阅读说明：本技术 安全转矩关断控制方法、电路及电机控制器 (Safe torque turn-off control method and circuit and motor controller ) 是由 刘洋 于 2020-03-27 设计创作，主要内容包括：本发明提供了一种安全转矩关断控制方法、电路及电机控制器,所述方法包括：向用于对前端模块的输出信号进行处理的电路发送第一诊断信号,所述电路在接收到所述前端模块的输出信号为安全转矩关断STO信号时向后端执行模块输出第一关断信号,所述第一关断信号用于使所述后端执行模块停止输出；接收所述电路的反馈信号,并在所述反馈信号符合第一预设条件时向所述后端执行模块输出第二关断信号,所述第二关断信号用于使所述后端执行模块停止输出。本发明实施例可以可靠实现电机危险失效管控,提高设备的安全性。(The invention provides a safe torque turn-off control method, a circuit and a motor controller, wherein the method comprises the following steps: sending a first diagnosis signal to a circuit for processing an output signal of a front-end module, wherein the circuit outputs a first turn-off signal to a rear-end execution module when receiving that the output signal of the front-end module is a safe torque turn-off STO signal, and the first turn-off signal is used for stopping the output of the rear-end execution module; and receiving a feedback signal of the circuit, and outputting a second turn-off signal to the rear-end execution module when the feedback signal meets a first preset condition, wherein the second turn-off signal is used for enabling the rear-end execution module to stop outputting. The embodiment of the invention can reliably realize the management and control of the dangerous failure of the motor and improve the safety of equipment.)

1. A safe torque off control method, characterized in that the method comprises:

sending a first diagnosis signal to a circuit for processing an output signal of a front-end module, wherein the circuit outputs a first turn-off signal to a rear-end execution module when receiving that the output signal of the front-end module is a safe torque turn-off STO signal, and the first turn-off signal is used for stopping the output of the rear-end execution module;

and receiving a feedback signal of the circuit, and outputting a second turn-off signal to the rear-end execution module when the feedback signal meets a first preset condition, wherein the second turn-off signal is used for enabling the rear-end execution module to stop outputting.

2. The safe torque off control method according to claim 1, characterized in that the first preset condition is: the feedback signal of the circuit does not include a preset level for a first preset time after the first diagnostic signal is sent to the circuit.

3. The safe torque off control method according to claim 1, characterized by further comprising: and outputting a second turn-off signal to the rear-end execution module when the feedback signal of the circuit is kept unchanged within a second preset time after the circuit is powered on.

4. A safe torque shutdown control circuit is characterized by comprising a signal conversion unit and a fault diagnosis unit; the signal conversion unit is respectively connected with the front-end module and the rear-end execution module, and outputs a first turn-off signal to the rear-end execution module when receiving a safe torque turn-off STO signal of the front-end module, wherein the first turn-off signal is used for stopping the output of the rear-end execution module;

the fault diagnosis unit outputs a first diagnosis signal to the signal conversion unit according to a first preset period, and outputs a second turn-off signal to the rear-end execution module when a feedback signal returned by the signal conversion unit meets a first preset condition, wherein the second turn-off signal is used for enabling the rear-end execution module to stop outputting.

5. The safe torque shutdown control circuit of claim 4, the signal conversion unit including a first input terminal, a second input terminal, a first output terminal, and a second output terminal, the fault diagnostic unit including a first diagnostic output terminal, a first feedback input terminal, and an enable signal output terminal;

the signal conversion unit is connected with the front-end module through the first input terminal and is connected with the rear-end execution module through the first output terminal;

the fault diagnosis unit is connected with the second input terminal of the signal conversion unit through the first diagnosis output terminal, connected with the second output terminal of the signal conversion unit through the first feedback input terminal, and connected with the back-end execution module through the enable signal output terminal, and outputs a first diagnosis signal through the first diagnosis output terminal according to a first preset period, and acquires a feedback signal returned by the signal conversion unit through the first feedback input terminal;

the first preset condition is as follows: the feedback signal of the first feedback input terminal does not include a preset level within a first preset time after the first diagnostic signal is transmitted to the signal conversion unit.

