Safety control system, servo driving device and servo motor system

Abstract

The invention relates to the technical field of servo control, and provides a safety control system, a servo driving device and a servo motor system. The safety control system comprises a driving processor and a safety processor, wherein the driving processor is used for generating a driving signal of a target motor according to first control information corresponding to the target motor; and the safety processor is used for performing safety state monitoring according to the second control information corresponding to the target motor to obtain a monitoring result, generating a corresponding STO state signal based on the monitoring result, and sending the STO state signal to the STO module, so that the STO module controls the gating state of the buffer module according to the STO state signal. By arranging the independent driving processor and the safety processor, it is ensured that the safety state monitoring result is not interfered by running of the driving processor, and the system is in the safety state.

Description

Technical Field

[0001] The present application relates to the technical field of servo control, and in particular to a safety control system, a servo drive device and a servo motor system. Background Art

[0002] During the process of the servo drive control system controlling the motor, if the motor needs to stop, such as for maintenance or when emergency braking is required due to danger, the servo drive control system will use the safety function to implement the safe torque shutdown output, ultimately achieving the effect of stopping the motor.

[0003] Common safety functions include the safe torque off (STO) method. STO uses the loop of the safety input signal to forcibly shut down the drive signal of the power transistor inside the driver, thereby safely shutting down the output torque of the motor. At the same time, it can also prevent accidental starting of the motor and protect the safety of personnel and equipment.

[0004] At present, the STO state is determined by a preset diagnostic algorithm based on the actual analysis of the motor drive, and the STO state is used to implement the STO method. However, the diagnostic code of the diagnostic algorithm and other functional codes in the servo drive control system, such as motor control code and communication code, are integrated in the same processor. The content processed by the processor is too numerous and complex, and the software code is prone to problems. The accumulation of faults in the software code is likely to cause the diagnostic algorithm to fail, posing a safety hazard.

[0005] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve. Summary of the invention

[0006] In view of this, embodiments of the present application provide a safety control system, a servo drive device, and a servo motor system to reduce the possibility of failure of the diagnostic algorithm in the prior art.

[0007] According to a first aspect of an embodiment of the present application, a safety control system is provided, including a drive processor and a safety processor, wherein:

[0008] a drive processor, configured to generate a drive signal of the target motor according to first control information corresponding to the target motor, and send the drive signal to the buffer module, so that the motor driver drives the target motor based on the drive signal in the buffer module;

[0009] The safety processor is used to perform safety status monitoring according to the second control information corresponding to the target motor to obtain a monitoring result, generate a corresponding STO status signal based on the monitoring result, and send the STO status signal to the STO module, so that the STO module controls the gating state of the buffer module according to the STO status signal.

[0010] According to a second aspect of the embodiments of the present application, a servo drive device is provided, comprising:

[0011] As mentioned above, the safety control system;

[0012] Buffer module and STO module connected to the safety control system;

[0013] A motor driver connected to the buffer module.

[0014] According to a third aspect of the embodiments of the present application, a servo motor system is provided, comprising:

[0015] A servo drive device as described above;

[0016] The target motor connected to the motor driver in the servo drive unit.

[0017] The beneficial effects of the embodiments of the present application compared with the prior art include at least the following: the embodiments of the present application set up an independent drive processor and a safety processor, wherein the safety processor performs the safety status monitoring action, and the drive processor generates an analysis process for controlling the drive signal of the target motor, which does not interfere with the safety status monitoring, thereby avoiding the accumulation of faults in the analysis process leading to the failure of the safety status detection, and keeping the system in a safe state. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 It is a schematic diagram of an application scenario of an embodiment of the present application;

[0020] Figure 2 It is a partial schematic diagram of a specific application scenario provided by an embodiment of the present application;

[0021] Figure 3 It is a timing diagram of related signals in a self-checking process provided by an embodiment of the present application;

[0022] Figure 4 It is a structural schematic diagram of a safety control system provided by an embodiment of the present application;

[0023] Figure 5 This is a scenario diagram of another application scenario provided by an embodiment of the present application. DETAILED DESCRIPTION

[0024] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0025] A safety control system, a servo drive device and a servo motor system according to an embodiment of the present application will be described in detail below with reference to the accompanying drawings.

