Safe torque cancelling circuit

Abstract

The invention discloses a safety torque cancelling circuit which comprises a channel loop configured to obtain a safety signal from a safety loop of an elevator and cut off a power supply of an isolation driving unit of an upper bridge arm switch tube or / and a lower bridge arm switch tube in response to the state of the safety signal; and the diagnosis loop receives the output state of the channel loop and is used for cutting off the driving signal of the upper bridge arm switch tube or / and the lower bridge arm switch tube when the diagnosis is abnormal. While electronic star sealing is realized, the fault margin and safety of the STO are not reduced. In addition, as the STO only blocks the driving signal of the upper bridge arm or the lower bridge arm, the lower bridge arm or the upper bridge arm can adopt an electric braking method for improving the braking torque disclosed by CN117997175A.

Description

Technical Field

[0001] This invention relates to the field of safe torque cancellation (STO) technology in drives, and more specifically, to a safe torque cancellation (STO) circuit. Background Technology

[0002] In applications such as motor drives and elevator control, the requirements for system safety are becoming increasingly stringent, with Safe Torque Off (STO) and star-locking becoming essential safety functions.

[0003] Currently, a common technical solution for achieving the safe torque cancellation function is through the operation of a contactor. With increasing competition, low-cost, compact STO solutions (such as functional safety devices or safety circuit devices) are attracting more and more attention. A common STO solution is to use the frequency converter to block the inverter arm drive signal (cut off the drive signal power supply and / or lock out the drive signal output) to achieve the safe torque shutdown function.

[0004] Currently, one of the commonly used methods for sealing off elevator control systems is to use a "sealing contactor," which adds a sealing contactor between the frequency converter and the PM motor to short-circuit the three-phase input of the motor. However, the contactor sealing scheme is not advantageous in terms of cost, size, and noise. Therefore, the scheme that uses the switching transistors of the frequency converter's inverter bridge arm to form a sealing circuit (usually called electronic sealing) has begun to gain popularity. That is, while the frequency converter blocks the drive signal of the upper bridge arm, it controls the switching transistors of the lower bridge arm to conduct, thereby short-circuiting the three-phase input of the motor.

[0005] The Elevator Type Testing Standard (TSG T7007-2022) requires that the Safety Integrity Level (SIL3) of the Safe Torque Cancellation (STO) function reach SIL3, and the hardware fault margin should be at least 1. Implementing STO requires blocking the drive signal output of the inverter arm. However, when using an electronic star-blocking scheme to implement the star-blocking function, it is necessary to turn on the switching transistors of either the upper or lower arm. Therefore, the implementation of the star-blocking function may conflict with the aforementioned Safe Torque Cancellation function, making it impossible to simultaneously implement both functions.

[0006] Chinese invention patent publication number CN112117952B proposes a first safety torque shutdown module to shut off the drive signal power supply of the upper bridge arm, and a second safety torque shutdown module to shut off the drive signal power supply of the lower bridge arm, with diagnostic functions to achieve a dual-path redundancy design, thereby improving the safety of the motor drive system. However, when using an electronic star-sealing solution, the need to turn on the switching transistors of the upper or lower bridge arm reduces the hardware fault margin of the safety torque cancellation safety function, thus reducing safety.

[0007] CN111404423A proposes using two signal conversion units to disable the enable of two series-connected buffer chips, and a fault diagnosis unit to detect the hardware of the signal conversion units, disabling the enable of the two buffers when an anomaly is detected. The electronic star-sealing device based on this scheme is located after the STO device, and the hardware fault margin of the STO is not affected during electronic star-sealing. This scheme provides relatively complete diagnosis for the signal conversion units, but the diagnosis of the buffers is relatively simple, lacking diagnosis of whether each drive signal is disabled.

[0008] The CN114498542A shuts down the power and enable signals of the upper and lower bridge arm buffers via a dual-channel power supply with diagnostics. When the star-sealing function is active, the power and enable signals of the second channel still maintain STO (Safe Torque Off) operation, and the hardware fault margin is 1, ensuring the safety of the safe torque shutdown function. However, the lack of buffer diagnostics reduces safety. Summary of the Invention

[0009] To address the above problems, this invention provides a Safety Torque Cancellation (STO) circuit.

