JP4721055B2 - Vacuum pump - Google Patents

Description

  The present invention relates to a DC brushless motor and a rotary vacuum pump that rotates a rotor blade by the DC brushless motor.

  A rotary vacuum pump is a pump that forms a vacuum state by sucking the inside of a vacuum vessel or the like by a rotating mechanism such as a turbine blade, and a turbo molecular pump or the like belongs to this. The rotary vacuum pump includes, for example, a pump unit having fixed blades and rotary blades, and rotates the rotary blades with respect to the fixed blades by driving a DC brushless motor motor to suck and exhaust the inside of the vacuum vessel.

  In an environment that dislikes lubricating oil, such as semiconductor manufacturing equipment, magnetic levitation type magnetic bearings that support the rotor in a non-contact manner have been increasingly adopted. On the other hand, in an environment where external noise is severe, such as a semiconductor manufacturing apparatus, it is difficult to completely prevent malfunction such as runaway of a magnetic bearing control processor in the control device.

  When a failure occurs in the control of the magnetic bearing due to the runaway or malfunction of the processor, the non-contact support by the magnetic bearing stops, and the rotor rotating at high speed is directly held by the protective bearing. The contact support by the protective bearing of the rotor rotating at high speed causes damage to the rotor and the bearing, and leads to a failure of the pump.

  In this way, even if the magnetic bearing is once held by the protective bearing due to poor control of the magnetic bearing, if the magnetic levitation can be resumed in a relatively short time by returning from the control failure, damage to the protective bearing will occur. Can be reduced. Therefore, it is important to perform a return operation early from a control failure.

  Conventionally, a control device for a vacuum pump such as a turbo molecular pump is program-controlled by a processor. Even if this processor has a function to monitor the runaway or malfunction of the processor, if the processor runs away or malfunctions, the operation of the processor itself is unstable, so the monitoring and reset functions are normal. However, it is difficult to prevent control failures due to processor runaway or malfunction.

  Therefore, it is conceivable to detect the runaway of the processor by using a built-in or external watchdog (runaway monitoring) timer and perform a recovery operation by a simple reset operation of the processor.

In the prevention of the above-mentioned control failure, the malfunction of the processor is merely prevented only by the reset operation by the watchdog (runaway monitoring) timer.
(1) A control failure due to a malfunction of the peripheral circuit cannot be detected as a runaway.
(2) In the case where runaway occurs when external noise is continuously applied and the program on the memory that controls the processor is rewritten, the program will not be loaded correctly on the memory even if the reset operation is performed. Because there is no, you may repeatedly runaway. Also,
(3) When high-voltage noise is applied, the elements mounted on the processor and peripheral circuits are latched up, and it may be necessary for the operator to turn on the power for the entire system. There is a problem.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to solve the above-described problems and to detect a control failure due to a malfunction of a peripheral circuit in addition to a processor.

  It is another object of the present invention to eliminate control failure caused by rewriting of a program due to external noise or the like.

  It is another object of the present invention to allow power to be turned on again without an operator even in a latched-up state.

  The vacuum pump of the present invention includes a first processor that controls a magnetic bearing and its peripheral circuit, and a second processor that performs a function other than the control of the magnetic bearing. By providing the function to monitor the control failure of the magnetic bearing, the function to reset the first processor, the function to check the memory of the first processor, etc., it is possible to detect the control failure due to malfunction of the processor and peripheral circuits. Prevents control failures caused by rewriting of the program due to external noise.

  Further, by providing a power shut-off circuit that shuts off the power supply to the first processor and its peripheral circuits by the second processor, it is possible to automatically shut off and turn on the power together with the reset operation.

  The vacuum pump of the present invention is a magnetic levitation type vacuum pump, and the control device includes a first processor for controlling the magnetic bearing and a first peripheral circuit, and a second processor for performing other controls except for the control of the magnetic bearing. Is provided.

  The second processor receives signals from the first processor and the first peripheral circuit, and monitors the control failure of the magnetic bearing due to the runaway of the first processor and the malfunction of the first peripheral circuit. When the control failure of the magnetic bearing is detected, 1 A function is provided to reset the processor and perform a recovery operation from a control failure of the magnetic bearing. This makes it possible to detect and recover from a control failure caused by the runaway of the first processor that performs magnetic bearing control or the malfunction of its peripheral circuit.

