Compact safety torque turn-off circuit for electric motor

Abstract

An electric safety torque shut-off circuit (STO) arranged to be connected to a motor drive (MD) of an electric motor (MT), where the safety torque shut-off circuit (STO) is arranged to stop the electric motor (MT) from generating torque in the event that at least one of at least two conditions is detected. The circuit (STO) is based on a connection of first and second electrical inputs (I1, I2) arranged to be connected to corresponding first and second external electrical switches (SW1, SW2). A pulse generator (PG) is connected to the second electrical input (I2) and generates an oscillating electrical output voltage when powered from the second electrical input (I2). The modulator (MOD) generates an electrical output signal, which is a modulated version of the voltage at the first input (I1), at a ratio defined by a pulse generator (PG) controlled by the second input (I2). The output from the modulator (MOD) is applied to an optical coupler (OPT), which produces an electrically isolated output, which is applied to the two logic comparator blocks (B1, B2). These blocks (B1, B2) are used to drive the respective high-side and low-side door pole driver portions of the motor drive (MD) only if both the first and second pulse detection outputs indicate that both the first and second pulse detectors (PD1, PD2) detect the pulse signal. This provides a compact safety function, for example, integrated into the housing of the motor together with the motor drive of the electric motor. In this way, the circuit (STO) is still in accordance with the EN ISO 13849-1: 2015 PL e gateway 3 and the IEC 61508-1: 2010 SIL 3, and therefore, the circuit (STO) is still in accordance with the EN ISO 13849-1: 2015 PL e gateway 3.

Description

Technical Field

[0001] The present invention relates to a safety circuit for an electric motor, such as an electric motor for driving a pump, etc. In particular, the present invention relates to a compact safety circuit that can prevent the electric motor from generating torque without disconnecting the main power supply. Background Art

[0002] Electric motors are used in a wide range of applications and various settings, where they must comply with safety regulations.

[0003] The safety function can be achieved by interrupting the power supply to the motor. However, this means that normal operation will be slow to resume after a safety stop, as motor control needs to be restarted.

[0004] Safety circuits for safe torque off (STO) can be used. However, to comply with safety requirements such as IEC 61508-1:2010, Safety Integrity Level (SIL) 3, and following the guidelines of EN ISO 13849-1:2015 for Performance Level (PL) e, category 3, such circuits require bulky components. This means that it is not possible to integrate the safety circuits into the compact housing of the motor or motor and pump equipment.

[0005] Therefore, to provide safety functions in applications involving electric motors, external components are required, for example for connection to a switch to detect the opening of a door, etc., where life safety requires that the motor be stopped. Summary of the Invention

[0006] Purpose of the present invention

[0007] In view of the above, an object of the present invention is to provide a compact motor safety circuit that complies with the safety provisions of certain standards, such as IEC 61508 (SIL 3) and ENISO 13849 (category 3).

[0008] Contents of the invention

[0009] A first aspect of the present invention provides an electric safe torque off circuit arranged to be connected to a motor drive of an electric motor, wherein the safe torque off circuit is arranged to stop the electric motor from generating torque if at least one of at least two conditions is detected, the safe torque off circuit comprising:

[0010] - a first electrical input and a second electrical input arranged to be connected to corresponding first and second external electrical switches or contacts,

[0011] - a pulse generator connected to the second electrical input and arranged to generate an oscillating electrical output voltage at the output when powered from the second electrical input,

[0012] a modulator connected to the first electrical input and the output of the pulse generator, wherein the modulator is arranged to generate an electrical output signal at a rate defined by the pulse generator controlled by the second input, the electrical output signal being a modulated version of the voltage at the first input,

[0013] - an electrical isolator assembly connected to receive the electrical output signal from the modulator and arranged to generate an electrical output signal in response, wherein the electrical output signal is electrically isolated from the electrical output signal from the modulator.

[0014] Such a safety circuit is advantageous because it can be implemented using few, relatively simple components, and the circuit is therefore suitable for low-cost implementation and occupies a minimum of space.