[0010] The safety torque cancellation (STO) circuit of the present invention includes:

[0011] A channel circuit, the channel circuit being configured to receive a safety signal from an elevator safety circuit, and wherein, in response to the safety signal status, the power supply to the isolation drive unit of the upper arm switch tube or / and lower arm switch tube is cut off;

[0012] A diagnostic circuit receives the output status of the channel circuit and, when an abnormality is diagnosed, cuts off the drive signal of the upper arm switch or / and lower arm switch.

[0013] In a preferred embodiment of the present invention, there are two channel loops, including a first channel loop and a second channel loop. The first channel loop and / or the second channel loop can hardware cut off the power supply to the isolation drive unit; or the first channel loop or the second channel loop can cut off the enable or power supply of the buffer.

[0014] In a preferred embodiment of the present invention, the first channel circuit and / or the second channel circuit are configured to obtain a safety signal from the elevator safety circuit, and the power supply to the upper arm switch tube or the isolation drive unit of the lower arm is cut off in response to the safety signal status.

[0015] In a preferred embodiment of the present invention, both the first channel circuit and the second channel circuit include a channel input circuit, a logic circuit, and a switch; the channel input circuit is configured to be connected to the elevator safety circuit to receive a safety signal, and its output terminal is connected to the first input terminal of the logic circuit. The output terminal of the logic circuit outputs an on / off signal to the control terminal of the switch, so that when a safety signal is received and disconnected, the switch is turned off, thereby cutting off the power supply to the isolation drive unit on the upper or lower bridge arm switch tube.

[0016] In a preferred embodiment of the present invention, the input terminal of the diagnostic circuit receives the output status of the channel input circuit and the switch.

[0017] In a preferred embodiment of the present invention, the input terminal of the diagnostic circuit also receives the output state of the logic circuit.

[0018] In a preferred embodiment of the invention, the output states of the first channel loop or the second channel loop are different from each other at least during a given period.

[0019] In a preferred embodiment of the present invention, the output terminal of the diagnostic circuit outputs an on / off signal to the second input terminal of the logic circuit of the first channel circuit and the second channel circuit, respectively.

[0020] In a preferred embodiment of the present invention, the logic circuit of the first channel loop or the second channel loop uses an OR logic circuit to generate a control signal to turn off the switch, such that when the channel input loop receives a safety signal to disconnect, or when the diagnostic circuit outputs a shutdown signal, the switch is turned off.

[0021] Due to the adoption of the above technical solution, the beneficial effects of the present invention are as follows:

[0022] One advantage of the present invention is that, while achieving electronic star-blocking, the fault margin and safety of the STO are not reduced. Furthermore, since the STO only blocks the drive signals of the upper or lower arm, the lower or upper arm can employ the electrical braking method for increasing braking torque disclosed in CN117997175A. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the drive system for a permanent magnet synchronous motor (rectifier and isolation drive sections are omitted).

[0024] Figure 2 This is a schematic diagram of the circuit module in Example 1.

[0025] Figure 3 This is a schematic diagram of the elevator safety circuit and the A-channel input circuit in Example 1.

[0026] Figure 4 This is a schematic diagram of the circuit module in Example 2.

[0027] Figure 5 This is a schematic diagram of the elevator safety circuit and the A-channel input circuit in Example 2.

[0028] Figure 6 This is a schematic diagram of the circuit module in Example 3.

[0029] Figure 7 This is a schematic diagram of the elevator safety circuit and the A-channel input circuit in Example 3.

[0030] Figure 8 This is a schematic diagram of a circuit module according to one embodiment.

[0031] Figure 9 This is a schematic diagram of a circuit module according to another embodiment.

[0032] Figure 10 This is a schematic diagram of a circuit module for yet another embodiment.

[0033] Figure 11 This is a sequence diagram of elevator operation in one embodiment.

[0034] Figure 12 This is a sequence diagram of elevator operation according to another embodiment. Detailed Implementation

[0035] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0036] refer to Figure 1 The existing "electronic star-blocking" technology can be achieved by blocking the drive signals of the controllable switching transistors T1, T2, and T3 (such as IGBTs) of the upper bridge arm of the frequency converter, while keeping the drive signals of the controllable switching transistors T4, T5, and T6 (such as IGBTs) of the lower bridge arm always active, or by blocking the drive signals of the controllable switching transistors T4, T5, and T6 (such as IGBTs) of the lower bridge arm of the frequency converter, while keeping the drive signals of the controllable switching transistors T1, T2, and T3 (such as IGBTs) of the upper bridge arm always active.