  The second processor of the present invention resets the first processor, checks the program written in the program execution memory of the first processor, confirms that the program is correctly written, Let the processor resume control of the magnetic bearings. As a result, the program on the memory that has been rewritten by external noise or the like can be repaired, and runaway due to a program defect can be prevented.

  The second processor of the present invention has a first power shut-off circuit that shuts off power supply to the first processor and the first peripheral circuit, and sends a reset signal to the first processor and also shuts off the first power The first processor is reset by sending a power-off signal to the circuit to cut off the power and turning it on again after a predetermined time. As a result, even when the first processor or the first peripheral circuit is latched up, it is possible to perform reset by turning on the power again.

   In addition, the second processor of the present invention performs at least one of alarm issue operation, communication control, and motor control. The first processor receives a signal associated with a control other than the magnetic bearing control performed by the second processor and the second peripheral circuit controlled by the second processor, and monitors the runaway of the second processor and the control failure of the control. When the control failure is detected, the second processor is reset and a recovery operation from the control failure is performed.

  According to this, even when a control failure occurs in the control other than the magnetic bearing, the first processor can recover from the control failure by monitoring the second processor.

  The first processor of the present invention has a second power shutoff circuit for shutting off the power supply to the second processor and the second peripheral circuit controlled by the second processor, and sends a reset signal to the second processor. Then, a power shut-off signal is sent to the second power shut-off circuit to shut off the power, and the second processor is reset by turning it on again after a predetermined time. As a result, even when the second processor or the second peripheral circuit is latched up, it is possible to perform reset by turning on the power again.

  Furthermore, by setting the core voltage of one of the first processor and the second processor higher than the core voltage of the other processor, the noise resistance of the processor can be improved and the return operation can be performed reliably.

  According to the present invention, it is possible to detect a control failure due to a malfunction of a peripheral circuit in addition to a processor.

  In addition, it is possible to eliminate control failure due to rewriting of the program due to external noise or the like.

  Even in the latched-up state, the power can be turned on again without an operator.

  Further, in the aspect of the present invention, by providing the second processor included in the vacuum pump with the runaway detection function of the first processor, an equivalent function can be realized without using a watchdog timer circuit.

  Furthermore, by providing the second processor with a function for monitoring poor control of the magnetic bearing, the first processor can be reset and returned to the control of the magnetic bearing due to malfunction of the peripheral circuit. .

  Furthermore, by providing the second processor with the memory verification function of the first processor, after confirming that the program is correctly loaded on the memory after the reset, the first processor can be put into an operating state.

  Further, in the aspect of the present invention, when latch-up occurs by causing the second processor to have the control function and the circuit that shuts off the power supply to the first processor and the peripheral circuit included in the vacuum pump, It can be reset by turning on the power again.

  Further, by providing the first processor included in the vacuum pump of the present invention with the runaway detection function of the second processor, an equivalent function can be realized without using a watchdog timer circuit.

  Further, by providing the first processor with a circuit and a control function for shutting off the power supply to the second processor and its peripheral circuits, it is possible to reset the power supply when the latch-up occurs.

  Further, in the first processor and the second processor provided in the vacuum pump of the present invention, by setting the core voltage of at least one of the processors to a high voltage, the noise resistance of the processor provided in the vacuum pump is improved and the return operation is performed. It can be done reliably.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Hereinafter, a turbo molecular pump will be described as an example of the vacuum pump, but the vacuum pump can be commonly applied to a vacuum pump that performs levitation control using a magnetic bearing.

  The turbo molecular pump is composed of a pump body and a control device. The pump body is composed of a rotor formed with turbine blades, a stator blade that achieves an exhaust function in combination with the rotor, a magnetic bearing device that supports the rotor in a non-contact manner, and a motor that rotates the rotor at high speed. . The magnetic bearing is composed of a sensor for acquiring rotor position information and an electromagnet for maintaining the rotor at a desired position.

