Safe torque turn-off control system and electronic equipment

Abstract

The utility model discloses a safe torque turn-off control system and electronic equipment. The safe torque turn-off control system comprises an STO signal input unit, a logic switch unit, a diagnosis unit and a filtering unit, the STO signal input unit outputs an STO signal; the diagnosis unit outputs a diagnosis signal; the logic switch unit synthesizes the STO signal and the diagnosis signal, outputs a diagnosis feedback signal to the diagnosis unit, and outputs a synthesized signal to the filtering unit; the diagnosis unit detects whether the logic switch unit breaks down or not according to the diagnosis feedback signal, and the filtering unit filters the composite signal and then outputs an STO signal. According to the technical scheme, the diagnosis unit is arranged for diagnosis, dependence on the CPU is avoided, even if the CPU fails or the program is abnormal, the system can still generate the diagnosis signal and detect the diagnosis feedback signal, normal operation of the STO function is ensured, and the safety and reliability of the system are remarkably improved.

Description

Technical Field

[0001] The utility model relates to the technical field of power electronics, in particular to a safety torque shutdown control system and electronic equipment. Background Art

[0002] During operation, a frequency converter or servo drive may experience abnormal output torque. Once this occurs, it can easily cause production accidents or personal safety incidents. To prevent these issues, existing technologies have designed a safe torque off (STO) function for drive devices such as servo drives and frequency converters. When an accident occurs, the safe torque off function stops the machine without disconnecting the drive power supply. This function can effectively prevent personal safety incidents caused by drive failures. The IEC61508 standard (Functional Safety of Electrical / Electronic / Programmable Electronic Safety Systems), officially released by the International Electrotechnical Commission, proposes the use of the safety integrity level (SIL) concept to measure the reliability of safety functions. The highest level in the industrial field is SIL3. Achieving SIL3 for an STO function means higher safety, which is also the future development trend.

[0003] Currently, existing technologies generally use dual-channel redundancy to implement the STO function and improve its safety integrity level. This is achieved by controlling the enable terminal of the buffer to cut off the torque output. To improve safety integrity, the buffer is diagnosed, but this control method has certain drawbacks:

[0004] The diagnostic signal is generated by the CPU. When the CPU fails, the diagnostic signal will not be sent normally. Utility Model Content

[0005] The embodiments of the present invention provide a safe torque off control system and an electronic device to solve the above technical problems.

[0006] A first aspect of an embodiment of the present utility model provides a safe torque off control system, comprising: an STO signal input unit, a logic switch unit, a diagnostic unit, and a filter unit;

[0007] The output end of the STO signal input unit is connected to the first input end of the logic switch unit to output an STO signal according to an external torque off command;

[0008] The output terminal of the diagnosis unit is connected to the second input terminal of the logic switch unit to output a diagnosis signal;

[0009] The first output terminal of the logic switch unit is connected to the input terminal of the diagnosis unit, and the second output terminal is connected to the input terminal of the filter unit to synthesize the STO signal and the diagnosis signal, turn on or off according to the synthesized signal, output a diagnosis feedback signal to the diagnosis unit, and output the synthesized signal to the filter unit;

[0010] The diagnosis unit detects whether the logic switch unit fails according to the diagnosis feedback signal, and the filtering unit filters the synthesized signal and then outputs the STO signal.

[0011] Optionally, the logic switch unit includes a logic sub-unit and a switch sub-unit;

[0012] The first input terminal and the second input terminal of the logic subunit are respectively the first input terminal and the second input terminal of the logic switch unit, the output terminal of the logic subunit is connected to the input terminal of the switch subunit, and the first output terminal and the second output terminal of the switch subunit are respectively the first output terminal and the second output terminal of the logic switch unit;

[0013] The logic subunit synthesizes the STO signal and the diagnostic signal and outputs a synthesized signal. The switch subunit is turned on or off according to the synthesized signal, outputs a diagnostic feedback signal to the diagnostic unit, and outputs the synthesized signal to the filter unit.

[0014] Optionally, the diagnosis unit includes a diagnosis signal generating subunit and a feedback signal detecting subunit;

[0015] The output terminal of the diagnostic signal generating subunit is the output terminal of the diagnostic unit, so as to generate and output a diagnostic signal;

[0016] The input end of the feedback signal detection subunit is the input end of the diagnosis unit, and detects whether the logic switch unit fails according to the diagnosis feedback signal.

[0017] Optionally, the diagnostic signal generating subunit includes a first timing module, a first current limiting resistor, a second current limiting resistor and a first energy storage module;

[0018] The power supply terminal of the first timing module is connected to one end of the first current limiting resistor and receives a power supply voltage. The second end of the first current limiting resistor is respectively connected to one end of the second current limiting resistor and the discharge end of the first timing module. The other end of the second current limiting resistor is respectively connected to one end of the first energy storage module and the voltage detection end of the first timing module.

[0019] When the power supply voltage charges the first energy storage module through the first current limiting resistor and the second current limiting resistor, the voltage detection end of the first timing module outputs a diagnostic signal when detecting the voltage, and when the voltage reaches a first preset voltage value, causes the first energy storage module to discharge through the second current limiting resistor and the discharge end.

[0020] Optionally, the feedback signal detection subunit includes a second timing module, a second energy storage module, and a third current limiting resistor, the input end of the second timing module is the input end of the feedback signal detection subunit, the power supply end of the second timing module and one end of the third current limiting resistor are connected together to receive the power supply voltage, the other end of the third current limiting resistor is respectively connected to the voltage detection end of the second timing module and one end of the second energy storage module, and the other end of the second energy storage module is grounded;

[0021] The power supply voltage charges the second energy storage module through the third current limiting resistor. The second timing module receives the diagnosis feedback signal and outputs a diagnosis result signal according to the voltage of the second energy storage module.

[0022] Optionally, the safety torque off control system further includes a power supply monitoring unit, which is respectively connected to the STO signal input unit, the switch subunit, the diagnostic signal generating subunit, and the feedback signal detecting subunit;

[0023] The power supply monitoring unit provides power supply voltage to the STO signal input unit, the switch subunit, the diagnostic signal generating subunit and the feedback signal detecting subunit respectively, and outputs a fault signal when detecting that the power supply voltage is not within a preset voltage range.

[0024] Optionally, the safety torque off control system further includes: a control unit, the control unit being connected to the power supply monitoring unit;

[0025] When the control unit detects that the power monitoring unit outputs a fault signal, the control unit controls the motor to stop running.

[0026] Optionally, the logic subunit includes a first logic subunit and a second logic subunit, the switch subunit includes a first switch subunit and a second switch subunit, and the filter unit includes a first filter subunit and a second filter subunit;

[0027] The output end of the STO signal input unit is connected to the first input end of the first logic subunit and the first input end of the second logic subunit respectively, so as to output the first STO signal and the second STO signal according to the external torque shutdown command;

[0028] The output end of the diagnostic signal generating subunit is connected to the second input end of the first logic subunit and the second input end of the second logic subunit respectively, so as to output a first diagnostic signal and a second diagnostic signal;

[0029] The output end of the first logic subunit is connected to the input end of the first switch subunit to synthesize the first STO signal and the first diagnostic signal and output a first synthesized signal; the output end of the second logic subunit is connected to the input end of the second switch subunit to synthesize the second STO signal and the second diagnostic signal and output a second synthesized signal;

[0030] The first output end of the first switch subunit is connected to the input end of the first filtering subunit, and the second output end of the first switch subunit is connected to the first input end of the feedback signal detection subunit, so as to be turned on or off according to the first synthetic signal, output the first diagnostic feedback signal to the feedback signal detection subunit, and output the first synthetic signal to the first filtering subunit;

[0031] The first output terminal of the second switch subunit is connected to the input terminal of the second filtering subunit, and the second output terminal of the second switch subunit is connected to the second input terminal of the feedback signal detection subunit, so as to be turned on or off according to the second synthetic signal, and output the second diagnostic feedback signal to the feedback signal detection subunit, and output the second synthetic signal to the second filtering subunit;

[0032] The feedback signal detection subunit detects whether the first logic subunit and the first switch subunit are faulty according to the first diagnostic feedback signal, and detects whether the second logic subunit and the second switch subunit are faulty according to the second diagnostic feedback signal;

[0033] The first filtering subunit filters the first composite signal and outputs the first STO signal, and the second filtering subunit filters the second composite signal and outputs the second STO signal.

