Motor safety control circuit, motor safety control method, and moving apparatus

Abstract

Embodiments of the present application provide a motor safety control circuit, a motor safety control method, and a moving apparatus. The motor safety control circuit comprises a power supply, a safety controller, a safety driver, and motors; each motor is provided with a motor brake; and the safety driver is provided with a torque off device. The safety driver is separately electrically connected to the power supply, the safety controller, the motors, and the motor brakes. The motors are configured to drive the moving apparatus to move. The moving apparatus comprises a differential wheel set; and two motors in the differential wheel set are respectively electrically connected to the torque off device. When the moving apparatus is in an abnormal state, the safety controller outputs an off signal to the torque off device; and after receiving the off signal, the torque off device controls the motors electrically connected to the torque off device to stop and starts the motor brakes. In this way, when the moving apparatus is in an abnormal state, a torque off device simultaneously controls braking of two motors in a differential wheel set, thereby safely and efficiently controlling the apparatus to stop.

Description

Motor safety control circuit, motor safety control method and mobile device

[0001] The present application claims priority to the Chinese patent application No. 202411106747.5, filed on August 12, 2024, and entitled "Motor safety control circuit, motor safety control method and mobile device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of motor motion control, and in particular to a motor safety control circuit, a motor safety control method and a mobile device. BACKGROUND

[0003] Motors are widely used in various industries as power sources, bringing great convenience to production and life. For mobile devices driven by motors, how to control the safe stop of the mobile device when the mobile device faces abnormal situations such as collision risks is a crucial problem. For example, in the case of obstacles invading the driving area of the mobile device, abnormal speed of the mobile device, etc., the mobile device needs to stop in time to avoid collision and damage to the device.

[0004] In order to improve the turning ability of the device, a differential wheel set can be configured in the mobile device, and two motors are used to drive one drive wheel, so that the mobile device can turn in various directions. For mobile devices equipped with a differential wheel set, how to safely and efficiently control the mobile device to stop in time when the mobile device faces abnormal situations such as collision risks is a problem that needs to be solved urgently. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a motor safety control circuit, a motor safety control method and a mobile device, so as to safely and efficiently control the mobile device to stop by synchronously controlling the two motors in the differential wheel set to stop and brake when the mobile device is in an abnormal situation. The specific technical solutions are as follows:

[0006] In a first aspect, the embodiments of the present application provide a motor safety control circuit, which comprises a power supply, a safety controller, a safety driver and a motor, the motor is provided with a motor brake, and the safety driver is provided with a torque off device, wherein:

[0007] The safety driver is electrically connected with the power supply, the safety controller, the motor and the motor brake respectively; the motor is used to drive the mobile device to move; the mobile device comprises a differential wheel set, two motors in the differential wheel set are electrically connected with the torque off respectively, and the motor brake electrically connected with each motor is electrically connected with the torque off respectively;

[0008] The safety controller is used to output an off signal to the torque off when the mobile device is in an abnormal situation.

[0009] The torque off is used to receive the off signal input by the safety controller, control the motor electrically connected with the torque off to stop, and open the motor brake.

[0010] In the second aspect, the embodiments of the present application provide a motor safety control method, which is applied to the torque off in the safety driver of the motor safety control circuit in any one of the first aspect, the motor is used to drive the mobile device to move; the mobile device comprises a differential wheel set, two motors in the differential wheel set are electrically connected with the torque off respectively, and the motor brake electrically connected with each motor is electrically connected with the torque off respectively; the method comprises:

[0011] Receiving the off signal input by the safety controller, controlling the motor electrically connected with the torque off to stop, and opening the motor brake, wherein the off signal is output by the safety controller in the motor safety control circuit to the torque off when the mobile device is in an abnormal situation.

[0012] In the third aspect, the embodiments of the present application provide a mobile device, which comprises the motor safety control circuit in any one of the first aspect and at least one differential wheel set.

[0013] In the fourth aspect, the embodiments of the present application further provide a computer program product comprising instructions, which, when executed on a computer, cause the computer to perform the motor safety control method in any one of the above.

[0014] The embodiments of the present application have the following beneficial effects:

[0015] In the scheme provided by the embodiment of the application, the motor safety control circuit comprises a power supply, a safety controller, a safety driver and a motor, the motor is provided with a motor brake, and the safety driver is provided with a torque shutdown device, wherein: the safety driver is electrically connected with the power supply, the safety controller, the motor and the motor brake; the motor is used for driving the mobile device to move; the mobile device comprises a differential wheel set, two motors in the differential wheel set are electrically connected with the torque shutdown device in the safety driver, and the motor brake electrically connected with each motor is electrically connected with the torque shutdown device; the safety controller is used for outputting a shutdown signal to the torque shutdown device when the mobile device is in an abnormal condition; and the torque shutdown device is used for receiving the shutdown signal input by the safety controller, controlling the motor electrically connected with the torque shutdown device to stop and opening the motor brake. Since the two motors in the differential wheel set of the mobile device and the motor brake electrically connected with each motor are electrically connected with the torque shutdown device, when the mobile device is in an abnormal condition, the two motors in the differential wheel set can be synchronously controlled to stop and the motor brake can be synchronously opened through the torque shutdown device, so that each motor is controlled to stop and the motor brake is controlled to stop through synchronous control, the driving wheel of the mobile device is controlled to stop moving, and then the mobile device is controlled to stop safely. Moreover, the torque shutdown device can quickly respond to control each motor to stop and the motor brake to open, so that the control efficiency of the mobile device is improved. Of course, any product or method implementing the application does not necessarily need to achieve all the advantages described above. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and serve to explain the principles of the application, and do not limit the application in any way.

[0017] FIG. 1 is a structural schematic diagram of a motor safety control circuit according to an embodiment of the application;

[0018] FIG. 2 is a structural schematic diagram of a torque shutdown device according to the embodiment shown in FIG. 1;

[0019] FIG. 3 is a structural schematic diagram of a motor safety control circuit according to the embodiment shown in FIG. 1;

[0020] FIG. 4(a) is a structural schematic diagram of another motor safety control circuit according to the embodiment shown in FIG. 1;

[0021] FIG. 4(b) is a flowchart of controlling a motor based on speed information according to the embodiment shown in FIG. 4(a);

[0022] FIG. 5 is a structural schematic diagram of a safety signal control motor comprising a plurality of safety drivers according to the embodiment shown in FIG. 1;

[0023] FIG. 6(a) is a structural schematic diagram of another motor safety control circuit according to the embodiment shown in FIG. 1;

[0024] Fig. 6(b) is a schematic diagram of a motor control flow based on the motor safety control circuit shown in Fig. 6(a);

[0025] Fig. 7(a) is a schematic diagram of a structure of a safety driver connected with a motor brake based on the embodiment shown in Fig. 1;

[0026] Fig. 7(b) is a schematic diagram of a motor safety control circuit based on the connection shown in Fig. 7(a);

[0027] Fig. 8(a) is a schematic diagram of a structure of a safety driver connected with a motor based on the embodiment shown in Fig. 1;

[0028] Fig. 8(b) is another schematic diagram of a motor safety control circuit based on the connection shown in Fig. 8(a);

[0029] Fig. 9 is a schematic diagram of a structure of a safety driver based on the embodiment shown in Fig. 1;

[0030] Fig. 10 is another schematic diagram of a structure of a safety driver based on the embodiment shown in Fig. 1;

[0031] Fig. 11 is a schematic diagram of a structure of a control circuit including a multi-module safety controller based on the embodiment shown in Fig. 1;

[0032] Fig. 12 is a schematic diagram of a structure of an input module based on the embodiment shown in Fig. 11;

[0033] Fig. 13 is a schematic diagram of a structure of a processing module based on the embodiment shown in Fig. 11;

[0034] Fig. 14 is another schematic diagram of a structure of a processing module based on the embodiment shown in Fig. 11;

[0035] Fig. 15 is a schematic diagram of a structure of an output module based on the embodiment shown in Fig. 11;

[0036] Fig. 16 is a schematic diagram of a specific structure of a motor safety control circuit based on the embodiment shown in Fig. 1;

[0037] Fig. 17 is a schematic diagram of an internal structure of a safety driver based on the embodiment shown in Fig. 16;

[0038] Correspondence between the names of components in FIGS. 1-17 and corresponding reference signs is as follows: 101 power supply, 102 safety controller, 103 safety driver, 104 motor, 105 motor brake, 106 torque off, 1031 motor winding drive, 1032 motor brake drive, 107 motor encoder, 108 safety input device, 109 high-side control switch, 110 low-side control switch, 111 first master controller, 112 first slave controller, 121 first input interface, 122 second input interface, 123 third input interface, 1021 input module, 1022 processing module, 1023 output module, 113 second master controller, 114 second slave controller, 124 fourth input interface, 131 first output interface, 115 third master controller, 116 third slave controller, 125 fifth input interface, 132 second output interface, 126 sixth input interface, 127 seventh input interface, 117 fourth master controller, 118 fourth slave controller, 128 eighth input interface, 133 third output interface, 134 fourth output interface. DETAILED DESCRIPTION

[0039] To make the objectives, technical solutions, and advantages of the present application clearer, further detailed descriptions will be given below with reference to the drawings and examples. Obviously, the described examples are only some of the examples of the present application, but not all. Based on the examples in the present application, all other examples obtained by those skilled in the art belong to the scope of protection of the present application.

[0040] To safely and efficiently control a mobile device to stop in time when the mobile device faces an abnormal situation such as a collision risk, the present application provides a motor safety control circuit, a motor safety control method, and a mobile device. First, a motor safety control circuit provided by the present application is introduced.

[0041] The motor safety control circuit provided by the present application can be applied to a mobile device with a differential wheel set, for example, a movable intelligent robot with a differential wheel set, a mobile handling device with a differential wheel set, and the like, which are not specifically limited here. For the sake of description, the following is referred to as a mobile device.

[0042] Each differential wheel set includes two motors and a drive wheel set driven to move by the two motors in the differential wheel set. That is, the drive wheel set can include a first drive wheel and a second drive wheel, the first drive wheel is driven by one motor in the differential wheel set, and the second drive wheel is driven by the other motor in the differential wheel set, so as to realize steering and flexible movement of the mobile device by two independently driven drive wheels, while solving the problem of different driving distances of the two drive wheels when the mobile device turns.

[0043] As shown in Figure 1, a motor safety control circuit includes a power supply 101, a safety controller 102, a safety driver 103 and a motor 104, the motor 104 is provided with a motor brake 105, the safety driver 103 is provided with a torque off 106, wherein:

[0044] The safety driver 103 is electrically connected with the power supply 101, the safety controller 102, the motor 104 and the motor brake 105 respectively; the motor 104 is used to drive the mobile device to move; the mobile device includes a differential wheel set, two motors 104 in the differential wheel set are electrically connected with the torque off 106 respectively, and the motor brake 105 electrically connected with each motor 104 is electrically connected with the torque off 106 respectively;

[0045] The safety controller 102 is used to output a shutdown signal to the torque off 106 when the mobile device is in an abnormal situation;

[0046] The torque off 106 is used to receive the shutdown signal input by the safety controller 102, control the motor 104 electrically connected with the torque off 106 to stop, and open the motor brake 105.

[0047] In the scheme provided by the embodiment of the application, the motor safety control circuit includes a power supply, a safety controller, a safety driver and a motor, the motor is provided with a motor brake, the safety driver is provided with a torque off, wherein: the safety driver is electrically connected with the power supply, the safety controller, the motor and the motor brake respectively; the motor is used to drive the mobile device to move; the mobile device includes a differential wheel set, two motors in the differential wheel set are electrically connected with the torque off in the safety driver respectively, and the motor brake electrically connected with each motor is electrically connected with the torque off respectively; the safety controller is used to output a shutdown signal to the torque off when the mobile device is in an abnormal situation; the torque off is used to receive the shutdown signal input by the safety controller, control the motor electrically connected with the torque off to stop and open the motor brake. Since the two motors in the differential wheel set of the mobile device and the motor brake electrically connected with each motor are electrically connected with the torque off, when the mobile device is in an abnormal situation, the two motors in the differential wheel set can be controlled to stop and the motor brake can be opened synchronously through the torque off, so that each motor is controlled to stop and the motor brake is controlled to open synchronously, the driving wheel of the mobile device is controlled to stop moving, and then the mobile device is controlled to stop safely. Moreover, the torque off can quickly respond to control each motor to stop and open the motor brake, so that the control efficiency of the mobile device is improved.

[0048] The mobile device is driven to move by the motor 104, which is driven and controlled by the safety driver 103. When the mobile device is in normal condition, the motor 104 needs to keep normal movement to ensure the normal work of the mobile device. In this case, the electrical connection path between the power supply 101 and the safety driver 103 is closed, so that the safety driver 103 can convert the electrical energy provided by the power supply 101 into electrical energy for driving the motor 104 to move, and provide electrical energy for the motor 104 through the electrical connection between the safety driver 103 and the motor 104, and then the safety driver 103 controls the movement of the motor 104, so that the mobile device moves with the movement of the motor 104.

[0049] The function of the motor brake 105 is to lock the position of the motor 104 when the motor 104 stops, so that the motor 104 does not move due to external force. Therefore, when the motor 104 is in normal working condition, the motor brake 105 does not need to work, that is, the motor brake 105 is in closed state. Therefore, when the mobile device is in normal condition, the safety driver 103 can close the motor brake 105 through the electrical connection between the safety driver 103 and the motor brake 105.

[0050] In which, closing the motor brake 105 makes the motor brake 105 in closed state, that is, the motor rotor is in released state or unlocked state, the motor brake 105 is separated from the motor rotor, the fixation of the motor rotor is released, the motor rotor can rotate freely, and the mobile device can start running normally. Correspondingly, opening the motor brake 105 makes the motor brake 105 in open state, that is, the motor rotor is in braking state or locked state, the motor brake 105 fixes the motor rotor, and prevents the motor rotor from rotating under the action of external force, so that the mobile device stops running.

[0051] For example, when the motor 104 is in normal working condition, the safety driver 103 can provide electrical energy for the motor brake 105 through the electrical connection between the safety driver 103 and the motor brake 105, and control the motor brake 105 to be closed.

[0052] The safe torque off (STO) function is a function of cutting off the power supply circuit directly connected to the power device to prohibit the circuit to provide current for the motor 104 and the motor brake 105. Because there is no current, the motor 104 cannot generate torque, so that the motor stops. Compared with the way of directly disconnecting the power supply, the way of disconnecting the power supply by the safe torque off function can avoid the damage of the safety driver. Therefore, in order to improve the safety of motor braking, the safe torque off function can be added in the safety driver. And the safe torque off function is realized by the processor of the safety driver and the switch in the motor power supply circuit, which is located between the power supply and the motor. By cutting off the switch, the power supply circuit of the motor can be disconnected.

