JP7735674B2 - Motor control device - Google Patents

Description

The present invention relates to a motor control device that drives and controls a motor.

In recent years, servo systems have come to be used in manufacturing sites to control the positioning of moving parts in various machines. Such servo systems include a servo motor for operating various machinery, an encoder attached to the servo motor, a servo driver for driving the servo motor, and a control device for outputting position command information and other information to the servo driver. In addition to reducing costs and improving productivity, ensuring worker safety has become an important requirement in manufacturing sites. For this reason, servo systems are also being required to comply with appropriate safety standards.

Patent Document 1 discloses a full-closed loop position control servo driver that performs positioning control by feeding back a position detection signal from a linear scale and a speed detection signal from a rotary encoder to a position control driver, and after positioning is complete, the position control driver outputs a positioning completion signal to a controller. Furthermore, Patent Document 2 discloses a control device that outputs a safety stop signal to stop the driving equipment when a diagnostic processing unit diagnoses a serious fault state in at least one of the position and rotational speed of the rotating shaft.

Japanese Patent Application Publication No. 7-225615 JP 2016-206842 A

In the past, it was thought that improving the safety performance of a motor control device that drives and controls a motor required improving the safety performance of the encoder that detects the movement of the motor and generates input information for the motor control device. Therefore, the encoder design must meet the requirements of certain safety standards. For example, IEC 61508 is one such safety standard. IEC 61508 is an international standard for functional safety related to electrical, electronic, and programmable electronic safety. IEC 61508 defines the system failure probability using a scale called SIL (Safety Integrity Level), as shown in Table 1 below.

IEC 61508 defines the requirements that must be met for each SIL in the table, clarifying the efforts that the safety control system must achieve. SIL is divided into four levels, from SIL1 to SIL4, with the higher the SIL number, the higher the safety performance. For example, a motor control device with a configuration that achieves a high SIL value is desired as a motor control device with high safety performance.

The present invention was made in consideration of these problems, and aims to provide technology that improves the safety performance of motor control devices.

In this invention, to solve the above problem, when the motor control device determines that a fault has occurred in the operation of the encoder or the driven part based on two independent first feedback signals corresponding to the operation of the motor and two independent second feedback signals corresponding to the operation of the driven part, it executes processing to cut off the drive signal via the cutoff unit. This configuration allows the motor control device to have redundant fault detection mechanisms, thereby improving the safety performance of the motor control device.

In one embodiment of the present invention, a motor control device includes: a first signal receiving unit that receives two independent first feedback signals from a first encoder that detects the operation of the motor in response to the operation of the motor; a second signal receiving unit that receives two independent second feedback signals from a second encoder that detects the operation of a driven part driven by the motor in response to the operation of the driven part; a motor control unit that generates a command value for the operation of the motor based on an operation command signal for driving the motor and at least one predetermined feedback signal from the first feedback signal and the second feedback signal so that the operation of the motor follows the operation command signal; a drive unit that supplies a drive current to the motor in response to the command value from the motor control unit; a cutoff unit that cuts off transmission of the drive signal from the motor control unit to the drive unit in response to the command value; and a safety control unit that executes a cutoff process for the drive signal via the cutoff unit when it is determined that a fault has occurred in the operation of the encoder or the driven part based on the two first feedback signals received via the first signal receiving unit or the two second feedback signals received via the second signal receiving unit.

In this way, redundant feedback signals are received from the first encoder that detects the operation of the motor and the second encoder that detects the operation of the driven part, and by using these first and second feedback signals, it is possible to make fault determinations redundant, thereby improving the reliability of the feedback values. Explaining this based on the above-mentioned safety standard IEC 61508, in a configuration in which the first and second feedback signals are each redundant, compared to a configuration in which the second feedback signal is not redundant, for example, the hardware fault tolerance (HFT) value is higher and the SIL value can be increased.