[0034] Optionally, the safe torque off control system further includes a first power monitoring subunit and a second power monitoring subunit, the first power monitoring subunit being connected to the first switch subunit, and the second power monitoring subunit being connected to the second switch subunit;

[0035] The first power monitoring subunit provides a first power supply voltage to the first switch subunit, and when the first power monitoring subunit detects that the first power supply voltage is not within a preset voltage range, outputs a first fault signal;

[0036] The second power monitoring subunit provides a second power supply voltage for the second switch subunit. When the second power monitoring subunit detects that the second power supply voltage is not within a preset voltage range, the second power monitoring subunit outputs a second fault signal.

[0037] A second aspect of an embodiment of the present utility model provides an electronic device, comprising the safe torque off control system and the actuator described in the first aspect.

[0038] The technical effect of the embodiments of the present utility model is as follows: Through the coordinated operation of the various modules described above, this technical solution can generate stable diagnostic signals under different operating conditions and perform accurate fault detection, ensuring that the STO function can be accurately executed when required, avoiding the risks of false triggering and missed diagnosis. By providing a diagnostic unit for diagnosis, this technical solution avoids dependence on the CPU. Even in the event of CPU failure or program anomalies, the system can still generate diagnostic signals and detect diagnostic feedback signals, ensuring the normal operation of the STO function. By eliminating the impact of CPU failure on diagnostic signal generation, the safety and reliability of the system are significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0040] Figure 1 This is a first structural diagram of a safe torque off control system provided by the first embodiment of the present utility model;

[0041] Figure 2 This is a second structural diagram of a safe torque off control system provided by the first embodiment of the present utility model;

[0042] Figure 3 This is a third structural diagram of a safe torque off control system provided in the first embodiment of the present utility model;

[0043] Figure 4 This is a structural diagram of a diagnostic signal generating subunit in a safe torque off control system provided in the first embodiment of the present utility model;

[0044] Figure 5 This is a circuit diagram of a diagnostic signal generating subunit in a safe torque off control system provided by the first embodiment of the present utility model;

[0045] Figure 6This is a first structural diagram of a feedback signal detection subunit in a safe torque off control system provided by the first embodiment of the present utility model;

[0046] Figure 7 This is a second structural diagram of a feedback signal detection subunit in a safe torque off control system provided in the first embodiment of the present utility model;

[0047] Figure 8 A circuit diagram of a feedback signal detection subunit in a safe torque off control system provided in a first embodiment of the present invention;

[0048] Figure 9 yes Figure 8 Waveform diagram under normal diagnostic conditions;

[0049] Figure 10 yes Figure 8 Waveform diagram in abnormal diagnosis case;

[0050] Figure 11 This is a fourth structural diagram of a safe torque off control system provided in the first embodiment of the present utility model;

[0051] Figure 12 This is a fifth structural diagram of a safe torque off control system provided in the first embodiment of the present utility model;

[0052] Figure 13 This is a sixth structural diagram of a safe torque off control system provided by the second embodiment of the present utility model;

[0053] Figure 14 This is a seventh structural diagram of a safe torque off control system provided by the second embodiment of the present utility model;

[0054] Figure 15 yes Figure 14 A circuit diagram of the first power monitoring subunit in FIG.

[0055] Figure 16 yes Figure 14 A circuit diagram of the second power monitoring subunit in FIG.

[0056] Figure 17 This is an eighth structural diagram of a safe torque off control system provided by the second embodiment of the present utility model;

[0057] In the figure: 101, STO signal input unit; 102, logic switch unit; 103, diagnostic unit; 104, filtering unit; 121, logic subunit; 122, switch subunit; 131, diagnostic signal generating subunit; 132, feedback signal detecting subunit; 141, first filtering subunit; 142, second filtering subunit; 151, first power supply monitoring subunit; 152, second power supply monitoring subunit; 161, primary power supply of isolated driver chip; 162, secondary power supply of isolated driver chip; 311, first timing module; 312, first current limiting resistor; 313, second current limiting resistor; 314, first energy storage module; 321, second timing module; 322, third current limiting resistor; 323, switching device; 324, fourth current limiting resistor; 325, second energy storage module. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0059] It should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to make the disclosure thorough and complete and to fully convey the scope of the present invention to those skilled in the art. In the drawings, the dimensions and relative dimensions of layers and regions may be exaggerated for clarity. Like reference numerals denote like elements throughout.

[0060] In order to fully understand the present invention, the following description will provide detailed structures and steps to illustrate the technical solutions proposed by the present invention. The preferred embodiments of the present invention are described in detail below. However, in addition to these detailed descriptions, the present invention may also have other implementation methods.

[0061] Example 1

[0062] This embodiment provides a safe torque off control system, such as Figure 1 As shown, it includes: an STO signal input unit 101, a logic switch unit 102, a diagnosis unit 103 and a filtering unit 104;

[0063] The output end of the STO signal input unit 101 is connected to the first input end of the logic switch unit 102 to output an STO signal according to an external torque off command;

[0064] The output terminal of the diagnosis unit 103 is connected to the second input terminal of the logic switch unit 102 to output a diagnosis signal;

[0065] The first output terminal of the logic switch unit 102 is connected to the input terminal of the diagnosis unit 103, and the second output terminal is connected to the input terminal of the filter unit 104 to synthesize the STO signal and the diagnosis signal, turn on or off according to the synthesized signal, and output a diagnosis feedback signal to the diagnosis unit 103 and output the synthesized signal to the filter unit 104;

[0066] The diagnosis unit 103 detects whether the logic switch unit 102 has a fault according to the diagnosis feedback signal, and the filtering unit 104 filters the synthesized signal and outputs an STO signal.

[0067] The main function of the STO signal input unit 101 is to receive an external torque-off command and convert it into an STO signal recognizable within the system. The STO signal input unit 101 typically includes a signal interface for receiving command signals from an external controller or emergency stop device. Optoelectronic isolation, relays, or digital input circuits can be used to receive and process the STO signal. The received STO signal may be a high-level or low-level signal, or a set of coded signals. During circuit design, this signal must be converted into a logic signal that meets the requirements of the logic switch unit 102. The logic switch unit 102 typically includes logic gates and a switch chip. It receives two input signals (the STO signal and the diagnostic signal) and synthesizes them into a control signal through its built-in logic circuitry. This synthesized control signal is used to control a switching device, such as a transistor or MOSFET, to actually turn the circuit on or off. Furthermore, the logic switch unit 102 has a feedback loop that feeds the synthesized signal back to the diagnostic unit 103 for status monitoring. This feedback loop can be used to detect whether the switch status is consistent with expectations and to initiate protective measures if an anomaly is detected. The main function of the diagnostic unit 103 is to monitor the operating status of the logic switch unit 102 and detect whether it has a fault. The diagnostic unit 103 typically includes a signal generation circuit and a state detection circuit. The signal generation circuit generates a diagnostic signal, and the state detection circuit continuously monitors the output state of the logic switch unit 102, comparing the actual output with the expected output. If the diagnostic unit 103 detects that the state of the switch unit does not match the expected state (for example, it should output a high level but outputs a low level), it will generate a fault signal and issue an alarm. It can also report the fault state to the upper control system or trigger an emergency stop. The filter unit 104 filters the synthesized signal from the logic switch unit 102 to remove the diagnostic signal from the signal. The filter unit 104 is typically composed of a low-pass filter (such as an RC filter) and can also smooth high-frequency noise or spike interference to ensure the smoothness of the output signal. The filtered signal ensures that the STO signal propagated within the system is correct and will not be falsely triggered or malfunctioned due to transient interference or noise.