[0015] Specifically, the circuit complies with Performance Level e Category 3 according to European Standard 13849-1:2015, even though it can be implemented with only a single signal transmission between the two circuits, such as an optocoupler as a galvanic isolator, connecting the low-voltage side of the safety circuit to the power module including the motor drive. This can be achieved by using a pulse signal generated by a modulator as a driver for the galvanic isolator (such as an optocoupler) and detecting it after the galvanic isolator. A possible failure of the galvanic isolator (such as an optocoupler) will always result in a safe state. This ensures that any failure before or even at the optocoupler will result in a safe state. In this way, the need for redundant optocouplers is eliminated, and the safety circuit still complies with Category 3 safety requirements.

[0016] Furthermore, the circuit is a purely hardware solution and therefore software-independent, which makes it easy to integrate into a wide variety of motors and applications.

[0017] The small space required allows the safe torque-off circuit to be at least partially integrated with the motor drive. Thus, the safety function can be integrated, for example, within the motor housing, along with the motor drive. The motor thus has built-in safety features, making it easy to integrate into various applications. For example, an electrical switch in a protective door can be simply connected to the motor, providing a high degree of safety without the need for external safety circuits.

[0018] Hereinafter, preferred embodiments and features will be described.

[0019] Preferably, the safe torque off circuit is arranged to be connected to the motor drive to stop the motor from producing torque in the event of a failure of a single component of the electric safe torque off circuit.

[0020] Preferably, the safe torque off circuit has only one electrical isolator assembly, preferably an optocoupler, connected between the first and second electrical inputs and an electrical output arranged to be connected to the motor drive.

[0021] Preferably, the safe torque off circuit is arranged to stop the electric motor from producing torque in the event of a single component failure by using a single electrical isolator assembly.

[0022] Preferably, the outputs of the galvanic isolator assemblies are used to derive control signals for controlling the motor drive in the event of a single component failure, thereby stopping the electric motor (MT) from generating torque. In particular, the outputs of the galvanic isolator assemblies can be used to control corresponding high-side gate driver outputs and low-side gate driver outputs, respectively, to drive corresponding high-side gate driver sections and low-side gate driver sections of the motor drive.

[0023] The safe torque-off circuit preferably includes a first logic comparator block and a second logic comparator block, both of which are arranged to receive an electrical output signal from the electrical isolator assembly and provide corresponding first and second logic outputs. The logic comparator blocks can be particularly implemented as electronic logic components that receive a voltage at an input and generate an output voltage according to a predetermined scheme. These logic comparator blocks allow for detection of any fault in response to receiving an output from the electrical isolator (e.g., an optocoupler). In particular, each of the first and second logic comparator blocks preferably includes a pulse detector that is connected to receive the electrical output signal from the electrical isolator assembly, and the first and second logic comparator blocks are arranged to generate corresponding first and second logic outputs based on the outputs of the corresponding pulse detectors. In particular, the circuit can include a first interconnected logic comparator and a second interconnected logic comparator that are arranged to receive corresponding first and second pulse detection outputs from the corresponding pulse detectors and, in turn, receive corresponding first and second logic outputs. In particular, the first and second logic comparator blocks can be configured to respectively conduct corresponding high-side gate driver outputs and low-side gate driver outputs to drive the corresponding high-side gate driver portion and low-side gate driver portion of the motor drive in response to the first and second logic outputs. Thus, the first and second logic comparator blocks are configured to only drive the high-side gate driver portion and low-side gate driver portion of the motor drive if both the first and second pulse detection outputs indicate that both the first and second pulse detectors have detected a pulse signal. More specifically, the circuit can include corresponding first and second logic gates, preferably AND gates, configured to receive the corresponding first and second logic outputs and conduct corresponding high-side gate driver outputs and low-side gate driver outputs to drive the corresponding high-side gate driver portion and low-side gate driver portion of the motor drive. In the case of a three-phase motor, it should be understood that the high-side gate driver outputs and low-side gate driver outputs are preferably applied to the high-side gate driver portion and low-side gate driver portion of all three phases of the motor drive.

