Safe Torque Off (STO) and Safe Brake Control (SBC)
What are STO and SBC?
Safe Torque Off (STO) and Safe Brake Control (SBC) are the most basic safety functions for servo drives according to IEC 61800-5-2. STO prevents the drive from supplying torque-generating current to the motor by hardware-based blocking of the power transistors (IGBTs) at the gate driver level. SBC safely controls an external holding brake by interrupting the power supply to the brake output.
Why is this important?
STO is the basis of all drive-integrated safety functions. Without STO, external contactors would have to disconnect the power supply—with greater effort, more cabling, and additional sources of error. STO replaces this external shutdown with a SIL 3-certified function integrated into the drive.
SBC is essential for gravity-loaded axes: if STO removes the torque, a vertical axis without a brake would descend uncontrollably. SBC ensures that the holding brake engages safely before the drive loses power.
Together, STO and SBC enable:
- Safe emergency stop circuits without external power contactors
- Protection for vertical axes — brake closes before torque is removed
- Basis for higher safety functions — SS1, SS2, and SOS are based on STO/SBC
- Certification up to SIL 3 / PLe / Category 3 — highest safety level customary in drive technology
How does it work?
STO — Stop Category 0 (uncontrolled stop): STO blocks the gate signals of the power transistors in the inverter. The motor can no longer generate torque and coasts to a stop. This is a purely hardware-based function with a dual-channel architecture: two independent safety channels must both be active in order for the drive to generate torque. If one channel fails, STO is automatically activated.
Negative logic (zero-active): The command to activate STO is 0 (not 1). This means that a cable fault or signal loss automatically results in a safe state—a fail-safe design principle.
SBC — Safe Brake Control: SBC works with spring-applied holding brakes that are open when energized. If the power supply is interrupted, the spring closes the brake. The sequence is crucial: SBC first activates the brake, followed by STO after a configurable delay time (Brake Time Delay, 0x6661:1). This prevents the axis from moving uncontrollably between torque withdrawal and brake engagement.
Important: SBC should only be activated when the machine is at a standstill or running at very low speed. Braking from high speeds can damage the mechanical brake. SS1 is connected upstream for controlled braking.
How does SOMANET implement this?
STO and SBC are implemented on the SOMANET Safe Motion Module (SMM) —a separate hardware module that is mounted between the processor and drive module of the SOMANET Circulo. Activation is performed via FSoE (Fail Safe over EtherCAT) or via two safe digital inputs (standalone).
STO and SBC do not require encoder feedback and achieve SIL 3 / PLe / Category 3 regardless of the encoder configuration. All higher-level safety functions (SS1, SS2, SOS, SLS) use STO/SBC as a fallback level — they always have the highest priority in the safety system.
Further links:
