Motor control device

Abstract

To enhance safety performance of a motor control device.SOLUTION: The motor control device receives two first feedback signals independent from each other from a first encoder that detects operation of a motor, receives two second feedback signals independent from each other from a second encoder that detects operation of a driven unit, generates, based on an operation command signal for driving the motor, the first feedback signal, and the second feedback signal, a command value concerning the operation of the motor such that the operation of the motor follows the operation command signal, and when a driving unit supplies the motor with a driving current for driving the motor based on a driving signal corresponding to the command value, executes interruption processing of the driving signal when it is determined that a failure occurs concerning operation of an encoder or the driven unit based on the first feedback signal and the second feedback signal.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to a motor control device that controls the drive of a motor. [Background technology]

[0002] In recent years, servo systems have been used in manufacturing sites for controlling the positioning of moving parts in various machines. Such servo systems include a servo motor for operating various types of machinery, an encoder attached to the servo motor, a servo driver for driving the servo motor, and a control device for outputting position command information and the like to the servo driver. In addition to cost reduction and productivity improvement, ensuring worker safety is becoming an important requirement in manufacturing sites. Therefore, servo systems are also being required to comply with appropriate safety standards.

[0003] Patent Document 1 discloses a full-closed loop position control servo driver that performs positioning control by feeding back a position detection signal from a linear scale and a speed detection signal from a rotary encoder to a position control driver, and after positioning is completed, the position control driver outputs a positioning completion signal to a controller. Patent Document 2 also discloses a control device that outputs a safety stop signal to stop the driving equipment when a diagnostic processing unit diagnoses a serious fault state in at least one of the position and rotation speed of the rotating shaft. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 7-225615 [Patent Document 2] Japanese Patent Application Laid-Open No. 2016-206842 Summary of the Invention [Problem to be solved by the invention]

[0005] In the past, it was thought that in order to improve the safety performance of a motor control device that drives and controls a motor, it was necessary to improve the safety performance of the encoder that detects the movement of the motor and generates input information for the motor control device. Therefore, the design of the encoder must meet the requirements of certain safety standards. For example, IEC61508 is defined as such a safety standard. IEC61508 is an international standard for functional safety related to electrical, electronic, and programmable electronic safety. IEC61508 measures the probability of system failure using a scale called SIL (Safety Integrity Level), as shown in Table 1 below. It is stipulated in. [Table 1]

[0006] IEC61508 defines the requirements that must be met for each SIL in the table, clarifying the efforts that the safety control system must achieve. SIL is divided into four levels, from SIL1 to SIL4, and the higher the SIL number, the higher the safety performance. For example, a motor control device with a high safety performance is desired that has a high SIL value.

[0007] The present invention has been made in consideration of such problems, and has an object to provide a technique for improving the safety performance of a motor control device. [Means for solving the problem]

[0008] In order to solve the above problem, in the present invention, when a motor control device determines that a fault has occurred in the operation of the encoder or the driven part based on two mutually independent first feedback signals corresponding to the operation of the motor and two mutually independent second feedback signals corresponding to the operation of the driven part, the motor control device executes processing to cut off the drive signal via the cutoff unit. With this configuration, the motor control device has a redundant configuration for determining faults, thereby improving the safety performance of the motor control device.

[0009] In one aspect of the present invention, a motor control device includes: a first signal receiving unit that receives, from a first encoder that detects operation of the motor, two mutually independent first feedback signals in response to operation of the motor; a second signal receiving unit that receives, from a second encoder that detects operation of a driven part driven by the motor, two mutually independent second feedback signals in response to operation of the driven part; a motor control unit that generates a command value for operation of the motor based on an operation command signal for driving the motor and a predetermined feedback signal, at least one of the first feedback signal and the second feedback signal, so that operation of the motor follows the operation command signal; a drive unit that supplies a drive current to the motor in response to the command value from the motor control unit; a cut-off unit that cuts off transmission of the drive signal from the motor control unit to the drive unit in response to the command value; and a safety control unit that, when it is determined that a fault has occurred in operation of the encoder or the driven part based on the two first feedback signals received via the first signal receiving unit or the two second feedback signals received via the second signal receiving unit, executes a cut-off process for the drive signal via the cut-off unit.

