Patent Description:
Machinery manufactured in the European Union is now required to demonstrate safety against injury by the application of the standards IEC62061 and ISO <NUM> and related standards which, in order to mitigate risk, and consistent with the philosophy of Functional Safety, require the torque exerted by the motor to be limited a fail-safe manner; this is termed Safely Limited Torque, hereafter termed 'SLT', as defined in the standard IEC <NUM>-<NUM>-<NUM>.

The practice and terminology of functional safety will be briefly reviewed. The process sub-system is that part of the drive not related to functional safety. 'Safe Torque Off', hereafter termed 'STO', means a safety control function that prevents the generation of torque in a motor-drive sub-system. Therefore 'putting the drive in STO' means that the safety sub-system is disabling the drive. A 'Hardware Fault Tolerance', or simply 'HFT', of N means that N+<NUM> faults could cause a loss of the safety-related control function. One-out-of-two, written 1oo2, indicates a two-channel safety scheme with HFT=<NUM>. 'Probability of dangerous Failure per Hour', or simply PFHD, is the average probability of a dangerous failure per hour of a safety related system or sub-system to perform the specified safety function. 'Safety Integrity Level', hereafter termed 'SIL', means the probability of a safety control system or sub-system satisfactorily performing the required safety-related control functions under all stated conditions lies within a prescribed range. IEC62061 defines three levels of SIL; SIL1 which has a PFHD in the range ≥ <NUM>-<NUM> to < <NUM>-<NUM>, SIL2 which has a PFHD in the range ≥ <NUM>-<NUM> to < <NUM>-<NUM> and SIL3 which has a PFHD in the range ≥ <NUM>-<NUM> to < <NUM>-<NUM> and is the most stringent. Note that in addition to these PFHD requirements, each SIL also has 'architectural requirements', namely each SIL must be realized by certain prescribed structures, as set out in table <NUM> of IEC <NUM>. Further architectural requirements may be imposed by other machinery standards such as the robotics safety standard ISO <NUM> which requires at least SEL2 and HFT=<NUM> for all safety functions. In practice therefore, a safety sub-system that implements Safely Limited Torque must have two channels. Redundancy, such as in <CIT>, is a key concept in the implementation of functional safety, in a two-channel system one of the channels is effectively a redundant channel that is present so that, in the event of a discrepancy between the two channels, voting logic will put the system into a safe state using STO, see for example "ACTIVE CUBE Application manual - Safe Torque Off",Bonfiglioli Vectron. The channels of a two-channel safety system can be realized with identical hardware or they can use different hardware and this is advantageous as it reduces common cause failures by adding diversity to the safety sub-system. The term 'Black Channel' in communication means transmitting safety-related information through non-safe hardware in a reliable fashion by using additional checking measures in the communication protocol. 'Diagnosis' is the automatic testing of a safety channel and includes the checking of a first safety channel by a second safety channel. 'Fault Reaction' is the action taken by the safety sub-system when the process sub-system exceeds a prescribed safe limit or when an internal fault has been detected within the safety sub-system itself. In sectors such as aviation, the fault reaction of the safety sub-system is to cause a back-up control system to operate: this is called 'fail to operational'. However in the machinery sector the fault reaction is to shut-down at least part of the machine using STO and thus render it safe; the fault reaction is said to be 'fail-safe'. Finally, it should be noted that functional safety places constraints on how the product is conceived, designed, tested and maintained; these safe processes are in addition to ordinary engineering practices.

In a permanent magnet synchronous motor, torque is produced by the product of the vector of current and the vector of flux. <NPL>) represents this in his equation (<NUM>) and this can be equivalently expressed as: the motor torque is proportional to the sine of the angle between the rotor flux vector and the stator current vector multiplied by the magnitude of the rotor flux vector and the magnitude of stator current vector. The reader may refer to LEONHARD chapter <NUM> for a full explanation of the control of permanent magnet AC servo motors.

There are four reasons for measuring current in a servo drive: firstly, to commutate the motor and perform closed-loop control of the motor torque; secondly, to protect the power electronics from excessive peak currents that might arise from a fault in the motor or motor cable; thirdly, to operate the motor windings and drive electronics within their thermal limits; and fourthly, to implement safely limited torque.

<FIG> and <FIG> show typical sets of locations for current sensors that are found in servo drives offered on the market today.

In <FIG> there are current sensors <NUM>, <NUM> and <NUM> in series with each of the low side IGBTs of inverter bridge <NUM>. The term IGBT in this document simply means 'semiconductor switch' and could equally be a power MOSFET or similar device. The pair of IGBTs in a phase leg are switched in a complementary fashion, thus when low side IGBT <NUM> is ON then high side IGBT <NUM> is off and vice-versa. Consider sensor <NUM>, when its respective low side IGBT <NUM> is ON then the current in sensor <NUM> is representative of the U phase current. Sensors <NUM> and <NUM> can similarly sense the V and W phase currents when the respective low side IGBTs are ON. Therefore, when all three low-side IGBTs <NUM>, <NUM>, <NUM> are ON simultaneously then the respective current sensors <NUM>, <NUM>, <NUM> simultaneously provide valid measurements of the U, V and W phase currents.