6. The safe torque turn-off control circuit according to claim 5, wherein the signal conversion unit comprises a current-limiting subunit, a first isolating subunit, a first filtering subunit and a second filtering subunit, wherein a primary side of the first isolating subunit is connected to the first input terminal via the current-limiting subunit, the second input terminal is directly connected to a primary side of the first isolating subunit, a secondary side of the first isolating subunit is connected to the first output terminal via the first filtering subunit, and a secondary side of the first isolating subunit is connected to the second output terminal via the second filtering subunit;

the first isolation subunit is composed of a first optical coupler, a positive output end of a secondary side of the first optical coupler is connected with a power supply input end through a current-limiting resistor, and a negative output end of the secondary side of the first optical coupler is connected with a reference ground; and the first filtering subunit and the second filtering subunit are respectively connected with the positive output end of the secondary side of the first optocoupler.

7. The safe torque shutdown control circuit of claim 5, wherein the fault diagnosis unit comprises a microcontroller, a switch subunit and a second isolation subunit, and the first feedback input terminal and the enable signal output terminal are respectively constituted by pins of the microcontroller; the microcontroller comprises a detection signal output pin, the detection signal output pin is connected to the primary side of the second isolation subunit through the switch subunit, and the secondary side of the second isolation subunit is connected with the first diagnosis output terminal;

the second isolation subunit consists of a second optocoupler, and the switch subunit consists of a switch tube; and a detection signal output pin of the microcontroller is connected to a control end of the switch tube, the switch tube is connected with a primary side of the second optocoupler in series, and a secondary side of the second optocoupler is connected with a second input terminal of the signal conversion unit.

8. The safe torque shutdown control circuit of claim 7, wherein the back end execution module includes two buffer chips connected in series; the safe torque turn-off control circuit comprises two signal conversion units, and the two signal conversion units are respectively connected with the same front end module through first input terminals and are respectively connected with the two buffer chips in a one-to-one correspondence mode through first output terminals;

the rear-end execution module stops outputting a driving pulse to the rear-end inversion module when any buffer chip receives the first turn-off signal or the second turn-off signal;

the fault diagnosis unit comprises two second isolation subunits;

the microcontroller comprises two first feedback input terminals, and detection signal output pins of the microcontroller are connected to the primary sides of the two second isolation subunits through the switch control subunits respectively;

and the secondary sides of the two second isolation subunits are respectively connected with the second input terminals of the two signal conversion units in a one-to-one correspondence manner.

9. The safety torque shutdown control circuit according to any one of claims 4 to 8, wherein the fault diagnosis unit includes a second diagnosis output terminal and a second feedback input terminal, and the fault diagnosis unit outputs a second diagnosis signal through the second diagnosis output terminal in a second preset cycle, and outputs a second shutdown signal for stopping the output of the back-end execution module through the enable signal output terminal when a signal of the second feedback input terminal meets a second preset condition.

10. A motor controller comprising a safe torque off control circuit as claimed in any one of claims 4 to 9.

Technical Field

The embodiment of the invention relates to the field of motion control, in particular to a safe torque turn-off control method, a safe torque turn-off control circuit and a motor controller.

Background

In an industrial field, when the personal safety of an operator is threatened, a frequency converter or a servo driver is powered off by pressing an emergency stop button, so that a motor stops outputting torque, a machine stops running, and the human body is prevented from being injured by accidental actions of the machine. However, a power-off restart often takes a long time to stop the machine, especially a high-power inverter or drive, and it often takes a long time to power on and off the machine once, which has a great influence on production efficiency.

In order to prevent personal injury accidents caused by accidental starting of electrical equipment and avoid the influence on normal production caused by power-Off restart, STO (safe torque Off) functions have been proposed for driving equipment such as frequency converters and servo motor drivers. The STO function can prevent the driver from generating torque when the motor stops, thereby effectively preventing personal injury accidents caused by accidental starting of the motor.

However, in the existing motion control system, the STO function can only achieve torque shutdown, and hardware implementing the STO function is not diagnosed, thereby causing a risk of failure of the STO function. In addition, the existing circuit for implementing the STO function is complex.

