Patent Description:
As is known to those skilled in the art, motor drives are utilized to control operation of a motor. According to one common configuration, a motor drive includes a DC bus having a DC voltage of suitable magnitude from which an AC voltage may be generated and provided to an AC motor. The DC voltage may be provided as an input to the motor drive or, alternately, the motor drive may include a converter section which converts an AC voltage input to the DC voltage present on the DC bus. The motor drive receives a command signal which indicates the desired operation of the motor. The command signal may be a desired torque, speed, or position at which the motor is to operate. The torque, speed, or position of the motor is controlled by varying the amplitude and frequency of the AC voltage applied to the stator of the motor. An inverter section is provided between the DC bus and the output of the motor drive to generate the controlled AC voltage from the DC voltage present on the DC bus to achieve desired operation of the motor.

The motor is, in turn, used to provide a desired motion. The desired motion may, for example, be controlled operation of an axis of motion in an industrial machine or process. The motor may be directly connected, for example, to a flywheel, spindle, or other rotational actuator. Optionally, the motor may be connected via a gearbox to provide rotational motion or to translate rotational motion to linear motion. The axis of motion may be fixed in a horizontal plane, vertical plane, or anywhere in between, The axis, or a combination of axes, may vary between planes, for example, as a first motor causes a second motor to change orientation, such as on a robotic arm.

As is known in the art, desired motion from a motor may be intermittent. Many processes require a motor to move an axis from a first location to a second location and then remain at the second location for a period of time. The period of time the motor remains at the second location may vary from seconds to hours or days depending on the application. In order to conserve energy, it is often desirable to enable the motor drive only while motion is desired. The motor drive receives the command signal corresponding to desired operation of the motor and controls the motor accordingly. When the desired operation of the motor is complete, the command signal is removed and the motor drive may be disabled.

If the motor drive is disabled, it is no longer able to control operation of the motor. If a motor is controlling an axis of motion in which potential energy may be stored, the potential energy may be released when the motor is no longer controlling motion. Examples of systems in which potential energy is stored include, but are not limited to, a system in which a spring is wound, tension is applied to a web of material, or a load is lifted in a vertical plane or in any non-horizontal plane that requires a lifting torque. When the motor no longer controls the load, the motor has a potential for movement as a result of the potential energy being release. For example, the spring may unwind, the tension in the web may be released, or gravity acting on the load may cause the load to lower. If the force on the load as a result of the stored potential energy is sufficient to overcome, for example, mechanical advantage resulting from gearing, friction forces, and the like, the load will start, moving when the motor drive is disabled if there is no other holding force preventing such motion.

In order to avoid such undesired motion, it is common to provide a holding brake for motors and axes in which potential energy is stored. The holding brake may be mechanically coupled to the motor, to an output shaft, or at any point along the mechanical drive train that is suited for such coupling according to the application requirements. A common sequence of events to prevent undesired motion as a result of releasing the stored potential energy is to command the motor to come to a stop or to stop motion of the axis. When the axis is at or near a stopped condition, the holding brake is set and the motor drive is then disabled. The holding brake will prevent undesired motion as a result of the stored potential energy. Optionally, the motor drive may be configured to remain enabled while potential energy is stored in the axis and the motor drive receives a command to maintain a constant position. The motor drive monitors the position feedback from the motor to ensure that motor is able to hold the load at the constant position and prevent, undesired motion. In either instance, a single system, that is, either the holding brake or the motor drive, is responsible for maintaining a constant position of the motor.

Many industrial machines or processes require interaction with technicians or other personnel. For example, a process line may move a mechanical assembly in position for a worker to add a component to the assembly. A machining center may have a machine head that drills, grinds, cuts, or otherwise interacts with a part and then raises up for unloading of a completed part and loading of a new part. During interaction with a technician or other personnel, the controlled machine or process must provide a safe operating condition for such interaction. These safe operating conditions require that the system be single-failure proof. In other words, if a single component were to fail, or if additional components fail as a result of the initial component failing, the control system is able to maintain the safe operating condition. However, providing a safe operating condition with stored potential energy presents certain challenges.

Historically, it has been known to provide redundant systems in order to achieve a safe operating condition. A fully redundant system may include, for example, a first holding brake and a second holding brake, where each brake is configured to safely hold the maximum expected suspended load. Similarly, the fully redundant system may include a pair of motors and a pair of motor drives, where each motor and motor drive pair is configured to safety control operation of the motion of axis in the event one of the components fails. However, fully redundant systems add significant expense and complexity. Two of each component is required, and the multiple components require extra space. A supervisory system is often required to monitor the system, detect failure of a primary component, and to manage switch-over to a redundant component.

