Systems and methods for safely holding a load having stored potential energy

Abstract

Systems and methods for safely holding a load having stored potential energy are disclosed. An improved system and method for providing safe-level operation of an electric motor and motor drive that controls the operation of a load having stored potential energy, the system and method including a dual-channel approach for monitoring and maintaining control of the load. A first safety channel is configured to control the operation of a holding brake that provides sufficient holding force to hold the stored potential energy in the load. A second safety channel is configured to independently enable and disable torque generation from the motor drive that controls the operation of the electric motor. When torque generation from the motor drive is enabled, the motor drive and the electric motor are capable of providing sufficient torque to hold the stored potential energy in the load. Monitoring and subsequent control of each safety channel are provided to ensure that a single failure in either channel does not result in an accidental release of the stored potential energy from the load.

Description

Technical Field

[0001] The subject matter disclosed herein relates to systems and methods for providing a safety-rated function for holding a load. More specifically, the safety-rated function is configured to prevent a single failure in an electric motor brake or an electric motor drive from causing a load having stored potential energy to release the stored potential energy in an undesired manner. Background Art

[0002] As is known to those skilled in the art, an electric motor drive is used to control the operation of an electric motor. According to a common configuration, the electric motor drive includes a DC bus having a DC voltage of an appropriate magnitude from which an AC voltage can be generated and supplied to an AC motor. The DC voltage can be provided as an input to the electric motor drive, or alternatively, the electric motor drive can include a converter section that converts an AC voltage input into the DC voltage present on the DC bus. The electric motor drive receives a command signal indicating a desired motor operation. The command signal can be a desired torque, speed, or position for the motor to operate. The torque, speed, or position of the motor is controlled by changing the magnitude and frequency of the AC voltage applied to the stator of the motor. An inverter section is provided between the DC bus and the output of the electric motor drive to generate a controlled AC voltage from the DC voltage present on the DC bus to achieve the desired operation of the motor.

[0003] The electric motor is in turn used to provide a desired motion. The desired motion can be, for example, the controlled operation of a motion axis in an industrial machine or process. The electric motor can be directly connected to, for example, a flywheel, a spindle, or other rotary actuator. Optionally, the electric motor can be connected via a gearbox to provide a rotary motion or convert a rotary motion into a linear motion. The motion axis can be fixed in a horizontal plane, a vertical plane, or any position between the two. For example, when a first electric motor causes a second electric motor to change orientation, such as on a robotic arm, the axis or combination of axes can vary between planes.

[0004] As is well known in the art, the desired motion from the electric motor can be intermittent. Many processes require the electric motor to move the axis from a first position to a second position and then hold at the second position for a period of time. Depending on the application, the period of time the electric motor holds at the second position can vary from a few seconds to several hours or days. To conserve energy, it is generally desirable to enable the electric motor drive only when the desired motion is required. The electric motor drive receives a command signal corresponding to the desired motor operation and controls the electric motor accordingly. When the desired motor operation is completed, the command signal is removed and the electric motor drive can be disabled.

[0005] If the motor drive is disabled, it can no longer control the operation of the motor. If the motor controls a moving axis in which potential energy can be stored, the potential energy can be released when the motor no longer controls the movement. Examples of systems that store potential energy include, but are not limited to, systems in which a spring is wound, tension is applied to a web of material, or a load is lifted in a vertical plane or in any non-horizontal plane where lifting torque is required. When the motor no longer controls the load, the motor has the potential to move due to the release of potential energy. For example, the spring can unwind, the tension in the web can be released, or the force of gravity acting on the load can cause the load to lower. If the force acting on the load due to the stored potential energy is sufficient to overcome the mechanical advantage, such as that produced by gearing, friction, etc., the load will start to move when the motor drive is disabled, if no other holding force prevents such movement.

[0006] To avoid such undesirable movement, a holding brake is typically provided for the motor and axis that stores potential energy. The holding brake can be mechanically coupled to the motor, to the output axis, or at any point along the mechanical drive train suitable for such coupling according to the application requirements. The common sequence of events to prevent undesirable movement due to the release of stored potential energy is to command the motor to stop or stop the movement of the axis. When the axis is at or near a stopped state, the holding brake is set and then the motor drive is disabled. The holding brake will prevent the undesirable movement due to the stored potential energy. Optionally, the motor drive can be configured to remain enabled when potential energy is stored in the axis and the motor drive receives a command to hold a constant position. The motor drive monitors the position feedback from the motor to ensure that the motor can hold the load in a constant position and prevent undesirable movement. In either case, a single system, either the holding brake or the motor drive, is responsible for maintaining the constant position of the motor.

[0007] Many industrial machines or processes need to interact with technicians or other personnel. For example, a production line can move mechanical components to a proper position so that workers can add parts to the components. A machining center can have a machine head that drills, grinds, cuts, or otherwise interacts with parts and then raises to unload the completed parts and load new parts. During the interaction with technicians or other personnel, the controlled machine or process must provide safe operating conditions for such interaction. These safe operating conditions require the system to be single-failure proof. In other words, if a single component fails, or if additional components fail due to the failure of the initial component, the control system can maintain safe operating conditions. However, there are certain challenges in providing safe operating conditions with stored potential energy.

