undervoltage, overloads and short circuits that would invalidate position data.
• Open-circuit and short-circuit conditions on differential pairs are detected through fail-safe biasing, abnormal common-mode levels and diagnostic frames.
• When encoder supply or cabling faults are detected, the pitch system must not continue full-speed motion on stale or guessed positions; safe limits or STO are applied instead.

Shielding, grounding and surge considerations:

• Shielded twisted-pair cables help reject motor noise and external interference; shield termination strategy must avoid large ground loops.
• Encoder lines require surge and fast-transient protection appropriate for tower and nacelle environments, while detailed lightning protection is handled by dedicated surge and lightning monitoring subsystems.

CRC, safety frame checking and redundant encoders:

• MCUs independently verify CRC and safety frame contents from the encoder to detect bit errors and inconsistent status information.
• Persistent CRC failures or invalid safety frames are logged and treated as faults that limit or stop motion until resolved.
• Redundant encoder topologies, using dual channels or two different encoders, provide additional protection against sensor or cabling failures and allow cross-checking of blade angle.

Motor / servo drive chain (gate drivers, sensing and protection)

Pitch actuators are typically three-phase BLDC or PMSM motors with high gear ratios, or electro-hydraulic systems driven by pump motors and control valves. The drive chain must deliver sufficient torque and speed for feathering and normal pitch motion, while integrating fast protection and coordinated STO behaviour when faults occur.

Gate drivers and power stages:

• Three-phase full-bridge stages with high-side and low-side gate drivers for BLDC and PMSM pitch motors.
• Gate drivers with robust dv/dt immunity, configurable dead time and gate monitoring to prevent shoot-through and detect abnormal gate faults.
• Isolated or high-side drivers where reinforced isolation and predictable behaviour during surges and ground shifts are required.

Protection functions (desat, OC, OT, UVLO):

• Desaturation detection on IGBTs or MOSFETs to identify short-circuit and locked-rotor conditions and trigger rapid, controlled turn-off.
• Overcurrent protection based on shunt or sigma-delta current measurements to enforce safe torque limits and prevent prolonged overload.
• Overtemperature monitoring of power switches, drivers and PCB hotspots, supporting derating before shutdown when thermal margins shrink.
• Undervoltage lockout on gate driver supplies and logic rails to block partial turn-on and undefined behaviour when supply levels are not within specification.

Current and DC-link sensing:

• Phase or low-side shunt resistors, or isolated sigma-delta modulators, provide current feedback for torque control and fast fault detection.
• DC-link voltage sensing confirms that sufficient energy is available to complete feather operations and supports controlled derating when the link is low.
• Current and DC-link measurements are used to verify that STO events and braking actions produce the expected decay in torque and motor current.

Braking and emergency torque release:

• Controlled electrical braking profiles limit mechanical shock on the gearbox and blades during deceleration and emergency feathering.
• Mechanical brakes or hydraulic valves are arranged so that loss of power or STO requests move the system towards a safe, parked configuration.
• Emergency torque release paths coordinate gate driver disable, DC-link management and brake engagement to remove drive torque quickly and predictably.

Gate disable and STO cooperation:

• Gate driver enable and shutdown pins are wired to the STO hardware path so that safety decisions immediately remove PWM drive to the motor stage.
• DC-link contactors, pre-charge elements and braking resistors are arranged so that STO and emergency braking do not leave uncontrolled energy in the pitch drive.

Control loop, observers and fault handling

The pitch control loop translates blade angle commands into motor torque in a structured chain of position, velocity and current control. Observers monitor speed, acceleration and overspeed profiles, while fault handling logic classifies abnormal behaviour and selects controlled derating or STO-based shutdown.

Control chain from angle to torque:

• The position loop compares commanded blade angle with absolute encoder feedback and generates a pitch velocity target within configured rate limits.
• The velocity loop drives motor speed towards the target while respecting acceleration constraints that protect the gearbox and blades from mechanical shock.
• The torque or current loop uses phase current measurements to deliver the torque required by the velocity loop, with limits set by mechanical and thermal margins.

Overspeed and motion profile checking:

• Shaft or generator speed measurements are compared against pitch angle and rate to ensure that the turbine follows expected overspeed mitigation profiles.
• When pitch motion does not reduce speed as expected during feathering, the loop flags an abnormal condition and escalates towards emergency actions.
• Overspeed supervision in the pitch loop complements, rather than replaces, converter and grid-side protections discussed on generator converter pages.

Fault classification and actions:

• Minor faults, such as a single encoder channel error, soft overtemperature warning or transient communication disturbance, trigger controlled derating.
• Derating strategies include reduced maximum pitch speed, reduced torque limits and increased diagnostic frequency while still allowing safe operation.
• Major faults, including dual encoder failures, watchdog timeouts, STO chain failures, welded contacts or persistent overspeed, demand rapid feathering and STO activation.
• Major faults require maintenance intervention before resuming normal service and are stored with high priority in local logs.

