The obstacle to integrating six gate drivers into one device was never performance. It was analyzability. With six single channel drivers you can enumerate the failure modes of the power stage by inspection, because each driver is simple and each path is separate. TI says as much: the discrete gate driver solution is often used for STO, and its failure modes are easy to analyze because of the simplicity of the gate driver IC [1]. Collapse them into one integrated three phase device and the failure mode analysis your safety case depends on moves inside silicon you cannot see into.
Our reading is that this, more than board area, is why size constrained 48 V to 60 V drives held onto discrete gate drive as long as they did. Understanding it is the key to knowing what to demand from a supplier before you integrate.
What the standard actually requires
Safe torque off is defined in IEC 61800-5-2 as the function that prevents force producing power from being provided to the motor [1]. Not a stop. Not a brake. The removal of torque generating capability. The same standard's safe stop 1 and safe stop 2 stop the drive in a controlled manner, using motor position or current, and can then issue the STO command [1].
Two other standards set the bar you have to clear.
ISO 13849-1 classifies architectures by Category. Categories 3 and 4 require the safety function to keep working in the presence of a single fault [1]. The same standard grades outcomes by Performance Level from a through e, where e is the highest [1].
IEC 61508 handles the quantitative side through Safety Integrity Levels, where SIL 3 is typically the highest requirement seen in industrial motor drive systems [1]. It also gives us hardware fault tolerance: a system with HFT equal to 1 maintains its safety function through a single fault [1]. Performance Level e is considered equivalent to SIL 3 [1].
Where a given robot lands on that scale is a machine level question. For autonomous mobile robots, ISO 3691-4 requires a minimum of PL d, reachable with either a Category 2 or a Category 3 architecture [3]. No standard we can cite yet settles the level for a humanoid working beside people, which is a reason to design the STO path for more headroom than the mobile robot minimum, not less.
Safe torque off is named under six of the eleven safety functions in TI's mapping of ISO 3691-4 to drive subfunctions, more than any other subfunction [3]. That is why it dominates the integration discussion.
The architecture that gets you there
The reference architecture follows IEC 61800-5-2 Annex B. External safety devices assert two channels, STO-A and STO-B. Each channel contains a pulse inhibition function and its own diagnosis function. When a channel is activated, its pulse inhibition function disconnects the gate driver power supply from the gate drivers, so the power switches turn off because their drivers no longer have a rail to drive from. Each channel returns its own diagnosis signal, and the system reports a single STO feedback [1].
If STO-A fails, a properly designed STO-B still stops the motor torque. Redundant channels give you HFT equal to 1 and meet Category 3 or 4 from an architecture point of view [1]. The effectiveness of the diagnostic functions is then evaluated against the SIL and Performance Level requirements [1].
Two engineering questions this architecture raises
The safe state is reached by supply removal, not by active gate pull down. The switches turn off because the driver supply is gone [1]. That is a different failure profile from a driver actively holding gates low. Gate charge has to decay, and while it does, a dV/dt event on the switch node has no strong pull down opposing Miller induced turn on. At 48 V or 60 V with GaN edge rates, this is worth measuring on your own board during the safety validation rather than assuming from the block diagram.
Bringing the two channels into one die is the open question, and TI lists it among the questions a designer will face. The brief names four with an integrated three phase driver: what the detailed failure modes inside it are, how to connect STO-A and STO-B to it, what documentation exists, and whether a third party has validated the concept [1]. Two pulse inhibition channels in separate packages on separate supplies have an obvious independence argument. Two channels acting on one die, one package and one thermal environment have a harder one, and in our experience the common cause failure question is the first one an assessor asks. This is the specific thing to ask a supplier to show you.
What the vendor documentation does and does not cover
Here is the distinction that matters when you are assembling a safety case.
TI's DRV8350F and DRV8353F are released as Functional Safety Quality Managed devices with documentation to assist the STO design, and TI collaborated with TÜV SÜD on a proposed STO system concept using the DRV8350F, evaluated in accordance with SIL 3, Category 4 and Performance Level e requirements, with a concept report available [1]. The closely related DRV8353F smart gate driver carries a TÜV SÜD approved technical report walking through the design steps for IEC 61800-5-2 compliance [2].
Read what that covers. The third party evaluation is of a system concept built using the device. It is reusable design evidence, and it removes much of the analysis burden that kept designers on discrete drivers. It is not the same artifact as a component certified to a SIL capability, and the hardware level analysis of the complete drive still belongs to you. Being precise about which artifact you are holding is what keeps a certification audit from becoming an expensive surprise.
Why this converges with everything else in the joint
The applications TI names as the drivers for this integration are linear motor transport systems, industrial collaborative robots, industrial mobile robots and AGVs, all with power stages at typical supply voltages of 48 V to 60 V where system hardware size is strongly constrained [1].
That is the same segment, at the same voltage, that is pulling in GaN power stages with the driver integrated [2] and split supply gate drivers built for STO on a 48 V rail [4]. The design pressures are consistent: put the inverter inside the joint, remove the heat sink, shrink the board, and keep a safety case that a certification body will accept. Safe torque off is the piece of that stack where the integration argument is hardest, because it is the only piece where the thing being integrated is the ability to prove a negative.
References
- Texas Instruments, Design Smaller Safe Torque Off (STO) Systems Using Integrated 3-Phase Smart Gate Drivers, SLVAF31, March 2021.
- Texas Instruments, How Motor Drive Innovations Are Helping Solve Robotic Movement Design Challenges, SSZTCZ3, September 2023.
- Texas Instruments, Simplifying Robotics Motor Drive Safety Assessments, SPRAD98, May 2023.
- Texas Instruments, Cobots to Humanoids: Driving System Efficiency and Safety into Higher-Power Robots, SSZTD67, November 2024.