[0024] The pulse generator may be arranged to generate an output voltage that switches between two levels. Specifically, the pulse generator may be arranged to oscillate at a frequency of 1-100 kHz, such as 10-50 kHz, such as 10-20 kHz, such as 14-16 kHz. The pulse generator is preferably arranged to generate an output voltage that switches between a DC voltage and electrical ground (0 V), such as a DC voltage of 10-50 V, such as 20-30 V, such as 24 V.

[0025] The galvanic isolator assembly is implemented by an optocoupler. In particular, it is noteworthy that the galvanic isolator assembly can be implemented using only a single optocoupler and the safe torque off circuit can still comply with European Standard 13849-1:2015 Category 3.

[0026] In a second aspect, the present invention provides a method for stopping a motor from generating torque when at least one of at least two conditions is detected. The method comprises:

[0027] - sensing electrical signals at respective first and second electrical inputs connected to first and second external electrical switches or contacts,

[0028] - generating an oscillating electrical output voltage at the output of the pulse generator when powered from the second electrical input,

[0029] - generating an electrical signal which is a modulated version of the voltage at the first electrical input and at the output of the pulse generator, and

[0030] - generating an electrically isolated signal corresponding to the electrical signal at the first electrical input and the output of the pulse generator by an electrical isolator component such as an optocoupler, the electrical signal being a modulated version of the voltage at the first electrical input and the output of the pulse generator.

[0031] The method preferably includes providing electrically isolated signals to a first interconnected comparator block and a second interconnected comparator block. In particular, the method may include controlling gate driver signals to high-side and low-side gate driver sections of a motor drive in response to outputs from the first and second logic comparator blocks. More specifically, the method may include applying first and second logic outputs from the comparator blocks to the motor drive to conduct corresponding high-side and low-side gate driver signals, respectively, such that the high-side and low-side gate driver sections of the motor drive are driven only when both first and second pulse detection outputs indicate that both the first and second pulse detectors have detected a pulse signal. In particular, in the case of a three-phase motor, the method preferably includes driving the corresponding high-side and low-side gate driver sections for each electrical phase of the three-phase motor drive.

[0032] In a preferred embodiment, the method includes applying the output of only one galvanic isolator assembly to the inputs of the first logic block and the second logic block.

[0033] In a preferred embodiment, the method includes applying a high-side gate driver portion and a low-side gate driver portion of controlling the motor drive in response to the output of only one galvanic isolator assembly.

[0034] In a preferred embodiment, the method includes applying an electrically isolated signal to a first logic block and a second logic block having outputs connected to a motor drive, so as to cause the motor to stop generating torque if either of the first logic block and the second logic block detects that the electrically isolated signal is absent or indicates a state in which at least one of the first external electrical switch or contact and the second external electrical switch or contact indicates a fault condition. In particular, the method may include controlling corresponding high-side and low-side gate driver outputs to drive corresponding high-side and low-side gate driver portions of the motor drive in response to the outputs from the first logic block and the second logic block.

[0035] In a third aspect, the present invention provides a system comprising

[0036] - an electric motor, for example a three-phase motor, is arranged to rotate the shaft,

[0037] - a motor drive connected to the motor and arranged to drive the motor via a high-side gate driver group and a low-side gate driver group controlled by corresponding high-side gate driver signals and low-side gate driver signals

[0038] - The Safe Torque Off circuit according to the first aspect is connected to the motor drive.

[0039] The electric motor may be a permanent magnet electric motor, but the electric motor is not limited thereto.

[0040] The motor may be arranged to be powered by an AC power source providing a 100V AC to 500V AC power input, such as the public grid. In some embodiments, such as for solar power, the motor may be configured to receive power input in the form of a DC voltage, such as a positive or negative DC voltage.