Thus, it would be desirable to provide an improved system and method for providing safety-rated operation of a motor and motor drive controlling operation of a load with stored potential energy.

<CIT> relates to a machine that includes a motor including a brake. A robot includes a motor that includes a brake and moves an arm on a drive axis, and a rotational position detector that detects movement of the arm. When a state occurs in which the robot is preferably emergency-stopped, a control device performs an emergency stop control in which the brake is operated and power supply to the motor is interrupted. When the movement of the arm is detected based on an output of the rotational position detector during the emergency stop control, the control device supplies power to the motor to prevent the movement of the arm.

According to one embodiment of the invention, a system for safe retention of loads includes a motor configured to control operation of a load responsive to rotation of the motor, a holding brake configured to prevent rotation of the motor, a position feedback device operatively coupled to the motor and configured to generate a position feedback signal corresponding to an angular position of the motor, and a motor drive. The motor drive is configured to receive a command to stop rotation of the motor, bring the motor to a stop responsive to receiving the command, control operation of the holding brake via a first safety channel, and control operation of torque output to the motor from the motor drive via a second safety channel. The first safety channel is operative to set the holding brake responsive to stopping the motor, and the second safety channel is operative to disable torque production from the motor drive when the holding brake is set. The motor drive monitors the position feedback signal when the holding brake is set, and re-enables torque production via the second safety channel when the position feedback signal changes beyond a predefined threshold with the holding brake set.

According to another embodiment of the invention, a method for safe retention of loads receives a safety rated load retention request at a motor drive and brings the motor to a stop with the motor drive responsive to receiving the safety rated load retention request. The motor drive is operatively connected to a motor configured to lift a load responsive to rotation of the motor. A holding brake, configured to prevent rotation of the motor, is set with the motor drive via a first safety channel within the motor drive responsive to the motor drive stopping the motor. Torque production is disabled from the motor drive via a second safety channel within the motor drive responsive to setting the holding brake via the first safety channel. A position feedback signal, corresponding to an angular position of the motor, is monitored when the holding brake is set and the torque production is disabled, and the torque production is re-enabled via the second safety channel when the position feedback signal changes beyond a predefined threshold with the holding brake set.

According to yet another embodiment of the invention, a motor controller for safely retaining loads includes a motor output configured to supply voltage to a motor operatively connected to the motor controller, a brake output configured to supply an output signal, where the output signal is configured to control operation of a holding brake operatively coupled to the motor to prevent rotation of the motor, a position feedback input configured to receive a position feedback signal generated by a position feedback device operatively coupled to the motor, and a controller. The controller is configured to receive a safety rated load retention request and bring the motor to a stop responsive to receiving the safety rated load retention request. The motor is configured to control operation of a load responsive to rotation of the motor. The controller is further configured to generate the output signal for the brake output with a first safety channel responsive to the motor drive stopping the motor, disable torque production from the motor controller via a second safety channel within the motor drive responsive to generating the output signal, monitor the position feedback signal when the output signal is being generated and the torque production is disabled, and re-enable torque production via the second safety channel when the position feedback signal changes beyond a predefined threshold when the output signal is being generated.

These and other advantages and features of the invention will become apparent to those skilled in the art from the detailed description and the accompanying drawings. It should be understood, however, that the detailed description and accompanying drawings, while indicating preferred embodiments of the present invention, are given by way of illustration and not of limitation.

The subject matter disclosed herein describes an improved system and method for providing safety-rated operation of a motor and motor drive controlling operation of a load with stored potential energy. The system provides for a two-channel method of monitoring and retaining control of the load. A first safety channel is configured to control operation of a holding brake, where the holding brake provides sufficient holding force to prevent motion in the load resulting from the stored potential energy. A second safety channel is configured to independently provide feedback monitored control of the motor via the motor drive. One function of the second safety channel is to enable and disable torque production from the motor drive controlling operation of the motor. When torque production from the motor drive is enabled, the motor drive and motor are able to provide sufficient torque to prevent motion in the load resulting from the stored potential energy. Monitoring and subsequent control of each safety channel is provided to ensure that a single failure in either channel will not cause the unexpected release of the stored potential energy from the load.

