WO2024099231A1 - 运动控制系统及方法 - Google Patents

运动控制系统及方法 Download PDF

Info

Publication number
WO2024099231A1
WO2024099231A1 PCT/CN2023/129671 CN2023129671W WO2024099231A1 WO 2024099231 A1 WO2024099231 A1 WO 2024099231A1 CN 2023129671 W CN2023129671 W CN 2023129671W WO 2024099231 A1 WO2024099231 A1 WO 2024099231A1
Authority
WO
WIPO (PCT)
Prior art keywords
safety
mobile device
signal
emergency stop
instruction
Prior art date
Application number
PCT/CN2023/129671
Other languages
English (en)
French (fr)
Inventor
曲欣茹
彭兴文
王堃
Original Assignee
北京极智嘉科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京极智嘉科技股份有限公司 filed Critical 北京极智嘉科技股份有限公司
Publication of WO2024099231A1 publication Critical patent/WO2024099231A1/zh

Links

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/18—Numerical control [NC], i.e. automatically operating machines, in particular machine tools, e.g. in a manufacturing environment, so as to execute positioning, movement or co-ordinated operations by means of programme data in numerical form
    • G05B19/414—Structure of the control system, e.g. common controller or multiprocessor systems, interface to servo, programmable interface controller
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Definitions

