EPOS4: Motor stop at communication lost?

Topic:

• Is it possible that the EPOS4 stops a motor's motion if there are no commands or data transmitted by the master (PLC, PC, ...) anymore, e.g. due to some failure or interruption of the communication line?

Situation:

It is required by an application that the motor controller (e.g. EPOS4) detects if the data exchange of the supervisor system (= master, e.g. PLC, PC, ...) gets offline. This might happen due to a malfunction of the master or even more likely that the data line might be interrupted. The motor controller should switch to error state automatically and stop a motor's motion then.

Solution:

The answer to this question strongly depends on which bus interface is in use by your system. There are some possible solutions depending on the bus interface mentioned below.  Safety aspects of the required solution and possibly required additional measures might have to be considered in addition (like mentioned by the final section "General remark: Safety standards?").

I.) CANopen:

I.1.) Basics

If there is a CAN interface and a CANopen master (e.g. PLC) in use, the so-called "Heartbeat protocol" is the base to detect some blocked interface communication of a CANopen master or slave devices (e.g. EPOS4).

At least one or even more devices of a CAN network are so-called "Heartbeat producer(s)" while all devices can be so-called "Heartbeat consumers". If a "Heartbeat consumer" does not detect "Heartbeat" messages by the "Heartbeat producer" within a configured period of time, the "Heartbeat consumer" sets itself to a "CAN heartbeat error" state (EPOS4: Error code = 0x8130). The "Heartbeat consumer" (= motor controller) will typically stop the motor and disables the power stage in case of communication error states. In case of an EPOS4 it is possible to select (= configure) the preferred stopping method out of a list.

I.2.) Configuration hints

If the slave (e.g. EPOS4) has to  stop the motor's motion by its own in case there is no communication by the master present anymore, the following configuration is recommended:

• The CANopen master (e.g. PLC) has to be the "Heartbeat producer".
  The necessary configuration has to be done by the object "Producer heartbeat time" (0x1017) of the master or its initial commissioning or system manager tools.
• The CANopen slaves (e.g. EPOS4) have to be "Heartbeat consumers".
  This is configured by the object "Consumer heartbeat time" (0x1016) of each slave or quite easily by EPOS Studio's "CANopen / Error protocol".
  • Rule of thumb:
    "Consumer heartbeat time" >= "Producer heartbeat time" + 20 ms
• EPOS4: Error reaction
  The EPOS4's reaction in case of a "CAN heartbeat error" (and some other communication error states) can be configured by the object "Abort connection option code" (0x6007).

I.3.) CANopen Master: Requirements

The so-called "System manager" or other tools provided by the suppliers of real time CANopen masters (e.g. PLC) typically offer some simple way to configure "Heartbeat" and activate it automatically at system startup.

Hint in case of non real time masters:
Even if there is no real time master (e.g. PC, microcontroller) present, it might be possible to transmit periodical "Heartbeat" messages. These messages have to be generated and transmitted as one task of a cyclic main loop of a master's application code for example. Such application code based solutions might result in a higher variation (i.e. less accuracy) of the periodicity of the "Heartbeat" message if the processing time of the main loop depends on states and actions within its different other tasks. It is recommended to configure the "Consumer heartbeat time" of the slaves more tolerant in such a case, i.e. set it to two or up to five times of the expected master's main loop execution time, e.g.:
"Consumer heartbeat time" = 3 x "Master's main loop processing time"

Restriction of "EPOS Command library":
The "EPOS Command Library" does not support automatic generation of "Heartbeat" messages and in case of an EPOS4 there is also no function call present by the library to generate the required "Heartbeat" message within an application's main loop. If the "EPOS Command library" is in use by a Windows or Linux based system, "Heartbeat" cannot be used.

I.4.) Cross reference

• "EPOS4 Application Notes Collection":
  • Chapter "5.6. Heartbeat Protocol"
• "EPOS4 Firmware Specification":
  • Chapter "6.2.9 Consumer heartbeat time" (Object: 0x1016)
  • Chapter 6.2.89 "Abort connection option code" (Object: 0x6007)
  • Chapter "7.2.34 CAN heartbeat error" (Error code: 0x8130)
• EPOS Studio's "CANopen Wizard / Error Protocol":
  

II.) EtherCAT communication:

II.1.) Basics

An EtherCAT network does not require a specific configuration to detect problems caused by interrupted communication lines. EtherCAT is always based on a cyclic data data exchange (typ. every 1 - 5 ms) in operational state. If the data exchange is not present anymore, each device can trigger its error state. In case of an EPOS4 it is the "EtherCAT communication error" (= error code: 0x8180). The EPOS4's reaction in case of a communication error state can be configured by the object "Abort connection option code" (Object: 0x6007).

II.2.) Cross reference

• "EPOS4 Firmware Specification":
  • Chapter 6.2.89 "Abort connection option code" (Object: 0x6007)
  • Chapter "7.2.36 EtherCAT communication error" (Error code: 0x8180)

III.) RS232 and USB

III.1.) Basics

Due to the fact there is no periodic data exchange mandatory by the RS232 and USB protocol it is impossible for an EPOS4 (or EPOS2) to judge if there is actually no data transmitted by the master or the communication is interrupted due to some broken data line (or master's malfunction).

III.2) Workaround

The following configuration and wiring enables the master to command a motor stop if the communication line does not work anymore. Preconditions for the described solution are that the master (e.g. Raspberry Pi, microcontroller) has at least one digital output and the master as well as the EPOS4 do still work properly.

• One of EPOS4's digital inputs has to be configured as "Quick stop".
  
  
  
• The master polls an EPOS4's object content periodically (e.g. every 100 ms).
  • Hint:
    The most useful objects for cyclic polling are typically the "Statusword" (0x6041) or "Position actual value" (0x6064). Most applications will require the updated data of these objects again and again anyway.
    
    
• If the master does not get a reply to the object request by the EPOS4 anymore (i.e. a time-out is present), this is typically an indication for a disturbed or interrupted communication line. The master can set its digital output then which triggers the EPOS4's "Quick stop" reaction.
  Preconditions: This stopping method presumes that ...
  
  • ... the master still works fine and is able to set the digital output.
  • ... the I/O line is not broken too.
  • ... the EPOS4 is still working fine and can react on the "Quick stop" signal.

General remark: Safety standards?

Please be aware that all of the solutions mentioned above cannot(!!) fulfill specific safety requirements or safety standards (SIL ...). If the final device or machine has to fulfill specific safety standards or there is some risk of human injury, there might be the need for a separate and certified safety controller which can "safely" stop the motor in case of a critical malfunction of a component (master, slave, or wiring).