Turning initially to <FIG>, an exemplary application incorporating one embodiment of the invention includes a conveyor system <NUM> transporting a series of pallets <NUM> with a part <NUM> loaded on each pallet. The conveyor system <NUM> passes through a protected region <NUM>, where the protected region has fencing <NUM> on three sides and a light barrier <NUM> on the fourth side. A robot, <NUM>, interacts with each part <NUM> as it travels through the protected region <NUM>. As illustrated, a technician <NUM> may need to periodically enter the protected region <NUM>. The technician <NUM> may, for example, need to perform periodic maintenance on the robot <NUM> or conveyor system <NUM>. Optionally, personnel may need to inspect a part <NUM> passing through the enclosed region <NUM>. By requiring entry through the light barrier <NUM>, an industrial controller, such as a programmable logic controller (PLC), may detect an interruption in the light barrier <NUM> as the technician <NUM> enters the protected region <NUM> and then put the robot <NUM> and/or conveyor system <NUM> into a safe operating state to prevent injury to the technician <NUM>. The safe operating state may simply cause motion of the robot <NUM> and or conveyor system <NUM> to stop motion. As illustrated, an arm <NUM> of the robot <NUM> may be raised, or partial ly raised, and constitute a suspended load. In order to ensure the protected region <NUM> is safe for the technician <NUM>, it is necessary to ensure that the arm <NUM> does not inadvertently lower, causing injury to the technician <NUM> inspecting the base of the robot <NUM>.

Turning next to <FIG>, a motor drive <NUM> may be operatively connected to a motor <NUM>, which is, in turn, configured to control a load, L, such as raising and lowering the arm <NUM> of the robot <NUM> shown in <FIG>. The motor drive <NUM>, which may incorporate the various embodiments of the invention disclosed herein, is configured to receive a three-phase AC voltage at an input <NUM> of the motor drive <NUM>. The input <NUM> of the motor drive is connected to a rectifier section <NUM> of the motor drive <NUM> and provides the three-phase AC voltage to the rectifier section <NUM>. The rectifier section <NUM> may include any electronic device suitable for passive or active rectification as is understood in the art. With reference also to <FIG>, the illustrated rectifier section <NUM> includes a set of diodes <NUM> forming a diode bridge that rectifies the three-phase AC voltage to a DC voltage on the DC bus <NUM>. Optionally, the rectifier section <NUM> may include other solid-state devices including, but not limited to, thyristors, silicon-controlled rectifiers (SCRs), or transistors to convert the input power <NUM> to a DC voltage for the DC bus <NUM>. The DC voltage is present between a positive rail <NUM> and a negative rail <NUM> of the DC bus <NUM>. A DC bus capacitor <NUM> is connected between the positive and negative rails, <NUM> and <NUM>, to reduce the magnitude of the ripple voltage resulting from converting the AC voltage to a DC voltage. It is understood that the DC bus capacitor <NUM> may be a single capacitor or multiple capacitors connected in parallel, in series, or a combination thereof. The magnitude of the DC voltage between the negative and positive rails, <NUM> and <NUM>, is generally equal to the magnitude of the peak of the AC input voltage.

The DC bus <NUM> is connected in series between the rectifier section <NUM> and an inverter section <NUM>. Referring also to <FIG>, the inverter section <NUM> consists of switching elements, such as transistors, thyristors, or SCRs as is known in the art. The illustrated inverter section <NUM> includes an insulated gate bipolar transistor (IGBT) <NUM> and a free-wheeling diode <NUM> connected in pairs between the positive rail <NUM> and each phase of the output voltage as well as between the negative rail <NUM> and each phase of the output voltage. Each of the IGBTs <NUM> receives gating signals <NUM> to selectively enable the transistors <NUM> and to convert the DC voltage from the DC bus <NUM> into a controlled three phase output voltage to the motor <NUM>. When enabled, each transistor <NUM> connects the respective rail <NUM>, <NUM> of the DC bus <NUM> to an electrical conductor <NUM> connected between the transistor <NUM> and the output terminal <NUM>. The electrical conductor <NUM> is selected according to the application requirements (e.g., the rating of the motor drive <NUM>) and may be, for example, a conductive surface on a circuit board to which the transistors <NUM> are mounted or a bus bar connected to a terminal from a power module in which the transistors <NUM> are contained. The output terminals <NUM> of the motor drive <NUM> may be connected to the motor <NUM> via a cable including electrical conductors connected to each of the output terminals <NUM>.

One or more modules are used to control operation of the motor drive <NUM>. According to the embodiment illustrated in <FIG>, a controller <NUM> includes the modules and manages execution of the modules. The illustrated embodiment is not intended to be limiting and it is understood that various features of each module discussed below may be executed by another module and/or various combinations of other modules may be included in the controller <NUM> without deviating from the scope of the invention. The modules may be stored programs executed on one or more processors, logic circuits, or a combination thereof. The controller <NUM> may be implemented, for example, in a microprocessor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), or other such customizable device. The motor drive <NUM> also includes a memory device <NUM> in communication with the controller <NUM>. The memory device <NUM> may include transitory memory, non-transitory memory or a combination thereof. The memory device <NUM> may be configured to store data and programs, which include a series of instructions executable by the controller <NUM>. It is contemplated that the memory device <NUM> may be a single device, multiple devices, or incorporated, for example, as a portion of another device such as an application specific integrated circuit (ASIC). The controller <NUM> is in communication with the memory <NUM> to read the instructions and data as required to control operation of the motor drive <NUM>.