[0037] Because one arm of the inverter was constantly blocked, preventing Figure 1 The intermediate circuit's C1 and C2 (as well as the mains power supply) provide driving energy to the PM motor. In this case, the PM motor cannot generate torque other than braking torque, so "electronic star-sealing" is a safe form of electrical braking.

[0038] The invention will be further explained below when the drive signals of the controllable switches T1, T2, and T3 of the upper arm are blocked, and the controllable switches T4, T5, and T6 of the lower arm are electrically braked. The principle also applies to blocking the drive signals of the controllable switches T4, T5, and T6 of the lower arm and electrically braking the controllable switches T1, T2, and T3 of the upper arm.

[0039] This invention discloses an STO circuit, including a first channel circuit, a second channel circuit, and a diagnostic circuit 4.

[0040] Example 1: As Figure 1 As shown, in this embodiment, the first channel circuit is configured to obtain a safety signal from the elevator safety circuit, and in response to the safety signal state, the power supply of the isolation drive unit 3 of the upper arm switch tube is cut off; the second channel circuit is configured to obtain a safety signal from the elevator safety circuit, and in response to the safety signal state, the power supply of the isolation drive unit 3 of the upper arm switch tube is cut off.

[0041] The first channel circuit includes a first channel input circuit 1a, a first logic circuit 1b, and a first switch 1c; the second channel circuit includes a second channel input circuit 2a, a second logic circuit 2b, and a second switch 2c.

[0042] The first channel input circuit 1a is configured to be connected to the elevator safety circuit to receive safety signals. The output terminal of the first channel input circuit 1a is connected to the first input terminal of the first logic circuit 1b. The output terminal of the first logic circuit 1b outputs an on / off signal to the control terminal of the first switch 1c, so that when the safety signal is received and disconnected, the first switch 1c is disconnected, thereby cutting off the power supply to the isolation drive unit 3 of the upper bridge arm switch tube.

[0043] The second channel input circuit 2a is configured to be connected to the elevator safety circuit to receive safety signals. The output terminal of the second channel input circuit 2a is connected to the first input terminal of the second logic circuit 2b. The output terminal of the second logic circuit 2b outputs an on / off signal to the control terminal of the second switch 2c, so that when the safety signal is received and disconnected, the second switch 2c is turned off, thereby cutting off the power supply to the isolation drive unit 3 of the upper bridge arm switch tube.

[0044] The input terminal of the diagnostic circuit 4 receives the output states of the first channel input circuit 1a, the second channel input circuit 2a, the first switch 1c, and the second switch 2c; in some embodiments, the input terminal of the diagnostic circuit 4 also receives the output states of the first logic circuit 1b and / or the second logic circuit 2b.

[0045] Diagnostic circuit 4 performs diagnostics based on the received signals. The diagnostics may include, but are not limited to, the first channel circuit and the logic states of the first channel circuit being different from each other at least for a given period of time, the input and output logic states of the first logic circuit 1b being inconsistent, the input and output logic states of the second logic circuit 2b being inconsistent, the input and output logic states of the first switch 1c being inconsistent, and the input and output logic states of the second switch 2c being inconsistent. The output terminal of diagnostic circuit 4 outputs on / off signals to the second input terminals of the first logic circuit 1b and the second logic circuit 2b, respectively.

[0046] The first logic circuit 1b and the second logic circuit 2b use an OR logic circuit to generate control signals to turn off the first switch 1c and the second switch 2c, such that when the first channel input circuit 1a receives a safety signal to disconnect, or when the diagnostic circuit 4 outputs a shutdown signal, the first switch 1c is disconnected; and when the second channel input circuit 2a receives a safety signal to disconnect, or when the diagnostic circuit 4 outputs a shutdown signal, the second switch 2c is disconnected.

[0047] Preferably, the diagnostic circuit 4 includes a programmable electronic device, such as a microcontroller.

[0048] Preferably, the programmable electronic device of the diagnostic circuit 4 can be shared with the PWM generation DSP processor 5 of the frequency converter.

[0049] Preferably, the diagnostic circuit 4 has a fault memory function. When an abnormality is diagnosed, the fault can only be cleared by manual reset.

