Safety

UPAN Core is built on one rule: the device does not trust anyone who sends it commands — not an AI agent, not an app, not a package, not a PC, and not us. The motion core, on its own processor core, checks every move against the machine limits, and the e-stop input disables the drivers in hardware. This page explains what that protects, what it does not, and what to check before you switch the machine on. The firmware is in development, so details may still change.

A functional stop, not a safety-rated one

The ESTOP input is a functional stop (not safety-rated). It stops the axes reliably, but it is not a certified emergency stop circuit.

An emergency stop to EN ISO 13850 / EN 60204-1 is a function of the whole machine: an emergency stop button on a safety relay that cuts power with a contactor (for example the mains feed of the power supply). If your machine needs an emergency stop — any machine with a spindle, a saw or a laser does — build it that way and use the UPAN e-stop input in addition.

Not for these jobs

Do not use UPAN to drive gates and doors, lifts and hoists, anything that moves over people, or medical devices. These need certified controls.

How the e-stop works

The e-stop input expects a normally closed (NC) contact between +5V and ESTOP on the OUT / E-STOP terminal (see Wiring). Pressing the button or a broken wire triggers it.

When it triggers:

1. Hardware logic disables all drivers at once — the drivers in the sockets, the EN line of the external driver terminals and the drivers of an UPAN Axis module — even if the firmware has hung.
2. The motion core sees the input, aborts any running program, marks the axes as not homed and reports the event.

A stop command from software (estop, stop) is accepted from any connected client, even one that does not hold control of the device.

After a stop, nothing restarts by itself

• The drivers stay off after you release the button. Motion resumes only after an explicit command (fault-clear in upan-cli, FaultClear in the API, or the button on the controller screen).
• The same applies after any fault (limit switch, driver error, lost supply during motion).
• After a stop or fault the axes are not homed any more: steps may have been lost, so the position is not trusted. Home again before absolute moves.

Warning: A vertical axis without a mechanical brake falls when the driver switches off. Fit a brake or a counterweight.

Note: Outputs OUT1–OUT4 currently keep their state during a stop. They can be switched off but not on while the stop is active. Whether some outputs should switch off by themselves (a valve or a clamp) is not final yet.

Limits the motion core enforces

Every axis has two sets of limits:

• The network cannot change machine limits at all. Physical access to the device is needed.
• A move or program that exceeds a limit is refused before the first step. The refusal says which limit, what was requested and what is allowed, so an agent can correct the request without guessing.
• Programs are checked twice: when loaded and again when started (limits may have changed in between). The check covers every loop, so the full range of travel is known before the axes move.
• A limit switch in the direction of motion stops the axis at once (ERROR_LIMIT_SWITCH). Moving away from a triggered switch is allowed; moving towards it is refused.
• If the motor supply is missing or too low, motion on the drivers in the sockets is refused; if it disappears during a move, the axis faults.

What a package can and cannot do

A package from upan.tools sets the controller screen, the working limits, the axis settings within the machine limits and the programs. It cannot change the firmware, the machine limits or the e-stop. The firmware is the same for everyone and signed by us (Secure Boot v2, encrypted flash); the controller refuses firmware that is not.

The controller screen and any app in a package run in your browser and talk to the controller only through its API, so they get the same checks as any other client.

Homing rules

The device does not know where an axis is until it has been homed.

Homing means a Home command (by limit switch or, with a TMC2209, by stall detection) or SetPosition (you declare the current position). After homing, a jog stops by itself at the working limit.

Connection loss

• Jog needs a steady stream of commands. If the connection drops, the axis stops by itself after a timeout.
• A loaded program keeps running when Wi-Fi or USB drops. The machine should not stop half-way because of Wi-Fi. Stop it with the e-stop or a stop command.

Before the first power-on

1. Power supply of 12–24 V, never above 36 V; not a 48 V supply. On LRS supplies, check the 115/230 V switch.
2. PE connected to the supply, machine frame and motor housings. Mains through a 2–6 A type C breaker (see Power).
3. Supply polarity at the power terminal: pin 1 +, pin 2 GND.
4. Drivers seated the right way in the sockets, with heatsinks; motors connected before the supply is switched on.
5. Stop button wired as NC between +5V and ESTOP, or a jumper between pins 6 and 7 of OUT / E-STOP.
6. Limit switches wired as NC, or marked as absent in the axis settings.
7. Sensors on +V rated for your supply voltage. Loads on OUT1–OUT4 rated for the supply voltage and at most 0.5 A.
8. Set the motor current to the nameplate value before the first move (the package from the agent asks for it).

Working on the machine

• Never connect or disconnect a motor, or plug a driver into a socket, while the supply is on: it destroys the driver. Switch off the mains side of the supply first, and do all other wiring with the power off too.
• Do not reach into the machine while the device is powered: a running program continues even if your phone loses the connection.