The controller <NUM> receives a reference signal <NUM> identifying desired operation of the motor <NUM> connected to the motor drive <NUM>. The reference signal <NUM> may be, for example, a position reference (θ*), a speed reference (ω*), or a torque reference (T*). For a high performance servo control system, the reference signal <NUM> is commonly a position reference signal (θ*).

The controller <NUM> also receives feedback signals indicating the current operation of the motor drive <NUM>. According to the illustrated embodiment, the controller <NUM> includes a feedback module <NUM> that may include, but is not limited to, analog to digital (A/D) converters, buffers, amplifiers, and any other components that would be necessary to convert a feedback signal in a first format to a signal in a second format suitable for use by the controller <NUM> as would be understood in the art The motor drive <NUM> f3 may include a voltage sensor <NUM> and/or a current sensor <NUM> on the DC bus <NUM> generating a feedback signal corresponding to the magnitude of voltage and/or current present on the DC bus <NUM>. The motor drive <NUM> may also include one or more voltage sensors <NUM> and/or current sensors <NUM> on the output phase(s) of the inverter section <NUM> generating a feedback signal corresponding to the magnitude of voltage and/or current present on the electrical conductors <NUM> between the inverter section <NUM> and the output <NUM> of the motor drive.

The controller <NUM> utilizes the feedback signals and the reference signal <NUM> to control operation of the inverter section <NUM> to generate an output voltage having a desired magnitude and frequency for the motor <NUM>. The feedback signals are processed by the feedback module <NUM> and converted, as necessary, to signals for the control module <NUM>. The control module <NUM> also receives the reference signal <NUM> and executes responsive to the reference signal <NUM> and the feedback signals to generate a desired output voltage signal to a gate driver module <NUM>. The gate driver module <NUM> generates the gating signals <NUM>, for example, by pulse width modulation (PWM) <NUM> (see also <FIG>) or by other modulation techniques. The gating signals <NUM> subsequently enable/disable the transistors <NUM> to provide the desired output voltage to the motor <NUM>, which, in turn, results in the desired operation of the mechanical load, L, coupled to the motor <NUM>.

The controller <NUM> includes a brake module <NUM> configured to control operation a holding brake <NUM> operatively connected to the motor <NUM>. In some embodiments of the invention, the holding brake <NUM> may be connected to engage a portion of a drive train, such as a drive shaft remotely located from the motor <NUM> and between the motor <NUM> and the driven component of the industrial machine or process. The brake module <NUM> is configured to generate a control signal <NUM> to release and set the brake. A brake set feedback signal <NUM> is input to the motor drive <NUM>, passing through the feedback module <NUM> and back to the brake module <NUM>. When it is desired to operate the motor <NUM>, the brake module <NUM> is configured to generate the control signal <NUM> to release the brake and to monitor the brake set feedback signal <NUM> to verify the brake has been released. When the motor <NUM> is stopped, the brake module <NUM> is configured to reset the control signal <NUM> to release the brake and to monitor the brake set feedback signal <NUM> to verify that the holding brake <NUM> is set. Operation of the brake module <NUM> will be discussed in more detail below.

Referring next to <FIG>, an exemplary control module <NUM> for the motor drive <NUM> is illustrated. The control module <NUM> receives the position reference signal (θ*) <NUM> as an input. The control module <NUM> includes a number of control loops. According to the embodiment illustrated in <FIG>, the control module <NUM> includes a position control loop, a velocity control loop, and a current control loop. The control loops are shown as cascading control loops where an output of one control loop is provided as an input to another control loop. It is contemplated that various other control topologies may be utilized within the motor drive <NUM>.

In the position control loop, the position reference signal (θ*) <NUM> is compared to a position feedback signal (θ) <NUM> at a first summing junction <NUM>. A position error signal is output from the first summing junction <NUM> and input to a position loop controller <NUM>. According to the illustrated embodiment, the position loop controller <NUM> is a proportional-integral (PI) controller. Optionally, the position loop controller <NUM> may be just a proportional (P) controller or further include a derivative (D) component. Each of the proportional (P), integral (I), and/or derivative (D) components of the position loop controller <NUM> includes a controller gain. The position loop controller gains are commonly referred to as a position loop proportional gain (Kpp), position loop integral gain (Kpi), and a position loop derivative gain (Kpd). The output of the position loop controller <NUM> is a velocity reference signal (ω*).

