HK1207354B - Drive device of an elevator - Google Patents

Description

Drive device for elevator

Technical Field

The invention relates to a safety system of a drive apparatus of an elevator.

Background

In elevator systems, there must be safety systems according to safety regulations, by means of which the operation of the elevator system can be stopped, for example as a result of a fault or an operating error. The aforementioned safety system comprises a safety circuit comprising a safety switch in series, the switch measuring the safety of the system. The opening of the safety switch indicates that the elevator system has been compromised. In this case the operation of the elevator system is interrupted and the power supply from the electricity network to the elevator motor is disconnected by means of the contactors, bringing the elevator system into a safe state. Further, the supply of current to the electromagnet of the mechanical brake is disconnected using the contactor, thereby activating the mechanical brake.

Contactors as mechanical elements are unreliable because the contactors only withstand a certain amount of current opening. The contacts of the contactor may also weld closed if the contacts of the contactor are overloaded, in which case the ability of the contactor to break the current is terminated. A failure of the contactor may thus lead to a loss of safety in the elevator system.

As the element, the contactor is large-sized, and thus the equipment including the contactor also becomes large. On the other hand, the general aim is to utilize the building space as efficiently as possible, in which case the deployment of large-sized elevator elements containing contactors may cause problems.

Therefore, there will be a need to find a solution that reduces the number of contactors in an elevator system without compromising the safety of the elevator system.

The present invention aims to address one or more of the above disadvantages. One object of the invention is to disclose a drive apparatus of an elevator implemented without contactors.

In order to achieve this object, the invention discloses a drive apparatus of an elevator according to claim 1. Preferred embodiments of the invention are described in the dependent claims. Some embodiments of the invention and combinations of different embodiments of the invention are also provided in the description part and drawings of the present application.

Disclosure of Invention

The drive apparatus of the elevator according to the invention comprises a direct current bus and a motor bridge (motor bridge) connected to the direct current bus for the power supply of the elevator motor. The motor bridge includes a high side switch and a low side switch for supplying power from the dc bus to the elevator motor when driving with the elevator motor and also supplying power from the elevator motor to the dc bus when braking with the elevator motor. The driving apparatus includes: a control circuit of the engine bridge, by means of which the operation of the engine bridge is controlled by generating control pulses in the control poles of the high-side and low-side switches of the engine bridge; a brake controller including a switch for supplying power to a control coil of the electromagnetic brake; a brake control circuit for controlling the operation of the brake controller by generating a control pulse in a control electrode of a switch of the brake controller by the brake control circuit; an input circuit for a safety signal that can be disconnected and connected from outside the drive device; drive prevention logic (drive prevention logic) connected to the input circuit and configured to prevent (present) passage of a control pulse to a control pole of a high-side switch and/or a low-side switch of the engine bridge when the safety signal is turned off (past); and brake drop-out logic (brake drop-out logic) connected to the input circuit and configured to prevent passage of control pulses to a control pole of a switch of the brake controller when the safety signal is turned off. A direct current bus here denotes a direct voltage power bus, i.e. a part of a main circuit conducting/transmitting electric power, such as a bus bar of a direct current intermediate circuit of a frequency converter.

Thus, with the drive prevention logic according to the invention, the power supply from the direct current bus via the motor bridge to the elevator motor can be disconnected without a mechanical contactor by preventing the passage of control pulses to the control pole of the high-side switch and/or the low-side switch. Likewise, with the brake drop logic according to the invention, the power supply to the control coil of each electromagnetic brake can be disconnected without mechanical contactors by blocking the passage of control pulses to the control pole of the brake controller. The switches of the brake controller and the high-side and low-side switches of the motor bridge are most preferably solid state switches such as IGBT transistors, MOSFET transistors or bipolar transistors.

In a preferred embodiment of the invention, the aforementioned brake controller is connected to the dc bus and the brake controller comprises the aforementioned switch for supplying power from the dc bus to the control coil of the electromagnetic brake. Thus, the energy returned to the dc bus in connection with the braking of the elevator engine can also be utilized in the brake control, thereby increasing the efficiency ratio of the drive machinery of the elevator. Furthermore, the main circuit of the drive apparatus of the elevator is simplified when no separate power supply of the brake controller needs to be arranged in the drive apparatus.

The invention enables the integration of the power supply appliance of the elevator engine and the brake control into the same drive appliance, preferably into the frequency converter of the hoisting machine of the elevator. This is of utmost importance, since the combination of the power supply appliance of the elevator engine and the brake control is indispensable from the point of view of the safe operation of the hoisting machine of the elevator and thus from the point of view of the safe operation of the entire elevator. The drive apparatus according to the invention can also be connected via a safety signal as part of the safety gear of the elevator, in which case the safety gear of the elevator is simplified and can be implemented easily in many different ways. Furthermore, the combination of the safety signal, the drive prevention logic and the brake drop logic according to the invention enables a complete implementation of the drive device without mechanical contactors, using only solid state elements. Most preferably, the input circuit for the safety signal, the brake drop logic and the drive prevention logic are implemented with discrete solid state elements only, i.e. without an integrated circuit. In this case, it is advantageous to analyze the effect of EMC disturbances in different fault situations and, for example, from the outside of the drive apparatus to the input circuit of the safety signal, which is also advantageous for connecting the drive apparatus to different elevator safety devices.

