Patent Publication Number: US-2023141274-A1

Title: Safety switching system and method for braking electric motor

Description:
FIELD 
     The present invention relates to systems and methods for braking electric motors, and more particularly, embodiments concern a safety switching system and method including multiple independent switching units for braking an electric motor and feedback units for monitoring and reporting the operational readiness of the switching units. 
     BACKGROUND 
     It is sometimes desirable or necessary to brake electric motors in order to slow or stop them, and various systems and methods for braking electric motors are known. However, such systems often include single points of failure that may fail without warning if or when they do fail. Safety is a particular concern in the operation of mobile robots, automatic guided vehicles, and other motorized machinery if the robot, vehicle, or other machine and its load cannot reliably be slowed or stopped in a timely manner. 
     This background discussion is intended to provide information related to the present invention which is not necessarily prior art. 
     SUMMARY 
     Embodiments address the above-described and other problems and limitations in the prior art by providing a safety switching system and method including multiple independent switching units for braking an electric motor and feedback units for monitoring and reporting the operational readiness of the switching units. 
     An embodiment of the present invention may provide a safety switching system configured to brake an electric motor including a plurality of motor windings in a mobile device further including a safety controller and a motor controller configured to provide power to and electronically control operation of the electric motor. The safety switching system may include a multi-phase shorting system, an electromechanical brake system, and a feedback system. The multi-phase shorting system may be configured to brake the motor by diverting power from the motor windings, and may include independent first and second switching units. Each of the switching units may include a plurality of normally-closed solid state switches configured to close and connect a respective motor winding of the plurality of motor windings to an electrical ground, and a switch control unit controlled by the safety controller and configured to cause the plurality of switches to close and connect the plurality of motor windings to the electrical ground and thereby divert power from the plurality of motor windings. The electromechanical brake system may be configured to mechanically brake the motor, and may include an independent third switching unit connected to an electromechanical brake. The third switching unit may include two normally-open solid state switches controlled by the safety controller and configured to activate the electromechanical brake. The feedback system may be configured to communicate to the safety controller a switch failure of one or more of the switches either as a short circuit fault or an open circuit fault, wherein if the switch failure occurs then the safety controller may activate the multi-phase shorting system and the electromechanical brake system. 
     Another embodiment of the present invention may provide a system including a mobile device and a safety switching system. The mobile device may include an electric motor including a plurality of motor windings, a safety controller, and a motor controller configured to provide power to and electronically control operation of the electric motor. The safety switching system may be configured to brake the electric motor, and may include a multi-phase shorting system, an electromechanical brake system, and a feedback system. The multi-phase shorting system may be configured to brake the motor by diverting power from the motor windings, and may include independent first and second switching units. Each of the first and second switching units may include a plurality of normally-closed solid state switches configured to close and connect a respective motor winding of the plurality of motor windings to an electrical ground, and a switch control unit controlled by the safety controller and configured to cause the plurality of switches to close and connect the plurality of motor windings to the electrical ground and thereby divert power from the plurality of motor windings. The electromechanical brake system may be configured to mechanically brake the motor, and may include an independent third switching unit connected to an electromechanical brake. The third switching unit may include two normally-open solid state switches controlled by the safety controller and configured to activate the electromechanical brake. The feedback system may be configured to communicate to the safety controller a switch failure of one or more of the switches either as a short circuit fault or an open circuit fault, wherein if the switch failure occurs then the safety controller may activate the multi-phase shorting system and the electromechanical brake system. 
     Various implementations of the above-described embodiments may include any one or more of the following features. The mobile device may be a mobile robot or an automatic guided vehicle. Following activation of the multi-phase shorting system, the safety controller may wait a pre-established delay period before activating the electromechanical brake. The pre-established delay period may be between four and eight seconds. The safety controller may be further configured to activate the electromechanical brake without a delay period. The switches of the first, second, and third independent switching units may be power metal oxide semiconductor field effect transistors (MOSFETs). 