An advantage of the scheme of <FIG> is that the current sensors <NUM>, <NUM> and <NUM> can be resistors and, if the drive control circuit (not illustrated) is also referred to the negative bus <NUM>. then there is no requirement for level translation; therefore the current sensing scheme of <FIG> is low cost.

There are drives, particularly low voltage drives, on the market using the current sensing arrangement of <FIG>, however there are reasons why the current sensing arrangement of <FIG> is not widely used, particularly at high bus voltages. One reason is that packaged IGBT inverter bridges such as type FP150R12KT4 from Infineon Semiconductor do not allow the connection of a sensor in series with the emitter of each low side IGBT. A second reason is that the phase currents must be sampled when the low-side IGBTs are ON whereas current measurements that are continuously valid are preferred for the purposes of both current control and over-current protection.

In <FIG> there are current sensors <NUM>, <NUM> and <NUM> in series with U, V and W phase currents flowing into the motor <NUM>. The current sensors <NUM>, <NUM> and <NUM> allow both the calculation of the stator current vector, hereafter termed 'current vector', and the detection of fault currents that would arise from a short-circuit to chassis. The phase current sensors <NUM>, <NUM> and <NUM> are typically each implemented as a resistor in combination with a voltage isolation circuit, or alternatively for higher current drives, as DC current transformers. Both types of sensor circuit are of a size and cost that is significant in relation to the product as a whole; therefore there is commercial pressure to use fewer sensors of this type.

The sum of the motor phase currents is zero and therefore the current vector can be calculated from just two of the phase currents and thus it is sufficient to use only two current sensors, say <NUM> and <NUM> for closed-loop control of the motor currents. Therefore <FIG> has only two current sensors <NUM> and <NUM> to monitor the current in the U and V motor phases. The DC link current is also measured at <NUM> because it is necessary to protect the W phase current against short-circuit currents that are not detected by sensors <NUM> and <NUM>. The measurement from <NUM> is used solely to switch off the gate drives to the IBGT module <NUM>, this action does not require isolation with respect to the gate driver circuit (not illustrated) for the IBGT module <NUM> and therefore the over-current protection circuit (not illustrated) can be referenced to the negative voltage bus <NUM>: in other words using a current sensor <NUM> in the negative DC bus <NUM> is a cost-effective way of protecting the IGBT inverter bridge <NUM> against fault currents.

TAKAHASHI (<CIT>) teaches a scheme for the measurement of phase current that measures the sum of the U and V currents, thereby measuring the W phase current using iw = -iu-iv, and the sum of the V and W currents, thereby measuring the U phase current using iu = -iw-iv, using special DC current transformers having two primary windings that can thereby sense the sum of two currents. This technique is applicable to a variant of <FIG> but in the interests of brevity it will not be described further.

The prior art of Safely Limited Torque will be briefly reviewed. For accurate limitation of torque, with the option of different positive and negative limit values, it is necessary for the drive electronics to know the position and magnitude of the current vector and the position and magnitude of the rotor flux vector - hereafter termed 'flux vector'. For an AC permanent magnet servo that has surface magnets, the flux vector is aligned with the rotor magnets and therefore the position of the rotor within an electrical turn can be used to indicate of the angle of the flux vector. The magnitude of the flux vector is set during the magnetizing process as part of manufacture and therefore the position of the rotor is indicative of both the angle and the amplitude of the rotor flux vector.

An AC permanent magnet servo that has interior magnets has a rotor flux vector that results from the sum of the flux vector from the magnets and a contribution form the stator current vector. Thus there is additional computational complexity when calculating the flux vector for an interior magnet motor but no additional quantities need to be measured over those required for torque estimation for surface magnet motors. This invention applies equally to both types of motor.

It is an architectural requirement of safety standard ISO <NUM> ("Safety requirements for industrial robots") and is preferred in safety standard ISO <NUM>-<NUM> ("Safety of machinerySafety-related parts of control systems") that in the safety sub-system shall be two-channel, including the measurement of the rotor position and current vector.

A two-channel measurement of the rotor position can be performed using a two-channel encoder rated for functional safety at SIL2 or above. It is alternatively and equivalently possible to monitor two encoders of safety rating SIL1 to achieve safe position monitoring to SIL2.

A two-channel current vector measurement can be implemented using a duplicated set of sensors, for example by elaborating the prior art of <FIG> to include a further, redundant, pair of phase current sensors <NUM> and <NUM> into the prior art of <FIG>. The main disadvantage of this implementation is that it requires inclusion of further current sensors with their attendant size and cost penalties.

