Previously, we offered steps on how to design functional safety into your machines as well as common safety functions. In our final installment of this blog series, we dive into how safe torque off (STO) works and introduce a design that simplifies system complexity.

An In-Depth Look at STO

STO is a critical fallback state in many safety functions. Because of its prevalence, it is important to understand how STO works and its advantages over previous methods of reducing machine risk.

Before the STO function, machines featured redundant contactors to ensure that the motor did not generate torque. These contactors would physically disconnect the drive from the motor. However, multi-axis applications featuring this design quickly become cost-prohibitive. Additionally, the design is too weight- and space-inefficient for mobile, battery-powered applications.

Eliminating the need for redundant contactors, STO uses discrete, redundant enable inputs for the drive power stage. This provides a hardware solution without requiring firmware, as shown below.

A simplified servo drive power stage model.

This simplified servo drive power stage depicts power transistors as switches. Both high and low transistors must be closed in order to drive a current through the motor. If either of the enables are inactive, no current flows and the motor is rendered safe.

The failure mode and effects analysis (FMEA) of this power stage circuitry is how STO implementations are rated. Drive manufacturers will often provide diagnostic requirements to meet PL and SIL ratings. Advanced servo drives will use a safety-rated processor to perform automated diagnostics.

Functional Safety System Trends

In many safety systems, it is common for the drive to only feature STO as its sole safety function while all others are handled by a PLC that is designed to conform to safe architecture and firmware guidelines. The PLC monitors the machine via a second encoder. If a safety function is triggered, it activates STO and disables the drive power stage.

Common safety configuration featuring a safe PLC.

The current design trend for functional safety systems is to incorporate all the safety functions in the drive and connect it to an encoder, both of which meet safety specifications. Eliminating the PLC reduces system complexity and simplifies wiring. If the system requires safety functions with high ratings, the encoder provides additional position information for redundancy.

Safety configuration featuring a safe drive.

In this configuration, the encoder and drive communicate via a safety-rated protocol and can be considered a safety system. The redundant communication frame monitoring within the drive also uses this protocol. This system design allows a lower-rated PLd/SIL2 encoder to be used for PLe/SIL3 safety functions — so long as the drive features additional diagnostics.

This design also does not connect STO to the drive power stage. Instead, interlocks and collision detection sensors are connected to a controller that can command STO and other safety functions to multiple drives via a safety-rated communication network. In the figure above, the safety network is FailSafe over EtherCAT® (FSoE).

Utilizing this design is an optimal way to include functional safety in a machine. Functional safety can provide simplified, lower-cost systems with increased productivity and safer machine-human interaction without the need for bulky protective equipment.

Read our technical note to learn more.

Technology Blog

Similar Posts

Adding Functional Safety to Automated Machines: Part II

Adding Functional Safety to Automated Machines: Part I

Copley Controls Coming to MD&M West 2025!