Patent Application
20250080015
The present invention relates to a controller and a processing device and, in one non-limiting example, to a controller for controlling an operation of a motor in various types of processing devices or machine drive systems that include motors.
In a field of various processing devices equipped with motors (e.g., injection molding machines, press machines), in order to ensure safety of the processing device and a surrounding environment, etc., a safe stop function that performs control safely stopping the motor of the device (hereinafter for sometimes abbreviated as “safety function”) must be provided. Specifically, the control for safely stopping the motor includes various types of control such as torque-off stop and deceleration stop. This control is executed based on a signal (sometimes called a safety signal or the like) from an external device provided outside the device.
As a conventional example of performing torque-off control of a motor, for example, there is a technique described in Patent Document 1 below. Patent Document 1 discloses a power converter with an STO (safe torque off) function. In addition, the safety functions of mechanical drive systems using motors are internationally standardized, and the above STO is one of the internationally standardized (defined) safety functions. The STO function can be said to be a function for forcibly interrupting the torque of the motor.
On the other hand, a specific configuration of each block such as input, output, and monitoring in the safety function is not standardized and is left to individual product design.
Patent Document 1: Japanese Patent Application Laid-open No. 2011-8642
By the way, in order to strengthen the safety function, in the individual product design, it is conceivable to have such a configuration that a safety signal from the external device and therefore a path (safety route) of the signal are duplicated and the same safety signal is outputted from the external device at the same time and in parallel. Even if a failure occurs in one of the safety paths by adopting such a configuration, the control for safely stopping the motor can be executed.
Double safety path monitoring can be realized, for example, by externally monitoring an operating state of an output block that outputs a control signal to a motor drive circuit. On the other hand, when this is applied to industrial machine systems that use multiple-axis motors and their controller, such as servo press machines and plastic processing machines, there are problems in that burden of monitoring increases in a host system and a failure rate due to wiring etc. increases.
An object of the present invention is to facilitate construction of a safety system in an industrial machine in which the motor is used by incorporating a monitoring function for a multiple system safety system and a protection function according to a monitoring result into a control system that drives and controls the motor.
In order to achieve the above objects, the present invention employs a configuration and a method described in a scope of patent claims. As an example, a controller of the present invention:
Includes: a motor driver sending a drive current to a motor to put the motor into a normal operation state and controls the motor so that the normal operation state goes into a safe stop state according to a multiple command related to a safety function operation sent from outside; and
According to the present invention, it is possible to easily construct a safety system in an industrial machine system using a motor.
Hereinafter, before describing each embodiment of the present disclosure, schematic contents common to each embodiment will be described with reference to the drawings as appropriate. A processing device system described below is mainly composed of a combination of the following devices (1) to (3).
A motor controller 1 is a device for controlling three operations (rotation start/stop, rotation direction, rotation speed, etc.) of an electric motor (hereinafter simply referred to as a motor) 3 used as a power source for a processing device, and is a main device (controller) in the disclosed processing device system. The motor controller 1 comprises various functional block units as shown in
Note that the motor 3 and the processing device using the motor controller 1 is not particularly limited, and examples thereof include various industrial devices such as plastic processing machines such as servo press machines and injection molding machines.
(2) External Safety Device (Indicated by Symbols 2 and 2A in
The external safety device 2 is a device for: monitors the operation of the motor 3 or the processing device; generating multiple commands (arbitrary number of signals indicating the same content for Lo/High) regarding the safety function operation of the processing device; and transmitting (inputting) the generated multiplex commands to the motor controller 1 through a transmission system.
As shown, the external safety device 2 is an external device separate from the motor controller 1 and, in this example, is connected to the motor controller 1 via multiple (double in each figure) signal lines and a wired interface. Note that the connection between the motor controller 1 and the external safety device 2 may be partially or wholly replaced by communication means (wireless interface). The external safety device 2 can also be called a safety function unit. Further, a transmission system (wired or wireless interface etc.) for multiple commands sent from the external safety device 2 (safety function unit) to the motor controller 1 can be called a safety signal transmission unit.
When these external safety devices 2 detect an abnormality in the operation of the motor 3 or the processing device, a stop command (e.g., a pre-defined signal (e.g., Lo or High signal)) for safety stopping the motor 3 and therefore the processing device is sent (inputted) to the motor controller 1. On the other hand, if the external safety device 2 does not detect any abnormality in the operation of the motor 3 or the processing device, an execution command (e.g., High or Lo signal) for executing the control of the motor 3 by the motor controller 1 as it is is sent (inputted) to the motor controller 1. In each figure and below, the above-described stop command and execution command are collectively referred to as safety input signals S1 and S2.
Note that since the configuration of a safety function unit (external safety device 2) which is an external device, a method of detecting an abnormality, and the like are well known, a detailed description thereof will be omitted as appropriate.
A safety monitoring device 16 is a device playing a role as a “command monitoring unit” monitoring that respective contents (commands, i.e., Lo/High states) of the multiple safety input signals S1 and S2 sent (inputted) from the external safety device 2 to the motor controller 1 (commands, i.e., Lo/High states) match each other. In the illustrated example, the safety monitoring device 16: inputs each of the multiple safety input signals S1 and S2 through branch lines of the signal lines to which the safety input signals S1 and S2 are transmitted; compares etc. the content (command) of the inputted signal to monitor and therefore diagnose it; and outputs a signal indicating a diagnosis result to the motor controller. Hereinafter, the signal indicating this diagnosis result will be referred to as “diagnosis protection signal Sd”.