In the velocity control loop, the velocity reference signal (ω*) is compared to a velocity feedback signal (ω) at a second summing junction <NUM>. The velocity feedback signal (ω)) is generated by taking a derivative, as shown in the derivative block <NUM>, of the position feedback signal (<NUM>). The velocity feedback signal (ω) may also be filtered by a velocity filter block <NUM>. A velocity error signal is output from the second summing junction <NUM> and input to a velocity loop controller <NUM>. According to the illustrated embodiment, the velocity loop controller <NUM> is a proportional-integral (PI) controller. Optionally, the velocity loop controller <NUM> may be just a proportional (P) controller or further include a derivative (D) component. Each of the proportional (P), integral (I), and/or derivative (D) components of the velocity loop controller <NUM> includes a controller gain. The velocity loop controller gains are commonly referred to as a velocity loop proportional gain (Kvp), velocity loop integral gain (Kvi), and a velocity loop derivative gain (Kvd). The output of the velocity loop controller <NUM> is an acceleration reference signal.

The control module <NUM> may also include feed forward branches. According to the illustrated embodiment, the control module <NUM> includes feed forward branches for both the velocity and the acceleration elements. The position reference signal (θ*) is passed through a first derivative element <NUM> to obtain a velocity feed forward signal. The velocity feed forward signal is multiplied by a velocity feed forward gain (Kvf) <NUM> and combined with the velocity reference signal (ω*) and the velocity feedback signal (ω) at the second summing junction <NUM>. The velocity feed forward signal is passed through a second derivative element <NUM> to obtain an acceleration feed forward signal. The acceleration feed forward signal is multiplied by an acceleration feed forward gain (Kaf) <NUM> and combined with the acceleration reference signal at a third summing junction <NUM> to generate a modified acceleration reference signal (α*'). As is understood in the art, the output of the third summing junction <NUM> is also commonly referred to as a torque reference signal. The angular acceleration in a motor is proportional to the torque and may be found by multiplying the angular acceleration by the inertia. In one embodiment of the control module <NUM>, the inertia may be incorporated into the controller gains for the velocity loop controller <NUM> and the feed forward gain <NUM>, thereby saving a calculation within the controller <NUM>. Optionally, an inertia gain block may be included after the summing junction <NUM> to convert the modified acceleration reference signal (α*') to a torque reference signal.

The modified acceleration reference signal (α*') or torque reference signal output from the third summing junction <NUM> is further processed prior to generating gate signals <NUM> for the inverter section <NUM>. The modified acceleration reference signal (α*') or torque reference signal is provided as an input to a filter section <NUM>. The filter section <NUM> may include one or more filters to remove unwanted components from the control system, such as a low pass filter to attenuate undesirable high frequency components or a notch filter to attenuate specific frequency components having an undesirable effect on the controlled mechanical load. It is further contemplated that additional filters may be included in the filter section without deviating from the scope of the invention. It is further contemplated that the inertia gain may be incorporate into a filter or within a gain inside the filter section <NUM>. Whether provided as an input to the filter section <NUM> or converted within the filter section <NUM>, the output of the filter section <NUM> is a torque reference, T*.

The output of the filter section <NUM> is passed through a torque gain block <NUM>. The torque gain block <NUM> includes a torque constant (Kt) which defines a relationship between the current provided to the motor <NUM> and the torque output by the motor. The torque gain block <NUM> may include one or more additional gain elements combined with the torque constant (Kt) to produce a desired current reference (I*) to a current regulator <NUM>. The current regulator receives a current feedback signal (Ifdbk) from the current sensors <NUM> at the output of the motor drive <NUM> and utilizes a current controller, which may include proportional, integral, and/or derivative components to regulate the current in the motor <NUM>. The output of the current regulator <NUM> is provided to the gate driver <NUM> which, in turn, generates the switching signals <NUM> to the inverter section <NUM>.

The output of the gate driver <NUM> is illustrated as being supplied to the plant <NUM> of the controlled system. In a motion control system, the plant <NUM> typically includes the inverter section <NUM> of the motor drive <NUM>, the motor <NUM>, a mechanical load, a position feedback device <NUM>, and mechanical couplings between the motor <NUM> and mechanical load or between the motor <NUM> and a position feedback device <NUM>. The position feedback device <NUM> generates the position feedback signal (θ) used by the control module <NUM>.