[0008] Historically, redundant systems have been known to provide for safe operating conditions. A fully redundant system can include, for example, a first holding brake and a second holding brake, where each brake is configured to safely hold a maximum expected suspended load. Similarly, a fully redundant system can include a pair of electric motors and a pair of motor drives, where each motor and motor drive pair is configured to safely control the operation of the movement of a shaft in the event of the failure of one of the components. However, fully redundant systems add significant cost and complexity. Two of each component are required, and multiple components require additional space. A supervisory system is often required to monitor the system, detect failures of the primary components, and manage the switching to redundant components.

[0009] Accordingly, it is desirable to provide an improved system and method for providing a safety-rated operation of an electric motor and a motor drive that control the operation of a load having stored potential energy. SUMMARY OF THE INVENTION

[0010] According to one embodiment of the present invention, a system for safely holding a load includes: an electric motor configured to control the operation of a load in response to rotation of the electric motor; a holding brake configured to prevent rotation of the electric motor; a position feedback device operably coupled to the electric motor and configured to generate a position feedback signal corresponding to an angular position of the electric motor; and a motor drive. The motor drive is configured to receive a command to stop rotation of the electric motor, stop the electric motor in response to receiving the command, control the operation of the holding brake via a first safety channel, and control the operation of the torque output from the motor drive to the electric motor via a second safety channel. The first safety channel is operable to set the holding brake in response to stopping the electric motor, and the second safety channel is operable to disable torque generation from the motor drive when the holding brake is set. When the holding brake is set, the motor drive monitors the position feedback signal, and when the position feedback signal changes by more than a predetermined threshold when the holding brake is set, the motor drive re-enables torque generation via the second safety channel.

[0011] According to another embodiment of the present invention, a method for securely holding a load: receiving a safety-rated load holding request at a motor drive, and in response to receiving the safety-rated load holding request, stopping the motor using the motor drive. The motor drive is operably connected to the motor, and the motor is configured to lift the load in response to rotation of the motor. In response to the motor drive stopping the motor, setting a holding brake via a first safety channel within the motor drive, the holding brake being configured to prevent rotation of the motor. In response to setting the holding brake via the first safety channel, disabling torque generation from the motor drive via a second safety channel within the motor drive. When the holding brake is set and torque generation is disabled, monitoring a position feedback signal corresponding to the angular position of the motor, and when the position feedback signal changes by more than a predetermined threshold when the holding brake is set, re-enabling torque generation via the second safety channel.

[0012] According to yet another embodiment of the present invention, a motor controller for securely holding a load includes: a motor output configured to provide voltage to a motor operably connected to the motor controller; a brake output configured to provide an output signal, where the output signal is configured to control the operation of a holding brake operably coupled to the motor to prevent rotation of the motor; a position feedback input configured to receive a position feedback signal generated by a position feedback device operably coupled to the motor; and a controller. The controller is configured to receive a safety-rated load holding request and stop the motor in response to receiving the safety-rated load holding request. The motor is configured to control the operation of the load in response to rotation of the motor. The controller is further configured to, in response to the motor drive stopping the motor, generate an output signal for the brake output using a first safety channel, disable torque generation from the motor controller via a second safety channel within the motor drive in response to generating the output signal, monitor the position feedback signal when the output signal is being generated and torque generation is disabled, and re-enable torque generation via the second safety channel when the position feedback signal changes by more than a predefined threshold when the output signal is being generated.

[0013] From the detailed description and the drawings, these and other advantages and features of the present invention will become apparent to those skilled in the art. However, it should be understood that the detailed description and the drawings, while indicating preferred embodiments of the present invention, are given by way of illustration and not limitation. Many changes and modifications may be made within the scope of the present invention without departing from its spirit, and the present invention includes all such modifications. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Various exemplary embodiments of the subject matter disclosed herein are shown in the drawings, in which like reference numerals always represent like parts, and in which:

[0015] Figure 1 is an exemplary industrial environment in connection with one embodiment of the present invention;

[0016] Figure 2 is a block diagram of a motor drive in connection with one embodiment of the present invention;

[0017] Figure 3 is Figure 2 a block diagram representation of the rectifier section of the motor drive of;

[0018] Figure 4 is Figure 2 a block diagram representation of the inverter section and the gate drive module of the motor drive of;

[0019] Figure 5 is Figure 2 a block diagram representation of one embodiment of the controller of the motor drive of;

[0020] Figure 6 is a timing diagram showing the steps for safely suspending a load in accordance with one embodiment of the present invention; and

[0021] Figure 7 is Figure 2 a block diagram representation of a part of the gate drive of.

[0022] In describing the various embodiments of the present invention shown in the drawings, specific terms will be employed for the sake of clarity. However, the present invention is not limited to the particular terms selected, and it should be understood that each particular term includes all technical equivalents that operate in a similar manner to achieve a similar purpose. For example, the words "connected", "attached" or terms similar thereto are often used. They are not limited to direct connection, but include connection through other elements, and such connections are considered equivalent by those skilled in the art. Detailed Description

[0023] Reference is made to the non-limiting embodiments described in detail below to more fully explain the various features and advantageous details of the subject matter disclosed herein.

[0024] The subject matter disclosed herein describes an improved system and method for providing safe-rated operation of an electric motor and motor drive that controls the operation of a load having stored potential energy. The system provides a dual-channel approach for monitoring and maintaining control of the load. A first safety channel is configured to control the operation of a holding brake, where the holding brake provides sufficient holding force to prevent movement of the load caused by the stored potential energy. A second safety channel is configured to independently provide feedback monitoring control of the motor via the motor drive. One function of the second safety channel is to enable and disable torque generation from the motor drive that controls the operation of the motor. When torque generation from the motor drive is enabled, the motor drive and motor are capable of providing sufficient torque to prevent movement of the load caused by the stored potential energy. Monitoring and subsequent control of each safety channel are provided to ensure that a single fault in either channel does not result in an accidental release of the stored potential energy from the load.