The solution according to the invention thus simplifies the structure of the drive device, reduces the size of the drive device and improves reliability. In addition, when the contactor is removed, the interference noise generated by the operation of the contactor is also removed. The simplification of the drive apparatus and the reduction in size of the drive apparatus enable the drive apparatus to be deployed at the same position in the elevator system as the hoisting machine of the elevator. Since high power currents flow in the current conductors between the drive means and the hoisting machine of the elevator, the deployment of the drive means at the same location as the hoisting machine of the elevator enables shortening or even removal of the current conductors, in which case also the EMC disturbances generated by the operation of the drive means and the hoisting machine of the elevator are reduced.

In a preferred embodiment of the invention, the drive prevention logic is configured to allow passage of control pulses to the control poles of the high-side and low-side switches of the motor bridge when the safing signal is connected, and the brake drop logic is configured to allow passage of control pulses to the control poles of the switches of the brake controller when the safing signal is connected. The elevator can thus be operated only by connecting the safety signal, in which case the safety gear of the elevator is simplified.

In a preferred embodiment of the invention, the drive device comprises indicator logic for forming a signal for enabling the start of operation. The indicator logic is configured to activate a run enable signal when the drive prevention logic and the brake drop logic are both in a state to prevent passage of a control pulse, and the indicator logic is configured to de-activate the run enable signal if at least either of the drive prevention logic and the brake drop logic is in a state to allow passage of a control pulse. The drive device includes an output for indicating to monitoring logic external to the drive device a signal that allows for run initiation.

In a preferred embodiment of the invention, the power supply to the drive prevention logic is arranged via a signal path of the safety signal, and the signal path of the control pulses from the control circuit of the motor bridge to the drive prevention logic is arranged via an isolator.

In a preferred embodiment of the invention the power supply to the brake drop logic is arranged via the signal path of the safety signal and the signal path of the control pulse from the brake control circuit to the brake drop logic is arranged via an isolator.

By arranging the power supply to the drive blocking logic/brake drop logic via the signal path of the safety signal, it can be ensured that upon disconnection of the safety signal, the power supply to the drive blocking logic/brake drop logic is disconnected and the passage of the control pulse to the selected control pole of the switches of the engine bridge and brake controller is thus terminated. In this case, by opening the safety signal, the power supply to the engine and the control coil of the electromagnetic brake can be disconnected in a fail-safe manner without separate mechanical contactors.

In this context, an isolator refers to an element that breaks the passage of charge along a signal path. Thus, in an isolator, the signal is transmitted, for example, as electromagnetic radiation (an optical isolator) or via a magnetic or electric field (a digital isolator). By using an isolator, the passage of charge carriers from the control circuit of the engine bridge to the drive prevention logic and from the brake control circuit to the brake drop logic is prevented, for example, when the control circuit/brake control circuit of the engine bridge fails and is short circuited.

In the most preferred embodiment of the invention, the drive prevention logic comprises a bipolar or multipolar signal switch via which the control pulse travels to the control pole of the switch of the motor bridge, and at least one pole of the signal switch is connected to the input circuit (i.e. to the signal path of the safety signal) in the following manner: when the safety signal is switched off, the signal path of the control pulse through the signal switch is interrupted.

In a preferred embodiment of the invention, the aforementioned signal switch that drives the prevent logic/brake drop logic is a transistor, via its control gate, that controls the pulse to travel to the photodiode of the opto-isolator of the controller of the IGBT transistor. In this case, the signal path of the control pulse to the gate of the transistor is configured to travel via a metal film resistor (MELF resistor). The aforementioned transistor may be, for example, a bipolar transistor or a MOSFET transistor.

In a preferred embodiment of the invention, the aforementioned signal switch is fitted in conjunction with the control pole of each high-side switch of the motor bridge and/or in conjunction with the control pole of each low-side switch of the motor bridge.

In a preferred embodiment of the invention, the aforementioned power supply occurring via the safety signal is configured to be disconnected by disconnecting the safety signal.

In a preferred embodiment of the invention, the drive device comprises a rectifier connected between the ac power source and the dc bus.

In a preferred embodiment of the invention, the drive device is fully realized without mechanical contactors.

The drive apparatus according to the invention is suitable for use in an elevator safety device comprising: a sensor configured to monitor a function important from the viewpoint of safety of the elevator; an electronic monitoring unit containing an input for data formed by the aforementioned sensors monitoring the safety of the elevator; and a drive apparatus according to the invention for driving the hoisting machine of an elevator. A signal conductor for a safety signal is led from the electronic monitoring unit to the drive device. The electronic monitoring unit comprises means for disconnecting/connecting the safety signal from/to the input circuit of the drive device. The electronic monitoring unit is arranged to bring the elevator into a state preventing operation by disconnecting the safety signal and to remove the state preventing operation by connecting the safety signal. Thus, by disconnecting the safety signal with the electronic monitoring unit, the elevator can be brought into a safe state, in which case the power supply from the direct current bus to the elevator motor is terminated and the machinery brake is activated to brake the movement of the traction sheave of the hoisting machine of the elevator when the safety signal is disconnected.

A signal allowing the start of operation may be directed from the drive device to the electronic monitoring unit, and the electronic monitoring unit may be configured to read the state of the signal allowing the start of operation when the safety signal is switched off. The electronic monitoring unit may be arranged to: the operation of the elevator is prevented if the signal allowing the start of operation is not activated when the safety signal is switched off. In this case, the electronic monitoring unit may monitor the operating conditions of the drive prevention logic and the brake drop logic based on the signal that allows the run to be initiated. For example, if the signal to allow run initiation is not active, the electronic monitoring unit may infer that at least one or the other of the drive prevention logic and the brake drop logic is faulty.

