Understand the interface decision

Wind can continue to drive a rotor after a command is issued. Capacitors, batteries and linked circuits can also retain electrical energy. The stop function must coordinate the machine’s approved energy-control methods and preserve any functions needed to complete the response.

A rotating wind turbine can retain mechanical input while electrical conditions change. Define the complete control action and energy destination together. A component-level response is only one part of the system-level protective function being assessed.

Put these inputs in the review record

Use a project-specific worksheet to capture the following information. For each entry, name the document, revision and person responsible for resolving any uncertainty.

• Energy sources and stored energy inside the stop boundary. Identify the exact configuration and the supporting document.
• The turbine manufacturer’s permitted stopping methods. Keep the design assumptions visible in the project record.
• The sequence and confirmation of each required protective action. Name the responsible reviewer and resolve any missing information.
• Reset, restart and access conditions after the stop completes. State how this entry will be verified during acceptance.

Define the acceptance boundary

Accept a defined functional response supported by the machine risk assessment and equipment instructions. Do not equate an emergency-stop command with electrical isolation for maintenance. The two functions can have different boundaries and verification requirements.

The record should show commanded actions and observed states separately. It must also distinguish resetting the emergency-stop device from permission to restart; clearing the command alone should not be treated as evidence that the original hazard has been resolved.