Observers, timestamps and local logging:

• Observers estimate pitch velocity and acceleration from encoder data and check them against configured limits and expected motion profiles.
• Events are tagged with timestamps derived from an RTC or a time-synchronised source so that turbine-level diagnostics can reconstruct fault sequences.
• Local fault logs in the pitch controller store STO activations, derating decisions and profile violations, providing a detailed history that complements higher-level SCADA records.

Communication and diagnostics (local, redundant)

The pitch controller exchanges commands, status and diagnostics with the nacelle controller and local service tools over redundant communication channels. Interface choices such as RS-485, Industrial Ethernet and CANopen Safety must support deterministic command delivery, heartbeat supervision and structured diagnostic upload without taking over TSN and remote SCADA functions that belong to the nacelle controller and gateway.

Interfaces to the nacelle controller:

• RS-485 or similar differential serial links for robust, low-bandwidth command and status exchange in existing or cost-sensitive platforms.
• Industrial Ethernet variants such as EtherCAT, PROFINET or Ethernet/IP for higher bandwidth and tighter real-time behaviour in newer turbine architectures.
• CANopen Safety or comparable safety fieldbus profiles for the transmission of safety-related commands and feedback with additional CRC and time constraints.

Redundant and local communication paths:

• Dual physical channels, for example RS-485 plus Industrial Ethernet, allow continued control when one link fails and support separation of safety-critical and non-critical traffic.
• Connections from both a main nacelle controller and a safety controller require clear priority rules so that emergency stop and feather requests override routine commands.
• Local service ports, such as maintenance Ethernet or USB, provide direct access for commissioning, firmware updates and log retrieval without bypassing the safety chain.

Heartbeat and command validity windows:

• Heartbeats from the nacelle controller confirm that control and safety paths are alive and carry information about operating mode and command sequence counters.
• Each pitch angle or velocity command is treated as valid only within a defined time window; expired commands are discarded to avoid running on stale references.
• Loss of heartbeats or repeated command timeouts cause the pitch system to move through a graded response, from holding position with limits to safe feathering and STO if needed.

Diagnostic upload:

• Diagnostic messages report current angles, speeds, currents, DC-link voltage, temperatures and redundancy status together with fault codes and self-test results.
• Periodic summaries and event-triggered updates ensure that nacelle-level systems see both steady health trends and detailed information about major events.
• When bandwidth is constrained, the pitch controller prioritises safety and state information while retaining full-resolution logs locally for later inspection.

Firmware integrity and updates:

• Firmware images are verified at startup using integrity checks, and only validated images are allowed to drive motors or participate in safety decisions.
• Dual-image or rollback mechanisms reduce the risk of leaving the pitch controller in an unusable state after an interrupted update.
• Update procedures through local or nacelle-initiated channels keep the drive chain in a safe condition until the new firmware is fully verified and released.

Environmental and mechanical constraints

Pitch controllers, encoders, cables and drive electronics operate inside the hub and nacelle under vibration, temperature extremes, moisture, salt fog and electromagnetic stress. These environmental and mechanical constraints shape component selection, PCB design, enclosure concepts and maintenance schedules as much as electrical specifications.

Vibration and mechanical shock:

• Continuous broadband vibration and occasional shocks from braking, grid disturbances and gearbox events act on the hub-mounted control hardware.
• PCBs, heavy components and connectors require mechanical fixation, strain relief and vibration-rated designs to avoid cracked solder joints and intermittent contacts.
• Mounting arrangements and enclosures must avoid resonances in dominant tower and drivetrain frequency bands.

Temperature, humidity, freezing and salt fog:

• Hub and nacelle temperatures can range from deep cold to high summer heat, so devices, passives and electrolytic capacitors must meet the required operating and lifetime targets.
• Condensation and frost risk increase with thermal cycling; conformal coating, controlled airflow and local heating help protect sensitive circuitry from moisture.
• Offshore and coastal turbines face salt fog that accelerates corrosion of connectors, exposed metal and unprotected PCB areas, requiring appropriate materials and surface treatments.

Encoder cable bending life and routing:

• Encoder cables in loops between tower, nacelle and hub experience repeated flexing over the turbine lifetime, so drag-chain or flex-rated cables are needed.
• Cable routing and fixation must respect minimum bend radius and prevent abrasion or strain on encoder connectors and glands.
• Cable degradation directly impacts position feedback quality and can manifest as intermittent encoder disagreements that the safety logic treats as major faults.

Condensation and icing on the drive board:

• Moisture films and ice on PCB surfaces can reduce insulation resistance, increase leakage and trigger nuisance trips or latent failures.
• Conformal coating, adequate creepage distances, slotting and controlled internal climate reduce the impact of condensation and frost.
• Temperature monitoring and, where needed, internal heaters help keep the control enclosure within safe operating conditions during cold starts and idle periods.