Hereinafter, description will be made on the following assumption: when the respective commands (Lo/High) included in the multiple safety input signals (S1, S2) outputted from the external safety device 2 match each other, the safety monitoring device 16 outputs the Lo signal as the diagnosis protection signal Sd and when they do not match each other, the safety monitoring device 16 outputs the High signal as the diagnosis protection signal Sd.
Next, the technical significance of the safety monitoring device 16 will be explained in relation to other devices. The motor controller 1 described in (1) normally sends a drive current to the motor 3, thereby controlling the motor 3 and therefore the processing device so as to perform operations and therefore functions according to the purpose etc. Hereinafter, this state may be referred to as a “normal operating state”. Further, since the operations of the motor 3 and therefore the processing device in the normal operating state are well known, a detailed description thereof will be omitted.
On the other hand, the motor controller 1 performs control such as reduction or cutting-off of the drive current sent to the motor 3 when the stop command (for example, Lo signal) is inputted from the above (2), that is, the external safety device 2 to safely stop the motor 3 and the processing device. By performing such control, the motor 3 (processing device) can be shifted from a normal operation state to a safe stop (torque off or deceleration stop) state.
Note that, the significance of sending the multiple commands (safety input signals S1 and S2) from the external safety device 2 to the motor controller 1 is to enhance safety protection. More specifically, for example, in a case where the stop command and the execution command are sent from the external safety device 2 to the motor controller 1 through two signal lines, even if any trouble occurs and the above commands cannot be transmitted to one of the signal transmission systems (circuits, signal lines, and radio wave state in a case of wired, etc.), the command (safety input signal) can be transmitted through the remaining signal transmission system.
Therefore, when the safety input signal (S1 or S2) indicating the stop command is inputted from any of the signal transmission systems of the external safety device 2 in the above normal operation state, the motor controller 1 enters the safe stop state, performs the same control as that described above, and safely stops the motor 3 and the processing device. In this way, safety protection a is strengthened by adopting configuration in which the safe stop control is performed in accordance with the stop command inputted from any of the signal transmission systems.
On the other hand, as described above, if one of the signal transmission systems of the external safety device 2 fails and the processing device continues to operate while this is left unattended, the enhancement of the safety protection described above becomes a mere formality. In addition, if a further failure occurs in the external safety device 2, the motor controller 1 may be unable to control the safe stop. Such a case is likely to occur, for example, when the Lo signal is assigned to the execution command and the High signal is assigned to the stop command. For this reason, the following is premised on the reverse, that is, a configuration in which the High signal is assigned to the execution command and the Lo signal is assigned to the stop command as the safety input signals S1 and S2. With such a configuration, when trouble such as disconnection etc. occurs in one of the signal transmission systems, the signal (command) of the signal transmission system becomes Lo, so that it is conceivable that there is an advantage of facilitating detection of the occurrence of various troubles.
On the other hand, even if there are no disconnection etc. in all of the signal transmission systems of the external safety device 2 and the safety input signals S1 and S2 (Lo/High commands) are generally sent normally, a phase (for example, timing to switch to the stop command from the execution command) may occur. In this case, the motor controller 1 performs the safe stop control in response to the earlier sent stop command from the safety point of view. However, if the stop command signal to which the response is made is an erroneous signal based on a malfunction etc. of the external safety device 2, disadvantages associated with the timing of performing the safe stop being too early (e.g., lowering etc. an operation rate and productivity of the processing device) may occur.
Therefore, in the processing device system, it is necessary to provide a device for monitoring and diagnosing that the multiple commands (Lo/High) sent (inputted) from the safety monitoring device 16 described above in (3), that is, the external safety device 2 to the motor controller 1 mutually match each other.
In other words, the safety monitoring device 16 is a device responsible for monitoring and therefore diagnosing whether the external safety device 2 is operating normally. Hereinafter, when the respective commands (Lo/High) of the multiple safety input signals S1 and S2 sent (inputted) from the external safety device 2 to the motor controller 1 match each other, the safety monitoring device 16 determines that the external safety device 2 is operating normally, and outputs the Lo signal (diagnostic protection signal Sd=Lo).
Further, when the commands (Lo/High) of the multiple safety input signals S1 and S2 sent (inputted) from the external safety device 2 to the motor controller 1 do not match each other, the safety monitoring device 16 determines that the external safety device 2 or the transmission system is not operating normally, and outputs the High signal (diagnostic protection signal Sd=High).
Note that, conventionally, the safety monitoring device as described above has been used as an exterior device similar to the external safety device 2, that is, as the external device of the motor controller 1, exclusively during maintenance of the processing device system, thereby diagnosing whether each part is in the normal operation. As such a safety monitoring device, for example, a device using a signal monitoring method called EDM (External Device Monitoring) is known.
On the other hand, when the safety monitoring device is used as an external device of the motor controller 1, there is a problem in that wirings to the processing device system become complicated and, depending on the frequency of maintenance, wiring connection work becomes troublesome.
In view of the above problems, each embodiment described below adopts a configuration in which the safety monitoring device is mounted as an internal device of the motor controller 1. For convenience etc. of explanation, the safety monitoring device 16 will be replaced with a safety monitoring unit 16 in the following description.