A data transmission bus can be formed between the electronic monitoring unit and the drive apparatus, and the drive apparatus can contain an input for measuring data of a sensor for measuring the state of motion of the elevator. The electronic monitoring unit can be arranged to receive measurement data from sensors measuring the state of motion of the elevator via a data transmission bus between the electronic monitoring unit and the drive apparatus. The electronic monitoring unit thus detects quickly a malfunction of the sensors or measuring electronics measuring the state of motion of the elevator, in which case the elevator system can be transferred to a safe state as quickly as possible under the control of the electronic monitoring unit. In this case, the electronic monitoring unit can also monitor the operation of the drive apparatus without separate monitoring components, for example during emergency braking, in which case the emergency braking can be carried out by engine braking with a controlled deceleration under the control of the electronic monitoring unit, so that the forces exerted on the elevator passengers during the emergency stop are reduced. That is, excessive force during an emergency stop may cause an elevator passenger to experience unpleasant sensations or even create a truly dangerous condition.

The drive apparatus according to the invention is also suitable for use in an elevator safety device comprising: safety circuit comprising mechanical safety switches fitted in series with each other, which safety switches are configured to monitor functions that are important from the point of view of the safety of the elevator. The signal conductor of the safety signal can be led from the safety circuit to the drive device. The safety circuit may comprise means for disconnecting the safety signal from the input circuit of the drive device and for connecting the safety signal to the input circuit of the drive device. The safety signal may be configured to be disconnected from the input circuit of the driving device by opening a safety switch in the safety circuit. The drive device according to the invention can thus be connected as part of an elevator safety arrangement with a safety circuit by connecting the drive device to the safety circuit via a safety signal.

The safety device may comprise an emergency drive device connected to a dc bus of the drive device. The emergency drive apparatus may comprise a secondary power source, whereby during a failure of the primary power source of the elevator system, power may be supplied to the dc bus. Both the emergency drive and the drive can be realized completely with mechanical contactors. In the safety device, the structure and placement of the drive prevention logic and the brake drop logic also enable disconnection of the ongoing power supply from the secondary power source to the elevator motor and the electromagnetic brake via the dc bus without mechanical contactors.

The aforementioned secondary power source may be, for example, a generator, a fuel cell, a battery, a super capacitor (supercapacitor), or an inertia wheel. If the secondary power source is rechargeable (e.g. a battery, a supercapacitor, a flywheel, some type of fuel cell), the electric power returned to the dc bus via the engine bridge during braking of the elevator engine can be charged into the secondary power source, in which case the efficiency ratio of the elevator system is increased.

In a preferred embodiment of the invention, the drive prevention logic is configured to prevent passage of control pulses to the control pole of only the high-side switch of the motor bridge, or alternatively to prevent passage of control pulses to the control pole of only the low-side switch of the motor bridge, when the safety signal is switched off. In the same context, the use of the bridge part of the control motor bridge in the manner described in international patent application No. WO 2008031915 a1 achieves dynamic braking of the elevator motor without any mechanical contactors, in which case dynamic braking from the elevator motor to the dc bus is possible even if the safety signal is switched off and the power supply from the dc bus to the elevator motor is thus prevented. The energy returned in dynamic braking can also be charged into the secondary power source of the emergency drive device, thereby increasing the efficiency ratio of the elevator system.

In the most preferred embodiment of the invention both the drive prevention logic and the brake drop logic are implemented in the drive apparatus of the elevator using only solid state elements. In a preferred embodiment of the invention, the indicator logic is implemented in the drive apparatus of the elevator using only solid-state elements. Solid-state components are preferred over mechanical components such as relays and contactors, especially because of their better reliability and quieter operating noise. As the number of contactors decreases, the wiring of the safety system of the elevator becomes simpler, because separate wiring is usually required for connecting the contactors.

In some embodiments of the invention the drive equipment and Safety arrangement of the elevator can be implemented without indicator logic, because by means of the brake drop logic and the drive prevention logic designed according to the invention, a very high Safety Integrity Level (Safety Integrity Level) can be achieved per se, even a Safety Integrity Level SIL 3 according to the EN IEC 61508 standard, in which case separate measurement feedback (signal to allow run initiation) on the operation of the drive prevention logic and the brake drop logic is not necessarily required.

According to the present invention, with a component to be arranged outside the drive device, the safety signal is disconnected by disconnecting/preventing the passage of the safety signal to the input circuit, and with a device to be arranged outside the drive device, the safety signal is connected by allowing the passage of the safety signal to the input circuit.

In a preferred embodiment of the invention, the safety signal is divided into two separate safety signals which can be disconnected/connected independently of each other, and the drive device comprises two input circuits for the two safety signals, respectively. In this case, a first one of the input circuits is connected to the drive prevention logic in the following manner: preventing passage of a control pulse to a control pole of a high-side switch and/or a low-side switch of the engine bridge when a first of the aforementioned safing signals is switched off; and a second one of the input circuits is connected to brake drop logic as follows: when the second of the aforementioned safety signals is switched off, the passage of a control pulse to the control pole of the switch of the brake controller is prevented. In this case, the electronic monitoring unit may comprise means for disconnecting the aforesaid safety signal independently of each other, in which case the activation of the brake and the disconnection of the power supply to the electric motor may be performed as two separate processes, even at two different times.