     The feedback system may be an analog feedback system configured to report a status of each of the first and second switching units of the multi-phase shorting system to the safety controller as a first voltage indicating the switch failure has not occurred and a second voltage indicating the switch failure has occurred. The analog feedback system may disable the second switching unit and check the first switching unit for the open circuit fault and the short circuit fault, and then disable the first switching unit and check the second switching unit for the short circuit fault and the open circuit fault. 
     The feedback system may be a digital feedback system configured to report a status of each of the first and second switching units of the multi-phase shorting system to the safety controller as a high value indicating the switch failure has not occurred and a low value indicating the switch failure has occurred. The digital feedback system may disable the second switching unit and check the first switching unit for the open circuit fault, and then disable the first switching unit and check the second switching unit for the open circuit fault, and check the first and second switching units simultaneously for the short circuit fault. 
     The safety switching system may further include a torque-off system configured to brake the electric motor by disabling the motor controller and thereby remove power from the motor and cause the motor to slow due to a load torque and a friction effect. The safety controller may verify that the torque-off system is functioning properly and can disable the motor controller, and if the torque-off system is malfunctioning and cannot disable the motor controller the safety switching system may prevent the electric motor from starting. The safety switching system may be configured to perform progressive multi-stage braking of the electric motor by activating the torque-off system to disable the motor controller to cause the motor to coast to a stop; after a first delay period, activating the multi-phase shorting system to divert power from the motor windings of the motor and thereby shorten a time period required for the motor to stop; and after a second delay period, activating the electromechanical brake system to mechanically brake the motor and thereby further shorten the time period required for the motor to stop. 
     This summary is not intended to identify essential features of the present invention, and is not intended to be used to limit the scope of the claims. These and other aspects of the present invention are described below in greater detail. 
    
    
     
       DRAWINGS 
       Embodiments of the present invention are described in detail below with reference to the attached drawing figures, wherein: 
         FIG.  1    is a high-level flowchart of steps in an embodiment of a method of the present invention for braking an electric motor, wherein three stages of progressive braking are shown; 
         FIG.  2    is a matrix of electronic input signals and the corresponding statuses of the three stages of progressive braking of  FIG.  1   ; 
         FIG.  3    is a high level component diagram of an embodiment of a safety switching system for braking an electric motor; 
         FIG.  4    is a component diagram of a multi-phase shorting system and an electromechanical brake system of the system of  FIG.  3   ; 
         FIG.  5    is a component diagram of an implementation of an analog feedback unit component of the system of  FIG.  3   ; 
         FIG.  6    is a flowchart of steps in the operation of the analog feedback unit of  FIG.  5   ; 
         FIG.  7    is a component diagram of an implementation of a digital feedback unit component of the system of  FIG.  3   ; 
         FIG.  8 A  is a first matrix of digital signals provided by the digital feedback component of  FIG.  7    and their meanings; 
         FIG.  8 B  is a second matrix of digital signals provided by the digital feedback component of  FIG.  7    and their meanings; 
         FIG.  9    is a flowchart of steps in the operation of the digital feedback unit of  FIG.  7   ; and 
         FIG.  10    is a flowchart of steps in the operation of the digital feedback unit with regard to the operation of a third switching unit associated with an electromagnetic brake. 
     
    
    
     The figures are not intended to limit the present invention to the specific embodiments they depict. The drawings are not necessarily to scale. 
     DETAILED DESCRIPTION 
     The following detailed description of embodiments of the invention references the accompanying figures. The embodiments are intended to describe aspects of the invention in sufficient detail to enable those with ordinary skill in the art to practice the invention. The embodiments of the invention are illustrated by way of example and not by way of limitation. Other embodiments may be utilized and changes may be made without departing from the scope of the claims. The following description is, therefore, not limiting. The scope of the present invention is defined only by the appended claims, along with the full scope of equivalents to which such claims are entitled. 