In the above motor control device, the safety control unit may further determine the occurrence of a fault based on a comparison result between at least one of the first feedback value calculated from the first feedback signal and the second feedback value calculated from the second feedback signal and the operation command value calculated from the operation command signal, and cause the cutoff unit to cut off the drive signal based on the comparison result. This further improves the reliability of the feedback value. Explaining this based on the above safety standard IEC 61508, adopting a configuration that performs the cutoff process using the comparison result between the operation command value and the feedback value increases the safe failure fraction (SFF) of the encoder. As a result, as can be seen from Table 1 above, by increasing the SFF value while maintaining the hardware fault tolerance (HFT) value, it is possible to increase the SIL value, which is related to the safety performance of the motor control device.

In one embodiment of the present invention, a motor control device includes a first signal receiving unit that receives a first feedback signal from a first encoder that detects the operation of the motor in response to the operation of the motor; a second signal receiving unit that receives two independent second feedback signals from a second encoder that detects the operation of a driven unit driven by the motor in response to the operation of the driven unit; a motor control unit that generates a command value for the operation of the motor based on an operation command signal for driving the motor and at least one of the first feedback signal and the second feedback signal so that the operation of the motor follows the operation command signal; a drive unit that supplies a drive current to the motor in response to the command value from the motor control unit; and a drive circuit that generates a drive current in response to the command value. The motor control device includes a cutoff unit that cuts off transmission of the drive signal from the motor control unit to the drive unit, and a safety control unit that, when it is determined that a fault has occurred in the operation of the encoder based on the two first feedback signals received via the first signal receiving unit or the two second feedback signals received via the second signal receiving unit, executes a process to cut off the drive signal via the cutoff unit. The safety control unit determines the occurrence of the fault based on a comparison result between at least one of a first feedback value calculated from the first feedback signal and a second feedback value calculated from the second feedback signal and an operation command value calculated from the operation command signal, and executes the process to cut off the drive signal via the cutoff unit based on the determination result. In this way, by utilizing the comparison result between the operation command value and the feedback value, the motor control device can increase the safe failure fraction (SFF) of the encoder, as described above. As a result, the SFF value can be increased while maintaining the hardware fault tolerance (HFT) value, and the SIL value, which is related to the safety performance of the motor control device, can be increased.

The motor control device according to the present invention is a device that drives a motor based on an operation command signal. Examples of such a motor control device include a servo driver and an inverter. The operation command signal may be generated by another control device (such as a PLC) located outside the motor control device and provided to the motor control device, or it may be generated internally within the motor control device. Specifically, a command value for driving the motor is generated by the motor control unit from the operation command signal, a feedback signal, and a second feedback signal. When a drive signal accompanied by this command value is transmitted from the motor control unit to the drive unit, the drive unit supplies a drive current corresponding to the command value to the motor, driving the motor to follow the operation command signal. The command value can be generated according to any feedback method, such as a feedback method related to position information, speed information, etc., to enable the motor to be driven in accordance with the operation command signal.

The motor control device is equipped with a cutoff unit that cuts off the transmission of the drive signal from the motor control unit to the drive unit, and the cutoff process of the drive signal by the cutoff unit is controlled by the safety control unit. If it is determined that a fault has occurred in the operation of the encoder, the safety control unit executes the cutoff process, thereby achieving the safety performance of the motor control device. The cutoff process executed by the safety control unit includes determining whether or not a fault has occurred in the operation of the encoder or the driven unit based on the two first feedback signals received via the first signal receiving unit and the two second feedback signals received via the second signal receiving unit, and executing the cutoff process based on the determination result.

In addition, as another cut-off process, the safety control unit may use feedback values from the encoder to determine whether there is a fault regarding the motor's speed or position limits, and cut off the drive signal based on the results of that determination.

In the motor control device described above, the encoder may be configured to generate two independent feedback signals corresponding to the operation of the motor, and the safety control unit may, in the cut-off process, compare the operation command value with at least one of the two predetermined feedback values calculated from the two feedback signals. Even in a motor control device that uses feedback signals from an encoder with duplicated feedback signals, the safety performance can be more effectively improved. That is, the SIL value related to the safety performance of the motor control device can be made higher than the SIL value related to the safety performance of the encoder.

