Re: [CAD_CAM_EDM_DRO] Safety -- servo vs. stepper

Leslie M. Watts wrote:

>Servo run away issues are always of concern, but I wouldn't
>let them prevent me from using a servo's performance advantages.
>
>I do think about this though... I am pushing around 800+ pounds
>at high speed!
>
>My primary machine protection is a hardwired e-stop at ends of travel
>followed by a shock absorber tuned to dissipate the kinetic energy
>in a specific distance. The e-stop also shorts the servos with a ten
>ohm resistor to aid braking.
>
>As I think about it runaways would be caused by two basic scenarios:
>
>1) the computer/interface fails or locks up
>
>2) A servo amp output stage fails such that most of the supply
>voltage is applied to the motor.
>
>A watchdog of some kind might be the best way to deal with (1).
>I do not know if my emc control is set up for this (I think not). To work
>the computer would have to send a signal periodically to the hardwired
>estop system to keep it enabled. There is a estop_write bit on emc, but it
>is a continuous level and could easily fail in an enable mode.
>
>So what is needed here is a real time function that priodcally spits
>out a pulse THRU the interface card (so it's function is also checked).
>This might be pretty easy to do perhaps using an extra axis DAC.
>
>

A true servo system where the feedback loop is processed through the
CNC computer already has to update the velocity DACs every servo cycle.
I have a hardware (CMOS analog, even!) watchdog that can cause an
all-hardware E-stop if the computer fails to update the velocity controlling
part of the interface. On the PPMC (analog servo) it is on the DACs.
On the UPC (PWM servo) it is on the PWM generators. And, on
the Universal stepper controller, it is on the step rate generators.

>
>Now for (2) (servo amp short) something might work that continually compares
>the output current to the input voltage , at least for DC types. If it fails
>to be a reasonable facimile of a voltage controlled current source hard
>wired
>e-stop could be actuated. This also might be pretty easy to do.
>
>

This will cover a transistor failure, but might not detect a broken
velocity command
wire, failed encoder or broken encoder wire, etc. As long as the
encoders are
working, you really don't have to worry about much, the computer will
call for an estop if the machine suddenly takes off. That covers pretty much
any servo amp failure, as long as the E-stop cuts power to the servo amps.

So, the remaining failure mode you have to watch out for is a failed
encoder.
A bad connection on the power wire, or a short or open on either A or B
will cause it to no longer transmit continuous motion to the computer.
This will cause a servo runaway that the computer is not aware of, so that
is a real problem that needs to be taken care of. My system has the
overcurrent
trip set pretty sensitive, so the amp will fault in the event of a
runaway due
to either the encoder or DC tach failing. This is the case where the
computer
senses no motion, and sends a rapidly rising velocity command to the amp.

>A second at least partial safety that I use now is a software velocity limit
>a bit lower than the system can do at full tilt. If the velocity (checked by
>monitoring a separate tach) exceeds the soft limit e-stop is actuated.
>
>

Ah! Allen Bradley had something like this on the 7320 series of CNC
controls.
They computed an analog velocity from the tach signal, and compared it
to the
DC tach value. If the tach value exceeded the computed encoder velocity by
20%, that caused an estop. Of course, in those days, encoder failures were
VERY common, as the light bulbs would burn out every few months.
They also compared the two signals in each differential pair from the
encoder,
and if they remained the same for over one uS, that caused an e-stop.

>
>
>

Jon