[0026] Figure 1 Schematic diagram of the application scenario of the embodiment of the present application. Figure 1 As shown, the embodiment of the present application discloses a safety control system 1, including a drive processor 101 and a safety processor 102, wherein:

[0027] A drive processor 101, configured to generate a drive signal of the target motor according to first control information corresponding to the target motor, and send the drive signal to the buffer module, so that the motor driver drives the target motor based on the drive signal in the buffer module;

[0028] The safety processor 102 is used to perform safety status monitoring according to the second control information corresponding to the target motor to obtain a monitoring result, generate a corresponding STO status signal based on the monitoring result, and send the STO status signal to the STO module, so that the STO module controls the gating state of the buffer module according to the STO status signal.

[0029] Understandably, Figure 1 In the application scenario, in addition to the safety control system 1 of this embodiment, a buffer module, a motor driver, a target motor and an STO module are also included. The buffer module can also be called a buffer. The drive processor 101 is connected to the buffer module and outputs a drive signal in the form of PWM (Pulse Width Modulation) to the buffer module; the buffer module is connected to the motor driver, and the motor driver is connected to the target motor. The motor driver will read the drive signal in the buffer module and control the power transistor inside itself to act according to the drive signal, so that the target motor is driven by the power transistor.

[0030] On the other hand, the safety processor 102 is connected to the STO module and sends an STO state signal to the STO module, and the STO module is connected to the gate pin of the buffer module. The level of the gate pin determines whether the gate state of the buffer module is an enabled state or a disabled state. The buffer module in the enabled state will work normally according to the internal logic. When the buffer module is switched to the disabled state, it will stop working, and the motor driver cannot read the effective drive signal therein. In fact, the buffer module turns off the drive signal. At this time, the motor driver turns off the power transistor according to the drive signal and safely turns off the output torque of the target motor, and then the target motor will be safely shut down. The STO module generates a gate signal according to the STO state signal and sends it to the gate pin. The STO state signal, the gate signal and the gate state maintain a consistent corresponding relationship. In fact, the STO module realizes the control of the gate state of the buffer module in the form of a hardware circuit. In the application process of the STO strategy, the safety processor 102 analyzes the STO state, that is, performs safety state monitoring and outputs the STO state signal, and the STO module performs the STO action, which is specifically based on the STO state signal to control the gate state of the buffer module.

[0031] The embodiment of the present application sets up an independent drive processor and a safety processor, wherein the safety processor performs the safety status monitoring action, and the drive processor generates an analysis process for controlling the drive signal of the target motor, which will not interfere with the safety status monitoring, thereby avoiding the accumulation of faults in the analysis process leading to the failure of the safety status detection.

[0032] Furthermore, the security control system 1 of this embodiment may also include a preset storage area 103, wherein:

[0033] The preset storage area 103 allows read and write permissions to the security processor 102 and allows read-only permissions to the driver processor 101;

[0034] The security processor 102 is further configured to write the third control information into the preset storage area 103;

[0035] The driving processor 101 is further used to read the third control information in the preset storage area 103;

[0036] The first control information includes third control information, and the third control information includes at least one of the second control information and an STO state signal.

[0037] It can be understood that the relevant information of safety status monitoring will be written by the security processor into the preset storage area for the drive processor to read. The drive processor has read-only permission to the preset storage area and cannot write information in the preset storage area, ensuring that the results of safety status monitoring are not interfered with by the operation of the drive processor, so that the system is in a safe state.

[0038] Specifically, the safety status monitoring of the safety processor 102 in this embodiment includes flash memory check, program execution sequence monitoring, working status monitoring of the STO module and gating status monitoring of the buffer module. The flash check and program execution sequence monitoring are internal software monitoring. The flash check is to perform CRC (Cyclic Redundancy Check) check on the data stored in the firmware flash in the safety processor 102 after the safety processor 102 is powered on; the program execution sequence monitoring is to monitor the execution sequence of the internal program after the safety processor 102 is powered on. When the execution sequence is normal, the watchdog unit will be reset. Otherwise, the watchdog unit will not be reset, and the watchdog unit will reset the entire safety control system 1.

[0039] The working state monitoring of the STO module and the gate control state monitoring of the buffer module are external hardware monitoring, monitoring whether the STO module and the buffer module are faulty. Once any of them is faulty, the buffer module needs to be set to a disabled state. At this time: the safety state monitoring includes the working state monitoring of the STO module and the gate control state monitoring of the buffer module, and the monitoring results include the first monitoring result corresponding to the working state monitoring and the second monitoring result corresponding to the gate control state monitoring;

[0040] When either the first monitoring result or the second monitoring result indicates that a fault exists, the corresponding STO state signal is used to control the gate control state to a disabled state;

[0041] When both the first monitoring result and the second monitoring result indicate that there is no fault, the corresponding STO state signal is used to control the gating state to be an enabled state.

