Safety torque off circuit
Patent Information
- Application Number
- CN202510503117.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-21
- Publication Date
- 2026-10-23
Smart Images
Figure CN122963014A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to a safe torque shutdown circuit. Background Technology
[0002] Safe torque off (STO) can be used in motor drive systems such as DC variable speed drives, AC variable frequency drives, servo drives, or stepper drives. The STO function can be used when a forced power-off is required to prevent the motor drive from starting unexpectedly. Summary of the Invention
[0003] In one aspect, a system includes a Safe Torque Off (STO) circuit comprising a controllable switch, the STO circuit being configured to generate a control signal for a device. The control signal has a first state where the device is enabled when the controllable switch is ON, and a second state where the device is not enabled when the controllable switch is OFF. The system also includes an electronic controller and a diagnostic circuit, the electronic controller being configured to generate a diagnostic signal when the control signal has the first state, the diagnostic circuit being configured to modify the voltage of the diagnostic signal to generate a modified diagnostic signal, and to provide the modified diagnostic signal to the STO circuit to generate an output signal. The modified diagnostic signal includes a pulse whose voltage is expected to cause the controllable switch to open. The electronic controller is also configured to compare the output signal with a specification, and if the output signal does not conform to the specification, generate a fault signal.
[0004] Implementation methods may include one or more of the following features.
[0005] This specification can be the expected voltage range of the output signal when the controllable switch is open. If the voltage of the output signal exceeds this expected voltage range, the output signal does not conform to the specification. The diagnostic circuit can be configured to provide a modified diagnostic signal to the STO circuit at the diagnostic node, and the voltage of the pulse is equal to or greater than the voltage expected to be generated at the diagnostic node by the stop signal received at the STO circuit.
[0006] Controllable switches can include transistors.
[0007] The diagnostic circuit may include a level shifter. The level shifter may include a Zener diode.
[0008] The electronic controller can be configured to compare a first portion of the output signal with a first specification and a second portion of the output signal with a second specification. The first specification may be the expected voltage range of the output signal when the controllable switch is on, and the second specification may be the expected voltage range of the output signal when the controllable switch is off.
[0009] The electronic controller can also be configured to recognize output signals.
[0010] The system may also include the aforementioned device. The device may include a pulse width modulation (PWM) drive signal switch configured to output a PWM signal when the device is enabled. The system may also include a low-pass filter between the STO circuit and the device, configured to prevent modified diagnostic signals from reaching the device. In some embodiments, if the output signal does not conform to specifications, the electronic controller is further configured to provide a fault signal to the device, causing the device to switch to an inactive state.
[0011] On the other hand, the control system is configured to: generate a diagnostic signal with a period, wherein the diagnostic signal is low during a first portion of the period and high during a second portion of the period; provide the diagnostic signal to the boost module to generate an output voltage for a safe torque shutdown (STO) circuit; sample the output voltage once or multiple times during a first time window corresponding to the first portion of the period; compare one or more voltages sampled during the first time window with a first voltage specification; sample the output voltage during a second time window corresponding to the second portion of the period; compare the voltage sampled during the second time window with a second voltage specification; and generate a fault signal if the voltage sampled during the second time window does not meet the second voltage specification.
[0012] Implementation methods may include one or more of the following features.
[0013] The output voltage can be sampled more than once during the first time window, and the control system can be configured to generate a fault signal if the voltage sampled in the second time window does not meet the second voltage specification and if all voltages sampled in the first time window do not meet the first voltage specification.
[0014] The first voltage specification may include the expected voltage range when the controllable switch in the STO circuit is turned on, and the second voltage specification may include the expected voltage range when the controllable switch in the STO circuit is turned off.
[0015] The control system can be configured to generate diagnostic signals in response to determining that the control signal generated by the STO circuit is in an enabled state.
[0016] The control system can also be configured to: at the end of the cycle, if the voltage sampled during a first time window meets a first voltage specification and the voltage sampled during a second time window meets a second voltage specification, generate a second diagnostic signal with a period; provide the second diagnostic signal to a second boost module to generate a second output voltage in a second safe torque shutdown (STO) circuit; sample the second output voltage once or multiple times during the first time window, the first time window corresponding to a first portion of the period of the second diagnostic signal; compare one or more voltages sampled during the first time window with the first voltage specification; sample the output voltage during the second time window, the second time window corresponding to a second portion of the period of the second diagnostic signal; compare the voltage sampled during the second time window with the second voltage specification; and generate a fault signal if the voltage sampled during the second time window does not meet the second voltage specification.