In addition, safety functions of mechanical drive systems using motors are defined in multiple international standards (typically IEC61800-5 group). The present invention can be applied to safety functions. First and second embodiments described below will be described on the assumption that safe torque off (STO), which is an example of a safe stop operation, is controlled.
As shown in
Here, main functional blocks (circuits) included in the motor controller 1 are a safe torque off circuit (STO) 10, a three-phase inverter 11, an AC/DC conversion circuit 12, a current detector 13, and a motor control calculator 14, a control pulse generator (PWM) 15, and a safety monitor 16.
Among the above, the AC/DC conversion circuit 12 is connected to the AC main power supply 5, converts a three-phase
AC input from the AC main power supply 5 into DC, and feeds the converted DC power supply into the three-phase inverter 11. The AC main power supply 5 is, for example, an external power supply such as a commercial three-phase 200V AC.
The three-phase inverter 11, as shown in
Three phases of the three-phase inverter 11 are hereinafter referred to as U-phase, V-phase, and W-phase, respectively. Symbols U, V, and W are respectively assigned to the upper switches (arms) in the
The switches U, V, and W of each phase of the three-phase inverter 11 are connected in parallel to an output line of one pole (for example, a positive pole) of the AC/DC conversion circuit 12 and are connected to a corresponding phase (terminal) of the motor 3. The switches X, Y, and Z of the three-phase inverter 11 are connected in parallel to an output line of the other pole (for example, a negative pole) of the AC/DC conversion circuit 12 and are connected to a corresponding pole (terminal) of the motor 3. Further, the switch U and the switch X are connected in series with each other and are connected to the same pole of the motor 3 (the lowest terminal in
The three-phase inverter 11 having such switch circuits (a plurality of switches) can be realized by power semiconductors. The three-phase inverter 11 performs a switching operation of selectively turning on the switch U/X, the switch V/Y, and the switch W/Z according to a control pulse signal outputted from the control pulse generator 15 via a safe torque off circuit (STO) 10, thereby generating a three-phase AC current. The AC current after such a switching operation is sent to the motor 3 as a drive current, thereby rotating the motor 3 and operating the corresponding processing device.
Based on a basic program and various input signals, the motor control calculator 14 calculates a control operation amount for feedback-controlling the operation of the motor 3, generates a control signal indicating the calculated control operation amount, and outputs a control signal to a control pulse generator (“PWM” block in
More specifically, the motor control calculator 14 detects a drive current (voltage waveform etc.) supplied to the motor 3 through the current detector 13 arranged at any two of the three poles of the motor 3. Further, the motor control calculator 14 detects a rotation direction, a rotation speed, and a rotation position of the motor (a phase of a rotation shaft) of the motor 3 through an encoder 4 attached to the rotation shaft of the motor 3. In addition, the motor control calculator 14 can input and detect user's operation instructions through an operation input unit (not shown) including switches, levers, and the like of the processing device.
Then, based on the various input signals described above, the motor control calculator 14 calculates a difference (error) between the above detection result and the defined operation of the motor 3 (pre-defined rotation direction, rotation velocity, and phase). Then, the motor control calculator 14 calculates a control operation amount (here, form of the three-phase AC current to be supplied) that allows the motor 3 to operate without error corresponding to the basic program and the user's operation instruction, and outputs a control signal indicating a calculation result (hereinafter also simply referred to as a “control operation amount”) to the control pulse generator 15.
The control pulse generator 15 performs PWM (Pulse Width Modulation) modulation on the inputted control signal, and outputs a control pulse signal, whose pulse width is modulated, to the safe torque-off circuit 10. The control pulse generator (PWM) 15 converts the pulse width according to magnitude of the inputted control operation amount, and passes through a plurality of signal lines (three phases x two poles=six in this example) to generate a control pulse signal from each signal line. The control pulse generator (PWM) 15 outputs the generated control pulse signal to the three-phase inverter 11.
The control pulse generator 15 shown in
and uses a pulse width modulation method for generating pulses based on these magnitude relationships. Alternatively, the pulse generation method generated (outputted) by the control pulse generator 15 may be, for example, a pulse frequency modulation method that adjusts the pulse generation interval based on the magnitude of the control operation amount. Alternatively, as a pulse generation method generated (outputted) by the control pulse generator 15, the on/off state of each switch (U, V, W, X, V, Z) of the three-phase inverter 11 is defined by vector coordinates. Alternatively, a method of selecting a predetermined vector for each instantaneous value of the control operation amount may be used.
The motor control calculator 14 and the control pulse generator 15 can be implemented by a microcomputer or the like on which a control program is implemented, or by an analog/digital circuit. The same is true for the safe torque-off circuit 10 and the safety monitoring unit 16, but when configuring a safety system, blocks related to safety functions should be configured separately from others in order to minimize the influence of other functional blocks. For example, only the safe torque-off circuit 10 may be an analog/digital circuit, and may be physically separated from hardware such as a microcomputer on which other functions (control program, etc.) are implemented.
A safe torque-off circuit (STO) 10 is a circuit that functions when safely stopping the motor 3 used in the motor controller 1. As shown in FIG. PWM) 15, safety monitoring unit 16, and three-phase inverter 11. Also, the safe torque off circuit (STO) 10 is connected to the motor control calculation block 14 via the control pulse generator (PWM) 15.
The safe torque-off circuit 10 of the motor controller 1 is located in the middle of the path for transferring the control pulse signal obtained by the control pulse generator 15 to the three-phase inverter 11, and receives a safety input signal separately inputted from the external safety device 2. The control pulse signal transfer is activated or interrupted based on the contents of the commands of S1 and S2.
