SAFETY TORQUE OFF DEVICE FOR INTERRUPTING THE GENERATION OF TORQUE BY AN ELEVATOR INSTALLATION DRIVE MACHINE SUPPLIED BY A POWER SUPPLY DEVICE

Abstract

A safety torque off (STO) device interrupts torque generation by an elevator installation drive machine supplied by a power supply device being part of an inverter device, for example. The STO device includes a control input, signal input terminals connected to signal generation device outputs and signal output terminals connected to driver circuit inputs. Each of the STO signal input terminals is electrically connected to an associated one of the signal generation device outputs via first and second signal transmission switches connected in series. The control input is connected to first and second control units, wherein the first control unit, controlled by a control signal applied to the control input, switches switching states of all the first signal transmission switches and the second control unit, controlled by a control signal applied to the control input, switches switching states of all of the second signal transmission switches.

Claims

1-12. (canceled)

13. A safety torque off device for interrupting a generation of torque by an elevator installation drive machine supplied by a power supply device, wherein the power supply device includes a power input, a power output, a plurality of power switches connected to the power input and to the power output, and a driver circuit controlling the power switches, wherein the power supply device operates such that an electrical power applied to the power input is at least partially passed on to the power output under control of the driver circuit and the power switches as a function of signals applied by a signal generator device from a plurality of first signal outputs to a plurality of first signal inputs of the driver circuit, the safety torque off device comprising: a control input, a plurality of second signal inputs and a plurality of second signal outputs, wherein each of the first signal outputs of the signal generating device is selectively connectable to an associated one of the second signal inputs and each the first signal inputs of the driver circuit is selectively connectable to an associated one of the second signal outputs; wherein each of the second signal inputs is connected in series to the associated first signal output by a first signal transmission switch and a second signal transmission switch connected in series when both the first signal transmission switch and the second signal transmission switch are switched to a conductive switching state; and wherein the control input is electrically connected to a first control unit and a second control unit, the first control unit being controlled by a control signal applied to the control input to switch all of the first signal transmission switches between the conductive switching state and a non-conductive switching state, and the second control unit being controlled by the control signal applied to the control input to switch all of the second signal transmission switches between the conductive switching state and the non-conductive switching state.

14. The safety torque off device according to claim 13 including six of the second signal inputs and six of the second signal outputs.

15. The safety torque off device according to claim 13 wherein each of the first and second signal transmission switches is a normally conductive semiconductor switch that, in an absence of a control voltage at a gate terminal thereof, establishes an electrical connection between an associated one of the second signal inputs and a ground potential and, when the control voltage is applied to the gate terminal, interrupts the electrical connection between the associated second signal input and the ground potential, and wherein the first and second control units apply the control voltage to the gate terminals of the first and second signal transmission switches respectively as a function of the control signal applied to the control input.

16. The safety torque off device according to claim 15 wherein each of the first and second control units includes an optocoupler adapted, as a function of the control signal applied to the control input, to establish the control voltage at the gate terminals of the first and second signal transmission switches.

17. The safety torque off device according to claim 16 wherein each of the optocouplers includes a light source activated by the control signal applied to the control input and a photodiode unit generating the control voltage in response to illumination by the light source.

18. The safety torque off device according to claim 17 wherein the photodiode units each have two photodiodes connected in series.

19. The safety torque off device according to claim 13 in accordance with a safety integrity level SIL3 and a hardware fault tolerance of at least 1.

20. The safety torque off device according to claim 13 excluding any programmable components.

21. An inverter device for providing electrical drive power for an elevator installation drive machine, the inverter device comprising: a signal generator device generating control signals at a plurality of first signal outputs; a power supply device having a power input, a power output, a plurality of power switches connected to the power input and to the power output, and a driver circuit controlling the power switches, wherein the power supply device passes an electrical power applied to the power input at least partially to the power output under control of the power switches and the driver circuit as a function of the control signals generated by a signal generator device from the first signal outputs to first signal inputs of the driver circuit; and a safety torque off device according to claim 13 wherein each of the first signal outputs of the signal generator device is connected to one of the second signal inputs of the safety torque off device and each of the first signal inputs of the driver circuit is connected to one of the second signal outputs of the safety torque off device.