With reference again to <FIG>, the output of the control module <NUM> is provided as an input to the gate driver module <NUM>. The gate driver module <NUM> converts the output of the current regulator to a desired output voltage having a variable amplitude and frequency, where the amplitude and frequency are selected to produce the desired operation of the motor <NUM>. The gate driver module <NUM> then generates the gating signals <NUM> used by pulse width modulation (PWM) or by other modulation techniques to control the switching elements in the inverter section <NUM> to produce the desired output voltage. The gating signals <NUM> subsequently enable/disable the transistors <NUM> to provide the desired output voltage to the motor <NUM>, which, in turn, results in the desired operation of the mechanical load coupled to the motor <NUM>.

In certain applications, typically when human interaction is required with a controlled machine or process, control of the machine or process must occur according to a specified safety rating. Safety ratings define a level of risk associated with a specific hazard in an application. One common industrial standard for defining these levels of risk is the Safety Integrity Level (SIL) standard defined according to the International Electrotechnical Commission (IEC). The IEC defines four different SIL ratings, where SIL-<NUM> is the lowest safety level and SIL-<NUM> is the highest safety level. Each safety level defines a probability at which a failure may occur. In order to achieve a certain safety level, the control system must be configured such that, based on a risk analysis of the system, the control system satisfies the probability of a failure occurring for a desired safety level. One common way an industrial control system may achieve a desired safety rating is to provide redundancy in a system. Redundancy allows a single failure to occur within the control system while maintaining safe control of the system.

Providing independent safety channels within the controller, where each safety channel is operationally independent of the other, may allow the control system to achieve a desired safety rating. The desired safety rating may be, for example, a SIL-<NUM> safety rating according to the IEC standard or a Category <NUM> safety rating according to a Machine Safety Standard <NUM>-<NUM> (MSS). It is contemplated that the two independent safety channels may even be configured to achieve a Category <NUM> safety rating under MSS.

As previously indicated, there are numerous applications in which a load may acquire potential energy. These include, but are not limited to, a spring winding up, tension being applied to a web of material, or a load being raised. For ease of discussion, this specification will refer to an application in which a load is being suspended as one type of application in which a safety rating may be required. Suspension of a load does not necessarily require vertical lifting of a load. Any load which requires a motor to move and which, upon removal of control by the motor may be acted upon by gravity to cause motion of that load may be considered suspended. This includes, for example, a robotic arm, as illustrated in <FIG>, which may rotate about a pivot point or a conveyor system operating on an incline. This application is intended to be exemplary and not limiting and it is understood that the concepts discussed herein could apply to other loads in which potential energy is stored in the load or in the system as a result of controlling the motor <NUM> with the motor drive <NUM>.

In operation, the motor drive <NUM> receives multiple input signals to define desired operation of the motor drive <NUM>. The input signals include, for example, an enable input signal which enables the controller <NUM> within the motor drive to execute various modules, including the control module <NUM>, the brake module <NUM> and the like. The input signals also include a run command and/or a stop command. Optionally, a single input signal may be provided which corresponds to a run command in one state and a stop command in an opposite state. In still another embodiment, an analog input signal may define a desired speed of operation of the motor, wherein when the analog input is at zero volts, the motor <NUM> is commanded to stop and when the analog input is at a maximum voltage, such as any voltage in the range of <NUM>-<NUM> VDC and which may be set by a parameter stored in memory <NUM>, the motor is commanded to operate at rated speed. Still another input signal may be provided to indicate a desired direction of rotation of the motor <NUM>. Each of the input signals are provided to the controller <NUM>, where a series of instructions executing on a processor, a logic circuit, or a combination thereof, receive the input signals and cause the motor drive <NUM> to execute accordingly. The input signals may be provided as discrete signals at separate input terminals or be provided as data stored within a data packet communicated via an industrial network.

The present invention provides a system for safety-rated operation of a motor and a holding brake controlling operation of a suspended load. A first safety channel is provided within the motor drive <NUM> to control the holding brake <NUM>, and a second safety channel is provided within the motor drive <NUM> to independently provide feedback monitored control of the motor via the motor drive, where one function of the second safety channel is to enable torque production in the motor <NUM>. The two safety channels prevent a single failure from occurring which may cause a suspended load from lowering unexpectedly. The controller <NUM> of the motor drive is configured to provide two independent control channels and redundancy according to a desired safety level. It is contemplated, that each input signal may be provided as a redundant input signal with a logic input interface comparing inputs to verify that pairs of input signals are in the same state. The controller <NUM> may include redundant processors and/or logic circuits with comparison between inputs and outputs of the processor and/or logic circuits verifying correct operation of the controller <NUM>. The first safety channel may include a logic circuit, a processor, or a combination thereof within the controller <NUM> which is configured to control operation of the holding brake <NUM>. The second safety channel may similarly include a logic circuit, a processor, or a combination thereof within the controller <NUM> which is configured to enable torque production in the motor <NUM>. It is contemplated that each safety channel may be implemented in part, or on whole using the same redundant components, such as the same pair of processors or the same pair of input signals. However, the first and second safety channels operate independently of each other within the controller to the extent that a failure of one channel will not cause a failure of the other channel.