  The configuration of the turbo molecular pump is well known, and the present invention does not depend on the detailed configuration of the turbo molecular pump, and therefore detailed description thereof is omitted here.

  First, the first embodiment of the present invention will be described with reference to FIGS.

  In the first embodiment shown in FIG. 1, the vacuum pump 1 includes a turbo molecular pump main body 10 and a control device 20 that controls the turbo molecular pump 10. The turbo molecular pump body 10 includes a rotor formed with turbine blades, a stator blade that realizes an exhaust function in a set with the rotor, a magnetic bearing device that supports the rotor in a non-contact manner, and a motor that rotates the rotor at high speed. The magnetic bearing device includes an electromagnet 12 for levitating and supporting the rotor, and a sensor 11 for detecting the magnetic levitation state of the rotor. Examples of the sensor 11 include a sensor that detects a position in the radial direction and a sensor that detects a position in the thrust direction. In addition, since the structure of these turbo-molecular pump main bodies 10 is a structure known normally, description here is abbreviate | omitted.

  The control device 20 controls the magnetic levitation of the rotor in addition to controlling the rotational drive of the rotor of the turbo molecular pump main body 10. FIG. 1 mainly shows a configuration for controlling the magnetic levitation of the rotor by the magnetic bearing, and the configuration for controlling the rotational drive of the rotor can be the same as the configuration provided in an ordinary turbo molecular pump. The description in is omitted.

  The control device 20 includes a first processor 40 that controls the magnetic bearing, a first peripheral circuit 30, and a second processor 50 that performs processing other than the control of the magnetic bearing. The first peripheral circuit 30 includes a sensor circuit 31 that shapes a signal from the sensor 11 of the pump body, and a drive circuit 32 that amplifies a current signal to the electromagnet 12.

  The first processor 40 inputs a sensor signal obtained by the sensor 11 from the sensor circuit 31 and sends a magnetic bearing control signal for controlling the rotor to a predetermined position to the drive circuit 32 based on the sensor signal. . The drive circuit 32 drives the electromagnet 12 based on the magnetic bearing control signal sent from the first processor 40. The first processor 40 controls the magnetic bearing with the above-described configuration. In FIG. 1, the control of this magnetic bearing is indicated by a broken line.

  As described above, the first processor 40 mainly controls the magnetic bearing, whereas the second processor 50 performs processes other than the magnetic bearing control. The control performed by the second processor 50 includes, for example, alarm notification and communication control in addition to motor control for controlling the rotational drive of the rotor.

  In the present invention, the second processor 50 has a function of monitoring the first processor, resetting it, and returning it.

  The second processor 50 monitors the runaway of the first processor 40 by inputting a signal (runaway monitoring signal A) for monitoring the runaway of the first processor 40. As the runaway monitoring signal A, for example, an output signal that the first processor 40 periodically turns on and off during the magnetic bearing control process can be used. The second processor 50 determines the presence or absence of runaway by monitoring the runaway monitoring signal A. For example, the on / off state of the output signal that is periodically turned on / off is monitored, and if the on / off state continues for a certain period or more, it is determined that the runaway occurs.

  The second processor 50 receives a signal B for monitoring the control state of the magnetic bearing, and the magnetic bearing generated by the runaway of the first processor or the runaway of the processor based on the magnetic bearing control state monitor signal B. It is also possible to monitor the control failure. This magnetic bearing control state monitoring signal B receives, for example, data representing the control state of the magnetic bearing from the first processor 40 in the form of communication or shared memory, and determines the contents independently of the first processor 40. Can be realized.

  Further, as another monitoring method, the second processor 50 directly monitors the sensor circuit 31 and the drive circuit 32 that are peripheral circuits (first peripheral circuit 30) of the first processor 40, and outputs status signals from these circuits. It is also possible to input C and determine the control state of the magnetic bearing from the operation state of these peripheral circuits.

  The first processor 40 is connected so that a reset signal can be input from the second processor 50. When the second processor 50 detects a runaway or control failure of the first processor 40 based on at least one of the signals A, B, and C described above, the second processor 50 outputs a reset signal to the first processor 40 and resets it. Then, the magnetic levitation control is initialized and the return process is attempted.