  • the present invention relates to the technical field of mobile device control, and in particular to a motion control system and a motion control method.
  • the mobile device when the mobile device is controlled, the corresponding control signal is transmitted to the mobile device so that the mobile device moves according to the control signal.
  • the channel for controlling the signal transmission fails or there is a safety hazard (the control signal is at risk of being tampered with)
  • the mobile device cannot be managed by transmitting the control signal, which may cause the risk of the robot losing control. Therefore, a safe motion control method is urgently needed.
  • an embodiment of the present invention provides a motion control system to solve the technical defects existing in the prior art.
  • An embodiment of the present invention also provides a motion control method.
  • a motion control system comprising: a control platform and at least one mobile device, wherein the control platform communicates with each mobile device via at least two communication links;
  • the control platform is configured to generate an emergency stop command when a safety event is detected to be triggered, and transmit the emergency stop command to the mobile device through a first communication link, wherein the emergency stop command complies with a preset safety communication protocol, and the first communication link is a communication link of the preset safety communication protocol among the at least two communication links;
  • the mobile device is configured to receive an emergency stop instruction through a first communication link, parse the emergency stop instruction using a preset safety communication protocol, and perform a shutdown operation based on the parsing result.
  • a motion control method is provided, which is applied to a motion control system, wherein the motion control system comprises: a control platform and at least one mobile device, wherein the control platform communicates with each mobile device via at least two communication links; the motion control method comprises:
  • the control platform generates an emergency stop command when detecting that a safety event is triggered, and transmits the emergency stop command to the mobile device through a first communication link, wherein the emergency stop command complies with a preset safety communication protocol, and the first communication link is a communication link of the preset safety communication protocol among the at least two communication links;
  • the mobile device receives the emergency stop command through the first communication link, parses the emergency stop command using a preset safety communication protocol, and executes a shutdown operation based on the parsing result.
  • a motion control method which is applied to a control platform.
  • the motion control method includes:
  • An emergency stop command is transmitted to a mobile device via a first communication link, wherein the emergency stop command complies with a preset safety communication protocol, and the first communication link is a communication link of a preset safety communication protocol among at least two communication links between a control platform and a mobile device.
  • a motion control method which is applied to a mobile device.
  • the motion control method includes:
  • the first communication link is a communication link of a preset safety communication protocol among at least two communication links between the control platform and the mobile device, and the emergency stop command complies with the preset safety communication protocol;
  • the emergency stop command is parsed using the preset safety communication protocol, and the shutdown operation is performed based on the parsing result.
  • the motion control system includes: a control platform and at least one mobile device, and the control platform communicates with each mobile device through at least two communication links; the control platform is configured to generate an emergency stop command when a safety event is detected to be triggered, and transmit the emergency stop command to the mobile device through a first communication link, and the first communication link is a communication link with a preset safety communication protocol among the at least two communication links; the mobile device is configured to receive the emergency stop command through the first communication link, parse the emergency stop command using the preset safety communication protocol, and perform a shutdown operation based on the parsing result.
  • the mobile device After receiving the emergency stop command transmitted by the first communication link, the mobile device parses the emergency stop command and performs a shutdown operation based on the parsing result, that is, a first communication link is set for the emergency stop command, and a different communication link is used for transmission with other communication signals, and the transmission of the emergency stop command is protected by the preset safety communication protocol, thereby reducing the probability of transmission failure or error when the emergency stop command is transmitted to the mobile device, and improving the safety of the transmission of the emergency stop command.
  • FIG1 is a schematic structural diagram of a motion control system provided by an embodiment of the present invention.
  • FIG2 is an interactive flow chart of a motion control system architecture provided by an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of the structure of an actuator in a motion control system provided by an embodiment of the present invention.
  • FIG4 is a detailed structural diagram of a motion control system provided by an embodiment of the present invention.
  • FIG5 is a schematic diagram of the structure of the circuit 14 in FIG4 provided by an embodiment of the present invention.
  • FIG6 is a schematic diagram of a detailed structure of FIG5 provided by an embodiment of the present invention.
  • FIG7 is a method flow chart of a motion control method provided by an embodiment of the present invention.
  • FIG8 is a flowchart of actuator interaction under a motion control system architecture provided by an embodiment of the present invention.
  • FIG9 is a flowchart of actuator interaction under another motion control system architecture provided by an embodiment of the present invention.
  • FIG10 is a data flow diagram of a motion control system provided by an embodiment of the present invention.
  • FIG. 11 is a data flow diagram of another motion control system provided by an embodiment of the present invention.
  • FIG12 is an interactive flow chart of a motion control method provided by an embodiment of the present invention.
  • FIG. 13 is a flow chart of a motion control method applied to a control platform provided by an embodiment of the present invention.
  • FIG. 14 is a flow chart of a motion control method applied to a mobile device provided by an embodiment of the present invention.
  • FIG15 is a structural block diagram of a control platform provided by an embodiment of the present invention.
  • FIG. 16 is a structural block diagram of a mobile device provided in accordance with an embodiment of the present invention.
  • first, second, etc. may be used to describe various information in one or more embodiments of the present invention, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • the first may also be referred to as the second, and similarly, the second may also be referred to as the first.
  • Stop category 0 is to stop by immediately cutting off the power supply to the machine, that is, the stop is uncontrolled;
  • Stop category 1 is a controlled stop, the power supply to the actuator of the machine is kept, so that the machine gradually stops. The power is cut off only when the machine stops completely;
  • Stop category 2 is a controlled stop, the power supply to the drive device of the machine is kept.
  • a network segment generally refers to the part of a computer network that can communicate directly using the same physical layer devices.
  • Pass-through that is, transparent transmission (pass-through), which means that in communication, no matter what the business content of the transmission is, it is only responsible for transmitting the content from the source address to the destination address without making any changes to the business data content.
  • System software refers to a system that controls and coordinates computers and external devices and supports the development and operation of application software. It is a collection of various programs that do not require user intervention. Its main function is to schedule, monitor and maintain computer systems.
  • AGV Automated Guided Vehicle
  • the AGV is equipped with an automatic guidance system, which can ensure that the system can automatically travel along the predetermined route without the need for manual navigation, and automatically transport goods or materials from the starting point to the destination.
  • WIFI Wireless Fidelity
  • Grating An optical device consisting of a large number of parallel slits of equal width and equal spacing.
  • IP Internet Protocol
  • IP Address Internet Protocol Address
  • IP protocol is a protocol designed for computer networks to connect and communicate with each other.
  • CIP Safety Protocol It is an extension of the standard functions of the Common Industrial Protocol (CIP) and can be used for functional safety applications. It extends the model by adding CIP safety application layer functions to ensure that the safety system responds with correct behavior or selects a predetermined safety state within a known time during normal communication or when an error occurs.
  • CIP Common Industrial Protocol
  • Profisafe protocol is a fail-safe protocol that combines standard fieldbus technology and fail-safe technology into one system, that is, fail-safe communication and standard communication coexist on the same cable, and safety communication is not achieved through redundant cables.
  • PCIE Peripheral Component Interface Extend
  • PCIE Peripheral Component Interface Extend
  • CPU central processing unit
  • EtherNet/IP is a modern standard protocol for data encapsulation using the CIP protocol in Ethernet.
  • Controller Area Network is a serial communication protocol bus used for real-time applications and is one of the most widely used field buses in the world.
  • the AGV dispatching instructions and system emergency stop instructions are transmitted through the same wireless link between the system end and multiple AGVs in the venue.
  • the AGV dispatching instructions and system emergency stop instructions interact through the data link layer, lacking the protection of additional safety measures, that is, the system emergency stop instructions have the same error probability as the AGV dispatching instructions, which leads to the system emergency stop.
  • the function cannot be implemented reliably and cannot meet the safety level required for emergency stop in relevant safety standards.
  • the server receives a request and issues a system emergency stop command through software control.
  • the system emergency stop command is wirelessly sent to each AGV in the venue, and the AGV that receives the command stops immediately.
  • This transmission method of the emergency stop command makes the emergency stop command lack the protection of the secure communication layer, and there is a possibility that the command may be tampered with or damaged, resulting in the AGV not receiving the correct emergency stop command, resulting in the AGV being unable to stop in time, causing risks.
  • the motion control system includes: a control platform and at least one mobile device, and the control platform communicates with each mobile device through at least two communication links;
  • the control platform is configured to generate an emergency stop command when a safety event is detected to be triggered, and transmit the emergency stop command to the mobile device through a first communication link, and the first communication link is a communication link with a preset safety communication protocol among the at least two communication links;
  • the mobile device is configured to receive the emergency stop command through the first communication link, parse the emergency stop command using the preset safety communication protocol, and perform a shutdown operation based on the parsing result.
  • the mobile device After receiving the emergency stop command transmitted by the first communication link, the mobile device parses the emergency stop command and performs a shutdown operation based on the parsing result, that is, a first communication link is set for the emergency stop command, and a different communication link is used for transmission with other communication signals, and the transmission of the emergency stop command is protected by the preset safety communication protocol, thereby reducing the probability of transmission failure or error when the emergency stop command is transmitted to the mobile device, and improving the safety of the transmission of the emergency stop command.
  • the safe transmission method of the emergency stop command provided by the present invention can comply with relevant safety standards and be within the required acceptable range, that is, the first communication link for transmitting the emergency stop command can meet the safety level requirements specified in the ISO 3691-4 standard in the field of unmanned industrial vehicles.
  • a motion control system is provided.
  • the present invention also relates to a motion control method, which will be described in detail one by one in the following embodiments.
  • FIG. 1 shows a schematic diagram of the structure of a motion control system provided according to an embodiment of the present invention.
  • the motion control system includes a control platform 102 and at least one mobile device 104.
  • the control platform 102 communicates with the mobile device 104 via at least two communication links, the first communication link 103, specifically as follows:
  • the control platform 102 is configured to generate an emergency stop instruction when a safety event is detected to be triggered, and transmit the emergency stop instruction to the mobile device 104 through a first communication link 103, wherein the emergency stop instruction complies with a preset safety communication protocol, and the first communication link 103 is a communication link of the preset safety communication protocol among the at least two communication links;
  • the mobile device 104 is configured to receive the emergency stop instruction through the first communication link 103, parse the emergency stop instruction using the preset safety communication protocol, and perform a shutdown operation based on the parsing result.
  • the control platform refers to a platform for controlling multiple mobile devices.
  • a control platform is set outside the AGV work area to monitor and control the AGV.
  • the control platform can be composed of at least one physical hardware, and its control includes but is not limited to controlling movement, controlling transportation, controlling deceleration, controlling shutdown, etc.
  • the control platform can include a server that generates scheduling instructions (the scheduling instructions are specifically generated by the software on the server), and can also include a safety controller that generates emergency stop instructions (the emergency stop instructions are specifically generated by the safety controller in response to the triggering of a safety event).
  • a mobile device refers to a device that can move or stop autonomously according to the instructions of the control platform.
  • the mobile device can be a robot, an AGV cart, etc.
  • the autonomous mobile device performs corresponding processing through the instructions of the control platform, which can realize the control of the robot device by the control platform.
  • a safety event refers to the conditions required for the safe operation of the equipment.
  • a safety event may be triggered by the emergency stop button in the mobile device area being pressed, the light barrier being detected to be blocked, or the safety door lock being opened, etc.
  • the mobile device in the corresponding working area needs to make corresponding processing, that is, emergency stop operation.
  • the control platform will generate an emergency stop command and transmit the emergency stop command to the mobile device, which will perform the corresponding emergency stop processing. That is, by detecting whether the safety event is triggered, the corresponding processing can be quickly performed when the safety event is triggered to prevent the processing flow corresponding to the safety event from not being generated.
  • An emergency stop command refers to an instruction that contains information that requires a mobile device to perform an emergency stop. Through the emergency stop command, the mobile device can be operated in an emergency stop in any state until it stops.
  • a communication link refers to a signal transmission channel between two nodes, and a communication link can be a wireless communication link or a wired communication link.
  • the first communication link is a link of a preset safety communication protocol, and the first communication link is protected by the preset safety communication protocol, so that when an emergency stop instruction that complies with the preset safety communication protocol is transmitted through the first communication link, it can be protected by the preset safety communication protocol, and transmitted with other instructions using a different communication link, for example, a dispatch instruction can be transmitted using a second communication link different from the first communication link.
  • the preset safety communication protocol refers to a pre-set safety communication protocol that protects the first communication link.
  • the preset safety communication protocol is usually other safety communication protocols such as CIP safety protocol or Profisafe protocol.
  • the control platform when the control platform detects that a safety event is triggered, it quickly responds and generates an emergency stop command that complies with the preset safety communication protocol, so that the emergency stop command can pass through the first communication link of the preset safety communication protocol, and then the control platform transmits the emergency stop command to the mobile device through the first communication link; the mobile device receives the emergency stop command through the first communication link, and because the emergency stop command is generated when it is required It complies with the preset safety communication protocol. Therefore, when the mobile device needs to perform corresponding processing based on the instruction, it is parsed in advance to obtain the parsing result, and then the corresponding shutdown operation is performed based on the parsing result.
  • the shutdown operation can be to make the mobile device perform a deceleration and stop operation, or to make the mobile device perform a shutdown operation.
  • FIG. 2 shows an interaction flow chart under a motion control system architecture provided according to an embodiment of the present invention.
  • control platform includes a safety trigger mechanism 202 and a first safety control mechanism 204;
  • the safety trigger mechanism 202 is configured to generate a safety event trigger signal and send it to the first safety control mechanism 204 when identifying an event that meets the safety trigger condition;
  • the first safety control mechanism 204 is configured to receive the safety event trigger signal sent by the safety trigger mechanism 202, encode the safety event trigger signal using the preset safety communication protocol to obtain an emergency stop instruction, and transmit the emergency stop instruction to the mobile device through the first communication link.
  • the safety trigger mechanism 202 refers to a mechanism that generates a safety event through triggering.
  • the trigger may refer to clicking an emergency stop button, opening a safety door, etc.
  • the safety trigger mechanism 202 may be an emergency stop button, a safety door, a light barrier, etc.
  • the safety event is triggered by the safety trigger mechanism 202 and subsequently processed according to the security event control platform and mobile device.
  • the safety trigger mechanism 202 may continuously and stably output a signal, and when triggered, the output signal disappears or changes suddenly; or the safety trigger mechanism 202 may not output a signal, and when triggered, suddenly generates an output signal.
  • the safety trigger mechanism 202 can be triggered in a variety of ways.
  • the safety trigger mechanism 202 is an emergency stop button, which uses a dual-circuit pulse, that is, two power supplies provide input and output to the emergency stop button. Specifically, before the operator presses the emergency stop button, the emergency stop button is powered by circuit 1 and provides a low pulse, and the output is a low level. When the emergency stop button is pressed, circuit 2 provides current to the emergency stop button, providing a high pulse to output a high level.
  • the safety trigger mechanism 202 can be a safety door or a light barrier. The safety door and the light barrier both use an output signal switching device (OSSD, Output Signal Switch Device) signal.
  • OSD Output Signal Switch Device
  • the output signal switching device Before the safety door is opened or the light barrier is blocked, the output signal switching device is in a closed state, that is, the safety door and the light barrier do not output a signal. After the safety door is opened or the light barrier is blocked, the output signal suddenly changes to a high level or a low level signal.
  • the first safety control mechanism 204 refers to the main control mechanism in the control platform for controlling the mobile device, which is used to control the movement and stop of the mobile device. It is used to respond in time when the device or the device connected to it fails or generates a mutation signal. For example, when it is detected that the safety trigger mechanism 202 is triggered and a safety event occurs, an emergency stop command is generated, and the emergency stop command is transmitted to the mobile device to avoid the failure to handle in time when the device fails or mutates.
  • the safety event trigger signal refers to the signal generated when the safety trigger mechanism 202 is triggered, such as the emergency stop button is pressed, the grating is blocked, the safety door is opened and activated, etc.
  • Encoding the safety event trigger signal using a preset safety communication protocol can be performed by encoding the safety event trigger signal through logic programming in the first safety control mechanism 204 to obtain an emergency stop instruction that complies with the safety format of the CIP safety protocol.
  • the first safety control mechanism 204 may include a first safety input/output interface, a first safety processor, and a safety network module, wherein the first safety input/output interface is used to receive a safety event trigger signal generated by the safety trigger mechanism 202, and provide the received safety event trigger signal to the first safety processor for processing; wherein the first safety processor, through a response of logic programming and utilizing a preset safety communication protocol, encodes the safety event trigger signal into an emergency stop instruction that complies with the safety format of the CIP safety protocol, and before encoding the safety event trigger signal, it is also necessary to verify the signal, such as redundancy detection, to detect duplicate or erroneous trigger signals.
  • the received trigger signal shows that the emergency stop button is only half pressed, and the pressing event is checked to determine whether it actually triggers the generation of a safety event
  • timeout detection whether the transmission time of the safety event trigger signal from the safety trigger mechanism 202 to the first control execution mechanism has timed out
  • the time threshold can be pre-set to 0.01 seconds, and the detected time is compared with the preset time threshold to determine whether it has timed out
  • connection authorization detection which can be to detect whether the mobile device to be controlled is connected to the control platform. If the detection result is authorized, continue with subsequent processing; wherein the safety network module sends corresponding instructions in the form of a network port, namely an emergency stop instruction or a reset instruction.
  • the control platform includes a safety trigger mechanism 202 and a first safety control mechanism 204.
  • the safety trigger mechanism 202 is used to determine whether a safety event is triggered.
  • the first safety control mechanism 204 encodes the generated safety event and generates an emergency stop instruction.
  • the control platform directly processes the safety event trigger signal corresponding to the safety event and generates an instruction that a mobile device can directly process, thereby improving the response efficiency to the triggered safety event and further improving the transmission efficiency of the emergency stop instruction.
  • control platform includes a wireless transmitter 206
  • the wireless transmitter 206 is configured to forward the emergency stop command to a destination port, convert the emergency stop command into a wireless signal through the destination port and transmit it to the mobile device, wherein the destination port is a port for data transmission between the control platform and the mobile device through the first communication link.
  • the wireless transmitter 206 is used to transmit wireless signals, that is, convert the received emergency stop command into a wireless signal form, and then send it.
  • the wireless transmitter 206 may include a switch, a wireless controller and a wireless access point, wherein the switch is used to receive the emergency stop command and forward the emergency stop command to the wireless controller and the wireless access point, and the wireless controller and the wireless access point process the emergency stop command to obtain the emergency stop command in the form of a wireless signal, and transmit the wireless signal to the mobile device through the first communication link.
  • the destination port refers to the port for data transmission between the control platform and the mobile device through the first communication link.
  • a wireless transmitter is used to convert the emergency stop command into a wireless signal form that can be transmitted by the wireless transmitter, so that the emergency stop command can be wirelessly transmitted from the control platform to the mobile device through the first communication link.
  • the wireless transmission method improves the transmission efficiency, and the transmission is carried out through the first communication link, which provides a guarantee for the wireless transmission and further improves the safety of transmitting the emergency stop command.
  • control platform further includes a network address translation device
  • the wireless transmitter is further configured to send the emergency stop instruction to the network address translation device;
  • the network address translation device is configured to perform address translation on the emergency stop instruction, forward the emergency stop instruction after address translation to the destination port, and transmit the emergency stop instruction after address translation to the mobile device in the form of a wireless signal through the destination port.
  • a network address translation (NAT) device is a virtual network address translator that performs internal address translation for cross-segment communications, that is, converts the network address of the data sent by the wireless transmitter into a target network address that matches the network address corresponding to the mobile device, thereby obtaining data that matches the target network address of the mobile device.
  • NAT network address translation
  • the control platform includes a wireless transmitter and a network address translation device, and the control platform and the mobile device perform wireless signal transmission, wherein the mobile device and the wireless transmitter belong to different network segments, the IP address of the wireless transmitter belongs to the first network segment, and the IP address of the mobile device belongs to the second network segment. It is necessary to use the network address translation device to convert the signal sent by the wireless transmitter from the IP address of the first network segment to the corresponding IP address of the second network segment, complete the conversion and transmission of the signal across network segments, and realize signal transmission between the control platform and mobile devices belonging to different network segments through the network address translation device.
  • the control platform also includes a network address translation device.
  • the network address translation device When the control platform and the mobile device belong to different network segments, the network address translation device can be used to realize signal transmission between the two ends, so that the subsequent mobile device can perform corresponding processing based on the received instructions.
  • the mobile device includes a wireless receiver
  • the wireless receiver is configured to receive the wireless signal through the first communication link and forward the wireless signal into an emergency stop command in an Ethernet port format.
  • the wireless receiver 208 is used to receive the wireless signal and convert the received wireless signal into an emergency stop command in Ethernet format.
  • the wireless receiver 208 may include a wireless receiving module, a wireless receiving processor, and a forwarding module; wherein the wireless receiving module is used to receive the wireless signal sent from the wireless transmitter 206 of the control platform and forward it to the wireless receiving processor, and the forwarding method to the wireless receiving processor may be forwarding through a PCIE bus; wherein the wireless receiving processor is used to transparently transmit the received wireless signal to the forwarding module, which is processed by the forwarding module; wherein the forwarding module is used to convert the received wireless signal, convert it into an Ethernet port format, and output it.
  • the wireless receiver of the mobile device converts the received wireless signal into an emergency stop command in the Ethernet port format and forwards it. That is, when the mobile device initially receives the wireless signal, it first converts it into a signal in a format that can be recognized by the mobile device when executing it, so as to facilitate the subsequent execution of the shutdown operation based on the emergency stop command in the Ethernet format.
  • the mobile device includes a second safety control mechanism 210 and an execution mechanism 212;
  • the second safety control mechanism 210 is configured to parse the emergency stop instruction using the preset safety communication protocol, obtain a parsing result, and send the parsing result to the execution mechanism 212;
  • the execution mechanism 212 is configured to execute a shutdown operation based on the analysis result.
  • the second safety control mechanism 210 refers to a mechanism in a mobile device that controls and executes the mobile device based on the instructions of the control platform.
  • the instructions received from the control platform are parsed using a preset safety communication protocol, and the parsed results are output.
  • the second safety control mechanism 210 can parse the emergency stop instruction to obtain a parsing result, so that the mobile device can perform a shutdown operation based on the parsing result.
  • the execution mechanism 212 refers to a mechanism in a mobile device that executes the mobile device according to the instructions. For example, when receiving an emergency stop instruction, based on the emergency stop instruction, a shutdown operation or a deceleration stop operation is performed; when receiving a dispatch instruction, based on the dispatch instruction, a corresponding operation is performed.
  • the second safety control mechanism 210 may include a network communication stack, a second processor, a safety protocol stack, and a second safety input/output interface; wherein the network communication stack is an Ethernet/IP communication stack module, receives a control instruction, and filters and identifies the received control instruction, identifies the control instruction as a safety instruction received from the first communication link, and considers it as an emergency stop instruction, forwards the emergency stop instruction to the safety protocol stack, and the safety protocol stack parses the emergency stop instruction that complies with the preset safety communication protocol through the preset safety communication protocol to obtain the parsing result, and then outputs the parsing result in the form of input and output quantity through the second safety input/output interface.
  • the network communication stack is an Ethernet/IP communication stack module
  • the second processor is used to configure the initialization information of the network communication stack, and collect the status information and fault information of the internal modules contained in the second safety control mechanism 210, and outputs the initial status information, fault information, etc. of each module inside the second safety control mechanism 210.
  • the mobile device includes a second safety control mechanism 210 and an execution mechanism 212.
  • the second safety mechanism receives an emergency stop command, it processes it, determines that the emergency stop command is a safety command, and forwards the safety command to the execution mechanism 212.
  • the execution mechanism 212 performs corresponding processing according to the emergency stop command, thereby further determining the emergency stop command and then executing it, thereby improving the accuracy of the transmission of the emergency stop command.
  • the actuator 212 includes: a delay component, a movement controller, a safety drive, a motor and a speed encoder;
  • the mobile controller is configured to obtain a current moving speed of the mobile device in response to a parsing result of the emergency stop instruction, Predicting motor deceleration information according to the current moving speed, and sending the motor deceleration information to the safety driver;
  • the safety driver is configured to drive the motor to decelerate according to the motor deceleration information
  • the delay component is configured to send a power-off instruction to the safety drive in response to the parsing result of the emergency stop instruction when a preset delay time is reached;
  • the safety driver is further configured to drive the motor to power off and brake according to the power-off instruction
  • the speed encoder is configured to obtain a current speed of the motor and feed the current speed back to the mobile controller;
  • the mobile controller is further configured to generate an alarm message when the current rotation speed does not match the preset rotation speed.
  • the mobile controller refers to a controller that controls the actuator 212 of the mobile device, and is used to respond to the analysis result of the emergency stop instruction, and obtain the current moving speed of the mobile device, and predict the motor deceleration information based on the analysis result and the current moving speed; the motor deceleration information can be based on the analysis result to make the actuator 212 perform an emergency stop operation, and then predict the motor deceleration information that does not harm the mobile device according to the current speed.
  • the motor deceleration information refers to the predicted acceleration information or the motor speed for decelerating the mobile device.
  • the safety driver refers to a device in the mobile device that drives the motor of the mobile device based on the instruction of the mobile controller, that is, it is used to drive the motor to decelerate according to the motor deceleration information, so that the mobile device decelerates and stops.
  • the delay component refers to a device that controls the delayed stop of the motor, for example, the delay time can be set in advance for the delay component, and when the preset delay time is reached, the delay component sends a power-off instruction to the motor, wherein the delay time is usually set according to the resistance value adjusted by the dial switch, which is completed by the hardware circuit, and the default is 2 seconds, which can be adjusted according to the different ground conditions and speed requirements of each project, and the power-off instruction can be to make the motor power off, stop, brake, etc.