[0041] The electric motor may be in the electrical power range of 1 W to 100 W, but the invention is also advantageous for electric motors in the electrical power range of 100 W to 1 kW, or for electric motors in the electrical power range of 1-50 kW or even more.

[0042] The system may include a housing forming an enclosure, in which the motor drive and safe torque off circuits are located, wherein the housing is attached to the electric motor. Thus, a compact electric motor with integrated safety functions may be provided.

[0043] In one embodiment, the system comprises a rotary pump mechanism arranged to pump a fluid between a fluid inlet and a fluid outlet, and wherein the shaft of the electric motor is arranged to rotate the rotary pump mechanism. In particular, the rotary pump mechanism may be based on any known pump technology. For example, the rotary pump mechanism may comprise an impeller arranged to rotate within an impeller housing for pumping a fluid, such as a liquid (such as water) from the fluid inlet to the fluid outlet during rotation. In particular, the housing surrounding the rotary pump mechanism may be partially or fully integrated with the conductive motor housing. In particular, the motor drive and safe torque off circuitry may be encapsulated within such a housing, thereby providing a pump device with integrated safety functions.

[0044] The pump device may include a housing that encloses at least the electrical inverter. The housing preferably encloses all electronic components of the pump device, but it may also enclose further components, such as part or all of the electric motor or part or all of the rotary pump mechanism. The housing preferably has openings to allow for electrical connection to a power source; for example, it may have conduit connections for a fluid inlet and a fluid outlet. In particular, the housing may be made of a composite material or other non-conductive material.

[0045] The system may include first and second switches or contacts connected to first and second electrical inputs of a safe torque-off circuit. The first and second electrical contacts may be positioned to detect the opening of a door or port, thereby implementing a safe stop function to stop the motor from generating torque when the door is opened.

[0046] Those skilled in the art will know how to implement the present invention based on the disclosure of this specification and common knowledge in this technical field.

[0047] The above-described aspects of the invention may be combined.These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The safety circuit according to the present invention will now be described in more detail with reference to the accompanying drawings. The drawings illustrate one way of implementing the invention and should not be interpreted as limiting other possible embodiments falling within the scope of the appended claims.

[0049] Figure 1 A block diagram showing a safe torque-off circuit of a motor drive connected to an external switch and a motor,

[0050] Figure 2 shows a functional block diagram for explaining the functionality of an embodiment of a safe torque-off circuit, and

[0051] Figure 3 The steps of a method embodiment are shown. DETAILED DESCRIPTION

[0052] Figure 1 A block diagram of a safe torque-off circuit (STO) according to the present invention is shown. The output of the circuit is connected to a motor drive (MD) configured to drive a motor (MT). The STO circuit is intended to provide a motor safety function by stopping the motor from generating torque upon detecting that one of the switches SW1 and SW2 is closed. The STO circuit is preferably implemented to comply with the requirements of European Standard 13849-1:2015, Performance Level e, Category 3. In particular, the present invention provides an STO circuit that eliminates the need for two optocouplers to achieve compliance with European Standard 13849-1:2015, Performance Level e, Category 3. An embodiment of the STO circuit is described in more detail below.

[0053] The Safe Torque Off (STO) circuit is connected at its two input terminals I1 and I2 to corresponding electrical switches SW1 and SW2, such as a safety switch used to detect a door opening or the like. This detection triggers the STO circuit to switch to a safe mode, in which the electric motor MT is unable to generate torque. The switches SW1 and SW2 are connected to the Safe Torque Off (STO) circuit so that the circuit can react and switch to safe mode if at least one of the two switches SW1 and SW2 is activated. Therefore, the circuit STO can switch to safe mode if either of the following two conditions is met: 1) both switches SW1 and SW2 are activated, or 2) only one of the switches SW1 and SW2 is activated. In this way, a failure of one of the switches SW1 and SW2 can be tolerated and still cause the STO circuit to switch to safe mode.