[0053] The processor of the safety driver can be connected with the switch for controlling the on-off of the power supply circuit, and the combination of the processor of the safety driver and the switch for controlling the on-off of the power supply circuit can be used as a torque shutdown device for realizing the safety torque off function inside the safety driver. As shown in FIG. 2, the safety driver controls two motors in one-to-two mode. The safety driver converts the power supply into a power supply for the motor 1, the motor brake 1, the motor 2 and the motor brake 2, and a switch for controlling the on-off of the power supply circuit is arranged in the power supply circuit, and the switch and the processor of the safety driver constitute a torque shutdown device, wherein the processor receives a shutdown signal and controls the switch to be turned off, so as to realize the control process of shutting off the power supply of the motor and the motor brake through the torque shutdown device.

[0054] In order to receive the shutdown signal for indicating that the torque shutdown device shuts off the power supply, which is sent by the safety processor when the mobile device is in an abnormal condition, the safety driver can be provided with an interface for receiving the shutdown signal, which is referred to as an STO interface.

[0055] When the mobile device is in a normal condition, the torque shutdown device 106 is not required to work, i.e., the switch in the torque shutdown device 106 is in a closed state, so as to keep the motor 104 working normally. Therefore, when the mobile device is in a normal condition, the safety controller 102 does not need to output a shutdown signal to the torque shutdown device 106, and the switch in the torque shutdown device 106 is in a closed state.

[0056] When the mobile device is in an abnormal condition, such as an obstacle intruding into the driving area of the mobile device, the speed information of the mobile device being abnormal, an emergency stop button for controlling the emergency stop of the mobile device being triggered, etc., the mobile device needs to stop moving to avoid collision or damage, and in this case, the motor 104 for driving the mobile device to move needs to be braked to control the mobile device to stop.

[0057] Since the electric energy relied on by the motor 104 to move is provided by the power supply 101 to the safety driver 103 first, and then converted by the safety driver 103 and provided to the motor 104. Based on this, when the safety controller 102 detects that the mobile device is in an abnormal condition, the safety controller 102 can perform signaling interaction with the safety driver 103 to make the safety driver 103 control the motor 104 to brake.

[0058] The manner of detecting whether the mobile device is in an abnormal situation can select an existing detection algorithm for detection according to a specific type of the abnormal situation set in advance, and is not specifically limited herein. For example, for the abnormal situation of an obstacle invading the driving area of the mobile device, the existing path planning algorithm and obstacle detection algorithm can be combined to determine whether the obstacle invades the driving area of the mobile device, to determine whether the mobile device is in an abnormal situation. For the abnormal situation of the speed of the mobile device, the moving speed of the mobile device can be monitored, and whether the mobile device is in an abnormal situation is determined by judging whether the moving speed exceeds a preset threshold, and the like.

[0059] When it is necessary to control the motor 104 to stop, the motor 104 can be directly powered off or sent a motor winding closing signal by the safety driver 103 to control the motor 104 to stop. However, the direct power-off manner can cause damage to the device. Therefore, in order to improve the efficiency and safety of motor braking, the torque shutdown device 106 in the safety driver 103 can be used to open a power supply circuit directly connected to the power device, to prohibit the power supply circuit from sending current to the motor 104, to shut down the torque of the motor 104, to achieve braking of the motor 104, and because the motor brake 105 is also connected to the power supply circuit, when the power supply circuit is opened, the power supply of the motor brake 105 is also cut off, and the motor brake 105 is started. The power supply of the motor 104 and the motor brake 105 is a power supply inside the safety driver 103, which is mainly used to convert the power of the power supply 101 and supply power to the motor 104 and the motor brake 105.

[0060] In addition, because the mobile device is configured with a differential wheel set, one driving wheel in the differential wheel set is driven by one motor 104, and when the mobile device needs to be controlled to stop, two motors 104 need to be braked at the same time to control the two driving wheels to stop. If the two motors cannot be controlled to brake at the same time, the driving wheels will continue to move under the driving of the unbraked motor 104, causing the mobile device to continue to move and be damaged. Therefore, in order to control each motor 104 of each differential wheel set, each motor 104 in the differential wheel set can be electrically connected to the torque shutdown device 106 in the safety driver 103.

[0061] In addition, in order to avoid the motor 104 from moving again under the action of external force after stopping, the motor brake 105 electrically connected to each motor 104 can also be electrically connected to the torque shutdown device 106. The torque shutdown device 106 is located in the common part of the power supply circuit of the motor and the motor brake, and when the torque shutdown device disconnects the power supply circuit, the power supply of the motor 104 and the motor brake 105 can be cut off at the same time. The motor will stop under the condition of power-off, and the motor brake will automatically open under the condition of power-off. Therefore, the torque shutdown device can control each motor stopped and the motor brake opened by shutting down the power supply circuit at the same time.

[0062] In an implementation, the motor brake 105 shares the power supply with the motor 104, and the torque off 106 can disconnect the common part of the power supply circuit of the motor brake 105 and the motor 104, thereby shutting off the power supply of the motor 104 and the motor brake 105 electrically connected to the motor 104.

[0063] In this way, when the mobile device is in an abnormal situation, the safety controller 102 can output a shutdown signal to the torque off 106 in the safety driver 103, the torque off 106 can receive the shutdown signal input by the safety controller 102, and then the torque off 106 opens the power supply circuit connected to the power device, shuts off the power supply of the motor 104 electrically connected to the torque off 106, and the power supply of the motor brake 105 electrically connected to the motor, thereby controlling the motor 104 electrically connected to the torque off 106 to stop and open the motor brake 105.

[0064] In an implementation, the safety driver 103 further includes a motor winding drive 1031 and a motor brake drive 1032, the torque off 106 can receive the shutdown signal input by the safety controller 102, and control the motor 104 electrically connected to the torque off 106 to stop and open the motor brake 105, and in order to avoid the mobile device being unable to brake due to the failure of the torque off 106 to act, the safety driver 103 can send a winding closing signal to the motor winding drive 1031 of each motor 104 and a brake drive signal to the motor brake drive 1032 when receiving the shutdown signal, so that the motor winding drive 1031 closes the motor winding, the motor brake drive 1032 opens the motor brake 105, and controls the motor 104 to stop and lock.

[0065] In the scheme provided by the embodiments of the present application, since the two motors of the differential wheel set and the motor brake electrically connected to each motor in the mobile device are electrically connected to the torque off, in this way, when the mobile device is in an abnormal situation, the two motors of the differential wheel set can be synchronously controlled to stop and the motor brake can be synchronously opened by the torque off, thereby controlling the driving wheels of the mobile device to stop moving by synchronously controlling each motor to stop and brake, and further controlling the mobile device to stop safely. Moreover, the torque off can quickly respond to control each motor to stop and open the motor brake, thereby improving the control efficiency of the mobile device.

[0066] As an implementation of the embodiments of the present application, the safety driver 103 includes a motor winding drive 1031 and a motor brake drive 1032, the motor winding drive 1031 is electrically connected to the motor 104, and the motor brake drive 1032 is electrically connected to the motor brake 105;

[0067] The torque off 106 is configured to turn off the power supply of the motor 104 and the motor brake 105 electrically connected to the torque off 106 when receiving the off signal sent by the safety controller 102.

[0068] The safety driver 103 is configured to send a winding off signal to the motor winding driver 1031 to make the motor winding driver 1031 turn off the motor winding and send a brake driving signal to the motor brake driver 1032 to make the motor brake driver 1032 open the motor brake when receiving the off signal.

[0069] As shown in FIG. 3, the safety driver 103 is electrically connected to the power supply 101 and the safety controller 102, and the safety driver 103 includes the torque off 106, two motor winding drivers 1031, i.e., motor winding driver A and motor winding driver B, and two motor brake drivers 1032, i.e., motor brake driver A and motor brake driver B. The safety driver 103 is electrically connected to the two motors 104 to achieve one-to-two control. The torque off 106 is electrically connected to the motor 1, the motor brake 1, the motor 2, and the motor brake 2. The motor brake driver A is electrically connected to the motor brake 1 electrically connected to the motor 1, and the motor winding driver A is electrically connected to the motor 1. The motor brake driver B is electrically connected to the motor brake 2 electrically connected to the motor 2, and the motor winding driver B is electrically connected to the motor 2. The motor winding driver 1031 controls the start and stop of the motor 104 by controlling the motor winding, and the motor brake driver 1032 controls the opening and closing of the motor brake 105.

[0070] Therefore, when the mobile device is in an abnormal situation, the safety controller 102 can send an off signal to the torque off 106. When receiving the off signal sent by the safety controller 102, the torque off 106 can turn off the power supply of the motor 104 electrically connected to the torque off 106, so that the motor 104 electrically connected to the torque off 106 cannot generate torque, and turn off the power supply of the motor brake 105 electrically connected to the motor 104, so that the motor brake 105 is opened. The power supply of the motor 104 and the motor brake 105 is the power supply inside the safety driver 103.

[0071] In order to achieve more stable motor braking effect and avoid the failure of torque off response to brake control the motor 104, when receiving the off signal sent by the safety controller 102, the safety driver 103 can also send a winding off signal to the motor winding driver 1031 to make the motor winding driver 1031 turn off the motor winding, and send a brake driving signal to the motor brake driver 1032 to make the motor brake driver 1032 open the motor brake 105, so as to further brake and brake the motor 104.

[0072] In the scheme provided by the embodiments of the present application, the safety driver can include motor winding driving and motor brake driving. In this way, when the mobile device is in an abnormal situation, the torque off device can disconnect the power supply of the motor and the motor brake connected by the torque off device when receiving the off signal sent by the safety controller, control the motor brake and brake, and in order to improve the braking accuracy, the safety driver can also send a winding off signal to the motor winding driving and a brake driving signal to the motor brake driving when receiving the off signal, turn off the motor winding driving and turn on the motor brake driving, so as to control the motor to stop and turn on the motor brake, so that the motor brakes and brakes to lock, and then control the mobile device to stop.

[0073] As an embodiment of the present application, the off signal is I / O data.

[0074] The data exchanged between the safety controller 102 and the safety driver 103 can include communication data and I / O (Input / Output) data. The I / O data is transmitted through the connection channel (interface) with IO-Link between the safety controller 102 and the safety driver 103, and IO-Link is a point-to-point, serial digital interface protocol, rather than a bus protocol or other communication protocol. When the safety controller 102 and the safety driver 103 exchange I / O data, the receiving I / O data end does not need to use the communication protocol to perform data security check on the received I / O data, so that the transmission speed of the I / O data between the safety controller 102 and the safety driver 103 is faster.

[0075] In an embodiment, when the mobile device is in a normal situation, the control instructions exchanged between the safety controller 102 and the safety driver 103 are communication data, and when the mobile device is in an abnormal situation, the off signal exchanged between the safety controller 102 and the safety driver 103 is I / O data.

[0076] When the mobile device is in an abnormal situation, it is desired to control the mobile device to stop immediately to avoid damage to the mobile device. Since the stop of the mobile device is realized by controlling the motor brake, and the motor brake and the opening of the motor brake 105 are realized by the torque off device 106, in order to improve the control speed, the off signal sent by the safety controller 102 to the torque off device 106 is I / O data.

[0077] When detecting that the mobile device is in an abnormal situation, the safety controller 102 can send a shutdown signal to the safety driver 103 through the STO interface connected with the safety driver 103, since the shutdown signal is I / O data, the I / O data does not need to be checked by using various communication protocols, the shutdown signal can be quickly transmitted to the torque shutdown device 106, and then the torque shutdown device 106 can also quickly respond to the shutdown signal sent by the safety controller 102 to control the motor 104 electrically connected to the torque shutdown device 106 to stop and open the motor brake 105, and then control the mobile device to stop. In this way, compared with the mode that the safety controller 102 sends a stop instruction to the safety driver 103 through a communication loop, the I / O shutdown signal is directly sent to the torque shutdown device 106, the whole process from detecting that the mobile device is in an abnormal situation by the safety controller 102 to stopping the mobile device takes a short time, and the response speed of the torque shutdown device 106 is fast, and the control effect of stopping the mobile device to avoid obstacles in time can be achieved.

[0078] In the scheme provided by the embodiment of the application, the shutdown signal sent by the safety controller to the torque shutdown device is I / O data, after receiving the shutdown signal, the torque shutdown device does not need to perform communication data checking, so that the signal sending and signal responding process is shortened, after the safety controller sends the shutdown signal, the torque shutdown device can respond to the shutdown signal in time to control the motor to stop and open the motor brake, so that the motor braking efficiency is improved, and the control effect of stopping the mobile device in time is achieved.

[0079] As an implementation manner of the embodiment of the application, the motor 104 is further provided with a motor encoder 107, and the motor encoder 107 is electrically connected with the safety driver 103.

[0080] The motor encoder 107 is configured to detect speed information of the motor 104 and send the speed information to the safety driver 103.

[0081] The safety driver 103 is specifically configured to receive the speed information sent by the motor encoder 107, and when determining that the mobile device is in an abnormal situation based on the speed information, output a shutdown signal to the torque shutdown device 106, so that the torque shutdown device 106 controls the motor 104 electrically connected to the torque shutdown device 106 to stop and open the motor brake 105 of each motor 104.

[0082] The safety driver 103 is further configured to send the speed information to the safety controller 102.

[0083] The safety controller 102 is further configured to receive the speed information, and when determining that the mobile device is in an abnormal situation based on the speed information, output a shutdown signal to the torque shutdown device 106.

[0084] The torque off 106 is also configured to receive the off signal sent by the safety controller 102, determine whether the motor 104 electrically connected to the torque off 106 has stopped and open the motor brake 105; if not, control the motor 104 electrically connected to the torque off 106 to stop and open the motor brake 105.

[0085] In some cases, there may be no obstacles around the mobile device, but the mobile device may still be at risk of collision or damage, for example, the mobile device is out of control or the moving speed of the mobile device is set incorrectly, which causes the mobile device to move at too fast a speed and there is a risk of device damage. For another example, the moving wheel of the mobile device is entangled by external objects, which causes the moving wheel to move at too slow a speed.

[0086] Therefore, in addition to being provided with the motor brake 105, the motor 104 of the mobile device can also be provided with the motor encoder 107 electrically connected to the safety driver 103. Since the mobile device configured with the differential wheel set, for example, the omnidirectional robot, etc., the steering wheel size is large, and it is difficult to realize low height application, therefore, the current way of connecting the motor encoder 107 to the safety controller 102 requires a large signal loop, which is not suitable for speed monitoring of the mobile device configured with the differential wheel set. Considering the device structure, speed monitoring level requirement and safety control efficiency requirement, the motor encoder 107 is connected to the safety driver 103, so as to realize the small loop differential motor signal monitoring mode and meet the speed monitoring level requirement of PLd and above.

[0087] The motor encoder 107 can be configured to detect the speed information of the motor 104 and send the speed information to the safety driver 103 through the electrical connection between the motor encoder 107 and the safety driver 103.

[0088] The safety driver 103 can receive the speed information sent by the motor encoder 107 and determine whether the mobile device is in an abnormal situation based on the speed information.

[0089] In an embodiment, after receiving the speed information, the safety driver 103 can determine whether the speed information is within a preset speed range. If yes, it is determined that the current speed of the motor 104 is normal, and it can be further determined that the mobile device is not in an abnormal situation. If not, it is determined that the current speed of the motor 104 is abnormal, and it can be further determined that the mobile device is in an abnormal situation.