  • the safety driver when the preset delay time is reached, the safety driver also drives the motor to power off and brake in response to the power-off instruction sent by the delay component.
  • the speed encoder refers to the process of obtaining the real-time speed of the motor during the process of decelerating the motor until it stops when the motor is powered off and braked based on the safety driver.
  • the motor needs to go through a series of processes such as deceleration, stopping, shutting down, and braking to power off and brake the motor; the mobile controller is then configured to match the current speed obtained in real time with the preset speed. If there is a mismatch, an alarm message is generated. For example, in the third second when the motor starts to decelerate, the preset speed is 3 and the current speed is 2.8, then it is determined that there is a mismatch and an alarm message is generated.
  • the actuator includes a delay component, a mobile controller, a safety driver, a motor and a speed encoder.
  • the mobile controller predicts the deceleration information of the motor, and the speed encoder obtains the current speed of the motor to determine whether it matches the preset motor speed, and then decides whether to generate an alarm message;
  • the delay component also presets a delay time, and when the preset delay time is reached, regardless of whether the motor has decelerated and stopped to zero speed, the safety driver will drive the motor to cut off the power and brake, thereby avoiding the mobile device from failing to perform a shutdown operation within the preset time after receiving an emergency stop command, causing greater losses.
  • the actuator 212 further includes: a signal converter
  • the signal converter is configured to convert the parsing result of the emergency stop command into an initial safety signal that meets a target safety performance level, and output the initial safety signal to the delay component, wherein the target safety performance level is a safety performance level of the mobile device;
  • the delay component is further configured to send a power-off instruction to the safety driver based on the initial safety signal when a preset delay time is reached.
  • an equipment risk assessment can be conducted in accordance with the mechanical safety standards to determine the risk level of the mechanical equipment and the corresponding performance level (Performance Level, PL).
  • safety components with matching performance levels can be deployed in the mechanical equipment.
  • the autonomous mobile robot AMR
  • mobile device a mobile device that can move automatically
  • the control of mobile devices includes safe stop control.
  • stop type 0 direct power off and mechanical brake
  • stop type 1 the machine stops with electronic braking (speed monitoring during the process), then power off and mechanical brake
  • stop type 2 the machine stops with electronic braking, and the speed is zero and static monitoring. If the threshold is exceeded, the power is cut off and the mechanical brake is applied.
  • the mobile device side performs security protection control on the mobile device by deploying a security driver, etc.
  • the cost of deploying a security driver on the mobile device side is high.
  • the performance level of the mobile device is, for example, the first level
  • the performance level of the control component such as the security driver is, for example, the second level, which affects the security protection effect of the mobile device.
  • Risk assessment of equipment according to mechanical safety standards can refer to assessing the average probability of dangerous failure per hour of mobile equipment.
  • the five PLs include PLa, PLb, PLc, PLd and PLe from low to high.
  • PLa is the lowest level among the five PLs, with the highest average probability of dangerous failure per hour and the worst safety.
  • PLe is the highest level among the five PLs, with the lowest average probability of dangerous failure per hour and the best safety.
  • the PL of this type of mobile device is, for example, PLd level.
  • the behavior of the mobile device can be controlled in combination with the needs of the scenario, such as controlling the mobile device to stop, and the corresponding control device should be a PLd level safety control device.
  • the control device is deployed in the mobile device, and the control mechanism that meets a certain PL includes a safety driver and a safety laser radar, or a safety driver and a speed encoder.
  • control mechanism composed of the safety driver and the speed encoder has a PL of PLe level, which is higher than the PLd level of the mobile device, resulting in a certain waste of resources.
  • the stop type corresponding to the embodiment of the present invention is stop type 1.
  • the control process of stop type 1 includes: within the preset delay time, a power-off command is sent to the safety driver through the delay component of the mobile device to realize electronic braking of the mobile device to a speed of 0. After the delay time is reached, a safe torque off (Safe Torque Off, STO) signal is output to the safety driver, and the safe torque off (i.e., the motor is powered off) is added.
  • STO Safe Torque Off
  • the actuator 212 may include: a signal converter 10, a delay circuit 11, a mode selection component 12, and a monitoring circuit 13.
  • the signal converter 10 is a circuit of a target safety performance level, and the target safety performance level is the safety performance level of a mobile device.
  • the mobile device involved here is a mobile device controlled by the actuator 212.
  • an exemplary actuator 212 of an embodiment of the present invention may include: a signal converter 10, a delay circuit 11, a mode selection component 12, and a monitoring circuit 13.
  • the signal converter 10 is configured to convert the parsing result of the emergency stop command into an initial safety signal that meets the target safety performance level, and output the initial safety signal to the delay component 11, wherein the target safety performance level is the safety performance level of the mobile device.
  • the signal converter 10 is a circuit of the target safety performance level.
  • the delay component 11 is further configured to send a power-off instruction to the safety drive based on the initial safety signal when a preset delay time is reached.
  • the monitoring circuit 13 is used to transmit the monitoring result to the mobile device controller when the first level signal of the initial protection stop signal output by the signal converter 10 is detected, so that the mobile device controller triggers the motion control component to control the mobile device to achieve safe stop.
  • the monitoring circuit 13 can also be used to monitor the mode selection signal and the emergency stop switch signal.
  • the signal input to the signal converter 10 may come from a control platform of the mobile device.
  • the target safety performance level is, for example, a PLd level.
  • the signal converter 10 can be implemented as, for example, a PLd safety IO module (PLd safety IO module).
  • the initial safety signal is a safety signal that complies with the PLd level.
  • the mobile device needs a certain execution time from responding to the control instruction to reaching the target state corresponding to the control instruction. For example, taking the control of the mobile device to stop safely as an example, the mobile device needs a certain execution time from responding to the protection stop signal to decelerating to 0.
  • the preset delay time can be manually set by the dial switch according to the motion performance of the mobile device. The preset delay time is, for example, 9s.
  • the low-level signal triggers the protection stop control
  • the delay component 11 can be used to directly output the high-level signal in the DO signal to trigger the mobile device to start the stop operation.
  • the delay component 11 After receiving the low-level signal in the DO signal, the delay component 11 does not output the low-level signal, but continues to output the high-level signal to reach the preset delay time (for example, 9s).
  • the embodiment of the present invention refers to this process as the delay of the low-level signal. After the delay reaches 9s, the delay component 11 can output a low-level signal.
  • the initial safety signal includes a first level signal, wherein the first level signal is used to trigger a safe stop of the mobile device;
  • the actuator 212 further includes: a mode selection component;
  • the delay component is further configured to send the first level signal to the mode selection component when a preset delay time is reached;
  • the mode selection component is configured to send a power-off instruction to the safety driver if the delay component outputs the first level signal when the automatic mode is selected according to the input mode selection signal.
  • the first level signal of the initial safety signal is used to maintain the normal operation of the mobile device, and the first level signal is used to trigger a safe stop of the mobile device.
  • the mode selection component 12 is used to perform logical AND processing on the signal output by the delay component, the emergency stop switch signal and the enable switch signal of the mobile device when the automatic mode is selected according to the input mode selection signal; when the delay component outputs a first level signal or the emergency stop switch signal is a first level signal, output a safety stop signal to the motion control component of the mobile device to trigger the motion control component to control the mobile device to achieve a safe stop.
  • the initial safety signal includes a first level signal.
  • the first level signal can be used to trigger a safety stop of the mobile device.
  • the delay component 11 can be used to transmit the first level signal directly to the mode selection component 12 ; the delay component 11 can also be used to delay the first level signal according to a preset delay time, and output the delayed first level signal to the mode selection component 12 .
  • the mode selection component 12 is used to perform logical AND processing on the signal output by the delay component 11, the emergency stop switch signal and the enable switch signal of the mobile device when the automatic mode is selected according to the input mode selection signal; when the delay component 11 outputs a first level signal or the emergency stop switch signal is a first level signal, output a safety stop signal to the motion control component of the mobile device to trigger the motion control component to control the mobile device to achieve a safe stop.
  • the signal from the delay component 11 to the mode selection component 12 is bypassed, and only when the emergency stop switch signal is a first level signal, a safety stop signal is output to the motion control component of the mobile device to trigger the motion control component to control the mobile device to achieve a safe stop.
  • the initial safety signal further includes a second level signal, wherein the second level signal is used to maintain the normal operation of the mobile device;
  • the delay component is further configured to send the second level signal directly to the mode selection component.
  • the initial safety signal includes a second level signal.
  • the second level signal can be used to trigger the control of the mobile device behavior.
  • the first signal of the initial safety signal can be a second level signal.
  • the delay component 11 can continue to output the second level signal to the mode selection component 12, so that the motion control component can continue to control the mobile device within the preset delay time.
  • the actuator further comprises a manual operator signal interface, and the manual operator signal interface is used to receive a mode selection signal;
  • the mode selection component is further configured to switch the control mode of the actuator to the manual mode in response to the mode selection signal; in the manual mode, switch the control mode of the actuator to the automatic mode in response to the enable switch signal.
  • the delay component includes a first delay circuit and a second delay circuit
  • the signal converter is further configured to output the initial safety signal to the first delay circuit and the second delay circuit respectively.
  • the delay component 11 and the mode selection component 12 shown in FIG3 together constitute a circuit 14, which may include a first delay circuit 141 and a second delay circuit 142.
  • the signal converter 10 may be used to output the initial safety signal to the first delay circuit 141 and the second delay circuit 142, respectively.
  • the initial safety signal outputted by the signal converter 10 to the first delay circuit 141 is the first initial safety signal (eg, DO1 shown in FIG. 4 ).
  • the initial safety signal outputted by the signal converter 10 to the second delay circuit 142 is the second initial safety signal (eg, DO2 shown in FIG. 4 ).
  • first initial safety signal and the second initial safety signal are signals with the same content transmitted through different transmission channels.
  • the first initial safety signal and the second initial safety signal should be the same.
  • by transmitting signals through two transmission channels it is possible to verify whether there are safety hazards during the signal transmission process by cross-verifying whether the signals of the two channels are the same.
  • the motion control component of the mobile device may include a first drive circuit 21 and a second drive circuit 22.
  • the first delay circuit 141 may be used to output the second level signal of the first initial safety signal to STO1 (Safety torque off) of the first drive circuit 21 and STO1 of the second drive circuit 22, respectively, and to output the first level signal of the first initial safety signal to STO1 of the first drive circuit 21 and STO1 of the second drive circuit 22, respectively, after delaying according to a preset delay time.
  • the second delay circuit 142 may be used to output the second level signal of the second initial safety signal to STO2 of the first drive circuit 21 and STO2 of the second drive circuit 22, respectively, and to output the first level signal of the second initial safety signal to STO2 of the first drive circuit 21 and STO2 of the second drive circuit 22, respectively, after delaying according to a preset delay time.
  • the signal output by the first delay circuit 141 is represented by DO1_delay; the signal output by the second delay circuit 142 is represented by DO1_delay.
  • the actuator of the embodiment of the present invention can still perform security protection control on the mobile device through the other delay component, which is conducive to further improving security.
  • the motion control component of the mobile device may further include a mobile device controller 23, a first motor 26, and a second motor 27.
  • the mobile device controller 23 receives the monitoring result of the monitoring circuit 13 (in this embodiment, the monitoring circuit 13 is used as the first processor), and sends a signal to the first drive circuit 21 and the second drive circuit 22.
  • both the first drive circuit 21 and the second drive circuit 22 can be used to respond to the second level signal to trigger the mobile device controller to control the mobile device to stop safely.
  • the first drive circuit 21 is also used to respond to the first level signal after the delay, trigger the safety torque shutdown of the first motor 26, and trigger the mechanical brake of the first motor 26;
  • the second drive circuit 22 is also used to respond to the first level signal after the delay, trigger the second motor 27 to brake, and trigger the mechanical brake of the first motor 27. This process is the process of controlling the mobile device to stop safely.
  • the mobile device controller 23 can communicate with other circuits via a controller area network (CAN) bus.
  • CAN controller area network
  • the mobile device controller 23 communicates with the first drive circuit 21 and the second drive circuit 22 via CAN to control the first drive circuit 21 and the second drive circuit 22.
  • the first delay circuit 141 can be connected to the first emergency stop switch contact 24 of the mobile device, and is used for making a logic AND operation on the first level signal after the delay of the first delay circuit 141 and the first emergency stop control signal ES1 (emergency stop) triggered by the first emergency stop switch contact 24;
  • the second delay circuit 142 is connected to the second emergency stop switch contact 25 of the mobile device, and is used for making a logic AND operation on the first level signal after the delay of the second delay circuit 142 and the second emergency stop control signal ES2 triggered by the second emergency stop switch contact 25.
  • the first delay circuit 141 and the second delay circuit 142 can also receive control from the second processor.
  • the second processor accesses the interface through manual operation to generate a mode selection signal and an enable switch signal on the manual operator.
  • the first mode selection signal MAN1 is output to the first delay circuit 141
  • the second mode selection signal MAN2 is output to the second delay circuit 142.
  • the mode selection signal is a second level signal (ie, a high level)
  • it switches to manual mode
  • the mode selection signal is a first level signal (ie, a low level)
  • the control delay component 11 transmits the protection stop signal normally; in manual mode, the control delay component 11 is bypassed, and only the emergency stop switch signal and the enable switch signal play a control role.
  • the emergency stop switch signals ES1 and ES2 are both second level signals (i.e., high level)
  • the enable switch's EN-NO1 and EN-C1 contacts are connected, and the EN-NO2 and EN-C2 contacts are connected, DO1_delay and DO2_delay output second level signals (i.e., high level)
  • the mobile device controller 23 can control the first drive 21 and the second drive 22, and correspondingly trigger the first motor 26 and the second motor 27 to operate.
  • the monitoring result output by the monitoring circuit to the mobile device controller can be implemented as at least one of DO1, DO2, ES1, ES2, MAN1, and MAN2, and the specific content of the monitoring result can be implemented as different signals according to different scenarios.
  • the actuator 212 can support switching between the two modes by providing an access interface for a manual operator, thereby providing operating space for personnel to intervene in maintenance.
  • the mode selection component includes a first mode selection component and a second mode selection component
  • the output of the first delay circuit is connected in series with the input of the first emergency stop switch of the mobile device and the output of the second delay circuit, so as to perform a logic AND operation on the signal after the delay of the first delay circuit, the signal of the first emergency stop switch and the signal after the delay of the second delay circuit, and output a power-off instruction after the logic AND operation to the safety driver;
  • the first mode selection component selects the manual mode, the output of the first delay circuit is bypassed, and the second level signal is continuously output to the safety driver, wherein the second level signal is used to maintain the normal operation of the mobile device;
  • the output of the second delay circuit is connected in series with the input of the second emergency stop switch of the mobile device and the output of the first delay circuit, so as to perform a logical AND operation on the delayed signal of the second delay circuit, the signal of the second emergency stop switch and the signal of the first delay circuit, and output a power-off instruction after the logical AND operation to the safety driver;
  • the second mode selection component selects the manual mode, the output of the second delay circuit is bypassed, and the second level signal is continuously output to the safety driver.
  • FIG5 is a schematic diagram of the structure of the circuit 14 in FIG4 , including a first power supply (power1) 1411 and a second power supply (power2) 1421.
  • power11411 is used to supply power to the first delay circuit 1412
  • power21421 is used to supply power to the second delay circuit 1422.
  • power11411 and power21421 are set to power the two delay circuits respectively. In the event of a failure of either power, the other power can still power the corresponding delay circuit to maintain the processing and transmission of the safety stop signal, thereby maintaining safe control of the robot, which is conducive to achieving the PLd level.
  • the delay protection stop signal output by the first delay circuit 1412 is given to the first mode selection component 1413, and the first mode selection component outputs DO1_delay; the delay protection stop signal output by the second delay circuit 1422 is given to the second mode selection component 1423, and the second mode selection component outputs DO2_delay.
  • the first mode selection component 1413 and the second mode selection component 1423 respectively perform a logical AND operation on the received signals. For details, please refer to the description of other embodiments of this specification, which will not be repeated here.
  • the actuator 212 of the embodiment of the present invention is introduced below with reference to examples.
  • FIG6 shows an exemplary schematic diagram of an actuator 212.
  • the actuator 212 includes, for example, a PLd safe IO module, a first power supply 1411 and a second power supply 1421, a first delay circuit 1412 and a second delay circuit 1422, a first mode selection component 1413 and a second mode selection component 1423.
  • the first mode selection component 1413 may include a protection stop signal gating circuit 1, a series circuit 1, and an enable signal actuator 2121;
  • the second mode selection component 1423 may include a protection stop signal gating circuit 2, a series circuit 2, and an enable signal actuator 2122.
  • FIG. 6 is a schematic description of the actuator 212, and does not constitute a limitation on the actuator 212 of the embodiment of the present invention.
  • the actuator 212 of the embodiment of the present invention may also include more or fewer circuit modules.
  • some circuit modules in the actuator 212 may be split into two circuit modules, or some circuit modules may be combined into one circuit module for implementation. This is not limited here.
  • the first power supply 1411 supplies power to the first delay circuit 1412
  • the second power supply 1421 supplies power to the second delay circuit 1422.
  • the first power supply 1411 and the second power supply 1421 are both 5 volt (V) power supplies, for example.
  • the first power supply 1411 transforms a 24V power supply into a 5V power supply through a DC transformer (DC/DC 1) to supply power to the first delay circuit 1412.
  • the second power supply 1421 transforms a 24V power supply into a 5V power supply through a DC transformer (DC/DC 2) to supply power to the second delay circuit 1422.
  • power supply protection circuits can be set in the circuits of the first power supply 1411 and the second power supply 1421 (the power supply 2 in Figure 6 is not shown) to protect the corresponding power supply circuits.
  • the PLd safety IO module converts the signal into a DO signal that meets the PLd level, and outputs the DO1 signal to the first delay circuit 1412 and the DO2 signal to the second delay circuit 1422.
  • the DO1 signal and the DO2 signal have the same level.
  • the first signal of the DO1 signal and the DO2 signal can be a high level signal.
  • the first delay circuit 1412 can directly output the high-level signal of the DO1 signal to the series circuit 1 via the protection stop signal selection circuit 1.
  • a delay is performed (i.e., no output) until the delay time reaches the preset time and then outputs it to the protection stop signal selection circuit 1.
  • the output signal of the first delay circuit 1412 is referred to as OUT1
  • the signal output by the protection stop signal selection circuit 1 is referred to as DO1 delay signal 1 (DO1_DELAY_1).
  • the second delay circuit 1422 can directly output the high-level signal of the DO2 signal to the series circuit 2 via the protection stop signal selection circuit 2.
  • a delay is performed (i.e., no output) until the delay time reaches the preset time and then outputs it to the protection stop signal selection circuit 2.
  • the output signal of the second delay circuit 1422 is referred to as OUT2
  • the signal output by the protection stop signal selection circuit 2 is referred to as DO2 delay signal 1 (DO2_DELAY_1).
  • DO1_DELAY_1, DO2_DELAY_1 and the first emergency stop switch signal ES1 can be connected in series through a logical AND operation. In this way, when any of the three signals is at a low level, EN-C1 output by the series circuit 1 is at a low level, and DO1_delay (EN-NO1) is at a low level, and the first drive circuit and the second drive circuit will both stop safely.
  • DO2_DELAY_1, DO1_DELAY_1 and the second emergency stop switch signal ES2 can be connected through The logical AND operation is performed in series, so that when any of the three signals is at a low level, EN-C2 output by the series circuit is also at a low level, and DO2_delay (EN-NO2) is at a low level, and both the first drive circuit and the second drive circuit will stop safely.
  • protection stop signal gating circuit 1 is controlled by the first mode selection signal MAN1
  • protection stop signal gating circuit 2 is controlled by the second mode selection signal MAN2.
  • the actuator 212 When the manual operator is connected to the robot, the actuator 212 is in manual mode (manual mode), and MAN1 and MAN2 can be high. In addition, in manual mode, the OUT1 signal is bypassed, and the output DO1_DELAY_1 of the protection stop signal selection circuit 1 is always high; the OUT2 signal is bypassed, and the output DO2_DELAY_1 of the protection stop signal selection circuit 2 is always high. At the same time, the enable signal actuator 2121 will disconnect the original connection between EN-C1 and DO1_delay (EN-NO1), and EN-C1 and DO1_delay (EN-NO1) are controlled by the enable switch of the manual operator.
  • EN-NO1_delay EN-C1 and DO1_delay
  • EN-C1 and DO1_delay EN-NO1
  • EN-NO1 and DO1_delay EN-NO1
  • EN-NO1 and DO1_delay EN-NO1
  • EN-NO2 and DO2_delay EN-NO2
  • EN-NO1 EN-C1 and DO1_delay
  • MAN1 and MAN2 are at low levels, and the actuator 212 switches to the automatic mode (auto mode).
  • the robot is controlled by the remote dispatch system.
  • the output DO1_DELAY_1 of the protection stop signal selection circuit 1 is directly connected to the OUT1 signal
  • the output DO2_DELAY_1 of the protection stop signal selection circuit 2 is directly connected to the OUT2 signal
  • the EN-C1 of the enable signal actuator 2121 is directly connected to DO1_delay (EN-NO1)
  • the EN-C2 of the enable signal actuator 2122 is directly connected to DO2_delay (EN-NO2).
  • the first level signal is a low level signal; and the second level signal is a high level signal.
  • the initial safety signal includes a first level signal and a second level signal.
  • the first level signal can be used to trigger a safe stop of the mobile device.
  • the second level signal can be used to trigger control of the behavior of the mobile device.
  • the first signal of the initial safety signal can be a second level signal.
  • the initial safety signal may be, for example, a digital output (DO) signal
  • the first level signal may be, for example, a low level signal of the DO signal
  • the second level signal may be, for example, a high level signal of the DO signal.
  • DO digital output
  • the delay component can continue to output the first level signal to the mode selection component 12, so that the motion control component continues to control the mobile device within the preset delay period.
  • the signal from the delay component to the mode selection component 12 is bypassed, and only when the emergency stop switch signal is a second level signal, a safety stop signal is output to the motion control component of the mobile device to trigger the motion control component to control the mobile device to achieve a safe stop.
  • the delay component can be used to transmit the second level signal directly to the mode selection component; the delay component can also be used to delay the first level signal according to a preset delay time, and output the delayed first level signal to the mode selection component.
  • the embodiment of the present invention further provides a control method.
  • FIG7 An exemplary control method provided by an embodiment of the present invention is shown in FIG7 .
  • the control method is applied to an actuator 212 .
  • the actuator 212 for example, may be shown in any of the embodiments in FIG2 to FIG6 .
  • the control method includes the following steps:
  • Step S101 converting an input protection stop signal into an initial safety signal that meets a target safety performance level, wherein the initial safety signal includes a first level signal and a second level signal.
  • the target safety performance level is the safety performance level of the controlled mobile device, and the target safety performance level is, for example, PLd.
  • the initial safety signal meets the target safety performance level, so in this example, the initial safety signal is, for example, a PLd signal.
  • the initial safety signal may be a DO signal
  • the first level signal may be a low level signal
  • the second level signal may be a high level signal.
  • the first signal of the initial safety signal may be a high level signal.
  • the actuator 212 can be deployed on the mobile device side, and the signal received by the actuator 212 can come from the control platform of the mobile device.
  • the mobile device can operate in a pre-defined operating area, and a control platform is set corresponding to the operating area to control the mobile device operating in the operating area.
  • the control platform can generate a source signal in response to a user trigger, and send the source signal to the slave control module of the mobile device through a wireless network.
  • the slave control module of the mobile device sends the source signal to the signal converter of the actuator 212.
  • the slave control module can send the source signal to the signal converter through the Ethernet industrial protocol (EIP) module.
  • EIP Ethernet industrial protocol
  • the control platform does not belong to the category of machinery used for production, and risk assessment is not required. Therefore, the source signal generated by the control platform does not meet any safety performance level. Based on this, the source signal (i.e., the signal received by the actuator 212) should be converted by the signal converter into a signal of the target safety performance level (i.e., the initial safety signal) before it can be used to trigger the mobile device to perform the corresponding operation.
  • the source signal i.e., the signal received by the actuator 212
  • the signal converter i.e., the initial safety signal
  • Step S102 when the actuator is in the automatic mode, the initial safety signal is processed, and the processing includes: when the initial safety signal is a first level signal, the first level signal is delayed according to a preset delay time.
  • the second level signal is continuously outputted.
  • the manual mode can be switched to the automatic mode to output the first level signal.
  • Step S103 performing logical AND processing on the processed signal, the emergency stop switch signal of the mobile device, and the enable switch signal.
  • Step S104 controlling the behavior of the mobile device according to the result of the logic and processing.
  • controlling the behavior of a mobile device according to a result of logic AND processing includes: if the signal after the logic AND processing is a delayed first-level signal, driving a motor brake of the mobile device in response to the delayed first-level signal; and if the signal after the logic AND processing is a second-level signal, controlling the mobile device to stop safely.
  • the actuator 212 can still continue to respond to the first level signal in parallel to control the behavior of the mobile device so that the mobile device reaches a stopped state. Furthermore, the motor brake of the mobile device is driven in response to the first level signal to cut off the power of the mobile device, so that the mobile device can be stably stopped.
  • steps S102 to S104 are the processing process of two signals with the same content, which will not be expanded here.
  • the circuit components and signal flows involved in steps S101 to S104 can all be referred to the relevant descriptions in Figures 2 to 6, which will not be repeated here.
  • the actuator provided by the embodiment of the present invention includes a signal converter, a delay component, a mode selection component, and a monitoring circuit.
  • the signal converter is used to convert the input protection stop signal into an initial safety signal that meets the safety performance level.
  • the second level signal of the initial safety signal is used to maintain the normal operation of the mobile device, and the first level signal is used to trigger the safe stop of the mobile device, so as to provide a safety signal of the same level as the performance level of the mobile device.
  • the initial safety signal is output to the delay component, and the delay component is used to directly transmit the second level signal to the mode selection component, and to delay the first level signal for a preset delay time and then transmit it to the mode selection component.
  • the mode selection component is used to perform logical AND processing on the signal output by the delay component, the emergency stop switch signal of the mobile device, and the enable switch signal when the automatic mode is selected according to the input mode selection signal; when the delay component outputs the first level signal or the emergency stop switch signal is the first level signal, the safety stop signal is output to the motion control component of the mobile device to trigger the motion control component to control the mobile device to achieve safe stop.
  • the monitoring circuit is used to monitor the initial protection stop signal, the mode selection signal and the emergency stop switch signal, and when the initial protection stop signal is the first level signal, transmit the monitoring result to the mobile device controller, so that the mobile device controller controls the mobile device to the motion control component to achieve safe stop.
  • the present technical solution uses a circuit that meets the target safety performance level to replace the safety control component composed of the safety controller and other devices in the prior art, which is conducive to reducing costs and can provide control of a matching performance level (i.e., the target performance level) for the mobile device.
  • the mobile controller is further configured to send a power-on instruction to the security driver when receiving a reset instruction forwarded by the second security control mechanism;
  • the safety driver is further configured to drive the motor to reset according to the power-on instruction.
  • the mobile controller When the mobile controller receives the reset command forwarded by the second safety control mechanism, it sends a power-on command to the safety driver to reset the motor, that is, release the shutdown and brake state, so that when the scheduling command is received later, the corresponding scheduling processing can be directly performed based on the scheduling command.
  • the safety driver When the safety driver receives the power-on command sent by the mobile controller, it drives the motor to perform the power-on operation, that is, release the shutdown and brake state, and enter the standby state.
  • FIG. 8 shows an actuator interaction flow chart under a motion control system architecture provided according to an embodiment of the present invention, which is as follows:
  • the actuator includes: delay components, motion controller, safety drive, motor and speed encoder;
  • Phase 1 The mobile controller receives the emergency stop command transmitted by the second safety control mechanism, obtains the current moving speed of the mobile device, predicts the motor deceleration information according to the current moving speed, and sends the motor deceleration information to the safety driver;
  • the second stage the safety driver left and the safety driver right, according to the motor deceleration information, respectively drive the motor left and the motor right to decelerate according to the motor deceleration information;