A two-channel current vector measurement can alternatively be implemented by making a measure of all three phase currents as shown in <FIG> and making use of the identity iu+iv+iw≡<NUM>; this is the method of SCHWESIG (<CIT>). In effect, the two current measurements are treated by the safety sub-system as a first channel and second channel is constructed from different pairs of phase currents. SCHWESIG teaches an implementation of SLT using the current measurement scheme of <FIG> in combination rotor position measurements and other items. In brief, SCHWESIG calculates the product of the current vector and flux vector, this is done twice as a part of a two-channel safety sub-system wherein a disparity between the two computed values of torque shut down the drive using safe torque-off (STO). If the calculated torque exceeds the threshold value, then the drive is shut down using STO. SCHWESIG measures current in the manner of <FIG> but it would be advantageous in respect of both size and cost to implement safely limited torque (SLT) in the manner of <FIG>, namely to do so with the minimum, cheapest set of current sensors that is already present to protect the IGBT module.

The technique of SCHWESIG is adaptable to the current monitoring scheme of <FIG> by computing first and second torque values when the low side IGBTs are all ON simultaneously.

<NPL>) teaches a technique for inferring the three phase currents from the current returning to negative link <NUM> using just a single current sensor <NUM>. Note that there is a variable delay between the current measurement and the subsequent application of voltage; for this reason and because of the two abnormal conditions described below this technique is seldom used for closed loop control.

The invention is disclosed in the appended claim <NUM>. A torque-limiting safety circuit servo drive for AC permanent magnet motors is provided including a three-phase inverter bridge, a first current sensor in series with a first motor phase, a second current sensor in series with a second motor phase, a third current sensor in series with the DC bus, and a drive control circuit that controls the six pulse-width modulated gate drive signals for the three-phase inverter bridge. The drive circuit has first and second safety channel STO inputs whereby either channel can shut down the three-phase inverter bridge. The drive circuit emits a signal set to represent the switching state of the three-phase inverter bridge. The drive circuit modifying the switching pattern of the PWM so as to ensure that the dwell times of pulse-width modulation are sufficiently long to allow a valid measurement of phase current using the bus current sensor. A first safety processor controls the first safety channel STO input of the drive control circuit, and a second safety processor controlling the second safety channel STO input of the drive control circuit.

A torque-limiting safety circuit is further provided including a current vector re-constructor circuit wherein the current vector re-constructor circuit is supplied by the drive control circuit with a signal set representing the switching state of the three-phase inverter bridge, the current vector re-constructor circuit is further supplied with a signal representing the DC link current from the third current sensor, the current vector re-constructor constructs and second redundant estimated current vector, the current vector re-constructor circuit emits a signal set representing the estimated current vector and an error indication that confirms that the current vector estimate is valid. The first safety processor is supplied with the first phase current measurement and the second phase current measurement, wherein the first safety processor computes the motor torque and shuts down the three-phase inverter bridge using the first safety channel STO input of the drive control circuit when the motor exceeds a prescribed limit value. The second safety processor is supplied with the redundant estimated current vector and its related error indication, wherein the second safety processor computes the motor torque and shuts down the three-phase inverter bridge using the second safety channel STO input of the drive control circuit when the motor torque exceeds the prescribed limit value.

A torque-limiting safety circuit is further provided including a rotor position sensor sub-system that emits two independent measurements of position wherein the first safety processor is further supplied with a first measurement of rotor angle whereby, in combination with its respective computed current vector, it computes a signed value of motor torque and shuts down the three-phase inverter bridge using the first safety channel STO input of the drive control circuit when the motor torque exceeds either a prescribed positive limit value or a prescribed negative limit value. The second safety processor is further supplied with a second measurement of rotor angle whereby, in combination with its respective computed current vector, it computes a signed value of motor torque and shuts down the three-phase inverter bridge using the second safety channel STO input of the drive control circuit when the motor torque exceeds either the prescribed positive limit value or the prescribed negative limit value.