[0090] In another embodiment, after receiving the speed information, the safety driver 103 can determine the difference between the speed information and the ideal speed corresponding to the mobile device at present, determine whether the difference is less than a preset threshold, if yes, it is determined that the current speed of the motor 104 basically conforms to the ideal speed, and it is further determined that the mobile device is not in an abnormal situation, if no, it is determined that the difference between the current speed of the motor 104 and the ideal speed is too large, and it is further determined that the mobile device is in an abnormal situation.

[0091] In yet another embodiment, the number of motor encoders 107 can be multiple, and after receiving the speed information sent by each motor encoder 107, the safety driver 103 can determine whether each speed information is the same, if yes, it can further determine whether the mobile device is in an abnormal situation according to the received speed information, if no, it can determine that the mobile device is in an abnormal situation. Wherein, the number of motor encoders 107 of each motor 104 can be set according to actual needs, for example, 2, 3, etc., which is not limited here.

[0092] When the safety driver 103 determines that the mobile device is in an abnormal situation based on the speed information, it can output a shutdown signal to the torque shutdown 106 to make the torque shutdown 106 shut down the power supply of the motor 104 and the motor brake 105 connected to the torque shutdown 106, so as to control the motor 104 to stop and open the motor brake 105.

[0093] At the same time, in order to ensure the success rate of controlling the motor 104 to stop and brake, after receiving the speed information sent by the motor encoder 107, the safety driver 103 can not only determine whether the mobile device is in an abnormal situation based on the speed information by itself, and control the motor 104 to stop and open the motor brake 105 when the mobile device is in an abnormal situation, but also send the speed information to the safety controller 102, so that the safety controller 102 can determine whether the mobile device is in an abnormal situation based on the speed information after receiving the speed information, and control the motor 104 to stop and brake by sending a shutdown signal to each torque shutdown 106 when it is determined that the mobile device is in an abnormal situation.

[0094] In the normal situation of the mobile device, the safety controller 102 and the safety driver 103 communicate data through a communication loop, for example, the drive information, the speed information, etc. are transmitted through the communication loop, and the communication signals transmitted through the communication loop are communication data. After receiving the communication data, the safety controller 102 and the safety driver 103 need to check the data security of the communication data by using a communication protocol, for example, CAN (Controller Area Network), RS485, EtherCAT (Ethernet for Control Automation Technology), etc.

[0095] In an embodiment, the safety controller 102 and the safety driver 103 can communicate data through two communication loops. In this way, the safety controller 102 and the safety driver 103 can check whether the communication data between the two communication loops are the same, so as to achieve the purpose of data checking. Thus, the data checking process is simplified through the mutual checking between the two communication data.

[0096] In the abnormal situation of the mobile device, in order to improve the control efficiency of the mobile device, the safety controller 102 and the safety driver 103 communicate I / O data through a transmission loop. Since the I / O data does not need to be checked, the data transmission efficiency is improved, and thus the motor control efficiency is improved, i.e., the control efficiency of the mobile device is improved.

[0097] In this case, the safety driver 103 can send the speed information to the safety controller 102 through the communication loop. In this way, the safety controller 102 can receive the speed information sent by the safety driver 103, and determine whether the mobile device is in the abnormal situation based on the speed information. If the mobile device is in the abnormal situation, the safety controller 102 can output a shutdown signal to the torque shutdown device 106. The torque shutdown device 106 can receive the shutdown signal sent by the safety controller 102, and then determine whether the motor 104 electrically connected to the torque shutdown device 106 has stopped and the motor brake 105 has been opened. If the motor 104 electrically connected to the torque shutdown device 106 has stopped and the motor brake 105 has been opened, the torque shutdown device 106 does not need to respond to the above-mentioned shutdown signal. If the motor 104 electrically connected to the torque shutdown device 106 has not stopped and the motor brake 105 has not been opened, the torque shutdown device 106 can respond to the above-mentioned shutdown signal to shut down the power supply of the motor 104 and the motor brake 105, so as to control the motor 104 to stop and brake. In this way, through the double insurance control mode, the motor control accuracy is improved.

[0098] The manner in which the safety controller 102 determines whether the mobile device is in an abnormal condition based on the speed information can refer to the manner in which the safety driver 103 determines whether the mobile device is in an abnormal condition based on the speed information, which will not be described herein again.

[0099] As shown in FIG. 4(a), the safety driver is electrically connected with the power supply 101. There is a communication loop for communication of data and a transmission loop for I / O data between the safety controller 102 and the safety driver 103. The differential wheel set includes two motors 104, i.e., motor 1 and motor 2, each of which is provided with a motor brake 105 and a motor encoder 107. The motor 1, the motor 2, the motor brake 1, and the motor brake 2 are electrically connected with the torque off 106 of the safety driver 103. The motor encoder 1 and the motor encoder 2 are electrically connected with the safety driver 103 respectively and feed back the speed information of the motor to the safety driver 103 respectively. The safety driver 103 receives the encoder input 1 of the motor encoder 1 and the encoder input 2 of the motor encoder 2 and determines whether the mobile device is in an abnormal condition based on the speed information carried by the encoder input 1 and the encoder input 2 respectively. Moreover, the safety driver 103 sends the speed information carried by the encoder input 1 and the encoder input 2 to the safety controller 102 through the communication loop.

[0100] When the safety driver 103 determines that the mobile device is in an abnormal condition based on the speed information of the motor received by the encoder input 1 and the encoder input 2, the safety driver 103 turns off the power supply of the motor 1, the motor brake 1, the motor 2, and the motor brake 2 through the torque off 106, synchronously controls the motor 1 and the motor 2 to stop and opens the motor brake 105.

[0101] When the safety controller 102 determines that the mobile device is in an abnormal condition, the safety controller 102 sends a turn-off signal to the STO interface 1 of the torque off through the OUT1 interface and sends a turn-off signal to the STO interface 2 through the OUT2 interface respectively. The STO interface 1 and the STO interface 2 transmit the received turn-off signal to the torque off 106, the torque off 106 determines whether the motor electrically connected therewith has stopped and opens the motor brake, and turns off the power supply of the motor and the motor brake electrically connected therewith when the motor 104 electrically connected therewith has not stopped and the motor brake has not been opened, so that the motor stops and the motor brake is opened.

[0102] In an embodiment, when the motor encoder 107 detects an abnormal motor speed, the motor encoder 107 sends abnormal speed information to the safety driver 103, the safety driver 103 receives the abnormal speed information sent by the motor encoder 107, sends the abnormal speed information to the safety controller 102, and turns off the power supply of the motor and the motor brake connected to the torque off switch 106 through the switch of the torque off switch 106, so that the motor stops and the motor brake of each motor is opened. The safety controller 102 outputs a shutdown signal to the torque off switch 106 when receiving the abnormal speed information. The torque off switch 106 determines whether the motor connected to the torque off switch 106 has stopped and the motor brake has been opened when receiving the shutdown signal sent by the safety controller 102; if not, the torque off switch 106 controls the motor connected to the torque off switch 106 to stop and open the motor brake.

[0103] As shown in FIG. 4(b), when the motor encoder detects an abnormal motor speed, the motor encoder sends abnormal speed information to the safety driver, the safety driver receives the abnormal speed information, turns off the power supply of the motor and the motor brake through the torque off switch, closes the motor winding through the motor winding drive, and opens the motor brake through the motor brake drive, so as to stop the motor and open the brake; at the same time, the safety driver sends the abnormal speed information to the safety controller, and the safety controller outputs a shutdown signal to each torque off switch when receiving the abnormal speed information, so that the torque off switch closes the power supply of the motor and the motor brake.

[0104] In the scheme provided by the embodiments of the present application, the motor safety control circuit can further include a motor encoder. The motor encoder can detect speed information of the motor and send the speed information to the safety driver through the electrical connection between the motor encoder and the safety driver, so that when the safety driver determines that the mobile device is in an abnormal situation based on the speed information, the safety driver can control the motor to stop and engage the brake through the torque shutdown device and the motor brake, so that the mobile device is safely stopped. In addition, since the motor encoder is directly connected to the safety driver, and the response speed of the safety driver is fast, when the speed information indicates that the mobile device is in an abnormal situation, the safety driver can immediately brake and engage the brake of the motor, thereby improving the control efficiency of the mobile device. Further, in order to avoid the situation that the safety driver misjudges that the mobile device is in an abnormal situation and does not immediately brake the motor, after receiving the speed information, the safety driver can determine whether the mobile device is in an abnormal situation based on the speed information, and when the mobile device is in an abnormal situation, control the motor to stop and engage the brake. In addition, the safety driver can send the speed information to the safety controller, so that the safety controller can also determine whether the mobile device is in an abnormal situation based on the speed information, and when the mobile device is in an abnormal situation, send a shutdown signal to the torque shutdown device to control the motor to stop through the torque shutdown device, so that when the safety driver misjudges, the motor can still be controlled to stop and engage the brake, thereby improving the success rate of controlling the motor to stop and engage the brake through the double insurance control mode.

[0105] As an embodiment of the embodiments of the present application, the mobile device includes at least one differential wheel set, and the number of safety drivers 103 is the same as the number of differential wheel sets. The two motors 104 in each differential wheel set are electrically connected to one safety driver 103.

[0106] The mobile device can include at least one differential wheel set. In order to control each differential wheel set respectively, the same number of safety drivers 103 as the number of differential wheel sets of the mobile device can be set according to the number of differential wheel sets of the mobile device, that is, the number of safety drivers 103 in the motor safety control circuit is the same as the number of differential wheel sets of the mobile device. Further, each safety driver 103 can control two motors 104 in one differential wheel set, that is, each safety driver 103 can control two motors 104. The two motors 104 in each differential wheel set are electrically connected to the torque shutdown device 106, and the motor brake 105 electrically connected to each motor 104 is electrically connected to the torque shutdown device 106, so that the torque shutdown device 106 can synchronously control the two motors 104 in one differential wheel set.

[0107] Correspondingly, as shown in FIG. 5, the mobile device includes two differential wheel sets, and the motor safety control circuit of the mobile device includes two safety drivers 103. Each safety driver 103 is electrically connected with the power supply 101 and the safety controller 102, and each safety driver 103 is electrically connected with two motors 104 of one differential wheel set in a one-to-two manner. Each safety driver 103 can include a torque off 106, and the motor 104 electrically connected with the safety driver 103 and the motor brake 105 of the motor 104 are electrically connected with the torque off 106, that is, the torque off 1 of the safety driver 1 is electrically connected with the motor 1, the motor brake 1, the motor 2 and the motor brake 2 respectively; the torque off 2 of the safety driver 2 is electrically connected with the motor 3, the motor brake 3, the motor 4 and the motor brake 4 respectively.

[0108] The safety processor 102 can communicate with each safety driver 103, and when the mobile device is in an abnormal situation, the safety processor 102 can issue a shutdown signal to the STO interface 1 of each safety driver 103 through the OUT1 interface and issue a shutdown signal to the STO interface 2 of each safety driver through the OUT2 interface, and the STO interface 1 and the STO interface 2 send the received shutdown signal to the torque off 106, and the torque off 106 disconnects the power supply of the motor 104 and the motor brake 105 when receiving the shutdown signal. By synchronously controlling the torque off 106 in the two safety drivers 103 to shut down the power supply of the motor 104 and the motor brake 105 electrically connected therewith, the two drive wheels of the mobile device are stopped synchronously, and the mobile device is stopped.

[0109] In an embodiment, the mobile device includes at least one differential wheel set, the motor safety control circuit includes one safety driver 103, and the number of torque offs 106 in the safety driver 103 is the same as the total number of motors 104 in all differential wheel sets of the mobile device, and each motor 104 in each differential wheel set and the motor brake 105 of the motor 104 are electrically connected with one torque off 106 in the safety driver 103. That is, each torque off 106 in the safety driver 103 is electrically connected with one motor 104 and the motor brake 105 of the motor 104, and controls the motor 104 and the motor brake 105 electrically connected with the torque off 106.

[0110] In the scheme provided by the embodiments of the present application, the same data safety driver can be set in the motor safety control circuit according to the number of differential wheel sets of the mobile device, so that each safety driver controls one differential wheel set, and the motor and the motor brake in each differential wheel set are connected to the torque off of the safety driver, so that two motors in one differential wheel set can be synchronously controlled by one safety driver, and each differential wheel set of the mobile device can be synchronously controlled by each safety driver, thereby improving the control efficiency of the mobile device.

[0111] As an embodiment of the present application, the motor safety control circuit further comprises a safety input device 108, which is electrically connected to the safety controller 102.

[0112] The safety input device 108 is configured to send a safety signal to the safety controller 102 when detecting an obstacle around the mobile device or obtaining an externally triggered stop instruction.

[0113] The safety controller 102 is specifically configured to receive the safety signal sent by the safety input device 108, and output a shutdown signal to each torque off when determining that the mobile device is in an abnormal situation based on the safety signal.

[0114] The safety input device 108 mainly includes non-contact type and contact type, wherein the non-contact type safety input device can include laser radar, infrared detector, etc., and such safety input device 108 can be arranged on the mobile device, so as to detect the environment around the mobile device and determine whether there is an obstacle around the mobile device, for example, a certain range of area around the mobile device can be set as the safety area of the mobile device, and then the safety input device can detect whether a person or object intrudes into the safety area in real time, if so, it is determined that there is an obstacle around the mobile device, and then a safety signal can be sent to the safety controller 102.

[0115] The contact type safety input device 108 can include an emergency stop button, a reset button, a manual-automatic button, etc., and such safety input device can be arranged on the mobile device or not, and can also be a virtual button displayed on other electronic devices, when the safety input device 108 is externally triggered, for example, a person manually presses the emergency stop button, it is determined that an externally triggered stop instruction is obtained, and then a safety signal can be sent to the safety controller 102.

[0116] As shown in FIG. 6(a), the safety input device 108 is electrically connected with the safety controller 102, and the safety driver 103 is electrically connected with the power supply 101. The safety controller 102 can receive the safety signal sent by the safety input device 108, and determine whether the mobile device is in an abnormal situation based on the safety signal. For example, the safety controller 102 can directly determine that the mobile device is in an abnormal situation when receiving the safety signal sent by the safety input device 108, or the safety controller 102 can determine whether the safety signal is the same as a preset safety signal after receiving the safety signal sent by the safety input device 108, and if so, determine that the mobile device is in an abnormal situation, and the like.

[0117] The safety driver 103 includes the torque off 106, and the torque off 106 is electrically connected with the motor 104 and the motor brake 105, i.e., the torque off 106 is electrically connected with the motor 1, the motor brake 1, the motor 2 and the motor brake 2.

[0118] When the safety controller 102 determines that the mobile device is in an abnormal situation based on the safety signal, the safety controller 102 can output a shutdown signal to the torque off 106, so that the torque off 106 shuts down the power supply of the motor 1, the motor brake 1, the motor 2 and the motor brake 2, and synchronously controls the motor 1 and the motor 2 to stop and open the motor brake. As shown in FIG. 6(b), when the safety input device is triggered, the safety input device sends a safety signal to the safety controller, and then the safety controller determines whether the mobile device is in an abnormal state according to the safety signal, and sends a shutdown signal to the STO interface when determining that the mobile device is in an abnormal state. The torque off in the safety driver receives the shutdown signal, and closes the power supply of the motor and the motor brake electrically connected with the motor, and controls the motor to stop and open the motor brake.