[0010] In this way, redundant feedback signals are received from the first encoder that detects the operation of the motor and the second encoder that detects the operation of the driven part, and by using these first and second feedback signals, it is possible to make fault determinations redundant, thereby improving the reliability of the feedback values. Explaining this based on the above-mentioned safety standard IEC61508, in a configuration in which the first and second feedback signals are each redundant, compared to a configuration in which the second feedback signal is not redundant, for example, the hardware fault tolerance (HFT) value is higher and the SIL value can be increased.

[0011] In the motor control device, the safety control unit may further determine the occurrence of a fault based on a comparison result between at least one of a first feedback value calculated from the first feedback signal and a second feedback value calculated from the second feedback signal and an operation command value calculated from the operation command signal, and cause the cutoff unit to cut off the drive signal based on the comparison result. This further improves the reliability of the feedback value. To explain this based on the above-mentioned safety standard IEC 61508, employing a configuration that performs the cutoff process using the comparison result between the operation command value and the feedback value increases the safe failure fraction (SFF) of the encoder. As a result, as can be seen from Table 1 above, by increasing the SFF value while maintaining the hardware fault tolerance (HFT) value, it is possible to increase the SIL value, which is related to the safety performance of the motor control device.

[0012] In one aspect of the present invention, a motor control device includes a first signal receiving unit that receives a first feedback signal from a first encoder that detects operation of the motor in accordance with operation of the motor, a second signal receiving unit that receives two mutually independent second feedback signals from a second encoder that detects operation of a driven unit driven by the motor in accordance with operation of the driven unit, a motor control unit that generates a command value for operation of the motor based on an operation command signal for driving the motor and at least one of the first feedback signal and the second feedback signal so that operation of the motor follows the operation command signal, a drive unit that supplies a drive current to the motor in accordance with the command value from the motor control unit, and a drive current that supplies a drive current to the motor in accordance with the command value. and a safety control unit that, when it is determined that a fault has occurred in the operation of the encoder based on the two first feedback signals received via the first signal receiving unit or the two second feedback signals received via the second signal receiving unit, executes processing to shut off the drive signal via the shutoff unit. The safety control unit determines the occurrence of the fault based on a result of comparing at least one of a first feedback value calculated from the first feedback signal and a second feedback value calculated from the second feedback signal with an operation command value calculated from the operation command signal, and executes processing to shut off the drive signal via the shutoff unit based on the determination result. In this way, by utilizing the result of comparing the operation command value with the feedback value, the motor control device increases the safe failure fraction (SFF) of the encoder, as described above, and as a result, the SFF value is increased while maintaining the hardware fault tolerance (HFT) value, making it possible to increase the SIL value, which is related to the safety performance of the motor control device.

[0013] The motor control device according to the present invention is a device that drives a motor based on an operation command signal. Examples of such a motor control device include a servo driver and an inverter. The operation command signal may be generated by another control device (e.g., a PLC) located outside the motor control device and provided to the motor control device, or may be generated internally within the motor control device. Specifically, a command value for driving the motor is generated by the motor control unit from the operation command signal, a feedback signal, and a second feedback signal. When a drive signal including this command value is transmitted from the motor control unit to the drive unit, the drive unit supplies a drive current corresponding to the command value to the motor, thereby driving the motor to follow the operation command signal. The command value can be generated according to any feedback method, such as a feedback method related to position information, speed information, etc., to enable the motor to follow the operation command signal.

[0014] Here, the motor control device is equipped with a cutoff unit that cuts off transmission of the drive signal from the motor control unit to the drive unit, and the cutoff process of the drive signal by the cutoff unit is controlled by the safety control unit. If it is determined that a fault has occurred in the operation of the encoder, the safety control unit executes the cutoff process, thereby realizing safety performance of the motor control device. The cutoff process executed by the safety control unit includes determining whether or not a fault has occurred in the operation of the encoder or the driven unit based on two first feedback signals received via the first signal receiving unit and two second feedback signals received via the second signal receiving unit, and executing the cutoff process according to the determination result.

[0015] As another cut-off process, the safety control unit may use a feedback value from the encoder to determine whether there is a fault in the speed or position limits of the motor, and cut off the drive signal depending on the result of the determination.