  FIG. 2 is a flowchart for explaining the operation of the first embodiment of the present invention, and shows the operation performed by the second processor. In the flowchart of FIG. 2, the second processor 50 receives the runaway monitoring signal A or the magnetic bearing control state monitoring signal B from the first processor 40 (S1, S2), and the first processor 40 of the first processor 40 based on the input signal. It is determined whether or not there is a control failure due to runaway or runaway (S4).

  The second processor 50 receives the magnetic bearing control state signal C from the first peripheral circuit 30 (S3), and determines the presence or absence of control failure of the magnetic bearing based on the input signal (S5).

  When the second processor 50 detects the runaway of the first processor 40 or the control failure of the magnetic bearing, the second processor 50 outputs a reset signal to the first processor 40 to reset the first processor 40 (S6) and initialize the magnetic levitation control. (S7).

  Next, a second embodiment of the present invention will be described with reference to FIGS. In the second mode of the present invention, in the first mode, in the program executed by the first processor, the second processor has a function of determining whether or not rewriting is performed due to external noise or the like.

  In the second embodiment, after the first processor 40 is reset by the second processor 50, the program execution memory is checked, and it is confirmed that the correct program is written. Resume control.

  A second form shown in FIG. 3 is the same as the first form shown in FIG. A program execution memory 42 composed of a RAM or the like is provided, which is read out from the storage memory 41, written, and executed by the first processor 40. The second mode is the same as the first mode except for the configuration of the program storage memory 41 and the program execution memory 42. Therefore, the description of the configuration of parts common to the first mode is omitted here. To do.

  The second processor 50 takes in the programs from the program storage memory 41 and the program execution memory 42 and collates the programs. Here, the program fetched from the program execution memory 42 is a program to be judged, and the program fetched from the program storage memory 41 is a verification program used for judgment. The second processor 50 determines whether or not the program written in the program execution memory 42 has been rewritten using the verification program.

  Although the program execution memory 42 may be a non-volatile ROM, it is preferable to use a volatile RAM in a high-speed processor such as a DSP used for controlling the magnetic bearing. Immediately after the power is turned on or reset, the program is transferred from the nonvolatile program storage memory 41 to the RAM of the program execution memory 42 and then executed.

  FIG. 4 is a flowchart for explaining the operation of the second embodiment of the present invention, and shows the operation performed by the second processor. The flowchart of FIG. 4 shows the operation after the reset of the flowchart of FIG.

  In the flowchart of FIG. 4, a program is read from the program storage memory 41 and written to the program execution memory 42 (S11). The second processor 50 reads the program written in the program execution memory 42 (S12), and reads the program stored in the program storage memory 41 as a verification program (S13). The second processor 50 collates the program read from the program execution memory 42 using the verification program read from the program storage memory 41 (S14).

  If the program stored in the program execution memory 42 is rewritten as a result of the program verification (S15), the second processor 50 sends a reset signal to the first processor 40 (S16). The first processor 40 performs a reset again based on the reset signal sent from the second processor 50 (S17).

  If the reset result is defective due to this reset (S18), the process returns to S6 of FIG. 2 and repeats the reset process of the first processor again, or is returned by an operation by the operator (S19).

  Next, a third embodiment of the present invention will be described with reference to FIG. The third mode of the present invention is to store the verification program in the verification program storage memory 51 separately prepared in the second mode. The second processor 50 determines whether or not the program stored in the program execution memory 42 is normal by using the verification program read from the verification program storage memory 51.

  Other configurations are the same as those of the second embodiment described with reference to FIGS. 3 and 4, and thus description thereof is omitted here.

  Next, the 4th form of this invention is demonstrated using FIG. 6, FIG. In the fourth embodiment of the present invention, in the second embodiment, a program storage memory 52 is prepared on the second processor 50 side, the program is transferred from the second processor 50 to the program execution memory 42, and the first processor 40 It operates using an execution program.

  Further, the second processor 50 uses the program read from the program storage memory 52 as a verification program to determine whether or not the program stored in the program execution memory 42 is normal, and the program execution memory using this verification program The program transferred from 42 is verified.

