Aerotech Automation1 iXR3, Hardware Manual

Page: 84 / 112

2.10.2. STO Functional Description
The motor can only be activated when voltage is applied to both STO 1 and STO 2 inputs. The STO
state will be entered if power is removed from either the STO 1 or the STO 2 inputs. When the
STO state is entered, the motor cannot generate torque or force and is therefore considered safe.
The STO function is implemented with two redundant channels in order to meet stated performance
and SIL levels. STO 1 disconnects the high side power amplifier transistors and STO 2 disconnects
the low side power amplifier transistors. Disconnecting either set of transistors effectively prevents
the controller from being able to produce motion.
The controller software monitors each STO channel and will generate an Emergency Stop software
fault when either channel signals the stop state. Each STO channel contains a fixed delay which
allows the controller to perform a controlled stop before the power amplifier transistors are turned
off.
A typical configuration requiring a controlled stop has the Emergency Stop Fault mask bit set in the
FaultMask, FaultMaskDecel, and FaultMaskDisable parameters. This stops the axis using the rate
specified by the AbortDecelRate parameter. The software will disable the axis as soon as the
deceleration ramp is complete. This is typically configured to occur before the STO channel turns off
the power amplifier transistors.
The software controlled stop functionality must be excluded when considering overall system safety.
This is because the software is not safety rated and cannot be included as part of the safety function.
The controller will tolerate short diagnostic pulses on the STO 1+ and STO 2+ inputs. The parameter
"STOPulseFilter" specifies the maximum pulse width that the controller will ignore.
To resume normal operation, apply power to both STO 1 and STO 2 inputs and use the Acknowledge
All button or the AcknowledgeAll() or FaultAcknowledge() function to clear the Emergency Stop
software fault. The recommended use of the Emergency Stop Fault fault mask bits prevent the
system from automatically restarting.
You can achieve longer delay times through the use of an external delay timer, such as the Omron
G9SA-321 Safety Relay Unit. Place this device between the system ESTOP wiring and the controller's
STO inputs. Connect the ESTOP signal directly to a digital input, in addition to the external timer, to
allow the controller to begin a software-controlled stop as soon as the ESTOP signal becomes active.
Use the EmergencyStopFaultInput [A3200: ESTOPFaultInput] parameter to configure a digital input
as an ESTOP input.
2.10.2. STO Functional Description iXR3/XR3 Hardware Manual
84 www.aerotech.com