In a most preferred embodiment of the invention, the safety signal is connected when the direct voltage signal travels via the contacts of the safety relay in the electronic monitoring unit to the input circuit in the drive device, and the safety signal is disconnected when the passage of the direct voltage signal to the drive device is interrupted by controlling the opening of the contacts of the aforementioned safety relay. Thus, separating or cutting off the conductor of the safety signal also results in the disconnection of the safety signal, thereby preventing the operation of the elevator system in a fail-safe manner. Furthermore, it is possible to use transistors instead of safety relays in the electronic monitoring unit for switching off the safety signal, preferably two or more transistors connected in series with each other, in which case a short circuit of one transistor still does not prevent the switching off of the safety signal. The advantage of using transistors is that the safety signal can be switched off for a very short time, for example for a period of about 1 millisecond, if necessary, with the aid of which short breaks (short breaks) can be filtered from the safety signal in the input circuit of the drive device without affecting the operation of the safety logic of the drive device. Thus, by generating a short interruption in the safety signal in the electronic monitoring unit and measuring the breaking capacity of the transistor in conjunction with the disconnection of the safety signal, the breaking capacity of the transistor can be monitored regularly even during operation of the elevator.

The above as well as further features and further advantages of the present invention, as presented below, will be better understood by means of the following description of some embodiments, which does not limit the scope of application of the invention.

Drawings

Fig. 1 presents as a block diagram one safety arrangement of an elevator according to the invention.

Fig. 2 presents a circuit diagram of the engine bridge and drive inhibit logic.

Fig. 3 presents a circuit diagram of the brake controller and brake drop logic.

Fig. 4 presents an alternative circuit diagram for the brake controller and brake drop logic.

Fig. 5 presents another alternative circuit diagram of the brake controller and brake drop logic.

Fig. 6 presents the circuit of the safety signal in the safety device of the elevator according to fig. 1.

Fig. 7 presents as a block diagram the assembly of an emergency drive appliance to the safety device of the elevator according to fig. 1.

Fig. 8 presents as a circuit diagram the assembly of the drive device according to the invention incorporated into the safety circuit of an elevator.

Detailed Description

Fig. 1 presents as a block diagram a safety arrangement in an elevator system, in which an elevator car (not in the figure) is driven in an elevator hoistway (not in the figure) by means of the hoisting machine of the elevator via rope friction or belt friction. The speed of the elevator is adjusted to coincide with a target value (i.e., a speed reference) of the speed of the elevator car calculated by the elevator control unit 35. The speed reference is formed in such a way that the elevator can transfer passengers from one floor to another on the basis of elevator calls given by the elevator passengers.

The elevator car is connected to the counterweight by ropes or belts that run via the traction sheave of the elevator. In the elevator system, various roping solutions known in the art can be used, which in this context are not described in more detail. The elevator further comprises: an elevator motor as the electric motor 6, whereby the elevator car is driven by rotating the traction sheave; and two electromagnetic brakes 9, thereby braking the traction sheave and holding it in place. The elevator is driven by supplying electric power from the electricity network 25 to the electric motor 6 by means of the frequency converter 1. The frequency converter 1 comprises a rectifier 26, whereby the voltage of the ac network 25 is rectified for the dc intermediate circuit 2A, 2B of the frequency converter. The direct voltage of the direct-current intermediate circuit 2A, 2B is further converted by means of the motor bridge 3 into a variable-amplitude, variable-frequency supply voltage of the electric motor 6. A circuit diagram of the engine bridge 3 is presented in fig. 2. The engine bridge comprises a high side IGBT transistor 4A and a low side IGBT transistor 4B, both connected by generating short (preferably PWM (pulse width modulation) modulated) pulses in the gates of the IGBT transistors with a control circuit 5 of the engine bridge. The control circuit 5 of the engine bridge can be implemented using, for example, a DSP processor. The high-side IGBT transistor 4A is connected to the high-voltage bus 2A of the dc intermediate circuit, and the low-side IGBT transistor 4B is connected to the low-voltage bus 2B of the dc intermediate circuit. By alternately connecting the high-side IGBT transistors 4A and the low-side IGBT transistors 4B, a PWM-modulated pulse pattern is formed in the output R, S, T of the motor from the direct-current voltages of the high-voltage bus 2A and the low-voltage bus 2B, the frequency of the pulses of which pulse pattern is substantially greater than the fundamental frequency of the voltage. In this case, the amplitude and frequency of the fundamental frequency of the engine's output voltage R, S, T may be varied steplessly by adjusting the modulation index of the PWM modulation.

The control circuit 5 of the motor bridge also contains a speed regulator, whereby the speed of rotation of the rotor of the electric motor 6 and simultaneously the speed of the elevator car are regulated to the speed reference calculated by the elevator control unit 35. The frequency converter 1 comprises an input for a measuring signal of the pulse encoder 27, which signal is used to measure the speed of rotation of the rotor of the electric motor 6 in order to adjust the speed.

During engine braking, the power is also returned from the electric motor 6 via the motor bridge 3 to the direct-current intermediate circuit 2A, 2B, from where it can be fed forward back to the grid 25 by means of the rectifier 26. On the other hand, the solution according to the invention can also be implemented by means of a rectifier 26, which is not of the type that brakes the network, such as for example by means of a diode bridge. In this case, during engine braking, the power returned to the direct current intermediate circuit may be converted into thermal energy, for example in a power resistor, or may be supplied to a separate temporary storage of electric power, such as to a battery or a capacitor. During engine braking, the force effect of the electric motor 6 is in the opposite direction relative to the direction of movement of the elevator car. Thus, for example, when an empty elevator car is driven upwards, engine braking occurs, in which case the elevator car is braked by means of the electric motor 6, so that the counterweight is pulled upwards by means of its gravity.

The electromagnetic brake 9 of the hoisting machine of the elevator comprises a frame part fixed to the frame of the hoisting machine and an armature movably supported on the frame part. The brake 9 comprises a pusher spring which activates the brake by pressing down on the armature part to engage with a braking surface (engage) on the shaft of the rotor of the elevator or e.g. on the traction sheave, which is held on the frame part. The frame part of the brake 9 contains an electromagnet which exerts an attractive force between the frame part and the armature part. The brake is opened by supplying current to the control coil of the brake, in which case the attraction force of the electromagnet pulls the armature part away from the braking surface and the braking force effect is terminated. Correspondingly, the brake is dropped by disconnecting the current supply to the control coil of the brake, whereby the brake is activated.