[0068] The working process of this embodiment 1 is as follows: when the torque shutdown is triggered externally, the STO signal input unit 101 receives the instruction and converts it into an STO signal within the system. The logic switch unit 102 receives the STO signal and the diagnostic signal output by the diagnostic unit 103, synthesizes them, and determines whether the shutdown operation should be performed. The diagnostic unit 103 monitors the working status of the logic switch unit 102. If an abnormality is found, it will generate a diagnostic signal and feed it back to the logic switch unit 102 to correct or report the error. The synthesized signal output by the logic switch unit 102 is processed by the filter unit 104 to form a stable STO signal for controlling the actual torque shutdown operation of the system.

[0069] The technical effect of this first embodiment is that, through the coordinated operation of the aforementioned modules, stable diagnostic signals can be generated under different operating conditions, and accurate fault detection can be performed, ensuring that the STO function can be accurately executed when required, avoiding the risks of false triggering and missed diagnoses. By providing a diagnostic unit for diagnosis, this technical solution avoids dependence on the CPU. Even in the event of CPU failure or program anomalies, the system can still generate diagnostic signals and detect diagnostic feedback signals, ensuring the normal operation of the STO function. By eliminating the impact of CPU failures on diagnostic signal generation, the safety and reliability of the system are significantly improved.

[0070] For the logic switch unit 102, it is necessary to synthesize the STO signal and the diagnostic signal, control the on or off state, and generate a diagnostic feedback signal and a synthesized signal. To achieve these functions, the logic switch unit 102 includes but is not limited to the following structures: 1. Discrete logic gate circuit and switch module: Use discrete logic gates such as AND gates, OR gates, and NAND gates to logically synthesize the STO signal and the diagnostic signal. The synthesized signal is used to drive the switch operation and generate a diagnostic signal through the feedback path. 2. FPGA or CPLD structure: Use programmable logic devices (such as FPGAs or CPLDs) to achieve logic synthesis. Multi-level logical operations, signal processing, and state machine control can be implemented internally, and multiple signals can be processed in real time to generate high-precision diagnostic feedback signals. 3. ASIC (Application Specific Integrated Circuit) structure: It can integrate logic synthesis, signal processing, switch control, and diagnostic feedback functions. Inside the chip, the STO signal and the diagnostic signal are synthesized and processed by hardware circuits. 4. MCU (microcontroller) plus logic circuit structure: Use the microcontroller to perform logic synthesis operations, and use peripheral logic circuits (such as AND gates and OR gates) to assist in processing STO signals and diagnostic signals. The MCU can also monitor the switch status and generate diagnostic feedback signals.

[0071] As an implementation of the logic switch unit 102, Figure 2 As shown, the logic switch unit 102 includes a logic subunit 121 and a switch subunit 122;

[0072] The first input terminal and the second input terminal of the logic subunit 121 are respectively the first input terminal and the second input terminal of the logic switch unit 102, the output terminal of the logic subunit 121 is connected to the input terminal of the switch subunit 122, and the first output terminal and the second output terminal of the switch subunit 122 are respectively the first output terminal and the second output terminal of the logic switch unit 102;

[0073] The logic subunit 121 synthesizes the STO signal and the diagnosis signal and outputs the synthesized signal. The switch subunit 122 is turned on or off according to the synthesized signal and outputs a diagnosis feedback signal to the diagnosis unit 103 and the synthesized signal to the filter unit 104 .

[0074] Among them, the main function of the logic subunit 121 is to receive the STO signal and the diagnostic signal, and to perform logical synthesis on the two signals to generate a synthesized signal. The synthesized signal is determined based on the states of the two input signals. As an example, the logic subunit 121 can be an AND gate to synthesize the two signals. The function of the switch subunit 122 is to determine the on or off state of the circuit based on the synthesized signal from the logic subunit 121. Specifically, when the synthesized signal controls the switch subunit 122 to be turned on, the switch subunit 122 turns on the circuit; when the synthesized signal controls the switch subunit 122 to be turned off, the switch subunit 122 will cut off the circuit and stop the STO signal output.

[0075] The overall operation of the logic switch unit 102 is as follows: When the STO signal and the diagnostic signal are input to the logic switch unit 102, the logic sub-unit 121 first synthesizes these two signals to generate a composite signal. This composite signal is then transmitted to the switch sub-unit 122, which uses this signal to determine whether to open or close the circuit. Throughout this process, the switch sub-unit 122 continuously feeds its operating status back to the diagnostic unit 103 for real-time monitoring and diagnosis, ensuring that the system remains under control at all times.

[0076] The technical benefits of this embodiment are as follows: the logic subunit synthesizes and outputs the synthesized signal, and the switch subunit uses this synthesized signal to quickly and reliably control the circuit, thereby immediately shutting off torque output in the event of a dangerous situation, ensuring the safety of the system and personnel. The switch subunit also has a feedback function, returning diagnostic feedback signals to the diagnostic unit for subsequent diagnosis and verification. The coordination of the logic and switch subunits enables efficient processing and control of STO and diagnostic signals, ensuring that the system can quickly and safely cease operation in the event of a fault or anomaly.

[0077] In addition to using AND gates to synthesize signals, the logic subunit 121 can also use the following logic gates or combinational circuits to synthesize signals: OR gate, NAND gate, NOR gate, XOR gate, multi-stage combinational logic circuit, adder, etc.

[0078] Among them, the function of the switch sub-unit 122 is to perform on or off operations according to the synthetic signal, and at the same time output a diagnostic feedback signal to the diagnostic unit 103, and output a synthetic signal to the filtering unit 104, including but not limited to the following structures: MOSFET switch, IGBT switch, relay switch, optocoupler and transistor combination switch, integrated switch control chip, etc.

[0079] For the diagnosis unit 103, as Figure 3 As shown, the diagnostic unit 103 includes a diagnostic signal generating subunit 131 and a feedback signal detecting subunit 132; the output end of the diagnostic signal generating subunit 131 is the output end of the diagnostic unit 103 to generate and output a diagnostic signal; the input end of the feedback signal detecting subunit 132 is the input end of the diagnostic unit 103 to detect whether the logic switch unit 102 has a fault according to the diagnostic feedback signal.

[0080] The diagnostic signal generating subunit 131 includes but is not limited to the following structures: a single timer structure, a multi-stage timer structure, a programmable logic circuit structure, a microcontroller (MCU) structure, a digital signal processing (DSP) structure, and the like.

[0081] As an implementation of the diagnostic signal generating subunit 131, Figure 4 As shown, the diagnostic signal generating subunit 131 includes a first timing module 311 , a first current limiting resistor 312 , a second current limiting resistor 313 and a first energy storage module 314 ;

[0082] The power supply terminal of the first timing module 311 is connected to one end of the first current-limiting resistor 312 to receive the power supply voltage. The second end of the first current-limiting resistor 312 is respectively connected to one end of the second current-limiting resistor 313 and the discharge end of the first timing module 311. The other end of the second current-limiting resistor 313 is respectively connected to one end of the first energy storage module 314 and the voltage detection end of the first timing module 311.

