WO2023077457A1 - Safety control system and safety controller for industrial robot - Google Patents

Abstract

A safety control system and safety controller (10) for an industrial robot. The safety controller (10) is integrated in a control cabinet (20) of an industrial robot and comprises: a logic circuit (12) for generating a first security instruction on the basis of state information of a security input device (50) of the industrial robot; an output circuit (13) for connecting to the logic circuit (12) and connecting to a servo controller (30) of the industrial robot, and transmitting the first security instruction to the servo controller (30), such that the servo controller (30) executes the first security instruction; and a diagnosis circuit (101) for connecting to the output circuit (13) so as to determine whether the transmission path from the output circuit (13) to the servo controller (30) has failed. Safety logic control of an industrial robot is achieved by using a small-size safety controller (10) while it is ensured that a servo controller (30) of the industrial robot can be effectively stopped.

Description

A safety control system and safety controller for an industrial robot 【Technical field】

The present application relates to the field of safety control of industrial robots, in particular to a safety control system and safety controller of industrial robots.

【Background technique】

With the advancement of industrial automation, more and more industrial robots are used. While improving work efficiency, the safety function technology of industrial robots has become the top priority in R&D and design. In the industrial robot functional safety standard ISO 10218-1:2011 and the mechanical safety standard ISO 13849-1:2015, the safety function of industrial robots is required to meet Category 3 and Performance Level d. Specifically, in the industrial robot safety controller, the safety output requires a dual-channel design with a feedback monitoring function.

【Content of invention】

The present application at least provides a safety control system and a safety controller of an industrial robot.

The first aspect of the present application provides a safety controller, the safety controller is used to be integrated in the control cabinet of the industrial robot, the safety controller includes:

a logic circuit for generating a first safety instruction based on state information of a safety input device of an industrial robot;

The output circuit is used for connecting with the logic circuit and for connecting with the servo controller of the industrial robot, and is used for transmitting the first safety instruction to the servo controller, so that the servo controller executes the first safety instruction;

The diagnostic circuit is used to connect with the output circuit to determine whether the transmission path from the output circuit to the servo controller is faulty.

The second aspect of the present application provides a safety control system for an industrial robot, the safety control system comprising:

Safety input device for collecting hazard trigger signals;

Control cabinet;

Servo controller, set in the control cabinet, used to control industrial robots;

The main controller is set in the control cabinet and is used to control the servo controller;

The safety controller is set in the control cabinet;

Wherein, the safety controller is the above-mentioned safety controller.

In the above solution, by integrating the safety controller into the control cabinet of the industrial robot, a small-sized safety controller is used to realize the safety logic control of the industrial robot, and at the same time, the integration degree of the system is improved and the cost is reduced. In addition, the safety controller of this application uses hardware logic circuits such as logic circuits, output circuits, and diagnostic circuits to achieve the effects of small size, low cost, fast response speed, short development and verification cycle, and fast safety certification process. At the same time, the safety controller Use the diagnostic circuit to troubleshoot the output circuit to ensure that the servo controller of the industrial robot can be effectively stopped.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.

【Description of drawings】

The accompanying drawings here are incorporated into the specification and constitute a part of the specification. These drawings show embodiments consistent with the application, and are used together with the description to describe the technical solution of the application.

Fig. 1 is a schematic structural diagram of the first embodiment of the safety controller of the present application;

Fig. 2 is a schematic structural diagram of the second embodiment of the safety controller of the present application;

FIG. 3 is a schematic structural diagram of a third embodiment of the safety controller of the present application;

Fig. 4 is a schematic structural diagram of a fourth embodiment of a safety controller of the present application;

Fig. 5 is a schematic structural diagram of a fifth embodiment of the safety controller of the present application;

Fig. 6 is a schematic structural diagram of the sixth embodiment of the safety controller of the present application;

Fig. 7 is a schematic diagram of a first flow chart of the safety controller outputting a first safety instruction in the present application;

Fig. 8 is a second schematic flow diagram of the safety controller outputting the first safety instruction in the present application;

FIG. 9 is a schematic structural diagram of a seventh embodiment of a safety controller of the present application;

FIG. 10 is a schematic flow diagram of a reset operation performed by the safety controller of the present application;

Fig. 11 is a schematic flow chart of the application safety controller outputting a shutdown control command;

Fig. 12 is a schematic diagram of the first flow chart of the safety logic control performed by the safety controller of the present application;

Fig. 13 is a second schematic flow diagram of the safety logic control performed by the safety controller of the present application;

Fig. 14 is a schematic structural diagram of an embodiment of the security control system of the present application.

【Detailed ways】

The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific embodiments described here are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only some structures related to the present application are shown in the drawings but not all structures. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

In addition, terms such as "first" or "second" used in this specification to refer to numbers or ordinal numbers are used for descriptive purposes only, and should not be interpreted as express or implied relative importance or implied indications The number of technical characteristics. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. In the description of this specification, "plurality" means at least two, such as two, three or more, etc., unless otherwise specifically defined.

In the industrial robot functional safety standard ISO 10218-1:2011 and the mechanical safety standard ISO 13849-1:2015, the safety function of industrial robots is required to meet Category 3 and Performance Level d. This application provides a safety controller that realizes small size, high integration and low cost on the basis of meeting Category 3 and Performance Level d.

In addition, the safety controller of this application uses hardware logic circuits such as logic circuits, output circuits, and diagnostic circuits to achieve the effects of small size, low cost, fast response speed, short development and verification cycle, and fast safety certification process. At the same time, the safety controller Use the diagnostic circuit to troubleshoot the output circuit to ensure that the servo controller of the industrial robot can be effectively stopped.

Please refer to FIG. 1 . FIG. 1 is a schematic structural diagram of a first embodiment of a security controller of the present application. As shown in Figure 1, the safety controller 10 is integrated in the control cabinet 20 of the industrial robot, the control cabinet 20 of the industrial robot is further integrated with a servo controller 30 and a main controller 40, and the safety input device 50 of the industrial robot is arranged in the control cabinet 20, specifically, it can be arranged on the outer wall of the control cabinet 20.