[0025] First, turning to Figure 1 , an exemplary application incorporating an embodiment of the present invention includes a conveyor system 1 that conveys a series of pallets 2, where components 3 are loaded on each pallet. The conveyor system 1 passes through a protected area 4, where the protected area has fencing 5 on three sides and a light barrier 6 on the fourth side. A robot 7 interacts with each component 3 as it travels through the protected area 4. As shown, a technician 8 may need to enter the protected area 4 periodically. The technician 8 may, for example, need to perform periodic maintenance on the robot 7 or the conveyor system 1. Optionally, personnel may need to inspect the components 3 passing through the enclosed area 4. By requiring entry through the light barrier 6, an industrial controller, such as a programmable logic controller (PLC), can detect an interruption in the light barrier 6 when the technician 8 enters the protected area 4 and then place the robot 7 and / or the conveyor system 1 in a safe operating state to prevent injury to the technician 8. The safe operating state can simply be to stop the movement of the robot 7 and / or the conveyor system 1. As shown, the arm 9 of the robot 7 can be raised or partially raised and constitutes a suspended load. To ensure that the protected area 4 is safe for the technician 8, it must be ensured that the arm 9 does not inadvertently lower and cause injury to the technician 8 inspecting the base of the robot 7.

[0026] Next, turning to Figure 2 , a motor drive 10 can be operably connected to a motor 40, which in turn is configured to control a load L, such as raising and lowering Figure 1The arm 9 of the robot 7 shown in []. The motor driver 10, which can be combined with various embodiments of the present invention disclosed herein, is configured to receive a three-phase AC voltage at the input 15 of the motor driver 10. The input 15 of the motor driver is connected to the rectifier section 20 of the motor driver 10 and supplies the three-phase AC voltage to the rectifier section 20. The rectifier section 20 may include any electronic device suitable for passive or active rectification, as understood in the art. Also refer to Figure 3 , the rectifier section 20 shown includes a set of diodes 22 forming a diode bridge that rectifies the three-phase AC voltage into a DC voltage on the DC bus 25. Optionally, the rectifier section 20 may include other solid-state devices, including but not limited to thyristors, silicon-controlled rectifiers (SCRs), or transistors, to convert the input power 15 into a DC voltage for the DC bus 25. The DC voltage exists between the positive rail 27 and the negative rail 29 of the DC bus 25. A DC bus capacitor 24 is connected between the positive rail 27 and the negative rail 29 to reduce the amplitude of the ripple voltage generated due to the conversion of the AC voltage into a DC voltage. It should be understood that the DC bus capacitor 24 may be a single capacitor or multiple capacitors connected in parallel, series, or a combination thereof. The magnitude of the DC voltage between the negative rail 29 and the positive rail 27 is typically equal to the magnitude of the peak of the AC input voltage.

[0027] The DC bus 25 is connected in series between the rectifier section 20 and the inverter section 30. Also refer to Figure 4 , the inverter section 30 includes switching elements, such as transistors, thyristors, or SCRs well known in the art. The inverter section 30 shown includes insulated gate bipolar transistors (IGBTs) 32 and freewheeling diodes 34, which are connected in pairs between the positive rail 27 and each phase of the output voltage and between the negative rail 29 and each phase of the output voltage. Each IGBT 32 receives a gating signal 31 to selectively enable the transistor 32 and convert the DC voltage from the DC bus 25 into a controlled three-phase output voltage to the motor 40. When enabled, each transistor 32 connects the corresponding rails 27, 29 of the DC bus 25 to a conductor 33 connected between the transistor 32 and the output terminal 35. The conductor 33 is selected according to the application requirements (e.g., the rating of the motor driver 10), and the conductor 33 may be, for example, a conductive surface on the circuit board to which the transistor 32 is mounted, or a busbar that connects to the terminals of the power module containing the transistor 32. The output terminals 35 of the motor driver 10 may be connected to the motor 40 via a cable that includes conductors connected to each output terminal 35.

[0028] One or more modules are used to control the operation of the motor driver 10. According to Figure 2 the illustrated embodiment, the controller 50 includes these modules and manages the execution of these modules. The illustrated embodiment is not intended to be limiting, and it should be understood that the various features of each module discussed below may be performed by another module, and / or various combinations of other modules may be included in the controller 50 without departing from the scope of the present invention. These modules may be stored programs executed on one or more processors, logic circuits, or combinations thereof. The controller 50 may be implemented in, for example, a microprocessor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other such customizable devices. The motor driver 10 also includes a memory device 45 that communicates with the controller 50. The memory device 45 may include transient memory, non-transient memory, or a combination thereof. The memory device 45 may be configured to store data and programs, which include a series of instructions executable by the controller 50. It is contemplated that the memory device 45 may be a single device, multiple devices, or incorporated as part of another device, such as an application specific integrated circuit (ASIC). The controller 50 communicates with the memory 45 to read the instructions and data required to control the operation of the motor driver 10.

[0029] The controller 50 receives a reference signal 47 that identifies the desired operation of the motor 40 connected to the motor driver 10. The reference signal 47 may be, for example, a position reference (θ*), a speed reference (ω*), or a torque reference (T*). For a high performance servo control system, the reference signal 47 is typically a position reference signal (θ*).