[0050] Preferably, the diagnostic circuit 4 can also perform relevant hardware diagnostics on the power supply unit (not shown) to prevent power supply unit failure. For example, the power supply unit includes a 5V and / or 3.3V power supply, and the 5V and / or 3.3V power supply voltage signal is input to the microcontroller through a voltage divider circuit. The microcontroller can monitor the power supply for overvoltage and undervoltage. When the microcontroller detects that the power supply exceeds the normal voltage range (e.g., the normal voltage range is 90% to 110%), it determines that a circuit fault has occurred and outputs a shutdown signal to the first logic circuit 1b and the second logic circuit 2b, thereby cutting off the power supply to the first switch 1c and the second switch 2c, and thus cutting off the power supply to the isolation drive unit 3 of the upper bridge arm switching transistor.

[0051] It should be noted that elevator safety circuit 6 can be equipped with a safety switch in each safety component of the elevator, connected in series. The elevator can only operate when all safety switches are closed. If any safety switch in the elevator safety circuit malfunctions, that safety switch will not close, and the elevator will not operate.

[0052] refer to Figure 3The diagram shows a schematic of elevator safety circuit 6 and the first channel input circuit 1a. Elevator safety circuit 6 consists of a 48V power supply, an emergency stop safety switch (STOP), and a car door lock safety switch (GS), connected in series. Elevator safety circuit 6 can also independently collect the status information of each safety switch through a safety controller, and then use safety relays or controllable switching elements to output and control the on / off state of the elevator safety circuit.

[0053] It should be noted that the elevator is required to perform the STO safety function even when it stops normally. In some embodiments, the elevator safety circuit 6 can be disconnected at the end of the elevator safety circuit 6 by a switch Y1 controlled to turn off when the elevator stops, or the elevator safety circuit 6 can be disconnected by the safety controller when the elevator stops. As a result, the first channel input circuit 1a and the second channel input circuit 2a can receive the elevator safety circuit 6 disconnection signal, thereby triggering the first switch 1c and the second switch 2c to turn off, thereby cutting off the power supply to the isolation drive unit 3 of the upper bridge arm switch tube.

[0054] In some embodiments, the first channel input circuit 1a may include a filter circuit (such as an EMC circuit) consisting of resistors R1 and R2 and capacitor C1. The first channel input circuit 1a also includes an isolation circuit, such as an optocoupler PH1. The isolation circuit of the first channel input circuit 1a can be turned on when the elevator safety circuit 6 is closed and turned off when the elevator safety circuit 6 is open.

[0055] The first channel input circuit 1a may further include a signal level conversion circuit, such as an inverter, so that when the elevator safety circuit 6 is open, the first channel input circuit 1a outputs a high level; and when the elevator safety circuit 6 is closed, the first channel input circuit 1a outputs a low level. The second channel input circuit 2a may have the same structure as the first channel input circuit 1a. The scope of the invention is not limited in this respect.

[0056] In some embodiments, both the first switch 1c and the second switch 2c include controllable semiconductor switching devices, such as MOSFETs. In other embodiments, the first switch 1c and the second switch 2c may include other types of switching devices. The scope of the invention is not limited in this respect.

[0057] Figure 11This is a timing diagram for the elevator's normal operation and shutdown. A "high level" indicates that elevator safety circuit 6 is closed, and the first switch 1c and the second switch 2c are closed; a low level indicates that elevator safety circuit 6 is open, and the first switch 1c and the second switch 2c are open. After receiving the stop command, the inverter reduces the motor current to 0 at a predetermined slope. Then, at time t1, the DSP blocks the PWM output, cutting off the motor's power supply. After receiving the stop information from the inverter, the elevator controller cuts off switch Y1 at time t2, thereby cutting off elevator safety circuit 6. The output signal S100 of the first channel input circuit 1a and the output signal S200 of the second channel input circuit 2a become low. At time t3, the first switch 1c and the second switch 2c are turned off. After receiving the turn-off of the first switch 1c and the second switch 2c, the inverter can control the controllable switches T4, T5, and T6 of the lower bridge arm for electrical braking, or electronically block the PWM signal of the upper bridge arm by outputting the PWM signal of the lower bridge arm through the DSP. When the elevator starts, the elevator controller closes switch Y1, thereby closing the elevator safety circuit 6. Simultaneously, it controls the inverter to cancel the electrical braking, such as by the DSP shutting off the PWM signal output of the upper and lower bridge arms. At time t4, the output signal S100 of the first input circuit 1a and the output signal S200 of the second input circuit 2a become high. At time t5, the first switch 1c and the second switch 2c are turned on. After receiving the turn-on signal from the first switch 1c and the second switch 2c, the inverter outputs a PWM signal from the DSP to control the controllable switches T1, T2, T3, T4, T5, and T6 to operate normally, and the motor starts.