Wherein, the safety controller 10 is respectively connected to the servo controller 30 , the main controller 40 and the safety input device 50 , and the servo controller 30 is further connected to the main controller 40 .

The safety controller 10 obtains the status information of the safety input device 50 , and further outputs a safety command to the servo controller 30 according to the status information, so as to control the industrial robot to stop working through the servo controller 30 . At the same time, the safety controller 10 also reports the safety instruction to the main controller 40, and the main controller 40 disables the servo controller 30 based on the safety instruction, that is, stops the enabling output to the servo controller 30.

Specifically, the safety controller 10 outputs safety instructions to the servo controller 30 based on the state information of the safety input device 50. At this time, the state information of the safety input device 50 is dangerous trigger state information, that is, when the industrial robot needs to stop working due to an operation failure. , the safety input device 50 performs corresponding operations, so that the safety controller 10 learns that the industrial robot has failed through the dangerous trigger state information, and then outputs a safety instruction to the servo controller 30, and the servo controller 30 stops the industrial robot according to the safety instruction operate.

The safety controller 10 also reports the safety instruction to the main controller 40, and the main controller 40 learns that the servo controller 30 is shutting down the industrial robot based on the safety instruction, and further outputs a disabling instruction to the servo controller 30, so as to The servo controller 30 is disabled, and the enable output to the servo controller 30 is stopped. Wherein, the main controller 40 may output the disabling command after the servo controller 30 finishes shutting down the industrial robot.

Optionally, in this embodiment, the safety input device 50 may include an emergency stop switch, a safety door, an enabling switch, a reset button, and the like. Specifically, the safety input device 50 may include multiple types of safety input devices 50 or multiple safety input devices 50 of the same type. Optionally, in other embodiments, other input devices for monitoring the safety performance of the industrial robot may also be included.

Specifically, the safety controller 10 of this embodiment includes an input circuit 11 , a logic circuit 12 , an output circuit 13 and a diagnosis circuit 101 . The input circuit 11 , the logic circuit 12 and the output circuit 13 , the input circuit 11 is connected to the logic circuit 12 , the logic circuit 12 is further connected to the output circuit 13 , and the diagnosis circuit 101 is connected to the output circuit 13 .

Wherein, the input circuit 11 is used to connect with the safety input device 50 of the industrial robot, and then acquire the state information of the safety input device 50 .

The logic circuit 12 is used to connect with the main controller 40 of the industrial robot, and is used to generate a first safety instruction based on the state information of the safety input device 50 and transmit the first safety instruction to the output circuit 13 and the main controller 40 .

The output circuit 13 is used to connect with the servo controller 30 of the industrial robot, and is used to transmit the first safety instruction to the servo controller 30, so that the servo controller 30 executes the first safety instruction, and further controls the shutdown of the industrial robot.

The diagnostic circuit 101 is used to determine whether the transmission path from the output circuit 13 to the servo controller 30 is faulty.

The safety controller 10 of this embodiment is provided with an input circuit 11, a logic circuit 12, an output circuit 13, and a diagnostic circuit 101, and realizes safety logic control through hardware logic circuits, meeting the safety standard requirements of Category 3 and Performance Level d. At the same time, the diagnostic circuit 101 is used to monitor the transmission path from the output circuit 13 to the servo controller 30 to ensure that the servo controller 30 can effectively stop and improve the safety and reliability of the safety controller 10 .

In combination with FIG. 1 , further refer to FIG. 2 . FIG. 2 is a schematic structural diagram of a second embodiment of the safety controller of the present application. In this embodiment, the number of output circuits 13 is two, and the diagnosis circuit 101 is further used for cross-validating the output signals of the two output circuits 13 . Specifically, in response to the inconsistent output signals of the two output circuits 13, it is determined that the output circuit 13 is faulty.

Wherein, the diagnostic circuit 101 is also used to connect with the servo controller 30, and is used to determine the output circuit 13 and Whether the signal transmission channel between the servo controllers 30 is faulty. Further, the diagnostic circuit 101 can simultaneously detect faults in the signal transmission channels between the two output circuits 13 and the servo controller 30 .

Further, the diagnosis circuit 101 is also used for connecting with the logic circuit 12 , for comparing the first safety control instruction output by the output circuit 13 with the first safety instruction output by the logic circuit 12 . Specifically, in response to the fact that the first safety control command output by the output circuit 13 is inconsistent with the first safety control command output by the logic circuit 12 , the diagnosis circuit 101 determines that the output circuit 13 is faulty. At the same time, the diagnostic circuit 101 can feed back the verification result to the logic circuit 12 , and then report to the main controller 40 of the industrial robot through the logic circuit 12 .

Further, the diagnostic circuit 101 is also used to feed back the fault information of the signal transmission channel or the fault information of the output circuit 13 to the output circuit 13, and the output circuit 13 feeds back the corresponding fault information to the logic circuit 12, so that the fault can be detected by the logic circuit 12. The information is reported to the main controller 40 of the industrial robot, so that the main controller 40 disables the servo controller 30 ; or, the diagnosis circuit 101 is further used to cut off the power supply of the servo controller 30 .

Specifically, since the safety controller 10 includes two output circuits 13, there are two transmission paths from the two output circuits 13 to the servo controller 30, and when the two transmission paths fail, the main controller 40 disables the servo control The controller 30 or the diagnostic circuit 101 cuts off the power of the servo controller 30.

When any one of the transmission paths fails and the other transmission path works normally, the safety controller 10 can still output the first safety instruction to the servo controller 30 to control the servo controller 30 to execute the first safety instruction. There is no need to disable the servo controller 30 or cut off the power of the servo controller 30 .