Electromagnetic environment and magnetic fields:

• High dv/dt motor cabling and common-mode currents from the pitch drive inject noise that can couple into encoder, communication and sensor wiring.
• Layout, shielding, cable segregation and filtering are needed to keep analogue and digital reference nodes stable in this environment.
• Magnetic fields from power cables and permanent magnets can disturb magnetic encoders and current sensors, so careful placement and optional shielding are essential.

Lightning coupling and surge exposure:

• Blades, tower and nacelle form part of the lightning current path, and the resulting fields and potential differences can couple into encoder, motor and communication cables.
• Pitch control hardware must be selected and laid out with lightning and surge coupling in mind, while detailed surge protection topologies and lightning monitoring are defined in the Tower Lightning and surge-related pages.

Recommended IC roles for pitch control (brand-neutral)

A pitch controller combines redundant processing, safety comparators, STO-capable gate drivers, sensing front-ends and robust communication transceivers. Defining clear IC roles and design IDs helps keep the architecture consistent across turbine platforms while leaving flexibility to select different vendors during detailed BOM work.

Redundant MCUs, supervisors and fault log memory

Dual-core lockstep MCUs or dual independent controllers form the processing core, supported by external supervision and non-volatile memory for safety logs. Typical design IDs include:

• MCU_A / MCU_B — primary and redundant controllers with sufficient PWM, encoder, communication and safety features to meet the target ASIL level.
• SUP_IC1 — multi-output supervisory device that monitors key rails, provides reset and window watchdog functions for both MCUs and selected peripherals.
• NVM_LOG1 — FRAM or EEPROM for persistent fault and event logs with adequate endurance and retention over the turbine lifetime.
• PMIC_MCU — power-management IC that generates separated supplies for MCU_A and MCU_B with power-good signals and controlled sequencing.

Safety comparators and STO gate drivers

Hardware safety paths combine comparators for overspeed and limit detection with STO-capable gate drivers that can remove torque independent of MCU software.

• CMP_OVR1 / CMP_OVR2 — window comparators that supervise shaft speed, pitch angle and angle rate, issuing hardware-level trip requests when configured thresholds are exceeded.
• CMP_CURR1 — comparator channel dedicated to short-circuit and overcurrent detection in the pitch motor phase or DC-link path.
• STO_DRV1 — gate driver or driver set with certified STO inputs, dual enable channels, diagnostic feedback and timing compatible with the pitch safety concept.

Current, voltage and encoder interface front-ends

Isolated sigma-delta modulators and encoder interface ICs close the sensing loop between the mechanical system and the control algorithms.

• SD_MOD_I — isolated sigma-delta modulator for phase currents or DC-link current, with sampling rate and latency matched to the current control loop.
• SD_MOD_V — isolated sigma-delta modulator or precision ADC channel for DC-link and auxiliary voltage monitoring.
• ENC_IF1 — absolute encoder interface IC that supports EnDat or BiSS Safety frames and assists with CRC and status handling.
• RS422_ENC — RS-422/RS-485 transceiver dedicated to encoder differential lines with failsafe biasing and high immunity to motor noise.

Communication transceivers and protected inputs

Fieldbus and Ethernet transceivers connect the pitch controller to nacelle and safety controllers, while protected input stages handle limit switches and emergency contacts.

• RS485_COM1 / RS485_COM2 — main and backup RS-485 transceivers for commands, status and diagnostic upload, supporting extended common-mode range and high ESD levels.
• CAN_SAFETY1 — CAN transceiver used with a safety protocol such as CANopen Safety for high-integrity emergency commands and feedback.
• ETH_PHY1 — Industrial Ethernet PHY for connections to nacelle-level controllers, without taking over TSN or SCADA gateway roles.
• IN_FILT1 / IN_FILT2 — multi-channel digital input stages with filtering, surge protection and diagnostic features for limit switches and hard-wired interlocks.

Power-tree for MCUs, drivers and auxiliaries

The power-tree separates noisy and quiet domains, supports diagnostic coverage and maintains safe behaviour during brown-out and transient events.

• PMIC_DRV — supply generator for gate drivers, current sensors and other high-noise peripherals with appropriate UVLO levels and power-good signals.
• AUX_REG1 / AUX_REG2 — regulators for encoder supplies, solenoid valves and auxiliary sensors with monitoring where required by the safety concept.
• SUP_IC1 (shared) — ties power-good signals from PMIC_MCU and PMIC_DRV into a coherent supervision scheme that the safety software can interpret.

Design checklist for pitch control implementation

This checklist helps review a pitch control implementation before lab testing and field deployment. Each item can be linked to specific design IDs or part numbers in the project BOM so that safety, control and diagnostic requirements are explicitly covered.