[0119] In the scheme provided by the embodiment of the application, the motor safety control circuit can further include a safety input device. When detecting that an obstacle appears around the mobile device, or when obtaining an externally triggered stop instruction, i.e., when determining that the mobile device may be in an abnormal situation such as collision, the safety input device sends a safety signal to the safety controller through the electrical connection between the safety input device and the safety controller, so that the safety controller sends a shutdown signal to the torque off when the mobile device is in an abnormal situation, so that the torque off can control the motor to stop and open the motor brake, and thus the mobile device is safely stopped.

[0120] As an implementation manner of the embodiment of the application, as shown in FIG. 7(a), the torque off includes a high-side control switch 109, and the safety driver 103 further includes a low-side control switch 110.

[0121] The power supply 101 is electrically connected with the motor brake 105 through the high-side control switch 109, and the low-side control switch 110 is electrically connected with the motor brake 105, and the low-side control switch 110 is grounded.

[0122] The safety driver 103 is specifically configured to, when receiving the shutdown signal, turn off the high-side control switch 109, and / or turn off the low-side control switch 110, and turn on the motor brake.

[0123] The torque shutdown 106 includes the high-side control switch 109 and a processor, and the high-side control switch 109 is located between the power supply 101 and the motor brake 105, so that the torque shutdown can realize the opening of the power supply circuit through the high-side control switch 109. The safety driver further includes the low-side control switch 110 located between the motor brake 105 and the ground. Thus, the safety driver 103 can control the opening and closing of the motor brake 105 through the high-side control switch 109 and the low-side control switch 110, respectively, and specifically:

[0124] The power supply 101 can be electrically connected with the high-side control switch 109 and the motor brake 105, the safety driver 103 can be electrically connected with the high-side control switch 109 to control the opening and closing of the high-side control switch 109, and can be electrically connected with the low-side control switch 110 to control the opening and closing of the low-side control switch 110, one end of the low-side control switch 110 is electrically connected with the motor brake 105, and the other end is connected with the ground, that is, the safety driver 103 can be electrically connected with the motor brake 105 through the low-side control switch 110, and the low-side control switch 110 is grounded.

[0125] Because the high-side control switch 109 is located in the path between the power supply 101 and the motor brake 105, when the high-side control switch 109 is turned off, the power supply of the motor brake 105 can be cut off, and the effect of the brake is realized.

[0126] Therefore, in the above-mentioned motor safety control circuit, when receiving the shutdown signal input by the safety controller 102, the safety driver 103 can control the high-side control switch 109 to be turned off, and cut off the power supply of the motor brake 105 to turn on the motor brake.

[0127] For the safety driver 103, because the low-side control switch 110 electrically connected therewith is located between the motor brake 105 and the ground, when the low-side control switch 110 is turned off, the motor brake 105 cannot be powered on, so that the safety driver 103 can turn off the low-side control switch 110 to turn on the motor brake 105 when the mobile device is in an abnormal condition.

[0128] That is, when the safety driver 103 receives the shutdown signal input by the safety controller 102, the MCU (Micro Control Unit) inside the safety driver 103 processes the shutdown signal, and then turns off the high-side control switch 109 and / or turns off the low-side control switch 110, to turn off the motor brake power supply and turn on the motor brake.

[0129] The torque shutdown 106 turns off the motor brake power supply as follows: the STO interface of the safety driver 103 receives the shutdown signal input by the safety controller 102, and controls the high-side control switch 109 to be turned off by the MCU inside the safety driver 103, to turn off the motor brake 105 power supply.

[0130] In one embodiment, the safety driver includes a motor brake drive and a power supply switch, as shown in FIG. 7(b). C1 is the power supply, which is the positive electrode of a lithium battery or other power supply. The power supply switch is the high-side control switch (S1), the brake drive is the low-side control switch (S2), and the motor brake (L1) is electrically connected to the high-side control switch and the low-side control switch, respectively. The low-side control switch is connected to the power supply ground (GND). When the mobile device is in an abnormal situation, the safety driver can turn off the high-side control switch by turning off the power supply switch, or turn on the motor brake by controlling the brake drive to act.

[0131] The high-side control switch 109 is located in the path between the power supply 101 and the motor 104, and is also located in the path between the power supply 101 and the motor brake 105. Therefore, when the high-side control switch 109 is turned off, the power supply to the motor 104 and the power supply to the motor brake 105 can be simultaneously cut off, to achieve the effects of motor braking and motor braking. When the high-side control switch 109 is specifically located in the common part of the power supply circuit of the motor brake 105 and the power supply circuit of the motor 104, for example, turning off the high-side control switch 109 can cut off the power supply to the motor 104, to achieve the effect of stopping the motor 104, and can also cut off the power supply to the motor brake 105, to achieve the effect of the motor brake.

[0132] In one embodiment, because the low-side control switch 110 is located between the motor brake 105 and the ground, it can only control the path where the motor brake 105 is located, and cannot control the path where the motor 104 is located. Therefore, turning off the low-side control switch 110 cannot control the motor 104 to stop. Therefore, when the mobile device is in an abnormal situation, in addition to turning on the motor brake by turning off the low-side control switch 110, the safety driver 103 can also turn off the power supply circuit of each motor 104 to stop the motor 104.

[0133] In an embodiment, the safety driver 103 can include a power supply mainly used for converting the power of the power supply 101 to supply power to the motor 104 and the motor brake 105, that is, the power supply 101 shared by the motor brake 105 and the motor 104 can be the power supply shared by the motor brake 105 and the motor 104. In this case, because the power supply is mainly used for converting the power of the power supply 101 to supply power to the motor 104, the voltage of the power output by the power supply is consistent with the rated voltage of the motor 104, and the rated voltage of the motor brake 105 and the rated voltage of the motor 104 can not be the same, therefore, in order to enable the motor brake 105 to work normally, the safety driver 103 can further include a voltage conversion device, which can convert the voltage of the power from the power supply to the rated voltage of the motor brake 105 through PWM (Pulse Width Modulation) and then output to the motor brake 105.

[0134] In the scheme provided by the embodiments of the application, the safety driver includes a high-side control switch located between the power supply and the motor brake and a low-side control switch located between the motor brake and the ground, so that the safety driver can disconnect at least one of the high-side control switch and the low-side control switch to disconnect the power supply of the motor brake and start the motor brake when the mobile device is in an abnormal condition.

[0135] As an embodiment of the embodiments of the application, as shown in FIG. 8(a), the torque off device includes a high-side control switch 109, and the safety driver further includes a low-side control switch 110.

[0136] The power supply 101 is electrically connected to the motor 104 through the high-side control switch 109, the low-side control switch 110 is electrically connected to the motor 104, and the low-side control switch 110 is grounded.

[0137] The safety driver 103 is specifically configured to disconnect the high-side control switch 109 and / or disconnect the low-side control switch 110 to control the motor to stop when the off signal is received.

[0138] The safety driver 103 can include the high-side control switch 109 and the low-side control switch 110, the power supply 101 is electrically connected to the motor 104 through the high-side control switch 109, the low-side control switch 110 is electrically connected to the motor 104, and the low-side control switch 110 is grounded.

[0139] When the mobile device is in an abnormal situation, the safety driver 103 can disconnect the high-side control switch 109 to turn off the power supply of the motor 104, or disconnect the low-side control switch 110 to turn off the motor winding of the motor 104, control the motor 104 to stop, and then control the mobile device to stop. Specifically, when the safety driver 103 receives the turn-off signal sent by the safety controller 102, or determines that the mobile device is in an abnormal situation based on the speed information, the safety driver 103 can disconnect the high-side control switch 109 to turn off the power supply of the motor 104 through the processor MCU inside the safety driver 103, realize high-side control, and / or disconnect the low-side control switch to turn off the motor winding, realize low-side control. Thus, the motor 104 is controlled to stop by disconnecting the high-side control switch 109 or disconnecting the low-side control switch 110.

[0140] In the process of disconnecting the high-side control switch 109 by the safety driver 103 to turn off the power supply of the motor, the torque off 106 receives the turn-off signal input by the safety controller 102, controls the process through the processor MCU inside the safety driver 103, disconnects the high-side control switch 109 to turn off the power supply of the motor 104, and the safety driver 103 includes an STO interface. After the STO interface receives the turn-off signal, the turn-off signal is sent to the MCU, and the MCU controls the high-side control switch 109 to be disconnected to turn off the power supply of the motor.

[0141] In an embodiment, the safety driver includes power supply control and motor winding driving, as shown in FIG. 8(b). C1 is a power supply, which is the positive electrode of a power supply such as a lithium battery. The power supply switch, i.e., the high-side control switch (S1), is electrically connected to the motor winding driving and the Q1-Q6 three-phase arm bridge switches included in the motor M. The motor winding driving is connected to the power supply ground (GND), i.e., the low-side control switch. The safety driver can turn off the power supply of the motor by disconnecting the high-side control switch S1, or turn off the motor winding by turning off the three-phase arm bridge switches of the motor winding, so as to control the motor to stop.

[0142] In the scheme provided by the embodiment of the application, the safety driver can include a high-side control switch and a low-side control switch. The high-side control switch is electrically connected to the motor, and the low-side control switch is electrically connected to the motor and grounded. In this way, when the mobile device is in an abnormal situation, the safety driver can control the motor to stop by turning off the high-side control switch and / or turning off the low-side control switch.

[0143] As an embodiment of the present application, as shown in FIG. 9, the safety driver 103 includes a first master controller 111, a first slave controller 112, a first input interface 121, a second input interface 122, a high-side control switch 109, a motor winding drive 1031, and a motor brake drive 1032, the first master controller 111 and the second slave controller 112 are respectively electrically connected with the first input interface 121, the second input interface 122, the high-side control switch 109, the motor winding drive 1031, and the motor brake drive 1032, and the first master controller 111 and the first slave controller 112 are electrically connected; the torque off includes the first master controller, the first slave controller, and the high-side control switch;

[0144] The first master controller 111 is configured to acquire the off signal input by the safety controller 102 through the first input interface 121 and the second input interface 122, and determine whether the off signal acquired through the first input interface 121 is consistent with the off signal acquired through the second input interface 122, and if so, send the off signal to the first slave controller 112;

[0145] The first slave controller 112 is configured to acquire the off signal input by the safety controller 102 through the first input interface 121 and the second input interface 122, and determine whether the off signal acquired through the first input interface 121 is consistent with the off signal acquired through the second input interface 122, and if so, send the off signal to the first master controller 111;

[0146] The first master controller 111 is further configured to determine whether the acquired off signal input by the safety controller 102 is same as the off signal sent by the first slave controller 112, and if so, output a disconnect instruction to the high-side control switch 109, so that the high-side control switch 109 is disconnected, the motor 104 electrically connected with the high-side control switch 109 is stopped and the motor brake 105 is opened, a winding closing signal is output to the motor winding drive 1031, so that the motor winding drive 1031 closes the motor winding, and a brake drive signal is output to the motor brake drive 1032, so that the motor brake drive 1032 opens the motor brake 105;

[0147] The first slave controller 112 is further configured to determine whether the obtained shutdown signal input by the safety controller 102 is the same as the shutdown signal sent by the first master controller 111, and if so, to obtain the disconnection instruction, the winding closing signal and the brake driving signal output by the first master controller 111, and to determine whether the disconnection instruction, the winding closing signal and the brake driving signal determined based on the obtained shutdown signal input by the safety controller 102 and the shutdown signal sent by the first master controller 111 are respectively consistent with the disconnection instruction, the winding closing signal and the brake driving signal output by the first master controller 111. If there is an inconsistent signal, an alarm signal is output to the high-side control switch 109, the motor winding drive 1031 and the motor brake drive 1032, so that the high-side control switch 109 shields the disconnection instruction output by the first master controller 111, the motor winding drive 1031 shields the winding closing signal output by the first master controller 111, and the motor brake drive 1032 shields the brake driving signal output by the first master controller 111.

[0148] To ensure that the shutdown signal sent by the safety controller 102 can be transmitted to the torque shutdown device 106, the safety controller 102 and the safety driver 103 can have two shutdown signal transmission channels, i.e., the safety driver 103 includes two output interfaces for outputting the shutdown signal, and the safety driver 103 includes two input interfaces for receiving the shutdown signal.

[0149] Based on this, the safety driver 103 can include the first master controller 111, the first slave controller 112, the first input interface 121, the second input interface 122, the high-side control switch 109, the motor winding drive 1031 and the motor brake drive 1032. The first master controller 111 can obtain the shutdown information input by the safety controller 102 from the first input interface 121 and the second input interface 122 through electrical connection of the first master controller 111 with the first input interface 121 and the second input interface 122, and after obtaining the shutdown information, the first master controller 111 can determine whether the shutdown signal obtained through the first input interface 121 is consistent with the shutdown signal obtained through the second input interface 122. If so, the first master controller 111 can send the shutdown signal to the first slave controller 112 through electrical connection of the first master controller 111 with the first slave controller 112. If not, a notification message indicating an abnormal shutdown signal is output to enable relevant personnel to confirm the current situation of the mobile device and detect whether there is a program error in the safety controller 102.

[0150] Similarly, the first slave controller 112 can also obtain the shutdown information input by the safety controller 102 from the first input interface 121 and the second input interface 122 through the electrical connection between the first slave controller 112 and the first input interface 121 and the second input interface 122, respectively. After obtaining the shutdown information, the first slave controller 112 can determine whether the shutdown signal obtained through the first input interface 121 is consistent with the shutdown signal obtained through the second input interface 122. If consistent, the first slave controller 112 can send the shutdown signal to the first master controller 111 through the electrical connection between the first slave controller 112 and the first master controller 111. If inconsistent, a notification message indicating that the shutdown signal is abnormal is outputted, so that the relevant staff can confirm the current situation of the mobile device and detect whether there is a program error in the safety controller 102.

[0151] In this way, the first master controller 111 and the first slave controller 112 can obtain the shutdown information obtained by themselves and the shutdown information sent by the other controller. After obtaining the shutdown information sent by the first slave controller 112, the first master controller 111 can determine whether the shutdown information obtained by itself is the same as the shutdown information sent by the first slave controller 112. If the same, the first master controller 111 can output a disconnection instruction to the high-side control switch 109, so that the high-side control switch 109 is disconnected, and the motor 104 connected to the high-side control switch 109 is stopped and the motor brake 105 is opened, the motor winding drive 1031 is outputted with a winding closing signal to close the motor winding, and the motor brake drive 1032 is outputted with a brake driving signal to open the motor brake.

[0152] In an implementation manner, if the first master controller 111 and / or the first slave controller 112 only receives the shutdown signal input by one of the first input interface 121 and the second input interface 122, an interface exception elimination message is outputted, so that the staff can troubleshoot the abnormal interface and verify the actual operation of the mobile device, so as to control the mobile device manually based on the actual operation of the mobile device.