In this embodiment, two output circuits 13 are used to ensure that any one of the output circuits 13 can still work normally when a failure occurs, thereby improving the safety and reliability of the safety controller 10 and meeting the safety standards of Category 3 and Performance Level d.

In combination with FIG. 2 , further refer to FIG. 3 . FIG. 3 is a schematic structural diagram of a third embodiment of the safety controller of the present application. As shown in Figure 3, the present embodiment further includes a safety protection circuit 102, which is respectively connected with the output circuit 13 and the servo controller 30, and is used to realize the failure protection of the output circuit 13, and the first The safety command is transmitted to the diagnosis circuit 101 and the servo controller 30 .

Specifically, the number of safety protection circuits 102 is two, one safety protection circuit 102 is respectively connected to an output circuit 13 and the servo controller 30 , and the other safety protection circuit 102 is respectively connected to another output circuit 13 and the servo controller 30 . Among them, the safety protection circuit 102 can realize the function of protecting the output circuit 13 from failures such as overcurrent and short circuit, as well as the function of collecting output feedback.

In this embodiment, two safety protection circuits 102 are provided to respectively protect the two output circuits 13 from failure, so as to further improve the safety and reliability of the safety controller 10 .

In combination with FIG. 3 , further refer to FIG. 4 . FIG. 4 is a schematic structural diagram of a fourth embodiment of the safety controller of the present application. As shown in FIG. 4 , the logic circuit 12 of this embodiment includes a primary circuit 121 and a secondary circuit 122 .

Wherein, the primary circuit 121 is connected with the input circuit 11 , and is used for integrating the status information of multiple safety input devices 50 , and transmitting the integrated status information to the secondary circuit 122 .

Specifically, the primary circuit 121 can perform parallel-to-serial conversion on state information of a plurality of safety input devices 50 . The state information of each safety input device 50 can be a pulse signal, and the waveforms of the multiple pulse signals are different, and the primary circuit 121 integrates the multiple pulse signals to output a signal containing the information of the multiple pulse signals.

The secondary circuit 122 is respectively connected with the primary circuit 121 and the output circuit 13, and is used to generate a first safety instruction based on the integrated and processed state information, and transmit the first safety instruction to the output circuit 13, and then transmit the first safety instruction through the output circuit 13. The safety command is transmitted to the servo controller 30 .

Wherein, the secondary circuit 122 receives the signal output by the primary circuit 121, by judging whether the signal is the same as the multiple pulse signal integration signals in the normal state, if not, it proves that the state information of at least one safety input device 50 has changed , and at the same time generate a first safety instruction based on the judgment. Moreover, the secondary circuit 122 can further determine which specific safety input device 50 has its state information changed.

Further, in this embodiment, the safety controller 10 also includes an interactive circuit 14, the interactive circuit 14 is used to connect with the secondary circuit 122 and the main controller 40 of the industrial robot, and is used to obtain the information of the industrial robot from the main controller 40. the working mode, so that the secondary circuit 122 generates the first security instruction based on the integrated state information in the corresponding working mode. Wherein, the secondary circuit 122 can also report any one or a combination of the integrated status information, the first safety instruction, the fault information of the secondary circuit 122 and the fault information of the primary circuit 121 to the main controller 40 through the interactive circuit 14 .

Wherein, the interactive circuit 14 includes a first end connected to the secondary circuit 122 and a second end connected to the main controller 40, the interface of the second end is matched with the interface of the main controller 40, and no additional transfer ports are required. The applicability of the safety controller 10 is improved.

The diagnostic circuit 101 is further connected to the secondary circuit 122 to report the fault information of the signal transmission channel from the output circuit 13 to the servo controller 30 or the fault information of the output circuit 13 to the main controller through the interactive circuit 14 connected to the secondary circuit 122 40.

In this embodiment, the safety controller 10 acquires the working mode of the industrial robot issued by the main controller 40 by setting the interactive circuit 14, and reports the fault information to the main controller 40 at the same time, meeting the safety standard requirements of Category 3 and Performance Level d.

Wherein, the working mode of the industrial robot includes an automatic mode and a manual mode. When the working mode of the industrial robot is the automatic mode, the flow diagram of the secondary circuit 122 generating the first safety instruction based on the integrated state information is shown in FIG. 3 , when When the working mode of the industrial robot is the manual mode, the flowchart of the secondary circuit 122 generating the first safety command based on the integrated state information is shown in FIG. 4 .

In combination with FIG. 4 , further refer to FIG. 7 . FIG. 7 is a schematic diagram of a first flow chart of the safety controller outputting the first safety instruction in the present application. Specifically, in this embodiment, the safety controller 10 outputting the first safety instruction may include the following steps:

Step S11: Determine whether the industrial robot is in automatic mode.

Wherein, the secondary circuit 122 is connected with the main controller 40 through the interactive circuit 14 , so as to obtain the working mode of the industrial robot through the main controller 40 . When the secondary circuit 122 acquires that the working mode of the industrial robot is the automatic mode, step S12 is executed.

Step S12: Process according to relevant input information.

Wherein, in this embodiment, the safety input device 50 is specifically an emergency stop switch and a safety door, and the secondary circuit 122 is also used to receive feedback information from the output circuit 13 and the feedback information from the servo controller 30, and the relevant input information may include emergency The state information of the stop switch, the state information of the safety door, the feedback information of the output circuit 13 and the feedback information of the servo controller 30.

Specifically, the secondary circuit 122 acquires relevant input information, and further executes step S13 , step 14 and step 15 . Wherein, step S13, step 14, and step 15 may be performed simultaneously or sequentially, and the order of step S13, step 14, and step 15 may be adjusted according to actual needs, which is not limited in this embodiment.

Step S13: Determine whether the emergency stop switch is faulty.

Wherein, the emergency stop switch includes an off state and an on state, which can specifically be an off setting and a pressing setting. When the emergency stop switch is in the normal state, the emergency stop switch is disconnected, and the state information of the emergency stop switch is normal state information; when the emergency stop switch fails, the emergency stop switch is set to be pressed, and the emergency The state information of the stop switch is the danger trigger state information.