A brake controller 7 is integrated into the frequency converter 1, by means of which brake controller the two electromagnetic brakes 9 of the elevator are controlled by supplying current individually to the control coils 10 of the two electromagnetic brakes 9. The brake controller 7 is connected to the direct-current intermediate circuit 2A, 2B and generates a current supply from the direct-current intermediate circuit 2A, 2B to the control coil of the electromagnetic brake 9. The circuit diagram of the brake controller 7 is presented in more detail in fig. 3. For clarity, fig. 3 presents a circuit diagram for the power supply of only one brake, since the circuit diagram is similar for both brakes. Thus, the brake controller 7 comprises a separate transformer 36 for the two brakes, with the primary circuit of which the two IGBT transistors 8A, 8B are connected in series in the following manner: the primary circuit of the transformer 36 can be connected between the busbars 2A, 2B of the direct current intermediate circuit by connecting the IGBT transistors 8A, 8B. The IGBT transistors are connected by generating short (preferably PWM modulated) pulses in the gates of the IGBT transistors 8A, 8B with a brake control circuit 11. The brake control circuit 11 may be implemented by, for example, a DSP processor and may also be connected to the same processor as the control circuit 5 of the engine bridge. The secondary circuit of the transformer 36 contains a rectifier 37, by means of which rectifier 37 the voltage induced when connecting the primary circuit to the secondary circuit is regulated and supplied to the control coil 10 of the electromagnetic brake, which control coil 10 is thus connected to the secondary side of the rectifier 36. Furthermore, a current damping circuit 38 is connected in parallel with the control coil 10 to the secondary side of the transformer, which current damping circuit contains one or more elements (e.g. resistors, capacitors, varistors, etc.) which in connection with the opening of the current of the control coil 10 receive the energy stored in the inductance of the control coil of the brake and thus accelerate the opening of the current of the control coil 10 and the activation of the brake 9. The accelerated opening of the current occurs by opening the MOSFET transistor 39 in the secondary circuit of the brake controller, in which case the current of the coil 10 of the brake, changes direction to travel via the current damping circuit 38. The brake controller implemented with the transformer described herein is particularly fail-safe, especially from the point of view of ground faults, because the power supply from the dc intermediate circuit 2A, 2B to the two current conductors of the control coil 10 of the brake is disconnected when the modulation of the IGBT transistors 8A, 8B on the primary side of the transformer 36 is terminated.

The safety arrangement of the elevator according to fig. 1 comprises a mechanical normally closed safety switch 28, which mechanical normally closed safety switch 28 is configured to monitor the position/locking of the entrance of the elevator car and the operation of e.g. the overspeed governor of the elevator car. The safety switches of the entrances of the elevator cabs are connected in series with each other. Thus, the opening of the safety switch 28 indicates an event affecting the safety of the elevator system, such as the opening of an entrance to the elevator hoistway, the arrival of the elevator car at the limit switch of the permitted movement, the activation of the overspeed governor, etc.

The safety arrangement of an elevator comprises an electronic monitoring unit 20, which electronic monitoring unit 20 is a dedicated microprocessor controlled safety device that meets the EN IEC 61508 safety regulations and is designed to comply with the SIL 3 safety integrity level. The safety switch 28 is wired to the electronic monitoring unit 20. The electronic monitoring unit 20 is also connected to the frequency converter 1, the elevator control unit 35 and the control unit of the elevator car by means of the communication bus 30, and the electronic monitoring unit 20 monitors the safety of the elevator system on the basis of the data it receives from the safety switch 28 and from the communication bus. The electronic monitoring unit 20 forms a safety signal 13, on the basis of which safety signal 13 the operation of the elevator can be permitted or, on the other hand, can be prevented by disconnecting the power supply of the elevator motor 6 and activating the machinery brake 9 to brake the movement of the traction sheave of the elevator. Thus, the electronic monitoring unit 20 prevents the operation of the elevator e.g. when it is detected that the entrance of the elevator car has been opened, when it is detected that the elevator car has reached the limit switch for the permitted movement, and when it is detected that the overspeed governor has been activated. Furthermore, the electronic monitoring unit receives the measurement data of the pulse encoder 27 from the frequency converter 1 via the communication bus 30 and monitors the movement of the elevator car, in particular in connection with an emergency stop, on the basis of the measurement data of the pulse encoder 27 it receives from the frequency converter 1.

The frequency converter 1 is equipped with a special safety logic 15, 16 to be connected to the signal path of the safety signal, by means of which safety logic the disconnection of the power supply of the elevator motor 6 and the activation of the machinery brake can be performed using only solid-state elements without mechanical contactors, which improves the safety and reliability of the elevator system compared to solutions implemented by means of mechanical contactors. The safety logic is formed from drive prevention logic 15 (the circuit diagram of which is presented in fig. 2) and brake drop logic 16 (the circuit diagram of which is presented in fig. 3). Furthermore, the frequency converter 1 contains an indicator logic 17, which forms data for the electronic monitoring unit 20 about the operating state of the drive prevention logic 15 and the brake drop logic 16. Fig. 6 presents how the aforementioned electronic monitoring unit 20 and the safety function of the frequency converter 1 are connected together as a safety circuit of the elevator.