[0083] When the power supply voltage charges the first energy storage module 314 through the first current limiting resistor 312 and the second current limiting resistor 313, the voltage detection end of the first timing module 311 outputs a diagnostic signal when detecting the voltage, and when the voltage reaches the first preset voltage value, the first energy storage module 314 is discharged through the second current limiting resistor 313 and the discharge end.

[0084] The first timing module 311 monitors voltage changes and outputs different level signals based on different voltage thresholds. By timing the input voltage, the first timing module 311 can generate diagnostic signals with specific timing sequences. The voltage detection terminal of the first timing module 311 detects voltage in real time and outputs corresponding level signals at different voltage levels. The first current-limiting resistor 312 controls the current to prevent excessive current in the circuit from damaging components. During the charging process of the first energy storage module 314, the first current-limiting resistor 312 limits the current, ensuring a smooth and controlled charging process for the first energy storage module 314. The second current-limiting resistor 313 controls the discharge current to ensure that the first energy storage module 314 does not cause excessive current during discharge. It is also connected to the voltage detection terminal of the first timing module 311 and is used to regulate the voltage entering the voltage detection terminal to ensure accurate voltage detection. The first energy storage module 314 (typically a capacitor) is used to store charge and gradually increases the voltage during charging, allowing the first timing module 311 to detect voltage changes and output corresponding level signals. After being charged to a specific voltage, the first energy storage module 314 discharges through the second current limiting resistor 313 and the discharge terminal to provide power support for subsequent diagnostic signal generation.

[0085] The diagnostic signal can be a high-level signal, a low-level signal, or a high-low-level signal. As an example, the voltage detection terminal of the first timing module 311 outputs a first diagnostic signal when it detects a voltage. The voltage detection terminal of the first timing module 311 outputs a second diagnostic signal when it detects that the voltage reaches a first preset voltage value, and causes the energy storage module to discharge through the second current-limiting resistor 313 and the discharge terminal. The first diagnostic signal can be a high-level signal, and the second diagnostic signal can be a low-level signal.

[0086] The technical effect of this embodiment is that, through the coordination of various modules, precise monitoring and control of voltage changes are achieved, generating a diagnostic signal with a fixed pulse width. The coordination of the first timing module, the current-limiting resistor, and the energy storage module enables the circuit to stably generate pulse signals and trigger corresponding operations under different voltage conditions, providing a highly reliable diagnostic signal generation mechanism.

[0087] As an example, Figure 5As shown, the first timing module 311 is chip U3, the first current limiting resistor 312 is resistor R111, the second current limiting resistor 313 is resistor R112, the first energy storage module 314 is capacitor C111, and the diagnostic signal generating subunit 131 also includes resistor R110, capacitor C112 and capacitor C115. Pin 1 of chip U3 is respectively connected to the power supply VCC1, the first end of resistor R110, the first end of resistor R111, the first end of capacitor C112 and pin 5 of chip U3, pin 2 of chip U3 is respectively connected to the second end of resistor R111 and the first end of resistor R112, pin 3 of chip U3 is respectively connected to pin 4 of chip U3, the second end of resistor R112 and the first end of capacitor C111, pin 6 of chip U3 is connected to the second end of resistor R110 and constitutes the output end of the diagnostic signal generating subunit 131, pin 7 of chip U3 is connected to the first end of capacitor C115, pin 8 of chip U3 and the second end of capacitor C115 are commonly connected to ground, and the second end of capacitor C111 and the second end of capacitor C112 are both grounded.

[0088] The operating principle of this circuit structure is as follows: Power supply VCC1 charges capacitor C111 through resistors R111 and R112. As charging progresses, the voltage VI at the pulse trigger terminal THRES will continue to increase, that is, the voltage across capacitor C111 will reach VCC1, and then discharge through resistor R112 and pin 2 of chip U3. The corresponding relationship between the input trigger voltage and output of chip U3 is as follows, that is, the operating status is shown in the following table;

[0089]

[0090] When the reset pin 1 is at a low level, no matter how high the pulse input trigger voltage is, the output of chip U3 is a low level signal, and the discharge switch inside chip U3 is turned on. When the pulse input trigger voltage is in the voltage range of When the pulse input trigger voltage is When VCC1 is set to 0, the output of chip U3 is a low-level signal, and the discharge switch is in the on state. Capacitor C111 discharges through resistor R112 and pin 2 of chip U3. Since VCC1 is a fixed voltage, the voltage applied to capacitor C111 is also fixed. Therefore, chip U3 can generate a pulse signal with a fixed pulse width. The diagnostic signal generation subunit 131 is used to generate fixed pulses and provide them to the logic subunit 121 and the switch subunit 122. Its function is to diagnose whether these two subunits have faults, thereby improving the reliability and safety integrity level of the circuit.

[0091] As an implementation of the feedback signal detection subunit 132, Figure 6 As shown, the feedback signal detection subunit 132 includes a second timing module 321, a second energy storage module 325 and a third current-limiting resistor 322. The input end of the second timing module 321 is the input end of the feedback signal detection subunit 132. The power supply end of the second timing module 321 and one end of the third current-limiting resistor 322 are connected together to receive the power supply voltage VCC. The other end of the third current-limiting resistor 322 is respectively connected to the voltage detection end of the second timing module 321 and one end of the second energy storage module 325, and the other end of the second energy storage module 325 is grounded; the power supply voltage VCC charges the second energy storage module 325 through the third current-limiting resistor 322. The second timing module 321 receives the diagnostic feedback signal and outputs a diagnostic result signal according to the voltage of the second energy storage module 325.

[0092] The second timing module 321 is used to receive and process diagnostic feedback signals and output corresponding level signals based on the input signal and circuit state. It primarily monitors the voltage at the voltage detection terminal to determine the logic of the output signal and generates a diagnostic result signal based on voltage changes. In addition to generating a diagnostic result signal based on the voltage of the second energy storage module 325, the second timing module 321 can also generate a diagnostic result signal in combination with the diagnostic feedback signal. For example, it can adjust the on / off state of internal or external switching devices based on the diagnostic feedback signal and the voltage of the second energy storage module 325 to adjust the voltage of the second energy storage module 325 and generate a diagnostic result signal.

[0093] As another implementation of the feedback signal detection subunit 132, Figure 7As shown, the feedback signal detection subunit 132 includes a second timing module 321, a switch device 323, a second energy storage module 325, a third current limiting resistor 322 and a fourth current limiting resistor 324. The input end of the second timing module 321 is connected to one end of the fourth current limiting resistor 324, and the other end of the fourth current limiting resistor 324 is connected to the control end of the switch device 323. The power supply end of the second timing module 321 and one end of the third current limiting resistor 322 are connected in common to receive the power supply voltage VCC. The other end of the third current limiting resistor 322 is respectively connected to the voltage detection end of the second timing module 321 and the second energy storage module 323. 5 and the input end of the switch device 323, and the output end of the switch device 323 is grounded; when the switch device 323 is in the off state according to the diagnostic feedback signal, the second energy storage module 325 is charged, and when the switch device 323 is in the on state according to the diagnostic feedback signal, the second energy storage module 325 is discharged through the switch device 323; the second timing module 321 outputs a normal diagnosis result signal when the voltage of the second energy storage module 325 is not greater than the second voltage preset value, and the second timing module 321 outputs an abnormal diagnosis result signal when the voltage of the second energy storage module 325 is greater than the second voltage preset value.