Disclosure of Invention

The embodiment of the invention provides a safe torque turn-off control method, a safe torque turn-off control circuit and a motor controller, aiming at the problems that the hardware for realizing the STO function cannot be diagnosed and causes the STO function to have the risk of failure and the existing hardware circuit for realizing the STO function is complex.

In order to solve the above technical problems, an embodiment of the present invention provides a safe torque shutdown control method, including:

sending a first diagnosis signal to a circuit for processing an output signal of a front-end module, wherein the circuit outputs a first turn-off signal to a rear-end execution module when receiving that the output signal of the front-end module is a safe torque turn-off STO signal, and the first turn-off signal is used for stopping the output of the rear-end execution module;

and receiving a feedback signal of the circuit, and outputting a second turn-off signal to the rear-end execution module when the feedback signal meets a first preset condition, wherein the second turn-off signal is used for enabling the rear-end execution module to stop outputting.

Preferably, the first preset condition is that: the feedback signal of the circuit does not include a preset level for a first preset time after the first diagnostic signal is sent to the circuit.

Preferably, the method further comprises: and outputting a second turn-off signal to the rear-end execution module when the feedback signal of the circuit is kept unchanged within a second preset time after the circuit is powered on.

The embodiment of the invention also provides a safe torque turn-off control circuit, which comprises a signal conversion unit and a fault diagnosis unit; the signal conversion unit is respectively connected with the front-end module and the rear-end execution module, and outputs a first turn-off signal to the rear-end execution module when receiving a safe torque turn-off STO signal of the front-end module, wherein the first turn-off signal is used for stopping the output of the rear-end execution module;

the fault diagnosis unit outputs a first diagnosis signal to the signal conversion unit according to a first preset period, and outputs a second turn-off signal to the rear-end execution module when a feedback signal returned by the signal conversion unit meets a first preset condition, wherein the second turn-off signal is used for enabling the rear-end execution module to stop outputting.

Preferably, the signal conversion unit includes a first input terminal, a second input terminal, a first output terminal, and a second output terminal, and the fault diagnosis unit includes a first diagnosis output terminal, a first feedback input terminal, and an enable signal output terminal;

the signal conversion unit is connected with the front-end module through the first input terminal and is connected with the rear-end execution module through the first output terminal;

the fault diagnosis unit is connected with the second input terminal of the signal conversion unit through the first diagnosis output terminal, connected with the second output terminal of the signal conversion unit through the first feedback input terminal, and connected with the back-end execution module through the enable signal output terminal, and outputs a first diagnosis signal through the first diagnosis output terminal according to a first preset period, and acquires a feedback signal returned by the signal conversion unit through the first feedback input terminal;

the first preset condition is as follows: the feedback signal of the first feedback input terminal does not include a preset level within a first preset time after the first diagnostic signal is transmitted to the signal conversion unit.

Preferably, the signal conversion unit includes a current-limiting subunit, a first isolating subunit, a first filtering subunit, and a second filtering subunit, and a primary side of the first isolating subunit is connected to the first input terminal via the current-limiting subunit, the second input terminal is directly connected to the primary side of the first isolating subunit, a secondary side of the first isolating subunit is connected to the first output terminal via the first filtering subunit, and a secondary side of the first isolating subunit is connected to the second output terminal via the second filtering subunit;

the first isolation subunit is composed of a first optical coupler, a positive output end of a secondary side of the first optical coupler is connected with a power supply input end through a current-limiting resistor, and a negative output end of the secondary side of the first optical coupler is connected with a reference ground; and the first filtering subunit and the second filtering subunit are respectively connected with the positive output end of the secondary side of the first optocoupler.

Preferably, the fault diagnosis unit includes a microcontroller, a switch subunit and a second isolation subunit, and the first feedback input terminal and the enable signal output terminal are respectively formed by pins of the microcontroller; the microcontroller comprises a detection signal output pin, the detection signal output pin is connected to the primary side of the second isolation subunit through the switch subunit, and the secondary side of the second isolation subunit is connected with the first diagnosis output terminal;

the second isolation subunit consists of a second optocoupler, and the switch subunit consists of a switch tube; and a detection signal output pin of the microcontroller is connected to a control end of the switch tube, the switch tube is connected with a primary side of the second optocoupler in series, and a secondary side of the second optocoupler is connected with a second input terminal of the signal conversion unit.