In the present embodiment, the safe torque-off circuit 10 performs operations for transferring (supplying)/blocking the transfer (Supply Prohibited) of the control pulse signal supplied from the control pulse generator 15 to the three-phase inverter 11 according to the commands of the safety input signals S1 and S2.
Specifically, when both of the safety input signals S1 and S2 are execution commands, the safe torque-off circuit 10 determines that it is in a normal operation state, and transfers (supplies) the control pulse signal to the three-phase inverter 11.
On the other hand, when one of the safety input signals S1 and S2 is a stop command, the safe torque-off circuit 10 determines that a safe stop is necessary, and cuts off (prohibits) the transfer (supply) of the control pulse signal to the three-phase inverter 11. This cut-off (supply inhibition) operation causes the motor 3 to perform a safe torque off (hereinafter referred to as “STO”) operation. More specifically, the STO operation of the motor 3 is realized by turning off the power semiconductor gate (corresponding to each switch shown in
In one specific example, the safe torque-off circuit 10 receives signals sent from the external safety device 2 and the safety monitoring unit 16 described above, both of the safety input signals S1 and S2 are High, and the diagnostic protection signal Sd is Lo, the control pulse signal input from the control pulse generator 15 is sent (transferred) to the three-phase inverter 11 as it is.
Therefore, according to this system, during normal operation of various devices to which the motor 3 is attached, the motor 3 rotates according to the type of the device and the user's operation, and the motor is controlled by feedback control. 3. As a result, it is possible to ensure the accuracy of the operation of the device.
On the other hand, the safe torque-off circuit 10 operates when at least one of the safety input signals S1 and S2 among the signals sent and inputted from the external safety device 2 and the safety monitoring unit 16 is Lo, or when the diagnosis protection signal Sd is High, the transfer of the control pulse signal input from the control pulse generator 15 is cut off (supply prohibited). In one specific example of this case, the safe torque-off circuit 10 switches off all the switches (U, V, W, X, Y, and Z) are turned off (see
For convenience of explanation, the diagnostic protection signal Sd in the High state or the safety input signal S1 (S2) in the Low state may be referred to as a “current cutoff signal” hereinafter.
As can be understood from
By the way, the above-mentioned international standards (for example, IEC61508 or ISO13849) show the concept of constructing a safety system with dual inputs and dual outputs. A specific configuration of the blocks is not shown.
Therefore, the present inventor proposes specific configurations of the various blocks described above, as described below.
In the example shown in
From the standpoint of fail-safe, for example, in preparation for disconnection of the signal lines of the safety input signals S1 and S2, the signs and constants of the signals should be changed so that the motor controller 1 reaches the STO operation in the base state of this system. The level of the reference voltage applied by the voltage source may be chosen.
The buffer circuit BF0 determines whether or not to output control pulse signals inputted from the control pulse generation unit 15 through six signal lines (in other words, for six switches) to inputs of gate drive element GD. It plays a role of switching by the protection signal Sd.
Specifically, the buffer circuit BF0 includes (six) amplifying and inverting elements that amplify and invert the currents of the six signal lines to which the control pulse signal is inputted, and an inverting and amplifying element that inverts and amplifies the diagnostic protection signal Sd. Signal lines are connected to the buffer circuit BF0 so that the output of the inverting and amplifying element is inputted to each of the six amplifying and inverting elements (preceding stage of the inverting unit). Also, the outputs of the six amplifying and inverting elements are connected to the cathodes of the light emitting diodes in the optocouplers of the gate drive elements GD that operate the corresponding switches (U, V, W, X, Y, and Z) of the three-phase inverter 11.
In the state shown in
Moreover, even if one anode cutoff switch Q1 (or Q2) is turned on based on the safety input signal (either S1 or S2) from the state shown in
Note that in the present embodiment, when only one anode cutoff switch Q1 (or Q2) is turned on for a certain period of time, the diagnosis protection signal Sd goes high, causing all the switches (U to Z) of the three-phase inverter 11 to turn on are turned off, and no drive current is supplied to the motor 3. A specific circuit configuration and the like for realizing this operation will be described later with reference to
On the other hand, when both anode cutoff switches Q1 and Q2 are turned on based on the safety input signals S1 and S2 from the state shown in
In this example, when a High signal is inputted from the control pulse generator 15 and a Lo signal is outputted from the amplifying/inverting element of the buffer circuit BF0, the corresponding light-emitting diode of the gate drive element GD emits light, the current is outputted from the corresponding photocoupler, and the corresponding switch (any one of U to Z) of the three-phase inverter 11 is turned on. Conversely, when a Lo signal is inputted from the control pulse generator 15 and a High signal is outputted from the amplifying/inverting element of the buffer circuit BF0, the corresponding light-emitting diode of the gate drive element GD does not emit light, and the current from the corresponding photocoupler is not outputted, and the corresponding switch (any one of U to Z) of the three-phase inverter 11 is turned off.
Furthermore, when the diagnosis protection signal Sd inputted to the enable terminal (inverting amplifying element) is High, it is inverted to a Lo signal by the inverting amplifying element, and the Lo signal is inputted to all the amplifying and inverting elements of the buffer circuit BF0. Outputs of all amplifying and inverting elements become High due to the inverting process. As a result, none of the light-emitting diodes of the gate drive element GD emit light, none of the photocouplers output the current, and all switches (U to Z) of the three-phase inverter 11 are turned off.