[0153] In an implementation manner, if the first master controller 111 and the first slave controller 112 only receive the shutdown signal input by one of the first input interface 121 and the second input interface 122, it is determined whether the mobile device is in an abnormal state based on the shutdown signal, and when it is determined that the mobile device is in an abnormal state, the mobile device is controlled to stop through outputting a shutdown instruction, a stop signal and a brake signal, and an interface exception elimination message is outputted, so that the staff can troubleshoot the abnormal interface.

[0154] The first slave controller 112 can also determine whether the shutdown information obtained by the first slave controller 112 is the same as the shutdown information sent by the first master controller 111 after obtaining the two pieces of shutdown information. If not, the first slave controller 112 can output an abnormal prompt information to enable relevant staff to confirm the current situation of the mobile device and detect whether the safety controller 102 has a program error.

[0155] If the first slave controller 112 determines that the shutdown information obtained by the first slave controller 112 is the same as the shutdown information sent by the first master controller 111, the first slave controller 112 can further determine whether the disconnection instruction, the winding closing signal and the brake driving signal output by the first master controller 111 are correct. Specifically, the first slave controller 112 can obtain the disconnection instruction, the winding closing signal and the brake driving signal output by the first master controller 111, and determine whether the disconnection instruction, the winding closing signal and the brake driving signal determined based on the shutdown information received by the first slave controller 112 and the shutdown information sent by the first master controller 111 are consistent with the disconnection instruction, the winding closing signal and the brake driving signal obtained by the first master controller 111. If not, it means that the disconnection instruction, the winding closing signal and the brake driving signal output by the first master controller 111 may have errors. At this time, the first slave controller 112 can output an alarm signal to the high-side control switch 109, the motor winding drive 1031 and the motor brake drive 1032, so that the high-side control switch 109 shields the disconnection instruction output by the first master controller 111, the motor winding drive 1031 shields the winding closing signal output by the first master controller 111, and the motor brake drive 1032 shields the brake driving signal output by the first master controller 111, so as to avoid the high-side control switch 109, the motor winding drive 1031 and the motor brake drive 1032 from moving due to the error instruction output by the first master controller 111, resulting in that the movement state of the mobile device does not match the current environment.

[0156] The first slave controller 112 can not perform any operation when the disconnection instruction, the winding closing signal and the brake driving signal determined based on the shutdown information obtained by the first slave controller 112 and the shutdown information sent by the first master controller 111 are consistent with the disconnection instruction, the winding closing signal and the brake driving signal obtained by the first master controller 111.

[0157] In the scheme provided by the embodiments of the present application, the safety driver can include a first master controller, a first slave controller, a first input interface, and a second input interface. After receiving the shutdown information input by the first input interface and the second input interface, the first master controller and the first slave controller can respectively check whether the shutdown information input by the first input interface and the second input interface is the same, so as to avoid the misoperation caused by the information transmission error. In addition, the first master controller and the first slave controller can respectively determine whether the shutdown information obtained from the input interface and the shutdown information sent by the other controller to itself is the same. If the shutdown information is the same, it is indicated that the input interface can normally receive the shutdown information output by the external environment. Then, the first master controller and the first slave controller can control the motor to stop and brake by the high-side control switch, the motor winding drive, and the motor brake drive, so as to ensure the accuracy of the motor control according to the shutdown information, and the first slave controller can further determine whether the safety signal output by the first master controller is accurate, so as to ensure the safety.

[0158] The torque shutdown device 106 includes the first master controller 111, the first slave controller 112, and the high-side control switch 109. When detecting that the mobile device is in the abnormal state, the safety processor 102 outputs a shutdown signal to the torque shutdown device 106. The first master controller 111 and the first slave controller 112 process the shutdown signal according to the above processing flow, and control the high-side control switch 109 to be turned off when determining that the mobile device is in the abnormal state, so as to realize the control process of controlling the motor 104 to brake by the torque shutdown device 106.

[0159] As an embodiment of the present application, as shown in FIG. 10, the safety driver 103 includes the first master controller 111, the first slave controller 112, the third input interface 123, the high-side control switch 109, the motor winding drive 1031, and the motor brake drive 1032. The first master controller 111 and the first slave controller 112 are respectively electrically connected with the third input interface 123, the high-side control switch 109, the motor winding drive 1031, and the motor brake drive 1032, and the first master controller 111 and the first slave controller 112 are electrically connected. The torque shutdown device 106 includes the first master controller 111, the first slave controller 112, and the high-side control switch 109.

[0160] The first master controller 111 is configured to acquire the speed information input by the external environment through the third input interface 123, determine whether the mobile device is in an abnormal state based on the speed information, obtain a first determination result, and send the first determination result to the first slave controller 112.

[0161] The first slave controller 112 is configured to acquire speed information input externally through the third input interface 123, determine whether the mobile device is in an abnormal situation based on the speed information, obtain a second determination result, and send the second determination result to the first master controller 111.

[0162] The first master controller 111 is further configured to determine whether the first determination result and the second determination result are the same, and if so and the determination result indicates that the mobile device is in an abnormal situation, output a disconnection instruction to the high-side control switch 109, so that the high-side control switch 109 causes the motor 104 connected thereto to stop and the motor brake 105 to be opened, output a winding closing signal to the motor winding drive 1031, so that the motor winding drive 1031 closes the motor winding, and output a brake drive signal to the motor brake drive 1032, so that the motor brake drive 1032 opens the motor brake 105.

[0163] The first slave controller 112 is further configured to determine whether the first determination result and the second determination result are the same, and if so and the determination result indicates that the mobile device is in an abnormal situation, acquire the disconnection instruction, the winding closing signal, and the brake drive signal output by the first master controller 111, and determine whether the disconnection instruction, the winding closing signal, and the brake drive signal determined based on the first determination result and the second determination result are consistent with the disconnection instruction, the winding closing signal, and the brake drive signal output by the first master controller 111, respectively, and if not, output an alarm signal to the high-side control switch 109, the motor winding drive 1031, and the motor brake drive 1032, so that the high-side control switch 109 shields the disconnection instruction output by the first master controller 111, the motor winding drive 1031 shields the winding closing signal output by the first master controller 111, and the motor brake drive 1032 shields the brake drive signal output by the first master controller 111.

[0164] The safety driver 103 can include the first master controller 111, the first slave controller 112, the third input interface 123, the motor winding drive 1031, and the motor brake drive 1032. The first master controller 111 can acquire speed information input externally from the third input interface 123 through the electrical connection therebetween, determine whether the mobile device is in an abnormal situation based on the speed information, and send the first determination result to the first slave controller 112 through the electrical connection therebetween after obtaining the first determination result.

[0165] Similarly, the first slave controller 112 can also acquire the speed information inputted from the third input interface 123 through the electrical connection between the first slave controller 112 and the third input interface 123, and determine whether the mobile device is in an abnormal situation based on the speed information, and the first slave controller 112 can also send the second determination result to the first master controller 111 through the electrical connection between the first slave controller 112 and the first master controller 111 after obtaining the second determination result.

[0166] In this way, the first master controller 111 and the first slave controller 112 can obtain the determination result of the speed information and the determination result of the speed information of the other controller, and the first master controller 111 and the first slave controller 112 can determine whether the two determination results are the same after obtaining the two determination results, if the two determination results are the same and the determination result indicates that the mobile device is in an abnormal situation, the first master controller 111 can output a disconnection instruction to the high-side control switch 109, so that the motor 104 connected by the high-side control switch 109 is stopped and the motor brake 105 is opened, the winding closing signal is outputted to the motor winding drive 1031, so that the motor winding drive 1031 closes the motor winding, and the brake drive signal is outputted to the motor brake drive 1032, so that the motor brake drive 1032 opens the motor brake 105, thereby realizing the control of the motor brake and the brake. If the two determination results are different, the first master controller 111 can abnormally output prompt information, so that the relevant staff confirms the current situation of the mobile device and detects whether there is a program error in the safety controller 102.

[0167] Similarly, the first slave controller 112 can also determine whether the two determination results are the same after obtaining the two determination results, if the two determination results are different, the first slave controller 112 can abnormally output prompt information, so that the relevant staff confirms the current situation of the mobile device and detects whether there is a program error in the safety controller 102.

[0168] If the first slave controller 112 judges that the two judgment results it obtains are same and the judgment results indicate that the mobile device is in abnormal situation, the first slave controller 112 can further judge whether the disconnect instruction, the winding closing signal and the brake driving signal output by the first master controller 111 are correct, specifically, the first slave controller 112 can obtain the disconnect instruction, the winding closing signal and the brake driving signal output by the first master controller 111, and judge whether the disconnect instruction, the winding closing signal and the brake driving signal determined based on the first judgment result and the second judgment result are consistent with the disconnect instruction, the winding closing signal and the brake driving signal output by the first master controller 111 obtained. If not consistent, it means that the disconnect instruction, the winding closing signal and the brake driving signal output by the first master controller 111 may have errors, at this time the first slave controller 112 can output an alarm signal to the high-side control switch 109, the motor winding drive 1031 and the motor brake drive 1032, so that the high-side control switch 109 shields the disconnect instruction output by the first master controller 111, the motor winding drive 1031 shields the winding closing signal output by the first master controller 111, and the motor brake drive 1032 shields the brake driving signal output by the first master controller 111.

[0169] The first slave controller 112 can not operate when it judges that the disconnect instruction, the winding closing signal and the brake driving signal determined based on the first judgment result and the second judgment result are consistent with the disconnect instruction, the winding closing signal and the brake driving signal output by the first master controller 111 obtained.

[0170] The torque off 106 includes the first master controller 111, the first slave controller 112 and the high-side control switch 109. When receiving the speed information input externally, the first master controller 111 and the first slave controller 112 process the speed information according to the above processing flow, and control the high-side control switch 109 to be disconnected when judging that the mobile device is in abnormal situation based on the speed information, so as to realize the control process of controlling the brake of the motor 104 through the torque off 106.

[0171] In the scheme provided by the embodiments of the present application, the safety driver can include a first master controller, a first slave controller, and a third input interface for obtaining speed information of the mobile device, the first master controller and the first slave controller can respectively determine whether the mobile device is in an abnormal situation based on the speed information input by the third input interface, obtain a first determination result and a second determination result, and then the first master controller and the first slave controller can respectively determine whether the first determination result and the second determination result are the same, if not, it is very likely that one of the controllers has failed, at this time, a prompt information can be output, if the same, it is very likely that the first determination result and the second determination result are both normal operation, at this time, the first determination result and the second determination result, ensure the accuracy of the motor control according to the speed information, and the first slave controller can further determine whether the safety signal output by the first master controller is accurate to ensure safety.

[0172] As an embodiment of the present application, as shown in FIG. 11, the safety controller 102 includes an input module 1021, a processing module 1022 and an output module 1023, the processing module 1022 is electrically connected with the input module 1021, the safety driver 103 and the output module 1023 respectively, and the output module 1023 is electrically connected with the safety driver 103;

[0173] The input module 1021 is configured to obtain the safety signal input by the outside and send the safety signal to the processing module 1022;

[0174] The processing module 1022 is configured to receive the safety signal and the speed information sent by the safety driver 103, and send a control signal to the output module 1023 when determining that the mobile device is in an abnormal situation based on the safety signal or the speed information;

[0175] The output module 1023 is configured to receive the control signal sent by the processing module 1022, and output a shutdown signal to the torque shutdown device 106 when determining that the control signal indicates that the mobile device stops, so that the torque shutdown device 106 controls the motor 104 connected therewith to stop and open the motor brake 105 when receiving the shutdown signal.

[0176] The safety controller 102 can include multiple modules, i.e. the input module 1021, the processing module 1022 and the output module 1023, wherein the input module 1021 is connected with the outside, configured to obtain the safety signal input by the outside, for example, the input module 1021 can be electrically connected with the safety input device 108, configured to receive the safety signal sent by the safety input device 108 when detecting that there is an obstacle around the mobile device, or when obtaining the external triggered stop instruction.

[0177] The processing module 1022 can be electrically connected with the input module 1021 and the safety driver 103 respectively to acquire the external input safety signal from the input module 1021 and the speed information monitored by the safety driver 103 on the speed of the motor respectively, and then the processing module 1022 can determine whether the mobile device is in an abnormal situation based on the safety signal and / or the speed information.

[0178] The processing module 1022 can also be electrically connected with the output module 1023, so that when the processing module 1022 determines that the mobile device is in an abnormal situation based on the safety signal, it can send a control signal to the output module 1023 and the safety driver 103 through its electrical connection with the output module 1023 and its electrical connection with the safety driver 103 respectively. When the processing module 1022 determines that the mobile device is in an abnormal situation based on the speed information, because the safety driver 103 itself can determine whether the mobile device is in an abnormal situation according to the speed information, the processing module 1022 can only send a control signal to the output module 1023 through its electrical connection with the output module 1023.

[0179] The output module 1023 can receive the control signal sent by the processing module 1022, determine the content indicated by the control signal, and when the control signal indicates that the mobile device stops, the output module 1023 can output a shutdown signal to each torque off switch 106 in the safety driver 103 based on its electrical connection with each torque off switch 106, so that each torque off switch 106 controls the motor 104 electrically connected to the torque off switch 106 to stop and open the motor brake 105 when receiving the shutdown signal.

[0180] For example, the output module 1023 can receive the control signal sent by the processing module 1022, and determine the indicated action corresponding to the control signal based on the correspondence between the instructions stored in the output module 1023 and the indicated actions. If the control signal indicates that the mobile device stops, the output module 1023 can output a shutdown signal to the torque off switch 106 in the safety driver 103 based on its electrical connection with the torque off switch 106, so that the torque off switch 106 controls the motor 104 electrically connected to the torque off switch 106 to stop and open the motor brake 105 when receiving the shutdown signal.

[0181] In the scheme provided by the embodiments of the present application, the safety controller can include an input module, a processing module and an output module, wherein the input module and the processing module can be respectively used to acquire the safety signal input from outside and acquire the speed information sent by the safety driver, so that, on the one hand, the speed information sent by the safety driver can reach the processing module more quickly to determine whether the mobile device is in an abnormal condition, thereby achieving more rapid control, and on the other hand, even if the input module used to acquire the safety signal input from outside fails, the processing module can also directly acquire the speed information sent by the safety driver to determine whether the mobile device is in an abnormal condition, thereby ensuring the success rate of controlling the motor to stop and be braked.

[0182] As an embodiment of the present application, as shown in FIG. 12, the input module 1021 includes a second master controller 113, a second slave controller 114, a fourth input interface 124 and a first output interface 131, the second master controller 113 and the second slave controller 114 are electrically connected with the fourth input interface 124 and the first output interface 131 respectively, and the second master controller 113 and the second slave controller 114 are electrically connected;

[0183] The second master controller 113 is configured to acquire the safety signal input from outside through the fourth input interface 124 and send the safety signal to the second slave controller 114;

[0184] The second slave controller 114 is configured to acquire the safety signal input from outside through the fourth input interface 124 and send the safety signal to the second master controller 113;

[0185] The second master controller 113 is further configured to determine whether the acquired safety signal input from outside is same as the safety signal sent by the second slave controller 114, and if so, output the safety signal to the processing module 1022 through the first output interface 131;

[0186] The second slave controller 114 is further configured to determine whether the acquired safety signal input from outside is same as the safety signal sent by the second master controller 113, and if so, acquire the safety signal output by the second master controller 113 and determine whether the acquired safety signal input from outside is consistent with the safety signal output by the second master controller 113, and if not, output an alarm signal to the processing module through the first output interface 131 to make the processing module shield the safety signal output by the second master controller 113.