Specifically, if the secondary circuit 122 judges that the emergency stop switch is in a normal state according to the status information of the emergency stop switch, then return to step S12.

Step S14: Determine whether the safety door is faulty.

Wherein, the safety door specifically includes an open state and a closed state. When the safety door is in a normal state, the safety door is closed, and the state information of the safety door is normal state information; when the safety door fails, the safety door is in an open state, and the state information of the safety door is dangerous trigger state information.

Specifically, if the secondary circuit 122 judges that the safety door is in a normal state according to the state information of the safety door, it returns to step S12.

Step S15: judging whether the feedback information of the output circuit is inconsistent with the feedback information of the servo controller.

Wherein, the feedback information of the output circuit 13 may be the instruction information output by the output circuit 13 received from the secondary circuit 122 , which specifically may include receiving the first safety instruction and not receiving the first safety instruction.

The feedback information of the servo controller 30 may be status information of the servo controller 30 , specifically, may include a normal working state and an STO shutdown state. Among them, different from receiving the disabling command, the servo controller 30 in the STO shutdown state still receives the enable output of the main controller 40. When the industrial robot completes a safe shutdown and solves the fault, the servo controller 30 can directly control the industrial robot to start. , at this moment, the servo controller 30 can work normally without power failure.

Specifically, when the secondary circuit 122 receives the feedback information from the output circuit 13 that it has not received the first safety instruction, and receives the feedback information from the servo controller 30 that it is in a normal working state; or the secondary circuit 122 receives the output circuit 13 The feedback information is that the first safety instruction is received, and the feedback information received from the servo controller 30 is the STO stop state, the secondary circuit 122 judges that the feedback information of the output circuit 13 is consistent with the feedback information of the servo controller 30, and Return to step S12.

When the secondary circuit 122 receives the feedback information from the output circuit 13 as receiving the first safety instruction, and receives the feedback information from the servo controller 30 as a normal working state, then the secondary circuit 122 judges that the feedback information of the output circuit 13 is consistent with the servo The feedback information from the controller 30 is inconsistent.

When the secondary circuit 122 responds that the state information of the emergency stop switch and the safety door of the safety input device 50 are dangerous trigger state information, and the feedback information of the output circuit 13 is inconsistent with the feedback information of the servo controller 30, step S16 is executed.

Step S16: Generate a first security instruction.

Wherein, the first safety command is specifically an STO shutdown command, and the servo controller 30 controls the torque off of the industrial robot based on the first safety command, and then controls the industrial robot to stop working.

In this embodiment, the secondary circuit 122 outputs the first safety instruction based on the automatic mode of the industrial robot, and further implements the torque off of the industrial robot through the first safety instruction, which can meet the safety standard requirements of Category 3 and Performance Level d.

In combination with FIG. 4 , further refer to FIG. 8 . FIG. 8 is a schematic diagram of a second flow chart of the safety controller outputting the first safety command in the present application. Specifically, in this embodiment, the safety controller 10 outputting the first safety instruction may include the following steps:

Step S21: Determine whether the industrial robot is in manual mode.

Wherein, the secondary circuit 122 is connected with the main controller 40 through the interactive circuit 14 , so as to obtain the working mode of the industrial robot through the main controller 40 . When the secondary circuit 122 obtains that the working mode of the industrial robot is the manual mode, step S22 is executed.

Step S22: Process according to relevant input information.

Wherein, in this embodiment, the safety input device 50 is specifically an emergency stop switch and an enable switch, and the secondary circuit 122 is also used to receive feedback information from the output circuit 13 and the feedback information from the servo controller 30, and the relevant input information can be It includes the state information of the emergency stop switch, the state information of the enabling switch, the feedback information of the output circuit 13 and the feedback information of the servo controller 30 .

Specifically, the secondary circuit 122 obtains relevant input information, and further executes step S23 , step 24 and step 25 . Wherein, step S23, step 24, and step 25 may be performed simultaneously or sequentially, and the order of step S23, step 24, and step 25 may be adjusted according to actual needs, which is not limited in this embodiment.

Step S23: Determine whether the emergency stop switch is faulty.

Wherein, the emergency stop switch includes an off state and an on state, which can specifically be an off setting and a pressing setting. When the emergency stop switch is in the normal state, the emergency stop switch is disconnected, and the state information of the emergency stop switch is normal state information; when the emergency stop switch fails, the emergency stop switch is set to be pressed, and the emergency stop switch is The state information of the stop switch is the danger trigger state information.

Specifically, if the secondary circuit 122 judges that the emergency stop switch is in a normal state according to the state information of the emergency stop switch, then return to step S22.

Step S24: Judging whether the enabling switch fails.

Wherein, the enabling switch specifically includes an off state and an on state, which can specifically be a release setting and a pressing setting. When the enabling switch is in the normal state, the enabling switch is set to be pressed, and the state information of the enabling switch is normal state information at this time; when the enabling switch fails, the enabling switch is set to be released, and the enabling The state information of the switch is the state information of danger triggering.

Specifically, if the secondary circuit 122 judges that the enabling switch is in a normal state according to the status information of the enabling switch, then return to step S22.

Step S25: judging whether the feedback information of the output circuit is inconsistent with the feedback information of the servo controller.

Wherein, the feedback information of the output circuit 13 may be the instruction information output by the output circuit 13 received from the secondary circuit 122 , which specifically may include receiving the first safety instruction and not receiving the first safety instruction.

The feedback information of the servo controller 30 may be status information of the servo controller 30 , specifically, may include a normal working state and an STO shutdown state.

Specifically, when the secondary circuit 122 receives the feedback information from the output circuit 13 that it has not received the first safety instruction, and receives the feedback information from the servo controller 30 that it is in a normal working state; or the secondary circuit 122 receives the output circuit 13 The feedback information is that the first safety instruction is received, and the feedback information received from the servo controller 30 is the STO stop state, the secondary circuit 122 judges that the feedback information of the output circuit 13 is consistent with the feedback information of the servo controller 30, and Return to step S22.