[0017] In another aspect, the diagnostic module of the STO circuit includes: an input configured to receive a diagnostic voltage pulse; an inverting element configured to invert the diagnostic voltage pulse into an inverted diagnostic voltage pulse; and a boost element configured to modify the voltage of the inverted diagnostic voltage pulse into a modified pulse and inject the modified pulse into a diagnostic node of the STO circuit. The voltage of the modified pulse is consistent with the voltage expected to be generated at the diagnostic node by a stop signal provided to the STO circuit.
[0018] Implementations of any technology described herein may include apparatus, devices, systems, and / or methods. Details of one or more embodiments will be set forth in the accompanying drawings and the description below. Other features will also be apparent from the specification, the drawings, and the claims. Attached Figure Description
[0019] Figure 1 A block diagram of a Safe Torque Off (STO) system, including a logic control unit.
[0020] Figure 2 This is a block diagram of a system that includes another example of a logic control device.
[0021] Figure 3 This is an exemplary implementation of a voltage clamping circuit.
[0022] Figure 4 This is an example of a level shifter circuit.
[0023] Figure 5 yes Figure 2 A flowchart of the process executed during the operation of the logic control device.
[0024] Figure 6 These are examples of diagnostic signals and enhanced diagnostic signals.
[0025] Figure 7 This is a flowchart of an example of the detection process.
[0026] Figure 8 An example is shown illustrating how the output voltage, the second diagnostic signal, and the second output voltage change over time.
[0027] Figure 9 This is a block diagram of an example of a dual-channel system.
[0028] Figure 10 It is used for Figure 9 A flowchart illustrating an example of the system's diagnostic process. Detailed Implementation
[0029] Figure 1 This is a block diagram of a Safe Torque Off (STO) system 100 including a logic control unit 101. The logic control unit 101 includes an STO circuit 110 and a diagnostic circuit 150. The STO circuit 110 generates a control signal 102 based on the voltage at the STO input node 104 to enable or disable the device 140. When the voltage indication at the STO input node 104 has received an STO signal (or stop signal) 103, the controllable switch 111 should be turned off, and the device 140 should be disabled. The diagnostic circuit 150 injects an enhanced diagnostic signal 151 to confirm whether the controllable switch 111 is operating as expected.
[0030] Device 140 may be, for example, a modulation control drive signal switch for a motor drive. For instance, device 140 may be a pulse width modulation (PWM) drive signal switch for a variable frequency drive (VFD). When enabled, device 140 generates an output 141. Output 141 may be, for example, a PWM signal used to turn a controllable switch (e.g., an insulated-gate bipolar transistor (IGBT) in an inverter) on or off. When disabled, device 140 does not generate output 141, the IGBT is in the off state, and the load stops operating.
[0031] A stop signal 103 is provided to the STO input node 104 for intentionally disabling device 140. When the stop signal 103 occurs, the voltage at the STO input node 104 has a stop voltage value (STOP_V). The stop voltage value (STOP_V) generates a corresponding voltage at the control input 107 of the controllable switch 111. For example, the controllable switch 111 can be a transistor, such as a field-effect transistor (FET), which has an on threshold voltage and an off threshold voltage. Junction field-effect transistors (JFETs) and metal-oxide-semiconductor field-effect transistors (MOSFETs) are examples of field-effect transistors. When the controllable switch 111 is an FET, the control input 107 is the voltage between the gate and source of the FET. The FET is turned on when the voltage at the control input 107 exceeds the on threshold voltage; the FET is turned off when the voltage at the control input 107 is below the off threshold voltage.
[0032] The stop voltage value (STOP_V) should be low enough that the controllable switch 111 is open when the stop signal 103 occurs. When the controllable switch 111 is open, the control signal 102 has a voltage value corresponding to being disabled or inactive. In other words, when the stop signal 103 occurs, the controllable switch 111 should be open, and the device 140 should not be enabled.
[0033] During normal operation, the stop signal 103 does not occur, and the voltage at the STO input node 104 has a running voltage value (RUN_V). The running voltage value (RUN_V) is different from the stop voltage value (STOP_V). The running voltage value (RUN_V) generates a voltage value at the control input terminal 107 that turns on the controllable switch 111. For example, if the controllable switch 111 is a MOSFET, the running voltage value (RUN_V) will cause the voltage between the MOSFET's gate and source to exceed the turn-on threshold voltage, thereby turning on the MOSFET.