[0030] The controller 50 also receives a feedback signal indicative of the current operation of the motor driver 10. According to the illustrated embodiment, the controller 50 includes a feedback module 65, which may include, but is not limited to, an analog-to-digital (A / D) converter, a buffer, an amplifier, and any other components required to convert a feedback signal in a first format into a second format suitable for use by the controller 50, as understood in the art. The motor driver 10 may include a voltage sensor 51 and / or a current sensor 52 on the DC bus 25, which generate a feedback signal corresponding to the magnitude of the voltage and / or current present on the DC bus 25. The motor driver 10 may also include one or more voltage sensors 53 and / or current sensors 54 on the output phases of the inverter section 30, which generate a feedback signal corresponding to the magnitude of the voltage and / or current present on the conductor 33 between the inverter section 30 and the output 35 of the motor driver.

[0031] The controller 50 utilizes the feedback signal and the reference signal 47 to control the operation of the inverter section 30 to generate an output voltage having a desired amplitude and frequency for the motor 40. The feedback signal is processed by the feedback module 65 and converted into a signal for the control module 55 as needed. The control module 55 also receives the reference signal 47 and performs in response to the reference signal 47 and the feedback signal to generate a desired output voltage signal to the gate driver module 60. The gate driver module 60 generates the gate signal 31, for example, by pulse width modulation (PWM) 62 (see also Figure 7 ) or by other modulation techniques. The gate signal 31 then enables / disables the transistor 32 to provide the desired output voltage to the motor 40, which in turn results in the desired operation of the mechanical load L coupled to the motor 40.

[0032] The controller 50 includes a brake module 46 that is configured to control the operation of the holding brake 42 operatively connected to the motor 40. In some embodiments of the present invention, the holding brake 42 may be connected to engage a portion of the driveline, such as a drive shaft located away from the motor 40 and between the motor 40 and the driven component of the industrial machine or process. The brake module 46 is configured to generate control signals 41 for releasing and setting the brake. The brake setting feedback signal 43 is input to the motor driver 10, through the feedback module 65 and back to the brake module 46. When it is desired to operate the motor 40, the brake module 46 is configured to generate a control signal 41 for releasing the brake and monitor the brake setting feedback signal 43 to verify that the brake has been released. When the motor 40 stops, the brake module 46 is configured to reset the control signal 41 for releasing the brake and monitor the brake setting feedback signal 43 to verify that the holding brake 42 is set. The operation of the brake module 46 will be discussed in more detail below.

[0033] Next, referring to Figure 5 , an exemplary control module 55 for the motor driver 10 is shown. The control module 55 receives the position reference signal (θ*) 47 as an input. The control module 55 includes a plurality of control loops. According to the embodiment shown in Figure 5 , the control module 55 includes a position control loop, a speed control loop, and a current control loop. The control loops are shown as cascaded control loops, where the output of one control loop is provided as the input to another control loop. It is contemplated that various other control topologies may be used within the motor driver 10.

[0034] In the position control loop, a position reference signal (θ*) 47 is compared with a position feedback signal (θ) 48 at a first summing node 102. A position error signal is output from the first summing node 102 and input to a position loop controller 104. According to the illustrated embodiment, the position loop controller 104 is a proportional-integral (PI) controller. Optionally, the position loop controller 104 can be merely a proportional (P) controller or also include a derivative (D) component. Each of the proportional (P), integral (I), and / or derivative (D) components of the position loop controller 104 includes a controller gain. The position loop controller gains are commonly referred to as the position loop proportional gain (Kpp), the position loop integral gain (Kpi), and the position loop derivative gain (Kpd). The output of the position loop controller 104 is a speed reference signal (ω*).

[0035] In the speed control loop, a speed reference signal (ω*) is compared with a speed feedback signal (ω) at a second summing node 106. As shown by a derivative block 111, the speed feedback signal (ω) is generated by differentiating the position feedback signal (θ). The speed feedback signal (ω) can also be filtered by a speed filter block 113. A speed error signal is output from the second summing node 106 and input to a speed loop controller 108. According to the illustrated embodiment, the speed loop controller 108 is a proportional-integral (PI) controller. Optionally, the speed loop controller 108 can be merely a proportional (P) controller or also include a derivative (D) component. Each of the proportional (P), integral (I), and / or derivative (D) components of the speed loop controller 108 includes a controller gain. The speed loop controller gains are commonly referred to as the speed loop proportional gain (Kvp), the speed loop integral gain (Kvi), and the speed loop derivative gain (Kvd). The output of the speed loop controller 108 is an acceleration reference signal.

[0036] The control module 55 may also include a feed forward branch. According to the illustrated embodiment, the control module 55 includes a feed forward branch for speed and acceleration elements. The position reference signal (θ*) is passed through a first derivative element 112 to obtain a speed feed forward signal. The speed feed forward signal is multiplied by a speed feed forward gain (Kvf) 114 and combined with the speed reference signal (ω*) and the speed feedback signal (ω) at a second summing node 106. The speed feed forward signal is passed through a second derivative element 116 to obtain an acceleration feed forward signal. The acceleration feed forward signal is multiplied by an acceleration feed forward gain (Kaf) 118 and combined with the acceleration reference signal at a third summing node 120 to generate a modified acceleration reference signal (α*’). As understood in the art, the output of the third summing node 120 is also commonly referred to as the torque reference signal. The angular acceleration in the motor is proportional to the torque and can be obtained by multiplying the angular acceleration by the inertia. In one embodiment of the control module 55, the inertia can be incorporated into the controller gain and the feed forward gain 118 of the speed loop controller 108, thereby saving calculations within the controller 50. Optionally, an inertia gain block can be included after the summing node 120 to convert the modified acceleration reference signal (α*’) into a torque reference signal.