Here, specific examples of shutoff processing by the safety control unit in the motor control device described above are disclosed. First, the safety control unit may determine whether to execute the shutoff processing based on the difference between the predetermined feedback value and the operation command value during the shutoff processing. Second, the safety control unit may compare the rate of change of the predetermined feedback value with the rate of change of the operation command value during the shutoff processing, and determine whether to execute the shutoff processing based on the comparison result. Third, the safety control unit may determine whether to execute the shutoff processing based on the rate of change of the difference between the rate of change of the predetermined feedback value and the rate of change of the operation command value during the shutoff processing. Furthermore, the shutoff processing by the safety control unit may employ a combination of some or all of these processes, or alternatively, processes other than those described above may be employed.

It is now possible to improve the safety performance of the motor control device without being restricted by the safety performance of the encoder.

1 is a diagram showing a schematic configuration of a servo system in which a servo driver according to the present invention is incorporated; FIG. 1 is a diagram for explaining the safety performance of a subsystem of a servo driver according to the present invention. FIG. 2 is a functional block diagram of a servo driver according to the first embodiment. FIG. 10 is a diagram illustrating a cutoff process performed by a safety control unit. FIG. 10 is a functional block diagram of a servo driver according to a second embodiment. FIG. 10 is a diagram illustrating a cutoff process performed by a safety control unit according to a second embodiment. FIG. 10 is a functional block diagram of a servo driver according to a third embodiment. FIG. 10 is a diagram for schematically explaining the safety performance in a subsystem of a servo driver according to a third embodiment.

<First Example>
FIG. 1 is a schematic diagram of a servo system incorporating a servo driver corresponding to the motor control device of the present invention. The servo system includes a network 1, a motor 2, a first encoder 3, a servo driver 4, a standard PLC (Programmable Logic Controller) 5, a safety PLC 6, a second encoder 7, and a driven part 8. The motor 2 and the first encoder 3 form a servo motor. The servo system is a system for driving the driven part 8 using the motor 2. The motor 2 is incorporated into a mechanical device including the driven part 8 as an actuator of the mechanical device. For example, the motor 2 is an AC motor. The first encoder 3 is attached to the motor 2 to detect the operation of the motor 2. The first encoder 3 generates a first feedback signal indicative of the detected operation of the motor 2 and transmits the first feedback signal to the servo driver 4. The first feedback signal includes, for example, position information regarding the rotational position (angle) of the rotary shaft of the motor 2 and information regarding the rotational speed of the rotary shaft. A general incremental encoder or absolute encoder can be used as the first encoder 3.

The driven unit 8 is a mechanical device such as an industrial robot arm or a conveying device. In the example of FIG. 1, the driven unit 8 has a moving stage 81 and a transmission mechanism 82, with the moving stage 81 connected to the motor 2 via the transmission mechanism 82. The transmission mechanism 82 is a mechanism that transmits the driving force of the motor 2 to the moving stage 81, such as a pulley and drive belt, gear, or threaded rod. When the driving force of the motor 2 is transmitted to the moving stage 81 via the transmission mechanism 82, the moving stage 81 moves in accordance with this driving force. Note that the movement of the mechanical device by the motor 2 may involve rotation around a specific axis to change its orientation, or partial displacement due to expansion and contraction. A second encoder 7 is attached to the driven unit 8 to detect the movement of the driven unit 8. The second encoder 7 generates a second feedback signal indicating the movement of the driven unit 8 by, for example, reading a scale 71 that moves together with the moving stage 81 of the driven unit 8, and transmits the second feedback signal to the servo driver 4. The second feedback signal includes, for example, position information of the moving stage 81 and information about its moving speed. A general incremental encoder or absolute encoder can be used as the second encoder 7.

The servo driver 4 receives an operation command signal related to the operation (motion) of the motor 2 from the standard PLC 5 via the network 1, and controls the operation of the motor 2 so that the operation of the motor follows the operation command signal based on at least one predetermined feedback signal, namely the first feedback signal output from the first encoder 3 and the second feedback signal output from the second encoder 7. The servo driver 4 performs servo control related to the drive of the motor 2 based on the operation command signal from the standard PLC 5, the first feedback signal from the first encoder 3, and the second feedback signal from the second encoder 7. The servo driver 4 is also connected to the safety PLC 6 via the network 1. As a result, the servo driver 4 monitors for the occurrence of failures in the motor 2, servo driver 4, and driven part 8 based on the monitoring command signal received from the safety PLC 6, and returns the results to the safety PLC 6.