[0187] The input module 1021 can include a second master controller 113, a second slave controller 114, a fourth input interface 124, and a first output interface 131. The second master controller 113 can obtain the externally input safety signal from the fourth input interface 124 through the electrical connection therebetween, and send the safety signal to the second slave controller 114 through the electrical connection therebetween after obtaining the safety signal. Similarly, the second slave controller 114 can also obtain the externally input safety signal from the fourth input interface 124 through the electrical connection therebetween, and send the safety signal to the second master controller 113 through the electrical connection therebetween after obtaining the safety signal.

[0188] In this way, the second master controller 113 and the second slave controller 114 can obtain the safety signal obtained by themselves and the safety signal sent by the other controller. The second master controller 113 can determine whether the two safety signals obtained by itself are the same after obtaining the two safety signals, and if so, the second master controller 113 can output the safety signal to the processing module 1022 through the first output interface 131. If not, the second master controller 113 can output a prompt message to enable the relevant staff to confirm the current situation of the mobile device and detect whether the safety controller 102 has a program error.

[0189] Similarly, the second slave controller 114 can also determine whether the two safety signals obtained by itself are the same after obtaining the two safety signals, and if not, the second slave controller 114 can output a prompt message to enable the relevant staff to confirm the current situation of the mobile device and detect whether the safety controller 102 has a program error.

[0190] If the second slave controller 114 determines that the two safety signals obtained by itself are the same, the second slave controller 114 can further determine whether the safety signal output by the second master controller 113 is correct. Specifically, the second slave controller 114 can obtain the safety signal output by the second master controller 113, and determine whether the externally input safety signal obtained by itself and the safety signal output by the second master controller 113 are consistent. If not, it indicates that the safety signal output by the second master controller 113 may have an error. At this time, the second slave controller 114 can output an alarm signal to the processing module 1022 through the first output interface 131 to enable the processing module 1022 to shield the safety signal output by the second master controller 113, and the second slave controller 114 can output a prompt message to enable the relevant staff to confirm the current situation of the mobile device and detect whether the safety controller 102 has a program error.

[0191] The second slave controller 114 can not operate when it is determined that the acquired external input safety signal is consistent with the acquired safety signal output by the second master controller 113.

[0192] In the scheme provided by the embodiments of the present application, the input module can include a second master controller and a second slave controller. The second master controller and the second slave controller can respectively determine whether the safety signal acquired from the input interface and the safety signal sent by the other controller are the same. If they are the same, it indicates that the input interface can normally receive the safety signal output by the outside world. Then, the second master controller can output the safety signal to the processing module through the first output interface, so that the processing module performs the subsequent judgment process. In addition, the second slave controller can further determine whether the safety signal output by the second master controller is accurate, so as to ensure safety.

[0193] As an embodiment of the present application, as shown in FIG. 13, the processing module 122 includes a third master controller 115, a third slave controller 116, a fifth input interface 125 and a second output interface 132. The third master controller 115 and the third slave controller 116 are respectively electrically connected with the fifth input interface 125 and the second output interface 132. The third master controller 115 and the third slave controller 116 are electrically connected.

[0194] The third master controller 115 is configured to acquire the safety signal input by the input module 1021 through the fifth input interface 125, determine whether the mobile device is in an abnormal situation based on the safety signal, obtain a third judgment result, and send the third judgment result to the third slave controller 116.

[0195] The third slave controller 116 is configured to acquire the safety signal input by the input module 1021 through the fifth input interface 125, determine whether the mobile device is in an abnormal situation based on the safety signal, obtain a fourth judgment result, and send the fourth judgment result to the third master controller 115.

[0196] The third master controller 115 is further configured to determine whether the third judgment result and the fourth judgment result are the same. If they are the same and the judgment result indicates that the mobile device is in an abnormal situation, the third master controller 115 outputs a control signal to the output module 1023 through the second output interface 132.

[0197] The third slave controller 116 is also configured to determine whether the third determination result and the fourth determination result are same, and if the determination result indicates that the mobile device is in an abnormal situation, acquire the control signal output by the third master controller 115, and determine whether the control signal determined based on the third determination result and the fourth determination result is consistent with the acquired control signal output by the third master controller 115, and if not consistent, output an alarm signal to the output module 1023 through the second output interface 132, so that the output module 1023 masks the control signal output by the third master controller 115.

[0198] The processing module 1022 can include a third master controller 115, a third slave controller 116, a fifth input interface 125, and a second output interface 132. The third master controller 115 can acquire the safety signal input by the input module 1021 from the fifth input interface 125 through the electrical connection between the third master controller 115 and the fifth input interface 125, determine whether the mobile device is in an abnormal situation based on the safety signal, and obtain a third determination result. After obtaining the third determination result, the third master controller 115 can also send the third determination result to the third slave controller 116 through the electrical connection between the third master controller 115 and the third slave controller 116.

[0199] Similarly, the third slave controller 116 can acquire the safety signal input by the input module 1021 from the fifth input interface 125 through the electrical connection between the third slave controller 116 and the fifth input interface 125, determine whether the mobile device is in an abnormal situation based on the safety signal, and obtain a fourth determination result. After obtaining the fourth determination result, the third slave controller 116 can also send the fourth determination result to the third master controller 115 through the electrical connection between the third slave controller 116 and the third master controller 115.

[0200] In this way, the third master controller 115 and the third slave controller 116 can both obtain the determination result of the safety signal and the determination result of the safety signal of the other controller. After obtaining the two determination results, the third master controller 115 can determine whether the two determination results are same, and if the determination result indicates that the mobile device is in an abnormal situation, the third master controller 115 can output a control signal to the output module 1023 through the second output interface 132. If not, the third master controller 115 can output a prompt information to enable relevant staff to confirm the current situation of the mobile device and detect whether the safety controller 102 has a program error.

[0201] Similarly, after obtaining the two determination results, the third slave controller 116 can also determine whether the two determination results are same. If not, the third slave controller 116 can output a prompt information to enable relevant staff to confirm the current situation of the mobile device and detect whether the safety controller 102 has a program error.

[0202] If the third slave controller 116 judges that the two judgment results it obtains are same and the judgment result indicates that the mobile device is in an abnormal situation, the third slave controller 116 can further judge whether the safety signal output by the third master controller 115 is correct, specifically: the third slave controller 116 can obtain the control signal output by the third master controller 115, and judge whether the control signal determined based on the third judgment result and the fourth judgment result is consistent with the obtained control signal output by the third master controller 115, if not, it indicates that the safety signal output by the third master controller 115 may have errors, at this time, the third slave controller 116 can output an alarm signal to the output module 1023 through the second output interface 132, so that the output module 1023 shields the safety signal output by the third master controller 115, and the third slave controller 116 can also output prompt information, so that the relevant staff confirms the current situation of the mobile device, and detects whether the safety controller 102 has a program error.

[0203] When the third slave controller 116 judges that the control signal determined based on the third judgment result and the fourth judgment result is consistent with the obtained control signal output by the third master controller 115, the third slave controller 116 can not operate.

[0204] In the scheme provided by the embodiment of the application, the processing module can include a third master controller and a third slave controller, the third master controller and the third slave controller can judge whether the mobile device is in an abnormal situation based on the safety signal respectively, obtain a third judgment result and a fourth judgment result, and then the third master controller and the third slave controller can judge whether the third judgment result and the fourth judgment result are same, if not, it is very likely that one of the controllers has a fault, at this time, prompt information can be output, if same, it is very likely that the third master controller and the third slave controller are both in normal operation, at this time, the control signal can be output to the output module through the second output interface, which ensures the accuracy of the motor control according to the safety signal, and the third slave controller can further judge whether the control signal output by the third master controller is accurate to ensure safety.

[0205] As one of the embodiments of the application, as shown in FIG. 14, the processing module 1022 further includes a third master controller 115, a third slave controller 116, a sixth input interface 126, a seventh input interface 127 and a second output interface 132, the third master controller 115 and the third slave controller 116 are electrically connected with the sixth input interface 126, the seventh input interface 127 and the second output interface 132 respectively;

[0206] The third master controller 115 is configured to acquire the speed information sent by the safety driver 103 through the sixth input interface 126 and the seventh input interface 127, and determine whether the speed information acquired through the sixth input interface 126 is consistent with the speed information acquired through the seventh input interface 127. If the speed information acquired through the sixth input interface 126 is consistent with the speed information acquired through the seventh input interface 127, the third master controller 115 determines, based on the speed information, whether the mobile device is in an abnormal situation, and obtains a fifth determination result. The third master controller 115 sends the fifth determination result to the third slave controller 116.

[0207] The third slave controller 116 is configured to acquire the speed information sent by the safety driver 103 through the sixth input interface 126 and the seventh input interface 127, and determine whether the speed information acquired through the sixth input interface 126 is consistent with the speed information acquired through the seventh input interface 127. If the speed information acquired through the sixth input interface 126 is consistent with the speed information acquired through the seventh input interface 127, the third slave controller 116 determines, based on the speed information, whether the mobile device is in an abnormal situation, and obtains a sixth determination result. The third slave controller 116 sends the sixth determination result to the third master controller 115.

[0208] The third master controller 115 is further configured to determine whether the fifth determination result and the sixth determination result are the same. If the fifth determination result and the sixth determination result are the same and the determination result indicates that the mobile device is in an abnormal situation, the third master controller 115 outputs a control signal to the output module through the second output interface 132.

[0209] The third slave controller 116 is further configured to determine whether the fifth determination result and the sixth determination result are the same. If the fifth determination result and the sixth determination result are the same and the determination result indicates that the mobile device is in an abnormal situation, the third slave controller 116 acquires the control signal output by the third master controller 115, and determines whether the control signal determined based on the fifth determination result and the sixth determination result is consistent with the control signal output by the third master controller 115. If the control signal determined based on the fifth determination result and the sixth determination result is not consistent with the control signal output by the third master controller 115, the third slave controller 116 outputs an alarm signal to the output module through the second output interface 132, so that the output module shields the control signal output by the third master controller 115.

[0210] The processing module 1022 can include the third master controller 115, the third slave controller 116, the sixth input interface 126, the seventh input interface 127, and the second output interface 132. The third master controller 115 can acquire the speed information sent by the safety driver 103 from the sixth input interface 126 and the seventh input interface 127 through the electrical connection of the third master controller 115 with the sixth input interface 126 and the seventh input interface 127. The third master controller 115 determines whether the speed information acquired through the sixth input interface 126 is consistent with the speed information acquired through the seventh input interface 127. If the speed information acquired through the sixth input interface 126 is consistent with the speed information acquired through the seventh input interface 127, the third master controller 115 determines, based on the speed information, whether the mobile device is in an abnormal situation, and obtains a fifth determination result. After obtaining the fifth determination result, the third master controller 115 can send the fifth determination result to the third slave controller 116 through the electrical connection of the third master controller 115 with the third slave controller 116. If the speed information acquired through the sixth input interface 126 is not consistent with the speed information acquired through the seventh input interface 127, the third master controller 115 outputs an abnormal prompt information, so that the staff can confirm the speed information of the mobile device and check whether there is a program error in the related interface.

[0211] Similarly, the third slave controller 116 can obtain the speed information sent by the safety driver 103 from the sixth input interface 126 and the seventh input interface 127 through the electrical connection thereof with the sixth input interface 126 and the seventh input interface 127. It is judged whether the speed information obtained through the sixth input interface 126 is consistent with the speed information obtained through the seventh input interface 127; if consistent, it is judged based on the speed information whether the mobile device is in an abnormal situation, a sixth judgment result is obtained, and the third slave controller 116 can also send the sixth judgment result to the third master controller 115 through the electrical connection thereof with the third master controller 115 after obtaining the sixth judgment result; if inconsistent, an abnormal prompt information is outputted so as to facilitate the staff to confirm the speed information of the mobile device and check whether there is a program error in the relevant interface.

[0212] In this way, the third master controller 115 and the third slave controller 116 can obtain the judgment result of the speed information by itself and the judgment result of the speed information by the other controller, and the third master controller 115 can judge whether the two judgment results obtained by itself are the same after obtaining the two judgment results. If different, the third master controller 115 can output a prompt information so as to facilitate the staff to determine whether the mobile device is in an abnormal state.

[0213] Because the speed information is sent by the safety driver 103 to the processing module 1022, the safety driver 103 itself can determine whether the mobile device is in an abnormal situation according to the speed information, so when the third master controller 115 determines that the two judgment results obtained by itself are the same and the judgment result indicates that the mobile device is in an abnormal situation, the third master controller 115 can output only a control signal to the output module 1023 through the second output interface 132.

[0214] After acquiring two judgment results, the third slave controller 116 can also determine whether the two judgment results are the same. If they are different, the third slave controller 116 can output a prompt message to help staff determine whether the mobile device is in an abnormal state. If the third slave controller 116 determines that the two judgment results are the same and the judgment results indicate that the mobile device is in an abnormal state, then the third slave controller 116 can further determine whether the control signal output by the third master controller 115 is correct. Specifically, the third slave controller 116 acquires the control signal output by the third master controller 115 and determines whether the control signal determined based on the fifth and sixth judgment results is consistent with the acquired control signal output by the third master controller 115. If they are inconsistent, it indicates that the control signal output by the third master controller 115 may be incorrect. At this time, the third slave controller 116 outputs an alarm signal to the output module 1023 through the second output interface 132 so that the output module 1023 blocks the control signal output by the third master controller 115. At the same time, the third slave controller 116 can also output a prompt message to help relevant staff confirm the current status of the mobile device and detect whether there is a program error in the safety controller 102.

[0215] If the third slave controller 116 determines that the control signal determined based on the fifth and sixth determination results is consistent with the control signal output by the acquired third master controller 115, it may not perform any operation.

[0216] In the solution provided in this application embodiment, the processing module may include a third master controller and a third slave controller. The third master controller and the third slave controller can determine whether the mobile device is in an abnormal situation based on the speed information, and obtain a fifth judgment result and a sixth judgment result. Then, the third master controller and the third slave controller can determine whether the fifth judgment result and the sixth judgment result are the same. If they are different, it is very likely that one of the controllers has failed. At this time, a prompt message can be output. If they are the same, it is very likely that the third master controller and the third slave controller are operating normally. At this time, control commands can be output to the output module through the third output interface, ensuring the accuracy of motor control based on the safety signal. Furthermore, the third slave controller can further determine whether the control commands output by the third master controller are accurate to ensure safety.

[0217] As an implementation manner of the embodiment of the present application, as shown in FIG. 15, the output module includes a fourth master controller 117, a fourth slave controller 118, an eighth input interface 128, a third output interface 133 and a fourth output interface 134, the fourth master controller 117 and the fourth slave controller 118 are electrically connected with the eighth input interface 128, the third output interface 133 and the fourth output interface 134 respectively, and the fourth master controller 117 and the fourth slave controller 118 are electrically connected; the third output interface 133 and the fourth output interface 134 are electrically connected with different torque cut-off devices;

[0218] The fourth master controller 117 is configured to acquire the control signal input by the processing module 1022 through the eighth input interface 128, and send the control signal to the fourth slave controller 118.