[0016] In the motor control device, the encoder is configured to generate two feedback signals that are independent of each other in response to the operation of the motor, and the safety control In the cutoff process, the control unit may compare the operation command value with at least one of the two predetermined feedback values ​​calculated from the two feedback signals, respectively, and execute the cutoff process for the drive signal. In this way, even in a motor control device that uses a feedback signal from an encoder in which the feedback signal is duplicated, the safety performance can be more effectively improved. In other words, it is possible to raise the SIL value related to the safety performance of the motor control device above the SIL value related to the safety performance of the encoder.

[0017] Here, specific examples of the shutoff process by the safety control unit in the motor control device described above will be disclosed. First, the safety control unit may determine whether to execute the shutoff process based on the difference between the predetermined feedback value and the operation command value during the shutoff process. Second, the safety control unit may compare the rate of change of the predetermined feedback value with the rate of change of the operation command value during the shutoff process, and determine whether to execute the shutoff process based on the comparison result. Third, the safety control unit may determine whether to execute the shutoff process based on the rate of change of the difference between the rate of change of the predetermined feedback value and the rate of change of the operation command value during the shutoff process. Furthermore, the shutoff process by the safety control unit may employ a combination of some or all of these processes, or alternatively, may employ processes other than those described above. [Effects of the Invention]

[0018] It is possible to improve the safety performance of the motor control device without being restricted by the safety performance of the encoder. [Brief explanation of the drawings]

[0019] [Figure 1] 1 is a diagram showing a schematic configuration of a servo system in which a servo driver according to the present invention is incorporated; [Figure 2] FIG. 1 is a diagram for explaining the safety performance of a subsystem of a servo driver according to the present invention. [Figure 3] FIG. 2 is a functional block diagram of a servo driver according to the first embodiment. [Figure 4] FIG. 10 is a diagram illustrating a cutoff process performed by a safety control unit. [Figure 5] FIG. 10 is a functional block diagram of a servo driver according to a second embodiment. [Figure 6] FIG. 10 is a diagram illustrating a cutoff process performed by a safety control unit according to a second embodiment. [Figure 7] FIG. 10 is a functional block diagram of a servo driver according to a third embodiment. [Figure 8] FIG. 10 is a diagram for schematically explaining the safety performance in a subsystem of a servo driver according to a third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0020] <First Example> 1 is a schematic diagram of a servo system incorporating a servo driver corresponding to the motor control device of the present invention. The servo system includes a network 1, a motor 2, a first encoder 3, a servo driver 4, a standard PLC (Programmable Logic Controller) 5, and , a safety PLC 6, a second encoder 7, and a driven part 8. The motor 2 and the first encoder 3 form a servo motor. The servo system is a system for driving the driven part 8 by the motor 2. The motor 2 is incorporated into a mechanical device including the driven part 8 as an actuator of the mechanical device. For example, the motor 2 is an AC motor. The first encoder 3 is attached to the motor 2 to detect the operation of the motor 2. The first encoder 3 generates a first feedback signal indicative of the detected operation of the motor 2, and transmits the first feedback signal to the servo driver 4. The first feedback signal includes, for example, position information about the rotational position (angle) of the rotary shaft of the motor 2, information about the rotational speed of the rotary shaft, etc. The first encoder 3 is attached to a general ink jet printer. A linear encoder and an absolute encoder can be applied.

[0021] The driven unit 8 is a mechanical device such as an arm of an industrial robot or a conveying device. In the example of FIG. 1 , the driven unit 8 has a moving stage 81 and a transmission mechanism 82, and the moving stage 81 is connected to the motor 2 via the transmission mechanism 82. The transmission mechanism 82 is a mechanism that transmits the driving force of the motor 2 to the moving stage 81, such as a pulley and a drive belt, gears, or a threaded rod. When the driving force of the motor 2 is transmitted to the moving stage 81 via the transmission mechanism 82, the moving stage 81 moves in accordance with this driving force. Note that the movement of the mechanical device by the motor 2 may involve rotation around a specific axis to change its orientation, or partial displacement due to expansion and contraction. A second encoder 7 is attached to the driven unit 8 to detect the operation of the driven unit 8. The second encoder 7 generates a second feedback signal indicative of the operation of the driven unit 8 by, for example, reading a scale 71 that moves together with the moving stage 81 of the driven unit 8, and transmits the second feedback signal to the servo driver 4. The second feedback signal includes, for example, position information of the moving stage 81, information on the moving speed thereof, etc. A general incremental type encoder or absolute type encoder can be applied to the second encoder 7.