[0054] The Safe Torque Off (STO) circuit is connected to the motor drive (MD) of the electric motor (MT). More specifically, the Safe Torque Off (STO) circuit is configured to provide outputs GD_H and GD_L to the motor drive (MD) for driving the high-side and low-side gate driver sections of the motor drive (MD). Therefore, if the Safe Torque Off (STO) circuit detects that either of the safety switches (SW1) or (SW2) is closed, these outputs GD_H and GD_L can manipulate (e.g., gate or non-gate) the high-side and low-side gate drivers of the motor drive (MD) to stop the motor from generating torque. If only one of the high-side and low-side gate drivers is not conducting to drive the motor (MT), the motor (MT) will stop generating torque and thus enter a safe mode.

[0055] Figure 2An embodiment of a safe torque-off circuit (STO) is shown, along with a block diagram illustrating the functionality of the STO circuit. The circuit has two electrical inputs I1 and I2. These inputs I1 and I2 are connected to two safety switches SW1 and SW2. As shown, the two switches SW1 and SW2 are interconnected at a midpoint, which is connected to a fixed DC voltage DCV from a voltage source, such as 10-30V, for example 24V. This DCV voltage can typically be used as a power source for the electrical components of the safe torque-off circuit (STO).

[0056] The pulse generator PG is connected to the second electrical input (12) and is arranged to generate an oscillating electrical output voltage oscillating at 15 kHz between ground (0 V) and 24 V when powered from the second electrical input 12.

[0057] The modulator MOD is connected to a first electrical input I1 and to the output of the pulse generator PG and generates an electrical output signal which is a modulated version of the voltage at the first input I1 at a ratio defined by the pulse generator PG controlled by a second input I2 .

[0058] The electrical isolator component (eg, an optocoupler OPT) is connected to receive the electrical output signal from the modulator MOD and is arranged to correspondingly generate an electrical output signal that is electrically isolated from the electrical output signal from the modulator MOD.

[0059] Both the first and second logic comparator blocks B1 , B2 are arranged to receive the output from the optocoupler OPT and to provide corresponding first and second logic outputs O1 , O2 , respectively.

[0060] Each of the two logic comparator blocks B1, B2 includes a pulse detector PD1, PD2, which is connected to receive the output from the optocoupler OPT and is arranged to generate a corresponding logic output O1, O2 based on the output of the respective pulse detector PD1, PD2. The pulse detector PD1, PD2 provides a logic output indicating whether a pulse has been received.

[0061] First and second interconnected logic comparators L1, L2 are arranged to receive respective outputs from first and second pulse detectors PD1, PD2. These logic comparators L1, L2 are arranged to compare the signals from the pulse detectors PD1, PD2 with permissible limits, and if only one of the comparators L1, L2 detects an error, it is interconnected with the other of the comparators L1, L2 so that both logic outputs O1, O2 will indicate an error, so that even a failure in one of the pulse detectors PD1, PD2 will cause both logic outputs O1 and O2 to indicate an error.

[0062] Therefore, driving the high-side and low-side gate driver sections of the motor drive is ensured only when both the first and second logic outputs O1, O2 indicate that both the first and second pulse detectors PD1, PD2 have detected a pulse signal. Thus, the interconnection between the logic comparators L1, L2 ensures a fail-safe function even when only one signal input signal from the single optocoupler OPT is provided to the logic comparator block.

[0063] Finally, first and second logic gates LG1 and LG2 receive respective logic outputs O1 and O2, and are arranged to allow respective high-side and low-side gate driver outputs (H1, H2, H3, L1, L2, L3) to pass through to drive respective high-side and low-side gate driver sections of a motor drive, such as an insulated-gate bipolar transistor (IGBT)-based motor drive. Logic gates LG1 and LG2 are preferably implemented as AND gates.

[0064] In the case shown, three high-side gate driver outputs (H1, H2, H3) and three low-side gate driver outputs (L1, L2, L3) are generated for connection to a three-phase motor drive for driving a three-phase motor. In the case of a single-phase motor and motor drive, only a single output is generated for the corresponding high-side and low-side gate driver sections.