When the secondary circuit 122 receives the feedback information from the output circuit 13 as receiving the first safety instruction, and receives the feedback information from the servo controller 30 as a normal working state, then the secondary circuit 122 judges that the feedback information of the output circuit 13 is consistent with the servo The feedback information from the controller 30 is inconsistent.

When the secondary circuit 122 responds that the state information of the emergency stop switch and the enable switch of the safety input device 50 are dangerous trigger state information, and the feedback information of the output circuit 13 is inconsistent with the feedback information of the servo controller 30, step S26 is executed.

Step S26: Generate a first security instruction.

Wherein, the first safety command is specifically an STO shutdown command, and the servo controller 30 controls the torque off of the industrial robot based on the first safety command, and then controls the industrial robot to stop working.

In combination with FIG. 4 , further refer to FIG. 5 . FIG. 5 is a schematic structural diagram of a fifth embodiment of the safety controller of the present application. As shown in FIG. 5 , on the basis of the fourth embodiment, the number of secondary circuits 122 in this embodiment is two, and each secondary circuit 122 is connected to the primary circuit 121 , the output circuit 13 and the diagnostic circuit 101 respectively.

In this embodiment, the secondary circuit 122 outputs the first safety instruction based on the manual mode of the industrial robot, and further implements the torque off of the industrial robot through the first safety instruction, which can meet the safety standard requirements of Category 3 and Performance Level d.

Further, the safety controller 10 also includes a cross-validation circuit 15 , which is respectively connected to the two secondary circuits 122 and used for cross-validating the output signals of the two secondary circuits 122 to determine whether the secondary circuit 122 is faulty. Wherein, the output signal of the secondary circuit 122 at least includes the integrated status information and the first safety instruction.

Specifically, the cross-validation circuit 15 obtains the output signals of the two secondary circuits 122, and compares the integrated state information contained in the two output signals and the first security instruction, and specifically performs a comparison between the two integrated state information. comparison between and between two first safety instructions.

In this embodiment, the cross-validation circuit 15 performs cross-validation on the output signals of the two secondary circuits 122 to further improve the safety and reliability of the safety controller 10 and meet the safety standards of Category 3 and Performance Level d.

In combination with FIG. 5 , further refer to FIG. 6 . FIG. 6 is a schematic structural diagram of a sixth embodiment of the safety controller of the present application. As shown in Figure 6, on the basis of the fifth embodiment, the number of primary circuits 121 in this embodiment is two, one primary circuit 121 is connected to the input circuit 11 and one secondary circuit 122 respectively, and the other primary circuit 121 is connected to the input circuit 121 respectively. The circuit 11 and another secondary circuit 122 are connected.

The cross-validation circuit 15 is connected to the two primary circuits 121 respectively, and is used for cross-validating the output signals of the two primary circuits 121 to determine whether the primary circuit 121 is faulty. Wherein, the output signal of the primary circuit 121 includes the integrated state information. In this embodiment, the cross-validation circuit 15 performs cross-validation on the output signals of the two primary circuits 121 to further improve the safety and reliability of the safety controller 10 .

In combination with FIG. 6 , further refer to FIG. 9 . FIG. 9 is a schematic structural diagram of a seventh embodiment of the safety controller of the present application. As shown in FIG. 9 , the safety controller 10 of this embodiment further includes a reset input acquisition circuit 16 and a power protection circuit 17. The industrial robot is reset through the reset input acquisition circuit 16 and the power supply to the safety controller 10 is provided through the power protection circuit 17. The safety monitoring of the power supply further improves the safety and reliability of the safety controller 10 and meets the safety standard requirements of Category 3 and Performance Level d.

Wherein, the reset input acquisition circuit 16 is connected with the secondary circuit 122 for inputting a reset signal, and after receiving the reset signal, the secondary circuit 122 clears the first security instruction based on the integrated state information as normal and not triggered. Specifically, the reset input acquisition circuit 16 is respectively connected to the two secondary circuits 122, and respectively inputs reset signals to the two secondary circuits 122, so that the safety controller 10 performs a reset operation, and the two secondary circuits 122 The state information is that the first safety instruction is cleared because it is not triggered normally.

Specifically, clearing the first safety command by the secondary circuit 122 may specifically stop outputting the first safety command, or output a normal working command to replace the first safety command.

Optionally, in this embodiment, the reset input acquisition circuit 16 is directly connected to an external reset button, and a reset signal is obtained by operating the reset button. Optionally, in other embodiments, the reset input collection circuit 16 can also be connected to the input circuit 11 , and the input circuit 11 is further connected to a reset button, and the reset signal can be obtained through the input circuit 11 .

In combination with FIG. 9 , further refer to FIG. 10 . FIG. 10 is a schematic flowchart of a reset operation performed by the security controller of the present application. Specifically, the reset operation of the safety controller 10 in this embodiment may include the following steps:

Step S31: Obtain the working status of the industrial robot.

Wherein, the secondary circuit 122 is connected with the main controller 40 through the interactive circuit 14 , so as to obtain the working mode of the industrial robot through the main controller 40 .

Specifically, when the secondary circuit 122 judges that the industrial robot is in the automatic mode, step S32 is executed; when the secondary circuit 122 judges that the industrial robot is in the manual mode, step S37 is executed.

Step S32: Process according to relevant input information.

Wherein, in this embodiment, the relevant input information may include whether the working mode of the robot is automatic mode, status information of the emergency stop switch, status information of the safety door, and a reset signal.

Step S33: Determine whether a reset signal is received.

Wherein, when the secondary circuit 122 judges that the reset signal is received, step S34 is performed; when the secondary circuit 122 judges that the reset signal is not received, the process returns to step S32.

Step S34: Judging whether the emergency stop switch is in a normal working state.