[0034] The logic control device 101 and the STO circuit 110 include components such as resistors, diodes, transistors, and / or capacitors, the parameters of which may vary over time and / or with the operating environment. For example, a resistor is manufactured to have a certain nominal resistance, but due to variations in the manufacturing process, the actual resistance of the resistor may be greater than or less than the nominal resistance. Furthermore, the resistance of a resistor may change during its lifespan, for example, due to exposure to heat and current during use. This resistance variation is called parameter drift. Other electronic components may also experience parameter drift. For example, the voltage drop across a diode may be + / - 30% compared to its nominal value. Transistors also experience parameter drift. For example, the turn-on threshold voltage and / or turn-off threshold voltage may vary over time and / or with the operating environment, causing the actual turn-on threshold voltage and / or turn-off threshold voltage to be different from the values intended for use with the device.
[0035] Regardless of the source of parameter drift, it can cause voltage variations in the logic control device 101. For example, when the stop signal 103 occurs, the expected voltage at control input 107 can be calculated based on the stop voltage value (STOP_V) and the impedance of the electrical components between STO input node 104 and control input 107. However, due to parameter drift of the electrical components between STO input node 104 and control input 107, the actual voltage at control input 107 may differ from its expected value for a given voltage at STO input node 104. If the actual voltage at control input 107 is higher than the expected value, the controllable switch 111 may remain on and the device 140 may remain enabled when the stop signal 103 occurs. Furthermore, the on and / or off voltages of the controllable switch 111 may drift. For example, if the turn-off voltage of controllable switch 111 changes from its nominal value of 1 volt (V) to an actual value of 0.5V, the stop voltage value (STO_V) may be insufficient to turn off controllable switch 111. In this example, even if the voltage at control input 107 is as expected, controllable switch 111 remains on, and device 140 remains enabled even when stop signal 103 is present. This situation is undesirable and may pose a safety hazard because output 141 may continue to be generated when the operator expects output 141 to have been stopped.
[0036] On the other hand, the logic control unit 101 includes a diagnostic circuit 150 and a control module 170, which provide hardware and software-based parameter drift monitoring to ensure that the logic control unit 101 continues to operate normally and as expected even under parameter drift conditions. The diagnostic circuit 150 enables the logic control unit 101 to operate at a high safety level, such as SIL3 Ple Cat4 or higher. The diagnostic circuit 150 is hardware-based because it includes a level shifting circuit 180 that boosts the diagnostic pulse 171 from the electronic control module 170 into an enhanced diagnostic signal 151. The voltage of the enhanced diagnostic signal 151 should be sufficient to turn off the controllable switch 111 and be detected as an output signal 112 at the output of the STO circuit 110. The diagnostic circuit 150 also includes a software portion. For example, the control module 170 analyzes the output signal 112 to determine if the controllable switch 111 is functioning correctly. If the controllable switch 111 is malfunctioning, the control module 170 sends a fault signal 173 to the device 140 to disable the device 140. The control module 170 also uses a monitoring process that reliably detects the output signal 112 even in the presence of other pulse voltage signals (e.g., combined with...). Figure 7 (Discussed).
[0037] Figure 2 This is a block diagram of a system 200 including a logic control device 201. The logic control device 201 is a subset of the logic control device 101. Figure 1 One example implementation is shown. The logic control device 201 includes an STO circuit 210 and a diagnostic circuit 250. The logic control device 201 also includes a microcontroller 290. The microcontroller 290 can be used to monitor safety-related power supplies. In some implementations, the DSP 270 and the microcontroller 290 are combined into a single electronic controller.
[0038] STO circuit 210 generates control signal 202 for device 240. In the illustrated example, device 240 is a PWM modulated drive signal switch, including PWM buffers 242a and 242b. When device 240 is enabled, PWM control signal 241 is provided to the switches in the motor driver, causing these switches to turn on and off according to the pattern defined by PWM control signal 241, thereby providing power to the load. When device 240 is not enabled, PWM control signal 241 is not provided to the motor driver, and power is unavailable to the load.
[0039] STO circuit 210 includes an STO input node 204 connected to node 222 of input circuit 220. Input circuit 220 includes a transient voltage suppressor (TVS) diode 221 electrically connected between node 222 and ground, and a Zener diode 224 and a capacitor 225 connected in parallel between node 226 and ground. Impedance 227 is located between nodes 222 and 226. Impedance 227 is illustrated as a single element, but may also comprise multiple different resistors electrically connected together to form impedance 227. For example, impedance 227 may comprise two impedances in series, each consisting of two resistors in parallel. TVS diode 221 absorbs transient overvoltages, and Zener diode 224 provides a stable voltage at node 226. Capacitor 225 filters out high-frequency noise and mitigates the effects of noise on the components of STO circuit 210.