  FIG. 7 is a flowchart for explaining the operation of the fourth embodiment of the present invention, and shows the operation performed by the second processor. Further, the flowchart of FIG. 7 shows the operation after the reset of the flowchart of FIG.

  In the flowchart of FIG. 7, the second processor 50 reads a program from the program storage memory 52 (S21). The read program is transferred to the program execution memory, and the transfer result is read again (S22). The second processor 50 collates the program read from the program execution memory 42 using the collation program read from the program storage memory 52 (S23).

  If the program stored in the program execution memory 42 is rewritten as a result of the program verification (S24), the second processor 50 sends a reset signal to the first processor 40 (S25). The first processor 40 performs a reset again based on the reset signal sent from the second processor 50 (S26).

  If the reset result is defective due to this reset (S27), the process returns to S6 of FIG. 2 and repeats the reset process of the first processor again, or is returned by an operation by the operator (S28).

  Other configurations are the same as those of the second embodiment described with reference to FIGS. 3 and 4, and thus description thereof is omitted here.

  Next, a fifth embodiment of the present invention will be described with reference to FIGS. According to a fifth aspect of the present invention, in the first aspect, the second processor has a function of interrupting the power supply to the first processor and its peripheral circuits and initializing the first processor and the first peripheral circuits. It is something to make.

  In the fifth embodiment, when the second processor 50 detects a runaway or control failure of the first processor 40, initialization is performed by cutting off the power supply to the first processor 40 and the first peripheral circuit 30. I do.

  The fifth embodiment shown in FIG. 8 includes a power cutoff circuit 60 that cuts off the power supply to the first processor 40 and the first peripheral circuit 30 in the first embodiment shown in FIG. Since the fifth embodiment is the same as the first embodiment except for the configuration of the power shut-off circuit 60, the description of the configuration of parts common to the first embodiment is omitted here.

  In addition to applying a reset signal to the first processor 40, the second processor 50 outputs a control signal to the power shutoff circuit 60.

  When the second processor 50 detects the runaway of the first processor 40 or the control failure state of the magnetic bearing, the second processor 50 outputs a reset signal to the first processor 40 and outputs a shutoff instruction to the power shutoff circuit 60. The power supply to the first processor 40 and the first peripheral circuit 30 is cut off.

  After a certain period of time has passed since the power was shut off, the first processor 40 and the first peripheral circuit 30 are initialized by releasing the power shut-off instruction and the reset signal in this order. By shutting off the power supply, even if the elements included in the first processor 40 and the first peripheral circuit 30 are latched up, reliable return processing can be expected.

  FIG. 9 is a flowchart for explaining the operation of the fifth embodiment of the present invention, and explains the operation of the second processor. 9, the second processor 50 receives the runaway monitoring signal A and the magnetic bearing control state monitoring signal B from the first processor 40, and the magnetic bearing state signal C from the first peripheral circuit 30 (S31). A runaway or poor control is detected (S32).

  When the runaway or control failure of the first processor 40 is detected, the second processor 50 outputs a reset signal to the first processor 40 (S33) and outputs a power cut-off signal to the power cut-off circuit 60 (S34). .

  In response to the power cutoff signal, the power cutoff circuit 60 cuts off the power supply to the first processor 40 and the first peripheral circuit 30 (S35). The second processor 50 outputs a power cutoff signal to cut off the power supply, and then waits for a certain period of time (S36). After a certain time has elapsed, the second processor 50 performs an initialization process.

  In the initialization process, after the power-off instruction is canceled (S37), the reset process is canceled (S38). Thereafter, the program is downloaded to the first processor 40 (S39).

  Next, the sixth embodiment of the present invention will be described with reference to FIGS. According to a sixth aspect of the present invention, in the second aspect, the first processor has a function of monitoring the runaway of the second processor and the control failure of the second peripheral circuit controlled by the second processor.

  In the sixth embodiment, when the first processor 40 detects the runaway of the second processor 50 or the control failure of the second peripheral circuit 70, the second processor 50 is reset.

  The sixth embodiment shown in FIG. 10 includes a second peripheral circuit 70 controlled by the second processor 50 in the second embodiment shown in FIG. The second peripheral circuit 70 includes, for example, a communication circuit 80, an alarm issue circuit 90, a motor control circuit 100, and the like, and is controlled by the second processor 50.