Preferably, the back-end execution module comprises two buffer chips connected in series; the safe torque turn-off control circuit comprises two signal conversion units, and the two signal conversion units are respectively connected with the same front end module through first input terminals and are respectively connected with the two buffer chips in a one-to-one correspondence mode through first output terminals;

the rear-end execution module stops outputting a driving pulse to the rear-end inversion module when any buffer chip receives the first turn-off signal or the second turn-off signal;

the fault diagnosis unit comprises two second isolation subunits;

the microcontroller comprises two first feedback input terminals, and detection signal output pins of the microcontroller are connected to the primary sides of the two second isolation subunits through the switch control subunits respectively;

and the secondary sides of the two second isolation subunits are respectively connected with the second input terminals of the two signal conversion units in a one-to-one correspondence manner.

Preferably, the fault diagnosis unit includes a second diagnosis output terminal and a second feedback input terminal, and the fault diagnosis unit outputs a second diagnosis signal through the second diagnosis output terminal according to a second preset period, and outputs a second shutdown signal for stopping the output of the back-end execution module through the enable signal output terminal when a signal of the second feedback input terminal meets a second preset condition. The embodiment of the invention also provides a motor controller which comprises the safe torque turn-off control circuit.

The safe torque turn-off control method, the safe torque turn-off control circuit and the motor controller have the following beneficial effects: the signal conversion unit controls the rear-end execution module to stop torque output according to the STO signal, and the fault diagnosis unit detects hardware of the signal conversion unit, so that dangerous failure management and control of the motor can be reliably realized, and the safety of equipment is improved. In addition, the embodiment of the invention also has the characteristic of simple circuit structure.

Drawings

FIG. 1 is a schematic flow chart diagram of a safe torque shutdown control method provided by an embodiment of the invention;

FIG. 2 is a schematic diagram of a safe torque shutdown control circuit provided by an embodiment of the present invention;

FIG. 3 is a circuit topology diagram of a safe torque shutdown control circuit provided by an embodiment of the present invention;

FIG. 4 is a frequency plot of diagnostic pulses in a safe torque shutdown control circuit provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of a safe torque shutdown control circuit provided in accordance with another embodiment of the present invention;

fig. 6 is a circuit topology diagram of a safe torque shutdown control circuit according to another embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

As shown in fig. 1, the schematic flowchart of the safety torque shutdown control method provided in the embodiment of the present invention is shown, and the safety torque shutdown control method can be applied to a motor controller, such as a frequency converter, a servo driver, and the like, and improves the reliability of the STO function of the motor controller. The method of this embodiment may be implemented in a main control chip of a motor controller or a diagnostic chip independent of the main control chip, and specifically includes:

step S11: the method includes the steps of sending a first diagnostic signal to a circuit for processing an output signal of a front-end module, wherein the circuit for processing the output signal of the front-end module outputs a first shutdown signal (for example, a high-level signal) to a rear-end execution module when the circuit receives that the output signal of the front-end module is a safe torque Shutdown (STO) signal (for example, a low-level signal), and the first shutdown signal is used for stopping the output of the rear-end execution module.

Under normal conditions, the front-end module outputs a safety signal, i.e. a non-STO signal, to the circuit for processing the output signal of the front-end module, and accordingly, the circuit for processing the output signal of the front-end module outputs a normal state signal to the back-end execution module, and the back-end execution module receives the normal state signal to keep outputting (for example, keep outputting a pulse width modulation signal).

The first diagnostic signal may be a pulse signal having a fixed period, and the pulse signal does not affect the processing of the output signal of the front-end module by the circuit for processing the output signal of the front-end module.

Step S12: and receiving a feedback signal of a circuit for processing the output signal of the front-end module, and outputting a second turn-off signal to the rear-end execution module when the feedback signal meets a first preset condition, wherein the second turn-off signal is used for stopping the output of the rear-end execution module.