22. The inverter device according to claim 21 wherein the signal generator device is a digital signal processor.

23. The inverter device according to claim 21 wherein the power supply device includes an IGBT driver circuit, three upper IGBTs and three lower IGBTs, wherein the upper and lower IGBTs are activated by the IGBT driver circuit as a function of the control signals generated by the signal generator device, the control signals being passed through the safety torque off device, to pass on electrical power present at the power input at least partially to the power output.

24. An elevator installation comprising: an inverter device according to claim 21; a main power source providing electrical power at the power input of the power supply device of the inverter device; and an electric drive machine connected to the power output of the power supply device.

Description

DESCRIPTION OF THE DRAWINGS

[0058] FIG. 1 shows an elevator system according to an embodiment of the present invention.

[0059] FIG. 2 shows an inverter device according to an earlier concept.

[0060] FIG. 3 shows an inverter device according to an embodiment of the present invention.

[0061] FIG. 4 shows a circuit for a safety torque off device according to an embodiment of the present invention.

[0062] The drawings are merely schematic and not true to scale. Like reference signs refer to like or equivalent features in the various drawings.

DETAILED DESCRIPTION

[0063] FIG. 1 shows an elevator installation 1 having an elevator car 3 and a counterweight 5, which can be displaced vertically by a drive machine 9 within an elevator shaft with the aid of a suspension element 7. The drive machine 9 is supplied with electrical power by an inverter device 11. The inverter device 11 comprises a power supply device 13 which is fed with electrical power from a main power source 71 (FIG. 3) at a power input 21 and which is controlled by a signal generator device 17 via signals.

[0064] If necessary, for example if the elevator car 3 stops on a floor and elevator doors are open to enable passengers to get on or off, it may be necessary to ensure that the elevator car 3 is not temporarily moved under any circumstances.

[0065] It has long been customary for elevator installations to equip static inverters with switches, relays or contactors in order to be able to safely and reliably disconnect the power supply from the drive machine 9.

[0066] Such switches, relays or contactors are now to be replaced by the use of electronic circuits. Such electronic circuits can be advantageous in terms of lower cost, lower noise and/or higher reliability than conventional switches, relays or contactors.

[0067] For this purpose, a safety torque off device 15 is connected between the signal generator device 17 and the power supply device 13, with the aid of which torque generation of the drive machine 9 supplied by the power supply device 13 can be reliably interrupted. The signal generator device 17 and the safety torque off device 15 are jointly part of an inverter control 19.

[0068] Official regulations such as the European standards EN61800-5-2:2007 and EN81-20:2014 or their previous version EN81.1:1998 specify specifications and requirements that must be taken into account when building or operating elevator installations.

[0069] In addition to these specifications and requirements, the following additional specifications can be defined, which can have a substantial influence on the design of a circuit for a safety torque off device:

i) In order to avoid software becoming part of a certification of elevator components, it may be preferable to implement the safety torque off device without using any programmable logic components. This measure can reduce expenditure for maintenance or the like.
ii) The safety torque off device should be able to be used for or in inverter devices from different manufacturers and thus with different construction concepts. This requirement can have a significant impact on the safety function. Earlier concepts of safety torque off devices could be designed in the manner shown in FIG. 2. They consisted of a 2-channel structure, each of which could either interrupt the PWM signals to the three upper IGBTs or the three lower IGBTs of a power supply device. Failure in one of the channels resulted in either the top or bottom IGBTs not being interrupted. It was believed that turning off all of the top IGBTs or all of the bottom IGBTs would be sufficient to prevent the inverter from inducing a rotating field in the AC motor of the connected drive machine, which would build up torque and cause the motor to rotate. Therefore, it had to be possible to rule out crosstalk between the PWM signals for the upper side and for the lower side in the IGBT gate driver circuit. However, such a malfunction cannot be reliably ruled out for certain power modules. Therefore, as described further below, the circuit for the safety torque off device was added as shown in FIG. 3. In this way, even in the event of a fault in one of the channels, the power from the drive machine is reliably disconnected, even in the event of a fault in the power unit.
iii) The circuit of the safety torque off device should preferably be implemented in the inverter control or on its circuit board, which can be used unchanged in various inverter variants. Such a procedure can reduce the effort required to certify each variant of inverters.
iv) The circuit of the safety torque off device should be certified according to EN81-20:2014 and EN81-1:1998 in order to be able to use the inverter in regions where the new standard is not accepted.