[0022] The servo driver 4 receives an operation command signal related to the operation (motion) of the motor 2 from the standard PLC 5 via the network 1, and controls the operation of the motor 2 based on at least one predetermined feedback signal of a first feedback signal output from the first encoder 3 and a second feedback signal output from the second encoder 7 so that the operation of the motor follows the operation command signal. The servo driver 4 executes servo control related to the drive of the motor 2 based on the operation command signal from the standard PLC 5, the first feedback signal from the first encoder 3, and the second feedback signal from the second encoder 7. The servo driver 4 is also connected to the safety PLC 6 via the network 1. As a result, the servo driver 4 monitors the occurrence of failures in the motor 2, the servo driver 4, and the driven part 8 based on a monitoring command signal received from the safety PLC 6, and returns the results to the safety PLC 6.

[0023] Furthermore, the servo driver 4 calculates a command value for the operation of the motor 2 based on the operation command signal from the standard PLC 5, the first feedback signal from the first encoder 3, and the second feedback signal from the second encoder 7. Furthermore, the servo driver 4 supplies a drive current to the motor 2 so that the operation of the motor 2 follows the command value. This supply current utilizes AC power sent from an AC power supply 11 to the servo driver 4. In this embodiment, the servo driver 4 is of a type that receives three-phase AC, but it may also be of a type that receives single-phase AC.

[0024] Here, FIG. 2 is a block diagram of the safety functions in the three subsystems that make up the servo driver 4 as a single system: the input configuration, the calculation configuration, and the output configuration. The input configuration is a subsystem related to the input to the servo driver 4, and its safety performance depends heavily on the safety performance of the first encoder 3. Specifically, the first encoder 3 has a duplicated circuit that enables independent pulse output by simultaneous scanning within it, as will be described later, and the duplicated feedback signal is input to the servo driver 4 via an independent wiring. Similarly, the second encoder 7 has a duplicated circuit that enables independent pulse output by simultaneous scanning within it, and the duplicated feedback signal is input to the servo driver 4 via an independent wiring. Therefore, the input configuration is a subsystem related to the safety functions InS11 and InS12 by the first encoder 3 and the safety function InS13 by the second encoder 7. In this case, the hardware fault tolerance (HFT) is 2. Generally, the safe failure fraction (SFF) of an encoder is It is not easy to increase the SFF in terms of the volume (size) and cost of the encoder, so in this embodiment, the SFF of the first encoder 3 and the second encoder 7 is in the range of 60% or more and less than 90%. Therefore, the safety integrity level (SIL) of the input configuration is 3.

[0025] The calculation configuration is a subsystem related to calculations for calculating outputs from inputs in the servo driver 4. For example, the calculation circuit using a microprocessor (MPU) is configured to be independent and duplicated, thereby enabling the safety functions CtS11, CtS12, CtS21 , CtS22, and the HFT in this case is 2. In addition, it is generally easy to increase the SFF of the calculation configuration relatively, so the SFF of the calculation configuration is relatively high, falling within the range of 90% to 99%. Therefore, the SIL of the calculation configuration is 4. Furthermore, the output configuration is a subsystem related to the output from the servo driver 4, and as will be described later, depends on the safety performance of the interrupter unit 43, which interrupts the transmission of the drive signal from the motor control unit 42 to the drive unit 44. Specifically, the output configuration has safety functions OtS11, OtS12, OtS21, and OtS22, with the electrical circuits forming the interrupter unit 43 being independently duplicated, and the HFT in this case is 2. In addition, it is generally easy to increase the SFF of the output configuration relatively, so the SFF of the calculation configuration is relatively high, falling within the range of 90% to 99%. Therefore, the SIL of the output configuration is also 4.