Thus, according to the circuit configuration shown in
On the other hand, when any photocoupler of the gate drive element GD is in the ON state and the diagnostic protection signal Sd inputted to the inverting amplifier element of the buffer circuit BF0 becomes Hi, the signal of Hi applied by inverting amplification becomes Lo and is inputted to each amplifying/inverting element of the buffer circuit BF0. As a result, the output of the control pulse signal inputted from the control pulse generator 15 through each signal line to the subsequent stage (gate drive element GD) is blocked, and all the photocouplers of the gate drive element GD are turned off. Therefore, in this case, all the switches (U to Z) of the three-phase inverter 11 are in an off state (see
Thus, according to the circuit example shown in
Note that when the diagnosis protection signal Sd is lost, the enable terminal of the buffer element BF0 is turned off and, as a result, the light emission of the light-emitting diodes of all the photocouplers (U to Z) of the gate drive element GD is cut off. In addition, the configuration is such that the safe torque off of the motor 3 can be realized.
The buffer element BF0 may be a multi-channel element. Also in this case, an enable terminal capable of turning ON/OFF the output of each channel of the buffer element BF0 may be provided, and the diagnosis protection signal Sd may be inputted to the enable terminal.
As for the gate drive element GD, a circuit configuration using a photocoupler has been described with reference to FIG. 2. As another example, the gate drive element GD is an element capable of switching between transfer/transfer inhibition (blocking) of each pulse signal inputted from the control pulse generator 15, such as an optical coupler or an element incorporating a magnetic coupler. Furthermore, as another example, the gate drive element GD is not limited to a configuration in which each pulse signal inputted from the control pulse generator 15 is transferred as it is, and each pulse signal is transferred to each gate of the three-phase inverter 11. It may be a circuit that converts to various digital signals for driving the switches (U to Z).
The safety monitoring unit 16 shown in
The first processing block B1 of the safety monitoring unit 16 is configured by sequentially connecting an XOR unit B11, a charging/discharging unit B12, and a latch unit B13 in series from the preceding stage.
Of these, the XOR unit B11 includes the safety input signal S1 and the safety input signal S2, detects whether there is a difference in the polarity of High/Low of these signals, and if there is a difference, outputs a High signal to the subsequent stage, outputs the High signal to the subsequent stage. The XOR unit B11 corresponds to the “comparison unit” of the present disclosure. For example, as shown in
Note that hereinafter, a resistor having the same function will be referred to as a “pull-down resistor”, and a resistor that plays the opposite role of pulling up the output will be referred to as a “pull-up resistor”.
One end of the pull-down resistor R11 is connected to the output ends of the XOR element X1 and the XOR unit B11, and the other end of the pull-down resistor R11 is connected to the reference potential. Such a pull-down resistor R11 has a role of, for example, lowering the output potential of the XOR unit B11 to the reference potential when the safety monitoring unit 16 is activated, and stabilizing the output value. The same is also applied to the pull-down resistance 14 of the latch unit B3 described later.
Next, the charging/discharging unit B12 plays a role of a timer that stores information on duration of the difference by charging the high current output when the difference is detected by the XOR unit B11. Such a charging/discharging unit B12, for example as shown in
Here, the resistor R12 corresponds to the “second resistor” of the present disclosure. One end of the resistor R12 is connected to the output end of the XOR element (X1), and the other end of the resistor R12 is connected to the output end of the charging/discharging unit B12.
Further, the capacitor C11 has a role of charging and discharging the current supplied to the charging/discharging unit B12, and one end (positive voltage terminal) of the capacitor C11 is connected to the other end of the resistor R12 and the output terminal of the charging/discharging unit B12, and the other end of the capacitor C11 is connected to the reference potential.
Further, in the example shown in
The above diode circuit does not function when charging the capacitor C11 (the circuit with only the resistor R12 functions), and functions as a parallel resistance circuit of the resistors R12 and R13 when discharging the capacitor C11. Therefore, the difference in the resistance values of the resistors R12 and R13 allows the charging and discharging currents (time constants) to be adjusted to different values.
The charging/discharging unit B12 having such a configuration charges the capacitor C11 (charge accumulation) when the output of the preceding XOR unit B11 changes from Low to High (in other words, when there is a difference between the signals S1 and S2), the charging (charge accumulation) to the capacitor C11 is started. Then, when the output of the XOR unit B11 returns to Low before the charge accumulated in the capacitor C11 reaches the threshold (in other words, when there is no difference between the signals S1 and S2), the charge/discharge unit B12 resets the capacitor C11 (in other words, the timer) by discharging the charge accumulated in the capacitor C11 to the resistors R11, R12, and R13.
On the other hand, in the charging/discharging unit B12, when the output of the XOR unit B11 remains High for a certain period of time, charges are accumulated in the capacitor C11 and the voltage of the capacitor C11 gradually approaches the output voltage of the XOR unit B11.
Furthermore, the latch unit B13 has a function of determining whether or not the voltage of the capacitor C11 exceeds a predetermined voltage threshold, and holding (continuously outputting) the determination result as a High state output when the voltage exceeds the predetermined voltage threshold. If the voltage of the capacitor C11 is regarded as a timer, this action can be said to have the same effect as determining whether or not the duration of the difference between the safety input signal S1 and the safety input signal S2 has exceeded a predetermined time limit. Note that the charge/discharge unit B12 and the latch unit B13 correspond to the “latch unit” of the present disclosure. Also, hereinafter, the output of the latch unit B13 will be referred to as a signal SL.
