Failsafe control system

Abstract

A failsafe control system comprises a control circuit portion (23) including a controller (19), an actuator circuit portion (25) including a driver (17) and a monitor circuit (35), a first insulator circuit (27), and a second insulator circuit (39). The controller generates a control signal for driving actuators (11) and (13), and generates a monitor signal. The first insulator circuit translates the control signal. The second insulator circuit translates the monitor signal. The monitor circuit monitors receipt of the translated monitor signal, and outputs a stop signal to the driver if the second monitor signal is not received. The driver drives the actuator based on the translated control signal, and stops driving the actuators when the stop signal is received.

Description

FAILSAFE CONTROL SYSTEM

[0001] The present disclosure relates to failsafe control systems.

[0002] Control systems are used to control the operation of actuators, such as motors, magnets, hydraulic pistons and the like, wherein plural actuators can be combined with mechanical structures so that the control system can control the operation of complex apparatuses, such as machines used for manufacturing, vehicles, such as trains, and robots, for example, and other types of apparatuses.

[0003] Some of the apparatuses controlled by control systems must be operated such that safety considerations are taken into account. For example, a machine may harm an operator or a user of the machine, or it may cause damage to objects located in an environment of the machine, if the machine is not properly controlled or if some fault occurs.

[0004] Failsafe control systems have been developed which perform the necessary control operations while monitoring the control operation in order to detect the occurrence of faults, and which, if a fault is detected, control the actuators such that the apparatus driven by the actuators is stopped and assumes state which is regarded as a safe state potentially not harming persons or damaging objects.

[0005] PTL 1 discloses and discusses various architectures of failsafe control systems. Still, the failsafe control systems known from PTL 1 show control and safety issues in certain situations, such as situations in which an overvoltage affects the control and monitoring operations.

[0006] United States patent specification US 10,209,681 B2

[0007] It has been found that failsafe control systems known from the related art show deficiencies in certain situations, such as situations where an overvoltage occurs and affects components of the system such that they do not operate properly.

[0008] The present disclosure has been made in view of the above, and it is an object of the present disclosure to provide a failsafe control system offering improved safety in a wider range of situations.

[0009] In order to solve the above described problems and achieve the object, a failsafe control system according to the present disclosure comprises a control circuit portion including a controller, and an actuator circuit portion including a driver and a monitor circuit. The failsafe control system further comprises a first insulator circuit and a second insulator circuit. The controller may be a controller including a microprocessor, a microcomputer, a digital signal processor (DSP), or the like. The controller is configured to generate a control signal for driving at least one actuator. The driver receives the control signal and drives the at least one actuator based on the control signal. The at least one actuator can be any actuator used to operate an apparatus. For example, the at least one actuator may include an electric motor, a magnet, an electric switch, a hydraulic piston, a light source, such as a laser, or the like.

[0010] According to some embodiments, the first insulator circuit is configured to translate the control signal received from the controller into a control signal provided to the driver. According to some embodiments, the first insulator circuit has an input connected to the controller to receive the control signal from the controller, and it has an output connected to the driver to supply the translated control signal to the driver. Moreover, the insulator circuit provides electric insulation between its input and its output, wherein an electrical resistance between the input and the output is high. In particular, intentional galvanic connections between the input and the output of the first insulator circuit are not provided and do not exist. For example, an electric resistance between the input and the output of the first insulator circuit is greater than 1 MΩ, greater than 10 MΩ, or greater than 100 MΩ.

[0011] It is a function of the first insulator circuit to allow the supply of the control signal generated by the controller to the driver of the at least one actuator while, at the same time, electrically insulating the driver which is a member of the actuator circuit portion from the controller which is a member of the control circuit portion. An overvoltage occurring at the controller or some other member of the control circuit portion is prevented, by the first insulator circuit, from reaching the driver of the at least one actuator via the line used for supplying the control signal from the controller to the driver.

