Background Work

Emergency Stop is one of the safety functions.

Like all safety functions this means it should stops devices no matter what, regardless of user program state etc. and this need to be tamper resistant.

The way to accomplish this is to use outputs that are controlled by user program but also affected by safety state of the controller. In almost all cases safe state is deenergized state. So this is done by using safety circuit to interrupt power supply to the output card(s). But that may not be enough - for example if it is possible for the device (in this case spindle) to still run even if the control signal is off. This could be due to construction of the device itself. If the design is such that it could still run despite signal being off, then one cannot simply rely on blocking the signal - one need to block power to the device itself. Note that "could run" includes both normal or abnormally (for example due malfunction of the device).

If the device does not have built in (and correctly used) safety features, then interrupting power to the device itself is needed. And that too need to match the integrity level of the used safety function (in this case EStop). Safety integrity level includes things like redundancy, monitoring etc.

Implementing something that bypasses safety or pretends to be safe means liability. An example of this is any band-aid attempt to "make it safe" like turning off an output in user program. the robot outputs are not safety rated. neither are the robot or submit interpreter. nor they are tamper proof....

As Panic says: if this is a safety hazard, then the correct way to handle the problem is to wire the power supply of the spindle in series with the E-Stop circuit in some way.

One possible approach would be to have the spindle power interrupted by a relay closed by the Drives On status outputs at pins 35&36 and 33&34.

yes, it is possible of course... and it i trivial... but you have been warned. this is not what you want.

IF NOT $ALARM_STOP THEN
   $OUT[4]=FALSE
ENDIF

yes

IF $AUT AND NOT $ALARM_STOP THEN
   $OUT[4]=FALSE
ENDIF

The problem with using the SPS is that, if the SPS is not running for some reason, then the spindle will never be stopped. That's one reason (among several) that this is not a Safety-qualified solution.

One way to protect against SPS halts might be something in the SPS like:

IF bRunSpindle AND NOT $ALARM_STOP THEN
  PULSE ($OUT[4], TRUE, 0.1)
ENDIF

where bRunSpindle is a global BOOL variable. In this usage, every cycle of the SPS (which should execute a full loop several times every 0.012sec) will "pulse" $OUT[4].

But the Pulse command has a hidden trick: If you do something like this:

PULSE ($OUT[4], TRUE, 1.0)
WAIT SEC 0.5
PULSE ($OUT[4], TRUE, 1.0)

Then $OUT[4] will stay True for 1.5sec. Basically, repeating a Pulse command before the previous Pulse command expires extends the original Pulse. So, in the upper example, as long as bRunSpindle is True and $ALARM_STOP is False, $OUT[4] will stay True all the time. But, if either BOOL changes state, or the SPS is halted for any reason, 0.1sec later, $OUT[4] will become False.