[0094] The second timing module 321 is used to receive and process diagnostic feedback signals and output corresponding level signals based on the input signal and circuit status. It primarily determines the logic of the output signal by monitoring the voltage at the voltage detection terminal and the state of the switch device 323. Based on voltage changes and the conduction state of the switch device 323, accurate normal and abnormal diagnostic result signals are generated. This ensures that the system status can be correctly identified under different conditions, triggering corresponding actions such as alarms or protective measures, thereby improving the system's diagnostic accuracy and reliability. The switch device 323 (such as a MOSFET or transistor) is used to control the conduction and shutdown of the discharge circuit. Its state is determined by the diagnostic feedback signal, which in turn affects the overall operating state of the circuit and the output of the timing module. When the switch device 323 is on, the discharge circuit allows the discharge current to flow; when the switch device 323 is off, the discharge circuit is in an off state. The second energy storage module 325 is used to store electrical energy and begins discharging when the discharge circuit is on. The fourth current-limiting resistor 324 limits the current flowing to the control terminal of the switch device 323, ensuring that excessive current does not cause the switch device 323 to lose control or be damaged. The third current-limiting resistor 322 is connected to the power supply voltage VCC, the voltage detection terminal, and the second energy storage module 325. It is used to control the charging current of these components, ensuring that when the power supply voltage is supplied to each module, the current is appropriately limited to a safe range to prevent overcurrent damage to circuit components. The voltage detection terminal of the second timing module 321 is connected to the second energy storage module 325 to monitor its voltage status in real time. Based on the detected voltage value, the second timing module 321 outputs a diagnostic result signal.

[0095] The working process of this embodiment is as follows: when the switch device 323 is in the off state according to the diagnostic feedback signal, the second energy storage module 325 is in the charging state. In this state, the power supply (such as VCC, etc.) will charge the second energy storage module 325 through other circuit elements to enable it to store energy. When the switch device 323 is in the on state according to the diagnostic feedback signal, the second energy storage module 325 begins to discharge through the switch device 323 to adjust the voltage on the second energy storage module 325. The second timing module 321 continuously monitors the voltage of the second energy storage module 325. When the monitored voltage is not greater than the second voltage preset value, the second timing module 321 will output a normal diagnostic result signal, for example, a high-level signal, indicating that the working state is normal and there is no abnormality. If the voltage of the second energy storage module 325 exceeds the second voltage preset value, an abnormal diagnostic result signal will be output, for example, a low-level signal, to remind the system that there is a problem and measures need to be taken to protect the circuit or energy storage module.

[0096] The technical effect of this embodiment is that the feedback signal detection subunit can accurately monitor and respond to various state changes in the system through the coordinated work of various modules, can effectively distinguish between the normal state and abnormal state of the system, and output corresponding diagnostic signals to help maintenance personnel or the system to troubleshoot.

[0097] As an example, Figure 8 As shown, a circuit structure of the feedback signal detection subunit 132 is shown, wherein the second timing module 321 is a chip U4, the switching device 323 is a transistor Q1, the second energy storage module 325 is a capacitor C114, the fourth current limiting resistor 324 is a resistor R114, the third current limiting resistor 322 is a resistor R113, and the feedback signal detection subunit 132 also includes a resistor R115 and a capacitor C113.

[0098] The connection method of the circuit structure of the feedback signal detection subunit 132 is as follows: pin 1 of the chip U4 is respectively connected to the power supply VCC1, the first end of the resistor R113, the first end of the resistor R115 and the pin 5 of the chip U3; pin 2 of the chip U4 is respectively connected to pin 3 of the chip U4, the first end of the capacitor C114, the second end of the resistor R113 and the emitter of the transistor Q1; pin 4 of the chip U4 is connected to the first end of the resistor R114 and constitutes the input end of the feedback signal detection subunit 132; pin 6 of the chip U4 is connected to the second end of the resistor R115 and constitutes the output end of the feedback signal detection subunit 132; pin 7 of the chip U4 is connected to the first end of the capacitor C113; the second end of the resistor R114 is connected to the base of the transistor Q1; the second end of the capacitor C113, the second end of the capacitor C114 and the collector of the transistor Q1 are all grounded.

[0099] The working principle of this circuit structure is: the power supply VCC1 charges the capacitor C114 through the resistor R113. When the pin 4 of the chip U4 receives a continuous high level, the transistor Q1 will not be turned on, and the power supply VCC1 will continue to charge the capacitor C114 through the resistor R113. When the voltage of the capacitor C114 is greater than When the output is low, that is, once a problem pulse occurs, it will be diagnosed. Under normal conditions, pin 6 of chip U4 is high. When a problem pulse occurs, pin 6 of chip U4 will become low. This diagnostic result is used to indicate that a fault has occurred in the logic circuit unit or the switch circuit unit. Pin 4 of chip U4 is used to receive the diagnostic feedback signal and make a judgment on it. The judgment logic is as follows: Figure 9 It is the diagnostic signal, diagnostic feedback signal and diagnostic result signal in normal state. When the diagnostic feedback pulse is the same as the diagnostic pulse, the normal diagnostic result signal is output, which is always a high level signal. Figure 10 It is the diagnostic signal, diagnostic feedback signal and diagnostic result signal in abnormal state. When the diagnostic feedback pulse is different from the diagnostic pulse, the abnormal diagnostic result signal is output, and a low-level signal appears in the high-level signal.

[0100] Further, such as Figure 11 As shown, the safe torque off control system also includes a power supply monitoring unit 105, which is respectively connected to the STO signal input unit 101, the switch subunit 122, the diagnostic signal generating subunit 131 and the feedback signal detecting subunit 132; the power supply monitoring unit 105 provides power supply voltage to the STO signal input unit 101, the switch subunit 122, the diagnostic signal generating subunit 131 and the feedback signal detecting subunit 132, and outputs a fault signal when it detects that the power supply voltage is not within the preset voltage range.

[0101] The main function of the power supply monitoring unit 105 is to provide a stable power supply voltage to each unit and monitor the status of the power supply voltage. If the voltage exceeds a preset safety range, the power supply monitoring unit 105 immediately outputs a fault signal, notifying the system of a potential power supply problem. The fault signal output is a signal generated by the power supply monitoring unit 105 when it detects that the power supply voltage is not within the preset range. This signal is sent to the control unit in the system, triggering the system to enter protection mode or shut down.

[0102] The technical benefit of this embodiment is that, by introducing a power monitoring unit, the system can monitor the supply voltage status in real time, ensuring that the switch unit operates under stable voltage conditions. If the supply voltage deviates from the set safety range, the system can immediately respond by outputting a fault signal and triggering a safety mechanism, thereby enhancing the system's power supply safety and stability, ensuring that the switch unit can reliably execute safe torque off operations, and protecting the system and equipment from the risks of power supply fluctuations.

[0103] Further, such as Figure 12 As shown, the safe torque off control system further includes: a control unit 106, which is connected to the power monitoring unit 105; when the control unit 106 detects that the power monitoring unit 105 outputs a fault signal, it controls the motor to stop running.

[0104] The control unit 106 receives and monitors the output signal of the power monitoring unit 105. If the power monitoring unit 105 detects that the supply voltage is outside a preset range and outputs a fault signal, the control unit 106 immediately responds. Upon detecting the fault signal, the control unit 106 directly stops the motor to prevent equipment damage or safety incidents caused by power anomalies.

[0105] The technical benefit of this embodiment is that the control unit can respond quickly the moment the power monitoring unit detects a power problem, promptly stopping the motor and preventing potential mechanical failure or personal injury. The control unit can also collaborate with other safety mechanisms to immediately implement multiple protective measures in the event of a power failure, further enhancing system safety and reliability.