The servo driver 4 also calculates a command value for the operation of the motor 2 based on the operation command signal from the standard PLC 5, the first feedback signal from the first encoder 3, and the second feedback signal from the second encoder 7. The servo driver 4 then supplies a drive current to the motor 2 so that the operation of the motor 2 follows the command value. This supply current utilizes AC power sent from the AC power supply 11 to the servo driver 4. In this embodiment, the servo driver 4 is of a type that receives three-phase AC, but it may also be of a type that receives single-phase AC.

2 is a block diagram of safety functions in the three subsystems that make up the servo driver 4 as a single system: the input configuration, the calculation configuration, and the output configuration. The input configuration is a subsystem related to input to the servo driver 4, and its safety performance is largely dependent on the safety performance of the first encoder 3. Specifically, the first encoder 3 has a duplicated circuit that enables independent pulse output by simultaneous scanning within it, as described below, and the duplicated feedback signal is input to the servo driver 4 via independent wiring. Similarly, the second encoder 7 has a duplicated circuit that enables independent pulse output by simultaneous scanning within it, and the duplicated feedback signal is input to the servo driver 4 via independent wiring. Therefore, the input configuration has safety functions InS11 and InS12 by the first encoder 3 and safety functions InS21 and InS22 by the second encoder 7, and the hardware fault tolerance (HFT) in this case is 2. Generally, it is not easy to increase the safe failure fraction (SFF) of an encoder from the viewpoint of the volume (size) and price of the encoder, and for this reason, the SFF of the first encoder 3 and the second encoder 7 in this embodiment is in the range of 60% or more and less than 90%. Therefore, the safety integrity level (SIL) of the input configuration is 3.

The calculation configuration is a subsystem related to calculations for calculating outputs from inputs in the servo driver 4, and for example, a calculation circuit using a microprocessor (MPU) is configured to be independent and duplicated, thereby enabling the safety functions CtS11, CtS12, and CtS21 to be implemented.
, CtS22, and the HFT in this case is 2. Furthermore, it is generally easy to increase the SFF of the calculation configuration relatively high, and therefore the SFF of the calculation configuration is relatively high, falling within the range of 90% or more and less than 99%. Therefore, the SIL of the calculation configuration is 4. Furthermore, the output configuration is a subsystem related to the output from the servo driver 4, and as will be described later, depends on the safety performance of the interrupter unit 43, which interrupts the transmission of a drive signal from the motor control unit 42 to the drive unit 44. Specifically, the output configuration has safety functions OtS11, OtS12, OtS21, and OtS22, with the electrical circuits forming the interrupter unit 43 being independently duplicated, and the HFT in this case is 2. Furthermore, it is generally easy to increase the SFF of the output configuration relatively high, and therefore the SFF of the calculation configuration is relatively high, falling within the range of 90% or more and less than 99%. Therefore, the SIL of the output configuration is also 4.

The following describes the specific configuration of the servo driver 4. FIG. 3 is a functional block diagram of the servo driver 4 according to the first embodiment. As shown in FIG. 3, the servo driver 4 includes a feedback processing unit 41, a motor control unit 42, a shutoff unit 43, a drive unit 44, a first signal receiving unit 46, a second signal receiving unit 45, and a safety control unit 50. The first signal receiving unit 46 is an input interface that receives two independent first feedback signals in response to the operation of the motor 2 from the first encoder 3 that detects the operation of the motor. The first signal receiving unit 46 receives the first feedback signals and inputs them to the feedback processing unit 41. The second signal receiving unit 45 is an input interface that receives two independent second feedback signals in response to the operation of the driven part driven by the motor 2 from the second encoder that detects the operation of the driven part. The second feedback signal receiving unit 45 receives the second feedback signals and inputs them to the feedback processing unit 41. The feedback processing unit 41 generates a first feedback value based on the first feedback signal from the first encoder 3 and generates a second feedback value based on the second feedback signal from the second encoder 7. For example, when pulses are output from the first encoder 3 and the second encoder 7, the feedback processing unit 41 counts the pulses to calculate the position and movement speed of the motor 2 and the driven part 8, and generates feedback values that include values indicating the position and speed.