[0040] Node 226 is electrically coupled to the anode of diode 231. Impedance 232 is electrically connected between the cathode of diode 231 and diagnostic node 205. Impedance 232 and diagnostic node 205 are connected to impedance 233, which in turn is connected to impedance 234. Impedances 232, 233, and 234 are all shown as single elements, but they could also be a network of resistive elements electrically connected in a network with a total impedance. For example, impedance 232 could be two or more resistors in parallel, while impedance 233 could be two or more resistors in series.
[0041] Impedance 234 is connected to input node 206 of controllable switch 211. In the example of Figure 2, controllable switch 211 is a field-effect transistor (FET) with a gate (G), drain (D), and source (S). The gate (G) of FET 211 is electrically connected to input node 206, the drain (D) of FET 211 is electrically connected to a power supply, and the source (S) of FET 211 is electrically connected to node 235. Impedance 236 is electrically connected between nodes 206 and 235. The voltage between nodes 206 and 235 serves as control input 207, controlling the state of controllable switch 211. Switch 211 is associated with an on threshold voltage and an off threshold voltage. When the voltage at control input 207 exceeds the on threshold voltage, controllable switch 211 is on; when the voltage at control input 207 is less than the off threshold voltage, controllable switch 211 is off.
[0042] Impedance 236 is electrically connected to the anode of diode 237 at node 235. The cathode of diode 237 is electrically connected to low-pass filter 254, which is electrically connected to device 240. Low-pass filter 254 can be, for example, an RC filter. The output of low-pass filter 254 is control signal 202.
[0043] The diagnostic circuit 250 includes an output preparation circuit 260 and a level shifter circuit 280. The logic control unit 201 also includes a DSP 270 and a microcontroller 290. The DSP 270 generates a diagnostic signal 271, and the level shifter 280 boosts the voltage level of the diagnostic signal 271 to generate an enhanced diagnostic signal 251. The output preparation circuit 260 includes a diode 261 and a voltage divider comprising impedances 263 and 264. The anode of diode 261 is electrically connected to node 235, the cathode of diode 261 is electrically connected to impedance 263, and impedance 263 is electrically connected to impedance 264. Impedance 264 is grounded, and the output of the voltage divider (node 262 between impedances 263 and 264) is electrically connected to a voltage clamping circuit 266.
[0044] Voltage clamping circuit 266 protects DSP 270 from high voltages that may occur when STO circuit 210 fails. Figure 3 An example implementation of voltage clamping circuit 266 is shown. Voltage clamping circuit 266 includes impedance 267 and diode assembly 268. Impedance 267 is electrically connected to node 262 and diode assembly 268. Diode assembly 268 includes anti-parallel diodes 269a and 269b. Diode 269a is grounded, and diode 269b is connected to power supply V. When STO circuit 210 is fault-free, the output signal 212 provided to DSP 270 is the same as the output signal at node 262.
[0045] Back Figure 2 The DSP 270 includes an electronic processing module 272, an electronic memory 274, and an input / output interface 276. The electronic processing module 272 contains one or more electronic processors. The electronic processor of module 272 can be any type of electronic processor, and may or may not include a general-purpose central processing unit (CPU), graphics processing unit (GPU), microcontroller, field-programmable gate array (FPGA), complex programmable logic device (CPLD), and / or application-specific integrated circuit (ASIC).
[0046] Electronic memory 274 can be any type of electronic memory. In some embodiments, electronic memory 274 is capable of storing instructions in the form of computer programs or software. Electronic memory 274 may contain volatile and / or non-volatile components. Electronic memory 274 is coupled to processing module 272, enabling processing module 272 to access or read data in electronic memory 274 and write data to it. Electronic memory 274 stores instructions that, when executed, cause electronic processing module 272 to analyze data and / or retrieve information. Electronic memory 274 also stores values and specifications for processing output signal 212. Furthermore, electronic memory 274 stores executable instructions that cause electronic processing module 272 to generate signals, such as diagnostic signal 271 and fault signal 273.
[0047] I / O interface 276 is any interface that allows DSP 270 to send and receive electrical signals. For example, I / O interface 276 may include pins, ports, displays (e.g., liquid crystal displays (LCDs)), keyboards, audio inputs and / or outputs (e.g., speakers and / or microphones), visual outputs (e.g., lights, light-emitting diodes (LEDs)) (as a complement or alternative to the display), serial or parallel ports, Universal Serial Bus (USB) connections, and / or any type of network interface (e.g., Ethernet). I / O interface 276 may also allow non-physical contact communication via, for example, IEEE 802.11, Bluetooth, or Near Field Communication (NFC) connections. For example, DSP 270 and / or information stored in electronic memory 274 can be operated, configured, modified, or updated through I / O interface 276.
