Safe torque off (STO) for robot joints

By Tolerance Labs engineering team · Updated 18 October 2026

Safe torque off is the basic safety function of a motor drive: it makes sure the motor cannot produce torque. Knowing exactly what it does, and what it leaves undone, decides whether a robot stops safely or drops its arm.

What STO is

IEC 61800-5-2 defines safety functions for adjustable speed drives. Safe torque off (STO) is the simplest: the drive supplies no power to the motor that can cause torque or motion. The standard also defines functions built on it, such as safe stop 1 (SS1), safe stop 2 (SS2), safe operating stop (SOS) and safely limited speed (SLS).

STO is not the same as a software disable, an enable pin or a command over CAN. Those depend on firmware and a processor that can fail. STO acts in hardware, through circuits designed and rated for safety. Many low-cost joint modules and drivers have no STO input at all, so check the maker’s safety manual rather than the pin names on a connector.

How STO works in a drive

A drive makes torque by switching the transistors of its bridge through gate driver circuits. STO blocks that switching. A common design uses two independent channels: one removes the supply to the gate drivers, or blocks their signals, for the upper transistors, and the other does the same for the lower transistors. Either channel alone stops the bridge from driving current into the motor, so one failed channel still leaves the function working.

A safety controller or safety relay drives the two STO inputs, typically at 24 V, and the drive runs only while both are high. Most safety outputs send short test pulses, brief low pulses often a millisecond or less long, to detect a wire stuck high or shorted to the other channel. The drive must ignore pulses of that length, so check that its allowed pulse width matches the safety controller’s. Many drives also have a feedback output that reports the STO state, so the safety controller can detect a channel that did not switch.

What STO does not do

• It does not brake. With torque gone, a moving joint coasts until friction stops it. A fast joint can coast a long way.
• It does not isolate. The DC bus stays charged, and the motor terminals can still carry dangerous voltage. STO is not a means of isolation for electrical work; use the main disconnect and lockout procedures.
• It does not hold. A joint with a gravity load falls as soon as torque goes. It needs a holding brake, controlled as part of the stop; see holding brakes for robot joints.
• It does not stop generation. A permanent-magnet motor turned by its load or by a person still makes back-EMF, and the transistors’ body diodes still pass that energy to the bus; see regenerative braking and bus overvoltage.

Stop categories and SS1

IEC 60204-1 defines three stop categories for machines.

For robot joints with gravity loads, a category 1 stop usually serves better. The drive brings each joint to rest along a controlled ramp, the brakes engage, and STO follows. A category 0 stop leaves each joint to coast or fall until its brake bites, and the arm’s path during that time is not controlled. The stop category for each stop function comes from the risk assessment.

Drives implement SS1 in different ways. Some monitor the deceleration and trigger STO if it falls behind the ramp; others only wait a set time and then trigger STO. Ask which one a drive uses, and what it does if the controlled stop fails.

Worked example: how far a joint drops

Assume a shoulder joint with a gravity torque of 25 N·m and an output inertia of 0.6 kg·m², including reflected rotor inertia. STO removes torque at once, and the brake takes 30 ms to engage. These values are assumptions for the arithmetic; use your own and the brake maker’s engage time.

• Angular acceleration under gravity: α = T ÷ J = 25 ÷ 0.6 ≈ 41.7 rad/s².
• From rest, angle fallen before the brake engages: ½ × α × t² = 0.5 × 41.7 × 0.030² = 0.5 × 41.7 × 0.0009 ≈ 0.019 rad, about 1.1°.
• At a tool point 0.6 m from the axis: 0.019 × 600 ≈ 11 mm.
• Speed when the brake engages: 41.7 × 0.030 ≈ 1.25 rad/s, which the brake must then stop with its dynamic torque.
• If the joint was already moving down at 1 rad/s: 1 × 0.030 + 0.019 = 0.049 rad, about 2.8°, or about 29 mm at the tool.

Friction in the reducer slows the fall, so the estimate is conservative for a high-ratio joint and close to real for a backdrivable one. Add the brake’s own stopping distance from the engagement speed. With SS1, the drive holds the joint while the brake engages, and the drop is close to zero. Check the case on the bench: log the output angle while you trigger STO in the worst pose.

Wiring STO through a chain of joints

• Parallel. One pair of safety outputs feeds every drive’s STO inputs. The outputs must supply the total input current: if each input draws an assumed 20 mA, twelve joints need 12 × 20 = 240 mA per channel. Check the output rating, and check that the combined input capacitance does not stretch the test pulses until a drive trips.
• Grouped. Separate output pairs for each limb or group of joints. One group can stop while others hold, and each line stays short.

In robots built from joint modules, STO lines often run beside the power and bus cables through each joint. Route the two channels so that a single cable fault cannot short them together, or to 24 V, without detection; test pulses with different timing on each channel catch most such faults. Read back each drive’s STO feedback, so the controller knows every joint actually stopped. Choosing a FOC motor driver covers the other inputs and protections to check on a drive.

STO is also faster than the common shortcut of opening a contactor in the DC bus. After the contactor opens, the bus capacitors can keep the bridges running for a moment, and every restart needs a pre-charge. A contactor can still serve as an extra measure where the assessment calls for one.

Rating the safety function

A safety function is rated as a whole: the input, such as an emergency stop button, the logic in a safety controller, and the output, here the drive’s STO and the brake. Two frameworks are common. ISO 13849-1 rates a safety-related control function by performance level (PL), from a to e. IEC 62061, the machinery application of IEC 61508, rates it by safety integrity level (SIL).

A drive’s STO rating, stated in its safety manual with values such as PFH and the PL or SIL it supports, covers only the drive’s part. The required level comes from the risk assessment, and the achieved level comes from combining every part, with the wiring, test pulses and diagnostic coverage. A drive with a high-rated STO does not raise a function with a single-channel button to that level. Ask the maker for the safety manual and certificate, not a datasheet line, and use the current edition of each standard. Power and force limiting covers safety for arms that work near people.

Checklist

• Confirm that each drive has hardware STO, with a safety manual, not only an enable input.
• Match the drive’s allowed test-pulse width to the safety controller’s outputs.
• Choose the stop category for each stop from the risk assessment, and prefer SS1 for joints with gravity loads.
• Fit holding brakes where joints fall, and compute the drop during the brake’s engage time.
• Check safety output current and pulse behavior for all the joints on one channel, and read back STO feedback.
• Rate the whole function, from input to brake, under ISO 13849-1 or IEC 62061.
• Do not use STO as electrical isolation.

Browse motor drivers, motor brakes and joint modules, and ask each maker for the safety manual before you design the stop.