Aerotech XC2e, Hardware Manual, Page: 55 / 92

2.4.2. STO Functional Description
The motor can only be activated when voltage is applied to both STO 1 and STO 2 inputs. The STO state
will be entered if power is removed from either the STO 1 or the STO 2 inputs. When the STO state is
entered, the motor cannot generate torque or force and is therefore considered safe.
The STO function is implemented with two redundant channels in order to meet stated performance and
SIL levels. STO 1 disconnects the high side power amplifier transistors and STO 2 disconnects the low
side power amplifier transistors. Disconnecting either set of transistors effectively prevents the XC2e
from being able to produce motion.
The XC2e software monitors each STO channel and will generate an Emergency Stop software fault when
either channel signals the stop state. Each STO channel contains a fixed delay which allows the XC2e to
perform a controlled stop before the power amplifier transistors are turned off.
A typical configuration requiring a controlled stop has the Emergency Stop Fault mask bit set in the
FaultMask, FaultMaskDecel, and FaultMaskDisable parameters. This stops the axis using the rate
specified by the AbortDecelRate parameter. The software will disable the axis as soon as the deceleration
ramp is complete. This is typically configured to occur before the STO channel turns off the power
amplifier transistors.
The software controlled stop functionality must be excluded when considering overall system safety.
This is because the software is not safety rated and cannot be included as part of the safety function.
The XC2e will tolerate short diagnostic pulses on the STO 1+ and STO 2+ inputs. The parameter
"STOPulseFilter" specifies the maximum pulse width that the XC2e will ignore.
To resume normal operation, apply power to both STO 1 and STO 2 inputs and clear the Emergency Stop
software fault using the Fault Acknowledge button or command. The recommended use of the
Emergency Stop Fault fault mask bits prevent the system from automatically restarting.
You can achieve longer delay times through the use of an external delay timer, such as the Omron G9SA-
321 Safety Relay Unit. Place this device between the system ESTOP wiring and the XC2e's STO inputs.
Connect the ESTOP signal directly to a digital input, in addition to the external timer, to allow the XC2e to
begin a software-controlled stop as soon as the ESTOP signal becomes active. Use the
EmergencyStopFaultInput [A3200: ESTOPFaultInput] parameter to configure a digital input as an ESTOP
input.
www.aerotech.com 55
XC2e Hardware Manual 2.4. Safe Torque Off Input (STO)