[0012] According to some embodiments, the controller further generates a monitor signal which is provided to the monitor circuit via the second insulator circuit. The monitor signal is generated by the controller such that the monitor signal indicates that the controller is working as intended. The monitor signal is monitored by the monitor circuit. The monitor circuit analyzes the received monitor signal and determines whether or not the received monitor signal fulfills an expected pattern. If the monitor signal fulfills the expected pattern, this is indicative of the fact that the controller is working according to its specifications and that it can be expected that the controller is also able to generate the control signal for driving the at least one actuator according to its specification. If the monitor signal does not fulfill the expected pattern, it can be assumed that the controller is not working properly and is not able to control the at least one actuator as intended, so that a safety risk may occur. If the monitor circuit does not receive the monitor signal fulfilling the expected pattern, the monitor circuit outputs a stop signal to the driver.

[0013] According to some embodiments, the driver is configured to drive the at least one actuator based on the control signal received from the controller via the first insulator circuit, and the driver is further configured to stop driving the at least one actuator when the stop signal is received from the monitor circuit. Therefore, if it is determined by the monitor circuit that the controller might not work properly, the driving of the at least one actuator is stopped in order to prevent harm to persons or damage to objects. Moreover, the driver can be configured to drive the at least one actuator such that a machine operated by the at least one actuator assumes a predefined resting state.

[0014] According to some embodiments, the second insulator circuit has an input connected to the controller to receive the monitor signal, and an output connected to the monitor circuit to supply the monitor signal to the monitor circuit. Herein, the second insulator circuit may have similar insulating properties as illustrated above with respect to the first insulator circuit. Specifically, an electric resistance between the input and the output of the second insulator circuit can be greater than 1 MΩ, 10 MΩ, or 100 MΩ and there is no galvanic connection between the input and the output of the second insulator circuit.

[0015] According to some embodiments, the failsafe control system is free of any galvanic connection between the control circuit portion and the actuator circuit portion. In particular, an electric resistance between the control circuit portion and the actuator circuit portion can be greater than 500 kΩ, greater than 5 MΩ, and in particular greater than 50 MΩ. An overvoltage occurring at one of the components of the control circuit portion is therefore insulated from the actuator circuit portion so that the driver controlling the at least one actuator is not damaged by the overvoltage occurring at the control circuit portion. The signals to be transmitted from the control circuit portion to the actuator circuit portion, i.e., the control signal and the monitor signal, are transferred via the first and second insulator circuits, respectively. The first and second insulator circuits provide sufficient insulating properties between their inputs and their outputs and are configured to translate signals received at their respective input to corresponding signals at their respective outputs while still maintaining the insulation properties to protect the actuator circuit portion including the driver from an overvoltage occurring at components of the control circuit portion.

[0016] According to some embodiments, the first and second insulator circuits may use optical coupling, inductive coupling, capacitive coupling and / or magnetic coupling to translate signals received at the input into signals outputted at the output.

[0017] According to some embodiments, the monitor signal is generated by the controller such that it is a time-dependent signal which changes over time according to a predefined pattern. The monitor circuit may then analyze the received monitor signal to determine whether the expected monitor signal fulfilling the predetermined pattern is received or not. In particular, if the received signal does not change over time and is a constant signal, it can be concluded that the controller does not work properly and may no longer generate the monitor signal fulfilling the predefined pattern, so that the monitor circuit may output the stop signal. The predefined pattern may be defined such that it is fulfilled if the voltage or current of the electric signal is greater than a first signal value during repeating first time periods and smaller than a second signal value during repeating second time periods alternating with the first time periods, and wherein the first and second time periods are shorter than a predetermined duration. The predetermined duration can be shorter than 10 seconds, shorter than 1 second, or shorter than 0.1 second. The monitor signal fulfilling the predefined pattern can be an alternating periodic signal, for example.

[0018] According to some embodiments herein, the monitor circuit is configured to output the stop signal when the monitor signal received via the second insulator circuit does not change from a predetermined first value to a predetermined second value within a predetermined duration of time.

[0019] The failsafe control system according to the present disclosure achieves an effect of protecting the driver of the actuator from an overvoltage possibly occurring on the side of the controller, and of monitoring whether the controller is working properly.