Wherein, the normal working state of the emergency stop switch is the released state, which can be specifically set to be disconnected, and the state information at this time is the normal state information. When the emergency stop switch fails, the state information at this time is the danger trigger state information.

Specifically, when the secondary circuit 122 obtains the state information of the emergency stop switch, and judges that the emergency stop switch is in a normal working state and no fault occurs according to the state information, then step S35 is executed, otherwise, step S32 is returned.

Step S35: Judging whether the safety door is in a normal working state.

Wherein, the normal working state of the safety door is the closed state, which can be specifically set to be closed, and the state information at this time is the normal state information. When the safety door fails, the state information at this time is the danger trigger state information.

Specifically, when the secondary circuit 122 obtains the status information of the safety door, and judges that the safety door is in a normal working state and no fault occurs according to the status information, step S36 is executed, otherwise, step S32 is returned.

Step S36: Empty the first security instruction.

Wherein, when the secondary circuit 122 judges that the reset signal has been received, and the emergency stop switch and the safety door are in a normal state without failure, it is judged that the industrial robot has returned to the normal working state, and the first safety instruction is further cleared to prevent the first The output of safety instructions affects the normal operation of industrial robots.

Step S37: Process according to relevant input information.

Wherein, in this embodiment, the relevant input information may include whether the working mode of the robot is the manual mode, status information of the emergency stop switch, and whether a reset signal is received.

Step S38: Judging whether a reset signal is received.

Wherein, when the secondary circuit 122 judges that the reset signal is received, step S39 is performed; when the secondary circuit 122 judges that the reset signal is not received, the process returns to step S37.

Step S39: Judging whether the emergency stop switch is in a normal working state.

Wherein, the secondary circuit 122 acquires the state information of the emergency stop switch, and if it is judged from the state information that the emergency stop switch is in a normal working state and no fault occurs, then step S36 is executed; otherwise, step S32 is returned.

In this embodiment, the reset signal is input through the reset input acquisition circuit 16, and after the fault of the industrial robot is judged and resolved, the working state of the industrial robot is reset, meeting the safety standard requirements of Category 3 and Performance Level d.

As shown in Figure 9, the power protection circuit 17 is connected with the output circuit 13 and the power supply 18 respectively, the power protection circuit 17 generates a second safety instruction based on the failure of the power supply 18, and the output circuit 13 transmits the second safety instruction to the servo controller 30, so that the servo controller 30 executes the second safety instruction. Wherein, the second safety command may specifically be an STO stop command, and the servo controller 30 controls the torque off of the industrial robot based on the second safety command, and then controls the industrial robot to stop working.

Optionally, in this embodiment, the power supply 18 is used to provide an operating voltage for the safety controller 10 , and the power protection circuit 17 is used to detect overcurrent, short circuit, overvoltage and undervoltage faults on the power supply 18 . Specifically, the power supply 18 may be an internal power supply integrated in the control cabinet 20 or an external power supply.

In combination with FIG. 9 , further refer to FIG. 11 . FIG. 11 is a schematic flowchart of a safety controller outputting a shutdown control command in the present application. Specifically, in this embodiment, the safety controller 10 outputting the shutdown control instruction may include the following steps:

Step S41: Determine whether the industrial robot is in a running state.

Wherein, the safety controller 10 judges the working state of the industrial robot, and only when it is judged that the industrial robot is in the running state, it needs to perform safety logic control on the industrial robot, and step S42 is further executed.

Step S42: Process according to relevant input information.

Wherein, the relevant input information in this embodiment includes whether the first safety instruction and the second safety instruction are received.

Specifically, the output circuit 13 acquires relevant input information, and further executes step S43 and step 44 . Wherein, step S43 and step 44 may be performed simultaneously or sequentially, and the sequence between step S43 and step 44 may be adjusted according to actual needs, which is not limited in this embodiment.

Step S43: Determine whether the first security instruction is received.

Wherein, when the output circuit 13 judges that the first safety instruction is received, step S45 is executed; when the output circuit 13 judges that the first safety instruction is not received, the step S42 is returned.

Step S44: Determine whether the second security instruction is received.

Wherein, when the output circuit 13 judges that the second security instruction is received, step S45 is performed; when the output circuit 13 judges that the second security instruction is not received, the process returns to step S42.

Step S45: Outputting a shutdown control command to the servo controller.

Wherein, since both the first safety instruction and the second safety instruction are STO shutdown commands, the output circuit 13 can output a shutdown control instruction to the servo controller 30 according to any one of them, and can also output a shutdown control instruction to the servo controller 30 according to both. instruction.

In this embodiment, the first safety instruction and the second safety instruction are used to output the shutdown control instruction to the servo controller 30 separately or simultaneously, so as to further improve the safety and reliability of the safety controller 10 and meet the safety standards of Category 3 and Performance Level d.

In the definition of IEC 60204-1, safe shutdown includes shutdown category 0 and shutdown category 1. This embodiment provides two specific safety logic control modes, so that the safety controller 10 can respectively realize the safe shutdown of shutdown category 0 and shutdown category 1.

Specifically, the logic circuit 12 is configured with a first working mode and a second working mode. On the one hand, in the first working mode, the logic circuit 12 transmits the first safety instruction to the servo controller 30 and the main controller 40 through the output circuit 13, so that the servo controller 30 executes the first safety instruction, and the main controller If the controller 40 disables the servo controller 30, the safety controller 10 realizes a safety shutdown of the shutdown category 0.

Please refer to FIG. 9 for specific safety logic control steps, and further refer to FIG. 12 . FIG. 12 is a schematic diagram of a first flowchart of safety logic control performed by the safety controller of the present application. Specifically, the safety logic control performed by the safety controller 10 in this embodiment may include the following steps:

Step S51: triggering a first category safety shutdown.