Similarly, the feedback signal may be a pulse signal having a fixed period, and the period of the change of the feedback signal is the same as the period of the change of the first diagnostic signal, but the change of the feedback signal is later than the first diagnostic signal.

According to the safe torque turn-off control method, the diagnosis signal is sent to the circuit for processing the output signal of the front-end module, and the hardware of the circuit is detected according to the feedback signal, so that the control on dangerous failure of the motor can be reliably realized, and the safety of equipment is improved.

In an embodiment of the present invention, the first preset condition in the step S12 is: the feedback signal of the circuit for processing the output signal of the front-end module does not include a preset level, for example, the feedback signal is a continuous high level or a continuous low level, within a first preset time after the first diagnostic signal is sent to the circuit.

In addition, considering that the circuit for processing the output signal of the front end module has a certain filtering delay, the safe torque off control method further includes: within a second preset time after the circuit for processing the output signal of the front-end module is powered on (e.g., the motor controller is powered on), if the feedback signal remains unchanged, a second turn-off signal is output to the back-end execution module.

As shown in fig. 2, the schematic diagram of the safety torque shutdown control circuit provided in the embodiment of the present invention is applicable to a motor controller, such as a frequency converter, a servo driver, etc., and improves the reliability of the STO function of the motor controller. The safety torque shutdown control circuit of the present embodiment includes a signal conversion unit 11 and a fault diagnosis unit 12, where the signal conversion unit 11 and the fault diagnosis unit 12 are respectively formed by connecting one or more electronic components, and implement corresponding electrical signal processing. The signal conversion unit 11 is respectively connected to the front end module 21 and the rear end execution module 22, and outputs a first shutdown signal to the rear end execution module 22 when receiving a safe torque Shutdown (STO) signal of the front end module 21, where the first shutdown signal 22 is used to stop the output of the rear end execution module; the fault diagnosis unit 12 outputs a first diagnosis signal to the signal conversion unit 11 according to a first preset period, and outputs a second shutdown signal to the back-end execution module 22 when a feedback signal returned by the signal conversion unit 11 meets a first preset condition, where the second shutdown signal is used to stop the output of the back-end execution module 22.

Specifically, the signal conversion unit 11 includes a first input terminal, a second input terminal, a first output terminal, and a second output terminal; the fault diagnosis unit 12 includes a first diagnosis output terminal, a first feedback input terminal, and an enable signal output terminal. The first input terminal, the second input terminal, the first output terminal, the second output terminal, the first diagnostic output terminal, the first feedback input terminal, and the enable signal output terminal may be conductive connection points between electronic components, and each of the first input terminal, the second input terminal, the first output terminal, the second output terminal, the first diagnostic output terminal, the first feedback input terminal, and the enable signal output terminal may include one or more conductive connection points.

In the present embodiment, the signal conversion unit 11 is connected to a front end module 21 (which is used to generate an STO signal according to a state of a motor or a device driven by the motor) through a first input terminal, and is connected to a rear end execution module 22 (which is used to output a driving voltage to the motor, thereby implementing driving control of the motor) through a first output terminal. When the first input terminal receives the STO signal from the front end module 21, the signal conversion unit 11 outputs a first shutdown signal for stopping the output of the rear end execution module 22 to the rear end execution module 22 through the first output terminal, that is, after the rear end execution module 22 receives the first shutdown signal, the output of the driving voltage to the motor is stopped (for example, the motor winding is shorted, and the motor is stopped to output the torque).

The failure diagnosis unit 12 is connected to the second input terminal of the signal conversion unit 11 through the first diagnosis output terminal, to the second output terminal of the signal conversion unit through the first feedback input terminal, and to the back-end execution block 22 through the enable signal output terminal. The fault diagnosis unit 12 outputs a first diagnosis signal through the first diagnosis output terminal according to a first preset period, and outputs a second shutdown signal for stopping the output of the back-end execution module through the enable signal output terminal when the signal of the first feedback input terminal meets a first preset condition, that is, the back-end execution module 22 stops outputting the driving voltage to the motor after receiving the second shutdown signal.