[0048] The microcontroller 290 also includes an electronic processor, electronic memory, and I / O interfaces.
[0049] The level converter circuit 280 receives the diagnostic signal 271 from the DSP 270 and generates an enhanced diagnostic signal 251. Figure 4 An example of a level shifter circuit 280 is shown. Figure 4 In the example shown, level shifter 280 includes diode 281. The anode of diode 281 is connected to the output pin of DSP 270, and the cathode of diode 281 is connected to impedance 282, which is connected to impedances 283 and 284. Impedance 283 is connected to the gate of FET 285, and impedance 284 is connected to the source of FET 285. The drain of FET 285 is connected to Zener diode 286, which is connected to diagnostic node 205.
[0050] Next reference Figure 5 The operation of logic control device 201 is discussed. Figure 5This is a flowchart of the process 500 executed by the electronic processing module 272 of the DSP 270 during the operation of the logic control device 201.
[0051] Procedure 500 first determines the state of control signal 202 (505). Control signal 202 has a high-level state and a low-level state. When control signal 202 is high, device 240 is enabled and generates output 241. When control signal 202 is low, device 240 is not enabled and does not generate output 241. Enable signal 255 represents the voltage at node 209 and provides the voltage of control signal 202 to DSP 270. Node 209 is located at the output of low-pass filter 254 and is also the input of device 240. The voltage levels corresponding to the high and low levels of control signal 202 are stored in electronic memory 274. For example, a high-level state can be defined as a voltage greater than 4V, while a low-level state can be defined as a voltage less than 2V. To determine the state of control signal 202, DSP 270 compares the voltage of enable signal 255 with the defined state of control signal 202. If enable signal 255 is high, control signal 202 is enabled. If enable signal 255 is low, then control signal 202 is not enabled.
[0052] At (510), if control signal 202 is not enabled, device 240 is in safe mode, and process 500 returns to (505) to continue monitoring the status of control signal 202. At (510), if control signal 202 is enabled, DSP 270 generates diagnostic signal 271 to test STO circuit 210 (515). See also Figure 6 The graph shows the voltage of diagnostic signal 271 over time (in seconds), which has a period (P) and a duty cycle. The duty cycle is the percentage of the period (P) during which the diagnostic signal remains low. Diagnostic signal 271 is high for the remaining time of the period (P), a duration of W. For example, the period could be 100 milliseconds (ms) with a duty cycle of 99.9%. In this example, diagnostic signal 271 is low (e.g., 0V) for 99.9 milliseconds and high for 0.1 milliseconds. In other words, W in this example is 0.1 milliseconds. The low-level voltage of diagnostic signal 271 is 0V, and the high-level voltage depends on the parameters of DSP 270, and can be, for example, 2 to 3.5V.
[0053] See also Figure 2 and Figure 4Diagnostic signal 271 is provided to level shifter circuit 280. When diagnostic signal 271 is low, FET 285 is off, and diagnostic signal 271 is grounded. When diagnostic signal 271 is high, FET 285 is on, inverting diagnostic signal 271 into an inverted diagnostic signal 289. Zener diode 286 generates a substantially constant voltage at node 205 with the voltage associated with Zener diode 286. Thus, level shifter circuit boosts the initial low voltage level of inverted diagnostic signal 289 into an enhanced diagnostic signal 251.
[0054] The voltage of the pulse of the enhanced diagnostic signal 251 corresponds to the stop voltage value (STOP_V) of system 200. The stop voltage value (STOP_V) is the voltage at STO input node 204 when STO signal 203 is present. In other words, the stop voltage value (STOP_V) is the voltage at STO node 204 when device 240 is intentionally disabled. The Zener diode 286 is selected to boost the voltage level of the inverted diagnostic signal 289 to at least the expected voltage at diagnostic node 205 when STO signal 203 is present. Boosting the inverted diagnostic signal 289 in this way allows the enhanced diagnostic signal 251 to be used to ensure that the stop voltage value (STOP_V) at STO input node 204 reliably shuts off controllable switch 211. For example, in one implementation, when the STO signal 203 is present, the voltage at the STO input node is 5V, and impedances 227 and 232 cause the 5V signal at the STO input node 204 to nominally correspond to a 4.59V voltage at the diagnostic node 205. Therefore, the voltage level of the enhanced diagnostic signal 251 should be at least 4.59V. In this example, a Zener diode with a voltage of 5.1V or 5V can be used as Zener diode 286.