[0020] Figure 1 is a schematic diagram illustrating a failsafe control system according to an embodiment.Figure 2 is a graph of a monitor signal generated in the failsafe control system shown in figure 1.Figure 3 is a graph illustrating an example of changes in various signals associated with an occurrence of abnormal ON.Figure 4 is a block diagram illustrating a failsafe control system according to a modification.Figure 5 is a graph illustrating an example of changes in various signals associated with an occurrence of abnormal ON in the failsafe control system according to the modification.Figure 6 is a graph illustrating an example of changes in various signals in a case where the control signal changes from a value indicating ON to a value indicating OFF.

[0021] Hereinafter, failsafe control systems according to embodiments will be described in detail with reference to the drawings. Figure 1 is a schematic diagram illustrating a failsafe control system 1 according to an embodiment.

[0022] The failsafe control system 1 is configured to control a machine 3. In the present embodiment, the machine 3 is a hydraulic press having a frame 5 supporting a bolster plate 7 and a movable ram 9. An actuator 11 is mounted on the frame 5 to move the ram 9 towards the bolster plate 7 to deform an object 12 arranged between the ram 9 and the bolster plate 7, and an actuator 13 is provided to move the ram 9 in the opposite direction to release the object 12. In the present embodiment, the actuators 11 and 13 can be hydraulic pistons.

[0023] The actuators 11 and 13 are driven by a driver 17 based on control signals generated by a controller 19. The controller 19 may be embodied by a microcomputer comprising a processor and a memory storing a program which, when executed by the processor, generates the control signals for the driver 17 such that the driver 17 controls the actuators 11 and 13 such that the machine 3 performs desired operations. The controller 19 is connected to a communication interface 21 which is connected to a network not shown in Figure 1, such as a wired network or a wireless network. In particular, the controller 19 has a command input terminal 22 connected to the communication interface 21 to receive the program to be loaded into the memory of the controller 19 and to receive commands controlling the controller 19.

[0024] The controller 19 and the communication interface 21 are components of a control circuit portion 23, while the driver 17 is a component of an actuator circuit portion 25. The control circuit portion 23 and the actuator circuit portion 25 are electrically insulated from each other. The insulation between the control circuit portion 23 and the actuator circuit portion 25 is provided in order to prevent that an overvoltage which occurs for some unexpected reason at a component of the control circuit portion 23 is transmitted to the driver 17 controlling the actuators 11 and 13 of the machine 3. Due to this insulation, the driver 17 will not be damaged by the overvoltage occurring at components of the control circuit portion 23 and possibly damaging these components.

[0025] The insulation between the control circuit portion 23 and the actuator circuit portion 25 can be provided such that an electric resistance between the control circuit portion 23 and the actuator circuit portion 25 is greater than 500 kΩ, greater than 5 MΩ, or greater than 50 MΩ. Moreover, the insulation can be configured such that it can withstand a high voltage, such as a voltage greater than 1 kV, greater than 2 kV, greater than 5 kV, or more, for a predetermined duration, such as a duration of one minute or more. Each of the control circuit portion 23 and the actuator circuit portion 25 has a suitable power supply not shown in Figure 1.

[0026] The control signal generated by the controller 19 is transmitted to the driver 17 via a first insulator circuit 27 configured to translate the control signal generated by the controller 19 into a corresponding control signal received by the driver 17. For this purpose, the first insulator circuit 27 has an input terminal 28 electrically connected to a control signal output terminal 29 of the controller 19. Moreover, the first insulator circuit 27 has an output terminal 30 electrically connected to a control signal input terminal 31 of the driver 17. There is no galvanic connection between the input terminal 28 and the output terminal 30 of the first insulator circuit 27. An electric resistance between the input terminal 28 and the output terminal 30 of the first insulator circuit 27 is greater than 1 MΩ. This electric resistance can also be greater than 10 MΩ, and in particular greater than 100 MΩ. Also, the first insulator circuit 27 may withstand high voltages, such as 1 kV, 2 kV, 5 kV or more, for a predetermined duration of time, such as one minute, or longer.

[0027] The first insulator circuit 27 is configured to translate the control signal received from the controller 19 at the input terminal 28 into a corresponding control signal outputted at the output terminal 30 such that it can be received by the driver 17. The first insulator circuit 27 can use any technology for translating the received control signal into the outputted control signal while maintaining the galvanic separation of the control circuit portion 23 and the actuator circuit portion 25. For example, the first insulator circuit 27 may use optical coupling, inductive coupling, capacitive coupling, and magnetic coupling, or some other technology to translate the control signal.