The first encoder 3 has a duplicated circuit that enables simultaneous scanning within it to output independent pulses, and outputs a duplicated feedback signal. Therefore, the feedback processing unit 41 receives the duplicated feedback signal from the first encoder 3 and generates a duplicated feedback value based on the feedback signal. The feedback processing unit 41 then sends the generated duplicated feedback value to the motor control unit 42 and also to the safety control unit 50.

The second encoder 7 also has a duplicated circuit that enables simultaneous scanning within it to output independent pulses, and outputs a duplicated feedback signal. Therefore, the feedback processing unit 41 receives a duplicated second feedback signal from the second encoder 7 and generates a duplicated second feedback value based on the second feedback signal. The feedback processing unit 41 then sends the generated duplicated second feedback value to the motor control unit 42 and also to the safety control unit 50.

Next, the motor control unit 42 receives an operation command signal from the standard PLC 5 and a first feedback value and a second feedback value from the feedback processing unit 41. The motor control unit 42 generates command values for performing position feedback control and speed feedback control based on the operation command signal and the first and second feedback values. For example, the motor control unit 42 generates a position command value and a speed command value through feedback control based on the operation command signal, the first feedback value, and the second feedback value. The feedback method used in this feedback control is a method that forms a servo loop suitable for the specified purpose (e.g., transporting cargo) of the mechanical device (conveyor device, etc.) in which the motor 2 is incorporated, and can be designed as appropriate. For example, the motor control unit 42 may control the motor 2 using either the first feedback value or the second feedback value. These command values generated by the motor control unit 42 are then sent to the cutoff unit 43 as drive signals.

Next, when the cutoff unit 43 receives a cutoff signal from the safety control unit 50 (described later), it stops the drive unit 44 by electrically blocking the passage of the drive signal from the motor control unit 42 to the drive unit 44 (described later). This stops the output of torque by the motor 2 even if the motor control unit 42 sends a drive signal. On the other hand, when a cutoff signal is not input to the cutoff unit 43, the cutoff unit 43 passes the drive signal including the command value output from the motor control unit 42 to the drive unit 44 as is. Note that the cutoff unit 43 is not limited to a configuration that exists independently from functional units such as the motor control unit 42. The motor control unit 42 may also function as the cutoff unit 43, and when it receives a cutoff signal from the safety control unit 50, it may stop the output of the position command value and speed command value, thereby stopping the drive unit 44.

The drive unit 44 receives a drive signal from the motor control unit 42 via the cutoff unit 43. The drive unit 44 has a circuit composed of semiconductor switching elements, such as IGBTs (Insulated Gate Bipolar Transistors), and generates a signal for turning the switching elements on and off in accordance with the PWM method based on the drive signal from the motor control unit 42, and turns the switching elements on and off in accordance with the signal. This supplies AC power to the motor 2, and the motor 2 is driven in accordance with the drive signal. On the other hand, when the cutoff unit 43 operates and cuts off the transmission of the drive signal to the drive unit 44, the output from the drive unit 44 is fixed to OFF. This stops the power supply to the motor 2, and therefore stops the output of torque from the motor 2.

In this way, the feedback processing unit 41, motor control unit 42, cut-off unit 43, and drive unit 44 are functional units directly related to the drive control of the motor 2. On the other hand, the safety control unit 50 is a functional unit that determines whether a malfunction has occurred in the operation of the first encoder 3, and if a malfunction is determined to have occurred, stops the operation of the motor 2 to ensure safety for that operation. Specifically, the safety control unit 50 further includes a determination unit 51 and a cut-off instruction unit 52. Control related to ensuring safety, including malfunction determination by the safety control unit 50, is executed based on monitoring commands from the safety PLC 6.

