Safe Torque Off (STO)
Safety function
Topic overview
Quick facts
STO is the most common drive safety function, defined among the stop and monitoring functions of IEC 61800-5-2, and typically forms the final element of machinery emergency stop and protective stop circuits.
When the STO inputs are de-energized, the drive's gate control blocks the power semiconductors so the motor can produce no torque, while the drive electronics and DC bus can remain powered, allowing fast restart and preserving diagnostics.
Two characteristics matter for system design. First, STO is uncontrolled removal of torque, equivalent to a stop category 0: the motor coasts unless external brakes act, so axes with gravity loads or high inertia usually need Safe Stop 1 (controlled deceleration then STO) or a safety-rated brake instead of bare STO.
Second, STO removes torque but not necessarily voltage from the motor terminals in all fault conditions, so it is not electrical isolation and does not replace lockout/tagout for work on the motor circuit.
Using drive-integrated STO usually eliminates external safety contactors, reducing panel space, wiring, and wear-related failures, which is why modern machine architectures route stop functions to the drive's STO terminals through a safety controller.
The case for Safe Torque Off
STO is where safety architecture meets the bill of materials: choosing drives with certified STO at the right integrity level removes contactors, shrinks panels, and speeds restart after protective stops, directly improving cycle time and uptime.
Choosing wrong costs more, a drive whose STO is only PL d cannot anchor a function requiring PL e, and an axis that coasts into an operator because bare STO was used on a vertical load is a design error with injury and recall consequences. The drive datasheet's certified values become load-bearing inputs to your machine's safety calculation.
Safe Torque Off in practice
STO demand sequence
The machine's risk assessment and stop-time analysis determine, per axis, which stop category and drive safety function applies.
Controls engineering wires the safety controller outputs to the drive's dual-channel STO inputs, incorporates the drive manufacturer's certified or PL data into the loop calculation, and validates by triggering each stop and measuring the actual stopping behavior.
For gravity or high-inertia axes the analysis must show what happens during the coast and whether SS1 or brakes are required.
Assessors check that the drive's certificate covers the claimed function and level, that both channels are actually wired and tested, that the coast-to-stop behavior was evaluated against the hazard, and that lockout/tagout procedures do not rely on STO as isolation.
Where teams get Safe Torque Off wrong
Standards related to Safe Torque Off
Safe Torque Off is defined and governed by IEC 61508 - the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
In programs run to ISO 13849-1, Safe Torque Off is one of the things the assessor checks first - defines performance levels (pl) for safety functions implemented in control systems, including pneumatic and hydraulic parts.
IEC 61800-5-2 drive safety functions compared
| Function | Behavior | Stop category |
|---|---|---|
| STO | Immediate torque removal, motor coasts | 0 |
| SS1 | Controlled deceleration then STO | 1 |
| SS2 | Controlled stop, drive stays energized (SOS) | 2 |
| SLS | Speed limited to safe value, monitored | n/a |
| SBC | Safe brake control output | n/a |
Safe Torque Off by industry
Safe Torque Off shapes how industrial machinery teams argue safety - fixed and mobile machinery, packaging lines, and manufacturing equipment.
Ask our team about Safe Torque Off
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.Safe Torque Off: related terms
How each connects to Safe Torque Off:
Safety Function appears in the same lifecycle work as Safe Torque Off and is usually produced or reviewed alongside it.
Both Safe Torque Off and Functional Safety sit under IEC 61508, so evidence for one usually references the other.
IEC 61508 connects the two: Safe Torque Off and SIL are assessed against the same lifecycle.
ISO 13849-1 connects the two: Safe Torque Off and Performance Level are assessed against the same lifecycle.
MTTFd is governed by ISO 13849-1 as well, which is why the two show up together in audits.
FMEA is governed by IEC 61508 as well, which is why the two show up together in audits.
Both Safe Torque Off and FMEDA sit under IEC 61508, so evidence for one usually references the other.
Both Safe Torque Off and Fault Tree Analysis sit under IEC 61508, so evidence for one usually references the other.
Both Safe Torque Off and Verification and Validation sit under IEC 61508, so evidence for one usually references the other.
Safety Management System is governed by IEC 61508 as well, which is why the two show up together in audits.
Both Safe Torque Off and Functional Safety Plan sit under IEC 61508, so evidence for one usually references the other.