Safe Torque Off (STO)

What Safe Torque Off Means in Motion Safety

Safe Torque Off is not a full power removal function. It is a safety-oriented torque inhibit that stops the drive from producing motor torque while leaving the broader control system energized, which matters in machines that need a safe stop category or controlled restart path.

Because STO acts at the torque-producing stage, it is different from simple stop commands in software or operator interfaces. It is usually implemented through a safety control circuit or safety-rated drive input, so the function can remove the drive's ability to energize the motor even if a normal control command fails.

Where STO Fits in Industrial Safety Architecture

STO belongs in the machine's safety architecture, alongside emergency stop logic, interlocks, safety relays or safety PLCs, and other protective functions. Its role is to reduce hazardous motion risk without forcing every system to de-energise completely, which can be important for uptime, diagnostics, and orderly shutdown.

In practice, STO is most useful when unexpected restart or unintended torque creation is the hazard to control. It can support safer maintenance and fault handling, but it is not a substitute for mechanical guarding, lockout procedures, or other safeguards when residual motion, gravity, or stored energy remain relevant.

What STO Does and Does Not Protect Against

STO blocks torque generation, but it does not necessarily remove all electrical energy, hold a load in place, or eliminate every motion hazard. A vertical axis, a coasting load, or external mechanical energy may still create danger after STO is active, so the machine design must account for the full motion profile.

That distinction is why STO is often one element in a layered design rather than the only safeguard. Where the hazard involves braking, position retention, or controlled deceleration, additional functions such as safe brake control or monitored stop behavior may be required by the machine's risk assessment.

Why STO Matters for Commissioning and Operations

STO is valuable because it gives operators and engineers a predictable safety boundary around motion. It lets the drive remain available for supervision and fault handling while preventing torque from being produced, which can reduce downtime and avoid unnecessary power cycling during safety events.

It also creates a governance obligation for industrial teams: the safety function has to be tested, documented, and treated as part of the machine's required protective design, not as a convenience feature. If the safety circuit, wiring, or drive configuration is altered, the expected STO behavior must still be verified before the machine returns to service.

Risk and Threat Considerations

STO reduces the risk of hazardous motion, but it can create a false sense of safety if teams assume it removes every energy source or every movement path. The main exposure is residual or secondary motion, including gravity-driven movement, mechanical coasting, or a misdesigned safety circuit that does not fully inhibit torque when needed.

Failure mechanism: A drive, safety input, or upstream safety circuit fails open, is miswired, bypassed, or is relied on as the only protection while other energy sources remain active.

Impact: The machine can still move, coast, or restart unexpectedly, exposing personnel to crushing, entanglement, or maintenance injury even though STO appears to be engaged.

Practitioner Guidance

Why practitioners should care: Treat STO as a specific torque-inhibit function, not a blanket "safe state." The design question is whether the machine still has dangerous motion, stored energy, or load retention risks after torque is removed.

What to watch for: Verify that the safety function is validated in the real machine state, including wiring, feedback behavior, restart conditions, and any dependency on external brakes or control logic. If those dependencies change, the safety case for STO changes too.

Related resources from NHI Mgmt Group

• What breaks when defenders rely on EDR alone against attackers who use living off the land or safe mode evasion?
• How should security teams decide whether JIT access is safe for non-human identities?
• What is the difference between short-lived access and safe access for non-human identities?
• What is the difference between self-service administration and safe delegated control?