[0042] Specifically, the buffer module is usually implemented in the form of a buffer chip, and its gated state monitoring can be achieved by triggering feedback through a test signal, that is, it is pre-set in the internal logic of the buffer module: when a test signal is received, a test feedback signal identical to the test signal is returned; when the buffer module is in an enabled state, its internal logic works normally, and when a test signal is received, a test feedback signal identical to the test signal is returned; when the buffer module is in a disabled state, the test feedback signal is expressed as maintaining the default level corresponding to the disabled state unchanged; if the buffer module does not return a test feedback signal according to the corresponding state, it can be confirmed that the current buffer module is faulty. Therefore, the process of gated state monitoring can include:

[0043] sending a test signal to a test port of the buffer module;

[0044] A test feedback signal sent by a test feedback port of a receiving buffer module;

[0045] Analyze whether the buffer module has a fault according to whether the test signal and the test feedback signal correspond to each other, and obtain a second monitoring result;

[0046] The fault-free buffer module generates a test feedback signal identical to the test signal when the gated state is an enabled state, and generates a test feedback signal with a constant level when the gated state is a disabled state.

[0047] Figure 2 It is a partial schematic diagram of a specific application scenario of the embodiment of the present application. Figure 2 As shown, the test port of the buffer module is pin 7, the test signal is SF_TEST, the test feedback port of the buffer module is pin 8, and the test feedback signal is TEST_FDB. Usually, the test signal SF_TEST is in the form of a pulse. In order to avoid the interference of signal delay and further improve the accuracy of the second monitoring result, the waveform of the subsequent test signal SF_TEST can be adjusted according to the test feedback signal TEST_FDB. For example, when it is found that the current test signal SF_TEST does not correspond to the test feedback signal TEST_FDB, it is preliminarily considered that the buffer module may be faulty, and the waveform of the test signal SF_TEST is changed to keep it at a high level or change it to another pulse width, and observe whether the test feedback signal TEST_FDB changes accordingly, and compare whether the current test signal SF_TEST corresponds to the test feedback signal TEST_FDB, and further confirm whether the buffer module is faulty.

[0048] Specifically, the STO module is a circuit composed of multiple parts including an STO input terminal, an optocoupler unit, and an STO power supply. Its working status monitoring is specifically the monitoring of each part in the circuit, mainly including whether the STO input terminal is working normally, whether the optocoupler unit is working normally, whether the voltage of the STO power supply is normal, etc. Depending on the structure of the circuit, the judgment details used in the working status monitoring will be different. In some embodiments, the STO module includes an STO input terminal, an optocoupler unit, and an STO power supply, wherein the input front stage of the optocoupler unit is powered by the STO input terminal, the output rear stage of the optocoupler unit is powered by the STO power supply, and the output port of the output rear stage is connected to the gate pin of the buffer module;

[0049] Working status monitoring includes:

[0050] Based on the output signal of the output port of the output post-stage, the terminal state of the STO input terminal is monitored to obtain the terminal monitoring result;

[0051] Monitor whether the voltage of the STO power supply is within a preset voltage range and obtain a power supply monitoring result;

[0052] When both the terminal monitoring result and the power supply monitoring result indicate that there is no fault, determining that the first monitoring result indicates that there is no fault;

[0053] When either the terminal monitoring result or the power supply monitoring result indicates that a fault exists, it is determined that the first monitoring result indicates that a fault exists.

[0054] It can be understood that the optocoupler unit includes an input front stage and an output back stage, the input front stage is powered by the STO input terminal, and the output back stage is powered by the STO power supply. The voltage of the STO power supply can be directly obtained and monitored to see if it is within the preset voltage range; the STO input terminal refers to the connection terminal of the safety device related to the safety control of the target motor, such as a safety relay, an emergency stop button, etc. The terminal status monitoring of the STO input terminal refers to analyzing whether the current STO input terminal is normally connected to the optocoupler unit and powered normally. This terminal status monitoring is generally based on the premise that the optocoupler unit is fault-free. Therefore, whether the STO input terminal is working normally can be reflected by whether the output signal of the optocoupler unit is normal. If the output signal of the optocoupler unit corresponds to the normally working STO input terminal, it is considered that the terminal monitoring result of the STO input terminal is that there is no fault.