[0028] The controller 19 further generates a monitor signal supplied to a monitor circuit 35. The controller 19 generates the monitor signal always, from when it starts operating until it stops operating. The monitor circuit 35 is configured to monitor the receipt of the monitor signal and to output a stop signal to the driver 17 if the monitor signal is not received. The monitor circuit 35 has an output terminal 36 for outputting the stop signal, and the output terminal 36 of the monitor circuit 35 is electrically connected to an input terminal 37 of the driver 17. The driver 17 is configured to stop driving the actuators 11 and 13 when it receives the stop signal from the monitor circuit 35.

[0029] The monitor circuit 35 is a component of the actuator circuit portion 25, and it receives the monitor signal from the controller 19 on the control circuit portion 23 via a second insulator circuit 39 bridging the insulation between the control circuit portion 23 and the actuator circuit portion 25. The second insulator circuit 39 has an input terminal 40 electrically connected to an output terminal 41 for outputting the monitor signal of the controller 19. The second insulator circuit 39 further has an output terminal 42 electrically connected to an input terminal 43 of the monitor circuit 35. The second insulator circuit 39 may have a same or similar configuration as the first insulator circuit 27. In particular, an electric resistance between the input terminal 40 and the output terminal 42 of the second insulator circuit 39 can be greater than 1 MΩ. This electric resistance can also be greater than 10 MΩ, and in particular greater than 100 MΩ. Also, the second insulator circuit 39 may withstand high voltages, such as 1 kV, 2 kV, 5 kV or more, for a predetermined duration of time, such as one minute, or longer.

[0030] Figure 2 shows a graph of an exemplary monitor signal generated by the controller 19. In the graph of Figure 2, a line 51 represents a value V of a voltage of the signal as it changes over time t. The signal represented by the line 51 changes over time according to a predetermined pattern. Specifically, the value V of the signal is greater than a first signal value V1 during first time periods T1, and smaller than a second signal value V2 during second time periods T2, wherein the first and second time periods T1 and T2 are repeating time periods, and wherein each first time period T1 is arranged between two second time periods T2.

[0031] The first and second time periods T1 and T2 are smaller than a suitable predetermined time period Δt, such as a duration of 10 seconds, 4 seconds, or 1 second. For example, the controller 19 may include an astable multivibrator configured to generate the monitor signal. The monitor circuit 35 may include a monostable multivibrator, for example.

[0032] The second insulator circuit 39 translates the signal shown in Figure 2 into a corresponding signal having a corresponding pattern. This translated signal is supplied to the monitor circuit 35. The monitor circuit 35 analyzes the received signal and determines whether the received signal fulfills the expected pattern. If the received signal does not fulfill the expected pattern, the monitor circuit 35 determines that the correct monitor signal is not received, and it outputs the stop signal towards the driver 17. Note that the monitor signal is a binary signal that takes either a predetermined first value VC1 larger than the first signal value V1 or a predetermined second value VC2 smaller than the second signal value V2. For example, the monitor circuit 35 outputs the stop signal if the value of the signal received at its input terminal 43 does not change from the first value VC1 to the second value VC2 within a time duration of two times the time period Δt.

[0033] When the driver 17 receives the stop signal, it stops the operation of the actuator 11 which moves the ram 9 of the hydraulic press towards the bolster plate 7. If, for example, an unexpected overvoltage damages the controller 19 after it has issued a control signal to the driver 17 commanding the actuator 11 to move the ram 9 towards the bolster plate 7, the controller 19 would never output a control signal commanding the driver 17 to stop this operation of the actuator 11, and the movement of the ram 9 would continue until the object 12 is damaged by excess deformation and also one or more components of the machine 3 are damaged. However, since the damaged controller 19 which is no longer able to perform its control function is also not able to generate the monitor signal. The monitor circuit 35 will then detect that it does not receive the monitor signal as expected, and it will output the stop signal to the driver 17. Since the driver 17 stops the operation of the actuator 11, the movement of the ram 9 is stopped and the excess deformation of the object 12 is prevented.