[0058] In some embodiments, at least one filter circuit can be inserted between the elevator safety circuit 6 and the first switch 1c, and between the elevator safety circuit 6 and the second switch 2c. The response time of the first channel circuit and the second channel circuit (i.e., the time from the elevator safety circuit 6 being disconnected to the cutting off time of the first switch 1c and the second switch 2c, and the time from the elevator safety circuit 6 being closed to the closing time of the first switch 1c and the second switch 2c) can be adjusted through the filter circuit, thereby adjusting the response time of the STO circuit (generally between 2ms and 40ms).

[0059] In some embodiments, the response time of the first channel input circuit 1a and the response time of the second channel input circuit 2a are inconsistent, such that when the elevator safety circuit 6 switches states, the first switch 1c turns on earlier than the second switch 2c by a preset time, or the first switch 1c turns off later than the second switch 2c by a preset time. Preferably, when the elevator goes from stopping to running, and the elevator safety circuit 6 goes from open to closed, the first switch 1c turns on earlier than the second switch 2c by a preset time, thereby confirming whether the second switch 2c is off within that preset time.

[0060] In some embodiments, the diagnostic circuit 4 also receives elevator stop information, preferably, receives inverter stop information, and more preferably receives it via I / O lines. Figure 12 As shown, after receiving the elevator stop command, the frequency converter reduces the motor current to 0 at a predetermined slope. Then, at time t1, the DSP turns off the PWM output, cuts off the power supply to the motor, and outputs stop information to the diagnostic circuit 4.

[0061] After receiving the stop information, diagnostic circuit 4 controls the first switch 1c and the second switch 2c to turn off (S103 and S203 change from high level to low level). At time t1, the first switch 1c and the second switch 2c are turned off. Compared to Figure 11 The first switch 1c and the second switch 2c are cut off by the output signal S100 of the first channel input circuit 1a and / or the output signal S200 of the second channel input circuit 2a. Directly utilizing the inverter's stop information to cut off the first switch 1c and / or the second switch 2c allows for faster disconnection, thus enabling earlier entry into the electrical braking state. In the event of brake failure during normal elevator stop, this more effectively limits the elevator's slippage speed, providing passengers with sufficient emergency reaction time and significantly reducing the likelihood of shear injuries from the building and the car at the doorway.

[0062] In some embodiments, such as Figure 12As shown, during the elevator stop, the diagnostic circuit 4 can output a brief high-level diagnostic pulse S103 while both the output signal S100 of the first channel input circuit 1a and the output signal S200 of the second channel input circuit 2a are at a low level. If the feedback S101 remains low, it indicates that the shutdown function of the first input of the first logic circuit 1b is normal; otherwise, it indicates that the shutdown function of the first input of the first logic circuit 1b is abnormal. Alternatively, if the feedback S102 remains low, it indicates that the shutdown functions of the first input of the first logic circuit 1b and the first switch 1c are normal; otherwise, it is abnormal. During the elevator stop, the diagnostic circuit 4 can output a brief high-level diagnostic pulse S203 while both the output signal S100 of the first channel input circuit 1a and the output signal S200 of the second channel input circuit 2a are at a low level. If the feedback S201 remains low, it indicates that the shutdown function of the first input of the second logic circuit 2b is normal; otherwise, it indicates that the shutdown function of the first input of the second logic circuit 2b is abnormal. Since both S100 and S200 are low, the hardware fault margin of the safety torque cancellation safety function is not compromised during diagnostic testing. It should be noted that because the first switch 1c and the second switch 2c are connected in series, when the shutdown function of the first channel input circuit 1a is normal, the feedback signal S202 for diagnosing the second switch 2c will still be low even if the second switch 2c fails, as the first switch 1c is off. This means the shutdown is considered normal, and it is impossible to diagnose whether the second switch 2c is abnormally shut down while both S100 and S200 are low.