Wherein, in this embodiment, the first category of safety shutdown is the safety shutdown of shutdown category 0. After judging that the safety shutdown of the first category is triggered, the safety controller 10 further executes steps S52 and S54. Wherein, step S52 and step S54 may be performed simultaneously or sequentially, and the sequence between step S52 and step S54 may be adjusted according to actual needs, which is not limited in this embodiment.

Step S52: Outputting the first safety command to the servo controller.

Wherein, the safety controller 10 triggers the first type of safety shutdown, the logic circuit 12 works in the first working mode, and outputs the first safety instruction to the servo controller 30 through the output circuit 13, and the servo controller 30 further executes step S53.

Step S53: Execute the first security instruction.

Wherein, the servo controller 30 receives the first safety instruction, executes the first safety instruction, and realizes the torque off of the industrial robot, so that the industrial robot stops working.

Step S54: Feedback the first shutdown trigger state to the main controller.

Wherein, when the industrial robot stops working, the safety controller 10 feeds back the state information of the servo controller 30 to the main controller 40, and the state information of the servo controller 30 is the first shutdown trigger state, and the main controller 40 further executes Step S55.

Step S55: Disable the servo controller.

Wherein, the main controller 40 disables the servo controller 30 according to the first shutdown trigger state fed back by the safety controller 10 , that is, stops the enable output to the servo controller 30 so that the servo controller 30 stops receiving the enable input.

On the other hand, in the second working mode, the logic circuit 12 starts timing, and transmits the first safety instruction to the servo controller 30 and the main controller 40 through the output circuit 13, so that the main controller 40 controls the servo controller 30 Shutdown, and after the timing result reaches the threshold value, the servo controller 30 is made to execute the first safety instruction, and the safety controller 10 implements a safety shutdown of shutdown category 1.

Please refer to FIG. 9 for specific safety logic control steps, and further refer to FIG. 13 . FIG. 13 is a second flow diagram of the safety logic control performed by the safety controller of the present application. Specifically, the safety logic control performed by the safety controller 10 in this embodiment may include the following steps:

Step S61: triggering the second type of safety shutdown.

Wherein, in this embodiment, the safety shutdown of the second category is the safety shutdown of shutdown category 1 . After judging that the safety shutdown of the second category is triggered, the safety controller 10 further executes step S62.

Step S62: Start the timing and feed back the trigger state of the second shutdown to the main controller.

Wherein, the safety controller 10 triggers the second type of safety shutdown, and the logic circuit 12 works in the second working mode. At this time, the safety controller 10 starts timing, and the safety controller 10 further executes step S63.

At the same time, the safety controller 10 feeds back the state information of the servo controller 30 to the main controller 40. At this time, the state information of the servo controller 30 is the second shutdown trigger state, and the main controller 40 further executes step S65.

Wherein, step S63 and step S65 may be performed simultaneously or sequentially, and the sequence between step S63 and step S65 may be adjusted according to actual needs, which is not limited in this embodiment.

Step S63: Determine whether the timing reaches the threshold.

Wherein, in this embodiment, the safety controller 10 judges whether the timing reaches a threshold value, specifically, the threshold value may be the total duration for which the main controller 40 controls the servo controller 30 to realize disabling. Optionally, in other embodiments, the timing can also be judged by the servo controller 30 .

When the safety controller 10 judges that the timing reaches the threshold, step S64 is further executed, otherwise, step S63 is returned.

Step S64: Outputting the first safety instruction to the servo controller.

Wherein, the safety controller 10 outputs the first safety instruction to the servo controller 30 through the output circuit 13, and the servo controller 30 further executes step S69.

Step S65: Planning the servo controller to stop.

Wherein, the main controller 40 plans the shutdown of the servo controller 30 based on the second shutdown trigger state, outputs a shutdown command to the servo controller 30, and further executes step S66.

Step S66: Judging whether the servo controller is stopped.

Wherein, the servo controller 30 receives the shutdown instruction output by the main controller 40, and executes the shutdown instruction. The main controller 40 judges whether the servo controller 30 is shut down, and when it is judged that the servo controller 30 is shut down, executes step S67, otherwise returns to step S66.

Step S67: Outputting a disable command to the servo controller.

Wherein, the main controller 40 further outputs a disabling instruction to the servo controller 30 for controlling the disabling of the servo controller 30 .

Step S68: Execute the disabling command.

Wherein, the servo controller 30 receives the disabling instruction and executes the disabling instruction, so that the servo controller 30 stops receiving the enabling output of the main controller 40 .

Step S69: Execute the first security instruction.

Wherein, the servo controller 30 receives the first safety instruction, executes the first safety instruction, and realizes the torque off of the industrial robot, so that the industrial robot stops working.

Optionally, the safety controller 10 of the present application can also include a teaching pendant, and the safety input device 50 is integrated on the teaching pendant, and the corresponding safety control operation can be performed through the teaching pendant, and at the same time, the industrial The movement of the robot, the completion of the teaching programming and the realization of the setting of the system can meet the safety standard requirements of Category 3 and Performance Level d.

In this application, the safety controller 10 is integrated in the control cabinet 20 of the industrial robot, and the small-sized safety controller 10 is used to realize the safety logic control of the industrial robot, while improving the integration degree of the system and reducing the cost. In addition, the safety controller 10 of the present application is composed of hardware logic circuits such as an input circuit 11, a logic circuit 12, and an output circuit 13, which is different from the case of using a microprocessor for logic control, and does not require the support of software or firmware, and can maximize Reduce the failure rate, and the response speed of the hardware logic circuit is fast, the cost is low, the cycle of development and verification is short, and the process of safety certification is fast.

The present application also provides a safety control system for an industrial robot, please refer to FIG. 14 , which is a schematic structural diagram of an embodiment of the safety control system of the present application. As shown in FIG. 14 , a safety control system 100 for an industrial robot includes a safety input device 110 , a control cabinet 120 , a servo controller 130 , a main controller 140 and a safety controller 150 . Wherein, the safety input device 110, the control cabinet 120, the servo controller 130, the main controller 140, and the safety controller 150 are the safety input device 50, the control cabinet 20, the servo controller 30, and the main controller disclosed in the above-mentioned embodiments. 40 and the safety controller 10, which will not be repeated here.