[0026] The following describes a more specific configuration of the servo driver 4. FIG. 3 is a functional block diagram of the servo driver 4 according to the first embodiment. As shown in FIG. 3, the servo driver 4 includes a feedback processing unit 41, a motor control unit 42, a shutoff unit 43, a drive unit 44, a first signal receiving unit 46, a second signal receiving unit 45, and a safety control unit 50. The first signal receiving unit 46 is an input interface that receives two independent first feedback signals in response to the operation of the motor 2 from a first encoder 3 that detects the operation of the motor 2. The first signal receiving unit 46 receives the first feedback signals and inputs them to the feedback processing unit 41. The second signal receiving unit 45 is an input interface that receives two independent second feedback signals in response to the operation of the driven unit driven by the motor 2 from a second encoder that detects the operation of the driven unit. The second feedback signal receiving unit 45 receives the second feedback signals and inputs them to the feedback processing unit 41. The feedback processing unit 41 generates a first feedback value based on the first feedback signal from the first encoder 3 and generates a second feedback value based on the second feedback signal from the second encoder 7. For example, when pulses are output from the first encoder 3 and the second encoder 7, the feedback processing unit 41 counts the pulses to calculate the position and movement speed of the motor 2 and the driven unit 8, and generates feedback values ​​including values ​​indicating the position and speed.

[0027] The first encoder 3 has a duplicated circuit that enables simultaneous scanning within it to output independent pulses, and outputs a duplicated feedback signal. Therefore, the feedback processing unit 41 receives the duplicated feedback signal from the first encoder 3 and generates a duplicated feedback value based on the feedback signal. The feedback processing unit 41 then sends the generated duplicated feedback value to the motor control unit 42 and also to the safety control unit 50.

[0028] The second encoder 7 also has a duplicated circuit that enables simultaneous scanning within it to output independent pulses, and outputs a duplicated feedback signal. Therefore, the feedback processing unit 41 receives the duplicated second feedback signal from the second encoder 7 and generates a duplicated second feedback value based on the second feedback signal. The feedback processing unit 41 then sends the generated duplicated second feedback value to the motor control unit 42 and also to the safety control unit 50.

[0029] Next, the motor control unit 42 receives an operation command signal from the standard PLC 5 and also receives a first feedback value and a second feedback value from the feedback processing unit 41. The motor control unit 42 generates command values ​​for executing position feedback control and speed feedback control based on the operation command signal and the first and second feedback values. For example, the motor control unit 42 generates a position command value and a speed command value through feedback control based on the operation command signal, the first feedback value, and the second feedback value. The feedback method used in this feedback control is a method that forms a servo loop suitable for a predetermined purpose (e.g., transporting luggage) of the mechanical device (e.g., conveying equipment) in which the motor 2 is incorporated, and can be designed as appropriate. For example, the motor control unit 42 may control the motor 2 using one of the first feedback value and the second feedback value. These command values ​​generated by the motor control unit 42 are then sent to the cutoff unit 43 as drive signals.

[0030] Next, when the cutoff unit 43 receives a cutoff signal from the safety control unit 50 (described later), it stops the drive unit 44 by not electrically passing the drive signal from the motor control unit 42 to the drive unit 44 (described later). As a result, even if the motor control unit 42 sends a drive signal, the output of torque by the motor 2 is stopped. On the other hand, when a cutoff signal is not input to the cutoff unit 43, the cutoff unit 43 passes the drive signal including the command value output from the motor control unit 42 to the drive unit 44 as is. Note that the cutoff unit 43 is not limited to a configuration that exists independently from functional units such as the motor control unit 42. The motor control unit 42 may also function as the cutoff unit 43, and when it receives a cutoff signal from the safety control unit 50, it may stop the drive unit 44 by stopping the output of the position command value and the speed command value.

[0031] Here, the drive unit 44 receives a drive signal from the motor control unit 42 via the cutoff unit 43. The drive unit 44 has a circuit configured with semiconductor switching elements such as IGBTs (Insulated Gate Bipolar Transistors), and generates a signal for turning the switching elements on and off in accordance with the PWM method based on the drive signal from the motor control unit 42, and turns the switching elements on and off in accordance with the signal. This supplies AC power to the motor 2, and the motor 2 is driven in accordance with the drive signal. On the other hand, when the cutoff unit 43 operates and cuts off the transmission of the drive signal to the drive unit 44, the output from the drive unit 44 is fixed to OFF. This stops the power supply to the motor 2, and therefore stops the output of torque from the motor 2.

[0032] In this way, the feedback processing unit 41, motor control unit 42, cut-off unit 43, and drive unit 44 are, so to speak, functional units directly related to drive control of the motor 2. On the other hand, the safety control unit 50 is a functional unit that determines whether a malfunction has occurred in the operation of the first encoder 3, and if it determines that a malfunction has occurred, stops the operation of the motor 2 to ensure safety for that operation. Specifically, the safety control unit 50 further includes a determination unit 51 and a cut-off instruction unit 52. Control related to ensuring safety, including malfunction determination by the safety control unit 50, is executed based on a monitoring command from the safety PLC 6.

