Safe Torque Off vs Contactor Safe Stop: Choosing the Architecture

Two architectures can stop a motor safely, and they are not interchangeable. One opens contactors and physically removes power from the motor. The other tells the drive’s electronics to stop firing the output stage, so the motor produces no torque while its terminals remain live. Both can satisfy a safety function; only one gives you galvanic isolation, and only one has wearing parts.

This is an architecture decision, not a component decision. If you are still choosing between a safety contactor and a standard contactor, that comparison is in safety versus standard contactors. This article assumes the safety function has already been defined and asks how to implement it: Safe Torque Off from the drive, a contactor-based power removal circuit, or the hybrid arrangement that most machine builders settle on.

Quick Answer: What Each Architecture Removes

The most expensive misconception in this area is treating STO as isolation. STO makes the motor safe to touch only if the motor cannot generate torque — it does not make the motor terminals dead. Anyone opening a motor terminal box after an STO stop is working on live conductors.

What STO Actually Does

Safe Torque Off is a function inside the drive. When the safety input is de-asserted, the drive’s control electronics stop generating the switching pattern for the power semiconductors, so no rotating field is produced and the motor cannot generate torque. The drive typically certifies this function to SIL 3 / PL e as a subsystem; whether the whole machine achieves that level depends on the sensors, wiring and verification around it.

Three properties define its use:

• It is a stop, not a disconnect. The output stage is not isolated, and the DC bus remains charged. The drive’s own discharge time and warning labels still apply.
• It stops torque, not motion. On a high-inertia load, or a vertical axis with an unbalanced load, the machine keeps moving under inertia or gravity after STO engages. Holding that load requires a brake — mechanical or a controlled braking sequence — which is a separate function.
• It is fast and diagnostic. Response is electronic, there are no contacts to weld, and the drive reports its safe state through a status word, which makes the safety function easier to validate and to keep validated.

Most drives pair STO with a controlled deceleration: the standard safety function SS1 (safe stop 1) commands a controlled stop, monitors that the motor actually decelerates, and then asserts STO. That combination gives you a controlled stop without wear, and it is why pure STO is less common in practice than SS1-on-STO.

What a Contactor Safe Stop Actually Does

A contactor-based safe stop removes the supply. The conventional implementation uses two contactors in series, each with mirror (force-guided) contacts, energised through a dual-channel safety relay or safety PLC with external device monitoring. Two devices in series exist to defeat a single welded contact: one contactor that fails closed still leaves a second device able to open the circuit.

The advantages are equally concrete:

• It works with any drive, including drives with no safety input at all — which is most of the installed base.
• It provides a visible break that maintenance staff can verify, and it can serve as the isolation point for work on the motor circuit when the safety procedure allows it.
• It covers a group. One contactor pair can remove power from several motors fed from a common group, which STO cannot do because STO is per drive.

The cost is mechanical: contacts wear, coils fail, and the drop-out time is not negligible. That last point interacts directly with coil suppression — a plain flyback diode on a DC coil can extend drop-out by a factor of six to ten, which may push the safety function’s response time outside its specification. The numbers are in contactor coil surge suppression, and this is the single most common reason a contactor-based safety circuit fails its validation on the bench.

Stop Categories Decide More Than the Hardware

IEC 60204-1 defines stop categories, and the category constrains the architecture before any device is chosen:

Category 0 on a high-inertia load means mechanical stress and, on a vertical axis, a load that may not hold. Category 1 needs a controlled deceleration path, which means the drive must stay powered and in control during the stop — a requirement that a contactor-only architecture cannot satisfy, because opening the contactor removes the drive’s ability to brake. This is where STO earns its place: it can be asserted after a controlled stop, with the drive still powered throughout.

Choosing the Architecture

The hybrid arrangement deserves a note because it is frequently the right answer and rarely the first one proposed. Pairing SS1-on-STO with a contactor backup gives a controlled stop and a redundant power-removal path, at the cost of one contactor pair and its wiring. On machines where a runaway after a safety stop is the dominant risk, that redundancy is usually justified; on a simple conveyor it is usually not.

Wiring and Verification Points That Decide the Outcome

• Dual channel, cross-monitored. Both architectures require two independent channels with cross-monitoring, or a certified single-channel device rated for the required category. A single contactor with a mirror contact is not a redundant channel.
• EDM on contactor architectures. External device monitoring watches the mirror contacts and refuses a restart if a contactor has welded. Without it, a welded contactor is only discovered at the next demand.
• Maximum demand rate. Safety functions have a specified maximum demand rate and a proof-test interval. On a contactor architecture with heavy cycling, the proof test has to be scheduled, not assumed.
• Response time budget. Add the safety relay’s response, the contactor’s drop-out time (including any suppression delay) and the machine’s stopping time. If that total exceeds the safe distance calculation, the architecture is wrong regardless of its category.
• Restart behaviour. A safety stop must not restart automatically on reset. Manual reset with a monitored reset button is the norm, and it must be outside the hazard zone.

Where the drive is being fed through a combination starter, the contactor may already be performing a switching duty that should not be conflated with the safety function — the distinction between a combination and non-combination starter is covered in combination versus non-combination starters, and the general starter selection context in contactor selection for motor starters.

Six Architecture Mistakes

One further constraint applies to the contactor itself: a latching or mechanically held contactor must never be used as the safety element, because it does not open on power loss. The mechanisms and their failure modes are described in latching and reversing contactor types.

Часто задаваемые вопросы

Is STO safer than a contactor?

Neither is inherently safer; each is certified to a level, and the application determines whether that level and the architecture are adequate. STO has no wearing parts and better diagnostics, but no isolation. A contactor pair isolates and works on any drive, but adds wear and drop-out time. Compare achievable performance level and functional suitability, not brand preference.

Can I use STO instead of a main contactor?

For stopping torque, yes — if the drive is STO-capable and the risk assessment accepts an architecture without galvanic isolation. For isolation during maintenance, no: a disconnect is still required, and many machine standards expect a physical means of isolation independent of the drive.

Does STO stop the motor immediately?

It removes torque immediately, but it does not stop motion. A coasting load continues under inertia, and a vertical load may fall unless a brake engages. Stop category 0 behaviour is the result unless the drive is commanded to decelerate first.

How many contactors do I need for a safe stop?

Conventionally two, in series, each with mirror contacts, monitored by a dual-channel safety relay with EDM. A single contactor is only acceptable when a certified device rated for the required category is used and the risk assessment supports it.

Why does my safety circuit take too long to drop out?

Check the coil suppression first. A plain flyback diode on a DC coil can extend drop-out by six to ten times, which is usually enough to break the response-time budget. Replacing it with a diode-plus-Zener combination or an MOV restores the speed while keeping the protection.

Can one contactor pair protect several drives?

Yes, and that is one of its advantages: a contactor pair upstream of a group removes power from every motor on that group at once. STO cannot do this because it is a function of each individual drive.

The Practical Takeaway

Decide the stop category first, then the architecture, then the devices. If the machine needs a controlled stop with power maintained during deceleration, the drive has to stay in control — which points to SS1 on STO, with a contactor pair added only if a redundant power-removal channel is justified. If the drives are older, the motors share a group, or isolation at the motor is a requirement, a contactor pair with mirror contacts and EDM is the right answer. In both cases, keep the disconnect, keep the brake, and check the drop-out time before signing the validation. For contactors used in the power-removal path, the CJX2-D / LC1-D series page lists the frame and auxiliary configurations, and the AC contactor category covers the range.