A torque-limiting safety circuit is further provided including a first current vector calculator and error detector circuit and a first current vector calculator and error detector circuit wherein a first current vector calculator and error detector circuit monitors the signal from the first phase current sensor, the signal from the second phase current sensor, the signal from the third current sensor in series with the DC bus. The signal set represents the switching state of the three-phase inverter bridge and thereby computes the current vector which it supplies as a signal set to the first safety processor. The first current vector calculator compares the signal from the third current sensor in series with the DC bus against the first or second phase current sensor as guided by the signal set representing switching state of the three-phase inverter bridge and by this means supplies a fault signal to the first safety processor denoting a discrepancy in the current measurement, thereby causing the first safety processor to shut down the drive using the first safety channel STO input. A second current vector calculator and error detector circuit monitors the signal from the first phase current sensor, the signal from the second phase current sensor, the signal from the third current sensor in series with the DC bus, the signal set representing the switching state of the three-phase inverter bridge and thereby computes the current vector which it supplies as a signal set to the second safety processor. The second current vector calculator compares the signal from the third current sensor in series with the DC bus against the first or second phase current sensor as guided by the signal set representing switching state of the three-phase inverter bridge and by this means supplies a fault signal to the second safety processor denoting a discrepancy in the current measurement, thereby causing the second safety processor to shut down the drive using the second safety channel STO input. The first safety processor is supplied with the first phase current measurement from the first current vector calculator, wherein the first safety processor computes the motor torque and shuts down the three-phase inverter bridge using the first safety channel STO input of the drive control circuit when the motor exceeds a prescribed limit value. The second safety processor is supplied with the second phase current measurement from the second current vector calculator, wherein the second safety processor computes the motor torque and shuts down the three-phase inverter bridge using the first safety channel STO input of the drive control circuit when the motor torque exceeds the prescribed limit value.

The features and advantage of the invention are apparent from the following description taken in conjunction with the accompanying drawings in which:.

This invention makes a two-channel measurement of the current vector using the arrangement of current sensors in <FIG>. The first safety channel will be termed safety channel A and the second safety channel will be termed safety channel B. The safety sub-system uses the phase current measurements from sensors <NUM> and <NUM> to form the current vector for safety channel A using the well-known Clarke transformation from LEONHARD equation (<NUM> a) in combination with Kirchoff's current law identity iu+iv+iw≡<NUM> as shown in <FIG>.

The current vector for safety channel B is derived from the bus current sensor <NUM> but here the measurements of the phase currents are discontinuous and are multiplexed through sensor <NUM> by the inverter bridge <NUM>. This uses the technique of BOYS. For example when IGBTs <NUM>, <NUM> and <NUM> are all ON and the remaining IGBTs <NUM>, <NUM> and <NUM> are all OFF then the current in sensor <NUM> is the U phase current with positive polarity. The eight possible states of inverter bridge <NUM> are shown in <FIG> and it will be seen that states <NUM><NUM> and <NUM><NUM>, namely all low side IGBTs are ON and all high-side IGBTs are ON respectively, apply no net voltage between the motor phases, these two states are therefore termed zero states and the remaining six states are termed active states.

The most common scheme of pulse width modulation in servo drives is for the switching frequency to be fixed and for one phase to switch at a time, therefore the inverter bridge <NUM> will dwell twice at each of the states shown in <FIG> during a PWM cycle. The states are represented as binary numbers. For example, inverter bridge <NUM> will start at zero state <NUM><NUM> and then switch to either <NUM><NUM> or <NUM><NUM> or <NUM><NUM> and then to <NUM><NUM> or <NUM><NUM> or <NUM><NUM> and then to zero state <NUM><NUM>, in the second half of the cycle inverter bridge <NUM> switches to <NUM><NUM> or <NUM><NUM> or <NUM><NUM> and then <NUM><NUM> or <NUM><NUM> or <NUM><NUM> before returning to the initial zero state <NUM><NUM>. Regardless of the exact sequence of states it will be seen that the inverter bridge <NUM> will dwell at each of the eight states during a PWM cycle and therefore that a measurement of each of the three phase currents is available twice per switching cycle.

In the first preferred embodiment of this invention, the safety sub-system creates the current vector measurement for safety channel B using the phase current measurements according to the table of <FIG> using the formula of <FIG> as derived from LEONHARD page <NUM>.

The current vector measurement for safety channel B according to <FIG> requires sampling and storing in a respective memory or logic register to be performed for each phase current measurement as they become available through the states of <FIG> so that the second measurement of the current vector can be re-constructed from these sequential measurements of the phase currents.

The elements of the safety sub-system that are required to implement SLT according to the first embodiment are depicted in <FIG>. <NUM>-X corresponds to the input section of the current sensor <NUM> and <NUM>-Y corresponds to the output section of the same sensor. The same input-output nomenclature is applied to current sensors <NUM> and <NUM>.

The current vector re-constructor circuit <NUM> is supplied with two input signals; the bus current signal from sensor <NUM> and a set of signals <NUM> that represent the state of the inverter bridge <NUM>. The set of signals <NUM> that controls the IGBT bridge <NUM> can also serve as set of signals <NUM> that represent the state of the inverter bridge <NUM>. The current vector re-constructor circuit <NUM> uses the formula of <FIG> and the relationships of <FIG> to create a pair of signals <NUM> that represents the current vector measurement for safety channel B and a signal <NUM> that indicates that the re-constructed current vector is valid. The current vector re-constructor circuit <NUM> uses sampling and storing, i.e. sample and hold action but implemented using digital circuitry, for each phase current measurement as they become available through the states of <FIG>.