[0063] When the elevator starts, the elevator controller controls switch Y1 to close, thereby closing the elevator safety circuit 6. At time t4, the output signal S100 of the first channel input circuit 1a and the output signal S200 of the second channel input circuit 2a become high. However, since the inverter still outputs stop information, S103 and S203 remain low. If the feedback S102 is low, or S101 is low, it indicates that the second input shutdown function of the first logic circuit 1b is normal. If the feedback S201 is low, it indicates that the second input shutdown function of the second logic circuit 2b is normal. Alternatively, comparing whether the states of S101 and S201 are consistent within a given period can also determine whether the second input shutdown functions of the first logic circuit 1b and the second logic circuit 2b are normal.

[0064] At time t5, a brief high-level diagnostic pulse S103 is output or a continuous high-level pulse S103 is output, which turns on the first switch 1c. The second switch 2c is then turned off by checking whether S202 is high. If it is low, the turn-off function is normal; otherwise, if it is high, the turn-off function is abnormal.

[0065] At time t6, when the diagnostic result of the diagnostic circuit 4 is normal, the inverter cancels the electric braking, outputs operating information to the diagnostic circuit 4, and the DSP outputs a PWM signal. After receiving the operating information from the inverter, the diagnostic circuit 4 sets S103 and S203 to a high level, which turns on the first switch 1c and the second switch 2c, thereby controlling the controllable switches T1, T2, T3, T4, T5, and T6 to operate normally and start the motor.

[0066] In some embodiments, the diagnostic circuit 4 receives a stop signal and uses this signal as a benchmark to compare it with the states of multiple key nodes, including but not limited to: the output S100 of the first channel input circuit 1a, the output S200 of the second channel input circuit 2a, the output S101 of the first logic circuit 1b, the output S201 of the second logic circuit 2b, the state S102 of the first switch 1c, and the state S202 of the second switch 2c. Through this comprehensive comparison mechanism, the diagnostic circuit 4 can more effectively assess the system state and confirm whether the STO circuit is functioning correctly. Compared to traditional methods that rely solely on whether the logic states of the first channel input circuit 1a and the second channel input circuit 2a remain consistent over a period of time to determine the effectiveness of the STO circuit, this embodiment introduces the operating signal as an additional verification benchmark. This improvement significantly enhances the comprehensiveness and accuracy of the diagnosis, particularly enabling the identification and reporting of even low-probability but significant events—namely, the simultaneous failure of the first and second channel circuits. In this way, the system can detect potential problems earlier, improving the overall operational safety and reliability.

[0067] In addition, Figure 11 During the periods t1~t3 and t4~t6, the electric braking is not activated, but... Figure 12 In this system, electric braking covers almost all periods during which the frequency converter stops, thus improving safety.

[0068] In some embodiments, the diagnostic circuit 4 can also output an enable signal to the inverter, preferably via an I / O line. Preferably, this enable signal can be turned off slightly earlier than the STO circuit disconnects the first switch 1c and / or the second switch 2c, preferably by 0.1–5 ms. When the inverter receives this enable signal and turns off, the DSP first blocks all PWM signals, and then enters electric braking after the first switch 1c and the second switch 2c are disconnected. The diagnostic circuit 4 can close the enable signal when the output S100 of the first channel input circuit 1a and the output S200 of the second channel input circuit 2b are both high, and the diagnostic result is normal.

[0069] In some embodiments, the diagnostic circuit 4 is connected to the inverter's DSP and the elevator controller via communication. Preferably, the diagnostic circuit 4 is connected to the DSP, and the elevator controller is connected to the DSP. The diagnostic circuit 4 may also output, but is not limited to: information indicating that the elevator safety circuit 6 is closed, such as the logical AND operation generated by the output S100 of the first channel input circuit 1a and the output S200 of the second channel input circuit 2a; information indicating that the elevator safety circuit 6 is closed and the diagnostic circuit 4 is fault-free; information indicating that the elevator safety circuit 6 is open, such as the logical OR operation generated by the output S100 of the first channel input circuit 1a and the output S200 of the second channel input circuit 2a; information indicating that the diagnostic circuit 4 is faulty; feedback information indicating Y1, such as the information obtained through the logical operation of S100 and S200; information indicating that the first switch 1c or the second switch 2c is turned off; the output S100 of the first channel input circuit 1a; the output S200 of the second channel input circuit 2a; the output S101 of the first logic circuit 1b; the output S201 of the second logic circuit 2b; the state S102 of the first switch 1c; the state S202 of the second switch 2c, etc.