[0106] Example 2

[0107] This embodiment 2 provides a safe torque off control system, based on the technical solution provided in embodiment 1, and sets a dual-channel output STO signal. Figure 13 As shown, the logic subunit 121 includes a first logic subunit 1211 and a second logic subunit 1212 , the switch subunit 122 includes a first switch subunit 1221 and a second switch subunit 1222 , and the filter unit 104 includes a first filter subunit 141 and a second filter subunit 142 ;

[0108] The output end of the STO signal input unit 101 is connected to the first input end of the first logic subunit 1211 and the first input end of the second logic subunit 1212 respectively, so as to output the first STO signal and the second STO signal according to the external torque off command;

[0109] The output end of the diagnostic signal generating subunit 131 is connected to the second input end of the first logic subunit 1211 and the second input end of the second logic subunit 1212 respectively, so as to output the first diagnostic signal and the second diagnostic signal;

[0110] The output end of the first logic subunit 1211 is connected to the input end of the first switch subunit 1221 to synthesize the first STO signal and the first diagnostic signal and output a first synthesized signal. The output end of the second logic subunit 1212 is connected to the input end of the second switch subunit 1222 to synthesize the second STO signal and the second diagnostic signal and output a second synthesized signal.

[0111] A first output terminal of the first switch subunit 1221 is connected to an input terminal of the first filtering subunit 141, and a second output terminal of the first switch subunit 1221 is connected to a first input terminal of the feedback signal detection subunit 132, so as to be turned on or off according to the first synthetic signal, and output the first diagnostic feedback signal to the feedback signal detection subunit 132, and output the first synthetic signal to the first filtering subunit 141;

[0112] A first output terminal of the second switch sub-unit 1222 is connected to an input terminal of the second filtering sub-unit 142, and a second output terminal of the second switch sub-unit 1222 is connected to a second input terminal of the feedback signal detection sub-unit 132, so as to be turned on or off according to the second synthetic signal, and output the second diagnostic feedback signal to the feedback signal detection sub-unit 132, and output the second synthetic signal to the second filtering sub-unit 142;

[0113] The feedback signal detection subunit 132 detects whether the first logic subunit 1211 and the first switch subunit 1221 are faulty according to the first diagnostic feedback signal, and detects whether the second logic subunit 1212 and the second switch subunit 1222 are faulty according to the second diagnostic feedback signal;

[0114] The first filtering subunit 104 filters the first composite signal and outputs a first STO signal. The second filtering subunit 104 filters the second composite signal and outputs a second STO signal.

[0115] The first logic subunit 1211 and the second logic subunit 1212 receive the first and second STO signals from the STO signal input unit 101, as well as the first and second diagnostic signals from the diagnostic signal generation subunit 131, respectively. Each logic subunit logically combines the STO and diagnostic signals to generate first and second combined signals, which are used to control the corresponding switching subunits. The first switching subunit 1221 receives the first combined signal from the first logic subunit 1211, controls the on / off state of the circuit based on this signal, outputs a first diagnostic feedback signal, and transmits the first combined signal to the first filtering subunit 141. The second switching subunit 1222 receives the second combined signal from the second logic subunit 1212 and performs similar operations to the first switching subunit 1221, generating a second diagnostic feedback signal and transmitting the second combined signal to the second filtering subunit 142. Each switching subunit converts the combined signal from the logic subunit into actual switching control operations, ensuring that the circuit is opened or closed only when safety conditions are met, directly affecting the execution of torque shutdown. The separate switch subunit design matches the dual-channel configuration of the logic subunit, improving the safety integrity of the system. The first filter subunit 141 filters the first composite signal from the first switch subunit 1221, removing the diagnostic signal and ensuring that the output first STO signal is stable and accurate. The second filter subunit 142 performs a similar function, filtering the second composite signal and outputting the second STO signal. The feedback signal detection subunit 132 detects the operating status of the first logic subunit 1211 and the first switch subunit 1221, as well as the second logic subunit 1212 and the second switch subunit 1222, and determines whether these units are faulty based on the diagnostic feedback signal. The feedback signal detection subunit 132 monitors the operating status of the system's key modules in real time by analyzing the diagnostic feedback signal, enabling it to quickly identify and report potential faults or anomalies. This improves the system's fault detection capability, enabling the system to take prompt action when a fault occurs, reducing risks and the impact of the fault, and further enhancing the system's safety and reliability. The STO signal input unit 101 receives external torque-off commands, converts them into internal first and second STO signals, and transmits them to the first and second logic subunits 1211 and 1212, respectively. This unit ensures that external safety-off commands are accurately received and distributed to the different logic subunits 121, implementing dual-channel control and ensuring the system can execute safety-off operations at critical moments.

[0116] The technical advantage of this embodiment is that the logic subunit, switch subunit, and filter subunit all utilize a dual-path redundancy design, significantly improving system reliability. Even if one channel fails, the other channel can still operate normally, ensuring that the system can continue to perform the safe torque off function. The STO signal and diagnostic signal received by each logic subunit undergo logical processing and synthesis to generate an independent composite signal, ensuring that each channel operates independently and accurately responds to external torque off commands. The filtered first and second STO signals respectively control the primary and secondary power supplies of the isolated driver chip, ensuring the reliability of the entire drive system during safe shutdown. The first and second diagnostic signals provided by the diagnostic signal generation subunit enable real-time diagnosis of each logic subunit and switch subunit. The first and second STO signals respectively control the primary and secondary power supplies of the isolated driver chip. This dual protection design ensures that the system can reliably cut off the power supply to the driver chip in any situation, achieving safe torque off. This design meets high-safety industrial standards (such as SIL requirements) and significantly improves system safety.

[0117] Further, such as Figure 14 As shown, the safety torque off control system also includes a first power supply monitoring subunit 151 and a second power supply monitoring subunit 152. The first power supply monitoring subunit 151 is connected to the first switch subunit 1221, and the second power supply monitoring subunit 152 is connected to the second switch subunit 1222; the first power supply monitoring subunit 151 provides a first power supply voltage to the first switch subunit 1221, and when the first power supply monitoring subunit 151 detects that the first power supply voltage is not within a preset voltage range, it outputs a first fault signal; the second power supply monitoring subunit 152 provides a second power supply voltage to the second switch subunit 1222, and when the second power supply monitoring subunit 152 detects that the second power supply voltage is not within a preset voltage range, it outputs a second fault signal.

[0118] The first power monitoring subunit 151 provides a first supply voltage to the first switching subunit 1221 and monitors the voltage in real time to detect whether the first supply voltage is within a preset safety range. If the first power monitoring subunit 151 detects that the first supply voltage is outside the preset range (e.g., overvoltage or undervoltage), the first power monitoring subunit 151 generates and outputs a first fault signal, notifying the system of a power anomaly. Similar to the first power monitoring subunit 151, the second power monitoring subunit 152 provides a second supply voltage to the second switching subunit 1222 and monitors the voltage to detect whether the second supply voltage is within a preset safety range. If the voltage deviates from the preset value, the second power monitoring subunit 152 generates and outputs a second fault signal. Upon receiving the synthesized signal from the first logic subunit 1211, the first switching subunit 1221 controls the on / off state of the circuit. Furthermore, if the first power monitoring subunit 151 detects a voltage anomaly and outputs a fault signal, the first switching subunit 1221 ceases normal switching operations to prevent erroneous operations caused by the power anomaly. Second switching subunit 1222 functions similarly to first switching subunit 1221. It receives the synthesized signal from second logic subunit 1212 and controls switching operations based on that signal. When second power monitoring subunit 152 outputs a fault signal, second switching subunit 1222 ceases operation to prevent malfunctions caused by voltage anomalies. First and second fault signals are generated by first and second power monitoring subunits 151, 152, respectively. These signals are output when the power supply voltage is detected to be outside a preset range.