Element <NUM> implements the drive control circuit, this includes commutation, current loop closure, PWM generation and a switching power supply for the control circuit however <FIG> does not further illustrate these elements in order to present a clear view of the distinctive aspects of the invention.

There is a safety processor <NUM> and <NUM> for each of the two safety channels A and B. This fulfils the architectural requirements of 'Basic subsystem architecture D' in IEC <NUM> or 'Category <NUM> or <NUM>' in ISO <NUM>; the torque is evaluated independently on each safety channel and compared against limit values to implement SLT. The calculation of the motor torque requires each safety processor <NUM>, <NUM> to rotate the current vector measurement into the frame of reference of the rotor as per LEONHARD equation (<NUM>) and for this reason each safety processor <NUM>, <NUM> is also supplied with an independent measurement <NUM> and 841of the rotor position. Signals <NUM> and <NUM> are equivalently provided either from two, independent position sensors or alternatively from a safe position sensor having two independent outputs; in both cases the position sensor is aligned with the rotor flux vector during manufacture. There is also cross-checking between the safety processors <NUM> and <NUM> using intercommunication signal set <NUM>.

The cross-checking compares the position measurements <NUM> and <NUM> for the two channels and also compares the computed torque values for the two channels; a discrepancy beyond a prescribed limit is considered to be a fault and the STO signals <NUM> and <NUM> will be de-energized thereby shutting down the drive <NUM>.

The cross-checking also compares the computed torque values for the two channels and again a discrepancy beyond a prescribed limit is considered to be a fault and the STO signals <NUM> and <NUM> will be de-energized thereby shutting down the drive <NUM>.

The channel A safety processor <NUM> receives data from the current sensors <NUM> and <NUM> and the channel A rotor position measurement <NUM>. It can optionally, in order to achieve greater diagnostic coverage, also receive data from the B channel's re-constructed current vector <NUM> and valid signal <NUM>. The channel A safety processor <NUM> has an output <NUM>, labelled STO_A, that can shut-down the PWM via the drive control circuit <NUM>.

The channel B safety processor <NUM> receives the channel B re-constructed current vector and the channel B rotor position measurement <NUM>. It can optionally, for greater diagnostic coverage, also receive data from the channel A current sensors <NUM> and <NUM>. The channel B safety processor <NUM> has an output <NUM>, labelled STO_B, that can shut-down the PWM via the drive control circuit <NUM>.

One practical realization of the current vector re-constructor circuit <NUM> would be as a microcontroller, an example of suitable microcontroller is the STM32F031K6T7 which has 16kB of flash memory, <NUM> bytes of SRAM, a built-in <NUM> clock generator, serial ports and a <NUM>-bit ADC: such a device can implement the re-constructor <NUM> as a single chip for only $<NUM>. An FPGA realization of the current vector re-constructor circuit <NUM> is alternatively possible and might be preferred - especially where it can be combined with an FPGA implementation of the drive control circuit <NUM>.

Safety standards such as IEC <NUM> require that the two safety channels and drive control circuit <NUM> are separated by protective barriers so that the failure of one these three sub-circuits will not compromise functional safety, that is at least one of the safety channels will remain operational. For the sake of clarity, the protective barriers are not illustrated in <FIG> but the protective barriers will be present in the pathway of signals <NUM>, <NUM>, <NUM>, <NUM> and also <NUM> and <NUM> where these signals reach the channel A safety processor <NUM>. The protective barriers can be implemented as impedances, opto-isolators, digital isolators and even as moat of unused gates within a logic device. Therefore the implementation of <FIG> can be varied to combine say the current re-constructor <NUM> with the channel B safety processor <NUM>, and/or to combine the channel A safety processor <NUM> with the drive circuit in an FPGA.

The current measurements derived from sensor <NUM>-X using the relationships of <FIG> are not simultaneous, thus when a measurement of say the U phase current is made it will be stale by the time that the measurement of the V phase current is made. This combination of fresh and stale current measurements in the current vector re-constructor circuit <NUM> will distort the estimate <NUM> of the current vector used by safety channel B and consequently when the safety sub-system monitors the difference between the current vectors of the A and B channels it will be necessary to accommodate this distortion as an expected discrepancy, thereby limiting the smallest torque threshold that can be reliably detected. A reduction in the distortion can be obtained by using the two most recent phase current measurements to reconstruct the third current using by making use of the identity iu+iv+iw≡<NUM> but some distortion of safety channel B current vector remains.

The requirement for a two-channel measurement in a 1oo2 safety system is fulfilled in the first preferred embodiment using a duplicate set of independent measurements. However it is possible, in a safety system that fails to an inoperative, safe state, to interpret the requirement for two channels not as two, duplicate sets of measurements but rather as a first set of a measurements in combination with a second set of measurements that, although not usable in their own right, independently indicate the validity of the first measurements. This latter approach is used in the second preferred embodiment of this invention as shown in <FIG>. The second preferred embodiment eliminates the problem of distortion in the reconstructed current vector <NUM> of <FIG>. Rather than assemble a second current vector to compare with the first current vector, the second preferred embodiment instead compares the phase currents from the two sources whenever the data from sensor <NUM>-Y is fresh and therefore accurate.

