STO, SS1 or SS2 – how to safely stop a machine

Safely stopping a machine is one of the most important aspects of functional safety in industry. Automation engineers often face the question: is it enough to simply cut the power, is controlled braking the better option, or should the drive be kept energized? In practice, the answer comes down to selecting the right stop function: Safe Torque Off (STO), Safe Stop 1 (SS1), or Safe Stop 2 (SS2). In this article, we explain step by step how these functions work, when to use each one, and what to watch for when designing a machine safety system. All of it is based on standards and good practice—presented in a practical, engineering-focused way, so it doesn’t read like a dry instruction manual.

Safe machine stopping, step by step

Before we dive into the details of STO, SS1, and SS2, it’s worth understanding the safe stop categories defined in the standards. The EN 60204-1 standard distinguishes three stopping scenarios (categories) that correspond to our safety functions:

1. Category 0 (STO) – an emergency stop achieved by immediately removing power from the drive, without controlled braking. This is the fastest way to stop a machine and corresponds to the classic slam of the emergency mushroom button. Unfortunately, it’s an uncontrolled stop—it doesn’t protect mechanisms from the effects of a sudden halt. As a result, it may be too harsh for delicate machines and can also lead to long restart times.
2. Category 1 (SS1) – a controlled stop where the system first actively brakes the machine and only once motion has ceased does it remove power (transitioning to STO). In other words, the motor decelerates under drive control, followed by a safe torque-off. This approach minimizes jolts and stops motion in a more civilized way. It does take a moment to brake, but it reduces the risk of mechanical damage. A typical use case is when safety requires slowing the motion rather than cutting power immediately—for example, production lines handling delicate items, where a sudden stop could damage the product.
3. Category 2 (SS2) – a controlled stop with torque maintained after stopping. In this case, once the motor has been braked, the power supply is not disconnected; instead, the drive transitions to a safe standstill-hold state (the SOS function – Safe Operating Stop). The motor remains energized and actively holds position, preventing any movement. This solution is essential wherever position stabilization is required after stopping—for example, in industrial lifts or machines with suspended loads (so the load doesn’t start to drop). Another advantage of category 2 is the ability to resume operation quickly, because the drive system remains ready.

This breakdown makes it possible to match the stopping method to the machine’s characteristics and the hazards involved. You’ll stop a small belt conveyor differently than a heavy overhead crane with high inertia. What matters is that the risk assessment at the design stage indicates which stopping scenario ensures the safety of people and equipment. Also remember that, under the regulations, a machine’s emergency stop (E-STOP) should be implemented in category 0 or 1—i.e., as STO or SS1. Category 2 (SS2), with the supply left energized, is not intended for a typical emergency mushroom button, because in a life-saving situation we want to reduce all energy sources as much as possible. SS2 does, however, have its place in other stopping modes, which we’ll get to in a moment.

How the Safe Torque Off (STO) function works

Safe Torque Off (STO) is the simplest, most fundamental safe stop function. It works by immediately removing energy from the motor—whether by cutting off the inverter’s output voltage or opening contactors in the supply circuit. As a result, the motor can no longer produce torque (or force, in the case of linear actuators). In other words, the drive can no longer power the machine’s moving parts. STO therefore corresponds to an uncontrolled category 0 stop, as described earlier.

It’s important to stress this: STO does not actively brake the motor—it simply coasts to a stop, slowed only by friction and mechanical resistance. That’s why the stopping time with STO depends on the system’s inertia. In machines with low inertia and high resistance (e.g., a small motor with a worm gearbox), motion will cease almost immediately. But if you have a high-speed spindle or a heavy rotor with significant mass, it may continue spinning for quite a while after power is removed. STO therefore works best where an immediate stop of the entire drive is not required—the natural resistive forces are sufficient to slow the machine down within an acceptable time.

The advantage of STO is its simplicity and high reliability. Today it’s a built-in function in virtually every modern frequency inverter or servo drive. It meets stringent standard requirements (often SIL 2 or SIL 3, PL d/e), so it can replace traditional power-isolating contactors. With STO, we can prevent unexpected motor starts—this function is a fundamental safeguard against uncontrolled motion after the machine is switched off. The emergency stop button typically activates STO, removing energy and immobilizing the drive in the simplest possible way.

Limitations? Because STO does not control deceleration, it does not protect against the effects of inertia. If, for example, you stop a conveyor loaded with goods simply by cutting power, the goods may keep sliding due to momentum. For vertical axes (e.g., an overhead crane, an elevator), STO alone can even be dangerous—removing torque can cause a suspended load to drop under gravity. That’s why, in certain applications, STO must be supplemented with additional measures, such as mechanical brakes that stop motion. In such cases, the SBC (Safe Brake Control) function is used; paired with STO, it safely applies a mechanical brake on the motor or axis. This solution is standard, for example, in the cranes and elevators mentioned above—immediately after torque is removed via STO, the brake holds the load in place.