  In the sixth embodiment, the first processor 40 has a function of monitoring, resetting, and returning the second processor 50.

  The first processor 40 monitors the runaway of the second processor 50 when a signal (runaway monitoring signal a) for monitoring the runaway of the second processor 50 is input. As the runaway monitoring signal a, for example, an output signal that the second processor 50 periodically turns on and off during the control process of the second peripheral circuit 70 can be used. The first processor 40 determines the presence or absence of runaway by monitoring the runaway monitoring signal a. For example, the on / off state of the output signal that is periodically turned on / off is monitored, and if the on / off state continues for a certain period or more, it is determined that the runaway occurs.

  Further, the first processor 40 receives a signal b for monitoring the control state by the second processor 50, and based on the control state monitoring signal b, the second processor 50 runs away or the control caused by the processor runaway occurs. Defects can also be monitored. The control state monitoring signal b is realized, for example, by receiving data representing a control state from the second processor 50 in the form of communication or shared memory, and determining the contents independently of the second processor 50. be able to.

  In addition, the first processor 40 directly monitors the communication circuit 80, the alarm signal generation circuit 90, the motor control circuit 100, and the like, which are peripheral circuits (second peripheral circuit 70) of the second processor 50, and the state from these circuits. It is also possible to input the signal c and determine the state of the second processor 50 from the operation state of the second peripheral circuit 70.

  The second processor 50 is connected so that a reset signal can be input from the first processor 40. When the first processor 40 detects a runaway or control failure of the second processor 50 based on at least one of the signals a, b, and c described above, the first processor 40 outputs a reset signal to the second processor 50 to reset it. The control is initialized and the return process is attempted.

  In the sixth mode, as in the second mode, the first processor 40 is monitored by the second processor 50, and the first processor 40 and the second processor 50 monitor each other, It is possible to recover even when the processor is abnormal, improving reliability.

  FIG. 11 is a flowchart for explaining the operation of the sixth embodiment of the present invention, and shows the operation performed by the first processor and the second processor.

  In the flowchart of FIG. 11, the second processor 50 inputs the runaway monitoring signal A or the magnetic bearing control state monitoring signal B from the first processor 40, and receives the magnetic bearing control state signal C from the first peripheral circuit 30. Then, based on the input signal, it is determined whether or not the first processor 40 has run out of control or has a control failure due to the runaway and the magnetic bearing has a control failure or not (S42).

  When the second processor 50 detects the runaway of the first processor 40 or the control failure of the magnetic bearing, the second processor 50 outputs a reset signal to the first processor 40 to reset the first processor 40 (S43) and initialize the magnetic levitation control. (S44).

  The first processor 40 receives the runaway monitoring signal a or the status signal b from the second processor 50, and also receives the status signal c from the second peripheral circuit 70 (S45). Based on this input signal It is determined whether or not the second processor 50 has run out of control or is out of control due to runaway, and whether or not the magnetic bearing is out of control (S46).

  When detecting the runaway of the second processor 50 or the control failure of the magnetic bearing, the first processor 40 outputs a reset signal to the second processor 50 to reset the second processor 50 (S47) and initialize the magnetic levitation control. (S48).

  Next, the seventh embodiment of the present invention will be described with reference to FIGS. According to a sixth aspect of the present invention, in the fifth aspect, the power supply to the second processor and its peripheral circuit (second peripheral circuit) is shut off, and the second processor and the second peripheral circuit are initialized. The first processor is provided.

  In the seventh embodiment, when a runaway or control failure of the second processor 50 is detected by the first processor 40, initialization is performed by cutting off the power supply to the second processor 50 and the second peripheral circuit 70. I do.

  The seventh embodiment shown in FIG. 12 includes a power shutoff circuit 61 that shuts off the power supply to the second processor 50 and the second peripheral circuit 70 in the fifth embodiment shown in FIG. Since the sixth embodiment is the same as the fifth embodiment except for the configuration of the power shut-off circuit 61, the description of the configuration of parts common to the fifth embodiment is omitted here.