For example, as shown in
Optionally, the latch unit B13 also includes a capacitor C12 that accumulates (charges and discharges) the output of the logic OR element O11. In the latch unit B13, one input of the OR element O11 is connected to the output terminal of the timer unit B12 and the voltage terminal (positive voltage terminal) of the capacitor C11, and the other input of the OR element O11 is configured by a direct feedback circuit the output of the OR element O11. Whether or not the voltage of the capacitor C11 exceeds the threshold is determined using the high-level voltage, which is the characteristic value of the logical OR element O11 as a threshold.
A second processing block B2 detects (determines) when both the safety input signal S1 and the safety input signal S2 indicate an operation permission state (for example, High) of the motor 3, and outputs the detection result (if operation permission state, Lo). For example, as shown in
The third processing block B3 includes an OR element O3 that performs a logical sum (OR operation) of input signals, and a pull-up resistor R3 connected to the output terminal of the OR element O3 and the output side of the third processing block B3. The input end of the OR element O3 is connected to the output terminal of the first processing block B1 and the output terminal of the second processing block B2, respectively.
Thus, the safety monitoring unit 16 OR-operates the output of the first processing block B1 and the output of the second processing block B2 using the OR element O3 of the third processing block B3, and outputs the result of the OR operation (Lo or High) as the diagnostic protection signal Sd. Then, the low or high diagnostic protection signal Sd outputted from the safety monitoring unit 16 is inputted to the enable terminal of the buffer element BF0 (see
In the following description, it is assumed that the motor 3 is allowed to operate when the diagnostic protection signal Sd is in the Lo state. In this case, the first processing block B1 outputs a Lo signal by operating the pull-down resistors R11, R14, etc. at startup. After that, in the first processing block B1, a difference occurs between the safety input signal S1 inputted from the external safety device 2 and the safety input signal (the output of the XOR unit B11 becomes High), and the difference becomes a predetermined value. When the time elapses, the high diagnostic protection signal Sd is continuously outputted.
The output of the second processing block B2 will be Lo when both the safety input signals S1 and S2 are High (operation permitted state). Also, the third processing block B3 outputs the logical OR of the output of the first processing block B1 and the output of the second processing block B2 as the diagnosis protection signal Sd.
Therefore, the safety monitoring unit 16 outputs a signal different from the normal signal (detects an abnormality between the signals S1 and S2) only when the first processing block B1 determines that the difference has continued for a certain period of time.
As described above, in this embodiment, the drive current is sent to the motor 3 to bring the motor 3 and the processing device into the normal operation state, and the safety input signal S1 and S2 (multiplexed commands) related to the safety function operation of the processing device sent from the external safety device 2, the motor controller (A safety monitoring unit 16 (command monitoring unit) is built in.
Then, as described in detail with reference to
Specifically, the safety monitoring unit 16 (command monitoring unit) includes an XOR unit B11 (comparison unit) that compares the respective safety input signals S1 and S2 (command) and outputs the difference as a High signal, and a power storage unit (charging/discharging unit B12) that accumulates electric charge, and a safe stop command generator (charging/discharging unit B12, latch unit B13) that generates and outputs a safety stop command (High diagnostic protection signal Sd) when the voltage of the power storage unit exceeds a threshold value.
In the motor controller 1 of the present embodiment having the safety monitoring unit 16 as described above, the safety input signal S1 and the safety input signal S2 are inputted and compared with each other, and one of these two inputs (S1, S2), the abnormality can be detected and STO of the operation of the motor 3 can be operated.
Further, according to the present embodiment in which the safety monitoring unit 16 is incorporated as an internal device of the motor controller 1, it is possible to monitor whether the external safety device 2 is operating properly without using an external monitoring device. In other words, monitoring can be performed without wiring. Therefore, there is an advantage that the safety design of the motor controller 1 and the processing device system as a whole, which incorporates a monitoring function for monitoring multiple safety input signals and detecting anomalies, is facilitated.
Furthermore, the power storage unit (charging/discharging unit B12) of the safety monitoring unit 16 (command monitoring unit) secures the time from when the XOR unit B11 (comparing unit) outputs a High signal until the voltage of the capacitor C11 exceeds the threshold. An RC time constant circuit (R12 and C11) is provided to charge capacitor C11 as follows. The safety stop command generation unit also includes a latch unit B13 that holds the output of the safety stop signal (High diagnostic protection signal Sd) when the voltage of the capacitor C11 exceeds the threshold (discharged from the capacitor C11).
The RC time constant circuit (R12 and C11) as described above can perform the same function as a general timer that measures time based on a clock signal, for example, and can be realized at low cost.
From another point of view, the safety monitoring unit 16 (command monitoring unit) sends the multiplexed commands (safety input signals S1, S2) to the first processing block B1 (first signal processing unit) and the second processing block B1 (first signal processing unit), respectively, and is branched in parallel to the signal processing unit B2 (second signal processing unit), and based on the logical sum (OR) of the calculation output of the first processing block B1 and the calculation output of the second processing block B2. The following diagnostic protection signal Sd is outputted to the circuit 10 (motor controller) with respect to the safe torque off.
