Runaway servo systems and hexapods

Ron,

I was building my current hexapod (Stewart platform) machine using
steppers. Steppers are lower performance, but they are safer
against electrical faults since most faults result in locking the
motors.

I had the machine built and ready to go, but had chosen motors with
far too low torque. By the time I had the anti-backlash system
working on the screws, and the felt wipers in place, there just
wasn't enough torque. I looked at higher torque steppers and
servos, and decided to use servos for higher performance and more
flexibility at what amounted to the same cost.

I then started thinking about the number of failure modes what will
result in a run-away servo:
1 - encoder failure
2 - wiring failure to the encoder
3 - servo drive failure in the encoder receiver circuits
4 - shorted servo drive transistors
5 - others, unknown at this time.

With a hexapod, it is difficult to create a limit switch at the end
of travel that will work. The effective limit of motion for each of
the six legs depends on where in the working envelope the tool is
position and with what tilts. A "home" switch, which is a limit at
the minimum extension is easy, but the other end is not easy, and
may be impossible.

My solution was to add redundant encoders, and monitor them with a
PLD (programmable logic device, in this case an Atmel 1504). I'm
using the Rutex drives, which like the Gecko drives are commanded
with step and direction pulses. Using a PLD, I accumulate
step/direction pulses which are going to the drives, and compare
them with the lower resolution redundant encoders. If they ever are
more than 1/2 turn off, the PLD signals an emergency stop, which
kills the motor DC transformer and shunts a low value resistor
across the power supply.

Of source, having an error detection system requires a way to test
the error correction system, so the step and direction generator is
set up so that pulses can be sent to the servo drives, the checking
system, or both.

The redundant encoders are aluminum disks of 0.025 aluminum which I
cut on my first hexapod, and two optical interrupters.

If either the servo encoders or the redundant encoders fail, there
will be an estop. If the drive shorts, there will be an estop.

I also bring a fault signal from the PLD to the controller which
occurs at 1/2 the error of where the estop is thrown. This might be
useful as a way of detecting an attempt to accelerate the platform
too fast.

I'm curious if you or others have experience with redundant
encoders. Particularly, I'm concerned that I've overlooked
something essential that makes the new machine unsafe. I understand
this doesn't address the problems of errors in the software that
generates the step and direction pulses.

-- Carl


At 09:07 PM 12/2/2004, R Rogers wrote:

While running the mill today and thinking about the runaway servo
issue should an encoder fail. I wondered if an electronic device
could be designed that mounts between the servo leads and the A/B
signal from the encoder. It would monitor the pulse train to the
servo and the signals returning from the encoder. Then be tied into
the E-stop circuit of the control. If a pulse stream was present and
a A/B signal stream was absent it would break a connection and make
the E-stop circuit drop out. Having hard limits at the extremeties
of the envelope seem to be the only protection available and could
result in alot of damage before it ever got there. That would be
great if something would monitor and trip in a very short distance
in the event of a lost encoder. Or would a dithering servo situation
make this impossible? If someone designed one that worked, I'd be
the first customer. Someone mentioned that Geckos fault after a 128
step/count discrepancy. I've heard and seen Marriss mention
the runaway servo issue and dont recall him saying it will stop in
a short distance. He stresses hard limits at the ends of the
travels.

Ron