Specifically, the safety input device 110 is used to collect hazard trigger signals. Wherein, the hazard trigger signal may include an emergency stop signal, a safety door closing signal, an enabling stop signal, and the like.

The servo controller 130 , the main controller 140 and the safety controller 150 are arranged in the control cabinet 120 , the servo controller 130 is used to control the industrial robot, and the main controller 140 is used to control the servo controller 130 .

Wherein, the safety input device 110 is connected with the servo controller 130 and the main controller 140, and is used to generate a safe torque off instruction based on a dangerous trigger signal under the control of the main controller 140, and the servo controller 130 executes the safe torque off command. Instructions to control the shutdown of industrial robots.

The above is only the implementation of the application, and does not limit the patent scope of the application. Any equivalent structure or equivalent process conversion made by using the specification and drawings of the application, or directly or indirectly used in other related technologies fields, are all included in the scope of patent protection of this application in the same way.

Claims (17)

A safety controller for an industrial robot is characterized in that it is used to be integrated in the control cabinet of the industrial robot, and the safety controller includes: a logic circuit, configured to generate a first safety instruction based on state information of a safety input device of the industrial robot; an output circuit, for connecting with the logic circuit, and for connecting with the servo controller of the industrial robot, for transmitting the first safety instruction to the servo controller, so that the servo controller executing said first security instruction; The diagnostic circuit is used to connect with the output circuit to determine whether the transmission path from the output circuit to the servo controller is faulty. The safety controller according to claim 1, wherein the number of the output circuits is two, and the diagnostic circuit is further used for cross-validating the output signals of the two output circuits; In response to the inconsistency of the output signals of the two output circuits, it is determined that the output circuit fails. The safety controller according to claim 1, wherein the diagnosis circuit is further used for connecting with the servo controller, and for communicating with the servo controller based on the first safety command output by the output circuit A feedback signal to the first safety instruction determines whether a signal transmission channel between the output circuit and the servo controller is faulty. The safety controller according to claim 1, wherein the diagnosis circuit is further used to connect with the logic circuit, and is used to compare the first safety control command output by the output circuit with the output of the logic circuit. The first security instruction is compared; The diagnostic circuit determines that the output circuit is malfunctioning in response to the first safety control command output by the output circuit not consistent with the first safety control command output by the logic circuit. The safety controller according to claim 1, wherein the diagnostic circuit is further used to feed back the fault information of the signal transmission channel or the fault information of the output circuit to the output circuit, and the output circuit feeding back the fault information to the logic circuit, so as to report the fault information to the main controller of the industrial robot through the logic circuit, so that the main controller disables the servo controller; or, The diagnostic circuit is further used to cut off the power supply of the servo controller. The safety controller according to claim 5, wherein the number of the output circuits is two, so as to form two transmission paths, and in response to failure of the two transmission paths, the servo is disabled. controller or cut off the power to the servo controller. The safety controller according to claim 1, characterized in that, the safety controller further comprises: a safety protection circuit, connected to the output circuit and the servo controller respectively, for realizing the control of the output circuit fault protection, and transmit the first safety command output by the safety protection circuit to the diagnosis circuit and the servo controller. The safety controller according to claim 1, wherein the logic circuit comprises: a primary circuit, connected to the input circuit, for integrating and processing the state information of a plurality of the safety input devices; The secondary circuit is respectively connected to the primary circuit and the output circuit, and is used to generate the first safety instruction based on the state information, and transmit the first safety instruction to the output circuit. The safety controller according to claim 8, wherein the number of said secondary circuits is two, and each of said secondary circuits is respectively connected to said primary circuit and said output circuit. The safety controller according to claim 9, characterized in that, the safety controller further comprises: a cross-validation circuit, respectively connected to the two secondary circuits, for outputting the two secondary circuits The signal is cross-validated to determine whether the secondary circuit fails, and the output signal includes at least the status information and the first safety instruction. The safety controller according to claim 10, wherein the number of said primary circuits is two, one said primary circuit is respectively connected to said input circuit and one said secondary circuit, and the other said primary circuit is respectively Connected to the input circuit and another of the secondary circuits. The safety controller according to claim 11, wherein the cross-validation circuit is connected to the two primary circuits respectively, and is used for cross-validating the output signals of the two primary circuits to determine the if the primary circuit fails, The output signal includes the integrated state information. The safety controller according to claim 8, characterized in that, the safety controller further comprises: an interactive circuit, respectively connected to the secondary circuit and the main controller, for obtaining from the main controller The working mode of the industrial robot, so that the secondary circuit generates the first safety instruction based on the state information in the working mode. The safety controller according to claim 13, wherein the secondary circuit is used to receive feedback information from the output circuit, and the secondary circuit transfers the state information, the second Any one or a combination of a safety command, the fault information of the secondary circuit and the fault information of the primary circuit is reported to the main controller. The safety controller according to claim 8, characterized in that, the safety controller further comprises: a reset input acquisition circuit connected to the secondary circuit for inputting a reset signal, and the secondary circuit receives the After the reset signal is received, the first security instruction is cleared based on the status information being normally not triggered. The safety controller according to claim 1, characterized in that, the safety controller further comprises: a power protection circuit connected to the output circuit and the power supply respectively, and the power protection circuit generates a fault based on the failure of the power supply A second safety instruction, the output circuit transmits the second safety instruction to the servo controller, so that the servo controller executes the second safety instruction. A safety control system for an industrial robot, characterized in that it comprises: Safety input device for collecting hazard trigger signals; Control cabinet; A servo controller, arranged in the control cabinet, is used to control the industrial robot; a main controller, arranged in the control cabinet, for controlling the servo controller; A safety controller is arranged in the control cabinet; Wherein, the safety controller is the safety controller according to any one of claims 1-16.

Images