  In addition to applying a reset signal to the second processor 50, the first processor 40 outputs a control signal to the power shut-off circuit 61.

  When the first processor 40 detects the runaway or control failure state of the second processor 50, the first processor 40 outputs a reset signal to the second processor 50 and outputs a shutdown instruction to the power shutdown circuit 61. The power supply to the processor 50 and the second peripheral circuit 70 is cut off.

  After a certain period of time has passed since the power was shut off, the second processor 50 and the second peripheral circuit 70 are initialized by releasing the power shut-off instruction and the reset signal in this order. By shutting off the power supply, even if elements included in the second processor 50 and the second peripheral circuit 70 are latched up, a reliable return process can be expected.

  FIG. 13 is a flowchart for explaining the operation of the seventh embodiment of the present invention, and explains the operations of the second processor and the first processor. In the flowchart of FIG. 13, S51 to S59 indicate the operation of the second processor, and S61 to S69 indicate the operation of the first processor.

  The second processor 50 receives the runaway monitoring signal A and the magnetic bearing control state monitoring signal B from the first processor 40, and the magnetic bearing state signal C from the first peripheral circuit 30 (S51), and the runaway or control failure is detected. It detects (S52).

  When the runaway or control failure of the first processor 40 is detected, the second processor 50 outputs a reset signal to the first processor 40 (S53) and outputs a power cut-off signal to the power cut-off circuit 60 (S54). .

  In response to the power cut-off signal, the power cut-off circuit 60 cuts off the power supply to the first processor 40 and the first peripheral circuit 30 (S55). The second processor 50 outputs a power cutoff signal to cut off the power supply, and then waits for a certain period of time (S56). After a certain time has elapsed, the second processor 50 performs an initialization process.

  In the initialization process, after the power-off instruction is canceled (S57), the reset process is canceled (S58). Thereafter, the program is downloaded to the first processor 40 (S59).

  Further, the first processor 40 receives the runaway monitoring signal a and the control state monitoring signal b from the second processor 50 and the state signal c from the second peripheral circuit 70 (S61), and detects a runaway or control failure (S61). S62).

  When the runaway or control failure of the second processor 50 is detected, the first processor 40 outputs a reset signal to the second processor 50 (S63) and outputs a power cut-off signal to the power cut-off circuit 61 (S64). .

  In response to the power cutoff signal, the power cutoff circuit 61 cuts off the power supply to the second processor 50 and the second peripheral circuit 70 (S65). The first processor 40 outputs a power cutoff signal to cut off the power supply, and then waits for a certain period of time (S66). After a certain time has elapsed, the first processor 50 performs an initialization process.

  In the initialization process, after the power-off instruction is canceled (S67), the reset process is canceled (S68). Thereafter, the program is downloaded to the second processor 50 (S69).

  In general, the higher the processing speed of the processor, the lower the core voltage tends to be. However, the higher the core voltage, the better the resistance against external noise, so the core voltage of either the first processor or the second processor is set to the other. By setting the value higher, the processor with the higher core voltage will not malfunction even when strong external noise is applied, and it can reliably recover even if the other processor malfunctions, improving reliability. I can do it.

  According to each embodiment of the present invention, by providing the second processor with the reset function of the first processor, it is not necessary to separately provide a runaway monitoring circuit in the first processor, and the circuit can be reduced. In addition to detection, the magnetic bearing return processing can be performed by resetting the first processor even when the control of magnetic levitation is poor due to a malfunction of the peripheral circuit.

  Further, in addition to the above effect, even when the control of the magnetic bearing is diverged due to disturbance or the like, the return processing of the magnetic bearing can be performed by resetting the first processor.

  In addition, according to the embodiment of the present invention, the certainty of the reset operation of the first processor can be further improved by providing the second processor with the execution memory verification function of the first processor. In addition, by providing the second processor with a power shut-off function to the first processor and its peripheral circuits, the first processor can also be used in the case of an abnormal state that cannot be recovered by normal reset processing such as latch-up. The complete reset process including the processor and its peripheral circuits can be performed, and thereby the reset process of the magnetic bearing by the reset becomes more reliable.