[0055] An enhanced diagnostic signal 251 is injected into the STO circuit 210 at diagnostic node 205 and generates a voltage at the control input 207 of the controllable switch 211. Pulses in the enhanced diagnostic signal 251 are filtered out at low-pass filter 254 and do not appear at node 209. Therefore, the enhanced diagnostic signal 251 does not interfere with the operation of device 240 or the state of control signal 202. An output signal 212 is generated and received at DSP 270 (520). DSP 270 compares the voltage of the received output signal 212 with the expected value of the output signal (525).
[0056] As described above, the voltage generated at node 205 by the pulse in the enhanced diagnostic signal 251 represents the voltage that would be generated when the STO signal 203 is present. Therefore, in the absence of parameter drift, the voltage generated at control input 207 by the pulse in the enhanced diagnostic signal 251 is low enough to turn off the controllable switch 211. Furthermore, the pulse in the enhanced diagnostic signal 251 also generates the expected voltage at node 235. When the enhanced diagnostic signal 251 generates the expected voltage at node 235, the output signal 212 also has the expected voltage. When the output signal 212 has the expected voltage, the STO circuit 210 operates normally. For example, in one embodiment, the voltage at node 205 is 5.05 V during intentional shutdown, while the voltage at node 235 is expected to be 0.36 V or lower when the controllable switch 21 is open. When the output signal 212 corresponds to a voltage of 0.3 V at node 235, the output signal 212 has the expected voltage. The diagnostic flag is set to PASS to indicate that the output signal 212 has the expected voltage. At (530), the process returns to (505) to continue monitoring control signal 202.
[0057] However, due to parameter drift, the voltage at control input 207 may be greater than expected, or the turn-off threshold of controllable switch 211 may have drifted, causing controllable switch 211 to fail to turn off in response to the enhanced diagnostic signal 251. In this case, the voltage at node 235 and the voltage at output 212 differ from the expected values. This deviation indicates that STO circuit 210 is malfunctioning, and STO signal 203 will fail to disable device 240. Continuing with the example above, where the expected voltage at node 235 is less than 0.36V, if the voltage at output signal 212 indicates that the voltage at node 235 is greater than 0.36V, then output signal 212 does not have the expected voltage. Diagnostic flag 527 is set to FAIL to indicate that STO circuit 210 is malfunctioning. At (530), process 500 proceeds to (535) and DSP 270 issues fault signal 273. Fault signal 273 disables device 240.
[0058] Figure 7 This is a flowchart of process 725. Process 725 is an example that can be used in process 500 (525). Process 725 is one possible implementation of comparing output signal 212 with an expected value. Process 725 can help identify the output signal 212 generated in response to diagnostic signal 271, thereby ensuring that fault signal 273 is not erroneously generated based on other signals that may propagate in STO circuit 210. Process 725 is executed by processing module 272 of DSP 270. Reference Figure 8Discussion step 725 shows the voltage change of the output signal 212 generated in response to diagnostic signal 271 over time. Output signal 212 has a period P and a pulse with a time width W. The period (P) can be 100 ms, and the duty cycle can be 99.9%. In this example, the time width is 0.1 ms.
[0059] The output signal 212 is sampled during a first time period (740). The first time period is the time period corresponding to the period during which the diagnostic pulse 271 is low. Continuing the example above, the first time period lasts from 0 milliseconds to approximately 99.9 milliseconds. The voltage of the output signal 212 is sampled at the end of the first sub-cycle (st1) and compared with the expected voltage. The controllable switch 211 should be on, and the expected voltage is known based on the characteristics of the controllable switch 211. For example, in one embodiment, the voltage at the diagnostic node 205 is 14.8V during normal operation, while the voltage at node 235 is expected to be 4.68V or higher when the controllable switch 211 is on. When the voltage of the output signal 212 corresponds to the 5V voltage at node 235, the output signal 212 has the expected voltage, and there is no fault condition. At (745), process 725 proceeds to (760).
[0060] On the other hand, if the voltage at voltage indicator node 235 of output signal 212 is less than 4.68V, then the sample acquired at the end of the first sub-cycle st1 has a diagnostic fault. In this case, at (745), process 725 proceeds to (750). If the first part of output signal 212 has not yet ended, process 725 returns to (740) and acquires another sample of output signal 212 when diagnostic signal 271 is low. Figure 8 In the example shown, a total of five samples of the output voltage 212 were acquired at different times while the diagnostic signal 271 was low. These samples are not necessarily acquired at fixed time intervals. If the voltage of all five samples is different from the expected value, an advanced diagnostic fault exists. Although five samples are used in this example, more or fewer samples may be acquired during the first time period (when the diagnostic signal 271 is low).
