What is (safe torque off) STO ?

What is STO ?

What is STO Safe Torque Off?

What Is STO (Safe Torque Off)?

STO – Safe Torque Off is a drive safety function that prevents the drive from producing the electrical energy required to generate motor torque.

In simple terms, a normal STOP command tells the drive, “stop the motor.” STO uses a safety-related path to tell the power stage, “do not allow the motor to produce torque.”

There is one very important consequence: STO does not necessarily stop a rotating motor immediately. A fan, saw spindle, centrifuge, roll or other high-inertia load may continue rotating after torque has been removed.

This is why STO is not a brake. Its primary job is to remove the drive's ability to generate torque. The time required for the machine to reach standstill is a separate safety consideration.

How does STO work? · STO vs normal STOP · Standards · FAQ

Try it: is STOP the same as STO?

Run the motor in the educational model below. First select Normal Stop: the drive actively reduces speed. Then run the motor again and activate Emergency Stop / STO. Torque disappears immediately, but the simulated motor continues to rotate while its stored mechanical energy decays.

Educational note: This simulation demonstrates the principle only. Real stopping time depends on inertia, friction, load, braking systems and the safety functions implemented on the machine.

How does STO work?

A modern VFD uses power semiconductors to create the controlled AC output supplied to the motor. When STO is activated, the safety-related circuitry prevents those power devices from being controlled in a way that can generate motor torque.

This means that even if an unintended RUN command reaches the normal control system, a correctly functioning STO safety path prevents the drive from producing torque.

STO can therefore form part of functions intended to prevent unexpected movement, supervise access to hazardous areas or place a drive into a torque-free state during certain non-electrical maintenance tasks.

STO does not necessarily disconnect mains power from the drive. The control electronics, DC link and other internal circuits may remain energized. STO must therefore not be treated as electrical isolation for work on energized components.

What is the difference between normal STOP and STO?

A normal STOP is part of the machine's ordinary control system. The drive can follow a deceleration ramp, continue producing controlled torque and bring the process to a planned stop.

STO is a safety function. Its priority is not to create a smooth process stop but to prevent torque-producing energy from being supplied to the motor.

Normal Stop: controlled motion → controlled deceleration → standstill.
STO: torque generation disabled → motor stops according to inertia and mechanical conditions.

The resulting motion may resemble coast stop, where the motor slows down without active drive torque.

Does STO stop the motor instantly?

No. This is one of the most important points to understand about Safe Torque Off.

If STO is activated on a large fan running at 1500 rpm, torque can be removed very quickly while the fan still contains substantial kinetic energy. It may continue rotating for seconds or much longer depending on inertia and friction.

The same issue applies to centrifuges, flywheels, saw spindles, large rolls and other high-inertia mechanisms.

What if the machine must stop quickly?

If the risk assessment requires controlled deceleration before torque is removed, another drive safety function such as SS1 – Safe Stop 1 may be appropriate.

In simplified terms, SS1 first performs a controlled deceleration and then transitions to the torque-off condition.

The correct safety function must be selected from the machine risk assessment. STO is not a universal answer to every hazardous-motion problem.

Is STO the same as Emergency Stop?

No. An emergency-stop pushbutton may be an input device that initiates a machine-level safety function. STO is a drive-level function used to prevent motor torque.

A typical chain might be:

Emergency-stop button → Safety relay / Safety PLC → STO channels → Drive → Motor torque disabled

However, not every emergency stop should necessarily result in immediate STO. Some machines must first decelerate in a controlled manner before torque is removed.

Is STO the same as disconnecting the main supply?

No. STO can prevent motor torque while dangerous voltage remains present inside the drive and possibly at other parts of the electrical system.

Electrical maintenance therefore requires appropriate isolation, lockout procedures and verification of the absence of hazardous energy.

What is dual-channel STO?