     In this description, references to “one embodiment,” “an embodiment,” or “embodiments” mean that the feature or features referred to are included in at least one embodiment of the invention. Separate references to “one embodiment,” “an embodiment,” or “embodiments” in this description do not necessarily refer to the same embodiment and are not mutually exclusive unless so stated. Specifically, a feature, component, action, step, etc. described in one embodiment may also be included in other embodiments, but is not necessarily included. Thus, particular implementations of the present invention can include a variety of combinations and/or integrations of the embodiments described herein. 
     Broadly, embodiments provide a safety switching system and method including multiple independent switching units for braking an electric motor and feedback units for monitoring and reporting the operational readiness of the switching units. In more detail, embodiments provide a safety switching system and method configured to perform progressive multi-stage braking of an electric motor, including implementing multi-phase shorting using multiple independent switching units and independently controlling an electromechanical brake switch unit, and monitor for and report open and/or short circuit faults in the switches to ensure operational readiness. As used herein, “multi-phase” shall mean two or more phases, for example, three phases. Potential applications include any mobile robot, automatic guided vehicle, or other mobile device or other battery-powered direct current motor application 
     Embodiments may provide at least three progressive stages of braking: Disabling the motor controller to de-energize and allow the electric motor to coast to a stop, shorting the windings of the motor to shorten the time required for the motor to stop, and engaging an electromechanical brake to further shorten the time required for the motor to stop. The system may synchronize and otherwise manage activation of each stage to maximize operational efficacy and minimize potential for damage. Further, embodiments may provide an adjustable time delay for engaging the electromechanical brake, and further provide an override feature for immediately engaging the electromechanical brake without regard to the specified time delay. Additionally, embodiments may provide initial and periodic circuit testing to verify that elements, especially the switches, of the system are properly functioning. 
     Referring to  FIGS.  1  and  2   , embodiments may be configured to employ at least three stages of braking. First, a torque-off (STO) system may be included and configured to quickly and reliably turn off or otherwise disable the motor controller in order to remove torque-generating energy (power) from the motor, as shown in step  20 . By itself, this will cause the motor to “coast” or slow to an eventual standstill due to the inherent braking effects of load torque and/or friction effect, as shown in step  22 . The controller may perform a check of the STO system when the larger system is turned on and every time the STO inputs go from any state to both high. Once the STO system is verified to work, the controller can safely allow the motor to be energized. 
     Second, rather than rely entirely on load torque or friction to brake the motor, after a delay, shown in step  24 , a multi-phase short condition may be imposed on the motor windings, as shown in step  26 . This absorbs a percentage of the motor energy and shortens the time required for the motor to stop. More specifically, activation of the STO may be followed by triggering of the multi-phase shorting of the motor windings. The STO feature may be engaged so that the controller&#39;s ability to energize the motor is turned off before shorting the motor phases to prevent an over-current situation. Further, the switches may be a predefined delay after activation of the STO to avoid damaging the motor controller due to the short circuit at the controller outputs. 
     Third, after an adjustable time delay (of, for example, one to six seconds), as shown in step  28 , an electromechanical brake may be engaged to further shorten the time required for the motor to stop, as shown in step  30 . Under certain conditions, the time delay may be ignored and the electromechanical brake may be engaged immediately. Engagement of the electromechanical brake may be controlled by hardware and/or by a safety controller. 
     Referring particularly to  FIG.  2   , a matrix is shown of electronic input signals  21  and the corresponding statuses of the above-described three stages of progressive braking, specifically, the STO status  23  (wherein “active” means that the motor controller power output is off), the multi-phase short status  27  (wherein “active” means that the power switches are on, thereby shorting the motor phases to ground), and the electromechanical brake status  31 . 