[0055] For example Figure 2 In the example shown, the STO input terminal BT is connected to the input front stage of the optocoupler unit OC through an input resistor to power the input front stage of the optocoupler unit. The power supply voltage is set according to the actual needs of the optocoupler unit, for example, it can be set to 24V; the STO power supply is connected to the output rear stage of the optocoupler unit through an output resistor to power the output rear stage of the optocoupler unit. The rated voltage of the STO power supply can be selected as +5V, and the preset voltage range can be set to 4.6V-5.4V. At this time, the STO power supply can be recorded as STO+5V, and another output resistor is provided between the connectable port and the output port of the output rear stage. The input front stage and output rear stage of the optocoupler unit both have a ground terminal, and a light-emitting diode is provided between the connectable port of the input front stage and the front stage ground terminal FGND, and this connectable port is connected to the STO input terminal to receive the power supply of the STO input terminal; a phototransistor is provided between the connectable port of the output rear stage and the rear stage ground terminal SGND, and the phototransistor is turned on when the light-emitting diode emits light; the connectable port of the output rear stage is connected to the STO power supply through an output resistor, and is connected to the first end of another output resistor at the same time, and the second end of the other output resistor is used as the output port of the output rear stage, and is connected to the gate pin OE.

[0056] according to Figure 2The connection relationship and the working principle of the optocoupler unit, when the STO input terminal works normally, the input front stage of the optocoupler unit is turned on, affected by the input front stage, the output back stage of the optocoupler unit is also turned on, the output port is grounded through the internal circuit of the output back stage, and the output signal should be low level; when the STO input terminal does not work normally, such as not connected to the optocoupler unit, the optocoupler unit is not turned on, the output port is connected to the STO power supply through the output resistor, and the output signal should be high level. Based on the above analysis, the corresponding relationship between the STO input terminal and the output signal can be known, and then the terminal monitoring result can be obtained.

[0057] It can be understood that as long as there is a fault in either the terminal monitoring result or the power supply monitoring result, it can be considered that the first monitoring result of the STO module is a fault.

[0058] It is understandable that after the system is powered on, before normal operation, a self-check can be performed to see if the optocoupler unit in the STO module is faulty. At this time, the action of the optocoupler unit is triggered by the safety processor 102 through the self-check unit simulating the level change of the STO input terminal. The self-check unit can be implemented by a transistor or other circuit. At this time, there are:

[0059] The STO module also includes a self-test unit, the input port of the self-test unit is connected to the self-test port of the safety processor, and the output port of the self-test unit is connected to the input front stage of the optical coupling unit;

[0060] The security processor is also used to:

[0061] Outputting a self-test signal to the self-test unit through the self-test port and receiving an output signal of the output subsequent stage;

[0062] Based on the self-test signal and the output signal, analyze whether the optocoupler unit has a fault and obtain the optocoupler self-test result;

[0063] When the self-test result of the optocoupler is that there is no fault, an action of performing safety status monitoring according to the second control information corresponding to the target motor to obtain a monitoring result is triggered.

[0064] It can be understood that the output port of the self-test unit is connected to the connectable port of the input front stage of the optocoupler unit, or the input port of the self-test unit is connected to the STO input terminal, so that the level of the output port of the self-test unit can control the state of the input front stage of the optocoupler unit. Since the working circuit and operation logic of the optocoupler unit remain unchanged, the signal entering the optocoupler unit, whether it is the self-test signal passing through the output port of the self-test unit or the signal of the STO input terminal, has the same corresponding relationship with the output signal, so the logic of the optocoupler self-test is the same as the terminal state monitoring of the STO input terminal.

[0065] It should be noted that whether the logic level of the self-test signal remains unchanged when passing through the self-test unit is determined by the specific circuit of the self-test unit. An unchanged logic level means that the high-level self-test signal outputs a high-level signal after passing through the self-test unit, and a changed logic level means that the high-level self-test signal outputs a low-level signal after passing through the self-test unit.

[0066] For example, Figure 2 The self-test unit K0 in the example is implemented by a transistor, and the control electrode of the transistor is used as the input port. When the transistor is turned on, the internal current of the transistor flows from the first end to the second end. The first end is used as the output port of the self-test unit, and the second end is grounded. At this time, if the self-test signal is high level and the transistor is turned on, the output port is grounded and the signal is low level, that is to say, the logic level of the self-test signal changes when passing through the self-test unit. At this time, the input front stage of the optical coupling unit is grounded, the optical coupling unit is turned off, and the output signal of the output rear stage is high level. The logic level of the self-test signal and the output signal should be the same.

