Safe Torque Off (STO) for AGV Drive Wheels | Supplier Checklist
Key takeaways
- STO (Safe Torque Off) is a drive function that prevents the drive from delivering torque-producing energy to the motor. It is defined in IEC 61800-5-2 and corresponds to stop category 0 of IEC 60204-1: power is removed and the motor coasts.
- STO does not brake the vehicle, does not electrically isolate the motor and does not hold a load. On a slope or a lifting axis it must be combined with a brake or another holding means.
- A drive with STO is a component, not a compliant AGV. The safety function a user sees, for example a protective stop when a scanner detects a person, is the whole chain: sensor, safety controller, STO channel and brake. The required performance level applies to that chain.
- "Has an STO input" is not the same as "certified STO". Ask for a certificate or safety data that names the standard, the achieved PL or SIL, the architecture and the response time.
What Safe Torque Off actually does
In a servo drive or motor controller, the power stage switches current into the motor windings. With STO active, the drive blocks the signals that would allow the power stage to produce torque, using a safety-rated circuit that is independent of the normal control software. If the vehicle controller crashes, the firmware misbehaves or a command is wrong, a correctly designed STO still stops the drive from producing torque.
In the vocabulary of IEC 60204-1 this is a category 0 stop: an uncontrolled stop by removing power. Related functions build on it. Safe Stop 1 (SS1), for instance, decelerates the drive in a controlled way and then triggers STO, which corresponds to a category 1 stop.
What STO does not do
- It does not brake. After STO the vehicle coasts. A heavy vehicle can travel a long distance before it stops, and on a ramp it may start to roll.
- It does not isolate the motor electrically. The motor terminals can still be connected to the power stage and the DC bus can still be live. STO is not a substitute for lock-out procedures during maintenance.
- It does not hold a load. For a lifting axis, torque removal means the load is held only by the mechanics. Ball-screw lifting mechanisms are generally back-drivable, so a holding brake or another holding means is normally required. See our guide on ball screw, trapezoidal screw or hydraulic lifting for how the mechanisms differ.
- It does not make the AGV compliant by itself. Compliance is a property of the complete vehicle and its risk assessment.
How STO fits into an AGV safety concept
Driverless industrial trucks are covered by ISO 3691-4, which specifies safety requirements and verification for driverless industrial trucks and their systems. It addresses functions such as emergency stop, personnel detection, braking and speed limitation, and it refers to ISO 13849-1 for the performance level (PL a to e) of the safety-related parts of the control system. The performance level required depends on the function and on your risk assessment; for personnel detection a high level such as PL d is commonly required, so check the current text of the standard and your own assessment rather than relying on a rule of thumb.
A typical protective-stop chain looks like this:
- A safety laser scanner or bumper detects a person or an obstacle.
- A safety controller or safety relay evaluates the signal.
- The safety controller opens the STO inputs of every traction drive and applies the brakes.
- The vehicle comes to rest within a stopping distance that was calculated, with margin, in the design of the protective field.
The drive's STO is one block in this chain. Its response time, the time from the STO request to the removal of torque, is part of the stopping-time budget, and its probability of dangerous failure feeds into the PL calculation.
Single-channel or dual-channel STO
Many drives offer two independent STO inputs (often labelled STO1 and STO2, or STO+ and STO-). Two channels allow the safety controller to cut torque even if one channel fails, and they are the usual way to reach higher performance levels. Single-channel implementations exist and may be sufficient for lower-risk functions, but they limit the achievable PL.
Also check how the drive behaves when only one channel is requested, whether it reports a discrepancy, and whether it needs a restart after the fault is cleared.
STO, brakes and slopes
Because STO removes torque rather than braking, vehicles that must stop in a defined distance or hold on a gradient normally use a brake that applies when power is removed (a spring-applied, power-off brake). Decide early whether the brake is released by the drive, by the safety controller or by the vehicle controller, and make sure a power loss or an STO event applies it. Your vehicle's braking requirements are set by the standard and your risk assessment.
If you are sizing drives for ramps, see our tractive force and wheel load calculation guide.
Questions to ask your drive supplier
| Question | Why it matters |
|---|---|
| Is the STO function certified, and by whom? | Some drives have an STO input that has not been assessed. Ask for the certificate, not the datasheet claim. |
| Which standard and which level (PL, SIL) does the certificate state? | It must be consistent with the PL your risk assessment demands, for example ISO 13849-1 and IEC 61800-5-2. |
| Single-channel or dual-channel? What is the architecture (category)? | Determines the achievable PL and your wiring. |
| What is the response time from STO request to torque removal? | Part of the stopping-time budget. |
| What are the failure rate (PFHd) and diagnostic coverage values? | Required inputs for the PL calculation of the whole safety function. |
| What is the mission time and is there a proof-test requirement? | Affects maintenance planning. |
| Does the drive tolerate the test pulses of your safety controller's outputs? | Avoids nuisance trips. |
| Does the drive provide an STO feedback signal? | Lets the safety controller monitor the function. |
| Does the drive control the brake? Is brake control safety-rated? | STO alone does not stop or hold the vehicle. |
| What are the restart conditions after an STO event? | Prevents unexpected restart. |
STO in JY Robot drive wheel modules
The JY-ISW STO series integrated servo wheel modules combine driver, motor, reducer and wheel in one unit for 0.6 to 2 t mobile robots, with a dual-circuit STO design and separate power and logic supplies. For the safety data and certification status that apply to your project, contact our engineers before you specify the module, so that the figures you use in your PL calculation come from the supplier's documentation.
FAQ
Is STO the same as an emergency stop?
No. An emergency stop is a function of the machine with its own requirements. STO is one way a drive can contribute to it. Many emergency stops combine STO with a brake and sometimes with a controlled deceleration before STO.
Can I use STO as the normal way to stop the vehicle?
Normally not. Stopping with STO removes control of the motor and wears brakes. Use controlled deceleration for normal stops and keep STO for safety-related stops.
Do I need STO on every drive wheel?
If a safety function has to stop the vehicle, every driven axis that can move it must be brought to a safe state. In practice that means STO or an equivalent on every traction drive, together with the brakes. Your risk assessment decides the details.
Does a certified STO make my AGV ISO 3691-4 compliant?
No. It is one certified building block. The complete vehicle, its safety functions and the verification evidence must satisfy the standard.
This article gives general engineering information and does not replace your risk assessment or the text of the applicable standards.