  According to the embodiment of the present invention, the first processor and the second processor are mutually monitored, so that it is not necessary to separately provide a runaway monitoring circuit in the second processor, and the circuit can be eliminated. In addition to the detection of a single runaway, the return processing can be performed by resetting the second processor in the event of malfunctions such as alarm generation control, communication control, motor control, etc. due to malfunction of the peripheral circuit.

  Furthermore, in the vacuum pump of the present invention, if the magnetic levitation can be resumed in a relatively short time by the return operation from the control failure even if the magnetic bearing is once held by the control failure of the magnetic bearing, Damage can be reduced. In some cases, the operation can be continued as it is.

  Therefore, if the return process of the magnetic levitation control can be reliably performed in a short time due to the above effect, the pump failure can be reduced and the maintenance cycle can be extended.

It is a schematic block diagram for demonstrating the 1st form of this invention. It is a flowchart for demonstrating the operation | movement of the 1st form of this invention. It is a schematic block diagram for demonstrating the 2nd form of this invention. It is a flowchart for demonstrating operation | movement of the 2nd form of this invention. It is a schematic block diagram for demonstrating the 3rd form of this invention. It is a schematic block diagram for demonstrating the 4th form of this invention. It is a flowchart for demonstrating the operation | movement of the 4th form of this invention. It is a schematic block diagram for demonstrating the 5th form of this invention. It is a flowchart for demonstrating the operation | movement of the 5th form of this invention. It is a schematic block diagram for demonstrating the 6th form of this invention. It is a flowchart for demonstrating the operation | movement of the 6th form of this invention. It is a schematic block diagram for demonstrating the 7th form of this invention. It is a flowchart for demonstrating the operation | movement of the 7th form of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Vacuum pump, 2 ... Pump main body, 11 ... Sensor, 12 ... Electromagnet, 20 ... Control device, 30 ... 1st peripheral circuit, 31 ... Sensor circuit, 32 ... Drive circuit, 40 ... 1st processor, 41 ... Program storage Memory, 42 ... Program execution memory, 50 ... Second processor, 51 ... Comparison program storage memory, 60, 61 ... Power cutoff circuit, 70 ... Second peripheral circuit, 80 ... Communication circuit, 90 ... Alarm circuit, 100 ... Motor Control circuit.

Claims (6)

In the magnetic levitation type vacuum pump,
The control device
A first processor and a first peripheral circuit for controlling a magnetic bearing;
A second processor that performs other control than the magnetic bearing control,
The second processor receives signals from the first processor and the first peripheral circuit, monitors the magnetic bearing for control failure due to runaway of the first processor and malfunction of the first peripheral circuit, and detects the control failure of the magnetic bearing. A vacuum pump characterized in that one processor is reset and the magnetic bearing is restored from a poor control.   The second processor resets the first processor, checks the program written in the program execution memory of the first processor, confirms that the program is written correctly, and then connects the magnetic bearing to the first processor. The vacuum pump according to claim 1, wherein the control is resumed. The second processor is
A first power shutoff circuit for shutting off power supply to the first processor and the first peripheral circuit;
A reset signal is sent to the first processor, a power shut-off signal is sent to the first power shut-down circuit to shut off the power, and the first processor is reset by turning it on again after a predetermined time. Item 3. A vacuum pump according to item 1 or 2. The second processor performs at least one of alarm issuing operation, communication control, and motor control,
The first processor receives a signal from a second processor and a second peripheral circuit controlled by the second processor,
4. The system according to claim 1, wherein a runaway of the second processor and a control failure of the control are monitored, the second processor is reset when the control failure is detected, and a recovery operation from the control failure is performed. A vacuum pump according to any one of the above. The first processor is
A second power shutoff circuit for shutting off power supply to the second processor and a second peripheral circuit controlled by the second processor;
A reset signal is sent to the second processor, a power shut-off signal is sent to a second power shut-off circuit to shut off the power, and the second processor is reset by turning it on again after a predetermined time. The vacuum pump according to any one of claims 1 to 4.   The vacuum pump according to any one of claims 1 to 5, wherein the core voltage of one of the first processor and the second processor is higher than the core voltage of the other processor.

Images