[0067] Therefore, according to the operating logic of the self-test unit and the optocoupler unit, the correct correspondence between the self-test signal STO_OUT and the output signal STO_FDB during the self-test of the optocoupler unit that has not failed can be determined. If the actual self-test signal and output signal do not conform to the correct correspondence, it means that the current optocoupler unit is faulty.

[0068] It is understandable that during the self-test of the optocoupler unit by the STO module, since the optocoupler unit is working normally and the gate state of the buffer unit is controlled by the output signal of the optocoupler unit, the gate state monitoring can also be added to the self-test process. At this time:

[0069] The STO module also includes a self-test unit, the input port of the self-test unit is connected to the self-test port of the safety processor, and the output port of the self-test unit is connected to the input front stage of the optical coupling unit;

[0070] The security processor is also used to:

[0071] Output a self-test signal to the self-test unit through the self-test port, receive the output signal of the output stage, and monitor the gated state of the buffer module to obtain the gated self-test result;

[0072] Based on the self-test signal and the output signal, analyze whether the optocoupler unit has a fault and obtain the optocoupler self-test result;

[0073] When both the optocoupler self-test result and the gate control self-test result indicate that there is no fault, an action of performing safety status monitoring according to the second control information corresponding to the target motor to obtain a monitoring result is triggered.

[0074] It is understandable that the monitoring of the gated state of the buffer module can be performed directly according to the process of sending a test signal, receiving a test feedback signal, and analyzing whether the test signal corresponds to the test feedback signal in the above embodiment. Figure 2 In the exemplary circuit structure, when the output signal of the optocoupler unit is low, the gating state of the corresponding buffer module is an enabled state; when the output signal of the optocoupler unit is high, the gating state of the corresponding buffer module is a disabled state.

[0075] Furthermore, when the output port of the optocoupler unit in the STO module is connected to the gate pin of the buffer module, a filter circuit is usually connected to achieve signal control buffering. After adding the gate state monitoring to the self-test process, it is also possible to determine whether the filter circuit is faulty by analyzing the timing of the signal. At this time, there are:

[0076] The STO module also includes a filter circuit, and the output port of the output post-stage is connected to the gate pin of the buffer module through the filter circuit; the gate self-test result includes whether the signal timing of the buffer module meets the electrical parameters of the filter circuit.

[0077] It is understandable that the filter circuit can be specifically configured according to actual conditions, for example Figure 2 In the example shown, the filter circuit includes a resistor and a grounded capacitor. The delay time between the signal output from the output port of the output stage and the signal of the gate pin can be calculated based on the electrical parameters of the filter circuit. The signal timing during the self-test process is analyzed to see whether it meets the delay time, that is, to determine whether the signal timing meets the electrical parameters of the filter circuit. When the filter circuit fails, the real-time delay time shown by the signal timing will be different from the delay time calculated based on the electrical parameters. The specific filter circuit failure is related to the structure of the filter circuit, such as Figure 2 The filter circuit in the circuit may have a short circuit in the resistor or a disconnected capacitor from the ground. Assuming that the delay time calculated based on the electrical parameters is greater than 5ms,

[0078] The related signal timing during the self-test process is as follows Figure 3 The signals in the self-test process include: self-test signal STO_OUT, output signal STO_FDB of the optocoupler unit, test signal SF_TEST, and test feedback signal TEST_FDB. The self-test signal STO_OUT is a high-level pulse with a pulse width of 350us and a period of 5ms, and the test signal SF_TEST is a high-level pulse with a pulse width of 2ms. Figure 3The right frame is an amplification of the third self-test signal pulse. When the self-test signal STO_OUT is at a low level, the output signal STO_FDB is at a low level, the gating state of the buffer module is at an enabled state, and the test signal SF_TEST and the test feedback signal TEST_FDB remain the same; when the self-test signal STO_OUT jumps to a high level at time t1, the output signal STO_FDB jumps to a high level, and the gating state of the buffer module should jump to a disabled state after a delay time, that is, the time difference between the gating state jump time t2 and t1 is the delay time, at this time, the test feedback signal TEST_FDB is not related to the test signal SF_TEST, and maintains the default level in the disabled state, which is a low level by default in this embodiment; when the self-test signal STO_OUT jumps to a low level at time t3, the output signal STO_FDB jumps to a low level, and the gating state of the buffer module should jump to an enabled state after a delay time, that is, the time difference between the gating state t4 and t3 is the delay time, at this time, the test feedback signal TEST_FDB and the test signal SF_TEST remain consistent again, however Figure 3 The gating state of the middle buffer module changes almost immediately after the self-test signal STO_OUT changes, that is, the time difference between t4 and t3 is very small, t4 is approximately equal to t3. Obviously, the filter circuit does not delay the change of the gating state, and there is a fault in the filter circuit. At this time, the diagnostic signal Fault Flag indicating the monitoring result, after analyzing that the time difference between t4 and t3 does not meet the requirements, immediately changes from the low level indicating that there is no fault to the high level indicating that there is a fault.