[0033] The determination unit 51 determines whether a fault related to the operation of the first encoder 3 has occurred based on the first feedback value, and determines whether a fault related to the operation of the second encoder 7 has occurred based on the second feedback value. The determination unit 51 determines, for example, whether the first feedback value and the second feedback value are normal or not. Specifically, the determination unit 51 receives duplicated first feedback signals from the first encoder 3, compares these first feedback signals, and determines that a fault related to the first encoder 3 has occurred if there is a deviation exceeding a threshold. The determination unit 51 also receives duplicated second feedback signals from the second encoder 7, and compares these second feedback signals. If there is a difference exceeding the threshold value, it is determined that a failure has occurred in the second encoder 7.

[0034] When the determination unit 51 determines that a fault has occurred, the cutoff instruction unit 52 generates a cutoff signal, which is then sent to the cutoff unit 43. Upon receiving the cutoff signal, the cutoff unit 43 cuts off transmission of the drive signal from the motor control unit 42 to the drive unit 44, as described above, thereby stopping torque output by the motor 2. The control state (presence or absence of a fault) by the safety control unit 50 is notified to the safety PLC 6 in the form of a response to a monitoring command from the safety PLC 6.

[0035] Here, the shutoff process by the safety control unit 50 having the determination unit 51 and the shutoff instruction unit 52 will be described with reference to FIG. 4. The shutoff process shown in FIG. 4 is repeatedly executed by a computing device (such as an MPU) forming the safety control unit 50, for example, at a control period in which a command value is generated. In step S101, the determination unit 51 acquires a first feedback value and a second feedback value from the feedback processing unit 41. Thereafter, in step S102, the determination unit 51 performs a process of determining whether or not a fault has occurred based on the first feedback value and the second feedback value. Step S103 is a branching process according to the determination result of step S102. If it is determined that a fault has occurred (S103, Yes), the process proceeds to step S104, where the shutoff instruction unit 52 generates a shutoff signal and sends the generated shutoff signal to the shutoff unit 43. This stops the torque output by the motor 2. On the other hand, if it is determined that no fault has occurred (S103, No), the shutoff instruction unit 52 does not generate a shutoff signal, and the process of FIG. 4 ends.

[0036] In this way, in the servo driver 4, the judgment unit 51 judges whether the first encoder 3 and the second encoder 7 have failed, and if a failure is judged, the cutoff unit 43 operates to stop torque output by the motor 2. This improves the accuracy of failure judgment and enhances the safety performance of the motor control device.

[0037] <Second Example> 5 is a functional block diagram of a servo driver 4 according to a second embodiment. This embodiment differs from the first embodiment in the configuration for determining a failure based on the value of the operation command signal, the first feedback value, and the second feedback value, but the other configurations are the same. Therefore, the same elements as those in the first embodiment are denoted by the same reference numerals, and a repeated description will be omitted.

[0038] As shown in FIG. 5, the safety control unit 50 of this embodiment has a comparison / determination unit 53. The comparison / determination unit 53 is a functional unit that determines whether a failure related to the operation of the first encoder 3 and the second encoder 7 has occurred, and this determination is made based on a feedback value linked to the operation of the motor 2 and the value of an operation command signal to the motor 2. Specifically, the comparison / determination unit 53 receives a duplicated first feedback value and a second feedback value from the feedback processing unit 41, and also receives an operation command signal from the standard PLC 5, and generates an operation command value P1 (P1 is not shown in FIG. 3) corresponding to that signal. Note that this operation command signal is the same as the operation command signal received by the motor control unit 42.

[0039] Generally, the failure rate λ of a product (for example, an encoder) can be roughly divided into a safe failure rate λs and a dangerous failure rate λd, and the dangerous failure rate λd can be further divided into a detectable dangerous failure rate λdd and an undetectable dangerous failure rate λdu. The SFF is defined by the following equation 1. SFF = (λs+λdd) / (λs+λd) (Equation 1) In order to increase the SFF, the ratio of detectable failures among dangerous failures must be It is important to make it bigger.

