Just to clarify...
IO is the default. This means no action from the safety relay. The normal power component (the triac) does your regulation and turns power off if over temp. In the extremely rare case that a triac fails in a stuck on position the safety relay will not trigger and you will have an overheat on that output.
AO enabled the safety relay. This means if an alarm triggers (such as the high / low alarms) the safety relay will mechanically cut power to the outputs.
So why is this a choice? On a Herpstat 1 I can't think of a good reason to not have it set to AO. There is only one output to affect. However on a Herpstat 2 (or above) a failure on one channel causing the safety relay to trigger would have an effect on the other channel as well. So lets say you had a ball python in a tank on one channel and $20K worth of eggs in a incubator on the other channel. Say your probe got dislodged from the tank and the sensed temp cooled below your low temp alarm. The safety relay would be tripped and now you have no heat to your incubator (maybe losing the eggs) but it may have saved the ball python tank from an overheat situation. Because thats a pretty big choice we can't make that for people. Safetywise AO is probably the better choice. Especially when considering how rare a triac failure is with our products due to the overrated component we use. We try to design for worst case scenarios though. :^)
Dion Brewington
Owner, Spyder Robotics