[0070] As a consequence, it may be preferable to implement the switching of the safety torque off device in accordance with EN61800-5-2:2007 with a safety integrity level SIL3 and a hardware fault tolerance of at least 1 as well as in accordance with EN81-1: 1998 § 14.1, which increases the necessary hardware fault tolerance to meet the requirements of the fault tree, i.e., for example, to meet a fault tolerance of three components (transistors) in EN81.

[0071] Taking into account the specified specifications and requirements, a safety torque off device 15 is therefore proposed for an inverter device 11, as is shown by way of example in FIG. 3. The inverter device 11 differs from the earlier concept shown in FIG. 2 mainly with regard to the structure of the safety torque off device 15.

[0072] The inverter device 11 is supplied with electrical power in the form of a three-phase current at a power input 21 by a main power source 71. In the power supply device 13 of the inverter device 11, the electrical power supplied is conducted to power switches 25 in the form of three upper IGBTs 67 and three lower IGBTs 69. Depending on the switching state of the IGBTs 67, 69, the electrical power is then passed on to a power output 23 of the power supply device 13. The elevator installation 1 drive machine 9 is connected to this power output 23.

[0073] The IGBTs 67, 69 are controlled by a common driver circuit 27 in the form of an IGBT driver circuit 65. The IGBT driver circuit 65 controls each of the three upper and three lower IGBTs 67, 69 in response to PWM signals which were generated by the signal generating device 17 in the inverter control 19.

[0074] In order to be able to interrupt the forwarding of the PWM signals from the signal generator device 17 to the driver circuit 27 if necessary, the safety torque off device 15 is connected between the signal generator device 17 and the driver circuit 27. Each of six signal outputs 29 of the signal generator device 17 is connected to a signal input terminal 35 of the safety torque off device 15. Furthermore, each of six signal inputs 31 of the driver circuit 27 is connected to a signal output terminal 37 of the safety torque off device 15.

[0075] In contrast to the earlier concept shown in FIG. 2, in which only a single signal transmission switch 38 was provided between each of the signal input terminals 35 and the assigned signal output terminal 37 in the safety torque off device 15, the concept presented here provides, between each of the signal input terminals 35, two signal transmission switches 39, 41 connected in series with the associated signal output terminal 37. By switching both the first signal transmission switch 39 and the second signal transmission switch 41 to a conducting state, an electrically conducting connection can be established between the respective signal input terminal 35 and the associated signal output terminal 37.

[0076] In order to be able to switch the switching states of the first and second signal transmission switches 39, 41 independently of one another, a first control unit 43 and a second control unit 45 independent of this are provided in the safety torque off device 15 (shown only very schematically in FIG. 3). Both control units 43, 45 are electrically connected to a control input 33 of the safety torque off device 15 and can receive via this control input 33, for example, a control signal to be used to control a temporary interruption of the torque generation of the drive machine. For example, such a control signal can be supplied by a safety chain of the elevator installation 1. The first control unit 43 switches the switching states of all the first signal transmission switches 39, whereas the second control unit 45 controls the switching states of all the second signal transmission switches 41.

[0077] In FIG. 4, a possible embodiment of a circuit for a safety torque off device 15 is shown.

[0078] The control input 33 is electrically connected both to the first control unit 43 and to the second control unit 45. Each of the two control units 43, 45 has its own optocoupler 53. A light source 57, for example in the form of an LED, is provided in the respective optocoupler 53. Depending on the control signal applied to the control input 33, the light source 57 is excited to emit light or not. The optocoupler 53 also has a photodiode unit 59. The photodiode unit 59 is galvanically decoupled from the rest of the optocoupler 53 and in particular from the control input 33. Each photodiode unit 59 comprises two photodiodes 61 which are connected to one another in series. When light strikes the photodiodes 61, they generate an electrical voltage similar to a solar cell.