  • Phase 3 The delay component simultaneously receives the emergency stop command transmitted by the second safety control mechanism, and sends a power-off command to the safety drive when the preset delay time is reached;
  • Stage 4 The left safety driver and the right safety driver drive the left motor and the right motor respectively to cut off power and apply the brake according to the power-off command;
  • the speed encoder obtains the current speed of the left motor and the right motor, and feeds the current speed back to the mobile controller.
  • the mobile controller generates an alarm message when the current speed does not match the preset speed.
  • a power-on command is sent to the safety driver, so that the safety driver drives the motor to reset and restore the standby state, so that when the mobile device is subsequently scheduled, it can be directly scheduled, thereby improving the efficiency of the subsequent operation of the mobile device.
  • the actuator includes: a safety controller, a movement controller, a safety driver, a motor and a data encoder;
  • the safety controller is configured to receive a parsing result of the emergency stop instruction and forward the parsing result to the mobile controller;
  • the mobile controller is configured to obtain a current moving speed of the mobile device in response to the analysis result, predict motor deceleration information according to the current moving speed, and send the motor deceleration information to the safety driver;
  • the safety driver is configured to drive the motor to decelerate according to the motor deceleration information
  • the data encoder is configured to obtain a current rotation speed of the motor and feed the current rotation speed back to the safety controller;
  • the safety controller is further configured to monitor the motor deceleration information and identify whether the motor decelerates according to the current speed. If the speed is abnormal, a power-off instruction is sent to the safety driver;
  • the safety driver is further configured to drive the motor to power off and brake according to the power-off instruction.
  • the safety controller refers to a device that monitors and controls the safe deceleration of the mobile device. For example, when the motor does not decelerate at a predetermined speed, it is determined that the motor is abnormal.
  • the analysis result is sent to the mobile controller, so that the mobile controller can control the mobile device to perform corresponding processing based on the analysis result; the mobile controller obtains the current speed of the mobile device based on the analysis result, predicts the motor deceleration information, and sends the motor deceleration information to the safety driver, so that the safety driver drives the motor to decelerate based on the predicted motor deceleration information.
  • the data encoder simultaneously obtains the real-time current speed of the motor, and feeds back the obtained current speed to the mobile controller, which monitors the deceleration information of the motor, matches the current speed of the motor with the speed in the predicted motor deceleration information, and determines whether there is a deceleration abnormality. If it is determined that it occurs, a power-off command is sent to the safety driver; the safety driver drives the motor to power off and brake.
  • the mobile controller matches the current speed of the motor with the speed in the predicted motor deceleration information and finds that the two are matched, that is, the motor has not decelerated abnormally, then the safety drive only needs to drive the motor to decelerate, without the need to power off the drive and apply the brake.
  • the actuator includes a safety controller, a mobile controller, a safety driver, a motor and a data encoder.
  • the mobile controller receives an emergency stop command and predicts the motor deceleration information, and uses the safety driver to drive the motor to decelerate according to the motor deceleration information.
  • the data encoder obtains the current speed of the motor in real time and forwards it to the safety controller.
  • the safety controller monitors the speed of the motor and determines whether there is an abnormality. When it is determined that there is an abnormality, the safety driver is used to drive the motor to cut off power and brake. To a certain extent, the safety of the motor is guaranteed and errors caused by abnormal deceleration of the motor are avoided.
  • the security controller is further configured to forward the reset instruction to the mobile controller when receiving the reset instruction forwarded by the second security control mechanism;
  • the mobile controller is further configured to send a power-on instruction to the security driver in response to the reset instruction;
  • the safety driver is further configured to drive the motor to reset according to the power-on instruction.
  • the reset instruction is sent to the mobile controller, and the mobile controller processes the reset instruction accordingly. That is, the mobile controller sends a power-on instruction to the safety driver based on the reset instruction, so that the safety driver drives the motor to power on, that is, releases the shutdown and braking states, so that the motor can be directly scheduled based on the scheduling instruction when receiving the scheduling instruction.
  • FIG. 9 shows an actuator interaction flow chart under another motion control system architecture provided according to an embodiment of the present invention, which is as follows:
  • the actuator includes: safety controller, motion controller, safety drive, motor and data encoder;
  • the safety controller receives the parsing result of the emergency stop command and forwards the parsing result to the mobile controller; the mobile controller receives the emergency stop command and obtains the current moving speed of the mobile device, predicts the motor deceleration information according to the current moving speed, and sends the motor deceleration information to the safety drive left and the safety drive right;
  • the second stage the left safety driver and the right safety driver drive the left motor and the right motor to decelerate according to the motor deceleration information; the data encoder obtains the current speed of the motor and feeds back the current speed to the safety controller;
  • the third stage the safety controller monitors the motor deceleration information, and identifies whether the left motor and the right motor have deceleration abnormalities according to the current speed. If so, a power-off instruction is sent to the left safety driver and the right safety driver; the left safety driver and the right safety driver drive the left motor and the right motor to power off and apply the brake according to the power-off instruction.
  • the safety controller when the safety controller receives a reset instruction, the reset instruction is forwarded to the mobile controller, and the mobile controller sends a power-on instruction to the safety drive, so that the safety drive drives the motor to perform a power-on operation, so that other instructions can be directly received subsequently and actions can be taken directly based on the instructions.
  • control platform is further configured to generate a scheduling instruction, and transmit the scheduling instruction to the mobile device through a second communication link, wherein the scheduling instruction complies with a preset data link communication protocol, and the second communication link is a communication link of the preset data link communication protocol among the at least two communication links;
  • the mobile device is further configured to receive the scheduling instruction through the second communication link, parse the scheduling instruction, and perform a scheduling operation based on the parsing result.
  • a dispatch instruction refers to an instruction for dispatching a mobile device generated by human operation or system software, and the dispatch instruction complies with a preset data link communication protocol.
  • the dispatch instruction may be a button that causes a mobile device to carry goods to be pressed, an instruction that causes a mobile device to place goods on a shelf to be input, etc.
  • the dispatch instruction is transmitted to the mobile device via the second communication link, and the mobile device performs the corresponding dispatch processing.
  • the dispatch instruction that complies with the preset data link communication protocol is transmitted via the second communication link, the dispatch instruction can be protected by the preset data link communication protocol, which greatly reduces the impact on the transmission of the emergency stop instruction.
  • the control platform is also used to generate a dispatch instruction.
  • the generated dispatch instruction complies with a preset data link communication protocol, and the dispatch instruction is transmitted to a mobile device via a second communication link.
  • the mobile device receives the dispatch instruction via the second communication link, parses it to obtain a parsing result, and performs dispatch work based on the parsing result.
  • the dispatch instruction is transmitted via a second communication link different from the first communication link. While ensuring the security of the dispatch instruction transmission, the impact on the emergency stop instruction transmission is greatly reduced.
  • control platform is further configured to generate a reset instruction when detecting that a reset event is triggered, and transmit the reset instruction to the mobile device through the first communication link;
  • the mobile device is further configured to receive the reset instruction through the first communication link, parse the reset instruction, and resume operation based on the parsing result.
  • a reset event refers to an event that causes a mobile device to reset due to human or system software reasons. For example, a reset event may be triggered when the emergency stop button in the mobile device area is released, the grating changes from being blocked to normal, the safety door is closed and a start action is manually performed, etc.
  • the control platform When a reset event is detected to be triggered, the control platform will generate a reset instruction and transmit the reset instruction to the mobile device.
  • the mobile device will perform corresponding reset processing based on the reset instruction, that is, resume work. That is, by detecting whether the reset event is triggered, the corresponding processing can be quickly performed when the reset event is triggered to prevent the processing flow corresponding to the reset event from not being generated.
  • a reset instruction refers to an instruction that contains information that causes a mobile device to reset. Through the reset instruction, the mobile device can resume work in a shutdown state.
  • a reset instruction is generated and transmitted to the mobile device via the first communication link.
  • the mobile device receives the reset instruction via the first communication link, parses the reset instruction, and resumes work based on the result of the analysis.
  • the network communication stack receives the control instruction, filters and identifies the received control instruction, identifies that the control instruction is a non-safety instruction received from the first communication link, parses the non-safety instruction through the preset data link communication protocol, obtains the reset instruction, and then outputs it to the execution structure in accordance with the Ethernet/IP protocol and CAN bus protocol format.
  • the reset instruction can also be a safety instruction
  • the network communication stack will forward the safety instruction to the safety protocol stack
  • the safety protocol stack parses the safety instruction that complies with the preset safety communication protocol through the preset safety communication protocol, obtains the parsing result as a reset instruction, and then outputs the parsing result safely in the form of input and output through the second safety input and output interface.
  • the control platform when the control platform detects that a reset event is triggered, the control platform generates a reset instruction and transmits it to the mobile device through the first communication link, so that the mobile device receives the reset instruction through the first communication link and parses the reset instruction to obtain a parsing result based on which the mobile device can perform corresponding processing, and performs recovery work based on the parsing result.
  • the reset instruction is transmitted through the first communication link, which ensures the transmission channel of the reset instruction and further ensures that the reset instruction is transmitted safely, so as to facilitate the post-reset processing of the mobile device.
  • the mobile device is further configured to feed back confirmation information to the control platform after receiving the emergency stop instruction;
  • the control platform is further configured to send a prompt message to the mobile device if the confirmation information fed back by the mobile device is not received within a preset safety period after the emergency stop command is transmitted to the mobile device;
  • the mobile device is further configured to execute a shutdown operation in response to the prompt message.
  • the preset safety period refers to a pre-set period for feedback of safety instructions, that is, after the control platform sends an emergency stop instruction to the mobile device, it waits for the time corresponding to the preset safety period, and needs to receive a confirmation message from the mobile device within the preset period.
  • the confirmation message refers to a message corresponding to the emergency stop instruction, which is used to inform the control platform that the mobile device has received the emergency stop instruction, wherein the control platform first sends an emergency stop instruction to the mobile device, and the mobile device needs to feedback a confirmation message to the control platform based on the emergency stop instruction, so that the control platform confirms that the mobile device has received the emergency stop instruction.
  • the prompt message refers to a message corresponding to the emergency stop instruction and the confirmation message, which is used to send a prompt message to the mobile device again when the control platform does not receive feedback from the mobile device, so that the mobile device performs a shutdown operation after receiving the prompt message, thereby achieving the purpose of the mobile device required by the emergency stop instruction.
  • the method of prompting the mobile device to perform a shutdown operation may also be that the control platform pre-sets a preset time duration during the normal working period of the mobile device. Every preset time duration, the control platform sends a first interaction message to the mobile device, and the mobile device needs to return a second interaction message to the control platform within a preset safety period. If the control platform fails to send the first interaction message or the mobile device fails to send the second interaction message, the control platform will send a prompt message to the mobile device, so that the mobile device will perform a shutdown operation in response to the prompt message.
  • the control platform After sending the emergency stop command to the mobile device, the control platform confirms whether the confirmation message sent by the mobile device is received within the preset safety period. If received, the emergency stop process ends.
  • the solution of the embodiment of the present invention is applied, by setting a preset safety period on the control platform, and after sending the emergency stop command, determining whether a confirmation message of the mobile device is received within the preset period; if not, sending a prompt message to the mobile device to make the mobile device perform a shutdown operation, so that even if the mobile device does not perform the shutdown operation according to the emergency stop command, it will perform the shutdown operation according to the received prompt message, thereby ensuring that the mobile device performs the shutdown operation.
  • first communication link and a second communication link between the control platform and the mobile device, wherein the first communication link complies with a preset safety communication protocol, and a safety task time interval is set on the control platform and the mobile device.
  • the control platform and the mobile device establish a connection, interactive confirmation is maintained according to the safety task time interval, that is, when the control platform successfully sends a first response message and receives a second response message returned by the mobile device, the interactive confirmation is considered valid; if the control platform fails to successfully send the first response message or the mobile device fails to successfully return the second response message, the mobile device is automatically controlled by the internal unit to enter a safe state, that is, an emergency stop state, which may be a second safety control mechanism sending an emergency stop command to the actuator, so that the mobile device is controlled to stop safely until the control platform and the mobile device are re-established. After the connection is re-established, the mobile device will automatically jump out of the safe state through the internal unit control and return to the state before entering the safe state.
  • FIG. 10 shows a data flow diagram of a motion control system provided according to an embodiment of the present invention
  • FIG. 10 shows a data flow diagram of another motion control system provided according to an embodiment of the present invention, as follows:
  • the control platform in Figure 10 includes a safety trigger mechanism, a first safety control mechanism, system software and a wireless transmitter; the mobile device includes a wireless receiver and an actuator, and the interaction between the control platform and the mobile device is only through a data link layer, that is, the physical layer.
  • the control platform includes a safety trigger mechanism, a first safety control mechanism and a wireless transmitter, and the mobile device includes a wireless receiver, a second safety control mechanism and an actuator; in the second communication link, the control platform includes system software and a wireless transmitter, and the mobile device includes a wireless receiver, a second safety control mechanism and an actuator, wherein the first communication link communicates through a safety communication layer protected by a preset safety communication protocol, and the second communication link communicates through a data link layer.
  • the motion control system includes: a control platform and at least one mobile device, the control platform and each mobile device communicate with each other through at least two communication links;
  • the control platform is configured to generate an emergency stop command when a safety event is detected to be triggered, and transmit the emergency stop command to the mobile device through a first communication link, and the first communication link is a communication link with a preset safety communication protocol among the at least two communication links;
  • the mobile device is configured to receive the emergency stop command through the first communication link, parse the emergency stop command using the preset safety communication protocol, and perform a shutdown operation based on the parsing result.
  • the mobile device After receiving the emergency stop command transmitted by the first communication link, the mobile device parses the emergency stop command and performs a shutdown operation based on the parsing result, that is, a first communication link is set for the emergency stop command, and a different communication link is used for transmission with other communication signals, and the transmission of the emergency stop command is protected by the preset safety communication protocol, thereby reducing the probability of transmission failure or error when the emergency stop command is transmitted to the mobile device, and improving the safety of the transmission of the emergency stop command.
  • FIG. 12 shows an interactive flow chart of a motion control method provided according to an embodiment of the present invention, which is applied to a motion control system, wherein the motion control system comprises: a control platform and at least one mobile device, wherein the control platform communicates with each mobile device via at least two communication links; specifically, the following steps are included:
  • Step 602 the control platform generates an emergency stop command when detecting that a safety event is triggered, and transmits the emergency stop command to the mobile device through a first communication link, wherein the emergency stop command complies with a preset safety communication protocol, and the first communication link is a communication link of the preset safety communication protocol among the at least two communication links;
  • Step 604 The mobile device receives the emergency stop instruction through the first communication link, parses the emergency stop instruction using the preset safety communication protocol, and performs a shutdown operation based on the parsing result.
  • steps 602 to 604 refer to the system implementation corresponding to FIG1 , which will not be described in detail here.
  • FIG. 13 shows a flow chart of a motion control method applied to a control platform according to an embodiment of the present invention, which specifically includes the following steps:
  • Step 702 When a safety event is detected to be triggered, an emergency stop instruction is generated;
  • Step 704 Transmit the emergency stop command to the mobile device via a first communication link, wherein the emergency stop command complies with a preset safety communication protocol, and the first communication link is a communication link of the preset safety communication protocol among at least two communication links between the control platform and the mobile device.
  • steps 702 to 704 please refer to the system implementation corresponding to FIG1 , which will not be described in detail here.
  • FIG. 14 shows a flow chart of a motion control method applied to a mobile device according to an embodiment of the present invention, which specifically includes the following steps:
  • Step 802 receiving an emergency stop command transmitted by a control platform through a first communication link, wherein the first communication link is a communication link of a preset safety communication protocol among at least two communication links between the control platform and the mobile device, and the emergency stop command complies with the preset safety communication protocol;
  • Step 804 parse the emergency stop instruction using the preset safety communication protocol, and execute a shutdown operation based on the parsing result.
  • steps 802 to 804 please refer to the system implementation corresponding to FIG1 , which will not be described in detail here.
  • the motion control system includes: a control platform and at least one mobile device, the control platform and each mobile device communicate with each other through at least two communication links;
  • the control platform is configured to generate an emergency stop command when a safety event is detected to be triggered, and transmit the emergency stop command to the mobile device through a first communication link, and the first communication link is a communication link with a preset safety communication protocol among the at least two communication links;
  • the mobile device is configured to receive the emergency stop command through the first communication link, parse the emergency stop command using the preset safety communication protocol, and perform a shutdown operation based on the parsing result.
  • the mobile device After receiving the emergency stop command transmitted by the first communication link, the mobile device parses the emergency stop command and performs a shutdown operation based on the parsing result, that is, a first communication link is set for the emergency stop command, and a different communication link is used for transmission with other communication signals, and the transmission of the emergency stop command is protected by the preset safety communication protocol, thereby reducing the probability of transmission failure or error when the emergency stop command is transmitted to the mobile device, and improving the safety of the transmission of the emergency stop command.
  • FIG15 shows a block diagram of a control platform provided according to an embodiment of the present invention.
  • the components of the control platform include a safety trigger mechanism 902 , a first safety control mechanism 904 , and a wireless transmitter 906 .
  • the safety trigger mechanism 902 includes an emergency stop button, a light barrier, a safety door, etc.
  • the output signal form of various safety trigger mechanisms 902 is specified by the design manual of each device. Common emergency stop buttons are dual-loop pulses, light barriers are OSSD signals, and safety door locks are OSSD signals.
  • the input is triggered by the operator or automatically triggered.
  • the output indicates the device status, including I/O signal outputs of triggered, untriggered or abnormal status.
  • the safety trigger mechanism 902 can be installed with an emergency stop button, a grating and a safety door at the periphery of the working area of the mobile device and at the position where it interfaces with the operator.
  • the safety door is the only passage for personnel to enter and exit the working area of the mobile device.
  • the working area of the mobile device is isolated from the outside world by a fixed fence to reduce the risk of impact or extrusion caused by the erroneous operation of the mobile device.
  • the first safety control mechanism 904 will issue an emergency stop command and transmit it to at least one mobile device; a safety door lock is installed on the safety door, which is the only entrance for the operator to enter the working area of the mobile device.
  • the emergency stop command will be sent by the first safety control mechanism 904 and transmitted to at least one mobile device; each safety trigger mechanism 902 is equipped with a reset button, and the reset command can be triggered by the reset button.
  • the first safety control mechanism 904 includes a first safety input-output interface, a first safety processor and a safety network module; the input is the condition of whether the safety trigger mechanism 902 or the reset button is triggered, that is, the output of the safety trigger mechanism 902 or the reset button; the output: whether the safety trigger mechanism 902 is triggered or whether the reset button is pressed is output in the form of a network port.
  • the first safety control mechanism 904 can respond to the triggering of the safety trigger mechanism 902 through logic programming, and transmit it through the preset safety communication protocol CIP safety.
  • the first safety input and output interface is used to input the state of the safety trigger mechanism 902 for the first safety processor; the first safety processor is used to respond to the triggering of the safety trigger mechanism 902 through logic programming.
  • the input signal is encoded into a safety format that complies with the CIP safety protocol. Perform the verification actions specified in the preset safety communication protocol, such as redundancy detection, data integrity verification, timeout detection, connection authorization detection, etc.
  • the safety network module is used to send the calculation results of the safety CPU in the form of a network port.
  • the output signal of the first safety control mechanism 904 is Ethernet/IP in the data link layer communication protocol and CIP safety in the safety communication layer, and a high-speed analog signal is sent in the form of a network port.
  • the wireless transmitter 906 includes a switch, a wireless controller, and a wireless access point. Its input is the output of the first security control mechanism 904, and its output is to send a wireless signal to the mobile device.
  • the switch is used to forward the data packet to the destination node port (wireless controller and wireless access point); the wireless controller and the wireless access point are used to convert the data packet into a wireless signal form and send it to the mobile device.
  • FIG16 shows a block diagram of a mobile device according to an embodiment of the present invention.
  • the components of the mobile device include a wireless receiver 1002 , a second safety control mechanism 1004 , and an execution mechanism 1006 .
  • the wireless receiver 1002 includes a wireless receiving module, a forwarding module, and a wireless receiving processor; the input is a wireless signal; and the output is an instruction in Ethernet format.
  • the wireless receiver 1002 is used to convert the received wireless signal into a data packet in the Ethernet port format.
  • the wireless receiving module is used to receive WIFI signals; the wireless receiving processor is used for transparent transmission of data packets; the forwarding module is used to forward the received wireless signal into the Ethernet port format.
  • the wireless receiver 1002 receives the 2.4GHz wireless signal, it is transmitted to the wireless receiving processor through the PCIE bus.
  • the wireless receiving processor transparently transmits the signal and the forwarding module outputs it from the network port in the Ethernet/IP protocol format.
  • the second safety control mechanism 1004 includes a network communication stack, a second processor, a safety protocol stack, and a second safety input and output interface, wherein the input is a data packet in an Ethernet port format; and the output is a safety output and a non-safety output.
  • the second safety control mechanism 1004 parses the non-safety data packet in the Ethernet/IP communication protocol format. For the safety data packet, it is parsed in the CIP safety preset safety communication protocol format. The parsed instructions are output in the format of input and output quantities.
  • the network communication stack is an Ethernet/IP communication stack module, which is used to filter the data packet into safety data and non-safety data. For safety data, the network communication stack sends it to the safety protocol stack. For non-safety data, the network communication stack parses it into non-safety instructions.
  • the second processor is used to configure the initialization information of the network protocol stack, collect the status information and fault information of each submodule of the second safety control mechanism 1004, and output non-safety instructions, such as reset instructions.
  • the safety protocol stack and the second safety input and output interface are used to parse the safety data in the CIP safety preset safety communication protocol format and perform safety output, such as system emergency stop instructions.
  • the input signal of the network communication stack is to receive the Ethernet/IP protocol data packet in the form of a network port, and the output signal is to interact with the actuator in the form of Ethernet/IP protocol and CAN bus protocol to transmit status information such as initialization, fault information and reset instructions, and transmit the safety data packet to the safety protocol stack.
  • the safety protocol stack outputs the parsed safety instruction signal in the form of input and output quantities through the second safety input and output interface.
  • the actuator 1006 may include a delay component, a motion controller, a safety drive, a motor, and a data encoder; the input is the safety instruction parsed by the second safety control mechanism 1004; and the output is the action of the actuator 1006 according to the instruction.
  • the actuator 1006 is used to act according to the instruction.
  • the mobile controller receives the emergency stop instruction transmitted by the second safety control mechanism 1004, obtains the current moving speed of the mobile device, predicts the motor deceleration information according to the current moving speed, and sends the motor deceleration information to the safety driver;
  • the safety driver includes a left safety driver and a right safety driver, and according to the motor deceleration information, drives the left motor and the right motor to decelerate according to the motor deceleration information;
  • the delay component receives the emergency stop instruction transmitted by the second safety control mechanism 1004 at the same time, and sends a power-off instruction to the safety driver when the preset delay time is reached;
  • the left safety driver and the right safety driver drive the left motor and the right motor to power off and brake according to the power-off instruction;
  • the speed encoder obtains the current speed of the left motor and the right motor, and feeds back the current speed to the mobile controller, and the mobile controller generates an alarm message when the current speed does not
  • the motor When the reset command is received, the motor will be powered on and the brake will be released, waiting for new commands from the control platform.
  • the received wireless signal will be directly transmitted To the mobile controller for parsing, which is different from the emergency stop command transmission link.
  • the reset command is transmitted from the network protocol stack to the second processor in the second safety control mechanism 1004, and then forwarded to the mobile controller.
  • the mobile controller sends a motor power-on and brake release command to the safety driver, and then the motor is reset.
  • the mobile device Before receiving the dispatch instruction, the mobile device will remain stationary and wait.
  • the second safety control mechanism 1004 outputs the emergency stop command in the form of input and output quantities through the second safety input and output interface, and outputs the reset signal in the CAN bus protocol.
  • the mobile device stops, the motor is powered off and the brake is applied as the final system emergency stop response.
  • the actuator 1006 may include a safety controller, a motion controller, a safety drive, a motor, and a data encoder.
  • the safety controller receives the parsing result of the emergency stop command, and forwards the parsing result to the mobile controller; the mobile controller receives the emergency stop command, and obtains the current moving speed of the mobile device, predicts the motor deceleration information according to the current moving speed, and sends the motor deceleration information to the safety driver left and the safety driver right; the safety driver left and the safety driver right drive the motor left and the motor right to decelerate according to the motor deceleration information; the data encoder obtains the current speed of the motor, and feeds the current speed back to the safety controller; the safety controller monitors the motor deceleration information, and identifies whether the motor left and the motor right have deceleration abnormalities according to the current speed, and if so, sends a power-off command to the safety driver left and the safety driver right; the safety driver left and the safety driver right drive the motor left and the motor right to power off and brake according to the power-off command.
  • the mobile device After receiving the reset command, the mobile device jumps out of the system emergency stop state and enters the normal state. If the motor is braked at this time, the mobile device will release the brake, remain stationary and wait for the system scheduling command from the control platform.
  • the system scheduling command link from the control platform to the mobile device does not pass through the second safety control mechanism 1004.
  • the received wireless signal is directly transmitted to the mobile controller for parsing, and is not the same as the emergency stop command transmission link.
  • the reset command is sent from the network protocol stack to the second processor of the second safety control mechanism 1004, then forwarded to the safety controller, and then forwarded to the mobile controller.
  • the mobile controller sends a reset command to the safety drive, and the motor is reset. Before receiving the scheduling command, the mobile device will remain stationary.
  • the second safety control mechanism 1004 outputs the reset command and the emergency stop command in the form of ordinary input and output interface and safety input and output interface quantities, respectively, and the stop of the mobile device is the final system emergency stop response.