The first preset condition may specifically be: the feedback signal of the first feedback input terminal of the fault diagnosis unit 12 does not include a preset level, for example, the feedback signal is a continuous low level or a continuous high level, within a first preset time after the first diagnosis signal is transmitted to the signal conversion unit 11.

In the above-mentioned safe torque turn-off control circuit, the signal conversion unit 11 controls the rear end execution module to stop torque output according to the STO signal from the front end module 21, and the fault diagnosis unit 12 detects the hardware of the signal conversion unit 11, so that the circuit (i.e. the signal conversion unit 11) realizing the STO function can be detected while the STO function is realized, thereby reliably realizing the management and control of dangerous failure of the motor, and improving the safety of the device

In an embodiment of the present invention, as shown in fig. 3, the signal conversion unit 11 in the safe torque turn-off control circuit may specifically include a current-limiting subunit 111, a first isolating subunit, a first filtering subunit 112, and a second filtering subunit 113, where the first isolating subunit may implement isolated output of an electrical signal, a primary side of the first isolating subunit is connected to a first input terminal (i.e., connected to the front-end module) through the current-limiting subunit 111, a second input terminal is directly connected to the primary side of the first isolating subunit, a secondary side of the first isolating subunit is connected to a first output terminal (i.e., connected to the rear-end execution module 22) through the first filtering subunit 112, and a secondary side of the first isolating subunit is connected to a second output terminal (i.e., connected to the fault detection unit 12) through the second filtering subunit 113. In this way, the signal conversion unit 11 can convert the STO signal from the front end module 21 into the control signal of the back end execution module 22, that is, the control level meeting the requirement of the back end execution module 22, and control the back end execution module 22 to stop outputting the driving voltage to the motor.

Specifically, the first isolator subunit may adopt a first optical coupler U1, a positive output end of a secondary side of the first optical coupler U1 is connected to a power supply input end (e.g., 3.3V) via the current limiter subunit 111, and a negative output end of the secondary side of the first optical coupler U1 is connected to a reference ground; the current limiting subunit 111 may be formed by two current limiting resistors, that is, the primary side of the first optocoupler U1 is connected to the front end module via the two current limiting resistors, and the first filtering subunit 112 and the second filtering subunit 113 are respectively connected to the positive output end of the secondary side of the first optocoupler U1. For example, in a normal condition (i.e., when the device normally operates), the STO signal from the front-end module may be at a high level, and the primary side of the first optical coupler U1 is turned on, so that the secondary side (i.e., the first output terminal) of the first optical coupler U1 outputs a low level, and the rear-end execution module 22 normally operates to output a driving voltage to the motor, so that the motor normally outputs a torque; when the torque needs to be turned off due to an abnormal condition of the equipment, the STO signal from the front-end module is at a low level, the primary side of the first optocoupler U1 is turned off, and the secondary side of the first optocoupler outputs a high level, so that the rear-end execution module 22 turns off the torque output of the motor (for example, all upper bridge arms of the inverter module are turned off, and all lower bridge arms of the inverter module are turned on, so that the winding of the motor is short-circuited).

In another embodiment of the present invention, referring to fig. 3, the fault diagnosis Unit 12 may specifically include a microcontroller (Micro Control Unit, MCU), a switch subunit 121, and a second isolation subunit, and the first feedback input terminal and the enable signal output terminal are respectively formed by pins of the microcontroller; the microcontroller comprises a detection signal output pin, and the detection signal output pin is connected to the primary side of the second isolation subunit via the switch subunit 121, and the secondary side of the second isolation subunit is connected to the first diagnostic output terminal.

Specifically, the second isolation subunit may adopt a second optical coupler U2, and the switch subunit 121 may be formed by a switch tube. A detection signal output pin of the microcontroller is connected with a control end of a switching tube, the switching tube is connected in series with a primary side of a second optocoupler U2 between a power supply voltage and a reference ground, and a secondary side of the second optocoupler U2 is connected with a second input terminal (namely the primary side of the first optocoupler U1) of the signal conversion unit 11.