Turning next to <FIG>, a timing chart <NUM> illustrates steps for safe suspension of loads using the first and second safety channels according to one embodiment of the invention. At time, t0, a safety rated load retention request (SLreq) signal <NUM> is received at an input to the motor drive <NUM>. The motor drive <NUM> verifies that the safety rated load retention request may begin and sets an internal status flag <NUM> indicating that a safe load retention process is active (SLact). Between times t0 and t1, the motor drive <NUM> is configured to bring the motor <NUM> to a stop. Once the motor <NUM> has reached zero speed or is below a minimum speed threshold, the motor drive <NUM> commands the brake to set. The brake module <NUM> in the controller <NUM> removes a Brake active (Bact) signal <NUM>, as shown at time t1, which de-energizes a brake coil and, in turn, causes the holding brake <NUM> to set. A first delay time <NUM> passes between commanding the holding brake <NUM> to set at time t1 and the holding brake physically being set as indicated by the Brake Set (Bset) feedback signal <NUM> transitioning to high at time t2.

Once the Brake Set signal <NUM> is received, the controller <NUM> begins monitoring the position feedback signal <NUM>, θ, for undesired motion, and a Safe Load Monitor (SLmon) status bit <NUM> is set. When the holding brake <NUM> is set, there should be no motion on the motor <NUM>, and the position feedback signal <NUM>, θ, should remain at a constant value, corresponding to the angular position at which the motor <NUM> was located when the brake set. A first bandwidth <NUM> is set within the motor drive <NUM> corresponding to an acceptable level of movement of the motor <NUM> with the holding brake set. The movement may occur, for example, as a few additional counts being read as a result of vibration of the holding brake <NUM> setting or from the brake set signal <NUM> being triggered before the holding brake <NUM> is fully set. To avoid nuisance or erroneous trips, an upper acceptable limit <NUM> and a lower acceptable limit <NUM> define the bandwidth <NUM> within which the position feedback signal <NUM> may change. It is contemplated that the bandwidth <NUM> is defined by one or more parameters stored within the memory device <NUM> of the motor drive <NUM> and is user configurable according to the application requirements. A single parameter may define the bandwidth <NUM> or an acceptable difference between the position feedback signal <NUM>, θ, and a change in position. Optionally, a first parameter may define the upper acceptable limit <NUM> and a second parameter may define the lower acceptable limit <NUM>. if the position feedback signal <NUM>, θ, remains within the bandwidth <NUM> while the brake is set, no action is required by the safe load retention function. A second delay time <NUM> is defined within the safe vertical function which defines a maximum allowable time in which the holding brake <NUM> is set. As illustrated in <FIG>, the second delay time <NUM> is set greater than the expected delay time <NUM> required for the holding brake <NUM> to set.

While commanding the brake to set, the first safety channel is also in communication with the second safety channel. The first safety channel sets an internal status flag requesting a Safety Torque Off (SToff) <NUM> operation. The second safety channel monitors the SToff <NUM> signal and waits for the second delay time <NUM> to ensure that the holding brake <NUM> has set. At time t3, the second safety channel then disables die torque output from the motor drive <NUM>, as shown by the Torque Off (Toff) signal <NUM>. With the Toff signal <NUM> set, the motor drive <NUM> is inhibited from supplying voltage to the motor <NUM> to prevent torque generation by the motor. With reference also to <FIG>, the second safety channel uses the safety circuit <NUM> to output a torque inhibit signal <NUM> to the gate driver <NUM> when it is desired to disable torque. For ease of illustration, the torque inhibit signal is illustrated as being supplied to a logical AND-gate <NUM> along with the output <NUM> of the modulation routine <NUM>. The output <NUM> of the modulation routine is a set of gating signals with a separate signal for each transistor <NUM> in the inverter. It is contemplated that the torque inhibit signal <NUM> may be a single signal which, prevents each output signal <NUM> from being supplied to the inverter <NUM>. Optionally, the gate driver <NUM> may be configured to allow a limited amount of torque to be produced and the gate driver <NUM> may generate individual torque inhibit signals corresponding to each transistor <NUM> to temporarily permit some of the modulation signals <NUM> to be output. According to still another option, the second safety channel may be configured to monitor the feedback signals from tire current sensors <NUM> and may permit a limited amount of torque to be generated by the motor <NUM> but may set the torque inhibit signal <NUM> if the current feedback and, therefore, the torque being produced by the motor <NUM> exceeds a predefined value. When the torque inhibit signal <NUM> is off, the signal is combined with the output of the modulation routine <NUM> such that the modulation signals <NUM> become the gating signals <NUM> used to control operation of the inverter <NUM>, allowing normal operation of the inverter <NUM>. It is not unusual for a motor drive <NUM> and motor <NUM> to be rated with a sufficient voltage and current rating that the resultant torque generated by the motor would exceed the holding torque of the holding brake <NUM> and cause the motor <NUM> to drive through brake. By disabling or limiting torque production, the second safety channel prevents a fault in the motor drive from driving through the holding brake and causing undesired motion of the suspended load.