Landscapes

  • Engineering & Computer Science (AREA)
  • Human Computer Interaction (AREA)
  • Manufacturing & Machinery (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Control Of Position, Course, Altitude, Or Attitude Of Moving Bodies (AREA)

Abstract

一种运动控制系统及方法，其中运动控制系统包括：控制平台（102）和至少一个移动设备（104），控制平台（102）与每个移动设备（104）之间通过至少两条通信链路通信；控制平台（102），被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路（103），将急停指令传输至移动设备（104），第一通信链路（103）为至少两条通信链路中预设安全通信协议的通信链路；移动设备（104），被配置为通过第一通信链路（103）接收急停指令，利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。通过在控制平台（102）与移动设备（104）之间设置至少两条通信链路，用符合预设安全通信协议的第一通信链路（103）传输急停指令，降低了急停指令传输至移动设备（104）时出现传输失败的发生几率，提高了急停指令传输的安全性。

Description

运动控制系统及方法
本发明要求于2022年11月8日提交中国专利局、申请号为202211392751.3、发明名称为“运动控制系统及方法”的中国专利申请的优先权，其全部内容通过引用结合在本发明中。
技术领域
本发明涉及移动设备控制技术领域，特别涉及一种运动控制系统。本发明同时涉及一种运动控制方法。
背景技术
随着移动设备技术的发展，越来越多的移动设备在货运、仓储、物流、餐饮等产业服务中得到广泛应用，极大方便了人类的生产生活。
在移动设备工作场景中，对移动设备进行控制时，通过向移动设备传输对应的控制信号，以使移动设备按照该控制信号进行运动，但是在控制信号传输的通道出现故障或者存在安全隐患(控制信号有被篡改的风险)时，无法通过传输控制信号对移动设备进行管理，可能会造成机器人失控的风险，因此，亟需一种安全的运动控制的方法。
发明内容
有鉴于此，本发明实施例提供了一种运动控制系统，以解决现有技术中存在的技术缺陷。本发明实施例同时提供了一种运动控制方法。
根据本发明实施例的第一方面，提供了一种运动控制系统，运动控制系统包括：控制平台和至少一个移动设备，其中，控制平台与每个移动设备之间通过至少两条通信链路通信；
控制平台，被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将急停指令传输至移动设备，其中，急停指令符合预设安全通信协议，第一通信链路为至少两条通信链路中预设安全通信协议的通信链路；
移动设备，被配置为通过第一通信链路接收急停指令，利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。
根据本发明实施例的第二方面，提供了一种运动控制方法，应用于运动控制系统，运动控制系统包括：控制平台和至少一个移动设备，其中，控制平台与每个移动设备之间通过至少两条通信链路通信；运动控制方法包括：
控制平台在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将急停指令传输至移动设备，其中，急停指令符合预设安全通信协议，第一通信链路为至少两条通信链路中预设安全通信协议的通信链路；
移动设备通过第一通信链路接收急停指令，利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。
根据本发明实施例的第三方面，提供了一种运动控制方法，应用于控制平台，运动控制方法包括：
在检测到安全事件被触发的情况下，生成急停指令；
通过第一通信链路，将急停指令传输至移动设备，其中，急停指令符合预设安全通信协议，第一通信链路为控制平台与移动设备之间至少两条通信链路中预设安全通信协议的通信链路。
根据本发明实施例的第四方面，提供了一种运动控制方法，应用于移动设备，运动控制方法包括：
通过第一通信链路接收控制平台传输的急停指令，其中，第一通信链路为控制平台与移动设备之间至少两条通信链路中预设安全通信协议的通信链路，急停指令符合预设安全通信协议；
利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。
本发明提供的运动控制系统包括：控制平台和至少一个移动设备，控制平台与每个移动设备之间通过至少两条通信链路通信；控制平台，被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将急停指令传输至移动设备，第一通信链路为至少两条通信链路中预设安全通信协议的通信链路；移动设备，被配置为通过第一通信链路接收急停指令，利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。通过在控制平台与移动设备之间设置至少两条通信链路，在控制平台检测到安全事件被触发的情况下，生成符合预设安全通信协议的急停指令，使得该急停指令可以通过预设安全通信协议的第一通信链路进行传输，传输至移动设备，移动设备在接收到第一通信链路传输的急停指令后，对该急停指令进行解析，并基于解析结果执行停机操作，也即为急停指令设定第一通信链路，与其他的通信信号采用不同的通信链路进行传输，并且通过预设安全通信协议对急停指令的传输进行保护，降低了在急停指令传输至移动设备时出现传输失败或错误的发生几率，提高了急停指令传输的安全性。
附图说明
被结合在说明书中并构成说明书的一部分的附图示出了本公开的实施例，并且连同其说明一起用于解释本公开的原理。
图1是本发明一实施例提供的一种运动控制系统的结构示意图；
图2是本发明一实施例提供的一种运动控制系统架构下的交互流程图；
图3是本发明一实施例提供的一种运动控制系统中执行机构的结构示意图；
图4是本发明一实施例提供的一种运动控制系统的详细的结构示意图；
图5是本发明一实施例提供的一种图4中电路14的结构示意图；
图6是本发明一实施例提供的一种图5的细化的结构示意图；
图7是本发明一实施例提供的一种运动控制方法的方法流程图；
图8是本发明一实施例提供的一种运动控制系统架构下的执行机构交互流程图；
图9是本发明一实施例提供的另一种运动控制系统架构下的执行机构交互流程图；
图10是本发明一实施例提供的一种运动控制系统的数据流图；
图11是本发明一实施例提供的另一种运动控制系统的数据流图；
图12是本发明一实施例提供的一种运动控制方法的交互流程图；
图13是本发明一实施例提供的一种应用于控制平台的运动控制方法的流程图；
图14是本发明一实施例提供的一种应用于移动设备的运动控制方法的流程图；
图15是本发明一实施例提供的一种控制平台的结构框图；
图16是本发明一实施例提供的一种移动设备的结构框图。
具体实施方式
在下面的描述中阐述了很多具体细节以便于充分理解本发明。但是本发明能够以很多不同于在此描述的其它方式来实施，本领域技术人员可以在不违背本发明内涵的情况下做类似推广，因此本发明不受下面公开的具体实施的限制。
在本发明一个或多个实施例中使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本发明一个或多个实施例。在本发明一个或多个实施例和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本发明一个或多个实施例中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本发明一个或多个实施例中可能采用术语第一、第二等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本发明一个或多个实施例范围的情况下，第一也可以被称为第二，类似地，第二也可以被称为第一。
首先，对本发明一个或多个实施例涉及的名词术语进行解释。
ISO 3691-4：目前唯一的工业无人驾驶车辆国际标准。
三种停止类别：停止类别0为通过立即切断供给机器设备的电源来实现停止，也就是停止不受控制；停止类别1为受控制的停止，供给机器设备执行机构的电源一直保持，以使机器设备逐渐停止下来。只有当机器设备完全停止后电源才被切断；停止类别2为受控制的停止，供给机器设备驱动装置的电源一直保持。
网段(network segment)一般指一个计算机网络中使用同一物理层设备能够直接通讯的那一部分。
透传：即透明传输(pass-through)，指的是在通讯中不管传输的业务内容如何，只负责将传输的内容由源地址传输到目的地址，而不对业务数据内容做任何改变。
系统软件：是指控制和协调计算机及外部设备，支持应用软件开发和运行的系统，是无需用户干预的各种程序的集合，主要功能是调度、监控和维护计算机系统。
自动导航车(AGV，Automated Guided Vehicle)：又名无人搬运车，其显著的特点是无人驾驶，AGV上装备有自动导向系统，可以保障系统在不需要人工引航的情况下就能够沿预定的路线自动行驶，将货物或物料自动从起始点运送到目的地。
无线(WIFI，Wireless Fidelity)：又名移动热点，代表无线保真度，通常只是以缩写的形式出现。
光栅：由大量等宽等间距的平行狭缝构成的光学器件。
互联网协议(IP，Internet Protocol Address)地址：又名网际协议地址，是IP协议提供的一种统一的地址格式，IP协议是为计算机网络相互连接进行通信而设计的协议。
CIP Safety协议：是通用工业协议(CIP，Common Industrial Protocol)标准功能的扩展，可用于功能安全应用，它通过添加CIP安全应用层功能来扩展模型，用于确保安全系统在正常通信或错误发生时，在已知的时间内以正确的行为或者选择一个预先确定的安全状态来响应。
Profisafe协议：是一种故障安全协议，使标准现场总线技术和故障安全技术合为一个系统，即故障安全通信和标准通信在同一根电缆上共存，安全通信不通过冗余电缆来实现。
PCIE(Peripheral Component Interface Extend)总线：是一个树状形的接口总线，其主要为中央处理器(CPU，Central Processing Unit)提供访问外围设备的总线接口。
EtherNet/IP：是一个现代化的标准协议，是为了在以太网中使用CIP协议而进行数据封装。
控制器局域网总线(CAN，Controller Area Network)：是一种用于实时应用的串行通讯协议总线，是世界上应用最广泛的现场总线之一。
在现有AGV的应用场景中，在系统端和场地内多台AGV之前，通过同一条无线链路传输AGV调度指令和系统急停指令，在这种通信架构下，AGV调度指令和系统急停指令通过数据链路层进行交互，缺乏附加安全措施的保护，即系统急停指令同AGV调度指令存在同样的出错概率，这带来了系统急停 功能无法可靠实现的问题，不能达到相关安全标准中对于急停所需安全等级的要求。
进一步，多台AGV在系统调度下做高速运行，当有异常情况发生时，服务器端接到请求，通过软件控制下发系统急停的指令，以无线的方式将系统急停指令下达到场地内每台AGV，收到指令的AGV立即停止。这种急停指令的传输方式使急停指令缺乏安全通信层的保护，存在指令被篡改、损坏等可能性，导致AGV没有收到正确的急停指令，导致AGV无法及时停止，造成风险。
为了解决上述技术问题，本发明提供的运动控制系统包括：控制平台和至少一个移动设备，控制平台与每个移动设备之间通过至少两条通信链路通信；控制平台，被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将急停指令传输至移动设备，第一通信链路为至少两条通信链路中预设安全通信协议的通信链路；移动设备，被配置为通过第一通信链路接收急停指令，利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。通过在控制平台与移动设备之间设置至少两条通信链路，在控制平台检测到安全事件被触发的情况下，生成符合预设安全通信协议的急停指令，使得该急停指令可以通过预设安全通信协议的第一通信链路进行传输，传输至移动设备，移动设备在接收到第一通信链路传输的急停指令后，对该急停指令进行解析，并基于解析结果执行停机操作，也即为急停指令设定第一通信链路，与其他的通信信号采用不同的通信链路进行传输，并且通过预设安全通信协议对急停指令的传输进行保护，降低了在急停指令传输至移动设备时出现传输失败或错误的发生几率，提高了急停指令传输的安全性。进一步使得本发明提供的急停指令的安全传输方式可以符合相关安全标准，且在要求的可接受范围内，也即，使传输急停指令的第一通信链路可以达到无人驾驶工业车辆领域ISO 3691-4标准规定的安全等级要求。
在本发明中，提供了一种运动控制系统。本发明同时涉及一种运动控制方法，在下面的实施例中逐一进行详细说明。
参见图1，图1示出了根据本发明一个实施例提供的一种运动控制系统的结构示意图，运动控制系统包括控制平台102和至少一个移动设备104，以一个移动设备104为例，控制平台102与移动设备104之间通过至少两条通信链路通信，第一通信链路103，具体如下：
控制平台102：被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路103，将所述急停指令传输至所述移动设备104，其中，所述急停指令符合预设安全通信协议，所述第一通信链路103为所述至少两条通信链路中所述预设安全通信协议的通信链路；
所述移动设备104，被配置为通过所述第一通信链路103接收所述急停指令，利用所述预设安全通信协议对所述急停指令进行解析，基于解析结果执行停机操作。
具体地，控制平台是指对多个移动设备进行控制的平台，比如，在仓储管理场景下，存在一个AGV工作区域，里面可以有多个AGV，在AGV工作区域外面设置有控制平台，对AGV进行监控、控制，该控制平台可以是由至少一台实体硬件组成，其进行控制包括但不限于控制移动、控制搬运、控制减速、控制停机等，通过对移动设备进行控制，可以实现移动设备的调度与停止，例如，控制平台可以包括生成调度指令的服务器(调度指令具体是由服务器上的软件生成)，还可以包括生成急停指令的安全控制器(急停指令具体是安全控制器对安全事件的触发响应生成)。相应的，移动设备是指可以依据控制平台的指令进行自主移动或停止的设备，比如移动设备可以是机器人、AGV小车等，自主移动设备通过控制平台的指令进行对应的处理，可实现控制平台对机器人设备的控制。
相应地，安全事件是指设备安全运行所需的条件，比如安全事件被触发可以是在移动设备区域的急停按钮被按下、光栅检测到被遮挡或者安全门锁被打开等等，而这些事件被触发后，使得对应工作区域的移动设备需要做出相应的处理，即急停操作。在检测到安全事件被触发时，控制平台就会产生急停指令，并将急停指令传输至移动设备端，由移动设备进行对应的急停处理，也即通过对安全事件是否被触发的检测，使得在安全事件被触发的情况下可以迅速做出相对应的处理，以防止未生成与安全事件对应的处理流程。急停指令是指包含令移动设备进行急停的信息的指令，通过急停指令，可以使移动设备在任意状态下都可以进行急停操作，直至停止。
进一步地，通信链路是指在两个节点之间的信号传输通道，通信链路可以是无线通信链路也可以是有线通信链路。在运动控制系统中，控制平台与移动设备之间至少存在两条通信链路，其中第一通信链路是预设安全通信协议的链路，该第一通信链路被预设安全通信协议所保护，使得在符合预设安全通信协议的急停指令在通过第一通信链路进行传输时，可以被预设安全通信协议所保护，且与其他的指令用不同的通信链路进行传输，比如，调度指令可以是使用与第一通信链路不同的第二通信链路进行传输。预设安全通信协议是指预先设置的对第一通信链路进行保护的安全通信协议，通过在第一通信链路中加入预设安全通信协议，使得在将急停指令由控制平台传输至移动平台时，在使用第一通信链路的同时，进一步起到了保护的作用，避免了在与其他指令共用同一条通信链路时，由于其他指令出现状况时导致的急停指令也无法传输的问题。
可选地，预设安全通信协议通常为CIP safety协议或者Profisafe协议等其他安全通信协议。
基于此，在控制平台检测到安全事件被触发时，迅速反应生成符合预设安全通信协议的急停指令，以使该急停指令可以通过预设安全通信协议的第一通信链路，之后控制平台通过第一通信链路将该急停指令传输至移动设备；该移动设备通过第一通信链路接收该急停指令，并由于该急停指令生成时是需要 符合预设安全通信协议的，故在移动设备需要依据该指令进行对应的处理时，预先对其进行解析，得到解析结果，再基于该解析结果执行相应的停机操作，该停机操作可以是使移动设备执行减速停止操作，也可以是使移动设备执行关机操作。
参见图2，图2示出了根据本发明一实施例提供的一种运动控制系统架构下的交互流程图。
本发明一种可选的实施例中，控制平台包括安全触发机构202和第一安全控制机构204；
所述安全触发机构202，被配置为在识别到符合安全触发条件的事件发生时，生成安全事件触发信号发送至所述第一安全控制机构204；
所述第一安全控制机构204，被配置为接收所述安全触发机构202发送的所述安全事件触发信号，利用所述预设安全通信协议对所述安全事件触发信号进行编码得到急停指令，通过第一通信链路，将所述急停指令传输至所述移动设备。
具体地，安全触发机构202是指通过触发产生安全事件的机构，比如触发可以是指点击急停按钮、打开安全门等等，安全触发机构202可以是急停按钮、安全门、光栅等等，通过安全触发机构202对安全事件进行触发，后续依据安全事件控制平台和移动设备进行处理。
可选地，在安全事件被通过安全触发机构202触发之前，可以是安全触发机构202持续稳定输出一个信号，在被触发时，输出信号消失或产生突变；还可以是安全触发机构202未输出信号，在被触发时，突然产生输出信号。
可选地，安全触发机构202的触发可以是有多种方式，一种可能的实现方式中，安全触发机构202是急停按钮，急停按钮使用的是双回路脉冲，即由两个电源对急停按钮提供输入与输出，具体可以是在操作人员通过按下急停按钮之前，急停按钮由回路1供电提供的是低脉冲，输出的是低电平，在急停按钮被按下时，由回路2为急停按钮提供电流，提供高脉冲输出高电平；另一种可能的实现方式中，安全触发机构202可以是安全门或光栅，安全门和光栅使用的均是输出信号切换装置(OSSD，Output Signal Switch Device)信号，在安全门被打开或光栅被遮挡住之前，输出信号切换装置时处于关闭状态，即安全门与光栅不输出信号，在安全门被打开或光栅被遮挡后，输出信号突变为高电平或低电平信号。
具体地，第一安全控制机构204是指在控制平台对移动设备进行控制中主要的控制机构，用于对移动设备的移动和停止进行控制，其用于在自身或者与它相连的设备出现故障或产生突变信号时，及时进行响应，比如，在检测到安全触发机构202被触发，产生安全事件时生成急停指令，并将急停指令传输至移动设备端，避免在设备出现故障或突变时，无法进行及时处理。具体参见图2，安全事件触发信号是指安全触发机构202被触发时产生的信号，比如可以是急停按钮被按下、光栅被遮挡、安全门被打开激活等等。
利用预设安全通信协议对安全事件触发信号进行编码可以是第一安全控制机构204中的逻辑编程对该安全事件触发信号进行编码，得到符合CIP safety协议安全格式的急停指令。
可选地，具体参见图2，第一安全控制机构204可以是包括第一安全输入输出接口、第一安全处理器和安全网络模块，其中第一安全输入输出接口，用于接收安全触发机构202生成的安全事件触发信号，并将接收到的安全事件触发信号提供给第一安全处理器进行处理；其中第一安全处理器，通过逻辑编程的响应，利用预设安全通信协议，将该安全事件触发信号编码为符合CIP safety协议安全格式的急停指令，并且在对该安全事件触发信号进行编码之前，还需要对该信号进行校验，比如冗余检测，将重复的或者错误的触发信号进行删除或提取、数据完整性校验，接收到触发信号中显示，急停按钮仅被按下一半，通过对按压的事件进行检验，确定是否真实触发生成安全事件、超时检测，对安全事件触发信号从安全触发机构202到第一控制执行机构的传输时间是否超时，比如可以是预先设置时间阈值为0.01秒，将检测到的时间与预设时间阈值进行比对，判断是否超时、连接授权检测，可以是检测需要控制的移动设备是否是与该控制平台相连接，若检测结果为已授权，则继续后续处理；其中安全网络模块，通过网络端口的形式发送相应的指令，即急停指令或复位指令。
应用本发明实施例的方案，控制平台包括安全触发机构202与第一安全控制机构204，通过安全触发机构202对安全事件进行触发与否，在触发的情况下，由第一安全控制机构204对该生成的安全事件进行编码，生成急停指令，使得在控制平台端对安全事件进行触发时，控制平台就会直接将该安全事件对应的安全事件触发信号进行处理，生成移动设备可以直接根据此进行处理的指令，提高了对安全事件被触发的响应效率，进一步提高了对急停指令的传输效率。
本发明一种可选的实施例中，控制平台包括无线发送器206；
所述无线发送器206，被配置为将所述急停指令转发至目的端口，通过所述目的端口将所述急停指令转换为无线信号传输至所述移动设备，其中，所述目的端口为所述控制平台与所述移动设备通过所述第一通信链路进行数据传输的端口。
具体地，无线发送器206用于对无线信号进行传输，也即将接收到的急停指令转换为无线信号形式，然后进行发送。具体参见图2，无线发送器206可以包括交换器、无线控制器和无线接入点，其中交换器用于接收急停指令，并将急停指令转发至无线控制器和无线接入点，由无线控制器和无线接入点对该急停指令进行处理，得到无线信号形式的急停指令，并将该无线信号通过第一通信链路传输至移动设备。目的端口是指控制平台与移动设备通过第一通信链路进行数据传输的端口。
应用本发明实施例的方案，利用无线发送器将急停指令转换为无线发送器可以传输的无线信号形式，以使该急停指令可以通过无线的方式通过第一通信链路，从控制平台传输至移动设备，通过无线传输方式提高了传输的效率，且是通过第一通信链路进行传输的，对无线方式的传输提供了保障，进一步提高了传输急停指令的安全性。
本发明一种可选的实施例中，控制平台还包括网络地址转换设备；
所述无线发送器，进一步被配置为将所述急停指令发送至所述网络地址转换设备；
所述网络地址转换设备，被配置为对所述急停指令进行地址转换，并将地址转换后的所述急停指令转发至所述目的端口，通过所述目的端口将地址转换后的所述急停指令以无线信号的形式传输至所述移动设备。
具体地，网络地址转换(NAT，Network Address Translation)设备是一种虚拟的网络地址转换器，对跨网段通信进行内部转地址处理，也即将无线发送器发送的数据的网络地址转换为目标网络地址，该目标网络地址符合移动设备对应的网络地址，得到符合移动设备的目标网络地址的数据。
示例性地，在跨网段的场景中，控制平台包括无线发送器和网络地址转换设备，控制平台与移动设备进行无线信号传输，其中，移动设备与无线发送器分属于不同的网段，无线发送器的IP地址属于第一网段、移动设备的IP地址属于第二网段，则需要利用网络地址转换设备，将无线发送器发送的信号由第一网段的IP地址转换为对应的第二网段的IP地址，完成信号跨网段的转换与发送，使得属于不同网段的控制平台和移动设备之间通过网络地址转换设备实现信号的传输。
应用本发明实施例的方案，控制平台还包括网络地址转换设备，通过网络地址转换设备，使得在控制平台与移动设备所属网段不同时，可以通过网络地址转换设备实现两端之间信号的传送，以便于后续移动设备基于接收到的指令进行相应的处理。
本发明一种可选的实施例中，移动设备包括无线接收器；
所述无线接收器，被配置为通过所述第一通信链路接收所述无线信号，将所述无线信号转发为以太网端口格式的急停指令。
具体地，参见图2，无线接收器208用于对无线信号进行接收，并将接收到的无线信号转换为以太网格式的急停指令，无线接收器208可以包括无线接收模块、无线接收处理器、转发模块；其中无线接收模块用于对从控制平台的无线发送器206中发送的无线信号进行接收并转发给无线接收处理器，转发给无线接收处理器的方式可以是通过PCIE总线进行转发；其中无线接收处理器用于对接收到的无线信号透传给转发模块，由转发模块进行处理；其中转发模块用于对接收到的无线信号进行转换，转换为以太网端口格式，进行输出。
应用本发明实施例的方案，移动设备的无线接收器通过将接收到的无线信号进行转换，转换为以太网端口格式的急停指令，并进行转发，也即移动设备在初接收到无线信号时，先将其进行转换，转换为移动设备端进行执行时可以识别的格式的信号，便于后续基于以太网格式的急停指令执行停机操作。
本发明一种可选的实施例中，移动设备包括第二安全控制机构210和执行机构212；
所述第二安全控制机构210，被配置为利用所述预设安全通信协议对所述急停指令进行解析，得到解析结果，将所述解析结果发送至所述执行机构212；
所述执行机构212，被配置为基于所述解析结果执行停机操作。
具体地，第二安全控制机构210是指移动设备中基于控制平台的指令对移动设备进行控制执行的机构，具体是对从控制平台接收到的指令，利用预设安全通信协议对该指令进行解析，并将解析得到的结果进行输出，比如在基于控制平台的急停指令进行处理时，可以是由第二安全控制机构210对急停指令进行解析，得到解析结果，以便于该移动设备可以基于该解析结果执行停机操作。执行机构212是指在移动设备中，依据指令对移动设备进行执行的机构，比如在接收到急停指令时，基于该急停指令，执行停机操作或减速停止工作；在接收到调度指令时，基于该调度指令，执行对应的操作。
可选地，具体参见图2，第二安全控制机构210可以包括网络通信栈、第二处理器、安全协议栈和第二安全输入输出接口；其中网络通信栈是一个Ethernet/IP通信栈模块，接收到控制指令，并对接收到的控制指令进行过滤识别，识别到该控制指令为从第一通信链路接收的安全指令，则认为其为急停指令，将该急停指令转发至安全协议栈，安全协议栈通过预设安全通信协议对符合预设安全通信协议的急停指令进行解析，得到解析结果，然后通过第二安全输入输出接口将解析结果以输入输出量形式进行安全输出。第二处理器用于配置网络通信栈的初始化信息，并采集第二安全控制机构210中包含的内部模块的状态信息和故障信息，同时输出第二安全控制机构210内部的各个模块的初始状态信息、故障信息等。
应用本发明实施例的方案，移动设备包括第二安全控制机构210和执行机构212，在第二安全机构接收到急停指令时，进行处理，确定该急停指令为安全指令，并将该安全指令转发至执行机构212，由执行机构212根据该急停指令进行对应的处理，实现了对急停指令的进一步确定，进而执行，也即提高了急停指令传输的正确率。
本发明一种可选的实施例中，所述执行机构212包括：延迟组件、移动控制器、安全驱动器、电机和速度编码器；
所述移动控制器，被配置为响应于所述急停指令的解析结果，获得所述移动设备的当前移动速度， 根据所述当前移动速度预测电机减速信息，并将所述电机减速信息发送至所述安全驱动器；
所述安全驱动器，被配置为驱动所述电机按照所述电机减速信息减速；
所述延迟组件，被配置为响应于所述急停指令的解析结果，在达到预设延迟时间的情况下，向所述安全驱动器发送断电指令；