Application examples for pitch control systems

These application examples illustrate how a pitch control architecture with redundant MCUs, safety comparators, STO-capable gate drivers and robust sensing behaves in real turbine events. Each scenario links mechanical behaviour, signal chains and safety logic into a complete control and protection sequence that can be traced against the design checklist.

Example 1 — Typhoon gust overspeed detected by profile observers and STO

A utility-scale turbine operates close to rated power as a tropical cyclone approaches. Wind speed and turbulence increase quickly and the rotor begins to accelerate despite normal pitch regulation. The absolute encoder interface provides continuous angle and speed feedback through EnDat or BiSS Safety frames, while current and DC-link measurements are streamed from isolated sigma-delta modulators.

The main controller MCU computes torque and pitch commands and tracks the target speed band. In parallel, a safety-focused MCU evaluates overspeed observers that compare the measured rotor speed and acceleration against an allowed profile for the current pitch angle and power level. When the gust causes the actual speed to approach the upper profile limit, the safety controller moves the turbine into a conservative mode, requesting faster feathering and reduced torque commands while remaining within normal operation.

A second, independent protection layer monitors speed via window comparators. Once the rotor crosses the hard overspeed threshold, the comparators assert a trip output that feeds directly into the STO-enabled gate drivers. The drivers remove torque within the specified reaction time even if the main MCU is delayed or unavailable. At the same time, the pitch controller issues a safe pitch-angle trajectory, moving each blade toward a feathered position using the remaining available energy and backup supply.

The event is recorded in non-volatile fault logs with timestamps, overspeed level, pitch angle and key currents. Diagnostic messages to the nacelle controller indicate that STO was triggered due to an overspeed profile violation and that the turbine is now in a safe pitch condition pending operator acknowledgement and wind assessment.

Example 2 — Encoder disagreement and derated but controlled operation

In a different operating period, the turbine runs steadily at partial load during moderate winds. The hub uses a redundant encoder arrangement: either two independent encoders or dual safety channels from a single encoder. Both channels feed the encoder interface ICs, and the two MCUs receive angle and speed values from each path during every control cycle.

Over time, cross-check logic detects that the two angle readings differ by approximately 0.3 degrees in a persistent way rather than as short spikes. The difference remains within the maximum tolerance for safe control, but exceeds the early-warning threshold defined for sensor degradation. The safety controller classifies the situation as encoder disagreement and moves the pitch control system into a degraded but controlled state.

In this state, pitch motion limits, speed margins and torque commands are tightened. The turbine is derated to a reduced power band to increase safety margin against overspeed and structural loads. The normal STO and hardware protection paths remain fully active, and the turbine can still execute emergency feathering if wind conditions deteriorate or further encoder divergence is observed. If the mismatch grows beyond a higher threshold, the safety architecture escalates to a controlled stop and safe pitch condition.

The derating decision, encoder difference statistics and relevant environmental conditions are written to persistent memory and reported to the nacelle controller. Fleet-monitoring systems can use this information to schedule inspection or replacement of encoders, cabling or connectors before a complete channel failure forces unplanned downtime.

Example 3 — Gate driver desaturation, motor shutoff and STO override

During a routine pitch adjustment, a combination of mechanical resistance and wiring degradation causes an abnormal current surge in one of the pitch motor phases. The gate driver detects desaturation of the power device: the voltage across the IGBT or MOSFET rises above the programmed threshold for longer than the blanking time that masks normal switching transients.

The gate driver reacts autonomously by turning off the affected phase and asserting a fault signal toward both MCUs and the safety supervision circuitry. The sigma-delta current measurement confirms an abnormal pattern. The control software classifies the event as a motor-side short or stall and stops issuing further torque commands for the affected axis while keeping the remaining logic in a defined state. Depending on the pitch system architecture, the controller may attempt a limited recovery sequence or immediately plan an emergency feathering strategy using alternative drives.

If repeated desaturation events are detected within a short window, or if the encoder feedback no longer matches the expected motion, the safety MCU raises the fault level to a major condition and requests STO. The STO-capable gate driver then disables all torque-generating paths, ensuring that no further electrical stress is applied to a potentially damaged motor, cable or power device. The turbine transitions to a safe state according to the system-level safety concept.

Each desaturation event and corresponding STO action is logged in non-volatile memory with phase identification, load conditions and temperature. Service teams can correlate these logs with mechanical inspections to identify root causes such as bearing issues, blocked mechanisms or cable damage, and adjust design margins and gate driver settings for future turbines.

Pitch control FAQ

This FAQ focuses on safety, encoders, STO, sensing and environmental aspects of pitch control systems in wind turbines. It complements the main sections on architecture, drive chains and diagnostics and is limited to the pitch controller itself, not yaw systems, main converters, SCADA gateways or pitch UPS hardware.