That is, the safety monitoring unit 16 uses the above-described timer function to send Lo as the diagnostic protection signal Sd when the period in which the safety input signals S1 and S2 (multiplexed commands) do not match each other does not exceed the allowable value. Then, when the period of non-coincidence exceeds the allowable value, Hi (safety stop command) is sent as the diagnosis protection signal Sd.
As a specific example of the circuit configuration for outputting the diagnosis protection signal Sd as described above, the first processing block B1 (first signal processing unit) includes an XOR unit B11, a charge/discharge unit B12, and a latch unit B13. are serially connected in order, and the second processing block B2 (second signal processing unit) is provided with a NAND unit that performs NAND operations on the safety input signals S1 and S2 (multiplexed commands) and outputs them.
Specifically, the XOR unit B11 includes an XOR element X1 that outputs an exclusive OR of the safety input signals S1 and S2 (multiplexed instructions), and a first resistor (R11) that pulls down the output of the XOR element X1.
The charge/discharge unit B12 is an RC time constant circuit composed of a second resistor (R12) one end of which is connected to the output end of the XOR element X1, and a capacitor C11 connected to the other end of the second resistor (R12), and charges the capacitor C11 when the output of the XOR element X1 is High, and discharges the capacitor C11 when the output of the XOR element X1 is Low.
Further, the latch unit B13 includes an OR element O11 whose first input terminal is connected to the output terminal of the RC time constant circuit (R12, C11), and a pull-down resistor (R14) that pulls down the output of the OR element O11, and the output of the OR element O11 is directly connected to the second input terminal of the OR element O11.
Furthermore, the NAND unit B2 of the second processing block B2 (second signal processing unit) includes a logical NAND element (N1) for calculating and outputting a negative logical product (NAND) of the commands (S1, S2), and a resistor (R21) that pulls up the output of the logic NAND element (N1).
With the circuit configuration described above, it is possible to switch between Lo and Hi (safety stop command) of the diagnostic protection signal Sd. Further, by adopting the circuit configuration described above, it is possible to provide ancillary functions for coping with various technical problems to be described later.
As described above, according to the present embodiment, a motor control system such as an inverter circuit for driving and controlling the motor 3 is equipped with a monitoring function of a multiple system safety system and a protection function according to the monitoring result. It is possible to more easily construct a safety system in a system of industrial machines such as processing device that uses the motor 3.
The main circuit configuration and operation of the safety monitoring unit 16 shown in
Next, ancillary functions of the safety monitoring unit 16 shown in
When the safety input signal S1 and the safety input signal S2 are inputted to the first processing block B1 of the safety monitoring unit 16, the XOR unit B11 outputs the output of the XOR element X1 (High/Lo) may be switched frequently. Such a case is, for example, a case where the difference between these two safety input signals repeatedly (S1, S2) occurs instantaneously due to some factor such as an error or minute noise.
Thus, when the frequency of switching the output (High/Lo state) of the XOR element X1 is high, depending on the configuration of the capacitor C11 in the subsequent charging/discharging unit B12, particularly when the discharge time constant of the capacitor C11 is large, the following problems may occur. That is, since the time for which the output of the XOR element X1 remains in the Lo state is shortened, the charge in the capacitor C11 of the charging/discharging unit B12 is not sufficiently discharged, and the output of the XOR element X1 repeatedly becomes High, so that the voltage rise characteristics of C11 may become uneven.
In order to deal with the above problem, it is required to improve the discharge characteristics of the capacitor C11 in the charging/discharging unit B12. Also, in order to improve the discharge characteristics while maintaining the accuracy of the timer measurement time described above, it is necessary to make the discharge time constant smaller than the charge time constant of the capacitor C11.
Regarding this problem, in this embodiment, as shown in
According to this configuration, the resistance value of the resistor R11 of the XOR unit B11 and the resistance value of the resistor R13 of the charging/discharging unit B12 are sufficiently smaller than the resistance value of the resistor R12 of the charging/discharging unit B12. The discharge time constant can be made smaller than the constant, and the discharge time can be shortened.
Therefore, according to the circuit configuration of the first processing block B1 in this embodiment, it is possible to improve the discharge characteristics of the capacitor C11 while maintaining the accuracy of the timer measurement time described above. Further, according to this circuit configuration, even when the frequency of switching the output (High/Lo state) of the XOR element X1 is high, the voltage rise characteristic of the capacitor C11 can be maintained.
The logical OR element O11 of the latch unit B13 has a circuit configuration in which once the output is set to High, it continues to output High.
Regarding this problem, as shown in
In the following, matters different from the safe torque-off circuit 10 shown in
As understood by comparing
In general, the main difference between the safe torque-off circuit 10A shown in
Similarly to the configuration shown in
In the example shown in
According to the safe torque-off circuit 10A configured as described above, when the operation is similar to that of
In the third embodiment, it is assumed that a monitor device 2B such as an image display is used as an external device of the motor controller 1A. Note that reference numeral 2A in
The motor controller 1A of the third embodiment includes test switches QT1 and QT2 capable of blocking transmission of the respective signals (S1 and S2) on the transmission paths of the safety input signal S1 and the safety input signal S2. In the state shown in
Specifically, the motor control calculator 14A additionally includes an operation unit 142 that outputs a signal for turning on/off the test switches QT1 and QT2. This operation unit 142 has a function of operating so that at least one of the multiple commands (S1, S2) is not sent to the motor control unit (safe torque off circuit 10 in this example).