[0219] The fourth slave controller 118 is configured to acquire the control signal input by the processing module 1022 through the eighth input interface, and send the control signal to the fourth master controller 117.

[0220] The fourth master controller 117 is further configured to determine whether the control signal input by the processing module 1022 and the control signal sent by the fourth slave controller 118 are same, and if same, output the cut-off signal to the torque cut-off device 106 through the third output interface 133 and the fourth output interface 134 respectively, so that the torque cut-off device 106 controls the motor 104 electrically connected with the torque cut-off device 106 to stop and open the motor brake based on the cut-off signal.

[0221] The fourth slave controller 118 is further configured to determine whether the control signal input by the processing module 1022 and the control signal sent by the fourth master controller 117 are same, and if same, acquire the cut-off signal output by the fourth master controller 117, determine whether the cut-off signal output by the fourth master controller 117 through the third output interface 133 and the cut-off signal output through the fourth output interface 134 are consistent, and determine whether the cut-off signal based on the control signal and the cut-off signal output by the fourth master controller 117 are consistent, and if inconsistent, output the alarm signal through the third output interface 133 and the fourth output interface 134 respectively, so that the torque cut-off device 106 shields the cut-off signal.

[0222] The output module 1023 can include a fourth master controller 117, a fourth slave controller 118, an eighth input interface 128, a third output interface 133, and a fourth output interface 134. The fourth master controller 117 can obtain the control signal input by the processing module 1022 from the eighth input interface 128 through the electrical connection between the fourth master controller 117 and the eighth input interface 128, and after obtaining the control signal, the fourth master controller 117 can send the control signal to the fourth slave controller 118 through the electrical connection between the fourth master controller 117 and the fourth slave controller 118. Similarly, the fourth slave controller 118 can also obtain the control signal input by the processing module 1022 from the eighth input interface 128 through the electrical connection between the fourth slave controller 118 and the eighth input interface 128, and after obtaining the control signal, the fourth slave controller 118 can also send the control signal to the fourth master controller 117 through the electrical connection between the fourth slave controller 118 and the fourth master controller 117.

[0223] In this way, the fourth master controller 117 and the fourth slave controller 118 can obtain the control signal obtained by themselves and the control signal sent by the other controller. After obtaining the two control signals, the fourth master controller 117 can determine whether the two control signals obtained by the fourth master controller 117 are the same. If they are the same, the fourth master controller 117 can turn off the signal to the torque off device 106 through the third output interface 133 and the fourth output interface 134, respectively, so that the torque off device 106 controls the motor 104 connected to the torque off device 106 to stop and open the motor brake based on the off signal. If they are different, the fourth master controller 117 can output a prompt message to enable the staff to detect whether there is an error in the program of the safety controller 102 and the related interface based on the prompt message.

[0224] After obtaining the two control signals, the fourth slave controller 118 can also determine whether the two control signals obtained by the fourth slave controller 118 are the same. If they are different, the fourth slave controller 118 can output a prompt message to enable the staff to detect whether there is an error in the program of the safety controller 102 and the related interface based on the prompt message.

[0225] If the fourth slave controller 118 judges that the two control signals obtained by it are the same, the fourth slave controller 118 can further judge whether the off signal output by the fourth master controller 117 is correct. Specifically, the fourth slave controller 118 can obtain the off signal output by the fourth master controller 117, and judge whether the off signal determined based on the control signal is consistent with the obtained off signal output by the fourth master controller 117. If not, it means that the off signal output by the fourth master controller 117 may have an error. At this time, in order to avoid the dangerous situation caused by the off signal output by the fourth master controller 117 may have an error, the fourth slave controller 118 can output an alarm signal through the third output interface 133 and the fourth output interface 134, so that each torque off 106 can shield the off signal.

[0226] The fourth slave controller 118 can not operate when judging whether the off signal determined based on the control signal is consistent with the obtained off signal output by the fourth master controller 117.

[0227] In the scheme provided by the embodiment of the application, the output module can include a fourth master controller and a fourth slave controller. The fourth master controller and the fourth slave controller can respectively judge whether the control signal obtained by the input interface and the control signal sent by another controller to itself are the same. If they are the same, it means that the input interface can normally receive the control signal output by the outside world. Then the fourth master controller and the fourth slave controller can output an off signal through the fourth output interface, so as to control the motor to stop and brake through the torque off and the motor brake, thereby ensuring the accuracy of the motor control. In addition, the fourth slave controller can further judge whether the safety signal output by the fourth master controller is accurate, so as to ensure safety.

[0228] The following will take FIG. 16-FIG. 17 as an example to introduce the motor safety control circuit provided by the embodiment of the application.

[0229] As shown in FIG. 16, the mobile device can include a plurality of differential wheel sets, each differential wheel set including one driving wheel set and two motors, the driving wheel set being movable in each direction under the driving of the two motors. The two motors in each differential wheel set are driven by one safety driver in one-to-two mode, and the number of safety drivers included in the motor safety control circuit is the same as the number of differential wheel sets. Each safety driver includes a torque off and two interfaces STO1 and STO2 for receiving a shutdown signal, and the torque off is electrically connected to the two motors in the differential wheel set and the motor brake electrically connected to each motor, i.e., the torque off of safety driver 1 is electrically connected to motor 1, motor brake 1, motor 2 and motor brake 2, respectively; the torque off of safety driver 2 is electrically connected to motor 3, motor brake 3, motor 4 and motor brake 4, respectively. The safety driver supplies power to the motor and the motor brake after converting the power, so that the power supply of the motor and the motor brake is the power supply converted by the safety driver, and the torque off is used to control the on-off of the power supply circuit of the power supply.

[0230] The safety input device can include a plurality of non-contact devices such as laser radars and a plurality of contact devices such as buttons, i.e., laser 1 to laser N and button 1 to button N. When the safety input device detects an obstacle around the mobile device or obtains an externally triggered stop instruction, it can send a safety signal to the input module in the safety controller, and the input module can communicate with the processing module of the safety controller after receiving the safety signal, and send the safety signal to the processing module to determine whether the mobile device is in an abnormal situation based on the safety signal. The processing module of the safety controller, safety driver 1 and safety driver 2 can also include two communication channels communication 1 and communication 2 for communication, and the safety controller can send a driving signal to the safety driver through communication 1 and communication 2, and the safety driver can feed back motor speed information to the safety controller through communication 1 and communication 2.

[0231] When the processing module determines that the mobile device is in an abnormal situation based on the safety signal, the processing module can communicate with the output module of the safety controller and send a control signal to the output module. After receiving the control signal, the output module can send a shutdown signal to the interface STO1 of each safety driver through the OUT1 interface and send a shutdown signal to the interface STO2 of each safety driver through the OUT2 interface, so that the interface STO1 and the interface STO2 synchronously receive the shutdown signal and transmit the received shutdown signal to the torque shutdown device, so that the torque shutdown device disconnects the power supply of the motor and the motor brake to which it is electrically connected, controls the motor to which it is electrically connected to stop and opens the motor brake, that is, the torque shutdown device of the safety driver 1 simultaneously shuts down the power supply of the motor 1, the motor brake 1, the motor 2 and the motor brake 2, and synchronously controls the motor 1 and the motor 2 to stop and open the motor brake; the torque shutdown device of the safety driver 2 simultaneously shuts down the power supply of the motor 3, the motor brake 3, the motor 4 and the motor brake 4, and synchronously controls the motor 3 and the motor 4 to stop and open the motor brake. Moreover, when the safety driver receives the shutdown signal, the safety driver can output a brake driving signal through the motor brake driving output and output a winding closing signal through the motor winding driving output to close the motor winding and open the motor brake, that is, the safety driver 1 can close the winding of the motor 1 through the motor winding driving A and open the motor brake 1 through the motor brake driving A, so that the motor 1 stops and opens the motor brake; the safety driver 2 can close the winding of the motor 2 through the motor winding driving B and open the motor brake 2 through the motor brake driving B, so that the motor 2 stops and opens the motor brake; the safety driver 2 can close the winding of the motor 3 through the motor winding driving A and open the motor brake 3 through the motor brake driving A, so that the motor 3 stops and opens the motor brake; and the safety driver 2 can close the winding of the motor 4 through the motor winding driving B and open the motor brake 4 through the motor brake driving B, so that the motor 4 stops and opens the motor brake.

[0232] Each motor can also be provided with 2 motor encoders, i.e., motor encoder 1 and motor encoder 2, each of which can detect the speed information of the motor and send the speed information to the safety driver, and the safety driver can determine whether the speed of each motor is abnormal based on the encoder inputs of each encoder, i.e., the safety driver 1 can determine whether the speed of motor 1 is abnormal based on the encoder input A1 of the motor encoder 1 of motor 1 and the encoder input A2 of the motor encoder 2, the safety driver 1 can determine whether the speed of motor 2 is abnormal based on the encoder input B1 of the motor encoder 1 of motor 2 and the encoder input B2 of the motor encoder 2, the safety driver 2 can determine whether the speed of motor 3 is abnormal based on the encoder input A1 of the motor encoder 1 of motor 3 and the encoder input A2 of the motor encoder 2, and the safety driver 2 can determine whether the speed of motor 4 is abnormal based on the encoder input B1 of the motor encoder 1 of motor 4 and the encoder input B2 of the motor encoder 2.

[0233] The internal structure of the safety driver is shown in FIG. 17, which includes shutdown signal interfaces STO1 and STO2, power supply, voltage reduction module, switch, main controller, slave controller, two-way communication channels communication 1 and communication 2 for communication with the safety controller, brake drive A, winding drive A, brake drive B, and winding drive B. Among them, the torque shutdown includes a switch and a controller. The main controller and the slave controller can respectively receive the shutdown signals sent by the safety processor from STO1 and STO2, communication 1 and communication 2 can respectively receive the communication data sent by the safety controller, the speed information of motor A sent by encoder A1 and encoder A2 of motor A, and the speed information of motor B sent by encoder B1 and encoder B2 of motor B, and check the data received by itself and the data received by the other controller through interaction, and then make control decisions.

[0234] Specifically, after receiving the speed information, the safety driver can determine whether the mobile device is in an abnormal situation based on the speed information through the main controller and the slave controller, if the mobile device is in an abnormal situation, the motor can be stopped and the motor brake can be opened through the switch in the torque shutdown, the motor brake drive, and the motor winding drive. Moreover, after receiving the speed information, the safety driver can also send the speed information to the processing module of the safety processor through the two-way communication channel, so that the processing module determines whether the mobile device is in an abnormal situation based on the speed information, if the processing module determines that the mobile device is in an abnormal situation, the processing module can send a control signal to the output module. The output module outputs a shutdown signal to the interface STO1 and the interface STO2 of each safety driver through OUT1 and OUT2 based on the control signal, so that the torque shutdown receives the shutdown signal, cuts off the power supply of the motor and the motor brake, controls the motor to stop and opens the motor brake.

[0235] In the scheme provided by the embodiment of the application, the motor safety control circuit can control the motor to stop and brake when the safety input device detects an obstacle around the mobile device, or when the safety input device acquires an externally triggered stop instruction, or when the motor encoder collects an abnormal speed of the motor, so that the mobile device is safely stopped. Moreover, the safety driver in the motor safety control circuit and the torque off device in the safety controller can respectively control the motor to stop and brake through their respective control modes when the mobile device is in an abnormal condition, so that the double insurance of motor braking is realized, and the success rate of controlling the motor to stop is ensured.

[0236] Corresponding to the motor safety control circuit, the embodiment of the application further provides a motor safety control method, which is described below.

[0237] The motor safety control method provided by the embodiment of the application can be applied to the torque off device in the safety driver in the motor safety control circuit described in any of the above embodiments, and the motor is used to drive the mobile device to move; the mobile device comprises a differential wheel set, two motors in the differential wheel set are respectively electrically connected to the torque off device in the safety driver, and the motor brake electrically connected to each motor is respectively electrically connected to the torque off device; the method comprises:

[0238] receiving the off signal input by the safety controller, controlling the motor electrically connected to the torque off device to stop, and opening the motor brake, wherein the off signal is output by the safety controller in the motor safety control circuit to the torque off device when the mobile device is in an abnormal condition.

[0239] The drive wheels in the differential wheel set of the mobile device are driven by two motors, and when it is desired to stop the device, the two motors in the differential wheel set need to be controlled at the same time, so that the drive wheels driven by the two motors can be stopped. Based on this, the two motors are respectively electrically connected to the torque off device of the safety driver, and the motor brake electrically connected to each motor is respectively electrically connected to the torque off device. In this way, when the safety controller in the motor safety control circuit detects that the mobile device is in an abnormal condition, the safety controller can send an off signal to the torque off device, the torque off device receives the off signal, and controls the motor electrically connected to the torque off device to stop and opens the motor brake by disconnecting the power supply of the motor and the motor brake electrically connected to the torque off device. In this way, one torque off device can control the two motors in the differential wheel set to brake at the same time, so that the control efficiency is improved while the mobile device is safely parked.

[0240] For example, when the safety controller determines that the mobile device is in an abnormal situation based on the safety input device input safety signal, only the torque off device can receive the off signal from the safety controller, the torque off device can receive the off signal input by the safety controller, control the motor connected to the torque off device to stop and open the motor brake.

[0241] When the safety controller determines that the mobile device is in an abnormal situation based on the speed information input by the safety driver, because the safety driver has determined whether the mobile device is in an abnormal situation according to the speed information at the same time when sending the speed information to the safety controller, and will control the motor to stop and open the motor brake when the mobile device is in an abnormal situation. In order to avoid the safety driver from not controlling the motor in time due to equipment failure, when the safety controller receives the speed information and determines that the mobile device is in an abnormal situation based on the speed information, the torque off device can receive the off signal, the torque off device can receive the off signal input by the safety controller, control the motor connected to the torque off device to stop and open the motor brake.

[0242] In the scheme provided by the embodiment of the application, because the two motors of the differential wheel set in the mobile device and the motor brake electrically connected to each motor are electrically connected to the torque off device, when the mobile device is in an abnormal situation, the two motors of the differential wheel set can be synchronously controlled to stop and the motor brake can be synchronously opened by the torque off device, so that the movement of the driving wheel of the mobile device is controlled to stop by synchronously controlling each motor to stop and brake, and the mobile device is controlled to stop safely. Moreover, the torque off device can quickly respond to control each motor to stop and open the motor brake in time, thereby improving the control efficiency of the mobile device.

[0243] Corresponding to the above motor safety control circuit, the embodiment of the application further provides a mobile device, which will be introduced below.

[0244] A mobile device, the mobile device comprising the motor safety control circuit of any of the above embodiments and at least one differential wheel set.