[0040] Therefore, the comparison / determination unit 53 compares the operation command value P1 with the feedback value and determines whether the difference between them is within an allowable range. Assuming that the motor 2 is driven in accordance with the operation command value P1, the difference between the operation command value P1 and the first and second feedback values ​​represents a discrepancy between the movement of the motor 2, which is the object of detection by the first encoder 3, and the detection result of the first encoder 3. Therefore, by utilizing this difference, it is possible to detect the occurrence of a dangerous failure.

[0041] In this way, the comparison / determination unit 53 utilizes the difference between the operation command value P1 and the first and second feedback values, allowing the servo driver 4 to more precisely determine whether a failure has occurred in the operation of the first encoder 3 and the second encoder 7. As a result, compared to the servo driver of the first embodiment, which does not have the comparison / determination unit 53, the SFF of the input configuration of the servo driver 4 is improved, and the SIL value can be increased. Note that the first and second feedback values ​​compared with the operation command value P1 may be either one or both of the duplicated feedback values. Alternatively, as another reasonable method of failure determination, the rate of change of the operation command value P1 may be compared with the rate of change of the feedback value, and a failure determination of the first encoder 3 may be performed using the difference between the two. Alternatively, a failure determination of the first encoder 3 may be performed using the difference between the two change rates. Any combination of these failure determination methods may be employed.

[0042] In this way, the comparison and judgment unit 53 judges whether or not there is a fault in the first encoder 3 by using the feedback value and the operation command value P1. If the comparison and judgment unit 53 judges that a fault has occurred, the cutoff instruction unit 52 generates a cutoff signal, and the generated cutoff signal is sent to the cutoff unit 43. Upon receiving the cutoff signal, the cutoff unit 43 cuts off the transmission of the drive signal from the motor control unit 42 to the drive unit 44 as described above, thereby stopping the torque output by the motor 2. Note that such a control state by the safety control unit 50 (whether or not there is a fault) is notified to the safety PLC 6 in the form of a response to a monitoring command from the safety PLC 6.

[0043] Here, the shutoff process by the safety control unit 50 having the comparison / determination unit 53 and the shutoff instruction unit 52 will be described with reference to Fig. 6. The shutoff process shown in Fig. 6 is repeatedly executed by a calculation device (such as an MPU) forming the safety control unit 50, for example, at a control period in which a command value is generated. In step S200, the determination unit 51 acquires a first feedback value and a second feedback value from the feedback processing unit 41. In addition, in S201, the determination unit 51 receives an operation command signal from the standard PLC 5 and generates an operation command value P1 corresponding to the signal.

[0044] In step S202, the determination unit 51 performs a process of determining whether or not a malfunction has occurred based on the first feedback value and the second feedback value. In step 203, a malfunction determination is made for the first encoder 3 based on the difference between the generated operation command value P1 and the feedback value acquired from the feedback processing unit 41. This determination is made by the comparison / determination unit 53.

[0045] Step S204 is a branching process depending on the determination results of steps S202 and S202. If it is determined that a fault has occurred (S203, Yes), the process proceeds to step S205, where the cutoff instruction unit 52 generates a cutoff signal, and the generated cutoff signal is sent to the cutoff unit 43. This stops the torque output by the motor 2. If it is determined that no fault has occurred (S204, No), the cutoff instruction unit 52 does not generate a cutoff signal, and the process of FIG. 6 ends.

[0046] As described above, in the servo driver 4 of this embodiment, the comparison / determination unit 53 determines whether the first encoder 3 has failed using the operation command value. If a failure is determined, the shutoff unit 43 stops torque output by the motor 2. This improves the accuracy of the failure determination of the first encoder 3, thereby improving the SFF of the input configuration of the servo driver 4. For example, in the first embodiment described above, as shown in FIG. 2 , the hardware fault tolerance of the input configuration was 2, the SFF was between 60% and 90%, and the safety integrity level (SIL) was 3. In contrast, in the servo driver 4 of this embodiment, the comparison / determination unit 53 compares the first and second feedback values ​​with the operation command value to determine whether the first encoder 3 and the second encoder 7 have failed. This improves the accuracy of the failure determination of the first encoder 3 and the second encoder 7, improving the SFF of the input configuration of the servo driver 4 to a range between 90% and 99%, and therefore increasing the SIL of the input configuration from 3 to 4. That is, according to this embodiment, the safety performance of the servo driver 4 can be improved compared to the first embodiment.