所述安全驱动器，还被配置为根据所述断电指令驱动所述电机断电并抱闸；
所述速度编码器，被配置为获取所述电机的当前转速，并将所述当前转速反馈至所述移动控制器；
所述移动控制器，还被配置为在所述当前转速与预设转速不匹配的情况下，产生报警信息。
具体地，移动控制器是指对移动设备的执行机构212进行控制的控制器，用于响应于该急停指令的解析结果，并获得该移动设备的当前移动速度，基于该解析结果和当前移动速度，预测电机减速信息；电机减速信息可以是基于解析结果使得执行机构212执行急停操作，进而根据当前速度预测出不伤害该移动设备的电机减速信息。电机减速信息是指预测得到的给移动设备进行减速的加速度信息或电机的转速。安全驱动器是指移动设备中基于移动控制器的指令，对移动设备的电机进行驱动的设备，也即用于驱动电机按照电机减速信息进行减速，使得该移动设备减速停止。延迟组件是指对电机的延迟停机进行控制的设备，比如可以是预先为延迟组件设置延迟时间，在到达预设延迟时间时，延迟组件向电机发送断电指令，其中，延迟时间通常根据拨码开关调节阻值来设定，由硬件电路完成，默认为2秒，可根据每个项目不同的地面条件和速度要求进行调整，所述断电指令可以是使得电机断电、停机、抱闸等。
进一步地，根据延迟组件，在达到预设延迟时间的情况下，安全驱动器还相应于延迟组件发送的断电指令，驱动电机断电抱闸。速度编码器是指电机基于安全驱动器进行断电抱闸时，在对该电机进行减速直至停止的过程中，获取电机的实时转速，电机进行断电并抱闸是需要经过减速、停止、停机、抱闸一系列进行处理的；之后移动控制器，还被配置为基于该实时获取到的当前转速与预设转速进行匹配，若不匹配时，产生报警信息，比如，在电机开始减速的第三秒，预设转速为3，当前转速为2.8，则确定不匹配，产生报警信息。
应用本发明实施例的方案，执行机构中包括延迟组件、移动控制器、安全驱动器、电机和速度编码器，通过移动控制器预测电机的减速信息，并通过速度编码器对电机的当前转速进行获取，确定与预设电机转速是否匹配，进而决定是否产生报警信息；延迟组件又通过预设延迟时间，在到达预设延迟时间时，无论电机是否已经减速停止至速度为零，均会通过安全驱动器驱动电机进行断电抱闸，避免移动设备在接收到急停指令后，未在预设的时间内执行停机操作造成更大的损失。
本发明一种可选的实施例中，所述执行机构212还包括：信号转换器；
所述信号转换器，被配置为将所述急停指令的解析结果转换为符合目标安全性能等级的初始安全信号，将所述初始安全信号输出至所述延迟组件，其中，所述目标安全性能等级为所述移动设备的安全性能等级；
所述延迟组件，进一步被配置为基于所述初始安全信号，在达到预设延迟时间的情况下，向所述安全驱动器发送断电指令。
机械设备在投入使用之前，可以按照机械安全标准进行设备风险评估，以确定机械设备的风险等级及所对应的性能等级(Performance Level，PL)，之后，可以在机械设备中部署相匹配性能等级的安全部件。例如，自主移动机器人(Autonomous Mobile Robot，AMR)这一可自动移动的移动设备(本发明下文简称为“移动设备”)被广泛应用于各个领域，例如智能仓储领域。移动设备的控制中包括安全停止(stop)控制。移动设备的stop分为以下三类：stop类型0：直接断电并机械抱闸；stop类型1：电子制动机器停止下来(过程有速度监控)，然后断电并机械抱闸；stop类型2：电子制动机器停止下来，速度零静止监控，如果超过阈值，断电并机械抱闸。
针对stop类型1，移动设备端通过部署安全驱动器等对移动设备进行安全保护控制。但，在移动设备端部署安全驱动器成本较高。而且，移动设备的性能等级例如是第一等级，而安全驱动器等控制部件的性能等级例如是第二等级，导致对移动设备的安全保护效果存在影响。
按照机械安全标准对设备进行风险评估，可以是指评估移动设备的平均每小时危险失效概率。一般的，按照风险评估的结果，对应划分五个性能等级(PL)，该五个PL从低到高包括PLa、PLb、PLc、PLd和PLe，其中，PLa为该五个PL中最低的等级，平均每小时危险失效概率相对最大，安全性也相对最差。PLe为该五个PL中最高的等级，平均每小时危险失效概率相对最小，安全性也相对最好。
例如，一种智能仓储场景中使用的移动设备，该类移动设备的PL例如是PLd等级。在使用过程中，可以结合场景的需求对移动设备的行为进行控制，如控制移动设备停止，相应控制器件应当是PLd等级的安全控制器件。一些实施例中，控制器件部署在移动设备中，而符合一定PL的控制机构包括安全驱动器和安全激光雷达等，或者安全驱动器和速度编码器等。这样，不仅拉高了控制部件的成本，而且安全驱动器和速度编码器组成的控制机构，PL为PLe等级，高于移动设备的PLd等级，造成了一定的资源浪费。
本发明实施例对应的stop类型为stop类型1，stop类型1的控制过程包括：在预设延时时间内，通过移动设备的延迟组件发送断电指令到安全驱动器，实现电子制动移动设备到速度为0，延时时间到达后，给安全驱动器输出安全转矩关断(Safe Torque Off，STO)信号，安全转矩关断(即马达断电)加机 械抱闸制动。
以下结合附图3至8，对本发明实施例的执行机构212进行示例性描述。
如图3所示，本发明实施例的一种示例性中，执行机构212，可以包括：信号转换器10、延迟组件(delay circuit)11、模式选择组件12、监测电路13。信号转换器10是目标安全性能等级的电路，目标安全性能等级是移动设备的安全性能等级。这里涉及的移动设备是该执行机构212所控制的移动设备。如图3所示，本发明实施例的一种示例性执行机构212，可以包括：信号转换器10、延迟组件(delay circuit)11、模式选择组件12、监测电路13。
信号转换器10，被配置为将急停指令的解析结果转换为符合目标安全性能等级的初始安全信号，将初始安全信号输出至延迟组件11，其中，目标安全性能等级为移动设备的安全性能等级。信号转换器10是目标安全性能等级的电路。
延迟组件11，进一步被配置为基于初始安全信号，在达到预设延迟时间的情况下，向安全驱动器发送断电指令。
监测电路13，用于在监测到信号转换器10输出的初始保护停止信号的第一电平信号的情况下，将监测结果传送给移动设备控制器，以使移动设备控制器触发运动控制部件控制移动设备实现安全停止。监测电路13，还可以用于监测模式选择信号和急停开关信号。
一些实施例中，输入到信号转换器10的信号可以来自于移动设备的控制平台。
示例性的，目标安全性能等级例如是PLd等级。相应的，信号转换器10例如可以实现为PLd安全IO模块(PLd安全IO模块)。初始安全信号是符合PLd等级的安全信号。
本技术场景中，移动设备从响应控制指令至达到控制指令对应的目标状态，移动设备需要一定的执行时间。示例性的，以控制移动设备安全停止为例，移动设备从响应保护停止信号至减速到0，需要一定的执行时间。一些实施例中，预设延时时长可以依据移动设备的运动性能，通过拨码开关人工设置。预设延时时长例如为9s。
本实例中，低电平信号触发保护停止控制，延迟组件11可以用于对DO信号中的高电平信号直接输出，以触发移动设备开始执行停止操作。在接收到DO信号中的低电平信号后，延迟组件11并不将低电平信号输出，而是持续输出高电平信号，以达到预设延时时长(例如是9s)，本发明实施例将该过程称为对低电平信号的延时。在延时达到9s后，延迟组件11可以输出低电平信号。
可见，采用本发明实施例中，使用满足目标安全性能等级的电路元器件形成的执行机构212，代替现有技术中的安全控制器与其他器件组成的安全控制组件，能够为移动设备提供相匹配性能等级(即目标性能等级)的控制，且能够降低成本。
本发明一种可选实施例中，所述初始安全信号包括第一电平信号，其中，所述第一电平信号用于触发所述移动设备的安全停止；
所述执行机构212还包括：模式选择组件；
所述延迟组件，进一步被配置为在达到预设延迟时间的情况下，向所述模式选择组件发送所述第一电平信号；
所述模式选择组件，被配置为在根据输入的模式选择信号选择自动模式的情况下，若所述延迟组件输出所述第一电平信号，则向所述安全驱动器发送断电指令。
初始安全信号的第一电平信号用于维持移动设备的正常运行，第一电平信号用于触发对移动设备的安全停止。
模式选择组件12，用于在根据输入的模式选择信号选择自动模式的情况下，对延迟组件输出的信号、移动设备的急停开关信号和使能开关信号，进行逻辑与处理；在延迟组件输出第一电平信号或急停开关信号为第一电平信号的情况下，输出安全停止信号到移动设备的运动控制部件，以触发运动控制部件控制移动设备实现安全停止。
一些实施例中，初始安全信号包括第一电平信号。第一电平信号可以用于触发对移动设备的安全停止。
延迟组件11可以用于将第一电平信号直接传送到模式选择组件12；延迟组件11还可以用于按照预设延时时长对第一电平信号进行延时，以及将延时后的第一电平信号输出至模式选择组件12。
模式选择组件12，用于在根据输入的模式选择信号选择自动模式的情况下，对延迟组件11输出的信号、移动设备的急停开关信号和使能开关信号，进行逻辑与处理；在延迟组件11输出第一电平信号或急停开关信号为第一电平信号的情况下，输出安全停止信号到移动设备的运动控制部件，以触发运动控制部件控制移动设备实现安全停止。
此外，在根据输入的模式选择信号选择手动模式的情况下，延迟组件11到模式选择组件12的信号被旁路，只有急停开关信号为第一电平信号时，输出安全停止信号到移动设备的运动控制部件，以触发运动控制部件控制移动设备实现安全停止。
本发明一种可选实施例中，所述初始安全信号还包括第二电平信号，其中，所述第二电平信号用于维持所述移动设备的正常运行；
所述延迟组件，还被配置为将所述第二电平信号直接发送至所述模式选择组件。
一些实施例中，初始安全信号包括第二电平信号。其中，第二电平信号可以用于触发对移动设备行为的控制。实际实施场景中，初始安全信号的第一个信号可以是第二电平信号。
需要指出的是，延迟组件11在对第一电平信号进行延时期间，延迟组件11可以持续向模式选择组件12输出第二电平信号，以使运动控制部件在预设延时时长内，持续对移动设备进行控制。
本发明一种可选实施例中，所述执行机构还包括手动操作器信号接口，所述手动操作器信号接口用于接收模式选择信号；
所述模式选择组件，还被配置为响应于所述模式选择信号，将所述执行机构的控制模式切换为所述手动模式；在所述手动模式下，响应于使能开关信号，将所述执行机构的控制模式切换为所述自动模式。
本发明一种可选实施例中，所述延迟组件包括第一延迟电路和第二延迟电路；
所述信号转换器，进一步被配置为将所述初始安全信号分别输出至所述第一延迟电路和所述第二延迟电路。
参见图4，图3中示意的延迟组件11和模式选择组件12，共同组成电路14，14可以包括第一延迟电路141和第二延迟电路142。本示例中，信号转换器10可以用于将初始安全信号分别输出到第一延迟电路141和第二延迟电路142。
其中，信号转换器10输出到第一延迟电路141的初始安全信号为第一初始安全信号(例如图4中所示的DO1)。信号转换器10输出到第二延迟电路142的初始安全信号为第二初始安全信号(例如图4中所示的DO2)。
应理解，第一初始安全信号和第二初始安全信号是通过不同传输通道传输的内容相同的信号，在第一初始安全信号和第二初始安全信号传输过程中，相关部件均正常运行的情况下，第一初始安全信号和第二初始安全信号应当相同。这样，本发明实施例中，通过两个传输通道传输信号的方式，可以通过交叉验证两个通道的信号是否相同，来验证信号传输过程中是否存在安全隐患。
进一步的，移动设备的运动控制部件可以包括第一驱动电路21和第二驱动电路22。第一延迟电路141可以用于将第一初始安全信号的第二电平信号分别输出至第一驱动电路21的STO1(Safety torque off)和第二驱动电路22的STO1，以及将第一初始安全信号的第一电平信号按照预设延时时长延时后，分别输出至第一驱动电路21的STO1和第二驱动电路22的STO1。第二延迟电路142可以用于将第二初始安全信号的第二电平信号分别输出至第一驱动电路21的STO2和第二驱动电路22的STO2，以及将第二初始安全信号的第一电平信号按照预设延时时长延时后，分别输出至第一驱动电路21的STO2和第二驱动电路22的STO2。
为了便于区分，将第一延迟电路141输出的信号用DO1_delay表示；将第二延迟电路142输出的信号用DO1_delay表示。
这样一来，第一延迟电路141和第二延迟电路142中的任一出现故障，本发明实施例的执行机构，依然可以通过另一延迟组件对移动设备进行安全保护控制，有利于进一步提高安全性。
再次参见图4，一些实现方式中，移动设备的运动控制部件还可以包括移动设备控制器23、第一马达26和第二马达27。移动设备控制器23接收监测电路13(本实施例将监测电路13用作第一处理器)的监测结果，并向第一驱动电路21和第二驱动电路22发送信号。示例性的，第一驱动电路21和第二驱动电路22均可以用于响应第二电平信号，触发移动设备控制器控制移动设备进行安全停止。第一驱动电路21，还用于响应延时后的第一电平信号，触发第一马达26的安全转矩关断，并触发对第一马达26的机械抱闸制动；第二驱动电路22，还用于响应延时后的第一电平信号，触发第二马达27抱闸，并触发对第一马达27的机械抱闸制动。该过程，即为控制移动设备安全停止的过程。
示例性的，移动设备控制器23可以通过控制器局域网总线(CAN，Controller Area Network)与其他电路进行通信。例如，移动设备控制器23通过CAN与第一驱动电路21和第二驱动电路22通信，控制第一驱动电路21和第二驱动电路22。
第一延迟电路141可以与移动设备的第一路急停开关触点24连接，用于使第一延迟电路141延时后的第一电平信号，与第一路急停开关触点24触发的第一急停控制信号ES1(emergency stop)进行逻辑与运算；第二延迟电路142与移动设备的第二路急停开关触点25连接，用于使第二延迟电路142延时后的第一电平信号，与第二路急停开关触点25触发的第二急停控制信号ES2进行逻辑与运算。
由于急停控制信号和安全停止信号均用于触发移动设备停止，这样一来，有利于简化电路结构。
如图4，第一延迟电路141和第二延迟电路142还可以接收第二处理器的控制。第二处理器通过手动操作接入接口，生成手动操作器上的模式选择信号和使能开关信号。第一路模式选择信号MAN1输出到第一延迟电路141，第二路模式选择信号MAN2输出到第二延迟电路142。模式选择信号是第二电平信号(即高电平)时，切换为手动模式；在手动模式下，模式选择信号是第一电平信号(即低电平)时，切换为自动模式。自动模式下，控制延迟组件11正常传输保护停止信号；手动模式下，控制延迟组件11被旁路，只有急停开关信号和使能开关信号发挥控制作用。当急停开关信号ES1和ES2均为第二电平信号(即高电平)、使能开关的EN-NO1和EN-C1触点接通、EN-NO2和EN-C2触点接通，DO1_delay和DO2_delay输出第二电平信号(即高电平)，移动设备控制器23可以控制第一驱动21和第二驱动22，对应触发第一马达26和第二马达27运转。
可见，监测电路向移动设备控制器输出的监测结果可以实现为DO1、DO2、ES1、ES2、MAN1、MAN2中的至少一个，监测结果的具体内容，可以根据不同场景实现为不同信号。
这样一来，该执行机构212通过提供手动操作器的接入接口，可以支持两种模式的切换，从而为人员介入维修提供操作空间。
本发明一种可选实施例中，所述模式选择组件包括第一模式选择组件和第二模式选择组件；
在所述第一模式选择组件选择自动模式的情况下，所述第一延迟电路的输出与所述移动设备的第一路急停开关的输入、所述第二延迟电路的输出串联，用于使所述第一延迟电路延迟后的信号与所述第一路急停开关的信号、所述第二延迟电路延迟后的信号进行逻辑与运算，并向所述安全驱动器输出逻辑与运算后的断电指令；在所述第一模式选择组件选择手动模式的情况下，所述第一延迟电路的输出被旁路，持续向所述安全驱动器输出第二电平信号，其中，所述第二电平信号用于维持所述移动设备的正常运行；
在所述第二模式选择组件选择自动模式的情况下，所述第二延迟电路的输出与所述移动设备的第二路急停开关的输入、所述第一延迟电路的输出串联，用于使所述第二延迟电路延迟后的信号与所述第二路急停开关的信号、所述第一延迟电路延迟后的信号进行逻辑与运算，并向所述安全驱动器输出逻辑与运算后的断电指令；在所述第二模式选择组件选择手动模式的情况下，所述第二延迟电路的输出被旁路，持续向所述安全驱动器输出所述第二电平信号。
图5，图5是图4中电路14的结构示意图，包括第一电源(power1)1411和第二电源(power2)1421。其中，power11411用于为第一延迟电路1412供电；power21421用于为第二延迟电路1422供电。
本技术方案中，通过设置power11411和power21421分别为两路延迟电路供电，在任一power故障的情况下，另一power依然可以为相应延迟电路供电，以维持安全停止信号的处理和传输，从而维持对机器人的安全控制，有利于达到PLd等级。
第一延迟电路1412输出的延时保护停止信号给到第一模式选择组件1413，第一模式选择组件输出DO1_delay；第二延迟电路1422输出的延时保护停止信号给到第二模式选择组件1423，第二模式选择组件输出DO2_delay。本示例中，第一模式选择组件1413与第二模式选择组件1423，分别对所接收的信号进行逻辑与运算的过程，详见本说明书其他实施例的描述，此处不予赘述。
以下结合示例对本发明实施例的执行机构212进行介绍。
图6示意了一种执行机构212的示例性示意图。该执行机构212例如包括：PLd安全IO模块(PLd safe IO)，第一电源1411和第二电源1421，第一延迟电路1412和第二延迟电路1422，第一模式选择组件1413和第二模式选择组件1423。其中第一模式选择组件1413可以包含保护停止信号选通电路1、串联电路1、使能信号执行机构2121；第二模式选择组件1423可以包含保护停止信号选通电路2、串联电路2、使能信号执行机构2122。
应理解，图6是对执行机构212的示意性描述，对本发明实施例的执行机构212不构成限制。在另一些实施例中，本发明实施例的执行机构212还可以包括更多或更少电路模块，在其他一些实施例中，执行机构212中的部分电路模块可以拆分为两个电路模块，或者，其中的部分电路模块也可以合并为一个电路模块实现。此处不予限制。
再次参见图6，第一电源1411为第一延迟电路1412供电，第二电源1421为第二延迟电路1422供电。第一电源1411和第二电源1421例如均是5伏(V)的供电电源。第一电源1411是将24V的电源通过直流变压器(DC/DC 1)变压为5V电源，为第一延迟电路1412供电。第二电源1421是将24V的电源通过直流变压器(DC/DC 2)变压为5V的电源，为第二延迟电路1422供电。
需要指出的是，第一电源1411和第二电源1421的电路中可以均设置电源保护电路(power supply protection circuits)(图6中电源2的部分未示出)，以保护相应电源电路。
在基于通用工业协议的网络黑色通道(CIP Safety Black channel)接收到远程控制平台的信号之后，PLd安全IO模块将该信号转换为符合PLd等级的DO信号，以及向第一延迟电路1412输出DO1信号，向第二延迟电路1422输出DO2信号。其中，DO1信号和DO2电平信号相同。示例性的，DO1信号和DO2信号的第一个信号可以为高电平信号。
第一延迟电路1412在接收到DO1信号之后，可以直接经由保护停止信号选通电路1输出DO1信号的高电平信号至串联电路1。针对DO1信号的低电平信号，进行延时(即不输出)，直到延时时长达到预设时长再输出至保护停止信号选通电路1。本实施例中，将第一延迟电路1412输出信号称为OUT1，将保护停止信号选通电路1输出的信号称为DO1延时信号1(DO1_DELAY_1)。同理，第二延迟电路1422在接收到DO2信号之后，可以直接经由保护停止信号选通电路2输出DO2信号的高电平信号至串联电路2。针对DO2信号的低电平信号，进行延时(即不输出)，直到延时时长达到预设时长再输出至保护停止信号选通电路2。本实施例中，将第二延迟电路1422输出信号称为OUT2，将保护停止信号选通电路2输出的信号称为DO2延时信号1(DO2_DELAY_1)。
串联电路1中，可以将DO1_DELAY_1、DO2_DELAY_1和第一路急停开关信号ES1通过逻辑与运算进行串联，这样当该三个信号任何一个为低电平时，串联电路1输出的EN-C1为低电平，而DO1_delay(EN-NO1)为低电平，第一驱动电路和第二驱动电路均会安全停止。
相应的，串联电路2中，可以将DO2_DELAY_1、DO1_DELAY_1和第二路急停开关信号ES2通过 逻辑与运算进行串联，这样当该三个信号任何一个为低电平时，串联电路输出的EN-C2也为低电平，而DO2_delay(EN-NO2)为低电平，第一驱动电路和第二驱动电路均会安全停止。
需要指出的是，保护停止信号选通电路1受第一路模式选择信号MAN1控制，保护停止信号选通电路2受第二路模式选择信号MAN2的控制。
当手动操作器接入到机器人上时，执行机构212为手动模式(manual mode)，MAN1和MAN2可以为高电平时。此外，手动模式下，OUT1信号被旁路，保护停止信号选通电路1的输出DO1_DELAY_1一直为高电平；OUT2信号被旁路，保护停止信号选通电路2的输出DO2_DELAY_1一直为高电平。同时使能信号执行机构2121会将EN-C1和DO1_delay(EN-NO1)之间原有的连接断开，EN-C1和DO1_delay(EN-NO1)受手动操作器的使能开关的控制。当使能开关被按下，EN-C1和DO1_delay(EN-NO1)接通；当使能开关弹起断开，EN-C1和DO1_delay(EN-NO1)断开，同时使能信号执行机构2122会将EN-C2和DO2_delay(EN-NO2)之间原有的连接断开。同理，EN-C2和DO2_delay(EN-NO2)受手动操作器的使能开关的控制，当使能开关被按下，EN-C1和DO1_delay(EN-NO1)接通，当使能开关弹起断开，EN-C1和DO1_delay(EN-NO1)断开。
当手动操作器与机器人断开时，MAN1和MAN2为低电平时，执行机构212切换为自动模式(auto mode)。自动模式下，机器人受远程调度系统控制。此时保护停止信号选通电路1的输出DO1_DELAY_1与OUT1信号直连，此时保护停止信号选通电路2的输出DO2_DELAY_1与OUT2信号直连，使能信号执行机构2121的EN-C1和DO1_delay(EN-NO1)直连，同时使能信号执行机构2122中的EN-C2和DO2_delay(EN-NO2)直连。
图6中各类信号对机器人的触发，以及机器人的响应过程，可以参见其他实施例的描述，此处不予赘述。
本发明一种可选实施例中，所述第一电平信号是低电平信号；所述第二电平信号是高电平信号。
一些实施例中，初始安全信号包括第一电平信号和第二电平信号。其中，第一电平信号可以用于触发对所述移动设备的安全停止。第二电平信号可以用于触发对移动设备行为的控制。实际实施场景中，初始安全信号的第一个信号可以是第二电平信号。
示例性的，初始安全信号例如可以是数字输出(digital output，DO)信号，第一电平信号例如可以是DO信号的低电平信号，第二电平信号例如可以是DO信号的高电平信号。
需要指出的是，延迟组件在对第二电平信号进行延时期间，延迟组件可以持续向模式选择组件12输出第一电平信号，以使运动控制部件在预设延时时长内，持续对移动设备进行控制。
此外，在根据输入的模式选择信号选择手动模式的情况下，延迟组件到模式选择组件12的信号被旁路，只有急停开关信号为第二电平信号时，输出安全停止信号到移动设备的运动控制部件，以触发运动控制部件控制移动设备实现安全停止。
延迟组件可以用于将第二电平信号直接传送到模式选择组件；延迟组件还可以用于按照预设延时时长对第一电平信号进行延时，以及将延时后的第一电平信号输出至模式选择组件。
对应本发明实施例的执行机构212，本发明实施例还提供了一种控制方法。
本发明实施例提供的一种示例性的控制方法如图7所示，该控制方法应用于执行机构212，该执行机构212例如可以如图2至图6中任一实施例所示。该控制方法包括以下步骤：
步骤S101，将输入的保护停止信号转换为符合目标安全性能等级的初始安全信号，初始安全信号包括第一电平信号和第二电平信号。
其中，目标安全性能等级是被控移动设备的安全性能等级，目标安全性能等级例如是PLd等级。初始安全信号符合目标安全性能等级，那么，本示例中，初始安全信号例如是PLd等级的信号。
示例性的，初始安全信号可以是DO信号，第一电平信号可以是低电平信号，第二电平信号可以是高电平信号。实际实施场景中，初始安全信号的第一个信号可以是高电平信号。
需要指出的是，该执行机构212可以部署在移动设备端，该执行机构212接收到的信号可以来自于该移动设备的控制平台。一种实施例中，该移动设备可以在预先划定的运行区域内运行，该运行区域对应设置控制平台，以对该运行区域内运行的移动设备进行控制。示例性的，该控制平台可以响应用户触发生成源信号，以及通过无线网将该源信号发送到该移动设备的从端控制模块。该移动设备的从端控制模块将该源信号发送到该执行机构212的信号转换器。从端控制模块可以通过以太网工业协议(Ethernet industrial protocol，EIP)模块将源信号发送到信号转换器。
其中，控制平台不属于用作生产的机械的范畴，可以不进行风险评估，那么，控制平台生成的源信号不符合任意安全性能等级。基于此，源信号(即执行机构212接收到的信号)应当被信号转换器转换为目标安全性能等级的信号(即初始安全信号)，才可以用与触发移动设备执行相应操作。
步骤S102，在执行机构处于自动模式下，对初始安全信号进行处理，处理包括：在初始安全信号是第一电平信号的情况下，按照预设延时时长对所述第一电平信号进行延时。
此外，响应于接收到的切换为手动模式的指令，持续输出第二电平信号。响应于接收到的使能信号，可以从手动模式切换为自动模式，以输出第一电平信号。
步骤S103，将处理后的信号、移动设备的急停开关信号和使能开关信号，进行逻辑与处理。
步骤S104，根据逻辑与处理后的结果控制移动设备的行为。
示例性的，根据逻辑与处理后的结果控制移动设备的行为，包括：若逻辑与处理后的信号为延时后的第一电平信号，响应延时后的第一电平信号驱动移动设备的马达抱闸；若逻辑与处理后的信号为第二电平信号控制移动设备安全停止。
需要指出的是，预设延时时长内，即使初始安全信号为第一电平信号，执行机构212依然持续可以并行响应第一电平信号对移动设备的行为进行控制，以使移动设备达到停止状态。进而，响应第一电平信号驱动移动设备的马达抱闸，以对移动设备进行断电，能够使移动设备稳定处于停止状态。
其中，在步骤S101中得到初始安全信号后，通过两个通道将初始安全信号传输到第一延迟电路和第二延迟电路。相应的，步骤S102至步骤S104中，均是对两路相同内容的信号的处理过程，此处不再展开。步骤S101至步骤S104涉及到的电路部件以及信号的流向，均可以参考图2至图6中相关的描述，此处不予赘述。