     Referring also to  FIGS.  3 - 10   , in one embodiment, a safety switching system  40  may be provided to perform progressive multi-stage braking of an electric motor  42  and to monitor and report operational readiness of system components, particularly system switches. Referring particularly to  FIG.  3   , the system  40  may broadly include the electric motor  42 , a battery  44 , a motor controller  46  providing multi-phase power to the motor  42 , a safety controller  48 , an STO system  50 , a multi-phase shorting system  52 , an electromechanical brake system  54 , and a feedback system  56 . Some or all of these components may be incorporated into a mobile device  60 , which may be, for example, a mobile robot or an automatic guided vehicle. The safety controller  48  may be substantially any suitable component or system for performing the functions described herein, such as a certified safety controller or a supervisory controller or supervisory system with additional monitoring and/or supervisory responsibilities. 
     The electric motor  42  may be configured to turn and thereby drive a load, and may include multiple windings  58 . In one implementation, the motor  48  may utilize three-phase power and include three such windings  58 . The battery  44  may be configured to provide direct current (DC) power to the motor controller  46  and to the safety controller  48 , the multi-phase shorting system  52 , and the electromechanical brake system  54 . The motor controller  46  may be configured to electronically control operation of the motor  42 , including power, speed, and torque, including converting the DC power provided by the battery  44  to multi-phase alternating current (AC) power and to provide single phase power to each of the windings  58  of the motor  42  in order to turn the motor  42 . The motor controller  46  may be a single channel or multiple channel (for example, dual channel) device. The safety controller  48  may be configured to transmit signals to the motor controller  46 , multi-phase shorting system  52 , and electromechanical brake system  54 , and to receive signals from the feedback system  56 . Communications to and from the safety controller  48  and other components of the system  40  may be facilitated by a controller area network (CAN) bus  62 . 
     The STO system  50  may be configured to quickly and reliably turn-off or otherwise disable the motor controller  46  in such a manner as to remove torque-generating energy from the motor  42 . By itself, this will cause the motor  42  to coast to an eventual standstill due to the inherent braking effects of load torque and/or friction effect. 
     The safety controller  48  may perform a check of the STO system  50  whenever power is turned on and whenever the STO inputs go from any state to both high and verify the ability of the STO system  50  to disable the motor controller  46 . If the STO system  50  is malfunctioning and cannot disable the motor controller  46 , the safety switching system  40  may prevent the motor  42  from starting. Activation of this first stage STO braking may be followed by triggering of the second stage multi-phase shorting of the motor windings  58 . 
     Referring particularly to  FIG.  4   , the multi-phase shorting system  52  may be configured to short the windings  58  of the motor  42  in order to absorb a percentage of the motor energy and shorten the time required for the motor  42  to stop. The multi-phase shorting system  52  may include first and second independent switching units  64 A, 64 B electrically connected to the motor windings  58 . Each of the first and second switching units  64 A, 64 B may include a switch control unit  66 A, 66 B, multiple normally-closed solid state switches  68 A, 68 B electrically connected at one end to the lines carrying power from the motor controller  46  to the motor windings  58  and at the other end to electrical ground, and analog feedback units  70 A, 70 B and/or digital feedback units  72 A, 72 B. In various implementations, the switches  68 A, 68 B may be substantially any suitable power transistor, such as MOSFETs, Gallium Nitride field effect transistors (GaN_FETs), or insulated-gate bipolar transistors (IGBTs). During normal operation, each switch control units  66 A, 66 B may receive two independent active-low control signals from the safety controller  48 . The feedback units  70 A, 70 B, 72 A, 72 B may provide status reports to the safety controller  48  through analog and digital signals which are used to diagnose open and short circuit faults in the switches  68 A, 68 B. 
     Before activating the multi-phase shorting system  52 , the STO system  50  may already be activated so that the ability of the motor controller  46  to energize the motor  42  is turned off before shorting the motor windings  58  to prevent an over-current situation. Further, the switches  68 A, 68 B may be triggered a predefined delay after activation of the STO system  50  to avoid damaging the motor controller  46  due to the short circuit at the controller outputs. The first and second switching units  64 A, 64 B may be configured to interrupt the power provided by the motor controller  46  to the windings  58  of the motor  42 . The switching units  64 A, 64 B may divert this power to electrical ground. Each of the first and second switching units  64 A, 64 B may operate independent of the other so that if one fails to activate the other may not. Operation of each of the first and second switching units  64 A, 64 B may be powered by the battery  44 . 