The motor control calculator 14A also includes a notification unit 141 that notifies the external monitor device 2B of the diagnosis protection signal Sd, the state of the device, etc. based on the diagnosis protection signal Sd transmitted from the safety monitoring unit 16. In the illustrated example, the diagnostic protection signal Sd outputted from the safety monitoring unit 16 is also inputted to the notification unit 141 and the operation unit 142. Other configurations (functions) of the motor control calculator 14A are equivalent to those of the motor control calculator 14 described above with reference to
The significance and advantages of the circuit configuration shown in
On the other hand, in the circuit configuration shown in
Moreover, in the circuit configuration shown in
More specifically, for example, in a state in which the safety input signals S1 and S2 indicate permission to operate the motor, one of the test switches QT1 or QT2 is turned OFF intentionally (for example, by a user's operation) to turn off the safety input. By interrupting the transmission of one of the signals S1, S2, it is possible to check whether the diagnosis protection signal Sd correctly transitions to High. In other words, according to the circuit configuration shown in
Although the test switches QT1 and QT2 shown in
In the example shown in
In each first-order time lag filter, the output side terminal of the resistor RF is connected to one terminal of the capacitor CF and the input terminals of the safety monitoring unit 16 and the safe torque off circuit 10. Also, the other terminal of the capacitor CF is connected to the reference potential. Furthermore, the time constant of each first-order time lag filter is sufficiently larger than the time constant of the RC time constant circuit defined by the resistor R12 (second resistor) and capacitor C11 of the safety monitoring unit (command monitoring unit) 16 described above is set to become enough to shorten.
According to the circuit configuration described above, the STO operation can be obtained in the safe torque-off circuit 10 without waiting for the diagnosis (Sd=High) by the safety monitoring unit 16, and the desired response is obtained as the multiple safety input signals S1 and S2.
A motor controller 1B shown in
Here, the safety control unit 20 has a function of outputting double deceleration commands SL1 and SL2 to the motor control calculation block 14. The safety control unit 20 also has a function of outputting double safe stop (STO) commands ST1 and ST2 to the safe torque-off circuit 10.
The safety control unit 20 can be realized by analog and digital circuits, software such as a microcomputer, or a combination thereof.
Further, the motor controller 1 may have a configuration in which a part of the functions of the motor controller 1 are separated and added as an option. For example, the safety monitoring unit 16 and the safety control unit 20 shown in
In one standard, the safety function Safe Stopl (SS1) is defined as a safe stop function having a period of deceleration based on a predetermined deceleration pattern as a step prior to torque-off stop at STO. As means for realizing SS1 that ensures such a deceleration period, the safety control unit 20 performs the following control.
When the safety control unit 20 receives a stop command or a safety stop command (Sd=High) from the safety monitoring unit 16 as the safety input signals S1 and S2, it sends double deceleration commands SL1 and SL2 to the motor control calculation block 14, and begins monitoring the speed of motor 3 based on signals received from encoder 4. When the speed of the motor 3 becomes equal to or lower than a predetermined speed (threshold speed) as a result of the monitoring, the safety control unit 20 sends an STO command to the safe torque-off circuit 10. Such control prevents the motor 3 from suddenly stopping when the safety input signals S1 and S2 are outputted, thereby preventing damage to the corresponding device and ensuring the safety of workers working with the device and the security can be ensured or expected.
The second anode cutoff switches Q1D and Q2D are normally ON (hereinafter referred to as “normally on”) polarity, and are driven (switched off) by the high output of the diagnostic protection signal SL. With this configuration, when a difference is detected between the safety input signal S1 and the safety input signal S2, the diagnosis protection signal SL outputs a high signal, thereby turning off both the second anode cutoff switches Q1D and Q2D. As a result, the motor 3 is in a torque-off state.
Among them, the anode cutoff switches Q1 and Q2, which play a role of cutting off the drive signals supplied to the motor 3 in response to the commands S1 and S2 (safety input signals), correspond to the “first cutoff unit” in the present disclosure. On the other hand, the second anode cutoff switches Q1D and Q2D, which serve to cut off the drive signal supplied to the motor 3 in response to the diagnostic protection signal SL (safety stop signal), are the “second cutoff unit” in the present disclosure. In this embodiment, the anode cutoff switch Q1 and the second anode cutoff switch Q1D in the first cutoff unit are connected in series, and similarly, the anode cutoff switch Q2 and the second anode cutoff switch Q2D in the first cutoff unit are connected in series.
Furthermore, in the circuit configuration shown in
On the other hand, after the safety monitoring unit 16 sets the diagnostic protection signal SL to High, the second anode cutoff switches Q1D and Q2D are turned off, so that the inputs to the safety monitoring unit 16 are the safety input signal S1 and the safety input signal S2. Although there is a possibility that the input state of is not reflected, the torque-off state of the motor 3 is maintained by the action of the latch unit B13, so the safety function can be achieved.
In this way, if the safety monitoring unit 16 is configured to feed back the downstream signal as an input of the safety monitoring unit 16 to the part (the second anode cutoff switches Q1D and Q2D in this embodiment) that operates the torque off,
Although the present invention has been described above based on the embodiments, the present invention is not limited to the configurations of the above-described embodiments, and various modifications are possible. In the embodiment described above, addition, deletion, replacement, etc. of components are possible except for essential components. Unless otherwise specified, each component may be singular or plural. A configuration in which various configuration examples are combined is also possible.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2022/002877 | 1/26/2022 | WO |