[0034] Moreover the driver 17 is configured such that, when the stop signal is supplied to the driver 17, the driver 17 operates the actuator 13 which moves the ram 9 away from the bolster plate 7 until the ram 9 is in its uppermost position which represents a resting state of the machine 3 and ensuring that no persons or objects are exposed to a risk originating from the machine 3.

[0035] <Modification> Next, a modification will be described. In the failsafe control system 1 illustrated in Figure 1, as described above, the monitor circuit 35 monitors whether the monitor signal fulfills the expected pattern. Therefore, if an error occurs in the signal generated by the control circuit portion 23 due to the influence of overvoltage or the like and results in the monitor signal not fulfilling the expected pattern, the monitor circuit 35 outputs a stop signal to the driver 17. As a result, when an error occurs in the signal generated by the control circuit portion 23, the driver 17 can stop the actuators 11 and 13. Hereinafter, the stopping of the actuators 11 and 13 using the stop signal by the monitor circuit 35 is also referred to as forced stop. The monitor circuit 35 may be configured not to output a signal to the driver 17 in a normal state, and may output a stop signal indicating that the actuators 11 and 13 are to be stopped to the driver 17 only when the actuators 11 and 13 are to be stopped. Alternatively, the monitor circuit 35 may output a signal (hereinafter referred to as a driver control signal) to the driver 17 in a normal state and for forced stop. In this case, if the monitor signal fulfills a predetermined pattern, the monitor circuit 35 sets the value of the driver control signal to a value indicating that forced stop is not to be performed (value that allows the actuators 11 and 13 to be driven), and if the monitor signal is determined not to fulfill a predetermined pattern, changes the value of the driver control signal to a value indicating forced stop. In this example, the driver control signal corresponds to the stop signal while the value of the driver control signal indicates a value indicating forced stop. In this manner, the monitor circuit 35 may output the stop signal to the driver 17 by changing the value of the driver control signal to a value indicating forced stop.

[0036] Here, an example in which the control signal output to the actuators 11 and 13 is a control signal for controlling ON (operation) / OFF (stop) of the actuators 11 and 13 will be described. As described above, in response to the communication interface 21 receiving a command, the control signal is input to the driver 17 via the controller 19 and the first insulator circuit 27. However, due to an anomaly in the control circuit portion 23, the control signal can have a value different from that of the command received by the communication interface 21, that is, an incorrect value. Specifically, for example, during a period in which the actuators 11 and 13 are supposed to remain standstill, an anomaly in the control circuit portion 23 can cause abnormal ON in which the control signal output from the control circuit portion 23 has a value indicating ON.

[0037] Figure 3 is a graph illustrating an example of changes in various signals associated with an occurrence of abnormal ON. In the graph illustrated in Figure 3, a line 61 indicates an expected monitor signal, that is, the value (voltage value) of the monitor signal following a predetermined pattern in a case where no anomaly occurs, and a line 62 indicates the value of the monitor signal in a case where abnormal ON occurs. In the example illustrated in Figure 3, the monitor signal is a signal having a pattern similar to that of the example illustrated in Figure 2, and takes either the second value VC2 smaller than the second signal value V2 or the first value VC1 larger than the first signal value V1.

[0038] In the graph illustrated in Figure 3, a line 63 indicates a control signal in a case where abnormal ON occurs, and a line 64 indicates the value of a driver control signal output from the monitor circuit 35 to the driver 17 in a case where abnormal ON occurs. In the graph illustrated in Figure 3, a line 65 indicates an output signal for controlling the actuators 11 and 13 output from the driver 17 to the actuators 11 and 13. This output signal is the same as the control signal that the driver 17 receives from the first insulator circuit 27, if the driver 17 is not commanded to perform forced stop from the monitor circuit 35. In this example, the control signal and the output signal are ON / OFF signals for controlling ON / OFF of the actuators 11 and 13, and are binary signals that take either a third value indicating stopping (OFF) of the actuators 11 and 13 or a fourth value indicating driving (ON) of the actuators 11 and 13.