In summary: STO immediately removes torque and prevents the motor from generating force. It is a fast emergency stop, category 0, ideal when every second counts in cutting energy. However, you must ensure that the machine’s natural run-down does not create a hazard—and if it does, supplement STO with brakes or use SS1.

Safe Stop 1 (SS1) – controlled braking to a stop

When you need a controlled machine stop, Safe Stop 1 (SS1) is the solution. SS1 provides a two-phase stop. In the first phase, the drive actively brakes the motor—reducing speed according to a defined deceleration ramp or monitoring the braking time. When speed drops to near zero, the second phase begins: an automatic switch to STO (safe torque off) and, if applicable, engagement of a mechanical brake (SBC) to fully secure the axis. In other words, SS1 first dissipates kinetic energy in a controlled manner, and then removes torque just like STO.

This mode corresponds to a category 1 stop in the standard—i.e., controlled braking + power removal. SS1 is recommended when the machine must stop as quickly as possible, but in a controlled way. A typical case is equipment running at high speed or with significant inertia. A sudden power cut (STO) will lead to a long coast-down or a severe mechanical jerk from an abrupt stop. Instead, SS1 performs dynamic braking using the motor—often allowing a faster stop than friction alone—while doing so under monitoring, making it safer for the mechanics.

Examples? Circular saws, grinders, centrifuges, mechanical presses—in general, machines with high rotational energy should be stopped using SS1. Imagine a large band saw: pressing STOP causes the inverter to apply a braking ramp and quickly reduce the saw’s speed. Once the saw stops, torque is removed (STO) and the machine remains safely immobilized. This makes the stop much faster than waiting for the saw to coast to a halt, while also avoiding the risk of damaging the drive or the workpiece due to a sudden jerk—braking remains fully under the system’s control.

It’s worth noting that the EN 61800-5-2 standard allows different ways of implementing SS1. Drive manufacturers offer, for example, the SS1-r (ramp monitoring) variant—where the system monitors the deceleration ramp and enables STO when speed falls below a defined threshold—or SS1-t (time controlled), where STO is enabled after a set time, regardless of speed. Regardless of implementation, the goal is the same: stop motion as quickly as is safely possible, and then remove energy at the end. SS1 typically requires more advanced control (e.g., a safety module in the inverter or a safety PLC), but most modern drives already include these functions as standard or as an option.

As an aside, SS1 is a common choice for implementing an emergency stop, category 1—for example, pressing the mushroom button where the machine is expected to decelerate rather than have power removed immediately. An emergency stop with controlled braking is required when an immediate power cut could increase the risk (e.g., material could spill out of a rapidly rotating drum). In practice, this is implemented so that after E-STOP is pressed, the safety controller issues a braking command to the drive (SS1 ramp), and if the speed does not drop to zero within a defined time, it still cuts power as a fail-safe. This reflects the fact that the emergency stop must always work, even if braking fails. The safety system designer should anticipate that scenario.

Safe Stop 2 (SS2) – stop with position holding

That leaves the third function: Safe Stop 2 (SS2). SS2 is, in a way, an extension of SS1. It also performs a stop in two phases (braking + safe standstill), but the difference is that we do not disconnect power after the motor stops. Instead of transitioning to STO, the drive actively maintains torque on the motor at zero speed using the SOS (Safe Operating Stop) function. In other words, the motor is safely stopped at a defined position, and that position is continuously monitored and maintained by the control system. This type of safe, energized standstill corresponds to a controlled stop, category 2, mentioned earlier.

What does this give us? Above all, a fast machine restart. Because the motor remains powered (even though it is at zero speed), motion can be resumed immediately without additional procedures. By comparison, after SS1 (category 1) the system transitions to STO, so to start again you first have to re-enable power to the drive, which can be time-consuming (requires resetting the safety system, etc.). SS2 removes that delay—motion can be released practically immediately once safety conditions allow.

SS2 is used where a machine or part of it only needs to remain stopped for a short time and we want to resume quickly, or where a standstill in a ready-to-run state is required. This often follows from the specifics of the process or the need for regular, brief operator interventions. An example could be a production line where, from time to time, an operator needs to walk up and clean something, adjust a sensor, or remove a defective product. Instead of shutting down the entire machine (and then laboriously starting it up again), SS2 can be used: the line stops in a controlled manner and remains in a safe standstill, the operator does what they need for a minute, and then continues running the machine without a full restart. Another example is calibrating a vision system on a machine—stop the conveyor at a precisely defined position, while the camera remains on and ready to continue working after adjustments are made.

In applications such as robotics or assembly, SS2 is sometimes used for so-called standby stopping—the robot stops at a defined position and holds it (e.g., with a tool above a part) during a short pause, then continues without needing recalibration. It is important to remember, however, that the system remains energized—so SS2 is not used for emergency stopping, but for controlled stops during planned interruptions or service modes. Standards clearly require that, in an emergency situation, power must still be removed (STO or SS1).

