A method of monitoring a safety function of a manipulator, in particular of a robot, comprising the steps of: monitoring a safety function (R, v, W) of the manipulator (S10, S11, S12) which comprises a standstill monitoring of the manipulator, a speed monitoring of the manipulator, an acceleration monitoring of the manipulator, a safety zone monitoring and/or work zone monitoring of the manipulator by means of a detection device which receives electromagnetic radiation and detects objects in the monitored space based thereupon and/or detects an opening of an access to the work zone, or a tool monitoring of the manipulator by means of a detection device which detects the absence of a tool of the manipulator or a malfunction of a tool of the manipulator; additionally monitoring a state parameter (q, T, B) of the manipulator (S20, S21, S22) different from the safety function of the manipulator, which state parameter is a position (q), a speed, an acceleration or a higher-order derivative of the position of the manipulator with respect to time, a time interval between an activation of the safety function monitoring and the determination that the safety function that is being monitored is not valid; or a bus fault signal; and halting the manipulator in a first mode (STOP 0) in which an energy supply of the drives of the manipulator is immediately interrupted if the safety function which is being monitored is not valid and the state parameter that is being monitored lies within a first range; and halting the manipulator (S30, S31, S32) in a second mode (STOP 1, STOP 2) different from the first mode, in which second mode the manipulator is slowed down by means of drives which are supplied with energy from the energy supply if the safety function which is being monitored is not valid and the state parameter which is being monitored lies within a second range, wherein, in connection with the halting because of the safety feature which is no longer valid, a distinction is made, on the basis of the monitoring of the state parameter, as to whether there is a malfunction of the manipulator or whether the manipulator functions without fault. monitoring a safety function (R, v, W) of the manipulator (S10, S11, S12) which comprises a standstill monitoring of the manipulator, a speed monitoring of the manipulator, an acceleration monitoring of the manipulator, a safety zone monitoring and/or work zone monitoring of the manipulator by means of a detection device which receives electromagnetic radiation and detects objects in the monitored space based thereupon and/or detects an opening of an access to the work zone, or a tool monitoring of the manipulator by means of a detection device which detects the absence of a tool of the manipulator or a malfunction of a tool of the manipulator; additionally monitoring a state parameter (q, T, B) of the manipulator (S20, S21, S22) different from the safety function of the manipulator, which state parameter is a position (q), a speed, an acceleration or a higher-order derivative of the position of the manipulator with respect to time, a time interval between an activation of the safety function monitoring and the determination that the safety function that is being monitored is not valid; or a bus fault signal; and halting the manipulator in a first mode (STOP 0) in which an energy supply of the drives of the manipulator is immediately interrupted if the safety function which is being monitored is not valid and the state parameter that is being monitored lies within a first range; and halting the manipulator (S30, S31, S32) in a second mode (STOP 1, STOP 2) different from the first mode, in which second mode the manipulator is slowed down by means of drives which are supplied with energy from the energy supply if the safety function which is being monitored is not valid and the state parameter which is being monitored lies within a second range, wherein, in connection with the halting because of the safety feature which is no longer valid, a distinction is made, on the basis of the monitoring of the state parameter, as to whether there is a malfunction of the manipulator or whether the manipulator functions without fault.