[0119] The technical advantage of this embodiment is that, by providing both a first power monitoring subunit and a second power monitoring subunit, the system can independently monitor the power supply status of each switch subunit. This dual-channel design allows the system to quickly identify abnormal power supply voltages and output a fault signal, ensuring safe system operation. If any power supply voltage falls outside a preset range, an immediate response is activated, preventing equipment failures or safety incidents caused by power supply issues, significantly improving system safety and reliability.

[0120] As an example, Figure 15As shown, the first power monitoring subunit includes a chip U1, a resistor R11, a resistor R12, a resistor R13, a resistor R14, a resistor R15, a resistor R16, a capacitor C11, a capacitor C12, a capacitor C13 and a capacitor C14, a pin 1 of the chip U1 is respectively connected to the feedback voltage VCC1_IN, a pin 2 of the chip U1, one end of the capacitor C11, one end of the resistor R11 and one end of the resistor R12, a pin 3 of the chip U1 is respectively connected to the other end of the resistor R11 and one end of the resistor R13, a pin 4 of the chip U1 is respectively connected to the other end of the resistor R13 and one end of the resistor R14, a pin 5 of the chip U1 is connected to one end of the resistor R15, a pin 6 of the chip U1 is connected to the other end of the resistor R12, and a pin 7 of the chip U1 is connected to the other end of the resistor R13. Pin 7 of chip U1 is respectively connected to pin 8 of chip U1, one end of capacitor C13 and one end of capacitor C14, and constitutes a voltage output end. Pin 9 of chip U1 is a fault signal output end. Pin 10 of chip U1 is connected to one end of capacitor C12. Pin 11 of chip U1 is connected to one end of resistor R16. Pin 12 of chip U1 is respectively connected to one end of resistor R14, one end of resistor R15, one end of resistor R16 and the other end of capacitor C12. The other end of resistor R14, the other end of resistor R15, the other end of resistor R16 and the other end of capacitor C12 are commonly connected to pin 12 of chip U1. The other end of capacitor C11, the other end of capacitor C13 and the other end of capacitor C14 are commonly connected to ground.

[0121] The working process of this circuit structure is as follows: one end of the resistor R13 is connected to pin 4 of the chip U1 and the resistor R14 respectively to form an overvoltage point and an undervoltage point. The overvoltage point threshold is UT1, and the undervoltage point threshold is UT2. When the VCC1_IN voltage is greater than UT1, or less than UT2, the power monitoring chip U1 will send a fault signal VCC1_FLY through pin 9. This fault signal will be sent to the main control chip to indicate that VCC1_IN has a fault. The main control chip will send a blocking signal to stop the motor. Capacitors C13 and C14 are used to filter out the VCC1 power supply ripple. Pins 7 and 8 of the chip U1 are used to power the diagnostic signal generation subunit 131, the feedback signal detection subunit 132, and the switch subunit 122, and can monitor the overvoltage and undervoltage status of the VCC1_IN power supply.

[0122] As an example, Figure 16As shown, the second power monitoring subunit 152 includes a chip U2, a resistor R17, a resistor R18, a resistor R19, a resistor R20, a resistor R21, a resistor R22, a resistor R23, a capacitor C15, a capacitor C16, a capacitor C17, a capacitor C18 and an optocoupler PC1, pin 1 of the chip U2 is respectively connected to the feedback voltage VCC2_IN, pin 2 of the chip U2, one end of the capacitor C15, one end of the resistor R17, one end of the resistor R18 and pin 1 of the optocoupler PC1, pin 3 of the chip U2 is respectively connected to the other end of the resistor R17 and one end of the resistor R19, pin 4 of the chip U2 is respectively connected to the other end of the resistor R19 and one end of the resistor R20, pin 5 of the chip U2 is connected to one end of the resistor R23, and the pin 6 of the chip U2 is respectively connected to the other end of the resistor R17 and one end of the resistor R19. Pin 6 is connected to the other end of resistor R18, pin 7 of chip U2 is respectively connected to pin 8 of chip U2, one end of capacitor C17 and one end of capacitor C18, pin 9 of chip U2 is connected to one end of resistor R21, pin 10 of chip U2 is connected to one end of capacitor C16, pin 11 of chip U2 is connected to one end of resistor R22, pin 12 of chip U2 is respectively connected to the other end of resistor R20, the other end of resistor R22, the other end of resistor R23 and the other end of capacitor C16, the other end of capacitor C17, the other end of capacitor C18 and the other end of capacitor C15 are commonly connected to ground, the other end of resistor R21 is connected to pin 2 of optocoupler PC1, pin 3 of optocoupler PC1 outputs a fault signal, and pin 4 of optocoupler PC1 is grounded.

[0123] The circuit structure operates as follows: The other end of resistor R19 is connected to pin 4 of chip U2 and the other end of resistor R20, forming overvoltage and undervoltage points. The overvoltage threshold is VT1, and the undervoltage threshold is VT2. When the voltage at VCC2_IN exceeds VT1 or falls below VT2, the power monitoring chip U2 issues a fault signal. Because the VCC2_IN power ground is COM, which is different from the weak current ground, the fault signal must be isolated by optocoupler PC1 before being sent to the main control chip. The fault signal first passes through the second end of resistor R21, connects to the second end of resistor R23, and pin 2 of optocoupler PC1. Since the fault signal output by chip U2 is low, indicating a fault in the VCC2_IN power supply, a fault signal VCC2_FLY is transmitted to the downstream stage through optocoupler PC1. This fault signal is sent to the main control chip, indicating a VCC2_IN power supply fault. The main chip then issues a blocking signal, causing the motor to stop.

[0124] As an implementation method, Figure 17 The figure shows the overall structure of the second embodiment. The first power monitoring sub-unit 151 can be used Figure 14 As shown in the circuit diagram, the second power monitoring subunit 152 can be used Figure 15As shown in the circuit diagram, the diagnostic signal generating subunit 131 can be used Figure 5 As shown in the circuit diagram, the feedback signal detection subunit 132 can adopt Figure 7 In the circuit diagram shown, the first logic subunit 1211 is an AND gate U5, the second logic subunit 1212 is an AND gate U6, the first filter subunit 141 includes a resistor R211 and a capacitor C211, and the second filter subunit 142 includes a resistor R212 and a capacitor C212. The function of the capacitor C211 and the capacitor C212 is to filter out the diagnostic pulse to prevent the diagnostic pulse from affecting the primary power supply of the isolation driver chip.

[0125] The operating process of this embodiment is as follows: the STO signal input unit 101 outputs the STO1 signal and the STO2 signal, the diagnostic signal generation subunit 131 outputs the first diagnostic signal and the second diagnostic signal, and the AND gate U5 combines the STO1 signal with the first diagnostic signal before sending it to the first switch subunit 1221 to turn it on or off. Since the first switch subunit 1221 controls the power supply to the primary power supply 161 of the driver isolation chip, it controls whether the PWM signal can be transmitted to the subsequent stage. When the external STO1 signal is enabled, the first switch subunit 1221 cuts off the power supply to the primary power supply 161 of the driver isolation chip, preventing the driver chip from outputting the PWM signal, thus cutting off the torque and allowing the motor to stop safely. The AND gate U6 combines the STO2 signal with the second diagnostic signal before sending it to the second switch subunit 1222 to turn it on or off. Since the second switch subunit 1222 controls the power supply to the secondary power supply 162 of the driver isolation chip, it controls whether the PWM signal can be transmitted to the subsequent stage. When the external STO2 signal is enabled, the second switch subunit 1222 will cut off the power supply of the secondary power supply 162 of the isolation driver chip, so that the isolation driver chip cannot output the PWM signal, the torque is cut off, and the motor can stop safely.