The measurement from the U phase current sensor at <NUM>-Y can be compared with the measurement from bus current sensor at <NUM>-Y in states <NUM><NUM> and <NUM><NUM>. In the latter state the current sensed current from <NUM>-Y must be inverted.

The measurement from the V phase current sensor at <NUM>-Y can be compared with the measurement from bus current sensor at <NUM>-Y in states <NUM><NUM> and <NUM><NUM>. In the latter state the current sensed current from <NUM>-Y must be inverted.

The measurements from the U phase current sensors at <NUM>-Y from the V phase current sensor at <NUM>-Y are added together (-iw= iu + iv ) before comparing with the measurement from bus current sensor at <NUM>-Y in states <NUM><NUM> and <NUM><NUM>. In the latter state the current sensed current from <NUM>-Y must be inverted.

The above three actions eliminate the problem of the distortion of safety channel B current vector found in the first embodiment by dispensing with safety channel B current vector altogether.

The implementation of SLT in <FIG> retains the same general structure and many of the elements of <FIG>. The reference numerals of <FIG> are consistent with those of <FIG>, thus for example the drive control circuit in <NUM> in <FIG> is the same as the control circuit in <NUM> in <FIG>. The description of <FIG> will therefore concentrate only on those elements that are different from <FIG>.

Safety channel A is equipped with a current vector calculator <NUM> whose inputs are the inverter bridge state <NUM>, a measurement of the DC link current <NUM>-Y, a measurement of the U phase current <NUM>-Y and a measurement of the V phase current <NUM>-Y. The current vector calculator <NUM> uses input signals <NUM>-Y and the <NUM>-Y to compute the stator current vector output <NUM>. Shortly after each change of inverter bridge state <NUM>, the current vector calculator <NUM> digitizes and measures the bus current signal from sensor <NUM>-Y and the U and V phase currents from sensors <NUM>-Y and <NUM>-Y, the W phase current is also computed from +iw = -iu-iv. In the case of inverter bridge states <NUM><NUM> and <NUM><NUM> - namely the zero states - no further action is taken but for all other states the instantaneous value of the bus current signal from sensor <NUM>-Y is checked by the current vector calculator <NUM> against the corresponding instantaneous value of phase current according to <FIG>. The current vector calculator <NUM> declares a fault at output <NUM> when the two estimates of phase currents diverge by more than a prescribed limit.

Safety channel B is likewise is equipped with a current vector calculator <NUM> whose inputs, outputs and operation are the same as the channel A current vector calculator <NUM>.

Each safety processor <NUM> and <NUM> computes the motor torque from the phase current measurements <NUM> and <NUM> in combination with the respective position measurement <NUM> and <NUM> for the respective safety channel. Note that this calculation can take place at any time, it will be valid regardless of switching state of the inverter bridge <NUM>.

Each safety processor <NUM> and <NUM> is also notified of errors in the current measurement via signals <NUM> and <NUM>. If either safety processor <NUM> and <NUM> detects a discrepancy from the other processor or that the torque has exceeded the prescribed threshold of the SLT safety function, or that there has been an error in the current measurement, then either safety processor <NUM> and <NUM> can shut-down the output drive control circuit <NUM> using their respective STO control signals <NUM> and <NUM>.

Both the first and second embodiments combine a two-channel measurement of rotor position with a two-channel measurement of the current vector to obtain a two-channel measurement of torque. The torque measurement can be a positive torque or a negative torque and this has the advantage that the computed torque can be compared against independent positive and negative limit values in order to implement SLT. This is of practical value; consider a machine where a gravity loaded axis is monitored using SLT to avoid crushing an operator's limb, in this machine the downward direction torque threshold would be low whereas the upward torque threshold must be higher to allow the machine to retract in the vertical direction.

However there is also a class of applications where the polarity of the torque is unimportant, an example would be the turntable axis of a robot; here a crushing hazard can be protected against using symmetrical torque thresholds because there is no need to retract against a gravitational load. If the polarity of the applied torque is unimportant then the first and second preferred embodiments can be simplified and this leads to the third and fourth preferred embodiments.

The third preferred embodiment the same as the first preferred embodiment as illustrated in <FIG> but with the removal of safety channel A rotor position measurement <NUM> and safety channel B rotor position measurement <NUM>; it is so similar to <FIG> that no further diagram is given. Each safety processor <NUM> and <NUM>, rather than computing torque, instead computes the magnitude of the channel A current vector and the magnitude of the channel B current vector and compares the two magnitudes against the SLT limit values. The motor torque is proportional to the sine of the angle between the rotor flux vector and the current vector, the worst case is that the angle is ninety degrees and that the sine is unity thereby yielding the maximum torque. For all other angles the resultant torque will be a lesser value and therefore simply using the magnitude of the current vector will over-estimate the motor current; an over-estimate will trigger SLT at too low a torque value but note that this is a safe condition.