The determination unit 51 determines whether a fault related to the operation of the first encoder 3 has occurred based on the first feedback value, and determines whether a fault related to the operation of the second encoder 7 has occurred based on the second feedback value. The determination unit 51 determines, for example, whether the first feedback value and the second feedback value are normal. Specifically, the determination unit 51 receives duplicated first feedback signals from the first encoder 3, compares these first feedback signals, and determines that a fault related to the first encoder 3 has occurred if there is a deviation exceeding a threshold. The determination unit 51 also receives duplicated second feedback signals from the second encoder 7, compares these second feedback signals, and determines that a fault related to the second encoder 7 has occurred if there is a deviation exceeding a threshold.

If the judgment unit 51 determines that a fault has occurred, the cutoff instruction unit 52 generates a cutoff signal, which is sent to the cutoff unit 43. Upon receiving the cutoff signal, the cutoff unit 43 cuts off the transmission of the drive signal from the motor control unit 42 to the drive unit 44, as described above, thereby stopping the torque output by the motor 2. The control status (presence or absence of a fault) by the safety control unit 50 is notified to the safety PLC 6 in the form of a response to a monitoring command from the safety PLC 6.

The shutdown process performed by the safety control unit 50, which has the determination unit 51 and shutdown instruction unit 52, will now be described with reference to FIG. 4. The shutdown process shown in FIG. 4 is repeatedly executed by the calculation device (e.g., MPU) that forms the safety control unit 50, for example, at the control cycle in which command values are generated. In step S101, the determination unit 51 acquires a first feedback value and a second feedback value from the feedback processing unit 41. Then, in step S102, the determination unit 51 performs processing to determine the presence or absence of a fault based on the first feedback value and the second feedback value. Step S103 is a branching process based on the determination result of step S102. If it is determined that a fault has occurred (S103, Yes), the process proceeds to step S104, where the shutdown instruction unit 52 generates a shutdown signal and sends the generated shutdown signal to the shutdown unit 43. This stops torque output by the motor 2. If it is determined that no fault has occurred (S103, No), the shutdown instruction unit 52 does not generate a shutdown signal, and the process of FIG. 4 ends.

In this way, in the servo driver 4, the judgment unit 51 judges whether the first encoder 3 and second encoder 7 have failed, and if a failure is detected, the cut-off unit 43 stops torque output by the motor 2. This improves the accuracy of failure judgment and enhances the safety performance of the motor control device.

<Second Example>
5 is a functional block diagram of a servo driver 4 according to a second embodiment. This embodiment differs from the first embodiment in the configuration for determining a failure based on the value of the operation command signal, the first feedback value, and the second feedback value, but the other configurations are the same. Therefore, the same elements as those in the first embodiment are designated by the same reference numerals, and a repeated description will be omitted.

As shown in FIG. 5, the safety control unit 50 of this embodiment has a comparison/determination unit 53. The comparison/determination unit 53 is a functional unit that determines whether a fault has occurred related to the operation of the first encoder 3 and the second encoder 7, and makes this determination based on the feedback value linked to the operation of the motor 2 and the value of the operation command signal to the motor 2. Specifically, the comparison/determination unit 53 receives duplicated first and second feedback values from the feedback processing unit 41, and also receives an operation command signal from the standard PLC 5, and generates an operation command value P1 (P1 is not shown in FIG. 3) corresponding to that signal. Note that this operation command signal is the same as the operation command signal received by the motor control unit 42.

Generally, the failure rate λ of a product (for example, an encoder) can be roughly divided into a safe failure rate λs and a dangerous failure rate λd, and the dangerous failure rate λd can be further divided into a detectable dangerous failure rate λdd and an undetectable dangerous failure rate λdu. The SFF is defined by the following equation 1.
SFF = (λs+λdd)/(λs+λd) (Formula 1)
In order to increase the SFF, it is essential to increase the proportion of detectable failures among dangerous failures.