[0061] The output voltage 212 is sampled during the second time period (760). During the second time period, the diagnostic signal 271 is high, and the controllable switch 211 is expected to be turned off. For example, in one embodiment, during the intentional off period, the voltage at diagnostic node 205 is 5.05V, while the voltage at node 235 is expected to be 0.36V or lower when the controllable switch 211 is off. When the output signal 212 corresponds to a voltage of 0.3V at node 235, the output signal 212 has the expected voltage. If the output signal 212 has the expected voltage, there is no diagnostic fault (765), the process 725 ends, and it can continue from the next diagnostic pulse. If the output signal 212 does not have the expected voltage, there is a diagnostic fault (765). Additional samples can be observed during the second time period. If the second time period has ended (770), a fault signal 273 is generated at (535).
[0062] Figure 9 This is a block diagram of a dual-channel system 900. The dual-channel system 900 includes a power supply 991, an inverter IGBT 993, and a logic control device 901 containing a safe torque turn-off mechanism for the inverter IGBT 993. System 900 includes two parallel channels: a first channel 994 and a second channel 995. The first channel includes an STO circuit 910_1, a diagnostic circuit 950_1, a low-pass filter 954_1, and a device 940_1. Device 940_1 is a PWM drive signal switch. When enabled, device 940_1 outputs a PWM signal to drive the inverter IGBT 993. The STO circuit 910_1 is identical to the STO circuit 210, the diagnostic circuit 950_1 is identical to the diagnostic circuit 250, and the low-pass filter 954_1 is identical to the low-pass filter 254.
[0063] The second channel 995 is identical to the first channel 994. The second channel 995 includes an STO circuit 910_2, a diagnostic circuit 950_2, a low-pass filter 954_2, and a device 940_2. Device 940_2 is a PWM drive signal switch. When device 940_2 is enabled, it outputs a PWM signal to drive the inverter IGBT 993. The STO circuit 910_2 is identical to the STO circuit 210, the diagnostic circuit 950_2 is identical to the diagnostic circuit 250, and the low-pass filter 954_2 is identical to the low-pass filter 254.
[0064] DSP 270 is configured to send signals to diagnostic circuits 950_1 and 950_2 and devices 940_1 and 940_2. DSP 270 is configured to receive signals from the outputs of STO circuits 910_1 and 910_2 and each low-pass filter 954_1 and 954_2. STO circuit 910_1 generates an output signal 212 in response to receiving a diagnostic pulse 271. STO circuit 910_2 generates an output signal 212_2 in response to receiving a diagnostic pulse 271_2.
[0065] Channels 994 and 995 are independent and separate. Including two channels provides redundancy and allows system 900 to achieve a higher level of certification than a single-channel system. For example, if STO circuit 910_1 fails, STO circuit 910_2 can continue to operate to provide safe torque shutdown functionality. Furthermore, although system 900 includes two channels 994 and 995, additional independent, identical parallel channels can be added to provide further redundancy.
[0066] Figure 10 This is a flowchart for performing diagnostics on system 900. If control signal 202 is enabled, diagnostics (1020) are performed on the first channel 994. For example, all or part of processes 500 and 725 can be performed on the first channel 994. After completing the diagnostics on the first channel 994, the same diagnostics (1020) are performed on the second channel 995. Diagnostics are not performed on both channels 994 and 995 simultaneously to avoid potential interference between the detection of output signal 212 in the first channel 994 and the detection of output signal 212_2 in the second channel 995. Reference Figure 8 The output signal 212_2 is displayed as a function of time. The output signal 212_2 is the same as the output signal 212, except that the output signal 212_2 appears after the output signal 212. This is because the diagnostic signal 271_2 is generated and provided to the diagnostic circuit 950_1 after the diagnostic signal 271 is provided to the diagnostic circuit 950_1.
[0067] These and other embodiments are all within the scope of the claims.
