Aerotech Automation1 XC2, Hardware Manual, Page: 56 / 96

2.4.2. STO Functional Description
The motor can only be activated when voltage is applied to both STO 1 and STO 2 inputs. The STO state
will be entered if power is removed from either the STO 1 or the STO 2 inputs. When the STO state is
entered, the motor cannot generate torque or force and is therefore considered safe.
The STO function is implemented with two redundant channels in order to meet stated performance and
SIL levels. STO 1 disconnects the high side power amplifier transistors and STO 2 disconnects the low
side power amplifier transistors. Disconnecting either set of transistors effectively prevents the XC2
from being able to produce motion.
The XC2 software monitors each STO channel and will generate an Emergency Stop software fault when
either channel signals the stop state. Each STO channel contains a fixed delay which allows the XC2 to
perform a controlled stop before the power amplifier transistors are turned off.
A typical configuration requiring a controlled stop has the Emergency Stop Fault mask bit set in the
FaultMask, FaultMaskDecel, and FaultMaskDisable parameters. This stops the axis using the rate
specified by the AbortDecelRate parameter. The software will disable the axis as soon as the deceleration
ramp is complete. This is typically configured to occur before the STO channel turns off the power
amplifier transistors.
The software controlled stop functionality must be excluded when considering overall system safety.
This is because the software is not safety rated and cannot be included as part of the safety function.
The XC2 will tolerate short diagnostic pulses on the STO 1+ and STO 2+ inputs. The parameter
"STOPulseFilter" specifies the maximum pulse width that the XC2 will ignore.
To resume normal operation, apply power to both STO 1 and STO 2 inputs and use the Acknowledge All
button or the AcknowledgeAll() or FaultAcknowledge() function to clear the Emergency Stop software
fault. The recommended use of the Emergency Stop Fault fault mask bits prevent the system from
automatically restarting.
You can achieve longer delay times through the use of an external delay timer, such as the Omron G9SA-
321 Safety Relay Unit. Place this device between the system ESTOP wiring and the XC2's STO inputs.
Connect the ESTOP signal directly to a digital input, in addition to the external timer, to allow the XC2 to
begin a software-controlled stop as soon as the ESTOP signal becomes active. Use the
EmergencyStopFaultInput [A3200: ESTOPFaultInput] parameter to configure a digital input as an ESTOP
input.
2.4. Safe Torque Off Input (STO) XC2 Hardware Manual
56 www.aerotech.com