[0037] Before generating the gate signal 31 for the inverter section 30, the modified acceleration reference signal (α*) or the torque reference signal output from the third summing node 120 is further processed. The modified acceleration reference signal (α*’) or the torque reference signal is provided as an input to the filter section 122. The filter section 122 may include one or more filters to remove unwanted components from the control system, such as a low pass filter to attenuate unwanted high frequency components, or a notch filter to attenuate specific frequency components that have an unwanted effect on the controlled mechanical load. It is also contemplated that additional filters may be included in the filter section without departing from the scope of the invention. It is also conceivable that the inertia gain can be incorporated into the filter or into the gain within the filter section 122. Whether provided as an input to the filter section 122 or converted within the filter section 122, the output of the filter section 122 is the torque reference, T*.

[0038] The output of the filter section 122 passes through the torque gain block 124. The torque gain block 124 includes a torque constant (Kt), which defines the relationship between the current supplied to the motor 40 and the torque output by the motor. The torque gain block 124 may include one or more additional gain elements combined with the torque constant (Kt) to generate a desired current reference (I*) to the current regulator 61. The current regulator receives a current feedback signal (Ifdbk) from the current sensor 54 at the output of the motor driver 10 and uses a current controller to regulate the current in the motor 40. The current controller may include proportional, integral, and / or derivative components. The output of the current regulator 61 is provided to the gate driver 60, which in turn generates a switching signal 31 to the inverter section 30.

[0039] The output of the gate driver 60 is shown as being supplied to the device 130 of the controlled system. In a motion control system, the device 130 typically includes the inverter section 30 of the motor driver 10, the motor 40, a mechanical load, a position feedback device 44, and a mechanical coupling between the motor 40 and the mechanical load or between the motor 40 and the position feedback device 44. The position feedback device 44 generates a position feedback signal (θ) used by the control module 55.

[0040] Referring again to Figure 2 , the output of the control module 55 is provided as an input to the gate driver module 60. The gate driver module 60 converts the output of the current regulator into a desired output voltage having a variable amplitude and frequency, where the amplitude and frequency are selected to produce the desired operation of the motor 40. Then the gate driver module 60 generates a gating signal 31, which is used by pulse width modulation (PWM) or other modulation techniques to control the switching elements in the inverter section 30 to produce the desired output voltage. The gating signal 31 then enables / disables the transistor 32 to provide the desired output voltage to the motor 40, which in turn results in the desired operation of the mechanical load coupled to the motor 40.

[0041] In some applications, typically when human interaction with a controlled machine or process is required, the control of the machine or process must be carried out according to a specified safety rating. The safety rating defines the level of risk associated with a particular hazard in the application. A common industrial standard for defining these risk levels is the Safety Integrity Level (SIL) standard defined by the International Electrotechnical Commission (IEC). The IEC defines four different SIL ratings, where SIL-1 is the lowest safety level and SIL-4 is the highest safety level. Each safety level defines the probability that a failure may occur. To achieve a certain safety level, the control system must be configured such that, based on a risk analysis of the system, the control system meets the probability of failure for the desired safety level. A common way for an industrial control system to achieve the desired safety rating is to provide redundancy in the system. Redundancy allows for a single failure within the control system while maintaining the safe control of the system.

[0042] Providing independent safety channels within the controller, where each safety channel is operationally independent of the other channels, can allow the control system to achieve the desired safety rating. The desired safety rating can be, for example, a SIL-3 safety rating according to the IEC standard or a Category 3 safety rating according to the Machinery Safety Standard 13849-1 (MSS). It is conceivable that two independent safety channels can even be configured to achieve a Category 4 safety rating under the MSS.

[0043] As previously mentioned, there are many applications where a load may acquire potential energy. These applications include, but are not limited to, spring winding, applying tension to a web of material, or raising a load. For the sake of discussion, this specification refers to applications where a load is suspended as one type of application that may require a safety level. The suspension of the load does not necessarily require the vertical lifting of the load. Any load that requires a motor to move and that can be caused to move by the action of gravity when the control of the motor is removed can be considered to be suspended. This includes, for example Figure 1 the robotic arm shown, which can rotate about a pivot point, or a conveyor system operating on a ramp. The present application is intended to be exemplary and not restrictive, and it should be understood that the concepts discussed herein can be applied to other loads where potential energy is stored in the load or system due to the use of the motor drive 10 to control the motor 40.

[0044] In operation, the motor driver 10 receives a plurality of input signals that define the desired operation of the motor driver 10. The input signals include, for example, an enable input signal that enables a controller 50 within the motor driver to execute various modules, including a control module 55, a braking module 46, and the like. The input signals also include a run command and / or a stop command. Optionally, a single input signal can be provided that corresponds to a run command in one state and a stop command in the opposite state. In yet another embodiment, an analog input signal can define the desired operating speed of the motor, where when the analog input is zero volts, the motor 40 is commanded to stop, and when the analog input is at a maximum voltage, such as any voltage in the range of 5 VDC to 24 VDC, and this voltage can be set by a parameter stored in the memory 45, the motor is commanded to operate at its rated speed. Another input signal can be provided to indicate the desired direction of rotation of the motor 40. Each input signal is provided to the controller 50, where a series of instructions executed on a processor, logic circuitry, or a combination thereof receives the input signals and causes the motor driver 10 to perform accordingly. The input signals can be provided as discrete signals at separate input terminals or as data stored within a data packet transmitted via an industrial network.

