Brooks Automation
P/N: PFD0-DI-00010, Rev 5.0.0, April 9, 2022
Collaborative Robot Safety
Copyright © 2022, Brooks Automation, Inc.
27
2.
Estop circuit for the PFDD Robots.
The PFDD robots have redundant Estop circuits that are
tested by forcing the supply voltage low and checking both circuits to be sure Estop is asserted
before allowing motor power to be enabled. If either Estop is asserted the motor power supply is
shut down after a 1 second delay, AND the motor power amplifiers are disabled.
This Estop
circuit is PLd and CAT 3 if a dual circuit Estop button is attached.
3.
Power failure while the robot is moving.
If AC Power is turned off while the robot is moving, a
fail-safe brake on the Z motor and on axes 4 and 5 of the PFDD6 robot are immediately applied
to ensure that the robot does not collapse under gravity. Note that for robot axes without brakes,
this will result in a controlled deceleration during a one second delay before motor power is
disabled in order to achieve a controlled stop.
4.
Encoder failure at any time.
Precise robots use serial absolute encoders which are checked
every 125 micro seconds for any data or checksum errors on the transmitted data. If 8 data
errors occur in a row (1ms), motor power is shut down. Communication errors are also checked
before allowing motor power to be enabled, and every 4ms thereafter. If 3 communication errors
occur in a row the robot is shut down within 12ms.
As either an encoder failure or a broken wire
between the encoder and controller will shut down the motor power, the encoder circuits are
compliant with CAT 3
.
TUV has verified this fail-safe operation.
5.
Wireless pendant connection failure.
It is possible to drive Precise robots using a wireless
teach pendant, which is in the form of a web server application, in manual mode from a wireless
tablet or laptop. In this case, a heartbeat connection is maintained between the controller and the
wireless pendant. If this heartbeat connection is lost, the robot will stop moving, but power will
remain on (Category 2 soft stop). For this test, the robot is moved under manual control using a
wireless pendant and the wireless router is unplugged. The robot should stop. While the
wireless pendant function supports an Estop, it is not recommended to use this function for a CAT
3 Estop as it is not redundant, although the robot can also be safely stopped by hand.
TUV has
verified this fail-safe operation.
6.
Power amplifier Command or Amp fault.
Both the total current command and the PID
component of the current command are monitored by a separate monitor task for saturation. If
either of these current commands saturate for longer than a specified time, a fault is generated
and the motor power is shut down. All motors in Precise robots are 3 phase brushless
motors. These motors require a rotating electrical field which must switch between the 3 phases
in order for the motor to turn. If a power transistor shorts to one of the power busses, only a
single phase will be energized. The motor will lock up and not turn.
Because a shorted transistor
in the power amp cannot cause uncontrolled motion, this is a fail-safe situation and therefore CAT
3 compliant.
This can be demonstrated on the bench by applying DC power from a power supply
across one of the motor phases. If one of the motor leads is shorted to ground or another motor
lead, the amplifier will detect a fault and shut down within 10 micro seconds.
TUV has verified
this fail-safe operation.
7.
CPU failure or software lockup
. Precise controllers all contain both hardware and separate
firmware watchdog timers that must be refreshed every 4 ms by the software running in the CPU
or the motor power is disabled and the brakes are set.
This circuit is both PLd and CAT 3
compliant.
This can be demonstrated by dropping the CPU into debug mode via the serial debug
port which simulates a software crash. This will disable motor power.
TUV has verified this fail-
safe operation.