Claims
1. A system comprising: A safe torque off (STO) circuit including a controllable switch is configured to generate a control signal for the device, wherein the control signal has a first state that enables the device when the controllable switch is turned on, and a second state that disables the device when the controllable switch is turned off. The electronic controller is configured to generate a diagnostic signal when the control signal has a first state; and The diagnostic circuit is configured as follows: The voltage of the diagnostic signal is modified to generate a modified diagnostic signal, wherein the modified diagnostic signal includes pulses with a voltage expected to turn off the controllable switch; and The modified diagnostic signal is provided to the STO circuit to generate an output signal. The electronic controller is further configured to: compare the output signal with a specification; and generate a fault signal if the output signal does not conform to the specification.
2. The system of claim 1, wherein the specification is an expected voltage range of the output signal when the controllable switch is off, and if the voltage of the output signal exceeds the expected voltage range, the output signal does not conform to the specification.
3. The system of claim 2, wherein the diagnostic circuit is configured to provide the modified diagnostic signal to the STO circuit at a diagnostic node, and the voltage of the pulse is equal to or greater than the voltage expected to be generated at the diagnostic node by a stop signal received at the STO circuit.
4. The system of claim 1, wherein the controllable switch comprises a transistor.
5. The system of claim 1, wherein the diagnostic circuit includes a level shifter.
6. The system of claim 5, wherein the level shifter comprises a Zener diode.
7. The system of claim 1, wherein the electronic controller is configured to compare a first portion of the output signal with a first specification and a second portion of the output signal with a second specification.
8. The system of claim 7, wherein the first specification is the expected voltage range of the output signal when the controllable switch is turned on, and the second specification is the expected voltage range of the output signal when the controllable switch is turned off.
9. The system of claim 1, wherein the electronic controller is further configured to recognize the output signal.
10. The system according to claim 1, further comprising the device.
11. The system of claim 10, wherein the device includes a pulse width modulation (PWM) drive signal switch configured to output a PWM signal when the device is enabled.
12. The system of claim 10, further comprising a low-pass filter located between the STO circuit and the device, the low-pass filter being configured to prevent the modified diagnostic signal from reaching the device.
13. The system according to claim 10, wherein, If the output signal does not meet the specification, the electronic controller is also configured to provide the fault signal to the device to switch the device to an inactive state.
14. A control system configured as follows: A diagnostic signal comprising one cycle is generated, wherein the diagnostic signal is low during the first portion of the cycle and high during the second portion of the cycle; The diagnostic signal is provided to the boost module to generate the output voltage of the safe torque shutdown STO circuit; The output signal is sampled once or multiple times during a first time window, the first time window corresponding to the first part of the period; One or more voltages sampled during the first time window are compared with a first voltage specification; The output signal is sampled during a second time window, which corresponds to the second part of the period; The voltage sampled during the second time window is compared with the second voltage specification; as well as If the voltage sampled during the second time window does not meet the second voltage specification, a fault signal is generated.
15. The control system according to claim 14, wherein, The output voltage is sampled more than once during the first time window, and the control system is configured to generate a fault signal if the voltage sampled in the second time window does not meet the second voltage specification and if all voltages sampled in the first time window do not meet the first voltage specification.
16. The control system according to claim 14, wherein, The first voltage specification includes the expected voltage range when the controllable switch in the STO circuit is turned on, and the second voltage specification includes the expected voltage range when the controllable switch in the STO circuit is turned off.
17. The control system of claim 14, wherein the control system is configured to generate the diagnostic signal in response to determining that a control signal generated by the STO circuit is in an enabled state.
18. The control system according to claim 15, wherein, The control system is also configured to: After the period ends, if the voltage sampled during the first time window meets the first voltage specification and the voltage sampled during the second time window meets the second voltage specification, a second diagnostic signal with the period is generated. The second diagnostic signal is provided to the second boost module to generate a second output voltage in the second safe torque shutdown STO circuit; The second output voltage is sampled once or multiple times during the first time window, which corresponds to the first part of the period of the second diagnostic signal; One or more voltages sampled during the first time window are compared with a first voltage specification; The second output voltage is sampled during the second time window, which corresponds to the second part of the period of the second diagnostic signal; The voltage sampled during the second time window is compared with the second voltage specification; as well as If the voltage sampled during the second time window does not meet the second voltage specification, a fault signal is generated.
19. A diagnostic module for an STO circuit, the diagnostic module comprising: The input terminal is configured to receive diagnostic voltage pulses; An inverting element is configured to invert a diagnostic voltage pulse into an inverted diagnostic voltage pulse; as well as A boost element is configured to modify the voltage of an inverted diagnostic voltage pulse into a modified pulse and inject the modified pulse into the diagnostic node of the STO circuit, wherein the modified pulse has a voltage consistent with the voltage expected to be generated at the diagnostic node by a stop signal provided to the STO circuit.