Engineering · Safety · Drives
Safe Torque Off (STO) and Drive Safety Functions
How can a drive be made to stop pushing a motor, and be trusted to do it?
Safe torque off (STO) is a safety function built into a variable frequency drive or servo drive (IEC 61800-5-2). When both of its inputs are removed, the drive blocks the signals to its output transistors, so it cannot produce torque and the motor coasts. It does not disconnect the mains and it does not brake. This page shows what happens inside the drive, how to wire the two channels, how it fits with controlled safe stops (SS1, SS2) and the other drive safety functions, how long a machine takes to stop, and how to test it. It is a learning aid: real safety functions come from a risk assessment, certified parts and the drive manual.
With both STO inputs on, the control electronics can switch the six IGBTs and the motor makes torque. When either input is removed, the STO circuit disconnects the gate driver, so no IGBT can switch and no rotating field is produced: the motor coasts. The rectifier and DC bus stay connected to the supply and stay charged (about 565 V on a 400 V supply), so STO is not electrical isolation. Lock out the supply and wait for the DC bus to discharge before any work on the drive or motor.
Both channels must be on for the drive to run, and they must agree. If one channel is stuck or lost, the drive still goes to the safe state through the other, and it reports a fault so the fault is found before the second channel can also fail. A safety relay or safety PLC with two independent safe outputs is used; a single ordinary contactor between the safety device and the STO input is not acceptable. Check the drive manual for the supply, the cable length limit, short-circuit protection and the restart behaviour, which can be a drive parameter.
| Level | Probability of dangerous failure per hour (ISO 13849-1 performance level) | Typical meaning for STO |
|---|
The drive’s STO is only one link. The overall result is limited by the weakest element, and the real calculation adds the failure rates of all parts. A single-channel emergency stop caps the chain at a low level whatever the drive can do. STO ratings differ by drive, from performance level d (SIL 2) to performance level e (SIL 3): read the data sheet.
| Stop category (IEC 60204-1) | Method | What happens | Typical use | Motor state |
|---|
The reaction time is the sum of the safety device, the safety relay or PLC and the drive. Many drives remove torque in under 20 ms; the real figure is in the drive manual and must be measured on the machine. The motor then coasts, so the machine needs longer to stop than the electronics need to react.
| Function | What it does | Torque removed? | Controlled stop? | Typical use |
|---|
Distance = speed × reaction time + speed squared ÷ (2 × deceleration). The deceleration is how fast friction and the load slow the machine once torque is gone. A vertical load is not slowed by friction: gravity accelerates it, so STO alone does not hold it and a safe brake (SBC) is needed. The stopping time and distance set how far away a guard or light curtain must be (ISO 13855; see the Industrial Safety Systems page).
| Standard | What it covers |
|---|
This page explains concepts with simplified models and typical figures. It is not a safety design. Safety functions must be specified from a risk assessment (ISO 12100), built from certified components used within their ratings, and validated against the drive manual and the current standards.