project-pegasus wrote: So I just need to add a relay between J1-100 and J1-98. What would you recommend to make the ESTOP circuit safer?
Machine safety design has evolved significantly. In the USA, NFPA79 is still relevant, and still more concerned with electrical safety than anything, in Europe, EN 62061 and EN ISO 13849-1 standardize the development of functional safety and control safety respectively. Siemens have a
safety doc
that gives a good overview.
For example - The estop button circuit on the XT is not redundant, and both wires travel through the same conduit. A short circuit in that conduit could prevent the estop from working. A better safety design would have a dual circuit switch with the wires physically separated. Simlarily the door interlock could also be redundant.
The XT safety design is inherent in the board design and component choice. Such designs are thus expensive to manufacture, expensive to change, expensive to prove and and expensive to certify. Modern machine designs often use modular specific-purpose safety controllers to monitor sensors and effect changes, making that certification easier. Another observation - the estop signal for most of the XT ( ATC excepted ) runs via the motion control card, where presumably the motion control software does some signal handling and powers down the spindle and servos. That pulls a lot of potential failure modes into the situation, not least the fact that the programming of the card can be changed by the PC. What else? Oh, the spindle is powered down by the VFD during estop, but there is no guarantee. A failure in the VFD control logic could leave the spindle spinning. The VFD should be fail-safe, but modern machine designs often include safety contactors to disconnect the motor leads from the VFD too. Disconnecting running motors is undesirable, can damage VFDs, and can result in a slower braking action than a VFD-controlled stop, so many safety controllers include a configurable time-delayed output; the estop first triggers a VFD stop and a couple of seconds later disconnects the motor as a backup.
Once you start looking at it, there's a lot that could be done to make it safer, but you could spend a lot of time and money doing so. It's a bit like trying to bring a classic car up to modern crash test standards - you might be better off just cutting chips.