Many industrial drives provide two safety channels, commonly identified as STO1 and STO2. Redundancy helps reduce the probability that a single wiring, contact or circuit failure will silently defeat the safety function.

Two wires by themselves do not create a validated safety system. The complete chain includes the initiating device, wiring, safety relay or safety PLC, drive inputs, diagnostics, reset behaviour and the machine's required safety performance.

The manufacturer's safety manual must be followed for channel timing, diagnostics, wiring, proof testing and restart behaviour.

Can STO hold a suspended load?

No. STO removes electrically generated motor torque; it does not mechanically lock the shaft.

On a hoist, lift or vertical axis, gravity may move the load when motor torque disappears. Mechanical brakes, safe brake control or additional safety measures may therefore be required.

Does STO eliminate the need for a contactor?

Not in every machine.

Integrated STO may reduce the need for certain external devices that were historically used only to prevent motor torque. However, isolation, maintenance, electrical protection or other system requirements may still require contactors, disconnecting devices or additional safety components.

Which standards are associated with STO?

IEC 61800-5-2 is one of the key standards for safety-related functions in power drive systems. The same field includes functions such as STO, SS1, SS2, SOS and safely limited motion functions.

See the OtomasyonAVM IEC 61800 guide for the wider adjustable-speed drive standards family.

At machine level, standards such as ISO 13849 and IEC 62061 may be used to design and evaluate safety-related control functions, depending on the machine and chosen methodology.

A drive advertised as capable of SIL 3 or PL e does not automatically make the complete machine SIL 3 or PL e. The entire safety function has to be considered from the initiating device through the logic and final actuator.

For the wider subject, see Industrial Standards.

How is the required safety performance determined?

The process starts with the machine risk assessment. The designer considers the severity of possible injury, exposure to the hazard and the possibility of avoiding or limiting the hazardous event.

The required safety performance can then be defined using the applicable methodology. The complete safety chain must be designed, calculated and validated to meet that target.

A drive with certified STO capability is one component in the safety function, not the complete safety function by itself.

Should a machine restart automatically after STO is cleared?

Removal of the safety demand should not automatically result in an unexpected machine restart.

The required reset and restart behaviour depends on the machine risk assessment, the safety architecture and the manufacturer's instructions. Many applications require a separate reset followed by a new start command.

Does STO need to be tested?

Yes. A safety function should be validated during commissioning and rechecked as required after safety-related wiring changes, component replacement or relevant maintenance work.

The exact acceptance-test and periodic-test requirements depend on the drive, safety architecture and applicable standards.

What STO does not do

STO is not a mechanical brake.
STO does not guarantee an instant stop.
STO is not mains isolation.
STO does not mechanically hold a suspended load.
STO alone is not the complete emergency-stop system.
A drive with STO does not automatically give the entire machine a SIL or PL rating.

STO FAQ

Is the motor electrically safe to touch when STO is active?
STO prevents torque generation, but it does not prove the absence of hazardous electrical voltage. Proper isolation is required for electrical work.

Does STO activate the motor's mechanical brake?
Not by itself. Mechanical brake control may require a separate control or safety function.

Can an ordinary digital STOP input replace STO?
Not automatically. A safety-related function must be designed to the required risk reduction and safety performance.

Does the VFD switch completely off when STO operates?
Usually not. The control system and other parts of the drive can remain powered while torque-producing output is inhibited.

Does STO provide rapid braking?
No. STO by itself normally results in a torque-free coast-down. A controlled safety stop may require a function such as SS1.

Why are there two STO channels?
Dual-channel architectures can provide redundancy and diagnostic capability so that a single fault is less likely to defeat the safety function.

Can I remove the main contactor when a drive has STO?
That decision depends on the complete electrical and machine-safety design. STO does not provide electrical isolation.

Can I permanently bridge STO inputs to clear an STO fault?
STO inputs should not be permanently bypassed merely to make a safety fault disappear. The reason for the safety demand or channel fault should be identified and corrected.