According to fig. 2, drive prevention logic 15 is fitted to the signal path between the control circuit 5 of the engine bridge and the control gate of each high-side IGBT transistor 4A. The drive prevention logic 15 includes a PNP transistor 23, and the emitter of the PNP transistor 23 is connected to the input circuit 12 of the safing signal 13 in such a manner that the power supply to the drive prevention logic 15 is generated from the direct-current voltage source 40 via the safing signal 13. The safety signal 13 travels via the contacts of the safety relay 14 of the electronic monitoring unit 20, in which case the power supply from the direct voltage source 40 to the emitter of the PNP transistor 23 is disconnected when the contacts 14 of the safety relay of the electronic monitoring circuit 20 are opened. Although fig. 2 and 3 only present one contact 14 of the safety relay, in practice the electronic monitoring circuit 20 contains two safety relay contacts 14/safety relays connected in series with each other, thereby trying to ensure the reliability of the opening. When the contact 14 of the safety relay is opened, the signal path of the control pulse from the control circuit 5 of the engine bridge to the control gate of the high-side IGBT transistor 4A of the engine bridge is simultaneously opened, in which case the high-side IGBT transistor 4A is opened and the power supply from the direct-current intermediate circuit 2A, 2B to the phase R, S, T of the electric motor is terminated. For simplicity, the circuit diagram of drive inhibit logic 15 in fig. 2 is presented only with respect to the R phase, as the circuit diagrams of drive inhibit logic 15 with respect to the S phase and the T phase are also similar.

As soon as the safety signal 13 is switched off, i.e. the contacts of the safety relay 14 are opened, the power supply to the electric motor 6 is blocked. The electronic monitoring unit 20 is connected to the safety signal 13 by controlling the closing of the contacts of the safety relay 14, in this case a direct voltage from a direct voltage source 40 connected to the emitter of the PNP transistor 23. In this case, a control pulse can proceed forward from the control circuit 5 of the engine bridge to the control gate of the high-side IGBT transistor 4A via the collector of the PNP transistor 23, thereby enabling the engine to operate. Since the voltage supply to the emitter of the PNP transistor has actually been cut off (the safety signal has been disconnected), the failure of the PNP transistor 23 may otherwise cause the control pulse to travel to the high-side IGBT transistor 4A, so the signal path of the control pulse from the control circuit 5 of the engine bridge to the drive prevention logic 15 is also arranged to travel via the opto-isolator.

According to fig. 2, the circuit of PNP transistor 23 is also well tolerant of EMC disturbances of the signal conductor connected to the safety signal 13 running outside the frequency converter, preventing it from accessing the drive prevention logic 15.

According to fig. 3, brake drop logic 16 is fitted to the signal path between the brake control circuit 11 and the control gates of the IGBT transistors 8A, 8B of the brake controller 7. Further, stopper drop logic 16 includes PNP transistor 23, and the emitter of PNP transistor 23 is connected to input circuit 12 of safing signal 13 in the same manner as the drive preventing logic. Therefore, when the contact 14 of the safety relay of the electronic monitoring unit 20 is opened, the power supply from the direct-current voltage source 40 to the emitter of the PNP transistor 23 of the stopper drop logic 16 is disconnected. At the same time, the signal path of the control pulses from the brake control circuit 11 to the control gates of the IGBT transistors 8A, 8B of the brake controller 7 is disconnected, in which case the IGBT transistors 8A, 8B are opened and the power supply from the direct current intermediate circuit 2A, 2B to the coil 10 of the brake is terminated. For the sake of simplicity, the circuit diagram of the brake drop logic 16 in fig. 3 is presented only in relation to the IGBT transistors 8B of the low voltage busbar 2B connected to the dc intermediate circuit, since the circuit diagram of the brake drop logic 16 in relation to the IGBT transistors 8A of the high voltage busbar 2A connected to the dc intermediate circuit is also similar.

After the electronic monitoring unit 20 has connected the safety signal 13 by controlling the closing of the contacts of the safety relay, the power supply from the dc intermediate circuit 2A, 2B to the brake coil is available again, in which case a dc voltage is connected from the dc voltage source 40 to the emitter of the PNP transistor 23 of the brake drop logic 16. Furthermore, the signal path of the control pulse formed by the brake control circuit 11 to the brake drop logic 16 is arranged to travel via the opto-isolator 21 for the same reasons set forth in relation to the above description of the drive prevention logic. Since the switching frequency of the IGBT transistors 8A, 8B of the actuator controller 7 is typically high, even 20 khz or more, the opto-isolator 21 must be selected in such a way that the delay of the control pulse through the opto-isolator 21 is minimized.

Instead of the opto-isolator 21, a digital isolator may also be used to minimize the delay. Fig. 4 presents an alternative circuit diagram of the actuator drop logic, which differs from the circuit diagram of fig. 3 in that the opto-isolator 21 is replaced with a digital isolator. One possible digital isolator 21 of FIG. 4 is a digital isolator with an ADUM 4223 type tag manufactured by Analog devices. The digital isolator 21 receives its operating voltage for the secondary side from the direct voltage source 40 via the contacts 14 of the safety relay, in which case the output of the digital isolator 21 terminates modulation when the contacts 14 are open.

Fig. 5 presents yet another alternative circuit diagram for the brake drop logic. The circuit diagram of figure 5 differs from that of figure 3 in that the opto-isolator 21 is replaced by a transistor 46 and the output of the actuator control circuit 11 is taken directly to the gate of the transistor 46. MELF resistor 45 is connected to the collector of transistor 46. The elevator safety code EN 81-20 specifies that the failure of the MELF resistor to become a short circuit need not be considered when performing the failure analysis, so by selecting the value of the MELF resistor to be sufficiently large, the signal path from the output of the brake control circuit 11 to the gates of the IGBT transistors 8A, 8B can be blocked when the safety contacts 14 are open. In this way, a simple and inexpensive drop logic of the brake is achieved.