The comparison/determination unit 53 therefore compares the operation command value P1 with the feedback value and determines whether the difference between the two is within an acceptable range. Assuming that the motor 2 is driven in accordance with the operation command value P1, the difference between the operation command value P1 and the first and second feedback values represents the discrepancy between the movement of the motor 2, which is the object of detection by the first encoder 3, and the detection results of the first encoder 3. Therefore, by utilizing this difference, it is possible to detect the occurrence of a dangerous failure.

In this way, the comparison/determination unit 53 utilizes the difference between the operation command value P1 and the first and second feedback values, allowing the servo driver 4 to more precisely determine whether a malfunction has occurred in the operation of the first encoder 3 and the second encoder 7. As a result, compared to the servo driver of the first embodiment, which does not have the comparison/determination unit 53, the SFF of the input configuration of the servo driver 4 is improved, making it possible to increase its SIL value. The first and second feedback values compared with the operation command value P1 may be either one or both of the duplicated feedback values. Another reasonable method of malfunction determination is to compare the rate of change of the operation command value P1 with the rate of change of the feedback value and determine whether the first encoder 3 has malfunctioned using the difference between the two. Alternatively, the difference between the two change rates may be used to determine whether the first encoder 3 has malfunctioned. Any combination of these malfunction determination methods may also be employed.

In this way, the comparison and judgment unit 53 uses the feedback value and the operation command value P1 to determine whether or not a fault has occurred in the first encoder 3. If the comparison and judgment unit 53 determines that a fault has occurred, the cut-off instruction unit 52 generates a cut-off signal, which is sent to the cut-off unit 43. Upon receiving the cut-off signal, the cut-off unit 43 cuts off the transmission of the drive signal from the motor control unit 42 to the drive unit 44, as described above, thereby stopping the torque output by the motor 2. The control status (presence or absence of a fault) by the safety control unit 50 is notified to the safety PLC 6 in the form of a response to a monitoring command from the safety PLC 6.

The shutdown process performed by the safety control unit 50, which has the comparison/determination unit 53 and shutdown instruction unit 52, will now be described with reference to Figure 6. The shutdown process shown in Figure 6 is repeatedly executed by the calculation device (such as an MPU) that forms the safety control unit 50, for example, at the control cycle in which command values are generated. In step S200, the determination unit 51 acquires the first feedback value and the second feedback value from the feedback processing unit 41. In addition, in S201, the determination unit 51 receives an operation command signal from the standard PLC 5 and generates an operation command value P1 corresponding to that signal.

In step S202, the judgment unit 51 performs processing to determine whether or not a malfunction has occurred based on the first feedback value and the second feedback value. In step 203, a malfunction determination is made for the first encoder 3 based on the difference between the generated operation command value P1 and the feedback value acquired from the feedback processing unit 41. This determination is made by the comparison/judgment unit 53.

Step S204 is a branching process depending on the determination results of steps S202 and S203. If it is determined that a fault has occurred (S203, Yes), the process proceeds to step S205, where the cutoff instruction unit 52 generates a cutoff signal, which is then sent to the cutoff unit 43. This stops torque output by the motor 2. If it is determined that no fault has occurred (S204, No), the cutoff instruction unit 52 does not generate a cutoff signal, and the process in Figure 6 ends.

As described above, in the servo driver 4 of this embodiment, the comparison/determination unit 53 uses the operation command value to determine whether the first encoder 3 has failed. If a failure is determined, the shutoff unit 43 operates to stop torque output by the motor 2. This improves the accuracy of the failure determination for the first encoder 3 and the SFF of the input configuration of the servo driver 4. For example, in the first embodiment described above, as shown in FIG. 2, the hardware fault tolerance of the input configuration was 2, the SFF was between 60% and 90%, and the safety integrity level (SIL) was 3. In contrast, in the servo driver 4 of this embodiment, the comparison/determination unit 53 compares the first and second feedback values with the operation command value to determine whether the first encoder 3 and the second encoder 7 have failed. This improves the accuracy of the SFF of the input configuration of the servo driver 4, bringing it to the range between 90% and 99%, and therefore the SIL of the input configuration also increases from 3 to 4. In other words, this embodiment improves the safety performance of the servo driver 4 compared to the first embodiment.