From a technical standpoint, implementing SS2 requires that the drive provide speed and position monitoring (SOS) and be certified to hold torque at standstill. Many modern drives offer this capability—for example, servo drives with safety modules can detect on their own whether the motor is stopped and safely hold it at the target position. If there is a risk that the load could still start moving (e.g., due to gravity on a vertical axis), an additional mechanical brake is typically used as well for full assurance. SS2 does not relieve us from thinking about physics—the fact that current is applied to the motor to hold position is not always sufficient in the event of, for example, a serious fault. Usually, however, nothing goes wrong during short standstills, and we gain in operational continuity.

Is SS1 sufficient in high-inertia applications?

It’s time to answer the question many designers ask themselves: in high-inertia systems, is SS1 enough, or is something more needed? High inertia means the machine stores a significant amount of kinetic energy—so it is harder to stop quickly. Intuition suggests that STO alone would be insufficient, because heavy parts would coast for a long time. SS1 therefore seems like the minimum needed to actively decelerate the drive. And indeed, in most cases SS1 is the gold standard for machines with high inertia—it provides the fastest stop because the drive acts like a brake. The examples mentioned earlier (saws, centrifuges, presses) are exactly the kinds of machines with substantial rotating mass where SS1 is essentially a necessity.

But does SS1 always do the job? It depends on the circumstances. SS1 guarantees that motion is brought to a stop, but once braking is complete the drive transitions to power removal (STO). If your application only needs to stop a heavy mechanism and wait while the operator removes a part or replenishes material, SS1 will most likely be fully sufficient—the machine will stop safely, and cutting power will prevent any surprises. You simply need to ensure that the drive and its components are designed to absorb the braking energy (e.g., suitable braking resistors in the inverter so it isn’t damaged when dissipating a large amount of energy). An industrial automation engineer should verify whether the inverter/servo drive has enough braking capability for the given inertia—this is a common mistake: the safety function works, but the drive trips on an overload fault when trying to brake a heavy flywheel.

The second issue is what happens after the stop. If the system has high inertia but comes to rest in a stable position (e.g., a horizontally mounted roller simply stops rotating), then fine. However, in machines where a large mass can move under external forces (including gravity), SS1 alone may not be enough—because once STO is active, the load may start moving. Example: a large inclined conveyor with a heavy belt and product load. We brake it with the motor (SS1), but when power is removed there is a risk that gravity will pull the belt downward. In such cases, you must add a mechanical means of preventing motion. This can be the previously mentioned SBC brake, which clamps when power is removed and holds position. Without it, you’re stuck—an electrical function alone won’t override the laws of physics. In other words, SS1 must be complemented with mechanical measures when the application requires it.

Could SS2 be better for high inertia? After all, SS2 maintains torque, so there’s no risk of the load being released. That’s true—SS2 provides active holding after the stop, which is beneficial, for example, on vertical axes with a load. However, in most cases a mechanical brake is still used there as an additional safeguard. SS2 is useful when you need a quick restart—i.e., when that heavy system must start frequently and you don’t want to reset the drive every time. High inertia by itself doesn’t force you to use SS2; what it does require is controlled braking—and that’s exactly what SS1 provides. In summary: in high-inertia machines, SS1 with a well-designed braking system is usually entirely sufficient, provided you include additional brakes on axes that could move on their own. SS2 can be added if the benefits of faster restart matter to you, or if a “ready-to-run” standstill is required (but that’s driven by the process, not inertia alone).

STO, SS1, and SS2 are three different answers to the question of how to stop a machine safely. Each of these functions has its place in an automation engineer’s toolkit. STO removes energy immediately—simple and reliable, but allowing the machine to coast on inertia. SS1 adds controlled braking, making the stop faster and gentler on the mechanics, and after stopping the machine is de-energized. SS2, in turn, stops just as quickly as SS1, but keeps the machine restrained under power, ready to restart in an instant.

When designing safe control systems, it’s worth being guided by both standards (EN 61800-5-2 describes these functions in detail) as well as common sense and risk assessment. The documents will tell us what is legally required, but it’s up to us—as industrial automation integrators—to match the solution to the specific machine. Sometimes the simplest STO will be best (fewer things to fail!), and sometimes you can’t do without SS1, because otherwise the equipment could be damaged during an emergency stop. In other situations, you’ll appreciate SS2, which reduces downtime and allows the work cycle to resume quickly.

Finally, remember: none of these functions will work miracles if it’s designed poorly or used outside its intended purpose. You need the right components (inverters certified for STO/SS1/SS2, sensors, safety controllers), correct configuration, and regular testing. It’s also worth considering training on standards and regulations (e.g., Machinery Directive 2006/42/EC, EN ISO 13849-1, EN 62061), because knowledge of the rules goes hand in hand with engineering practice. We hope this article has shed some light on the STO vs SS1 vs SS2 dilemma. Next time you need to design a safe machine stop, you’ll be able to choose the best option consciously—and above all, ensure maximum safety without compromising the process. Good luck with your projects, and always work safely!