[0047] <Third Example> 7 is a functional block diagram of a servo driver 4 according to a third embodiment. This embodiment differs from the second embodiment in that the pulse output circuit in the first encoder is not duplicated, and a non-duplicated feedback signal is output. Since the other configurations are the same, the same elements as those in the first embodiment are designated by the same reference numerals, and a repeated description will be omitted.

[0048] 8 is a block diagram of the safety functions in the three subsystems that make up the servo driver 4 according to the third embodiment, that is, the input configuration, the calculation configuration, and the output configuration when the servo driver 4 according to the third embodiment is considered as a single system. As shown in FIG. 8, the input configuration according to the third embodiment has a control function InS01 by the first encoder 3 and safety functions InS21 and InS22 by the second encoder 7, and in this case the hardware fault tolerance (HFT) is 1. Generally, it is not easy to increase the safe failure fraction (SFF) of an encoder from the standpoint of the volume (size) and price of the encoder. For this reason, the SFFs of the first encoder 3 and the second encoder 7 in this embodiment are in the range of 60% or more and less than 90%. For this reason, if the safety performance of the input configuration relies solely on the first encoder 3, the safety integrity level (SIL) of the input configuration would be 2, but in this embodiment, the comparison and judgment unit 53 judges whether or not there is a failure in the first encoder 3 using the operation command value, improving the accuracy of the failure judgment and improving the SFF of the input configuration of the servo driver 4, so that the safety integrity level (SIL) of the input configuration can be 3. As a result, even if a relatively inexpensive encoder that is not a safety encoder is adopted as the first encoder 3, the safety integrity level (SIL) can be 3. [Explanation of symbols]

[0049] 1. Network 2. Motor 3. First encoder 4. Servo driver 5...Standard PLC 6...Safety PLC 7 Second encoder 41 Feedback processing unit 42 Motor control unit 43.....breaker 44 Drive unit 50 Safety control section 51... Judgment Department 52 Shut-off instruction section 53... Comparison and Judgment Department

Claims

1. a first signal receiving unit that receives two first feedback signals independent of each other in response to an operation of the motor from a first encoder that detects an operation of the motor; a second signal receiving unit that receives, from a second encoder that detects the operation of a driven part driven by the motor, two second feedback signals that are independent of each other in accordance with the operation of the driven part; a motor control unit that generates a command value for the operation of the motor based on an operation command signal for driving the motor and at least one predetermined feedback signal of the first feedback signal and the second feedback signal so that the operation of the motor follows the operation command signal; a drive unit that supplies a drive current to the motor in response to the command value from the motor control unit; and a cutoff unit that cuts off transmission of a drive signal from the motor control unit to the drive unit in accordance with the command value; comparing the two first feedback signals to determine that a fault has occurred in the operation of the first encoder when there is a difference between the two first feedback signals that exceeds a threshold; comparing the two second feedback signals with each other, and determining that a malfunction has occurred in the operation of the second encoder if there is a difference between the two second feedback signals that exceeds a threshold; a safety control unit that, when determining that a failure has occurred in at least one of the operation of the first encoder or the operation of the second encoder, executes a process of cutting off the drive signal via the cutoff unit; A motor control device comprising:

2. The safety control unit further determines the occurrence of the failure based on a comparison result between at least one of a first feedback value calculated from the first feedback signal and a second feedback value calculated from the second feedback signal and an operation command value calculated from the operation command signal, and executes a process of cutting off the drive signal by the cutoff unit based on the determination result. The motor control device according to claim 1 .

3. The safety control unit determines whether or not to execute the shutoff process based on a difference between at least one of the first feedback value and the second feedback value and the operation command value, in the shutoff process. The motor control device according to claim 2 .

4. In the shutoff process, the safety control unit compares a rate of change of at least one of the first feedback value and the second feedback value with a rate of change of the operation command value, and determines whether or not to execute the shutoff process based on the comparison result. The motor control device according to claim 2 .

5. The safety control unit determines whether to execute the shutoff process based on a rate of change of a difference between a rate of change of at least one of the first feedback value and the second feedback value and a rate of change of the operation command value, in the shutoff process. The motor control device according to claim 2 .

Images