[0039] In the example illustrated in Figure 3, abnormal ON that occurs due to an anomaly in the control circuit portion 23 causes the value of the control signal indicated by the line 63 to change from a value indicating OFF to a value indicating ON at time TCON. The value of the monitor signal indicated by the line 62 also remains at the first value VC1 without following the predetermined pattern after the time TCONdue to an anomaly in the control circuit portion 23. For example, in response to the value of the monitor signal not changing from the first value VC1 to the second value VC2 within the period of time that is twice the time period Δt, the monitor circuit 35 determines that the monitor signal does not have the predetermined pattern, and commands the driver 17 to forcibly stop the actuators 11 and 13. Therefore, the time TMOFFat which the value of the driver control signal indicated by the line 64 changes from the value indicating that forced stop is not to be performed, that is, the value indicating ON, to the value indicating that forced stop is to be performed, that is, the value indicating OFF, is delayed from the time TCONby twice the time period Δt or more. As a result, the actuators 11 and 13 operate during the period TR from the time TCONto the time TMOFFalthough they are not supposed to operate, and a risk regarding safety of the user or the operator occurs.

[0040] Therefore, in a failsafe control system according to a modification, the timing at which the control signal changes from the value indicating OFF to the value indicating ON is delayed. Figure 4 is a block diagram illustrating the failsafe control system according to the modification. Components having the same functions as those in Figure 1 are denoted by the same reference signs as in Figure 1, and redundant explanations are omitted. As illustrated in Figure 4, a failsafe control system 1a according to the modification includes a delay circuit 60 in addition to the components of the failsafe control system 1 illustrated in Figure 1. The failsafe control system 1a according to the modification is similar to the failsafe control system 1 illustrated in Figure 1 except for the addition of the delay circuit 60.

[0041] The delay circuit 60 is, for example, an ON delay circuit that delays a timing (hereinafter also referred to as ON timing) at which the control signal input from the first insulator circuit 27 changes from a value (third value) indicating OFF to a value (fourth value) indicating ON by a delay time period. The delay circuit 60 outputs the control signal with the delayed ON timing to the driver 17. Figure 5 is a graph illustrating an example of changes in various signals associated with an occurrence of abnormal ON in the failsafe control system 1a according to the modification. Lines 61, 62, and 64 illustrated in Figure 5 are similar to those in the example illustrated in Figure 3.

[0042] A line 66 indicates the value of a control signal input from the delay circuit 60 to the driver 17, and a line 67 indicates an output signal for controlling the actuators 11 and 13 output from the driver 17 to the actuators 11 and 13. As illustrated in Figure 5, in the failsafe control system 1a according to the modification, the delay circuit 60 delays the timing at which the control signal changes from the value indicating OFF to the value indicating ON by the delay time period Td. As a result, the time TCONwhen the control signal changes from the value indicating OFF to the value indicating ON comes after the time TMOFFwhen the driver control signal changes from the value indicating ON to the value indicating OFF, and thus the output signal for controlling the actuators 11 and 13 output from the driver 17 to the actuators 11 and 13 does not have the value indicating ON but remains at the value indicating OFF. Therefore, the period TR in which the actuators 11 and 13 operate although they are not supposed to operate as illustrated in Figure 3 does not occur, and the safety of the user or the operator can be secured.

[0043] Note that the delay time period Tdonly needs to be a length equal to or longer than the time period from the time TCONwhen the control signal changes from the value indicating OFF to the value indicating ON until the monitor circuit 35 outputs the stop signal based on the monitor signal. For example, using the monitor signals having the patterns illustrated in Figures 2, 3, and 5, in a case where the stop signal is output in response to the value of the monitor signal not changing from the first value VC1 to the second value VC2 within the period of time that is twice the time period Δt, the delay time period Tdis set to twice the time period Δt or more. If the pattern of the monitor signal is fixed and the method of determining the output of the stop signal is fixed, the delay time period Tdmay be a fixed value. In a case where the time period from the time TCONuntil the monitor circuit 35 outputs the stop signal based on the monitor signal is variable because the pattern of the monitor signal is variable or because the method of determining the output of the stop signal is not fixed, the delay time period Tdmay be changeable in accordance with the time period from the time TCONuntil the monitor circuit 35 outputs the stop signal based on the monitor signal.