[0045] The present invention provides a system for the safe-rated operation of a motor and a holding brake that controls the operation of a suspended load. A first safety channel is provided within the motor driver 10 to control the holding brake 42, and a second safety channel is provided within the motor driver 10 to provide independent feedback monitoring control of the motor via the motor driver, where one function of the second safety channel is to enable torque generation in the motor 40. The two safety channels prevent a single failure that could cause an unexpected drop of the suspended load. The controller 50 of the motor driver is configured to provide two independent control channels and redundancy according to a desired safety level. It is contemplated that each input signal can be provided as a redundant input signal, where a logic input interface compares the inputs to verify that paired input signals are in the same state. The controller 50 can include redundant processors and / or logic circuitry that verify the correct operation of the controller 50 by comparing the inputs and outputs of the processors and / or logic circuitry. The first safety channel can include logic circuitry, a processor, or a combination thereof within the controller 50 that is configured to control the operation of the holding brake 42. The second safety channel can similarly include logic circuitry, a processor, or a combination thereof within the controller 50 that is configured to enable torque generation in the motor 40. It is contemplated that each safety channel can be implemented in part or in whole using the same redundant components, such as the same paired processors or the same paired input signals. However, the first safety channel and the second safety channel operate independently of each other within the controller such that a failure of one channel does not cause a failure of the other channel.

[0046] Next, turning to Figure 6 , timing diagram 150 shows the steps of safely suspending a load using a first safety channel and a second safety channel according to an embodiment of the present invention. At time t0, a safety level load hold request (SLreq) signal 11 is received at the input of the motor drive 10. The motor drive 10 verifies that the safety level load hold request can begin and sets an internal status flag 152 indicating that the safety load hold process is valid (SLact). Between time t0 and t1, the motor drive 10 is configured to stop the motor 40. Once the motor 40 reaches zero speed or below a minimum speed threshold, the motor drive 10 commands the brake to be set. The brake module 46 in the controller 50 removes the brake active (Bact) signal 41, as shown at time t1, which de-energizes the brake coil and in turn sets the holding brake 42. A first delay time 154 elapses between the command to set the holding brake 42 at time t1 and the physical setting of the holding brake at time t2, and the physical setting of the holding brake is indicated by the transition to high brake set (Bset) feedback signal 43.

[0047] Once the brake set signal 43 is received, the controller 50 begins to monitor the position feedback signal 48, θ for unwanted movement and sets the safety load monitor (SLmon) status bit 158. When the holding brake 42 is set, the motor 40 should not move, and the position feedback signal 48, θ should remain at a constant value corresponding to the angular position of the motor 40 when the brake is set. A first bandwidth 160 is set within the motor drive 10, which corresponds to an acceptable level of movement of the motor 40 with the holding brake set. For example, movement may occur due to triggering the brake set signal 43 before the holding brake 42 is fully set or vibration of the holding brake 42 setting, resulting in some extra counts being read. To avoid nuisance or false trips, an acceptable upper limit 162 and an acceptable lower limit 164 define the bandwidth 160 within which the position feedback signal 48 can change. It is contemplated that the bandwidth 160 is defined by one or more parameters stored in the storage device 45 of the motor drive 10 and is user-configurable according to application requirements. A single parameter can define the bandwidth 160 or the acceptable difference between the position feedback signal 48, θ and the position change. Alternatively, a first parameter can define the acceptable upper limit 162 and a second parameter can define the acceptable lower limit 164. If the position feedback signal 48, θ remains within the bandwidth 160 when the brake is set, the safety load hold function does not require any action. A second delay time 156 is defined within the safety vertical function, which defines the maximum allowable time for setting the holding brake 42. As Figure 6As shown, the second delay time 156 is set to be greater than the expected delay time 154 required for setting the holding brake 42.

[0048] When commanding a brake setting, the first safety channel is also in communication with the second safety channel. The first safety channel sets an internal status flag requesting a Safety Torque Off (SToff) 164 operation. The second safety channel monitors the SToff 164 signal and waits for the second delay time 156 to ensure that the holding brake 42 has been set. At time t3, the second safety channel then disables the torque output from the motor drive 10, as shown by the Torque Off (Toff) signal 166. In the case where the Toff signal 166 is set, the motor drive 10 is prohibited from supplying voltage to the motor 40 to prevent torque generation by the motor. Also referring to Figure 7 , when it is desired to disable the torque, the second safety channel uses the safety circuit 70 to output a torque inhibition signal 76 to the gate driver 60. For ease of illustration, the torque inhibition signal is shown as being provided to the logic AND gate 64 together with the output 63 of the modulation program 62. The output 63 of the modulation program is a set of gating signals having individual signals for each transistor 32 in the inverter. It is contemplated that the torque inhibition signal 76 could be a single signal that prevents each output signal 63 from being provided to the inverter 30. Optionally, the gate driver 60 can be configured to allow a limited amount of torque to be generated, and the gate driver 60 can generate individual torque inhibition signals corresponding to each transistor 32 to temporarily allow some of the modulation signals 63 to be output. According to yet another option, the second safety channel can be configured to monitor the feedback signal from the current sensor 54 and can allow a limited amount of torque to be generated by the motor 40, but can set the torque inhibition signal 76 if the current feedback and thus the torque generated by the motor 40 exceeds a predetermined value. When the torque inhibition signal 76 is off, the signal combines with the output of the modulation program 62 such that the modulation signal 63 becomes the gating signal 31 for controlling the operation of the inverter 30, allowing normal operation of the inverter 30. It is not uncommon to rate the motor drive 10 and the motor 40 at the following voltage and current ratings: the voltage and current ratings are sufficient to cause the final torque generated by the motor to exceed the holding torque of the holding brake 42 and to cause the motor 40 to pass through the brake. By disabling or restricting torque generation, the second safety channel prevents a fault in the motor drive from passing through the holding brake and causing an undesired movement of the suspended load.