[0079] It is understandable that for the above types of monitoring, different test parameters such as fault tolerance times, buffer time, test times, pulse width, test signal timing, etc. can be set according to actual conditions and user needs, so as to achieve safety status monitoring with different safety requirements, which is not limited here.

[0080] It can be understood that, according to the above description, the STO status signal sent by the safety processor to the STO module is ultimately intended to control the level of the gate pin of the buffer module. The STO status signal should be used to adjust the output signal of the STO module to the gate pin. The strategy for adjusting the output signal in the STO module needs to be based on the specific circuit settings of the STO module, such as Figure 2 In the example of the STO module, the adjustment strategies of its output signal include: adjusting the power supply of the STO power supply to the optocoupler unit and adjusting the power supply of the STO input terminal to the optocoupler unit. Therefore, the STO status signal is used for:

[0081] Controls whether the STO power supply supplies power to the output stage of the optocoupler unit.

[0082] Alternatively, the STO input terminal is controlled to supply power to the input front stage of the optical coupling unit.

[0083] Among them, whether the STO power supply supplies power to the output rear stage of the optical coupling unit can be controlled by the operation or shutdown of the STO power supply itself, or by the on-off between the STO power supply and the output rear stage or the on-off between the STO power supply and the grounding electrode; whether the STO input terminal supplies power to the input front stage of the optical coupling unit can be controlled by the on-off between the STO input terminal and the input front stage, or by whether the self-test unit pulls down the voltage of the STO input terminal. The specific implementation means can be set according to the actual situation and is not limited here.

[0084] It can be understood that, according to the above description, Figure 4 The structural diagram of the safety control system shown in the figure, in this embodiment of the safety control system, the safety processor may include:

[0085] A flash check unit for performing flash checks;

[0086] A sequence monitoring unit for performing program execution sequence monitoring;

[0087] A watchdog unit for resetting based on the results of program execution sequence monitoring;

[0088] A gate monitoring unit for monitoring the gate status of the buffer module;

[0089] A terminal monitoring unit for monitoring the terminal status of the STO input terminal;

[0090] A power monitoring unit for monitoring the voltage of the STO power supply;

[0091] An optocoupler self-test unit used to analyze whether the optocoupler unit has a fault.

[0092] Usually, after power-on initialization, the safety processor triggers the flash check unit and the optocoupler self-test unit in sequence to complete the power-on self-test, and then cyclically monitors according to the preset period, including triggering the terminal monitoring unit, the power monitoring unit, the gate monitoring unit, and the sequence monitoring unit in each preset period.

[0093] Accordingly, the drive processor is used to implement non-safety related control, such as position, speed, torque control, system monitoring, exception handling, etc. Therefore, the drive processor may include:

[0094] A system monitoring unit for performing system monitoring and obtaining monitoring results according to the first control information;

[0095] A three-loop control unit for performing three-loop control and generating control data according to the first control information that the system monitors normally;

[0096] a drive signal generating unit for generating a drive signal according to the control data;

[0097] A fault alarm processing unit is used to receive abnormal monitoring results of the system and perform fault alarm processing.

[0098] The three-loop control refers to the three control loops of servo control: position loop, speed loop and current loop.

[0099] Furthermore, in addition to the preset storage area with special permissions, the security control system may also include a drive storage area dedicated to the drive processor and a security storage area dedicated to the security processor, where the storage area includes at least one of RAM and flash.

[0100] Furthermore, the drive processor and the safety processor are both provided with a status interaction unit and an IPC (Inter-Process Communication) interface. The IPC interface can realize signal transmission between the two processors and between the processor and other modules, thereby receiving the corresponding first control information or second control information or alarm information. The status interaction unit is used to display the operating information of the processor or receive manual instructions.

[0101] It can be understood that the first control information refers to the information required for the drive processor to perform non-safety-related control, such as the real-time electrical parameters of the target motor, the drive signal, the STO status signal and the second control information, etc. The second control information refers to the information required for the drive controller to perform safety status monitoring, such as the signals involved in the various types of monitoring mentioned above, such as the self-test signal, the output signal of the optocoupler unit, the test signal, and the test feedback signal.