[0044] Note that the predetermined pattern of the monitor signal illustrated in Figure 3 is an example, and the pattern of the monitor signal is not limited thereto. The determination condition for the monitor circuit 35 to output the stop signal is not limited to the condition that the value of the monitor signal does not change from the first value VC1 to the second value VC2 within the period of time that is twice the time period Δt, and may be appropriately determined according to the predetermined pattern of the monitor signal such that an anomaly in the control circuit portion 23 can be detected.

[0045] The delay circuit 60 delays the ON timing, but need not delay the OFF timing, which is the timing at which the control signal changes from the value indicating ON to the value indicating OFF. Figure 6 is a graph illustrating an example of changes in various signals in a case where the control signal changes from a value indicating ON to a value indicating OFF. In the graph illustrated in Figure 6, a line 71 indicates the value of a control signal generated by the controller 19 in the event of emergency stop, a line 72 indicates the value of a control signal input to the delay circuit 60, a line 73 indicates the value of an output signal output from the delay circuit 60 to the driver 17, and a line 74 indicates the value of a driver control signal. The controller 19 changes the value of the control signal from the value indicating ON to the value indicating OFF, for example, in response to the communication interface 21 receiving an operation that gives a command for emergency stop from the user, operator, or the like. That is, the command to change the actuator 11 or 13 from the driving state to the stop state is given in response to receiving an operation that gives the command for emergency stop. The command for emergency stop is given, for example, by pressing an emergency stop button which is a part of the communication interface 21, but a method for the communication interface 21 to receive emergency stop is not limited thereto.

[0046] As illustrated in Figure 6, the delay circuit 60 does not delay the timing at which the input control signal changes from the value indicating ON to the value indicating OFF, that is, the OFF timing. As a result, the OFF timing of the output signal output from the delay circuit 60 to the driver 17 is not delayed from the time TEOFFwhich is the time when the command for emergency stop is given. As a result, the actuators 11 and 13 can be stopped without delay in the event of emergency stop. In addition, for example, in a case where a required value from occurrence of an unsafe event to transition to a safe state is defined, such as Process Safety Time defined in International Electrotechnical Commission (IEC) 61508-4 3.6.20, the required value can be fulfilled.

[0047] In the example illustrated in Figure 6, upon receiving the command for emergency stop, the controller 19 changes the value of the monitor signal to a specific pattern indicating emergency stop so that the monitor circuit 35 can quickly determine the emergency stop. The specific pattern indicating emergency stop may be, for example, a pattern that takes a value different from the first value VC1 and the second value VC2, a pattern that alternately switches between the values of the first value VC1 and the second value VC2 at a high speed, or other patterns. Upon detecting the specific pattern indicating emergency stop, the monitor circuit 35 promptly outputs the forced stop signal. As a result, the driver 17 can be commanded to stop the actuators 11 and 13 using both the control signal and the forced stop signal. Therefore, it is possible to improve safety by increasing redundancy in the event of emergency stop.

[0048] Note that it is not essential that the monitor signal have a specific pattern indicating emergency stop in the event of emergency stop, and even in the event of emergency stop, the controller 19 may keep the monitor signal in a predetermined pattern similar to that at any other time than emergency stop. In this case, forced stop using the driver control signal is not performed, but the driver 17 can stop the actuators 11 and 13 without delay using the control signal.

[0049] 1 failsafe control system 3 machine 5 frame 7 bolster plate 9 movable ram 11 actuator 12 object 13 actuator 17 driver 19 controller 21 communication interface 22 command input terminal 23 control circuit portion 25 actuator circuit portion 27 first insulator circuit 28 input terminal 29 control signal output terminal 30 output terminal 31 control signal input terminal 35 monitor circuit 36 output terminal 37 input terminal 39 second insulator circuit 40 input terminal 41 output terminal 42 output terminal 43 input terminal 60 delay circuit