[0049] Returning again to Figure 6, the first safety channel monitors the position feedback signal 48, θ, while the second safety channel disables torque generation to ensure that the position feedback signal 48, θ remains within the acceptable bandwidth 160. As shown at time t4, if the holding brake 42 fails to prevent the load L from causing rotation of the motor 40 and the position feedback signal 48, θ changes beyond the acceptable limit, the first safety channel removes the internal status flag for the safety torque off (SToff) 164 operation, and the safe load alarm (SLalm) 184 is set. As previously described, the second safety channel monitors the safety torque off (SToff) 164 request and immediately removes the torque off (Toff) signal 166 when it detects that the holding brake 42 cannot hold the suspended load. By removing the torque off (Toff) signal 166, the gate driver 60 can again supply voltage and current to the motor 40, which in turn generates torque within the motor 40. Thus, the motor 40 can provide a second method of holding the suspended load. The motor drive 10 regulates the motor 40 to provide sufficient torque to prevent the suspended load from dropping in the event of a holding brake failure.

[0050] For two-channel failures, this possibility still exists. At time t5, it is observed that the position feedback signal 48, θ exceeds the second threshold 182. During the safe load holding function, a second bandwidth 180 corresponding to the maximum motion level of the motor 40 to be detected is set within the motor drive 10 before the fault condition is set. The maximum upper limit 181 and the maximum lower limit 182 define the second bandwidth 180 within which the position feedback signal 48 can change. It is contemplated that the second bandwidth 180 is defined by one or more parameters stored in the storage device 45 of the motor drive 10 and can be configured by the user according to the application requirements. A single parameter can define the bandwidth 180 or the acceptable difference between the position feedback signal 48, θ and the position change. Optionally, a first parameter can define the maximum upper limit 181 and a second parameter can define the maximum lower limit 182. If the position feedback signal 48, θ remains within the second bandwidth 180, no fault is set. However, if the holding brake 42 or the motor 40 or a combination thereof is insufficient to present an undesired motion level on the motor 40, the safe load limit (SLlmt) 186 fault state is set. The fault signal 186 can be provided to a PLC communicating with the motor drive 10 to take any additional actions that the application may require and that are configured within the PLC.

[0051] The safety load hold function described herein provides safety level control of a suspended load. Two separate channels, each implemented within a motor drive, are each configured to safely suspend the load. Each channel monitors the other channel for faults and, in the event of a fault in the other channel, operates to suspend the load. Additionally, when one channel safely operates to suspend the load, the motor drive prohibits operation of the other channel that could cause an undesired movement of the load. This operation requires that the drive remain enabled even when the hold brake is set, such that the motor drive monitors position feedback and restarts torque in the event that the hold brake cannot suspend the load. Such operation is different from a typical motor controller, in which the motor drive stops the motor, removes the brake release signal (thereby setting the brake), and then the motor drive is disabled until subsequent operation of the motor is required. In the event that the hold brake cannot suspend the load by itself, a second safety channel may allow the hold brake to remain set to provide some resistance to the load, while the motor 40 controlled by the motor drive 10 provides the additional torque required to suspend the load. Optionally, if the hold brake is set and the motor drive 10 attempts to supply torque to the load, the motor drive 10 may experience instability. In such a case, the second safety channel may be configured to release the hold brake and fully support the suspended load. In either case, an alert and / or fault message is provided to warn the operator that one of the safety channels has experienced a fault.

[0052] It should be understood that the invention is not limited in its application to the details of construction and arrangement of components set forth herein. The invention is capable of other embodiments and of being practiced or carried out in various ways. Variations and modifications of the foregoing are within the scope of the invention. It should also be understood that the invention as disclosed and defined herein extends to all alternative combinations of two or more of the individual features mentioned or evident from the text and / or drawings. All such different combinations constitute various alternative aspects of the invention. The embodiments described herein illustrate the best mode known for practicing the invention and enable others skilled in the art to utilize the invention.

[0053] In the foregoing specification, various embodiments have been described with reference to the accompanying drawings. However, it will be apparent that various modifications and changes can be made thereto without departing from the broader scope of the invention set forth in the appended claims, and additional embodiments can be implemented. Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive.