Returning again to <FIG>, the first safety channel monitors the position feedback signal <NUM>, θ, while the second safety channel is disabling torque production to ensure that position feedback signal <NUM>, θ, remains within the acceptable bandwidth <NUM>. If, as shown at time t4, the holding brake <NUM> is not able to prevent the load. L, from causing rotation of the motor <NUM> and the position feedback signal <NUM>, θ, changes beyond an acceptable limit, the first safety channel removes the internal status flag requesting a Safety Torque Off (SToff) <NUM> operation and a Safe Load Alarm (SLalm) <NUM> is set. As previously indicated, the second safety channel monitors the Safety Torque Off (SToff) <NUM> request and immediately removes the Torque Off (Toff) signal <NUM> upon detection of the holding brake <NUM> being unable to hold the suspended load. By removing the Torque Off (Toff) signal <NUM>, the gate driver <NUM> is again able to supply voltage and current to the motor <NUM> which, in turn, generates torque within the motor <NUM>. The motor <NUM> may, therefore, provide a second method of holding the suspended load. The motor drive <NUM> regulates the motor <NUM> to provide sufficient torque to prevent the suspended load from lowering in the event of a holding brake failure.

The potential still exists for both channels failing. At time t5, the position feedback signal <NUM>, θ, is observed exceeding a second threshold value <NUM>. A second bandwidth <NUM> is set within the motor drive <NUM> corresponding to a maximum level of movement of the motor <NUM> to be detected before setting a fault condition during the safe load retention function. An upper maximum limit <NUM> and a lower maximum limit <NUM> define the second bandwidth <NUM> within which the position feedback signal <NUM> may change. It is contemplated that the second bandwidth <NUM> is defined by one or more parameters stored within the memory device <NUM> of the motor drive <NUM> and is user configurable according to the application requirements. A single parameter may define the bandwidth <NUM> or an acceptable difference between the position feedback signal <NUM>, θ, and a change in position. Optionally, a first parameter may define the upper maximum limit <NUM> and a second parameter may define the lower maximum limit <NUM>. If the position feedback signal <NUM>, θ, remains within the second bandwidth <NUM> no fault is set. If, however, neither the holding brake <NUM> nor the motor <NUM> nor a combination thereof is sufficient to present an undesirable level of motion on the motor <NUM> a Safe Load Limit (SLlmt) <NUM> fault condition is set. The fault signal <NUM> may be provided to a PLC in communication with the motor drive <NUM> to take any additional action as may be required by the application and as configured within the PLC.

Claim 1:
A system for safe retention of loads, the system comprising:
a motor (<NUM>) configured to control operation of a load responsive to rotation of the motor;
a holding brake (<NUM>) configured to prevent rotation of the motor;
a position feedback device (<NUM>) operatively coupled to the motor and configured to generate a position feedback signal (<NUM>) corresponding to an angular position of the motor; and
a motor drive (<NUM>) configured to:
receive a command (<NUM>) to stop rotation of the motor,
bring the motor to a stop responsive to receiving the command,
control operation of the holding brake via a first safety channel, wherein the first safety channel is operative to set the holding brake responsive to stopping the motor,
receive a brake set feedback signal (<NUM>) indicating that the holding brake has physically been set;
once the brake set feedback signal is received, begin monitoring the position feedback signal;
control operation of torque output to the motor from the motor drive via a second safety channel, wherein the second safety channel is operative to disable torque production from the motor drive when the holding brake is set, and
re-enable torque production via the second safety channel when the position feedback signal changes beyond a predefined threshold with the holding brake set.