综上，本发明实施例提供的执行机构包括信号转换器、延迟组件、模式选择组件、监测电路。其中，信号转换器，用于将输入的保护停止信号转换为符合所述安全性能等级的初始安全信号，所述初始安全信号的第二电平信号用于维持移动设备的正常运行，第一电平信号用于触发对所述移动设备的安全停止，从而可以提供与移动设备的性能等级同等级的安全信号。将所述初始安全信号输出到所述延迟组件，延迟组件用于将所述第二电平信号直接传送到模式选择组件，以及将所述第一电平信号延时预设延时时长后传送至所述模式选择组件。而所述模式选择组件，用于在根据输入的模式选择信号选择自动模式的情况下，对所述延迟组件输出的信号、移动设备的急停开关信号和使能开关信号，进行逻辑与处理；在所述延迟组件输出所述第一电平信号或所述急停开关信号为所述第一电平信号的情况下，输出安全停止信号到所述移动设备的运动控制部件，以触发所述运动控制部件控制所述移动设备实现安全停止。且所述监测电路，用于监测所述初始保护停止信号、所述模式选择信号和所述急停开关信号，以及在所述初始保护停止信号为所述第一电平信号的情况下，将监测结果传送给移动设备控制器，以使所述移动设备控制器向所述运动控制部件控制所述移动设备实现安全停止。可见，本技术方案，采用符合目标安全性能等级的电路代替现有技术中的安全控制器与其他器件组成的安全控制组件，有利于降低成本，且能够为移动设备提供相匹配性能等级(即目标性能等级)的控制。
本发明一种可选的实施例中，移动控制器，还被配置为在接收到所述第二安全控制机构转发的复位指令的情况下，向所述安全驱动器发送上电指令；
安全驱动器，还被配置为根据所述上电指令驱动所述电机复位。
移动控制器在接收到第二安全控制机构转发的复位指令的情况下，向安全驱动器发送上电指令，使得电机复位，即解除停机并抱闸的状态，以便于后续在接收到调度指令时，可直接基于调度指令进行对应的调度处理。安全驱动器在接收到移动控制器发送的上电指令的情况下，驱动电机执行上电操作，即解除停机和抱闸的状态，进入待机状态。
参见图8，图8示出了根据本发明一个实施例提供的一种运动控制系统架构下的执行机构交互流程图，具体如下：
执行机构包括：延迟组件、移动控制器、安全驱动器、电机和速度编码器；
当执行机构接收到急停指令时，具体的数据流向如下：
第一阶段：移动控制器接收到第二安全控制机构传输的急停指令，并获得移动设备的当前移动速度，根据当前移动速度预测电机减速信息，并将电机减速信息发送至安全驱动器；
第二阶段：安全驱动器左和安全驱动器右，根据电机减速信息，分别驱动电机左和电机右按照所述电机减速信息减速；
第三阶段：延迟组件同时接收到第二安全控制机构传输的急停指令，在达到预设延迟时间的情况下，向安全驱动器发送断电指令；
第四阶段：安全驱动器左和安全驱动器右根据断电指令分别驱动电机左和电机右断电并抱闸；
第五阶段：速度编码器获取电机左和电机右的当前转速，并将当前转速反馈至移动控制器，移动控制器在当前转速与预设转速不匹配的情况下，产生报警信息。
应用本发明实施例的方案，在移动控制器接收到复位指令时，向安全驱动器发送上电指令，使得安全驱动器驱动电机复位，恢复待机状态，以便于后续在对移动设备进行调度时，直接进行调度即可，提高了该移动设备后续投入工作的效率。
本发明一种可选的实施例中，执行机构包括：安全控制器、移动控制器、安全驱动器、电机和数据编码器；
所述安全控制器，被配置为接收所述急停指令的解析结果，将所述解析结果转发至所述移动控制器；
所述移动控制器，被配置为响应于所述解析结果，获得所述移动设备的当前移动速度，根据所述当前移动速度预测电机减速信息，并将所述电机减速信息发送至所述安全驱动器；
所述安全驱动器，被配置为驱动所述电机按照所述电机减速信息减速；
所述数据编码器，被配置为获取所述电机的当前转速，并将所述当前转速反馈至所述安全控制器；
所述安全控制器，还被配置为监测所述电机减速信息，根据所述当前转速识别所述电机是否发生减 速异常，若是则向所述安全驱动器发送断电指令；
所述安全驱动器，还被配置为根据所述断电指令驱动所述电机断电并抱闸。
具体地，安全控制器是指对该移动设备的安全减速进行监控与控制的设备，比如，在电机未按照预定的速度进行减速时，判断该电机存在异常。
在安全控制器接收到急停指令的解析结果时，将该解析结果发送至移动控制器，使得移动控制器可基于该解析结果，控制移动设备进行对应的处理；移动控制器基于该解析结果获取该移动设备的当前速度，预测得到电机减速信息，并将电机减速信息发送至安全驱动器，使得安全驱动器基于该预测的电机减速信息，驱动电机减速，数据编码器同时获取电机实时的当前转速，并将获取到的当前转速反馈至移动控制器，由移动控制器对电机的减速信息进行监测，根据电机的当前转速与预测的电机减速信息中的转速进行匹配，判断是否存在减速异常，若确定发生，则向安全驱动器发送断电指令；安全驱动器则驱动电机进行断电并抱闸。
另外，若移动控制器，根据电机的当前转速与预测的电机减速信息中的转速进行匹配时，发现二者是相匹配的，即电机未发生减速异常，则只需由安全驱动器驱动电机减速即可，无需驱动器断电并抱闸。
应用本发明实施例的方案，执行机构包括安全控制器、移动控制器、安全驱动器、电机和数据编码器，移动控制器通过接收急停指令，并预测得到电机减速信息，并利用安全驱动器驱使电机按照该电机减速信息进行减速，同时数据编码器实时获取电机的当前转速，并转发给安全控制器，由安全控制器对电机的转速进行监控，并判断是否存在异常，在确定存在异常时，利用安全驱动器驱使电机进行断电并抱闸，在一定程度上，保证了电机的安全，避免了在电机出现减速异常时导致的错误。
本发明一种可选的实施例中，安全控制器，还被配置为在接收到所述第二安全控制机构转发的复位指令的情况下，将所述复位指令转发至所述移动控制器；
移动控制器，还被配置为响应于所述复位指令，向所述安全驱动器发送上电指令；
安全驱动器，还被配置为根据所述上电指令驱动所述电机复位。
安全控制器在接收到第二安全控制机构发送的复位指令的情况下，将复位指令发送至移动控制器，由移动控制器对复位指令进行相应的处理，也即移动控制器基于该复位指令，向安全驱动器发送上电指令，使得安全驱动器驱动电机进行上电操作，也即解除停机和抱闸状态，以使电机在接收到调度指令时可直接基于调度指令进行调度。
参见图9，图9示出了根据本发明一个实施例提供的另一种运动控制系统架构下的执行机构交互流程图，具体如下：
执行机构包括：安全控制器、移动控制器、安全驱动器、电机和数据编码器；
当执行机构接收到急停指令时，具体的数据流向如下：
第一阶段：安全控制器接收急停指令的解析结果，将解析结果转发至移动控制器；移动控制器接收该急停指令，并获得移动设备的当前移动速度，根据当前移动速度预测电机减速信息，并将电机减速信息发送至安全驱动器左和安全驱动器右；
第二阶段：安全驱动器左和安全驱动器右驱动所述电机左和电机右按照所述电机减速信息减速；数据编码器获取电机的当前转速，并将当前转速反馈至安全控制器；
第三阶段：安全控制器监测所述电机减速信息，根据所述当前转速识别所述电机左和电机右是否发生减速异常，若是则向所述安全驱动器左和安全驱动器右发送断电指令；安全驱动器左和安全驱动器右根据所述断电指令驱动所述电机左和电机右断电并抱闸。
应用本发明实施例的方案，在安全控制器接收到复位指令时，将该复位指令转发给移动控制器，移动控制器向安全驱动器发送上电指令，以使安全驱动器驱动电机执行上电操作，以便于后续可直接接收另外的指令，并直接基于指令进行行动。
本发明一种可选的实施例中，所述控制平台，还被配置为生成调度指令，通过第二通信链路，将所述调度指令传输至所述移动设备，其中，所述调度指令符合预设数据链路通信协议，所述第二通信链路为所述至少两条通信链路中所述预设数据链路通信协议的通信链路；
所述移动设备，还被配置为通过所述第二通信链路接收所述调度指令，对所述调度指令进行解析，基于解析结果执行调度操作。
具体地，调度指令是指由人为操作或系统软件产生的对移动设备进行调度的指令，且该调度指令符合预设数据链通信协议，比如，调度指令可以是令移动设备搬运货物的按钮被按下、令移动设备放置货物至某货架的指令被输入等等。在控制平台产生调度指令后，将该调度指令通过第二通信链路传输至移动设备端，由移动设备端进行对应的调度处理，另外，通过第二通信链路对符合预设数据链通信协议的调度指令进行传输时，使得调度指令可以被预设数据链通信协议所保护，极大减少了对急停指令的传输产生影响。
应用本发明实施例的方案，控制平台还用于生成调度指令，生成的调度指令符合预设数据链通信协议，且通过第二通信链路将该调度指令传输给移动设备端，由移动设备通过第二通信链路接收该调度指令，并解析得到解析结果，基于解析结果执行调度工作，通过与第一通信链路不同的第二通信链路进行调度指令的传输，在保障调度指令传输的安全性的同时，也极大减少了对急停指令传输的影响。
本发明一种可选的实施例中，所述控制平台，还被配置为在检测到复位事件被触发的情况下生成复位指令，通过所述第一通信链路，将所述复位指令传输至所述移动设备；
所述移动设备，还被配置为通过所述第一通信链路接收所述复位指令，对所述复位指令进行解析，基于解析结果恢复工作。
具体地，复位事件是指由于人为或系统软件原因，使得移动设备进行复位的事件，比如复位事件被触发可以是移动设备区域的急停按钮被解除、光栅由被遮挡的变为正常、安全门被关上后人为执行启动动作等等。在检测到复位事件被触发时，控制平台就会生成复位指令，并将该复位指令传输至移动设备，由移动设备基于该复位指令进行对应的复位处理，即恢复工作，也即通过对复位事件是否被触发的检测，使得在复位事件被触发的情况下可以迅速做出相对应的处理，以防止未生成与复位事件对应的处理流程。复位指令是指包含令移动设备进行复位的信息的指令，通过复位指令，可以使移动设备在停机状态下恢复工作。
在控制平台检测到复位事件被触发时，生成复位指令，并通过第一通信链路，将复位指令传输至移动设备，移动设备通过第一通信链路接收复位指令，并对该复位指令进行解析，基于解析得到的结果恢复工作。
基于图2，网络通信栈接收到控制指令，并对接收到的控制指令进行过滤识别，识别到该控制指令为从第一通信链路接收的非安全指令，通过预设数据链路通信协议对该非安全指令进行解析，得到复位指令，然后按照Ethernet/IP协议和CAN总线协议格式输出到执行结构。当然，在另一种实现方式中，复位指令也可以是安全指令，则网络通信栈会将该安全指令转发至安全协议栈，安全协议栈通过预设安全通信协议对符合预设安全通信协议的安全指令进行解析，得到该解析结果为复位指令，然后通过第二安全输入输出接口将解析结果以输入输出量形式进行安全输出。
应用本发明实施例的方案，控制平台在检测到复位事件被触发时，生成复位指令，并通过第一通信链路传输至移动设备，使得移动设备通过第一通信链路接收该复位指令，并对该复位指令进行解析，解析得到移动设备可以基于该信息可以进行相应处理的解析结果，并基于该解析结果进行恢复工作，通过第一通链路进行复位指令的传输，保障了复位指令的传输渠道，进一步保障了复位指令被安全传输，以方便移动设备进行复位后的处理。
本发明一种可选的实施例中，所述移动设备，还被配置为在接收到所述急停指令后，向所述控制平台反馈确认信息；
所述控制平台，还被配置为若在向所述移动设备传输所述急停指令后的预设安全时段内，未收到所述移动设备反馈的所述确认信息，则向所述移动设备发送提示消息；
所述移动设备，还被配置为响应于所述提示消息，执行停机操作。
具体地，预设安全时段是指预先设置的对安全指令进行反馈的时段，也即在控制平台向移动设备发送急停指令之后，等待预设安全时段对应的时长，需要在预设时段内收到移动设备的确认消息。确认消息是指与急停指令相对应的消息，用于告知控制平台，移动设备收到了急停指令，其中，先由控制平台向移动设备发送急停指令，移动设备基于该急停指令，需要向控制平台反馈确认消息，以使控制平台确认移动设备收到了急停指令。提示消息是指与急停指令、确认消息相对应的消息，用于在控制平台未收到移动设备的反馈时，再次向移动设备发送的提示消息，以使移动设备在接收到提示消息后，执行停机操作，进而达到急停指令所需要移动设备达到的目的。
可选的，促使移动设备执行停机操作的方式，还可以是控制平台在移动设备正常工作时段，预先设置一个预设时长，每隔预设时长，控制平台向移动设备发送第一交互消息，而移动设备需要在预设安全时段内向控制平台返回第二交互消息，若发生控制平台发送第一交互消息失败或移动设备发送第二交互消息失败，控制平台均会向移动设备发送提示消息，以使移动设备响应于该提示消息执行停机操作。
可选地，未收到移动设备反馈的确认消息的可能性有很多种，可以是控制平台未将急停指令发送成功，还可以是控制平台发送成功，但是移动设备在返回确认消息是发送失败。
控制平台在向移动设备发送急停指令后，确认是否在预设安全时段内接收到移动设备发送的确认消息，若接收到，则急停流程结束。
应用本发明实施例的方案，通过在控制平台设置预设安全时段，并在发送急停指令后，确定是否在预设时段内接收到移动设备的确认消息，若未收到，则向移动设备发送提示消息，以使移动设备执行停机操作，使得即使移动设备未根据急停指令执行停机操作，也会根据接收到的提示消息执行停机操作，确保了移动设备执行了停机操作。
控制平台和移动设备之间存在第一通信链路和第二通信链路，其中第一通信链路符合预设安全通信协议，且在控制平台和移动设备端设置安全任务时间间隔，在控制平台和移动设备建立连接后，按照安全任务时间间隔保持交互确认，也即，当控制平台成功发出第一响应消息，并接收到移动设备返回的第二响应消息，认为当次交互确认有效；若控制平台未成功发出第一响应消息或者移动设备未成功返回第二响应消息，则移动设备由内部单元控制自动进行安全状态，即急停状态，可以是第二安全控制机构向执行机构下发急停指令，使得移动设备受控安全停止，直至控制平台与移动设备重新建立连接，重新建立连接后，移动设备会自动通过内部单元控制跳出安全状态，恢复至进入安全状态之前的状态。
参见图10与图11，图10示出了根据本发明一实施例提供的一种运动控制系统的数据流图，图10示出了根据本发明一个实施例提供的另一种运动控制系统的数据流图，具体如下：
图10中控制平台包括安全触发机构、第一安全控制机构、系统软件和无线发送器；移动设备包括无线接收器、执行机构，其中提供的控制平台与移动设备之间进行交互仅是通过一条数据链路层、也即物理层进行交互。
图11中第一通信链路中，控制平台包括安全触发机构、第一安全控制机构和无线发送器，移动设备包括无线接收器、第二安全控制机构和执行机构；第二通信链路中，控制平台包括系统软件和无线发送器，移动设备包括无线接收器、第二安全控制机构和执行机构，其中第一条通信链路通过预设安全通信协议保护的安全通信层进行通信，第二通信链路通过数据链路层进行通信。
应用本发明实施例的方案，运动控制系统包括：控制平台和至少一个移动设备，控制平台与每个移动设备之间通过至少两条通信链路通信；控制平台，被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将急停指令传输至移动设备，第一通信链路为至少两条通信链路中预设安全通信协议的通信链路；移动设备，被配置为通过第一通信链路接收急停指令，利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。通过在控制平台与移动设备之间设置至少两条通信链路，在控制平台检测到安全事件被触发的情况下，生成符合预设安全通信协议的急停指令，使得该急停指令可以通过预设安全通信协议的第一通信链路进行传输，传输至移动设备，移动设备在接收到第一通信链路传输的急停指令后，对该急停指令进行解析，并基于解析结果执行停机操作，也即为急停指令设定第一通信链路，与其他的通信信号采用不同的通信链路进行传输，并且通过预设安全通信协议对急停指令的传输进行保护，降低了在急停指令传输至移动设备时出现传输失败或错误的发生几率，提高了急停指令传输的安全性。
参见图12，图12示出了根据本发明一个实施例提供的一种运动控制方法的交互流程图，应用于运动控制系统，所述运动控制系统包括：控制平台和至少一个移动设备，其中，所述控制平台与每个移动设备之间通过至少两条通信链路通信；具体包括以下步骤：
步骤602：所述控制平台在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将所述急停指令传输至所述移动设备，其中，所述急停指令符合预设安全通信协议，所述第一通信链路为所述至少两条通信链路中所述预设安全通信协议的通信链路；
步骤604：所述移动设备通过所述第一通信链路接收所述急停指令，利用所述预设安全通信协议对所述急停指令进行解析，基于解析结果执行停机操作。
步骤602至604具体的实施例内容参见图1对应的系统实施例，在此不再赘述。
参见图13，图13示出了根据本发明一个实施例提供的一种应用于控制平台的运动控制方法的流程图，具体包括以下步骤：
步骤702：在检测到安全事件被触发的情况下，生成急停指令；
步骤704：通过第一通信链路，将所述急停指令传输至移动设备，其中，所述急停指令符合预设安全通信协议，所述第一通信链路为所述控制平台与所述移动设备之间至少两条通信链路中所述预设安全通信协议的通信链路。
步骤702至704具体的实施例内容参见图1对应的系统实施例，在此不再赘述。
参见图14，图14示出了根据本发明一个实施例提供的一种应用于移动设备的运动控制方法的流程图，具体包括以下步骤：
步骤802：通过第一通信链路接收控制平台传输的急停指令，其中，所述第一通信链路为所述控制平台与所述移动设备之间至少两条通信链路中预设安全通信协议的通信链路，所述急停指令符合所述预设安全通信协议；
步骤804：利用所述预设安全通信协议对所述急停指令进行解析，基于解析结果执行停机操作。
步骤802至804具体的实施例内容参见图1对应的系统实施例，在此不再赘述。
应用本发明实施例的方案，运动控制系统包括：控制平台和至少一个移动设备，控制平台与每个移动设备之间通过至少两条通信链路通信；控制平台，被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将急停指令传输至移动设备，第一通信链路为至少两条通信链路中预设安全通信协议的通信链路；移动设备，被配置为通过第一通信链路接收急停指令，利用预设安全通信协议对急停指令进行解析，基于解析结果执行停机操作。通过在控制平台与移动设备之间设置至少两条通信链路，在控制平台检测到安全事件被触发的情况下，生成符合预设安全通信协议的急停指令，使得该急停指令可以通过预设安全通信协议的第一通信链路进行传输，传输至移动设备，移动设备在接收到第一通信链路传输的急停指令后，对该急停指令进行解析，并基于解析结果执行停机操作，也即为急停指令设定第一通信链路，与其他的通信信号采用不同的通信链路进行传输，并且通过预设安全通信协议对急停指令的传输进行保护，降低了在急停指令传输至移动设备时出现传输失败或错误的发生几率，提高了急停指令传输的安全性。
图15示出了根据本发明一个实施例提供的一种控制平台的结构框图。该控制平台的部件包括安全触发机构902、第一安全控制机构904、无线发送器906。
安全触发机构902包括急停按钮、光栅、安全门等，各种安全触发机构902的输出信号形式由各器件设计手册规定，常见的急停按钮为双回路脉冲，光栅为OSSD信号，安全门锁为OSSD信号；输入为由操作人员触发或自动触发；输出为指示设备状态，含已触发、未触发或异常状态的I/O信号输出。
安全触发机构902可以在移动设备工作区域外围，且与操作人员对接的位置，安装有急停按钮、光栅和安全门，其中，安全门是人员出入移动设备工作区域的唯一的通道，移动设备工作区域用固定围栏与外界进行隔离，用以减少由于移动设备错误运行造成的撞击或挤压风险。触发后，第一安全控制机构904会发出急停指令，并传输到至少一个移动设备；安全门上安装有安全门锁，是操作人员进入移动设备工作区域的唯一入口。当安全门锁被激活时，急停指令将由第一安全控制机构904发送并传输到至少一个移动设备；各安全触发机构902配备复位按钮，通过复位按钮，可触发复位指令。
第一安全控制机构904包括第一安全输入输出接口、第一安全处理器和安全网络模块；输入为是否触发了安全触发机构902或复位按钮的条件，即安全触发机构902或复位按钮的输出；输出：以网络端口的形式输出是否触发了安全触发机构902或是否按下了复位按钮。
第一安全控制机构904可以通过逻辑编程响应安全触发机构902的触发，并通过预设安全通信协议CIP safety传输。其中，第一安全输入输出接口用于输入安全触发机构902的状态供第一安全处理器；第一安全处理器用于通过逻辑编程响应安全触发机构902的触发。在安全通信层，将输入信号编码为符合CIP safety协议的安全格式。执行预设安全通信协议规定的校验动作，如冗余检测、数据完整性校验、超时检测、连接授权检测等。安全网络模块用于以网络端口形式发送安全CPU的运算结果。第一安全控制机构904输出信号在数据链路层通信协议为Ethernet/IP，在安全通信层为CIP safety，以网口形式发出高速模拟信号量。
无线发送器906包括交换器、无线控制器、无线接入点，其输入是第一安全控制机构904的输出，输出是向移动设备发送无线信号。交换器用于将数据包转发到目的节点端口(无线控制器和无线接入点)；无线控制器和无线接入点用于将数据包转换为无线信号形式并发送到移动设备。
对本发明范围的限制。本领域技术人员可以根据需要，增添或替换其他部件。
需要说明的是，该控制平台的技术方案与上述的运动控制系统的技术方案属于同一构思，控制平台的技术方案未详细描述的细节内容，均可以参见上述运动控制系统的技术方案的描述。
图16示出了根据本发明一个实施例提供的一种移动设备的结构框图。该移动设备的部件包括无线接收器1002、第二安全控制机构1004、执行机构1006。
无线接收器1002包括无线接收模块、转发模块、无线接收处理器；输入为无线信号；输出为以太网格式的指令。
无线接收器1002用于将接收到的无线信号转换为以太网端口格式的数据包。无线接收模块用于接收WIFI信号；无线接收处理器用于数据包透传；转发模块用于将接收到的无线信号转发为以太网端口格式，无线接收器1002接收到2.4GHz的无线信号后，通过PCIE总线传输到无线接收处理器，无线接收处理器透传该信号并由转发模块从网口以Ethernet/IP协议格式输出。
第二安全控制机构1004包括网络通信栈、第二处理器、安全协议栈、第二安全输入输出接口，其输入是以太网端口格式的数据包；输出是安全输出和非安全输出。
第二安全控制机构1004对于非安全数据包，以Ethernet/IP通信协议格式解析。对于安全数据包，以CIP safety预设安全通信协议格式进行解析。以输入输出量的格式输出解析的指令。网络通信栈是一个Ethernet/IP通信栈模块，用于将数据包过滤为安全数据和非安全数据。对于安全数据，网络通信栈将其发送到安全协议栈。对于非安全数据，网络通信栈将其解析为非安全指令。第二处理器用于配置网络协议栈的初始化信息，采集第二安全控制机构1004各子模块状态信息和故障信息，输出非安全指令，如复位指令。安全协议栈和第二安全输入输出接口用于解析CIP safety预设安全通信协议格式的安全数据，并进行安全输出，如系统急停指令。网络通信栈的输入信号是以网络端口形式的接收Ethernet/IP协议数据包，输出信号是以Ethernet/IP协议和CAN总线协议交互到执行机构，以传输初始化等状态信息和故障信息和复位指令，将安全数据包传输到安全协议栈。安全协议栈通过第二安全输入输出接口以输入输出量形式输出解析后的安全指令信号。
执行机构1006可以是包括延迟组件、移动控制器、安全驱动器、电机、数据编码器；输入为由第二安全控制机构1004解析出的安全指令；输出为执行机构1006按指令要求动作。
执行机构1006用于按指令要求动作。当执行机构1006接收到急停指令时，移动控制器接收到第二安全控制机构1004传输的急停指令，并获得移动设备的当前移动速度，根据当前移动速度预测电机减速信息，并将电机减速信息发送至安全驱动器；安全驱动器包括安全驱动器左和安全驱动器右，根据电机减速信息，分别驱动电机左和电机右按照所述电机减速信息减速；延迟组件同时接收到第二安全控制机构1004传输的急停指令，在达到预设延迟时间的情况下，向安全驱动器发送断电指令；安全驱动器左和安全驱动器右根据断电指令分别驱动电机左和电机右断电并抱闸；速度编码器获取电机左和电机右的当前转速，并将当前转速反馈至移动控制器，移动控制器在当前转速与预设转速不匹配的情况下，产生报警信息。
当收到复位指令后，电机将上电并解抱闸，等待控制平台的新指令。接收到的无线信号将直接传输 到移动控制器进行解析，这与急停指令传输链路不同。复位指令从网络协议栈传送到第二安全控制机构1004中的第二处理器，再转发到移动控制器。移动控制器向安全驱动器发送电机上电和解抱闸指令，然后电机复位。在收到调度指令之前，移动设备将静止在原地并等待。第二安全控制机构1004通过第二安全输入输出接口以输入输出量的形式输出急停指令，以CAN总线协议输出复位信号，以移动设备停止，电机断电并抱闸为最终的系统急停响应。
执行机构1006可以是包括安全控制器、移动控制器、安全驱动器、电机、数据编码器。
当执行机构1006接收到急停指令时，安全控制器接收急停指令的解析结果，将解析结果转发至移动控制器；移动控制器接收该急停指令，并获得移动设备的当前移动速度，根据当前移动速度预测电机减速信息，并将电机减速信息发送至安全驱动器左和安全驱动器右；安全驱动器左和安全驱动器右驱动所述电机左和电机右按照所述电机减速信息减速；数据编码器获取电机的当前转速，并将当前转速反馈至安全控制器；安全控制器监测所述电机减速信息，根据所述当前转速识别所述电机左和电机右是否发生减速异常，若是则向所述安全驱动器左和安全驱动器右发送断电指令；安全驱动器左和安全驱动器右根据所述断电指令驱动所述电机左和电机右断电并抱闸。
当收到复位指令后，移动设备跳出系统急停状态，进入正常状态。如果此时电机已抱闸，则移动设备将解除抱闸，静止在原地并等待来自控制平台的系统调度指令。控制平台到移动设备的系统调度指令链路未通过第二安全控制机构1004。接收到的无线信号直接传输到移动控制器进行解析，与急停指令传输链路不是同一条。复位指令从网络协议栈发送到第二安全控制机构1004的第二处理器，再转发到安全控制器，然后转发到移动控制器。移动控制器向安全驱动器发送复位指令，电机复位。在收到调度指令之前，移动设备将静止在原地。第二安全控制机构1004以普通输入输出接口、安全输入输出接口量的形式分别输出复位指令和急停指令，以移动设备停止为最终的系统急停响应。
对本发明范围的限制。本领域技术人员可以根据需要，增添或替换其他部件。
需要说明的是，该移动设备的技术方案与上述的运动控制系统的技术方案属于同一构思，移动设备的技术方案未详细描述的细节内容，均可以参见上述运动控制系统的技术方案的描述。
上述对本发明特定实施例进行了描述。其他实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
需要说明的是，对于前述的各方法实施例，为了简便描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某些步骤可以采用其它顺序或者同时进行。其次，本领域技术人员也应该知悉，发明中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定都是本发明所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其它实施例的相关描述。
以上公开的本发明优选实施例只是用于帮助阐述本发明。可选实施例并没有详尽叙述所有的细节，也不限制该发明仅为所述的具体实施方式。显然，根据本发明的内容，可作很多的修改和变化。本发明选取并具体描述这些实施例，是为了更好地解释本发明的原理和实际应用，从而使所属技术领域技术人员能很好地理解和利用本发明。本发明仅受权利要求书及其全部范围和等效物的限制。