Claims

1. A system for securely holding a load, the system comprising: a motor configured to control the operation of the load in response to rotation of the motor; a holding brake configured to prevent rotation of the motor; a position feedback device operably coupled to the motor and configured to generate a position feedback signal corresponding to an angular position of the motor; and a motor driver configured to: receive a command to stop rotation of the motor, stop the motor in response to receiving the command, control the operation of the holding brake via a first safety channel, wherein the first safety channel is operable to set the holding brake in response to stopping the motor, control the operation of the torque output from the motor driver to the motor via a second safety channel, wherein the second safety channel is operable to disable torque generation from the motor driver when the holding brake is set, monitor the position feedback signal when the holding brake is set, and when the position feedback signal changes by more than a predetermined threshold when the holding brake is set, re-enable torque generation via the second safety channel and release the holding brake so that the load is fully held by the generated torque.

2. The system according to claim 1, wherein the motor driver further includes an input configured to receive a safety-rated load holding request, and wherein the motor driver is configured to control the operation of the holding brake and the operation of the torque output to the motor via the first safety channel in response to receiving the safety-rated load holding request.

3. The system according to claim 2, wherein the second safety channel is configured to prevent any torque generation in the motor when the safety-rated load holding request is received and when the second safety channel determines that the holding brake is set.

4. The system according to claim 2, wherein the motor driver is configured to limit torque generation in the motor to a level less than the holding force applied by the holding brake when the safety-rated load holding request is received and when the second safety channel determines that the holding brake is set.

5. The system according to claim 2, wherein the motor driver includes: a first controller configured to generate a torque reference corresponding to a desired torque from the motor; a safety circuit configured to generate a torque shutdown command; and a gate driver circuit configured to: receive the torque reference and the torque shutdown command, generate a gate signal for an inverter within the motor driver to supply current to the motor to achieve the desired torque when the torque shutdown command is disabled, and When the torque shutdown command is enabled, the gating signals for the inverter within the motor drive are prohibited to disable torque.

6. The system according to claim 1, wherein, the holding brake is operatively mounted to the motor and is configured to prevent rotation of the motor shaft.

7. The system according to claim 1, wherein, the holding brake is mounted remote from the motor and is configured to prevent rotation of a shaft in a driveline controlled by the motor.

8. A method for securely holding a load, the method comprising the steps of: receiving a safety-rated load holding request at a motor drive, wherein the motor drive is operatively connected to a motor configured to lift a load in response to rotation of the motor; in response to receiving the safety-rated load holding request, stopping the motor using the motor drive; in response to the motor drive stopping the motor, setting a holding brake via a first safety channel within the motor drive, the holding brake being configured to prevent rotation of the motor; in response to setting the holding brake via the first safety channel, disabling torque generation from the motor drive via a second safety channel within the motor drive; when the holding brake is set and torque generation is disabled, monitoring a position feedback signal corresponding to an angular position of the motor; and when the position feedback signal changes by more than a predetermined threshold when the holding brake is set, re-enabling torque generation via the second safety channel and releasing the holding brake so that the load is fully held by the generated torque.

9. The method according to claim 8, wherein, when the safety-rated load holding request is received and when the second safety channel determines that the holding brake is set, the step of disabling torque generation causes the second safety channel to prevent any torque generation within the motor.

10. The method according to claim 8, wherein, when the safety-rated load holding request is received and when the second safety channel determines that the holding brake is set, the step of disabling torque generation causes the second safety channel to limit torque generation within the motor to a level less than the holding force applied by the holding brake.

11. The method according to claim 8, further comprising the steps of: controlling operation of the motor using a first controller within the motor drive, wherein the first controller is configured to generate a torque reference corresponding to a desired torque from the motor, and wherein the step of disabling torque generation further comprises: generating a torque shutdown command using a safety circuit within the motor drive; and when the torque shutdown command is enabled, prohibiting gating signals for an inverter within the motor drive.

12. A motor controller for securely holding a load, the motor controller comprising: Motor output, the motor output being configured to provide voltage to a motor operably connected to the motor controller; Brake output, the brake output being configured to provide an output signal, wherein the output signal is configured to control the operation of a holding brake operably coupled to the motor to prevent rotation of the motor; Position feedback input, the position feedback input being configured to receive a position feedback signal generated by a position feedback device operably coupled to the motor; Controller, the controller being configured to: Receive a safety-rated load holding request, wherein the motor is configured to control the operation of a load in response to rotation of the motor; Stop the motor in response to receiving the safety-rated load holding request; In response to the motor driver stopping the motor, generate the output signal for the brake output using a first safety channel; In response to generating the output signal, disable torque generation from the motor controller via a second safety channel within the motor driver; When the output signal is being generated and torque generation is disabled, monitor the position feedback signal; and When the position feedback signal changes by more than a predetermined threshold when the output signal is being generated, re-enable torque generation via the second safety channel and release the holding brake so that the load is fully held by the generated torque.

13. The motor controller according to claim 12, wherein, the second safety channel is configured to prevent any torque generation within the motor when the safety-rated load holding request is received.

14. The motor controller according to claim 12, wherein, the motor driver is configured to limit torque generation within the motor to a level less than the holding force applied by the holding brake when the safety-rated load holding request is received.

15. The motor controller according to claim 12, further comprising: A first controller, the first controller being configured to generate a torque reference corresponding to a desired torque from the motor; A safety circuit, the safety circuit being configured to generate a torque shutdown command; and A gate driver circuit, the gate driver circuit being configured to: Receive the torque reference and the torque shutdown command, When the torque shutdown command is disabled, generate a gate signal for an inverter within the motor controller to supply current to the motor to achieve the desired torque, and When the torque shutdown command is enabled, prohibit the gate signal for the inverter within the motor controller to disable torque.

Images