It is advantageous to create a product that implements both the first and third preferred embodiments in a unified design; this would allow the user the option of connecting to a safety rated encoder if he requires signed limitation of the torque according to the first embodiment or alternatively of connection to a standard encoder if unsigned limitation of the torque according to the third embodiment is sufficient. The hardware of <FIG> can implement either the first or the third preferred embodiments, it requires configuration to select the appropriate algorithm.

Similarly, the fourth preferred embodiment is the same as the second preferred embodiment as illustrated in <FIG> but with the removal of safety channel A rotor position measurement <NUM> and safety channel B rotor position measurement <NUM>; it is so similar to <FIG> that no further diagram is given. Each safety processor <NUM> and <NUM>, rather than computing torque, instead computes the magnitude of the channel A current vector and the magnitude of the channel B current vector and compares the two magnitudes against the SLT limit values.

It is advantageous to create a product that implements both the second and fourth preferred embodiments in a unified design; this would allow the user the option of connecting to a safety rated encoder if he requires signed limitation of the torque according to the first embodiment or alternatively of connection to a standard encoder if unsigned limitation of the torque according to the third embodiment is sufficient. The hardware of <FIG> can implement either the second or the fourth preferred embodiments, it requires configuration to select the appropriate algorithm.

To summarize, all four preferred embodiments use the measurement of the bus current in the various inverter bridge states either to create a measurement of the current vector for the channel B or else to confirm that the measurement of the current vector from two sensors in series with the motor phases are correct. There are numerous possible variations on the hardware implementation and it would indeed be possible to implement all four embodiments in a single design; this would allow SLT to be implemented with or without safe position feedback. All four preferred embodiments use a set of current sensors that is already present in many servo drive designs. A map of preferred embodiment against feature is provided in <FIG>.

All four preferred embodiments require deducing the phase current from the bus current and the inverter bridge state. There are two abnormal conditions wherein a timely measurement of each phase current will not be available at a rate of twice per PWM switching cycle from the bus current sensor <NUM> or <NUM> or <NUM>.

The first abnormal condition is when the servo drive is on but is applying no net voltage, the inverter bridge <NUM> will cycle between the zero states <NUM><NUM> and <NUM><NUM> wherein it can be seen from <FIG> that no current measurements are available from sensor <NUM>. A variant of this first abnormal condition is when the net output voltage is so low that, although the inverter sequences through all states, the dwell time in the states other than <NUM><NUM> and <NUM><NUM> is too short to allow a useful measurement of the respective phase current.

The dwell time must be long enough to allow transient effects, such as the impulse current flowing into stray capacitances and diode recovery currents, to decay. Therefore a practical minimum dwell time is on the order of <NUM> and in the first abnormal condition this may not be fulfilled. To overcome this problem, the drive circuit <NUM> or <NUM> is algorithmically altered to artificially prolong the dwell times that are present or to insert current measuring states of adequate dwell times that would otherwise be absent when the required dwell times have not occurred naturally through closed-loop control. The term 'prolongation' will cover both cases. This prolongation can be performed entirely in logic gates or by using software. These artificial dwell times will cause little disturbance to the torque loop and their impact can optionally be reduced by adding them as complementary state pairs one shortly after the other; for example inverter state <NUM><NUM> followed shortly afterwards by inverter state <NUM><NUM> will balance the net applied voltage of the disturbance and therefore lessen the resulting torque perturbation. In the case of the second and fourth embodiments the rate of the comparison between the two sources of current measurement, i.e. the rate of diagnosis, is not required to be very frequent, let us say every <NUM>, and therefore the artificial dwell times are only required at intervals of <NUM>, one phase at a time, to confirm the correct operation of both phase current sensors <NUM>/<NUM> and <NUM>/<NUM>.

The second abnormal condition occurs at high rotary speeds when the servo drive has insufficient bus voltage to fully control the phase currents; under these circumstances the PWM saturates and the drive is in what is called quasi-squarewave operation, the inverter bridge <NUM> will progress through a sequence such as <NUM><NUM> →<NUM><NUM> →<NUM><NUM> → <NUM><NUM> →<NUM><NUM> →<NUM><NUM> and then repeat but at the fundamental frequency of the current rather than at the PWM switching frequency, e.g. <NUM> rather than <NUM>. In this second abnormal condition a measurement of current is available for all three currents but at a rate much less than twice the PWM switching frequency. However this rate of <NUM> is frequent enough to check the two current measurements in the case of the second and fourth embodiments, whereas the first and third embodiments will require artificial dwell times to be inserted. In summary all four embodiments can operate despite this second abnormal condition.