Claims

1. A failsafe control system, comprising: 　　　a control circuit portion including a controller; 　　　an actuator circuit portion including a driver and a monitor circuit; 　　　a first insulator circuit; and 　　　a second insulator circuit, 　　　wherein the controller is configured to generate a first control signal for driving at least one actuator, and to generate a first monitor signal; 　　　wherein the first insulator circuit is configured to translate the first control signal received from the controller into a second control signal; 　　　wherein the second insulator circuit is configured to translate the first monitor signal received from the controller into a second monitor signal; 　　　wherein the monitor circuit is configured to monitor receipt of the second monitor signal from the second insulator circuit, and to output a stop signal to the driver if the second monitor signal is not received; and 　　　wherein the driver is configured to drive the at least one actuator based on the second control signal received from the first insulator circuit, and to stop driving the at least one actuator when the stop signal is received from the monitor circuit.

2. The failsafe control system according to claim 1, 　　　wherein the first insulator circuit has an input connected to the controller to receive the first control signal, and an output connected to the driver to supply the second control signal to the driver; and 　　　wherein the first insulator circuit is free of any galvanic connection between its input and its output.

3. The failsafe control system according to claim 2, 　　　wherein an electric resistance between the input and the output of the first insulator circuit is greater than 1 MΩ.

4. The failsafe control system according to one of claims 1 to 3, 　　　wherein the second insulator circuit has an input connected to the controller to receive the first monitor signal, and an output connected to the monitor circuit to supply the second monitor signal to the monitor circuit; and 　　　wherein the second insulator circuit is free of any galvanic connection between its input and its output.

5. The failsafe control system according to claim 4, 　　　wherein an electric resistance between the input and the output of the second insulator circuit is greater than 1 MΩ.

6. The failsafe control system according to one of claims 2 to 5, 　　　wherein at least one of the first insulator circuit and the second insulator circuit is configured to use at least one of optical coupling, inductive coupling, capacitive coupling, and magnetic coupling to translate signals received at its input to signals outputted at its output.

7. The failsafe control system according to one of claims 1 to 6, 　　　wherein the failsafe control system is free of any galvanic connection between the control circuit portion and the actuator circuit portion.

8. The failsafe control system according to claim 7, 　　　wherein an electric resistance between the control circuit portion and the actuator circuit portion is greater than 500 kΩ.

9. The failsafe control system according to one of claims 1 to 8, 　　　wherein the first monitor signal is an electric signal changing over time such that the signal is greater than a first signal value during repeating first time periods and the signal is smaller than a second signal value during repeating second time periods alternating with the first time periods; and 　　　wherein the first time periods and the second time periods are shorter than a predetermined time period.

10. The failsafe control system according to claim 9, 　　　wherein the predetermined time period is shorter than 10 seconds.

11. The failsafe control system according to one of claims 1 to 10, 　　　wherein the monitor circuit is configured to output the stop signal when the second monitor signal does not change from a predetermined first value to a predetermined second value within a predetermined time period.

12. The failsafe control system according to one of claims 1 to 11, 　　　wherein the controller has a command input to receive control commands for controlling the at least one actuator.

13. The failsafe control system according to one of claims 1 to 12, 　　　further comprising the at least one actuator, 　　　wherein the at least one actuator includes at least one of a motor, an electric switch, a hydraulic piston, and a light source.

14. The failsafe control system according to one of claims 1 to 12, 　　　further comprising a machine, 　　　wherein the machine is driven by the at least one actuator; 　　　wherein the machine has an operating state in which it performs movements, and a resting state in which the machine is in a predefined resting condition; and 　　　wherein the driver is configured to drive, when it has received the stop signal, the at least one actuator such that the machine assumes the resting state.

15. The failsafe control system according to any one of claims 1 to 14, 　　　comprising a delay circuit to perform a delay process on the second control signal such that a timing of giving a command to change the at least one actuator from a stop state to a driving state is delayed, 　　　wherein the second control signal that has undergone the delay process is input to the driver.

16. The failsafe control system according to claim 15, 　　　wherein the delay circuit does not delay a timing of giving a command to change the at least one actuator from the driving state to the stop state.

17. The failsafe control system according to claim 16, 　　　wherein the command to change the at least one actuator from the driving state to the stop state is given in response to receiving an operation that gives a command for emergency stop.

Images