     More specifically, each switch control unit  66 A, 66 B may be configured to cause its normally-closed switches  68 A, 68 B to close and thereby divert power away from the respective motor windings  58 . Each switch  68 A, 68 B may be configured to connect a respective motor winding to ground. Thus, for example, in the implementation in which there are three motor windings, each switching unit  64 A, 64 B may include first, second, and third switches. 
     In one implementation, the multi-phase shorting system  52  may be controlled by two independent active low safety input signals from the safety controller  48 . By default, the switches  68 A, 68 B may impose a short circuit condition when the multi-phase shorting system  52  is powered on. If both input signals to the STO system  50  are changed to high, the short circuit condition of the multi-phase shorting system  52  may be cleared and the motor  42  allowed to operate normally. Consequently, if any of these input signals becomes low or float, the multi-phase shorting system  52  may be reset to default to implement the multi-phase shorting condition. 
     If the battery  44  is disconnected and input power is lost to the multi-phase shorting system  52 , the switches  68 A, 68 B may not be controllable regardless of the state of the STO input signals. In this case, the electromechanical brake system  54  may be engaged to implement braking due to the presence of a crucial fault. The electromechanical brake system  54  may also be controlled by the safety controller  48  through two active low signals which deactivate the time delay at the high side switches of the electromechanical brake system  54  and allow for immediate engagement. 
     The electromechanical brake system  54  may be configured to mechanically brake the motor  42  to further shorten the time required for the motor  42  to stop. The electromechanical brake system  54  may operate independently of the first and second multi-phase switching units. The electromechanical brake system  54  may include a third switching unit  76  connected to an electromechanical brake  78 , and analog and/or digital feedback units (not shown, but similar or identical to the analog and digital feedback units of the multi-phase shorting system  52 ) reporting operational conditions to the safety controller  48 . The third switching unit  76  may include two normally-open switches  80  connected to the electromechanical brake  78  and controlled by two independent active-low control signals from the safety controller  48 . 
     The safety controller  48  may wait a pre-established delay period before activating the electromechanical brake  78 . In one implementation, there may be between one and six user-selectable delay periods of one second increments. Additionally or alternatively, the safety controller  48  may provide an independent input for activating the electromechanical brake  78  immediately and without regard to the pre-established a delay period. 
     In one implementation, the safety switch system may have two pairs of safety signals as inputs and one pair of safety signals as outputs. More specifically, two safety control inputs may trigger the multi-phase short and, after a delay, the electromagnetic brake, two safety brake control inputs may activate the electromagnetic brake without a delay, and two safety output signals may be sent to the motor controller to trigger the STO function. In a first (parallel) wiring implementation, the safety controller may send one pair of safety control signals to the safety switch, one pair of STO signals to the motor controller, and one pair of safe brake signals to the safety switch. In an alternative second (series) wiring implementation, the safety controller may send one pair of safety control signals to the safety switch and one pair of safe brake signals to the safety switch, and the safety switch sends the pair of STO signals to the motor controller. In the latter implementation, the safety switch, rather than safety controller, may control the time delay between triggering the STO function and triggering the multi-phase short function. 
     The feedback system  56  may be configured to allow the safety controller  48  to check operational readiness when the braking systems  50 , 52 , 54  are powered on, when the safety brake inputs are toggled, and at regular intervals if the systems are not powered off, in order to detect a failure of any of the switches  68 A, 68 B, 80  in the form of a short or open circuit condition. 