<Third Example>
7 is a functional block diagram of a servo driver 4 according to a third embodiment. This embodiment differs from the second embodiment in that the pulse output circuit in the first encoder is not duplicated, and a non-duplicated feedback signal is output. Since the other configurations are the same, the same elements as those in the first embodiment are designated by the same reference numerals, and a repeated description will be omitted.

Figure 8 is a block diagram of the safety functions in the three subsystems that make up the servo driver 4 of the third embodiment, namely the input configuration, calculation configuration, and output configuration, when it is considered as a single system. As shown in Figure 8, the input configuration of the third embodiment has a control function InS01 by the first encoder 3 and safety functions InS21 and InS22 by the second encoder 7, in which case the hardware fault tolerance (HFT) is 1. Generally, it is not easy to increase the safe failure fraction (SFF) of an encoder due to the volume (size) and price of the encoder. For this reason, the SFF of the first encoder 3 and second encoder 7 in this embodiment is in the range of 60% to 90%. For this reason, if the safety performance of the input configuration relies solely on the first encoder 3, the safety integrity level (SIL) of the input configuration would be 2. However, in this embodiment, the comparison and judgment unit 53 judges whether the first encoder 3 has failed using the operation command value, improving the accuracy of the failure judgment and improving the SFF of the input configuration of the servo driver 4, so the safety integrity level (SIL) of the input configuration can be 3. As a result, even if a relatively inexpensive non-safety encoder is used as the first encoder 3, the safety integrity level (SIL) can be 3.

1. Network 2. Motor 3. First encoder 4. Servo driver 5. Standard PLC
6...Safety PLC
7. Second encoder 41. Feedback processing unit 42. Motor control unit 43. Cut-off unit 44. Driving unit 50. Safety control unit 51. Determination unit 52. Cut-off instruction unit 53. Comparison and determination unit

Claims (5)

a first signal receiving unit that receives two first feedback signals independent of each other in response to an operation of the motor from a first encoder that detects an operation of the motor;
a second signal receiving unit that receives, from a second encoder that detects the operation of a driven part driven by the motor, two second feedback signals that are independent of each other in accordance with the operation of the driven part;
a motor control unit that generates a command value for the operation of the motor based on an operation command signal for driving the motor and at least one predetermined feedback signal of the first feedback signal and the second feedback signal so that the operation of the motor follows the operation command signal;
a drive unit that supplies a drive current to the motor in response to the command value from the motor control unit; and
a cutoff unit that cuts off transmission of a drive signal from the motor control unit to the drive unit in accordance with the command value;
comparing the two first feedback signals to determine that a fault has occurred in the operation of the first encoder when there is a difference between the two first feedback signals that exceeds a threshold value;
comparing the two second feedback signals with each other, and determining that a malfunction has occurred in the operation of the second encoder if there is a difference between the two second feedback signals that exceeds a threshold;
a safety control unit that executes a process of cutting off the drive signal via the cutoff unit when it is determined that a failure has occurred in at least one of the operations of the first encoder and the second encoder;
A motor control device comprising: The safety control unit further determines the occurrence of the failure based on a comparison result between at least one of a first feedback value calculated from the first feedback signal and a second feedback value calculated from the second feedback signal and an operation command value calculated from the operation command signal, and executes a process of cutting off the drive signal by the cutoff unit based on the determination result.
The motor control device according to claim 1 . The safety control unit determines whether or not to execute the shutoff process based on a difference between at least one of the first feedback value and the second feedback value and the operation command value, in the shutoff process.
The motor control device according to claim 2 . In the shutoff process, the safety control unit compares a rate of change of at least one of the first feedback value and the second feedback value with a rate of change of the operation command value, and determines whether or not to execute the shutoff process based on the comparison result.
The motor control device according to claim 2 . The safety control unit determines whether to execute the shutoff process based on a rate of change of a difference between a rate of change of at least one of the first feedback value and the second feedback value and a rate of change of the operation command value, in the shutoff process.
The motor control device according to claim 2 .