Aerotech Automation1 iXL2e, Hardware Manual

Page: 52 / 96

2.4.2. STO Functional Description
The motor can only be activated when voltage is applied to both STO 1 and STO 2 inputs. The STO
state will be entered if power is removed from either the STO 1 or the STO 2 inputs. When the
STO state is entered, the motor cannot generate torque or force and is therefore considered safe.
The STO function is implemented with two redundant channels in order to meet stated performance
and SIL levels. STO 1 disconnects the high side power amplifier transistors and STO 2 disconnects
the low side power amplifier transistors. Disconnecting either set of transistors effectively prevents
the drive from being able to produce motion.
The drive software monitors each STO channel and will generate an Emergency Stop software fault
when either channel signals the stop state. Each STO channel contains a fixed delay which allows the
drive to perform a controlled stop before the power amplifier transistors are turned off.
A typical configuration requiring a controlled stop has the Emergency Stop Fault mask bit set in the
FaultMask, FaultMaskDecel, and FaultMaskDisable parameters. This stops the axis using the rate
specified by the AbortDecelRate parameter. The software will disable the axis as soon as the
deceleration ramp is complete. This is typically configured to occur before the STO channel turns off
the power amplifier transistors.
The software controlled stop functionality must be excluded when considering overall system safety.
This is because the software is not safety rated and cannot be included as part of the safety function.
The drive will tolerate short diagnostic pulses on the STO 1+ and STO 2+ inputs. The parameter
"STOPulseFilter" specifies the maximum pulse width that the drive will ignore.
To resume normal operation, apply power to both STO 1 and STO 2 inputs and use the
Acknowledge
All button or the AcknowledgeAll() or FaultAcknowledge() function to clear the Emergency Stop
software fault. The recommended use of the Emergency Stop Fault fault mask bits prevent the
system from automatically restarting.
You can achieve longer delay times through the use of an external delay timer, such as the Omron
G9SA-321 Safety Relay Unit. Place this device between the system ESTOP wiring and the drive's STO
inputs. Connect the ESTOP signal directly to a digital input, in addition to the external timer, to allow
the drive to begin a software-controlled stop as soon as the ESTOP signal becomes active. Use the
EmergencyStopFaultInput parameter to configure a digital input as an ESTOP input.
2.4.2. STO Functional Description iXL2e/XL2e Hardware Manual
52 www.aerotech.com