[0079] Each photodiode unit 59 is connected on one side to a ground potential 55 and on an opposite side to gate terminals 49 of a plurality of semiconductor switches 47. In the example shown, the photodiode unit 59 of the optocoupler 53 of the first control unit 43 is connected to the gate terminals 49 of semiconductor switches 47, which serve as second signal transmission switches 41, whereas the photodiode unit 59 of the optocoupler 53 of the second control unit 45 is connected to the gate terminals 49 of semiconductor switches 47 serving as first signal transmission switches 39.

[0080] The semiconductor switches 47 are designed as switches that are electrically conductive in the normal state and are connected in such a way that, in the absence of a control voltage at the respective gate terminal 49, they establish an electrical connection between one of the signal input terminals 35, to which a drain terminal or a source terminal of the semiconductor switch 47 is connected, and a ground potential 51. In this case, any electrical voltage signal that may be present at the respective signal input terminal 35 is diverted via the semiconductor switch 47 to the ground potential 51 and thus cannot be passed on to the signal output terminal 37 electrically connected to the signal input terminal 35. A transmission of signals from the signal generator device 17 that are present at the signal input terminals 35 is thus reliably interrupted in the absence of a control voltage at the gate terminals 49.

[0081] Only when a control signal is present at the control input 33 of the safety torque off device 15, which causes the light sources 57 of the two optocouplers 53 to send light to the respective photodiode unit 59 and the photodiodes 61 then jointly generate a sufficiently high control voltage at the gate terminals 49 of all of the semiconductor switches 47 to them, can the semiconductor switches 47 switch to a non-conductive state. This interrupts the electrical connection between the signal input terminals 35 and the ground potential 51, so that the signals from the signal generator device 17 are passed on to the respective signal output terminals 37. In response to the receipt of these signals, the driver circuit 27 connected to it can then activate the power supply device 13 to pass a desired electrical power through to the drive machine 9.

[0082] In summary and in other words, the circuit for the safety torque off device 15 can be implemented with the topology shown in FIG. 4. The input of the safety chain is used to control the LEDs of two optocouplers 53. The photovoltaic outputs of the optocouplers, which are designed with a plurality of photodiodes connected in series, are used to activate the gates of normally conducting semiconductor components. As long as no voltage is applied to their gates, for example due to switched off LEDs in the optocoupler or a malfunction in an optocoupler, the six PWM signals generated by the DSP 63 in FIG. 3 are short-circuited to the ground potential GND and are therefore prevented from passing through to the power unit. As soon as the LEDs of the optocouplers are activated, a negative voltage is applied to the gate terminals of the semiconductor switches, which causes them to become high-impedance. As a result, the six PWM signals are passed unchanged through the circuit of the safety torque off device.

[0083] The topology used for the safety circuit of the safety torque off device can enable the following significant advantages:

[0084] The electrical or electronic system of the safety torque off device can be placed in the inverter control or on the inverter control board. It can therefore be used for different versions of static inverters without the need for further certification of the safety function.

[0085] Since there are no requirements for the power supply device or the power board, this is not part of the certification.

[0086] The forwarding of the signals present at the signal input terminals of the safety torque off device to the ground potential is better suited for different topologies of power supply devices. This reduces the need to add additional driver circuits afterwards.

[0087] Since the safety circuit is built on an error-proof principle, there are no error states that can be detected. It is therefore no longer a requirement to open the safety circuit after each trip, which can simplify the construction of the elevator control.

[0088] The safety circuit is only supplied with power by the safety circuit itself and does not require any additional supply.

[0089] The safety chain no longer needs to feed large coils of switches, relays or contactors, so that its own power supply including a copper wire diameter in the conducting cables can be reduced.

[0090] In summary, the proposed safety torque off device can consist of a cost-efficient and robust electrical or electronic system that meets all requirements. A higher effort compared to previously used solutions can provide substantial advantages in terms of maintenance. In addition, there are no requirements for the connected power supply device and the safety circuit.

[0091] Finally, it should be noted that terms such as “comprising,” “having,” etc. do not preclude other elements or steps and terms such as “a” or “an” do not preclude a plurality. Furthermore, it should be noted that features or steps that have been described with reference to one of the above embodiments may also be used in combination with other features or steps of other embodiments described above.

[0092] In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.