     Referring particularly to  FIGS.  5 - 9   , in one implementation, the multi-phase shorting system  52  may report its status to the safety controller  48  as an analog and/or a digital signal. Referring particularly to  FIGS.  5  and  6   , as discussed, each of the first and second switching units  64 A, 64 B may include the analog feedback unit  70 A, 70 B configured to monitor one or more relevant operational characteristics of the switches  68 A, 68 B and report the results via analog signals  84 A, 84 B to the safety controller  48 . Because the switches  68 A, 68 B of the two switching channels are connected in parallel, each channel may be checked independently, as reflected in the separate paths  120 , 122  shown in  FIG.  6   . Thus, the safety input signals are used to disable the one channel in order to check the condition of the other channel through the feedback signals. Once normal operation of the one channel switches is verified, the procedure can be repeated for the other channel. Because the switches  68 A, 68 B of each channel may be controlled by a single input signal, the condition monitoring procedure is simplified for the safety controller  48  as the feedback signals provide a general status report. In one implementation, the analog feedback reports open or short circuit faults within a wide range. The analog output signals provide the required information to detect a failure of any of the switches  68 A, 68 B. The different voltage feedback values are read and interpreted by the safety controller (steps  124 A, 124 B, 126 A, 126 B) during the self-check process to identify defective switches (steps  128 A, 128 B, 130 A, 130 B). 
     Additionally or alternatively, referring particularly to  FIGS.  7 - 9   , as discussed, each of the first and second switching units  64 A, 64 B may include the digital feedback unit  72 A, 72 B configured to monitor one or more relevant operational characteristics of the switches  68 A, 68 B and report the results via digital signals  94 A, 94 B to the safety controller  48 . In one implementation, the digital feedback may have a normally high or first output signal (typically characterized as a “one”) and report open or short circuit faults with a low or second output signal (typically characterized as a “zero”). As shown in  FIGS.  7 A and  7 B , the two channels of the multi-phase shorting system  52  may be checked independently for the detection of an open circuit component failure (path  140 ) shown in  FIG.  9   , but can be checked simultaneously for the short circuit detection (path  142 ). Because the switches  68 A, 68 B of each channel may be controlled by a single input signal, the condition monitoring procedure is simplified for the safety controller  48  as the feedback signals provide a general status report. In one implementation, the digital feedback reports open or short circuit faults within a wide range. The digital output signals provide the required information to detect a failure of any of the switches  68 A, 68 B. The different feedback values are read and interpreted by the safety controller (steps  144 , 146 , 148 ) during the self-check process to identify defective switches (steps  150 , 152 , 154 ). 
     Additionally, referring to  FIG.  10   , the feedback system  56  may be extended to encompass the switches  80  of the electromechanical brake system  54  as well. The digital output signals provide the required information to detect a failure of any of the switches  80 . The different feedback values are read and interpreted by the safety controller (step  164 ) during the self-check process to identify defective switches (steps  170 , 172 , 174 , 176 ). 
     In operation, the safety controller  48  may detect the fault through the feedback signals  84 A, 84 B, 94 A, 94 B and, in response, change the active-low control signals to high and thereby close the switches  68 A, 68 B of the first and second switching units  64 A, 64 B to short-circuit the motor windings  58  and open the switches  80  of the third switching unit  76  to engage the electromechanical brake  78 . Because the plurality of switching units  64 A, 64 B, 76  are independent of each other, the failure of one to function properly does not prevent the others from functioning to brake the motor  42 . 
     In one implementation, the system may use one motor controller and one safety controller to control multiple motors and multiple safety switching systems, with each motor having its own safety switching system. From the perspective of each motor, the system may function substantially similar or identical to the embodiments and implementations described above. 
     Although the invention has been described with reference to the one or more embodiments illustrated in the figures, it is understood that equivalents may be employed and substitutions made herein without departing from the scope of the invention as recited in the claims. 
     Having thus described one or more embodiments of the invention, what is claimed as new and desired to be protected by Letters Patent includes the following: