A kind of safe torque breaking circuit and system
The present invention relates to Power Electronic Circuit field, more particularly to a kind of safe torque shut-off（Safe Torque Off,
STO）Circuit and safe torque turning off system.
In the prior art, in order to prevent motor accidental activation, or avoid generation with the accident of damage to person, people are directed to
The products such as frequency converter, motor servo driver propose STO functions.The function be prevented from driver produced in motor turn
Square, is adapted in the security system for include machine.The IEC61508 standards that International Electrotechnical Commission formally issues（《Electrical/electronic/
The functional safety of programmable electronic security system》）, propose safety integrity level（SIL）Concept weigh security function
The degree of reliability, and 4 grades are divided into, the highest ranking of industrial circle is SIL3.The STO functions of meeting SIL3 being capable of band
Carry out security higher, be the trend of future development.
Two-way Redundancy Design being used current STO functional circuits and system, to improve security of system more.Even if however, double
Road is designed, in prolonged continuous operation, it is also possible to because failure accumulation causes security function to fail.Especially since temporarily
When the accident such as over-pressed, short-circuit or sporadic component defect trigger the possibility of failure high, it is therefore desirable to security function
The each several part of circuit is controlled to be periodically detected in time.
Chinese invention patent application file CN105576952A, discloses a kind of STO functional circuits of two-way Redundancy Design,
Including signaling conversion circuit, photoelectric coupled circuit, filter circuit etc., realize being realized while STO functions the self-inspection of partial circuit.This
Though self-inspection of the technical scheme comprising STO functional circuits, pertains only to input channel, output channel, power module are not directed to, and
Its input channel self-inspection is to send same detection burst pulse to two-way input channel by diagnosis unit to carry out self-inspection, the method without
The intersection short circuit of method detection input channel, diagnosis coverage rate is not high.And power module is important in STO functional circuits one
Point, the diagnosis to power module is very important.
Chinese utility model patent file CN205319683U, discloses a kind of safe torque turn-off function circuit, its skill
Art scheme includes two-way STO signal inputs, and by EMC circuits, under-voltage protecting circuit, light-coupled isolation, control Shang Qiao is with respectively
The IGBT of bridge drives the break-make of PWM power supplys, carrys out safe shutdown moment of torsion.It utilizes transistor base, optical coupling secondary edges, voltage-stabiliser tube in string
It is coupled structure, realizes the under-voltage protection function of power supply, but the not defencive function such as power supply overvoltage, excessively stream, overload.And its design is defeated
Enter passage not diagnose, output channel only has static diagnostic, i.e. diagnosis coverage rate is not low, and part of module is not diagnosed, it is overall
SIL grades are not high.
Chinese utility model patent file CN205170091U, discloses a kind of safe torque turn-off function circuit and elevator
Safety control system, the emphasis of its technical scheme is application of the STO technologies in elevator safety control system, and traditional is connect
Tentaculum mode is compared, and has many advantages, combines the control system of elevator industry, emphasizes a kind of overall design.Its system layer
On face, when performing security function, by safety return circuit so that band-type brake dead electricity, motor locking, while the auxiliary contact bullet of double embrace lock
Open, cause frequency converter safety return circuit to be input into and disconnect, trigger frequency converter security function.In its frequency converter aspect, doubleway output has deficient
Pressure protection, can respectively cut off bridge power supply on IGBT, lower bridge power supply, meanwhile, the state for exporting electronic switch is also patrolled by a series of
Whether the connection of volume final control control power supply to be, if power supply is obstructed, will dead electricity safety.This patent only refers to examining for power supply
Disconnected and only under-voltage without other diagnosis, diagnosis coverage rate is not high.
The content of the invention
In order to solve prior art presence above-mentioned technical problem, the present invention propose a kind of safe torque breaking circuit and
System, its input module uses two-way Redundancy Design with performing module, improves system reliability.To input module and execution mould
Block takes the method for dynamic detection to ensure that module has diagnosis coverage rate higher.
In order to realize goal of the invention, the technical scheme for being used is the present invention：
A kind of safe torque breaking circuit, including power module, input module A, input module B, performing module A, performing module B
And STO diagnostic modules.Wherein, input module A and performing module A is concatenated, and constitutes first passage, input module B and execution mould
Block B is concatenated, and constitutes second channel（Constitute binary-channel redundancy design）.
The STO diagnostic modules include diagnosis unit, signaling conversion circuit A, signaling conversion circuit B, undervoltage detection circuit,
Over-voltage detection circuit.
Described input module A, B are photoelectric coupled circuit, for receiving, isolation and amplifier STO function trigger signals.
Performing module A, B is comprising filter circuit, shaping circuit, OE diagnostic circuits, logic or circuit, the first buffering
Device, the second buffer.
Filter circuit is filtered to the signal that photoelectric coupled circuit is exported, and this design can will monitor target signal filter.
Shaping circuit carries out shaping to the signal that filter circuit is exported, and the output signal of filter circuit receives OE diagnostic circuit controls
System, high level is pulled into during OE is diagnosed.
Logic or circuit are carried out or computing to the output signal and power fail signal of shaping circuit.
First buffer and the second buffer series design, the part pwm signal for changing diagnosis unit transmission, are allowed to
Can be used to performing module back segment power circuit use.
Signaling conversion circuit A, signaling conversion circuit B in STO diagnostic modules connect with input module A, B respectively.STO is examined
Diagnosis unit in disconnected module can respectively send two-way and detect burst pulse to input module A, B by signaling conversion circuit A, B（Two
Individual photoelectric coupled circuit）, and the output signal of input module A, B is input into diagnosis unit.The dynamic inspection of input module is capable of achieving above
The input signal and input signal of shaping circuit A, B are input into the diagnosis unit of STO diagnostic modules, for shaping
Circuit carries out dynamic diagnosis.
The output signal and logic of shaping circuit A, B or the output signal of circuit A, B are input into the diagnosis of STO diagnostic modules
Unit, for carrying out dynamic diagnosis to logic or circuit.
The diagnosis unit output buffer detection signal of STO diagnostic modules to first buffer A, B sense channel, while
First buffer A, B sense channel is that output signal is input into diagnosis unit.Connected at the above two and be capable of achieving to the first buffer
The detection output signal of the sense channel output signal of first buffer A, B and second buffer A, B is input into respectively
To the diagnosis unit of STO diagnostic modules, for realizing the dynamic detection to the second buffer.
Diagnosis unit in STO diagnostic modules includes to the monitoring signal of performing module：The filtered electrical of first, second passage
The input signal on road, the input of the shaping circuit of first, second passage, output signal, the logic or circuit of first, second passage
Output signal, the sense channel output signal of the first buffer of first, second passage, the sense channel of the second buffer is defeated
Go out signal.
Diagnosis unit in STO diagnostic modules includes to the output signal of performing module：First, second passage OE diagnosis electricity
The detection signal on road, for the output signal of shaping circuit to be pulled into high level during OE is diagnosed；First second channel is buffered
Device electric circuit inspection signal, the sense channel of output to the first buffer.
The power module has three stage power source, comprising STO functional circuits power supply and STO diagnostic module power supplys.STO functions electricity
Road power supply is simultaneously that first passage and second channel are powered（Non- Redundancy Design）.
The power module includes+5V1 power supplys and+5V2 power supplys.
+ 5V2 power supplys are through over-voltage over-current protection circuit, overvoltage cut-out circuit, final output STO functions in the power module
Undervoltage detection circuit, over-voltage detection circuit in STO diagnostic modules connect+5V2 power supplys, can be respectively by comparison principle
Export under-voltage signal, over-pressed signal.
Above-mentioned under-voltage signal, over-pressed signal are input into logic NAND gate simultaneously, defeated through the output signal after NAND gate computing
Enter logic sum gate A, the input of logic sum gate B into performing module, the OE letters for controlling the first buffer, the second buffer
Above-mentioned under-voltage signal, over-pressed signal are input into and the monitoring of STO functional circuit power supplys are carried out to diagnosis unit simultaneously.
Above-mentioned over-pressed signal, while circuit is cut off in input to overvoltage, it is ensured that when over-pressed, cut off STO functional circuit power supplys.
Though the non-Redundancy Design of power module, its diagnosis coverage rate can reach 99%, while consider Dual Failures, for every kind of
Power failure mode uses two kinds of safeguard measures, meets SIL3 requirements.
1st, overvoltage：+ 5V2 outputs connect over-voltage over-current protection circuit, such as but not limited to fuse and the combination of voltage-stabiliser tube, protect
During card overvoltage, by STO functional circuits power good within the specific limits, in order to avoid burn out late-class circuit；2nd, when+5V2 reaches overvoltage
When comparing threshold value, alarm and block buffer, and having served as crush-cutting deenergizing and receive over-pressed signal, STO functional circuit power supplys are blocked
2nd, it is under-voltage：Module buffer OE pins are controlled by under-voltage signal, when under-voltage generation, make OE invalid, buffer envelope ripple,
System enters safe operating mode；Even if the 2, under-voltage ultimately result in dead electricity, OE pin levels are made to drop in the range of significant level, it is impossible to
Feng Bo, because the system is " dead electricity safety ", therefore can still enter safe operating mode.
3 excessively streams：STO functional circuits electric power loop add over-voltage over-current protection circuit, such as but not limited to fuse with it is steady
The combination of pressure pipe；2nd, overcurrent protection is carried in itself for generating the chip of STO functional circuit power supplys, show as primary current excessive
When, chip restarts hiccup, when accessory power supply cannot start, system dead electricity safety.
4th, overload：Similar with over current fault, simply rotection thresholds are different.Condition according to overload carries out two kinds of safeguard measures
Safe torque turning off system, is made up of, the switch element safe torque breaking circuit of the present invention and switch element,
For receiving the output of the second buffer, and it is converted into the torque of controlled motor rotation.
The brief course of work of safe torque breaking circuit of the present invention and system：
For first passage：STO functions trigger signal by photoelectric coupled circuit A, filter circuit A, shaping circuit A, logic sum gate A,
The first buffer of final output output control A, the output of the second buffer A enable pin（OE）.If STO functions trigger signal is not
Triggering, then buffer OE pins enable, the buffer output part pwm signal that sends of diagnosis unit to power circuit, if now
Second channel is normal, then realize that controlled motor is rotated, system worked well.If STO function trigger signals are triggered, first delays
Rush that device A, the second buffer A OE pins are invalid, PWM is blocked, shut-off motor is realized, into safe operating mode.
For second channel：STO functions trigger signal by photoelectric coupled circuit B, filter circuit B, shaping circuit B, logic or
Door B, the first buffer of final output output control B, the output of the second buffer B enable pin（OE）.If STO functions triggering letter
Number do not trigger, then buffer OE pins are enabled, the part pwm signal that buffer output diagnosis unit sends to power circuit, if
Now first passage is normal, then realize that controlled motor is rotated, system worked well.If STO function trigger signals are triggered, the
One buffer B, the second buffer B OE pins are invalid, and PWM is blocked, and shut-off motor are realized, into safe operating mode.
Because controlled motor produces the PWM of torque common by the output of first passage and performing module A, B of second channel
Determine, as long as therefore security function signal is triggered all the way, so that it may realize STO functions.In other words, the two paths of Redundancy Design,
Wherein failure does not interfere with the realization of STO functions all the way.
Advantage of the present invention is as follows：
1st, a kind of new circuit realiration STO functions are devised, realizes that binary-channel redundancy is designed, and each module（Input module, hold
Row module, power module）There are the diagnostic measures of diagnosis coverage rate high, improve the security integrity levels of STO functions（Can
Up to SIL3）.
2nd, output channel uses two-pass design, and the dynamic detection of output module is realized under zero vector state, prevents event
Barrier is accumulative, improves diagnosis coverage rate.
3rd, input channel uses two-way Redundancy Design, and the test burst pulse for having certain phase difference by sending two-way is realized defeated
Enter the dynamic monitoring of module, improve diagnosis coverage rate.
Though the 4th, the non-Redundancy Design of power module, its diagnosis coverage rate can reach 99%, while consider Dual Failures, for every
Plant power failure mode and use two kinds of safeguard measures, meet SIL3 requirements.
Brief description of the drawings
Fig. 1 safe torque breaking circuit schematic block diagrams of the present invention.
Fig. 2 safe torque turning off system block diagrams of the present invention.
Fig. 3 power modules and its diagnosis block diagram.
Fig. 4 input modules and its diagnosis block diagram.
Fig. 5 performing modules and its diagnosis block diagram.
With reference to the accompanying drawings and examples, the present invention is described in further detail, protection scope of the present invention is not limited to
As shown in Figure 1, 2, safe torque breaking circuit of the present invention, including power module, input module A, input module B,
Performing module A, performing module B and STO diagnostic module.Wherein, input module A and performing module A is concatenated, and is constituted first and is led to
Road, input module B and performing module B are concatenated, and constitute second channel（Constitute binary-channel redundancy design）.
1st, power module and its diagnostic circuit
(1) power module
As shown in figure 3, power module has three stage power source, for secondary power supply, related to security function is 5V_STO power supplys, is removed
Outside this, 5V_DIG power supplys are control electricity, for generating the three stage power source used for STO diagnostic modules.
(2) diagnostic circuit and measure
Due to this module not Redundancy Design, to reach diagnosis coverage rate higher, therefore two kinds are used to every kind of power failure mode
Multi-form means improve diagnosis coverage rate, prevent cumulative failure.
1. overvoltage：According to system 5V_STO power supply device operating voltage ranges, overvoltage threshold, design overvoltage detection work(are set
Can, when 5V_STO power supplys are more than overvoltage threshold, output overvoltage signal.To prevent overvoltage from causing dangerous failure, design measure is such as
Under：1st ,+5V2 outputs connect over-voltage over-current protection circuit, the such as but not limited to combination of fuse and voltage-stabiliser tube, it is ensured that when over-pressed,
By STO functional circuits power good within the specific limits, in order to avoid burning out late-class circuit；2nd, threshold value is compared when+5V2 reaches overvoltage,
When alarming and block buffer, and having served as crush-cutting deenergizing and receive over-pressed signal, the power supply output of block STO functional circuits.
2. it is under-voltage：According to system 5V_STO power supply device operating voltage ranges, brownout threshold is set, design under-voltage detection work(
Can, when 5V_STO power supplys are less than brownout threshold, export under-voltage signal.For prevent it is under-voltage cause dangerous failure, design measure is such as
Under：1st, module buffer OE pins are controlled by under-voltage signal, when under-voltage generation, make OE invalid, and buffer envelope ripple, system enters peace
Full working scope；Even if the 2, under-voltage ultimately result in dead electricity, OE pin levels are made to drop in the range of significant level, it is impossible to Feng Bo, due to
The system is " dead electricity safety ", therefore can still enter safe operating mode.
3. excessively stream：To prevent excessively stream from causing dangerous failure, design measure is as follows：1st, STO functional circuits electric power loop addition
The combination of over-voltage over-current protection circuit, such as but not limited to fuse and voltage-stabiliser tube；2nd, for generating STO functional circuit power supplys
Chip carries overcurrent protection in itself, show as primary current it is excessive when, chip restarts hiccup, when accessory power supply cannot start, is
System dead electricity safety.