[0102] It is understandable that the number of the above signals corresponds to the number of circuit structures connected to them, and is set according to the actual situation. It is understandable that the number of STO modules and buffer modules is usually the same, wherein each STO module is connected to a safety processor, each STO module is respectively connected to a buffer module, and controls the gating state of the buffer module, and one or more gating pins can be set on each buffer module, and the buffer module enters the disabled state as long as there is a gating pin corresponding to the disabled state. The pins of the drive signals of multiple buffer modules are connected in cascade, so that the transmission path of the drive signal is output by the drive processor, and is read by the motor driver after passing through each buffer module in turn. As long as there is a buffer module in the disabled state, the transmission path is disconnected, and the target motor is safely shut down.

[0103] like Figure 5 As shown, Figure 5It is a schematic diagram of the structure of two STO modules and two buffer modules, where the STO input terminals in the two STO modules are respectively denoted as BT1 and BT2, the optocoupler units are respectively denoted as OC1 and OC2, and the self-test units are respectively denoted as K1 and K2; the self-test signals related to the STO modules and the output signals of the optocoupler units are consistent with the number of STO modules, that is, the two self-test signals are STO1_OUT and STO2_OUT, and the output signals of the two optocoupler units OC1 and OC2 are STO1_FDB and STO2_FDB. When there is no fault, STO1_FDB and STO2_FDB should be consistent. Each buffer module is provided with two gate pins OE1 / OE2, so two filtering circuits are provided for each STO module; the safety processor outputs a test signal SF_TEST and sends it to buffer module 1 and buffer module 2 at the same time, and buffer module 1 and buffer module 2 will return the test feedback signal TEST_FDB, Figure 5 Each buffer module is provided with two test signal receiving pins for receiving the test signal SF_TEST, namely pin 7a and pin 7b, and each buffer module is provided with two test feedback signal sending pins, namely Figure 5 Each sending pin returns a test feedback signal, so the safety processor will receive TEST_FDB1 to 4. At this time, pins 1-6 of each drive module are used to receive the drive signal, and the transmission path of the drive signal is the drive processor, buffer module 1, buffer module 2, and motor driver.

[0104] It is understandable that, in addition to Figure 5 For example, the number of STO modules, buffer modules, the number of signals, and the number of other related circuit elements and interfaces mentioned in this embodiment can be set and adjusted according to actual conditions and are not limited here.

[0105] All the above optional technical solutions can be combined in any way to form optional embodiments of the present application, and will not be described in detail here. It should be understood that the size of the sequence number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0106] The embodiment of the present application sets up an independent drive processor and a safety processor, wherein the safety processor performs the safety status monitoring action, and the drive processor generates an analysis process for controlling the drive signal of the target motor, which will not interfere with the safety status monitoring, thereby avoiding the accumulation of faults in the analysis process that leads to the failure of the safety status detection, and keeping the system in a safe state.

[0107] Accordingly, the embodiment of the present application further discloses a servo drive device, comprising:

[0108] A safety control system as disclosed in any of the above embodiments;

[0109] Buffer module and STO module connected to the safety control system;

[0110] A motor driver connected to the buffer module.

[0111] Accordingly, the embodiment of the present application further discloses a servo motor system, comprising:

[0112] The servo drive device disclosed in the above embodiment;

[0113] The target motor connected to the motor driver in the servo drive unit.

[0114] It can be understood that the specific content of the safety control system here can refer to the details in the above embodiments, and will not be repeated here.

[0115] It can be understood that the servo drive device and the servo motor system in this embodiment have the same technical effects as the safety control system in the above embodiments, and will not be repeated here.

[0116] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0117] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium, such as a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, which may be in source code form, object code form, executable file or some intermediate form. The readable storage medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0118] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A safety control system, characterized in that: Includes a drive processor and a security processor, including: The drive processor is used to generate a drive signal of the target motor according to the first control information corresponding to the target motor, and send the drive signal to the buffer module, so that the motor driver drives the target motor based on the drive signal in the buffer module; The safety processor is used to perform safety status monitoring according to the second control information corresponding to the target motor to obtain a monitoring result, generate a corresponding STO status signal based on the monitoring result, and send the STO status signal to the STO module, so that the STO module controls the gating state of the buffer module according to the STO status signal.