[0065] Those skilled in the art will know how to achieve the combination by means of electrical circuit devices (means) Figure 2 The functional blocks shown and described can all be implemented using simple electrical components that take up only a small amount of space and can be realized at low cost.

[0066] Safety compliance is achieved by using an optocoupler. Optocouplers are bulky components that can be installed in compact device housings. Therefore, implementing the safety function with an optocoupler allows the safety function shutdown circuit to be integrated into the housing attached to the motor or pump device.

[0067] The safety circuit STO can preferably be implemented on one circuit board and connected to the input of an optocoupler which is implemented on another circuit board together with the components forming the motor drive. However, if desired, all these components can be implemented on one circuit board.

[0068] Figure 3Steps are shown for a method embodiment, namely, a method for stopping a motor from generating torque upon detecting at least one of at least two conditions. The method includes sensing S_I1_I2 electrical signals at first and second electrical inputs, the first and second electrical inputs being connected to respective first and second external electrical switches or contacts. Furthermore, the method includes generating an oscillating electrical output voltage G_OSC_V at the output of a pulse generator when powered from the second electrical input. Furthermore, generating a G_MOD electrical signal that is a modulated version of the voltage at the first electrical input and at the output of the pulse generator. Next, generating an electrically isolated signal G_EI via a single optocoupler device, the electrically isolated signal G_EI corresponding to the modulated version of the voltage at the first electrical input and at the output of the pulse generator. Furthermore, providing the electrically isolated signals P_CB1_CB2 to first and second interconnected comparator blocks. Furthermore, controlling gate driver signals C_GDS to the high-side and low-side gate driver portions of the motor drive in response to the outputs from the first and second logic comparator blocks.

[0069] In particular, the method may include conducting respective first and second logic outputs from a comparator block to a motor drive with high-side and low-side gate driver signals so as to drive high-side and low-side gate driver portions of the motor drive only if both the first and second pulse detection outputs indicate that both the first and second pulse detectors have detected a pulse signal.

[0070] The Safe Torque Off circuit is suitable for integration with three-phase motors in the power range of 1-50kW, for example. In particular, due to the compactness of the circuit, these motors can form part of pump equipment, the safety function can be easily integrated into the pump equipment, and the circuit still meets the high requirements of safety regulations.

[0071] In summary, the present invention provides an electric safe torque-off circuit (STO) arranged to be connected to a motor drive (MD) of an electric motor (MT), wherein the safe torque-off circuit (STO) is arranged to stop the electric motor (MT) from generating torque upon detecting at least one of at least two conditions. The circuit (STO) is based on the connection of first and second electrical inputs (I1, I2), which are arranged to be connected to respective first and second external electrical switches (SW1, SW2). A pulse generator (PG) is connected to the second electrical input (I2) and generates an oscillating electrical output voltage when powered by the second electrical input (I2). A modulator (MOD) generates an electrical output signal that is a modulated version of the voltage at the first input (I1) at a ratio defined by the pulse generator (PG) controlled by the second input (I2). The output from the modulator (MOD) is applied to an optocoupler (OPT), which generates an electrically isolated output that is applied to two logic comparator blocks (B1, B2). These blocks (B1, B2) are used to drive the corresponding high-side and low-side gate driver sections of the motor drive (MD) only when both the first and second pulse detection outputs indicate that both the first and second pulse detectors (PD1, PD2) have detected a pulse signal. This provides a compact safety function that can be integrated into the motor housing, for example, along with the motor drive. Despite this, the circuit (STO) complies with EN ISO 13849-1:2015 PL e category 3 (Performance Level e Category 3) and IEC 61800-5-2:2016 SIL 3 (Safety Integrity Level 3).