Claims (23)

  1. 一种运动控制系统，其特征在于，所述运动控制系统包括：控制平台和至少一个移动设备，其中，所述控制平台与每个移动设备之间通过至少两条通信链路通信；
    所述控制平台，被配置为在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将所述急停指令传输至所述移动设备，其中，所述急停指令符合预设安全通信协议，所述第一通信链路为所述至少两条通信链路中所述预设安全通信协议的通信链路；
    所述移动设备，被配置为通过所述第一通信链路接收所述急停指令，利用所述预设安全通信协议对所述急停指令进行解析，基于解析结果执行停机操作。
  2. 根据权利要求1所述的系统，其特征在于，所述控制平台包括安全触发机构和第一安全控制机构；
    所述安全触发机构，被配置为在识别到符合安全触发条件的事件发生时，生成安全事件触发信号发送至所述第一安全控制机构；
    所述第一安全控制机构，被配置为接收所述安全触发机构发送的所述安全事件触发信号，利用所述预设安全通信协议对所述安全事件触发信号进行编码得到急停指令，通过第一通信链路，将所述急停指令传输至所述移动设备。
  3. 根据权利要求1或2所述的系统，其特征在于，所述控制平台包括无线发送器；
    所述无线发送器，被配置为将所述急停指令转发至目的端口，通过所述目的端口将所述急停指令转换为无线信号传输至所述移动设备，其中，所述目的端口为所述控制平台与所述移动设备通过所述第一通信链路进行数据传输的端口。
  4. 根据权利要求3所述的系统，其特征在于，所述控制平台还包括网络地址转换设备；
    所述无线发送器，进一步被配置为将所述急停指令发送至所述网络地址转换设备；
    所述网络地址转换设备，被配置为对所述急停指令进行地址转换，并将地址转换后的所述急停指令转发至所述目的端口，通过所述目的端口将地址转换后的所述急停指令以无线信号的形式传输至所述移动设备。
  5. 根据权利要求3所述的系统，其特征在于，所述移动设备包括无线接收器；
    所述无线接收器，被配置为通过所述第一通信链路接收所述无线信号，将所述无线信号转发为以太网端口格式的急停指令。
  6. 根据权利要求1、2和5中任一项所述的系统，其特征在于，所述移动设备包括第二安全控制机构和执行机构；
    所述第二安全控制机构，被配置为利用所述预设安全通信协议对所述急停指令进行解析，得到解析结果，将所述解析结果发送至所述执行机构；
    所述执行机构，被配置为基于所述解析结果执行停机操作。
  7. 根据权利要求6所述的系统，其特征在于，所述执行机构包括：延迟组件、移动控制器、安全驱动器、电机和速度编码器；
    所述移动控制器，被配置为响应于所述急停指令的解析结果，获得所述移动设备的当前移动速度，根据所述当前移动速度预测电机减速信息，并将所述电机减速信息发送至所述安全驱动器；
    所述安全驱动器，被配置为驱动所述电机按照所述电机减速信息减速；
    所述延迟组件，被配置为响应于所述急停指令的解析结果，在达到预设延迟时间的情况下，向所述安全驱动器发送断电指令；
    所述安全驱动器，还被配置为根据所述断电指令驱动所述电机断电并抱闸；
    所述速度编码器，被配置为获取所述电机的当前转速，并将所述当前转速反馈至所述移动控制器；
    所述移动控制器，还被配置为在所述当前转速与预设转速不匹配的情况下，产生报警信息。
  8. 根据权利要求7所述的系统，其特征在于，所述执行机构还包括：信号转换器；
    所述信号转换器，被配置为将所述急停指令的解析结果转换为符合目标安全性能等级的初始安全信号，将所述初始安全信号输出至所述延迟组件，其中，所述目标安全性能等级为所述移动设备的安全性能等级；
    所述延迟组件，进一步被配置为基于所述初始安全信号，在达到预设延迟时间的情况下，向所述安全驱动器发送断电指令。
  9. 根据权利要求8所述的系统，其特征在于，所述初始安全信号包括第一电平信号，其中，所述第一电平信号用于触发所述移动设备的安全停止；所述执行机构还包括：模式选择组件；
    所述延迟组件，进一步被配置为在达到预设延迟时间的情况下，向所述模式选择组件发送所述第一电平信号；
    所述模式选择组件，被配置为在根据输入的模式选择信号选择自动模式的情况下，若所述延迟组件输出所述第一电平信号，则向所述安全驱动器发送断电指令。
  10. 根据权利要求9所述的系统，其特征在于，所述初始安全信号还包括第二电平信号，其中，所述第二电平信号用于维持所述移动设备的正常运行；
    所述延迟组件，还被配置为将所述第二电平信号直接发送至所述模式选择组件。
  11. 根据权利要求9所述的系统，其特征在于，所述执行机构还包括手动操作器信号接口，所述手动操作器信号接口用于接收模式选择信号；
    所述模式选择组件，还被配置为响应于所述模式选择信号，将所述执行机构的控制模式切换为所述手动模式；在所述手动模式下，响应于使能开关信号，将所述执行机构的控制模式切换为所述自动模式。
  12. 根据权利要求9所述的系统，其特征在于，所述延迟组件包括第一延迟电路和第二延迟电路；
    所述信号转换器，进一步被配置为将所述初始安全信号分别输出至所述第一延迟电路和所述第二延迟电路。
  13. 根据权利要求12所述的系统，其特征在于，所述模式选择组件包括第一模式选择组件和第二模式选择组件；
    在所述第一模式选择组件选择自动模式的情况下，所述第一延迟电路的输出与所述移动设备的第一路急停开关的输入、所述第二延迟电路的输出串联，用于使所述第一延迟电路延迟后的信号与所述第一路急停开关的信号、所述第二延迟电路延迟后的信号进行逻辑与运算，并向所述安全驱动器输出逻辑与运算后的断电指令；在所述第一模式选择组件选择手动模式的情况下，所述第一延迟电路的输出被旁路，持续向所述安全驱动器输出第二电平信号，其中，所述第二电平信号用于维持所述移动设备的正常运行；
    在所述第二模式选择组件选择自动模式的情况下，所述第二延迟电路的输出与所述移动设备的第二路急停开关的输入、所述第一延迟电路的输出串联，用于使所述第二延迟电路延迟后的信号与所述第二路急停开关的信号、所述第一延迟电路延迟后的信号进行逻辑与运算，并向所述安全驱动器输出逻辑与运算后的断电指令；在所述第二模式选择组件选择手动模式的情况下，所述第二延迟电路的输出被旁路，持续向所述安全驱动器输出所述第二电平信号。
  14. 根据权利要求10或13所述的系统，其特征在于，所述第一电平信号是低电平信号；所述第二电平信号是高电平信号。
  15. 根据权利要求7所述的系统，其特征在于，所述移动控制器，还被配置为在接收到所述第二安全控制机构转发的复位指令的情况下，向所述安全驱动器发送上电指令；
    所述安全驱动器，还被配置为根据所述上电指令驱动所述电机复位。
  16. 根据权利要求6所述的系统，其特征在于，所述执行机构包括：安全控制器、移动控制器、安全驱动器、电机和数据编码器；
    所述安全控制器，被配置为接收所述急停指令的解析结果，将所述解析结果转发至所述移动控制器；
    所述移动控制器，被配置为响应于所述解析结果，获得所述移动设备的当前移动速度，根据所述当前移动速度预测电机减速信息，并将所述电机减速信息发送至所述安全驱动器；
    所述安全驱动器，被配置为驱动所述电机按照所述电机减速信息减速；
    所述数据编码器，被配置为获取所述电机的当前转速，并将所述当前转速反馈至所述安全控制器；
    所述安全控制器，还被配置为监测所述电机减速信息，根据所述当前转速识别所述电机是否发生减速异常，若是则向所述安全驱动器发送断电指令；
    所述安全驱动器，还被配置为根据所述断电指令驱动所述电机断电并抱闸。
  17. 根据权利要求16所述的系统，其特征在于，所述安全控制器，还被配置为在接收到所述第二安全控制机构转发的复位指令的情况下，将所述复位指令转发至所述移动控制器；
    所述移动控制器，还被配置为响应于所述复位指令，向所述安全驱动器发送上电指令；
    所述安全驱动器，还被配置为根据所述上电指令驱动所述电机复位。
  18. 根据权利要求1所述的系统，其特征在于，所述控制平台，还被配置为生成调度指令，通过第二通信链路，将所述调度指令传输至所述移动设备，其中，所述调度指令符合预设数据链路通信协议，所述第二通信链路为所述至少两条通信链路中所述预设数据链路通信协议的通信链路；
    所述移动设备，还被配置为通过所述第二通信链路接收所述调度指令，对所述调度指令进行解析，基于解析结果执行调度操作。
  19. 根据权利要求1所述的系统，其特征在于，所述控制平台，还被配置为在检测到复位事件被触发的情况下生成复位指令，通过所述第一通信链路，将所述复位指令传输至所述移动设备；
    所述移动设备，还被配置为通过所述第一通信链路接收所述复位指令，对所述复位指令进行解析，基于解析结果恢复工作。
  20. 根据权利要求1所述的系统，其特征在于，所述移动设备，还被配置为在接收到所述急停指令后，向所述控制平台反馈确认信息；
    所述控制平台，还被配置为若在向所述移动设备传输所述急停指令后的预设安全时段内，未收到所述移动设备反馈的所述确认信息，则向所述移动设备发送提示消息；
    所述移动设备，还被配置为响应于所述提示消息，执行停机操作。
  21. 一种运动控制方法，其特征在于，应用于运动控制系统，所述运动控制系统包括：控制平台和至少一个移动设备，其中，所述控制平台与每个移动设备之间通过至少两条通信链路通信；所述方法包括：
    所述控制平台在检测到安全事件被触发的情况下生成急停指令，通过第一通信链路，将所述急停指令传输至所述移动设备，其中，所述急停指令符合预设安全通信协议，所述第一通信链路为所述至少两条通信链路中所述预设安全通信协议的通信链路；
    所述移动设备通过所述第一通信链路接收所述急停指令，利用所述预设安全通信协议对所述急停指令进行解析，基于解析结果执行停机操作。
  22. 一种运动控制方法，其特征在于，应用于控制平台，所述方法包括：
    在检测到安全事件被触发的情况下，生成急停指令；
    通过第一通信链路，将所述急停指令传输至移动设备，其中，所述急停指令符合预设安全通信协议，所述第一通信链路为所述控制平台与所述移动设备之间至少两条通信链路中所述预设安全通信协议的通信链路。
  23. 一种运动控制方法，其特征在于，应用于移动设备，所述方法包括：
    通过第一通信链路接收控制平台传输的急停指令，其中，所述第一通信链路为所述控制平台与所述移动设备之间至少两条通信链路中预设安全通信协议的通信链路，所述急停指令符合所述预设安全通信协议；
    利用所述预设安全通信协议对所述急停指令进行解析，基于解析结果执行停机操作。
PCT/CN2023/129671 2022-11-08 2023-11-03 运动控制系统及方法 WO2024099231A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211392751.3A CN115903670A (zh) 2022-11-08 2022-11-08 运动控制系统及方法
CN202211392751.3 2022-11-08

Publications (1)

Publication Number Publication Date
WO2024099231A1 true WO2024099231A1 (zh) 2024-05-16

Family

ID=86471984

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/129671 WO2024099231A1 (zh) 2022-11-08 2023-11-03 运动控制系统及方法

Country Status (2)

Country Link
CN (1) CN115903670A (zh)
WO (1) WO2024099231A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115903670A (zh) * 2022-11-08 2023-04-04 北京极智嘉科技股份有限公司 运动控制系统及方法
CN116394311B (zh) * 2023-06-08 2023-08-29 上海艾利特机器人有限公司 机器人急停保护处理方法、机器人及存储介质
CN116528245B (zh) * 2023-06-25 2023-11-10 北京极智嘉科技股份有限公司 安全控制方法、系统、移动设备及电子设备
CN116931531B (zh) * 2023-09-15 2024-02-06 宁德时代新能源科技股份有限公司 电池产线的安全控制系统及方法
CN117518935A (zh) * 2023-11-30 2024-02-06 弥费科技(上海)股份有限公司 一种空中运输车及其行进控制系统

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008064381A2 (de) * 2006-11-28 2008-06-05 Keba Ag Verfahren zum betreiben einer drahtlosen kommunikationsverbindung zwischen einem mobilen handbediengerät und einer maschinensteuerung sowie entsprechende systemkomponenten
JP2010287253A (ja) * 2010-08-23 2010-12-24 Daihen Corp 機械制御装置
CN110116408A (zh) * 2019-05-14 2019-08-13 深圳市证通电子股份有限公司 机器人安全控制方法、机器人及计算机可读存储介质
CN111426488A (zh) * 2020-04-25 2020-07-17 华南理工大学 基于Lora通信的无人驾驶车辆安全急停系统
CN112014714A (zh) * 2020-06-29 2020-12-01 埃夫特智能装备股份有限公司 一种工业机器人安全板电路测试平台
CN112865771A (zh) * 2020-12-31 2021-05-28 广州极飞科技股份有限公司 一种延时断电系统、无人设备和延时断电方法
CN115167201A (zh) * 2022-06-23 2022-10-11 华南理工大学 一种基于LoRa的无人车紧急制动遥控系统及方法
CN115903670A (zh) * 2022-11-08 2023-04-04 北京极智嘉科技股份有限公司 运动控制系统及方法

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008064381A2 (de) * 2006-11-28 2008-06-05 Keba Ag Verfahren zum betreiben einer drahtlosen kommunikationsverbindung zwischen einem mobilen handbediengerät und einer maschinensteuerung sowie entsprechende systemkomponenten
JP2010287253A (ja) * 2010-08-23 2010-12-24 Daihen Corp 機械制御装置
CN110116408A (zh) * 2019-05-14 2019-08-13 深圳市证通电子股份有限公司 机器人安全控制方法、机器人及计算机可读存储介质
CN111426488A (zh) * 2020-04-25 2020-07-17 华南理工大学 基于Lora通信的无人驾驶车辆安全急停系统
CN112014714A (zh) * 2020-06-29 2020-12-01 埃夫特智能装备股份有限公司 一种工业机器人安全板电路测试平台
CN112865771A (zh) * 2020-12-31 2021-05-28 广州极飞科技股份有限公司 一种延时断电系统、无人设备和延时断电方法
CN115167201A (zh) * 2022-06-23 2022-10-11 华南理工大学 一种基于LoRa的无人车紧急制动遥控系统及方法
CN115903670A (zh) * 2022-11-08 2023-04-04 北京极智嘉科技股份有限公司 运动控制系统及方法

Also Published As

Publication number Publication date
CN115903670A (zh) 2023-04-04

Similar Documents

Publication Publication Date Title
WO2024099231A1 (zh) 运动控制系统及方法
JP4317341B2 (ja) 安全関連オートメーション・バス・システム
EP3037902B1 (en) Diagnostics and enhanced functionality for single-wire safety communication
US11964677B2 (en) Platform door control apparatus based on double 2-vote-2 architecture
US8125109B2 (en) Modular safety switching system and method
KR102518003B1 (ko) 마스터/슬레이브 계위를 갖는 안전 모니터링 시스템을 포함하는 엘리베이터 시스템
US8509927B2 (en) Control system for controlling safety-critical processes
US9846423B2 (en) Smart taps for a single-wire industrial safety system
US9665072B2 (en) Method for determining a safety step and safety manager
CN202735763U (zh) 用于机器人的机器人运动控制安全系统
US6826433B1 (en) Failsafe data output system and automation system having the same
US10126727B2 (en) Method and system for safely switching off an electrical load
JP2004227575A (ja) 安全性関連プロセス情報の単一信号送信
US20040008467A1 (en) Safety communication system
EP2383623A1 (en) Modular safety switching device system with optical link
US20160197766A1 (en) Soft redundancy protocol
CN111049460B (zh) 一种三余度双驱动电机控制平台及控制方法
EP3260936B1 (en) Single-wire industrial safety system with safety device diagnostic communication
US20140312019A1 (en) Laser system processing unit connection
Castoldi et al. Network Programmability for Smart Factory Mobile Robotics: the SmartEdge Project Approach
CN219266810U (zh) 一种基于工业互联网的mes智能工厂系统
CN116360389B (zh) 一种电驱特种车辆的同步伺服控制器故障控制系统及方法
US11281191B2 (en) Global e-stop in an industrial safety system with local and global safety input devices
EP3945379A1 (en) Method of fast switching between devices
CN116528245B (zh) 安全控制方法、系统、移动设备及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23887921

Country of ref document: EP

Kind code of ref document: A1