[0126] Compared with the CPU participation diagnosis method on the market, this embodiment 2 can avoid the risks brought by CPU participation in diagnosis, such as CPU failure or program runaway, and the risk of being unable to diagnose normally. This technical solution cuts off the power supply of the actuator through the switching circuit, that is, cuts off the primary and secondary power supply of the isolation driver chip, to achieve safe torque shutdown and improve the safety integrity level of the safe torque shutdown system. At the same time, the switching circuit is periodically diagnosed, and the power supply of each module unit in the system is monitored to prevent overvoltage and undervoltage from causing device failure. The diagnostic device of the switching circuit is constructed by a hardware circuit, which avoids the participation of the CPU. The power supply monitoring unit is composed of a dedicated overvoltage and undervoltage monitoring IC, which improves the reliability of the safe torque shutdown.

[0127] Example 3

[0128] This embodiment 3 provides an electronic device, including: the safe torque off control system and the actuator described in embodiment 1 or embodiment 2. The actuator can be an isolated driver chip primary power supply and an isolated driver chip secondary power supply.

[0129] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A safe torque off control system, characterized in that: include: STO signal input unit, logic switch unit, diagnostic unit and filter unit; The output end of the STO signal input unit is connected to the first input end of the logic switch unit to output an STO signal according to an external torque off command; The output terminal of the diagnosis unit is connected to the second input terminal of the logic switch unit to output a diagnosis signal; The first output terminal of the logic switch unit is connected to the input terminal of the diagnosis unit, and the second output terminal is connected to the input terminal of the filter unit to synthesize the STO signal and the diagnosis signal, turn on or off according to the synthesized signal, output a diagnosis feedback signal to the diagnosis unit, and output the synthesized signal to the filter unit; The diagnosis unit detects whether the logic switch unit fails according to the diagnosis feedback signal, and the filtering unit filters the synthesized signal and then outputs the STO signal.

2. The safe torque off control system according to claim 1, wherein: The logic switch unit includes a logic subunit and a switch subunit; The first input terminal and the second input terminal of the logic subunit are respectively the first input terminal and the second input terminal of the logic switch unit, the output terminal of the logic subunit is connected to the input terminal of the switch subunit, and the first output terminal and the second output terminal of the switch subunit are respectively the first output terminal and the second output terminal of the logic switch unit; The logic subunit synthesizes the STO signal and the diagnostic signal and outputs a synthesized signal. The switch subunit is turned on or off according to the synthesized signal, outputs a diagnostic feedback signal to the diagnostic unit, and outputs the synthesized signal to the filter unit.

3. The safe torque off control system according to claim 2, wherein: The diagnostic unit includes a diagnostic signal generating subunit and a feedback signal detecting subunit; The output terminal of the diagnostic signal generating subunit is the output terminal of the diagnostic unit, so as to generate and output a diagnostic signal; The input end of the feedback signal detection subunit is the input end of the diagnosis unit, and detects whether the logic switch unit fails according to the diagnosis feedback signal.

4. The safe torque off control system according to claim 3, wherein: The diagnostic signal generating subunit includes a first timing module, a first current limiting resistor, a second current limiting resistor and a first energy storage module; The power supply terminal of the first timing module is connected to one end of the first current limiting resistor and receives a power supply voltage. The second end of the first current limiting resistor is respectively connected to one end of the second current limiting resistor and the discharge end of the first timing module. The other end of the second current limiting resistor is respectively connected to one end of the first energy storage module and the voltage detection end of the first timing module. When the power supply voltage charges the first energy storage module through the first current limiting resistor and the second current limiting resistor, the voltage detection end of the first timing module outputs a diagnostic signal when detecting the voltage, and when the voltage reaches a first preset voltage value, causes the first energy storage module to discharge through the second current limiting resistor and the discharge end.

5. The safe torque off control system according to claim 4, wherein: The feedback signal detection subunit includes a second timing module, a second energy storage module, and a third current limiting resistor. The input end of the second timing module is the input end of the feedback signal detection subunit. The power supply end of the second timing module and one end of the third current limiting resistor are connected together to receive the power supply voltage. The other end of the third current limiting resistor is respectively connected to the voltage detection end of the second timing module and one end of the second energy storage module. The other end of the second energy storage module is grounded. The power supply voltage charges the second energy storage module through the third current limiting resistor. The second timing module receives the diagnosis feedback signal and outputs a diagnosis result signal according to the voltage of the second energy storage module.

6. The safe torque off control system according to claim 5, wherein: The safety torque off control system further includes a power supply monitoring unit, which is respectively connected to the STO signal input unit, the switch subunit, the diagnostic signal generating subunit and the feedback signal detecting subunit; The power supply monitoring unit provides power supply voltage to the STO signal input unit, the switch subunit, the diagnostic signal generating subunit and the feedback signal detecting subunit respectively, and outputs a fault signal when detecting that the power supply voltage is not within a preset voltage range.

7. The safe torque off control system according to claim 6, wherein: The safe torque off control system further includes: a control unit connected to the power supply monitoring unit; When the control unit detects that the power monitoring unit outputs a fault signal, the control unit controls the motor to stop running.

8. The safe torque off control system according to claim 3, wherein: The logic subunit includes a first logic subunit and a second logic subunit, the switch subunit includes a first switch subunit and a second switch subunit, and the filter unit includes a first filter subunit and a second filter subunit; The output end of the STO signal input unit is connected to the first input end of the first logic subunit and the first input end of the second logic subunit respectively, so as to output the first STO signal and the second STO signal according to the external torque shutdown command; The output end of the diagnostic signal generating subunit is connected to the second input end of the first logic subunit and the second input end of the second logic subunit respectively, so as to output a first diagnostic signal and a second diagnostic signal; The output end of the first logic subunit is connected to the input end of the first switch subunit to synthesize the first STO signal and the first diagnostic signal and output a first synthesized signal; the output end of the second logic subunit is connected to the input end of the second switch subunit to synthesize the second STO signal and the second diagnostic signal and output a second synthesized signal; The first output end of the first switch subunit is connected to the input end of the first filtering subunit, and the second output end of the first switch subunit is connected to the first input end of the feedback signal detection subunit, so as to be turned on or off according to the first synthetic signal, output the first diagnostic feedback signal to the feedback signal detection subunit, and output the first synthetic signal to the first filtering subunit; The first output terminal of the second switch subunit is connected to the input terminal of the second filtering subunit, and the second output terminal of the second switch subunit is connected to the second input terminal of the feedback signal detection subunit, so as to be turned on or off according to the second synthetic signal, and output the second diagnostic feedback signal to the feedback signal detection subunit, and output the second synthetic signal to the second filtering subunit; The feedback signal detection subunit detects whether the first logic subunit and the first switch subunit are faulty according to the first diagnostic feedback signal, and detects whether the second logic subunit and the second switch subunit are faulty according to the second diagnostic feedback signal; The first filtering subunit filters the first composite signal and outputs the first STO signal, and the second filtering subunit filters the second composite signal and outputs the second STO signal.

9. The safe torque off control system according to claim 8, wherein: The safety torque off control system further includes a first power monitoring subunit and a second power monitoring subunit, wherein the first power monitoring subunit is connected to the first switch subunit, and the second power monitoring subunit is connected to the second switch subunit; The first power monitoring subunit provides a first power supply voltage to the first switch subunit, and when the first power monitoring subunit detects that the first power supply voltage is not within a preset voltage range, outputs a first fault signal; The second power monitoring subunit provides a second power supply voltage for the second switch subunit. When the second power monitoring subunit detects that the second power supply voltage is not within a preset voltage range, the second power monitoring subunit outputs a second fault signal.

10. An electronic device, characterized in that: include: The safe torque off control system and actuator according to any one of claims 1 to 9.

Images