[0072] Although the present invention has been described in conjunction with specifically illustrated embodiments, it should not be construed as being limited in any way to the examples presented. The scope of the invention is set out in the appended claims. In the context of the claims, the terms "comprise" or "comprising" do not exclude other possible elements or steps. References to "a" or "an" etc. should not be construed as excluding a plurality. The use of reference numerals in the claims with respect to elements shown in the drawings should also not be construed as limiting the scope of the invention. Furthermore, individual features mentioned in different claims may advantageously be combined together, and mentioning these features in different claims does not exclude that a combination of features is not possible and advantageous.

Claims

1. An electric safe torque off circuit (STO) arranged to be connected to a motor drive (MD) of an electric motor (MT), wherein The safe torque off circuit (STO) is arranged to stop the electric motor (MT) from generating torque if at least one of at least two conditions is detected, the safe torque off circuit (STO) comprising: - a first electrical input (I1) and a second electrical input (I2), said first electrical input (I1) and said second electrical input (I2) being arranged to be connected to a respective first external electrical switch or contact (SW1) and a second external electrical switch or contact (SW2), a pulse generator (PG) connected to said second electrical input (I2) and arranged to generate an oscillating electrical output voltage at an output when powered from said second electrical input (I2), a modulator (MOD) connected to the first electrical input (I1) and to the output of the pulse generator (PG), wherein the modulator (MOD) is arranged to generate an electrical output signal that is a modulated version of the voltage at the first electrical input (I1) at a ratio defined by the pulse generator controlled by the second electrical input (I2), an electrical isolator component (OPT), such as an optocoupler or the like, connected to receive the electrical output signal from the modulator (MOD) and arranged to generate an electrical output signal accordingly, wherein the electrical output signal is electrically isolated from the electrical output signal from the modulator (MOD).

2. The electric safe torque off circuit (STO) according to claim 1, wherein: The safe torque off circuit (STO) is arranged to be connected to the motor drive (MD) to stop the electric motor (MT) from generating torque in the event of a failure of a single component of the electric safe torque off circuit (STO).

3. The electric safe torque off circuit (STO) according to claim 1 or 2, wherein: The safe torque off circuit (STO) has only one single electrical isolator assembly (OPT), which is connected between the first electrical input (I1) and the second electrical input (I2) and an electrical output, which is arranged to be connected to the motor drive (MD).

4. An electric safe torque off circuit (STO) according to any one of the preceding claims, arranged to stop the electric motor (MT) from generating torque in the event of a single component failure by using a single electrical isolator component (OPT).

5. An electric safe torque off circuit (STO) according to any one of the preceding claims, wherein: The output of the galvanic isolator assembly (OPT) is used to derive a control signal for controlling the motor drive (MD) in the event of a single component failure to stop the motor (MT) from generating torque.

6. The electric safe torque off circuit (STO) according to claim 5, wherein: The output of the electrical isolator component (OPT) is used to control the corresponding high-side gate driver output (H1, H2, H3) and low-side gate driver output (L1, L2, L3) accordingly to drive the corresponding high-side gate driver part and low-side gate driver part of the motor drive (MD).

7. The electric safe torque off circuit (STO) according to any one of the preceding claims, further comprising - A first logic comparator block (B1) and a second logic comparator block (B2) are both arranged to receive the electrical output signal from the electrical isolator assembly (OPT) and to provide a corresponding first logic output (O1) and a second logic output (O2) respectively.

8. The electric safe torque off circuit (STO) according to claim 7, wherein: Each of the first logic comparator block (B1) and the second logic comparator block (B2) includes a pulse detector (PD1, PD2), which is connected to receive the electrical output signal from the electrical isolator component (OPT), and wherein the first logic comparator block (B1) and the second logic comparator block (B2) are arranged to generate the corresponding first logic output (O1) and the second logic output (O2) based on the output of the corresponding pulse detector (PD1, PD2).

9. The electric safe torque off circuit (STO) according to claim 8, wherein: The first logic comparator block (B1) and the second logic comparator block (B2) include corresponding first interconnected logic comparators (L1) and second interconnected logic comparators (L2), and the first interconnected logic comparator (L1) and the second interconnected logic comparator (L2) are arranged to receive corresponding first pulse detection outputs and second pulse detection outputs from the corresponding pulse detectors (PD1, PD2).