[0245] In the scheme provided by the embodiment of the application, because the two motors of the differential wheel set in the mobile device and the motor brake electrically connected to each motor are electrically connected to the torque off device, when the mobile device is in an abnormal situation, the two motors of the differential wheel set can be synchronously controlled to stop and the motor brake can be synchronously opened by the torque off device, so that the movement of the driving wheel of the mobile device is controlled to stop by synchronously controlling each motor to stop and brake, and the mobile device is controlled to stop safely. Moreover, the torque off device can quickly respond to control each motor to stop and open the motor brake in time, thereby improving the control efficiency of the mobile device.

[0246] The mobile device can further include a processor, a communication interface, and a memory, which communicate with each other through a communication bus.

[0247] The communication bus of the electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0248] The communication interface is used for communication between the electronic device and other devices.

[0249] The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0250] The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc. It can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0251] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; thus the use of any

[0252] Each of the embodiments in the present specification is described in a related manner, and the same or similar parts among the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the method and mobile device embodiments, since they are basically similar to the circuit embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0253] The above description is merely the preferred embodiments of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

A motor safety control circuit, characterized in that, The motor safety control circuit comprises a power supply, a safety controller, a safety driver and a motor, the motor is provided with a motor brake, the safety driver is provided with a torque shutdown device, wherein: The safety driver is electrically connected with the power supply, the safety controller, the motor and the motor brake respectively; the motor is used for driving a mobile device to move; the mobile device comprises a differential wheel set, two motors in the differential wheel set are electrically connected with the torque shutdown device respectively, and the motor brakes electrically connected with each motor are electrically connected with the torque shutdown device respectively; The safety controller is used for outputting a shutdown signal to the torque shutdown device when the mobile device is in an abnormal situation; The torque shutdown device is used for receiving the shutdown signal input by the safety controller, controlling the motor electrically connected with the torque shutdown device to stop, and opening the motor brake. The circuit according to claim 1, characterized in that The safety driver comprises a motor winding drive and a motor brake drive, the motor winding drive is electrically connected with the motor, and the motor brake drive is electrically connected with the motor brake; The torque shutdown device is specifically used for closing the power supply of the motor and the motor brake electrically connected with the torque shutdown device when receiving the shutdown signal sent by the safety controller; The safety driver is used for sending a winding closing signal to the motor winding drive to make the motor winding drive close the motor winding and sending a brake drive signal to the motor brake drive to make the motor brake drive open the motor brake when receiving the shutdown signal. The circuit according to claim 1, characterized in that The shutdown signal is I / O data. The circuit according to claim 1, characterized in that The motor is further provided with a motor encoder, and the motor encoder is electrically connected with the safety driver; The motor encoder is used for detecting speed information of the motor and sending the speed information to the safety driver; The safety driver is specifically used for receiving the speed information sent by the motor encoder and outputting a shutdown signal to the torque shutdown device to make the torque shutdown device control the motor electrically connected with the torque shutdown device to stop and open the motor brake of each motor when determining that the mobile device is in an abnormal situation based on the speed information; The safety driver is further used for sending the speed information to the safety controller; The safety controller is further used for receiving the speed information and outputting a shutdown signal to the torque shutdown device when determining that the mobile device is in an abnormal situation based on the speed information; The torque shutdown device is further used for receiving the shutdown signal sent by the safety controller, judging whether the motor electrically connected with the torque shutdown device has stopped and opened the motor brake, and controlling the motor electrically connected with the torque shutdown device to stop and open the motor brake if not. The circuit according to any one of claims 1-4, characterized in that The mobile device comprises at least one differential wheel set, the number of the safety drivers is the same as the number of the differential wheel sets, and two motors in each differential wheel set are electrically connected with a safety driver. The circuit according to claim 5, characterized in that The motor safety control circuit further comprises a safety input device, and the safety input device is electrically connected with the safety controller. The safety input device is configured to send a safety signal to the safety controller when an obstacle around the mobile device is detected or a stop instruction triggered by an external object is obtained. The safety controller is configured to receive the safety signal sent by the safety input device, and output a shutdown signal to the torque shutdown device when it is determined that the mobile device is in an abnormal situation based on the safety signal. The circuit according to claim 5, characterized in that The safety driver further includes a low-side control switch. The power supply is electrically connected to the motor through the high-side control switch, and the low-side control switch is electrically connected to the motor and grounded. The safety driver is configured to disconnect the high-side control switch and / or turn off the low-side control switch to control the motor to stop when the shutdown signal is received. The circuit according to claim 5, characterized in that The power supply is electrically connected to the motor brake through the high-side control switch, and the low-side control switch is electrically connected to the motor brake and grounded. The safety driver is configured to disconnect the high-side control switch and / or turn on the motor brake when the shutdown signal is received. The circuit according to claim 5, characterized in that The safety driver includes a first master controller, a first slave controller, a first input interface, a second input interface, a high-side control switch, a motor winding drive, and a motor brake drive. The first master controller and the first slave controller are electrically connected to the first input interface, the second input interface, the high-side control switch, the motor winding drive, and the motor brake drive. The first master controller and the first slave controller are electrically connected. The first master controller is configured to obtain the shutdown signal input by the safety controller through the first input interface and the second input interface, and determine whether the shutdown signal obtained through the first input interface is consistent with the shutdown signal obtained through the second input interface. If they are consistent, the shutdown signal is sent to the first slave controller. The first slave controller is configured to obtain the shutdown signal input by the safety controller through the first input interface and the second input interface, and determine whether the shutdown signal obtained through the first input interface is consistent with the shutdown signal obtained through the second input interface. If they are consistent, the shutdown signal is sent to the first master controller. The first master controller is further configured to determine whether the shutdown signal input by the safety controller and the shutdown signal sent by the first slave controller are the same. If they are the same, a disconnection instruction is output to the high-side control switch to disconnect the high-side control switch, so that the motor electrically connected to the high-side control switch stops and the motor brake is turned on. A winding closing signal is output to the motor winding drive to close the motor winding, and a brake drive signal is output to the motor brake drive to open the motor brake. The first slave controller is further configured to determine whether the obtained shutdown signal of the safety controller input is same as the shutdown signal sent by the first master controller, and if so, to obtain the disconnection instruction, the winding shutdown signal and the brake drive signal output by the first master controller, and to determine whether the disconnection instruction, the winding shutdown signal and the brake drive signal determined based on the obtained shutdown signal of the safety controller input and the shutdown signal sent by the first master controller are respectively same as the obtained disconnection instruction, the winding shutdown signal and the brake drive signal output by the first master controller, and if there is an inconsistent signal, to output an alarm signal to the high-side control switch, the motor winding drive and the motor brake drive, so that the high-side control switch shields the disconnection instruction output by the first master controller, the motor winding drive shields the winding shutdown signal output by the first master controller, and the motor brake drive shields the brake drive signal output by the first master controller. The circuit according to claim 5, characterized in that The safety driver comprises a first master controller, a first slave controller, a third input interface, a high-side control switch, a motor winding drive and a motor brake drive, the first master controller and the first slave controller are electrically connected with the third input interface, the high-side control switch, the motor winding drive and the motor brake drive respectively, and the first master controller and the first slave controller are electrically connected; the torque shutdown device comprises the first master controller, the first slave controller and the high-side control switch; The first master controller is configured to obtain speed information input from outside through the third input interface, determine whether the mobile device is in an abnormal situation based on the speed information, and obtain a first determination result, and send the first determination result to the first slave controller; The first slave controller is configured to obtain speed information input from outside through the third input interface, determine whether the mobile device is in an abnormal situation based on the speed information, and obtain a second determination result, and send the second determination result to the first master controller; The first master controller is further configured to determine whether the first determination result and the second determination result are same, and if so and the determination result indicates that the mobile device is in an abnormal situation, to output a disconnection instruction to the high-side control switch to disconnect the high-side control switch, so that the motor electrically connected with the high-side control switch is stopped and the motor brake is opened, output a winding shutdown signal to the motor winding drive to close the motor winding, and output a brake drive signal to the motor brake drive to open the motor brake. The first slave controller is further configured to determine whether the first determination result and the second determination result are same, and if yes and the determination result indicates that the mobile device is in an abnormal situation, acquire the disconnect instruction, the winding closing signal and the brake driving signal output by the first master controller, and determine whether the disconnect instruction, the winding closing signal and the brake driving signal determined based on the first determination result and the second determination result are same as the disconnect instruction, the winding closing signal and the brake driving signal output by the first master controller, respectively, and if not, output an alarm signal to the high-side control switch, the motor winding driver and the motor brake driving, so that the high-side control switch shields the disconnect instruction output by the first master controller, the motor winding driver shields the winding closing signal output by the first master controller, and the motor brake driving shields the brake driving signal output by the first master controller. The circuit according to claim 5, characterized in that The safety controller comprises an input module, a processing module and an output module, the processing module is electrically connected with the input module, the safety driver and the output module respectively, and the output module is electrically connected with the safety driver; The input module is configured to acquire an external input safety signal and send the safety signal to the processing module; The processing module is configured to receive the safety signal and speed information sent by the safety driver, and send a control signal to the output module when it is determined that the mobile device is in an abnormal situation based on the safety signal or the speed information; The output module is configured to receive the control signal sent by the processing module, and output a shutdown signal to the torque shutdown device when it is determined that the control signal indicates that the mobile device stops, so that the torque shutdown device controls the motor connected thereto to stop and open the motor brake when the shutdown signal is received. The circuit according to claim 11, characterized in that The input module comprises a second master controller, a second slave controller, a fourth input interface and a first output interface, the second master controller and the second slave controller are electrically connected with the fourth input interface and the first output interface respectively, and the second master controller and the second slave controller are electrically connected; The second master controller is configured to acquire an external input safety signal through the fourth input interface and send the safety signal to the second slave controller; The second slave controller is configured to acquire an external input safety signal through the fourth input interface and send the safety signal to the second master controller; The second master controller is further configured to determine whether the acquired external input safety signal and the safety signal sent by the second slave controller are same, and if yes, output the safety signal to the processing module through the first output interface; The second slave controller is further configured to determine whether the obtained external input safety signal is same as the safety signal sent by the second master controller, and if so, to obtain the safety signal output by the second master controller and determine whether the obtained external input safety signal is consistent with the obtained safety signal output by the second master controller; and if not, to output an alarm signal to the processing module through the first output interface, so as to make the processing module shield the safety signal output by the second master controller. The circuit according to claim 11, characterized in that The processing module comprises a third master controller, a third slave controller, a fifth input interface and a second output interface, the third master controller and the third slave controller are electrically connected with the fifth input interface and the second output interface respectively, and the third master controller and the third slave controller are electrically connected; The third master controller is configured to obtain the safety signal input by the input module through the fifth input interface, determine whether the mobile device is in an abnormal situation based on the safety signal, obtain a third determination result, and send the third determination result to the third slave controller; The third slave controller is configured to obtain the safety signal input by the input module through the fifth input interface, determine whether the mobile device is in an abnormal situation based on the safety signal, obtain a fourth determination result, and send the fourth determination result to the third master controller; The third master controller is further configured to determine whether the third determination result is same as the fourth determination result, and if so and the determination result indicates that the mobile device is in an abnormal situation, to output a control signal to the output module through the second output interface; The third slave controller is further configured to determine whether the third determination result is same as the fourth determination result, and if so and the determination result indicates that the mobile device is in an abnormal situation, to obtain the control signal output by the third master controller and determine whether the control signal determined based on the third determination result and the fourth determination result is consistent with the obtained control signal output by the third master controller, and if not, to output an alarm signal to the output module through the second output interface, so as to make the output module shield the control signal output by the third master controller. The circuit according to claim 11, characterized in that The processing module comprises a third master controller, a third slave controller, a sixth input interface, a seventh input interface and a second output interface, the third master controller and the third slave controller are electrically connected with the sixth input interface, the seventh input interface and the second output interface respectively; The third master controller is configured to obtain the speed information sent by the safety driver through the sixth input interface and the seventh input interface, determine whether the speed information obtained through the sixth input interface is consistent with the speed information obtained through the seventh input interface, and if so, determine whether the mobile device is in an abnormal situation based on the speed information, obtain a fifth determination result, and send the fifth determination result to the third slave controller; The third slave controller is configured to acquire speed information sent by the safety driver through the sixth input interface and the seventh input interface, determine whether the speed information acquired through the sixth input interface is consistent with the speed information acquired through the seventh input interface, if consistent, determine whether the mobile device is in an abnormal situation based on the speed information, obtain a sixth determination result, and send the sixth determination result to the third master controller; The third master controller is further configured to determine whether the fifth determination result and the sixth determination result are the same, and if the same and the determination result indicates that the mobile device is in an abnormal situation, output the control signal to the output module through the second output interface; The third slave controller is further configured to determine whether the fifth determination result and the sixth determination result are the same, and if the same and the determination result indicates that the mobile device is in an abnormal situation, acquire the control signal output by the third master controller, and determine whether the control signal determined based on the fifth determination result and the sixth determination result is consistent with the control signal acquired from the third master controller; If not consistent, output an alarm signal to the output module through the second output interface, so that the output module shields the control signal output by the third master controller. The circuit according to claim 11, characterized in that The output module comprises a fourth master controller, a fourth slave controller, an eighth input interface, a third output interface and a fourth output interface, the fourth master controller and the fourth slave controller are electrically connected with the eighth input interface, the third output interface and the fourth output interface respectively, and the fourth master controller and the fourth slave controller are electrically connected; the third output interface and the fourth output interface are electrically connected with different torque cut-off devices; The fourth master controller is configured to acquire the control signal input by the processing module through the eighth input interface, and send the control signal to the fourth slave controller; The fourth slave controller is configured to acquire the control signal input by the processing module through the eighth input interface, and send the control signal to the fourth master controller; The fourth master controller is further configured to determine whether the control signal input by the processing module and the control signal sent by the fourth slave controller are the same; if the same, output a cut-off signal to the torque cut-off device through the third output interface and the fourth output interface respectively, so that the torque cut-off device controls the motor electrically connected with the torque cut-off device to stop and start the motor brake based on the cut-off signal; The fourth slave controller is further configured to determine whether the control signal input by the processing module and the control signal sent by the fourth master controller are the same; if the same, acquire the cut-off signal output by the fourth master controller, determine whether the cut-off signal output by the fourth master controller through the third output interface is consistent with the cut-off signal output through the fourth output interface, and determine whether the cut-off signal determined based on the control signal is consistent with the cut-off signal acquired from the fourth master controller; If there is inconsistency, an alarm signal is output through the third output interface and the fourth output interface respectively, so that the torque off device shields the off signal. A method for safety control of an electric machine, characterized in that The method is applied to the torque off device in the safety driver of the motor safety control circuit in any one of claims 1-15, the motor is used to drive the movement of the mobile device; the mobile device comprises a differential wheel set, two motors in the differential wheel set are respectively electrically connected with the torque off device, and the motor brake electrically connected with each motor is respectively electrically connected with the torque off device; the method comprises: Receiving the off signal input by the safety controller, controlling the motor electrically connected with the torque off device to stop, and opening the motor brake, wherein the off signal is output by the safety controller in the motor safety control circuit to the torque off device when the mobile device is in an abnormal condition. A mobile device, characterized in that The mobile device comprises the motor safety control circuit in any one of claims 1-15 and at least one differential wheel set.

Images