In some embodiments, the circuit diagram of the drive prevention logic of fig. 2 has been replaced with a circuit diagram of the brake drop logic according to fig. 4 or 5. In this way, the transit time delay of the signal from the output of the control circuit 5 of the engine bridge to the gates of the IGBT transistors 4A, 4B can be reduced in the drive prevention logic.

According to fig. 6, the safety signal 13 is conducted from the direct voltage source 40 of the frequency converter 1 via the contacts 14 of the safety relay of the electronic monitoring unit 20 and onwards back to the frequency converter 1 to the input circuit 12 of the safety signal. Input circuit 12 is connected to drive prevention logic 15 and brake drop logic 16 via diode 41. The purpose of the diode 41 is to block the supply of voltage from the drive prevention logic 15 to the brake drop logic 16/from the brake drop logic 16 to the drive prevention logic 15 as a result of a fault occurring in the drive prevention logic 15 or the brake drop logic 16, such as a short circuit in particular.

Furthermore, the frequency converter contains an indicator logic 17, the indicator logic 17 forming data for the electronic monitoring unit 20 about the operating state of the drive prevention logic 15 and the brake drop logic 16. The indicator logic 17 is implemented as AND logic, the input of which is inverted. A signal to allow the start of the run is obtained as an output of the indicator logic, which reports that the drive blocking logic 15 and the brake drop logic are in working condition and thus allows the start of the next run. In order to activate the signal 18 that allows the start of operation, the electronic monitoring unit 20 opens the safety signal 13 by opening the contacts 14 of the safety relay, in which case the power supply of the drive blocking logic 15 and the brake drop logic 16 must go to zero, i.e. the supply of control pulses to the high-side IGBT transistor 4A of the engine bridge and the IGBT transistors 8A, 8B of the brake controller is blocked. If this occurs, indicator logic 17 activates signal 18 which allows the start of operation by controlling transistor 42 to conduct. The output of the transistor 42 is wired to the electronic monitoring unit 20 in such a way that when the transistor 42 is turned on, a current flows in an opto-isolator in the electronic monitoring unit 20, and the opto-isolator indicates to the electronic monitoring unit 20 that the start of operation is allowed. If at least either of the power supplies to the drive blocking logic and the brake drop logic does not go to zero after the contacts 14 of the safety relay have been opened in the electronic monitoring unit 20, the transistor 42 does not start to conduct and the electronic monitoring unit 20 deduces on the basis thereof that the safety logic of the frequency converter 1 has failed. In this case the electronic monitoring unit prevents the start of the next run and sends data about the prevented run to the frequency converter 1 and the elevator control unit 35 via the communication bus 30.

Fig. 7 presents an embodiment of the invention in which an emergency drive device 32 is added to the safety arrangement according to fig. 1, by means of which the operation of the elevator can be continued during periods of non-functioning of the electricity network, such as during overload or blackout. The emergency drive device comprises a battery pack 33, preferably a lithium ion battery pack, which is connected to the direct current intermediate circuit 2A, 2B via a direct current/direct current transformer 43, whereby power can be transmitted bidirectionally between the battery pack 33 and the direct current intermediate circuit 2A, 2B. The emergency driving apparatus is controlled in the following manner: at the time of braking, the battery pack 33 is charged with the electric motor 6, and at the time of driving with the electric motor 6, electric current is supplied from the battery pack to the electric motor 6. According to the invention, the drive prevention logic 15 and the brake drop logic 16 can also be used to disconnect the occurring supply of electrical power from the battery pack 33 to the electric motor 6 via the direct-current intermediate circuit 2A, 2B, in which case the emergency drive 32 can also be realized without adding a single mechanical contactor to the emergency drive 32/frequency converter 1.

Fig. 8 presents an embodiment of the invention, in which the safety logic of the frequency converter 1 according to the invention is fitted into an elevator with a conventional safety circuit 34. The safety circuit 34 is formed by safety switches 28, such as e.g. the safety switches of the doors of the entrance of an elevator hoistway, connected to each other in series. The coil of the safety relay 44 is connected in series with the safety circuit 34. When the current supply to the coil is terminated due to the opening of the safety switch 28 of the safety circuit 34, the contacts of the safety relay 44 are opened. Thus, for example, when a serviceman opens the door of the entrance of the elevator cage with a service key, the contacts of the safety relay 44 are opened. The contacts of the safety relay 44 are wired from the dc voltage source 40 of the frequency converter 1 to the common input circuit 12 of the drive prevention logic 15 and the brake drop logic 16 in the following manner: when the contacts of the safety relay 44 are opened, the power supply to the drive blocking logic 15 and the brake drop logic 16 is terminated. Thus, when the safety switch 28 is opened in the safety circuit 34, the passage of the control pulse to the control gate of the high-side IGBT transistor 4A of the motor bridge 3 of the frequency converter 1 is terminated and the power supply to the electric motor 6 of the elevator is disconnected. At the same time, the passage of the control pulses to the IGBT transistors 8A, 8B of the brake controller 7 is terminated and the brake 9 of the elevator is activated to brake the movement of the traction sheave of the elevator.

It is obvious to the person skilled in the art that, unlike the above, the electronic monitoring unit 20 may also be integrated into the frequency converter 1, preferably on the same circuit card as the drive prevention logic 15 and/or the brake drop logic 16. In this case, however, the electronic monitoring unit 20 and the drive prevention logic 15/brake drop logic 16 form components that can be clearly distinguished from one another, so that the fail-safe device architecture according to the invention is not broken off.