10. The electric safe torque off circuit (STO) according to any one of claims 7 to 9, wherein: The first logic comparator block (B1) and the second logic comparator block (B2) are arranged to receive the corresponding first logic output (O1) and the second logic output (O2), and accordingly turn on the corresponding high-side gate driver output (H1, H2, H3) and low-side gate driver output (L1, L2, L3) to drive the corresponding high-side gate driver part and low-side gate driver part of the motor drive (MD).

11. The electric safe torque off circuit (STO) according to claim 10, wherein: The first logic comparator block (B1) and the second logic comparator block (B2) are arranged to drive the high-side gate driver part and the low-side gate driver part of the motor drive (MD) only when the first pulse detection output and the second pulse detection output both indicate that a pulse signal is detected by both the first pulse detector (PD1) and the second pulse detector (PD2).

12. An electric safe torque off circuit (STO) according to claim 10 or 11, comprising corresponding first and second logic gates (LG1, LG2), wherein the first and second logic gates (LG2) are arranged to compare the corresponding first and second logic outputs (O1, O2) with the corresponding first and second gate driver signals to the motor drive (MD), and to generate corresponding high-side gate driver outputs (H1, H2, H3) and low-side gate driver outputs (L1, L2, L3) accordingly for driving the corresponding high-side gate driver section and low-side gate driver section in the motor drive (MD).

13. An electric safe torque off circuit (STO) according to any one of the preceding claims, wherein: The pulse generator (PG) is arranged to generate an output voltage switched between two levels, such as the pulse generator (PG) is arranged to generate an input voltage switched between a direct current voltage (DCV) and electrical ground, such as a direct current voltage (DCV) of 10V-50V.

14. A method for stopping a motor from generating torque upon detecting at least one of at least two conditions, the method comprising: - sensing an electrical signal (S_I1_I2) at a respective first and second electrical input connected to a first external electrical switch or contact, - generating an oscillating electrical output voltage (G_OSC_V) at the output of the pulse generator when supplied with power from said second electrical input, - generating an electrical signal (G_MOD) which is a modulated version of the voltage at the first electrical input and at the output of the pulse generator, and - generating an electrically isolated signal (G_EI) corresponding to said electrical signal by means of an electrical isolator component such as an optocoupler, said electrical signal being a modulated version of the voltage at said first electrical input and at the output of said pulse generator.

15. A method according to claim 14, comprising applying the output from only one galvanic isolator assembly to the inputs of the first logic block (B1) and the second logic block (B2).

16. A method according to claim 14 or 15, comprising controlling the high-side gate driver portion and the low-side gate driver portion of the motor drive (MD) in response to outputs from only one galvanic isolator component (OPT).

17. The method according to any one of claims 14 to 16, comprising applying the electrically isolated signal to a first logic block (B1) and a second logic block (B2) having an output connected to the motor drive (MD) to stop the motor (MT) from generating torque when any one of the first logic block (B1) and the second logic block (B2) detects that the electrically isolated signal is absent or that the electrically isolated signal indicates the following state: in the state, at least one of the first external electrical switch or contact and the second external electrical switch or contact indicates a fault state.

18. The method of claim 17 , comprising controlling corresponding high-side gate driver outputs (H1, H2, H3) and low-side gate driver outputs (L1, L2, L3) to drive corresponding high-side gate driver portions and low-side gate driver portions of the motor drive (MD) in response to outputs from the first logic block (B1) and the second logic block (B2).

19. A system comprising: - an electric motor arranged to rotate the shaft, a motor drive connected to the electric motor and arranged to drive the electric motor via corresponding high-side and low-side gate driver groups controlled by high-side and low-side gate driver signals, - A Safe Torque Off circuit according to any one of claims 1 to 13, connected to the motor drive.

Images