The microcontroller pulls out some high pulses (L-shaped pulses) from the low level signal of the secondary side of the first optocoupler U1 through a detection signal output pin, a switching tube and a second optocoupler U2, the signal with the L-shaped pulses is processed in two paths, one path is filtered by a first filtering subunit 122 to obtain L pulses and then sent to a rear-end execution module 22, and the other path is filtered by a second filtering subunit 123 to obtain L pulses and then sent to a first feedback input terminal of the microcontroller.

Furthermore, the fault diagnosis unit 12 may further include a second diagnosis output terminal and a second feedback input terminal, which are respectively connected to the back-end execution module 22. Specifically, the second diagnosis output terminal and the second feedback input terminal may be formed by pins of the microcontroller, and the fault diagnosis unit outputs the second diagnosis signal through the second diagnosis output terminal according to a second preset period, and outputs a second turn-off signal for stopping the output of the back-end execution module through the enable signal output terminal when a signal of the second feedback input terminal meets a second preset condition.

The microcontroller makes a more complete diagnosis of the entire loop at each power-up of the safe torque off control circuit. In addition, during the normal operation of the safe torque turn-off control circuit, the microcontroller continuously monitors and diagnoses the first optocoupler U1, the first filtering subunit 122 and the second filtering subunit 123 in real time, and the related resistance and capacitance are monitored and diagnosed. Referring to fig. 4, after the microcontroller outputs the diagnostic signal through the detection signal output pin, it needs to wait for a certain time (for example, 300us) to allow the external hardware to have time to generate a corresponding high-level input signal, and when the waiting time is reached, it detects whether the level signal of the first feedback input terminal is an expected high level, and if the level signal is not a high level signal, the microcontroller enters into an STO fault, and outputs a second off signal to the back-end execution module 22 through the enable signal output terminal, so that the back-end execution module 22 stops outputting the driving voltage to the motor.

In yet another embodiment of the present invention, as shown in FIGS. 5 and 6, the back-end execution module includes two serially connected buffer chips U3; accordingly, the safety torque shutdown control circuit includes two signal conversion units 11, and the two signal conversion units 11 are respectively connected to the same front end module 21 through the first input terminal and are respectively connected to the two buffer chips U3 through the first output terminal in a one-to-one correspondence manner (for example, connected to one enable pin of the buffer chip U3). When any buffer chip U3 receives the first turn-off signal or the second turn-off signal, the back-end execution module 22 stops outputting the driving pulse to the inverter module at the back end, so that the back-end execution module does not output the driving pulse to the motor any more. By the mode, redundant control can be realized, and the safety of the STO is further improved.

Correspondingly, the fault diagnosis unit 12 may include two switch subunits and two second isolation subunits, the microcontroller includes two first feedback input terminals, and the first diagnosis output terminals of the microcontroller are connected to the primary sides of the two second isolation subunits through one switch subunit, respectively; the secondary sides of the two second isolation subunits are respectively connected with the second input terminals of the two signal conversion units 11 in a one-to-one correspondence manner.

To realize power supply, the safety torque shutdown control circuit may further include a power supply unit, and power supply input terminals of the signal conversion unit 11 and the fault diagnosis unit 12 are respectively connected to an output terminal of the power supply unit. The fault diagnosis unit 12 may also perform related hardware diagnosis on the power supply unit to prevent the power supply unit from failing. For example, the power supply unit includes monitoring of 5V and 3.3V power supplies, and a 5V power supply voltage signal is input to the microcontroller through a voltage dividing circuit. The microcontroller can carry out overvoltage and undervoltage monitoring on the 5V power supply, when the microcontroller detects that the 5V power supply exceeds a normal voltage range (the normal voltage range is 4.75V-5.4V), the microcontroller judges that a circuit has a fault, and outputs a second turn-off signal (such as another enable pin of the buffer chip U3) to the rear-end execution module 22 through the enable signal output terminal, so that the rear-end execution module 22 stops outputting the driving voltage to the motor, and the motor torque is safely turned off.

The embodiment of the invention also provides a motor controller which can be a frequency converter, a servo driver and the like and comprises the safe torque turn-off control circuit.

The above description is only for the preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.