The invention has been described above by means of some examples of embodiments of the invention. It is obvious to a person skilled in the art that the invention is not limited solely to the embodiments described above, but that many other applications are possible within the scope of the inventive concept defined in the claims.

Claims (12)

1. Drive apparatus (1) of an elevator, comprising:

a direct current bus (2A, 2B);

a motor bridge (3) connected to the direct current bus for the power supply of an elevator motor (6);

the motor bridge (3) comprising a high-side switch (4A) and a low-side switch (4B), the high-side switch (4A) and the low-side switch (4B) being used to supply power from the DC bus (2A, 2B) to the elevator motor (6) when driving with the elevator motor (6) and also to supply power from the elevator motor (6) to the DC bus (2A, 2B) when braking with the elevator motor (6);

-a control circuit (5) of the engine bridge, by means of which the operation of the engine bridge (3) is controlled by generating control pulses in the control poles of a high-side switch (4A) and a low-side switch (4B) of the engine bridge;

characterized in that said drive device comprises:

a brake controller (7) comprising switches (8A, 8B) for supplying power to a control coil (10) of an electromagnetic brake (9);

a brake control circuit (11) for controlling the operation of the brake controller (7) by generating control pulses in the control poles of the switches (8A, 8B) of the brake controller by means of the brake control circuit (11);

an input circuit (12) for a safety signal (13), said safety signal (13) being disconnectable/connectable from outside the drive device (1);

drive prevention logic (15) connected to the input circuit (12) and configured to prevent passage of control pulses to the control pole of the high-side switch (4A) and/or the low-side switch (4B) of the engine bridge when the safety signal (13) is turned off; and

brake drop logic (16) connected to the input circuit (12) and configured to prevent passage of control pulses to the control poles of the switches (8A, 8B) of the brake controller when the safety signal (13) is off;

wherein a signal path of a control pulse from a control circuit (5) of the engine bridge to the drive prevention logic (15) is arranged via an isolator (21);

wherein a signal path of a control pulse to a control pole of a high-side switch (4A) and/or a low-side switch (4B) of the motor bridge runs via the drive prevention logic (15), and a power supply to the drive prevention logic (15) is arranged via a signal path of the safety signal (13).

2. The drive apparatus according to claim 1, characterized in that the brake controller (7) is connected to the direct current bus (2A, 2B);

and the switches (8A, 8B) are configured to supply power from the direct current bus (2A, 2B) to a control coil (10) of an electromagnetic brake (9).

3. The drive apparatus according to claim 1, characterized in that the drive prevention logic (15) is configured to allow passage of control pulses to the control poles of the switches (4A, 4B) of the motor bridge when the safety signal (13) is connected;

and the brake drop logic (16) is configured to allow passage of a control pulse to a control pole of a switch (8A, 8B) of the brake controller when the safety signal (13) is connected.

4. The drive device according to claim 1, characterized in that the drive device (1) comprises an indicator logic (17) for forming a signal (18) allowing a run initiation;

and the indicator logic (17) is configured to activate a signal (18) allowing a run initiation when both the drive prevention logic (15) and the brake drop logic (16) are in a state preventing the passage of a control pulse;

and the indicator logic (17) is configured to disconnect a signal (18) allowing the start of operation if at least either one of the drive prevention logic (15) and the brake drop logic (16) is in a state allowing passage of a control pulse;

and the drive device (1) comprises an output (19) for indicating to a monitoring logic (20) external to the drive device a signal (18) allowing the start of the operation.

5. The drive apparatus according to claim 1, characterized in that the signal path of the control pulse travels to the control pole of the switch (8A, 8B) of the brake controller via the brake drop logic (16);

and arranging the supply of power to the brake drop logic (16) via the signal path of the safety signal (13).

6. The drive apparatus according to claim 1, characterized in that the signal path of the control pulses from the brake control circuit (11) to the brake drop logic (16) is arranged via an isolator (22).

7. The drive apparatus according to claim 1, characterized in that the drive prevention logic (15) comprises a bipolar or multipolar signal switch (23), the control pulses to the control poles of the switches (4A, 4B) of the motor bridge traveling to the control poles of the switches (4A, 4B) of the motor bridge via the bipolar or multipolar signal switch (23);

and at least one pole of the signal switch (23) is connected to the input circuit (12) in the following way: when the safety signal (13) is switched off, the signal path of the control pulse via the signal switch (23) is interrupted.

8. Drive device according to claim 7, characterized in that the signal switch (23) is fitted in conjunction with the control pole of each high-side switch (4A) of the motor bridge and/or in conjunction with the control pole of each low-side switch (4B) of the motor bridge.

9. The drive apparatus according to claim 1, characterized in that the brake drop logic (16) comprises a bipolar or multipolar signal switch (24), via which a control pulse to a control pole of a switch (8A, 8B) of the brake controller travels to a control pole of a switch (8A, 8B) of the brake controller;

and at least one pole of the signal switch (24) is connected to the input circuit (12) in the following way: when the safety signal (13) is switched off, the signal path of the control pulse via the signal switch (24) is interrupted.

10. The drive apparatus according to any one of claims 1 to 9, characterized in that the supply of electrical power occurring via the signal path of the safety signal (13) is configured to be disconnected by disconnecting the safety signal (13).

11. Drive device according to any one of claims 1 to 9, characterized in that the drive device (1) comprises a rectifier (26) connected between an alternating current power source (25) and the direct current bus (2A, 2B).

12. The drive device according to any one of claims 1 to 9, characterized in that the drive device (1) is realized without any mechanical contactor.