4. overload：Overload fault is similar with over current fault, and simply rotection thresholds are different.Condition according to overload carries out two kinds
The design of safeguard measure.
2nd, input module and its diagnostic circuit
(1) input module circuit
As shown in figure 4, input module, two-way Redundancy Design（Input module A, B）.During system worked well, i.e. STO function signals
It is not triggered, photoelectric coupled circuit A, photoelectric coupled circuit B are in on-state, and low level is exported respectively；When STO function signals are triggered
When, photoelectric coupled circuit A, photoelectric coupled circuit B are cut off, and high level is exported respectively.
(2) input module diagnostic circuit
As shown in figure 4, signaling conversion circuit A, signaling conversion circuit B are used to change the test burst pulse that diagnosis unit sends, and
The output signal of input module is input into diagnosis unit and is monitored.
Diagnostic measures are as follows：
Diagnosis unit exports two-way test burst pulse within system response time（Short of width is triggering STO functions）, and two-way
There are certain phase intervals in test pulse.
1. input module single channel is short-circuit, dynamic detection of opening a way：By taking input module A as an example, if being examined in certain delayed scope
The monitoring signal A that disconnected unit is received is identical with test burst pulse A, then input module A is normal；If the monitoring signal A for receiving
It is always high level, then input module A open faults.If the monitoring signal A for receiving is always low, input module A short circuits
Failure（Short circuit herein refers to optocoupler input short or output short-circuit, and input and output intersect short circuit and will not make thrashing, therefore without inspection
Survey）；Input module B is similarly.
2. input module intersects short-circuit dynamic detection：Due to test burst pulse A and B do not overlap, if therefore diagnosis unit connect
The monitoring signal A for receiving is identical with B, then input module A and B occurs to intersect short trouble.
3rd, performing module and its diagnostic circuit
(1) performing module
As shown in figure 5, performing module A, B（Performing module A, B is referred to as performing module with not differentiating between herein）It is input into for receiving
Modules A, the signal of B outputs, determine on or off PWM outputs, so that the generation of controlled motor torque.Performing module leading portion control
Circuit processed is composed in series by the first buffer and the second buffer, and upper three pipes pwm signal and lower three pipes pwm signal are controlled respectively
Output.Increase switch element behind performing module and then form safe torque turning off system of the present invention.Switch element（Power electricity
Road）, it is controlled by the 6 road PWM that the second buffer is exported, and the conducting and shut-off of switching tube is determined, so that controlled motor is run.
By taking performing module A as an example, comprising filter circuit A, shaping circuit A, the first buffer A, the second buffer A, two strings
Join the OE pins of buffer（Low level is enabled）Controlled after logic or computing by two paths of signals, determine that on or off PWM is defeated
Go out, wherein, the first via is that input module A output signals are filtered, the STO function trigger signals after Shape correction（Can be diagnosed
" the performing module dynamic detection signal " that unit sends is dragged down）；Second tunnel is power module failure signal.Performing module B similarly,
The output of its buffer enables pin and is controlled by another road STO functions trigger signal.
(2) performing module diagnostic circuit
Diagnostic measures are as follows：
1. the diagnosis of logic sum gate：Two input signals of gate（Power failure signal, after Isolation, shaping
STO function trigger signals）, output signal（Buffer OE signals）Unit monitoring is diagnosed, diagnosis unit is enabled in buffer
Compare an input for gate and output during pin dynamic detection, gate is diagnosed according to truth table.
2. buffer enables pin（OE）The diagnosis of function：
Broken string, solder joint disengagement for being likely to occur due to OE pins etc., may cause the dangerous failure of security function, therefore do following dynamic
Detection：Under zero vector state, one group of buffer that three road PWM are all with 0 is detected diagnosis unit, in system response time
Interior realization is once to two groups of detections of buffer.