A torque-limiting safety circuit servo drive for an AC permanent magnet motor comprising: a three-phase inverter bridge fed from a DC bus; a first current sensor detecting current in a first motor phase; a second current sensor detecting current in a second motor phase; a third current sensor detecting current in the DC bus; a drive control circuit providing pulse-width-modulated gate drive signals to the three-phase inverter bridge, the drive control circuit having a first safety channel safe-torque-off input and a second safety channel safe-torque-off input, the drive control circuit adapted to emit a signal set representing a switching state of the three-phase inverter bridge to modify a pulse-width-modulated switching pattern; a first safety processor controlling the first safety channel safe-torque-off input of the drive control circuit; a second safety processor controlling the second safety channel safe-torque-off input of the drive control circuit; a first current vector calculator and error detector configured to detect a discrepancy based on a signal from the third current sensor and the signal set representing a switching state of the three-phase inverter bridge, said signals compared against the first and second current sensor signals and provide a fault signal to the first safety processor based on the discrepancy; and a second current vector calculator and error detector configured to detect a discrepancy based on a signal from the third current sensor and the signal set representing a switching state of the three-phase inverter bridge, said signals compared against the first and second current sensor signals and provide a fault signal to the second safety processor based on said discrepancy; wherein the drive control circuit is adapted to shut down the three-phase inverter bridge responsive to input from either of the first safety processor or the second safety processor. a three-phase inverter bridge fed from a DC bus; a first current sensor detecting current in a first motor phase; a second current sensor detecting current in a second motor phase; a third current sensor detecting current in the DC bus; a drive control circuit providing pulse-width-modulated gate drive signals to the three-phase inverter bridge, the drive control circuit having a first safety channel safe-torque-off input and a second safety channel safe-torque-off input, the drive control circuit adapted to emit a signal set representing a switching state of the three-phase inverter bridge to modify a pulse-width-modulated switching pattern; a first safety processor controlling the first safety channel safe-torque-off input of the drive control circuit; a second safety processor controlling the second safety channel safe-torque-off input of the drive control circuit; a first current vector calculator and error detector configured to detect a discrepancy based on a signal from the third current sensor and the signal set representing a switching state of the three-phase inverter bridge, said signals compared against the first and second current sensor signals and provide a fault signal to the first safety processor based on the discrepancy; and a second current vector calculator and error detector configured to detect a discrepancy based on a signal from the third current sensor and the signal set representing a switching state of the three-phase inverter bridge, said signals compared against the first and second current sensor signals and provide a fault signal to the second safety processor based on said discrepancy; wherein the drive control circuit is adapted to shut down the three-phase inverter bridge responsive to input from either of the first safety processor or the second safety processor.