Functional Safety and STO

What it is

Functional safety is the discipline of making a machine's dangerous motion stop by design rather than by hope. On the drive side the framework for that is IEC 61800-5-2. In the standard's own scope wording: IEC 61800-5-2:2016 specifies requirements and makes recommendations for the design and development, integration and validation of safety related power drive systems in terms of their functional safety considerations.

The standard defines the safety sub-functions of a power drive system, covers monitoring sub-functions and output functions, and is a product standard positioned within the framework of IEC 61508. The most fundamental of those sub-functions, and by far the most widely used in the field, is STO — Safe Torque Off.

What STO does can be put in one sentence: when it is engaged, the drive stops supplying the motor with energy that would produce torque. The motor cannot keep driving the load, because no torque is being produced. This is not a software “stop” command; the torque-producing path in the drive's power stage is itself interrupted.

How it differs from a contactor

The classical solution is a safety contactor, either between drive and motor or in the drive's supply. A contactor does the job, but it carries three costs.

First, a contactor is an electromechanical device: its contacts wear, they can weld, and it therefore has to be monitored by a feedback contact inside the safety circuit. It occupies panel space, adds wiring and becomes a maintenance item.

Second, productivity. When the contactor opens, the drive is left completely de-energised. Once the safety demand clears, the drive has to be re-energised, the DC-link capacitors have to charge and the drive has to become ready again. On a machine that stops often — a guarded station whose door opens and closes, a cell an operator enters constantly — that wait is written straight into cycle time.

Third, opening a contactor can cost the drive its position information and its ready state, so restarting may demand a homing run.

STO removes all three costs, because the interruption happens inside the drive, on the torque-producing path. The drive stays energised, communication stays up, state information is preserved — and yet the motor cannot produce torque. When the safety demand clears, the machine returns to production quickly.

One point has to be stated plainly in return: STO is not electrical isolation. Torque is removed, but voltage may still be present at the drive's output terminals. If work is to be carried out on the electrical installation, the supply must be disconnected and a lockout-tagout procedure applied. STO does not replace a maintenance procedure; it is the machine's safe stopping function during operation.

When to choose it

STO is the right answer on any machine where safety demands arrive often and returning to production quickly afterwards has value: guarded stations, feed points behind light curtains, presses with two-hand control, and cells an operator enters as a matter of routine.

In machine safety design STO is a building block rather than a complete answer on its own. The hazard analysis determines which stopping behaviour is required; some applications need motion to be brought down in a controlled way before torque is removed, others can have torque removed immediately. That decision is an outcome of the risk assessment, not a feature picked from a catalogue.

On the implementation side the STO inputs are driven from a safety relay or safety controller, and the whole chain — sensor, logic, drive — is assessed as one. A drive supporting STO does not by itself determine the safety level of the machine.

At SMB

In the SMB catalogue STO is not a feature of every drive series; it is available on the SDU3 series. That distinction is stated deliberately: on a machine that needs a safety function, drive selection starts from this property, not from the power rating.

In the selection guide STO is a filter criterion — tick STO under “Safety & Options” and only the drives carrying it remain in the list. That is also why this page carries no product list: STO is a property that products have, not a subset of the catalogue, and the right place to work with it is the filter.

If you want to talk through a machine's safety concept, send us your hazard analysis and the stopping behaviour you need, and we will make the drive selection against those requirements together.

Common questions

Does the motor definitely stop when STO is engaged? STO stops the supply of torque-producing energy to the motor. A load already in motion coasts to a stop under its own inertia; STO is not a braking function. On vertical axes under gravity that distinction is critical, and the need for a mechanical brake has to be assessed separately.

Can STO be triggered from software? STO is driven by hardware inputs coming from the safety chain. A stop command issued by ordinary application software does not stand in for a safety function.

Can I remove the contactor entirely? That is an outcome of the machine's risk assessment. STO covers the need for safe stopping during operation; if electrical isolation is required for maintenance, a disconnecting device is still needed.

Which standard applies? On the drive side, IEC 61800-5-2 is the product standard specifying requirements for safety related power drive systems, positioned within the IEC 61508 framework. The safety requirements for the machine as a whole come from the machinery safety standards.