In the first and third preferred embodiments the drive circuit <NUM> is responsible for ensuring that the dwell times of the IGBT inverter state <NUM> are long enough to allow valid current measurements to be made. The current vector re-constructor circuit <NUM> will indicate <NUM> when the re-constructed current vector <NUM> is invalid as a result of insufficiently long dwell times <NUM> and thereby cause safety processor <NUM> and optionally safety processor <NUM> to put the drive in STO using signals STO_B <NUM> and optionally STO_A <NUM>. This division of responsibilities allows the drive control circuit <NUM> to be wholly non-safe, that is designed and maintained without the constraints of safe processes, whereas the current re-constructor circuit <NUM> is part of the safety system.

Similarly, in the second and fourth preferred embodiments the drive circuit <NUM> is responsible for ensuring that the dwell times of the IGBT inverter state <NUM> are long enough to allow valid current measurements to be made. The current vector calculator and fault detector circuits <NUM> and <NUM> will respectively indicate <NUM> and <NUM> when either re-constructed current vector <NUM> or <NUM> is invalid as a result of insufficiently long dwell times <NUM> and thereby cause either or both safety processors <NUM> and <NUM> to put the drive in STO using signals STO_A <NUM> and/or STO_B <NUM>. This division of responsibilities allows the drive control circuit <NUM> to be wholly non-safe, that is designed and maintained without the constraints of safe processes, whereas the current vector calculator circuits <NUM> and <NUM> are part of the safety system.

The two safety processors <NUM>/<NUM> and <NUM>/<NUM> are typically implemented as microcontrollers. However the term 'safety processor' is technologically neutral and could alternatively be implemented using FPGA gates or as FPGA soft processors. The two safety processors <NUM>/<NUM> and <NUM>/<NUM> could be combined into a dual lock-step safety processor or into a triple mode redundant safety processor without changing the essential concept of the invention. The current re-constructor <NUM> and B channel safety processor <NUM> could be combined into a single device. Similarly the drive control circuit <NUM> could be combined into a single device with either safety processor for safety channel A <NUM> or the safety processor for safety channel B <NUM>. Implementations of <FIG> using one or more FPGAs are also possible.

This specification has avoided excessive generalizations in order to aid understanding but this should not be interpreted restrictively. There are many minor variations that do not change the essentials of the invention, including but not limited to sensing the high side bus current rather than the low side bus current <NUM>, sensing the V <NUM> and W <NUM> phase currents rather than the U <NUM> and V <NUM> phase currents. The exact partitioning of functionality between the channel B current vector calculator <NUM>/<NUM> and the channel B safety processor <NUM>/<NUM> can be varied to suit the availability of components and the location of isolation barriers. Similar remarks apply to A channel elements, moreover there is no normative requirement for the two safety channels A and B to be symmetrical. Signal paths <NUM>, <NUM>, <NUM>, <NUM> can be transmitted via black channels and with or without isolation. Further redundant measurements of the current vector are possible using an additional bus current sensor and/or phase current sensors. It is intended that the invention not be limited to the particular embodiments disclosed, but that the invention will include all embodiments falling within the scope of the claims.

Claim 1:
A torque-limiting safety circuit servo drive for an AC permanent magnet motor comprising:
a three-phase inverter bridge (<NUM>) fed from a DC bus;
a first current sensor (<NUM>) detecting current in a first motor phase;
a second current sensor (<NUM>) detecting current in a second motor phase;
a third current sensor detecting current in the DC bus;
a drive control circuit (<NUM>) providing pulse-width-modulated gate drive signals to the three-phase inverter bridge (<NUM>), the drive control circuit (<NUM>) having a first safety channel safe-torque-off input and a second safety channel safe-torque-off input, the drive control circuit (<NUM>) adapted to emit a signal set representing a switching state of the three-phase inverter bridge (<NUM>) to modify a pulse-width-modulated switching pattern;
a first safety processor controlling the first safety channel safe-torque-off input of the drive control circuit (<NUM>);
a second safety processor controlling the second safety channel safe-torque-off input of the drive control circuit (<NUM>);
a first current vector calculator and error detector configured to detect a discrepancy based on a signal from the third current sensor and the signal set representing a switching state of the three-phase inverter bridge (<NUM>), said signals compared against the first and second current sensor signals and provide a fault signal to the first safety processor based on the discrepancy; and
a second current vector calculator and error detector configured to detect a discrepancy based on a signal from the third current sensor and the signal set representing a switching state of the three-phase inverter bridge (<NUM>), said signals compared against the first and second current sensor signals and provide a fault signal to the second safety processor based on said discrepancy;
wherein the drive control circuit (<NUM>) is adapted to shut down the three-phase inverter bridge (<NUM>) responsive to input from either of the first safety processor (<NUM>) or the second safety processor (<NUM>).