2. The safety control system according to claim 1, characterized in that: The safety state monitoring includes working state monitoring of the STO module and gating state monitoring of the buffer module, and the monitoring result includes a first monitoring result corresponding to the working state monitoring and a second monitoring result corresponding to the gating state monitoring; When either the first monitoring result or the second monitoring result indicates that a fault exists, the corresponding STO state signal is used to control the gating state to be a disabled state; When both the first monitoring result and the second monitoring result indicate that there is no fault, the corresponding STO state signal is used to control the gating state to be an enabled state.

3. The safety control system according to claim 2, characterized in that: The process of gate state monitoring includes: Sending a test signal to a test port of the buffer module; Receiving a test feedback signal sent by a test feedback port of the buffer module; Analyze whether the buffer module has a fault according to whether the test signal corresponds to the test feedback signal, and obtain the second monitoring result; The fault-free buffer module generates the test feedback signal identical to the test signal when the gating state is an enabled state, and generates the test feedback signal with a constant level when the gating state is a disabled state.

4. The safety control system according to claim 2, characterized in that: The STO module comprises an STO input terminal, an optical coupling unit and an STO power supply, wherein the input front stage of the optical coupling unit is powered by the STO input terminal, the output rear stage of the optical coupling unit is powered by the STO power supply, and the output port of the output rear stage is connected to the gate pin of the buffer module; The working status monitoring includes: Based on the output signal of the output port of the output post-stage, terminal status monitoring is performed on the STO input terminal to obtain a terminal monitoring result; Monitor whether the voltage of the STO power supply is within a preset voltage range, and obtain a power supply monitoring result; When both the terminal monitoring result and the power supply monitoring result are that there is no fault, determining that the first monitoring result is that there is no fault; When either the terminal monitoring result or the power supply monitoring result indicates that a fault exists, it is determined that the first monitoring result indicates that a fault exists.

5. The safety control system according to claim 4, characterized in that: The STO module further comprises a self-test unit, an input port of the self-test unit is connected to the self-test port of the safety processor, and an output port of the self-test unit is connected to the input front stage of the optical coupling unit; The security processor is also used to: Outputting a self-test signal to the self-test unit through the self-test port, and receiving an output signal of the output post-stage; Based on the self-test signal and the output signal, analyzing whether the optical coupling unit has a fault, and obtaining an optical coupling self-test result; When the self-test result of the optocoupler is that there is no fault, the action of performing safety status monitoring according to the second control information corresponding to the target motor to obtain a monitoring result is triggered.

6. The safety control system according to claim 4, characterized in that: The STO module further comprises a self-test unit, an input port of the self-test unit is connected to the self-test port of the safety processor, and an output port of the self-test unit is connected to the input front stage of the optical coupling unit; The security processor is also used to: Outputting a self-test signal to the self-test unit through the self-test port, receiving an output signal of the output post-stage, and simultaneously monitoring the gated state of the buffer module to obtain a gated self-test result; Based on the self-test signal and the output signal, analyzing whether the optical coupling unit has a fault, and obtaining an optical coupling self-test result; When both the optocoupler self-test result and the gate control self-test result indicate that there is no fault, the action of performing safety status monitoring according to the second control information corresponding to the target motor to obtain a monitoring result is triggered.

7. The safety control system according to claim 6, characterized in that: The STO module also includes a filtering circuit, and the output port of the output post-stage is connected to the gating pin of the buffer module through the filtering circuit; the gating self-test result includes whether the signal timing of the buffer module meets the electrical parameters of the filtering circuit.

8. The safety control system according to claim 4, characterized in that: The STO status signal is used to: Controlling whether the STO power supply supplies power to the output rear stage of the optical coupling unit, Alternatively, the STO input terminal is controlled to supply power to the input front stage of the optical coupling unit.

9. The safety control system according to any one of claims 1 to 8, characterized in that: Also included is a preset storage area where: The preset storage area allows read and write permissions to the security processor, and allows read-only permissions to the drive processor; The security processor is further configured to write the third control information into the preset storage area; The driving processor is further configured to read the third control information in the preset storage area; The first control information includes the third control information, and the third control information includes at least one of the second control information and the STO state signal.

10. A servo drive device, characterized in that: include: A safety control system as claimed in any one of claims 1 to 9; A buffer module and an STO module connected to the safety control system; A motor driver connected to the buffer module.

11. A servo motor system, characterized in that: include: The servo drive device according to claim 10; A target motor is connected to a motor driver in the servo drive device.

Images