[0070] Example 2:

[0071] like Figure 4 As shown, the difference from Embodiment 1 is that the first channel input circuit 1a includes a first switch 1c, specifically as follows: Figure 5 As shown, PH1 acts as the first switch 1c.

[0072] Please see Figure 4 This is a schematic diagram of a circuit module according to another embodiment of this disclosure. The STO circuit structure and operating principle of this embodiment are similar to those of... Figure 2 The STO circuit structure and operating principle shown are similar, so they will not be described again here, only using the same symbols to represent similar circuit structures and operations. In contrast, as shown... Figure 2 The first channel input circuit 1a of the STO circuit shown in this embodiment does not have... Figure 2 The first logic circuit 1b and the first switch 1c are shown. Therefore, the output terminal of the first channel input circuit 1a is electrically connected to the power supply Vcc of the isolation drive unit 3 of the upper bridge arm switch and the second switch 2c. So PH1 in the first channel input circuit 1a constitutes the first switch 1c, specifically as follows: Figure 5 As shown. At this time, the power supply of the isolation drive unit 3 of the upper bridge arm switch tube is only controlled by the elevator safety circuit 6, and not by the diagnostic circuit 4.

[0073] Example 3

[0074] like Figure 6As shown, the difference from Embodiment 2 is that the first channel input circuit 1a includes not only the first switch 1c, but also Vcc. The specific details of its first channel input circuit 1a are as follows: Figure 7 As shown, the DC / DC module not only collects information about elevator safety circuit 6, but also provides power.

[0075] Please see Figure 6 This is a schematic diagram of a circuit module according to another embodiment of this disclosure. The STO circuit structure and operating principle of this embodiment are similar to those of... Figure 2 The STO circuit structure and operating principle shown are similar, so they will not be described again here, only using the same symbols to represent similar circuit structures and operations. In contrast, as shown... Figure 2 The first channel input circuit 1a of the STO circuit shown in this embodiment does not have... Figure 2 The diagram shows the first channel input circuit 1a, the first logic circuit 1b, and the first switch 1c. Therefore, the output of the first channel input circuit 1a is electrically connected to the second switch 2c. Thus, the first channel input circuit 1a constitutes the power supply for the isolation drive unit 3 of the upper bridge arm switch transistor and the first switch 1c, specifically as follows... Figure 7 As shown. At this time, the power supply of the isolation drive unit 3 of the upper arm switch transistor is only controlled by the elevator safety circuit 6, and not by the diagnostic circuit 4. The first channel input circuit 1a not only collects the information of the elevator safety circuit 6 through the DC / DC module, but also provides the power supply Vcc of the isolation drive unit 3 of the upper arm switch transistor.

[0076] In the above embodiments, the power supply for the elevator safety circuit 6 is DC 48V, but it can also be other voltages, such as DC 24V or AC 110V. When the elevator safety circuit 6 is powered by AC power, the on / off information of the safety circuit 6 can be transmitted through an optocoupler after rectification, or the information of the safety circuit 6 can be obtained through a DC to DC converter module after rectification, or the information of the elevator safety circuit 6 can be obtained through voltage regulation by a transformer and then rectification.

[0077] In some embodiments, the second channel circuit cannot directly disconnect the second switch in hardware, but instead disconnects the second switch 2c through the diagnostic circuit 4, such as... Figure 8 As shown. In this case, the microcontroller resources used in diagnostic circuit 4 can be reduced, but the safety is comparable. Figure 2 The indicated value will decrease.

[0078] In some embodiments, the second channel circuit does not cut off the power supply to the isolation drive unit 3 of the upper bridge arm switch, but instead cuts off the enable or power supply to the upper bridge arm PWM buffer, such as... Figure 9As shown in Figure 10. The diagnosis of the buffer can be achieved using existing technologies, such as CN111404423A, which uses the remaining channels of the buffer to diagnose whether the buffer's EN function is effective; or CN101908833A, which uses diodes to form a wired OR circuit for diagnosis; or directly acquiring the output of the upper bridge arm PWM buffer for diagnosis. In this case, the diagnostic logic of the second channel loop is simpler, unlike in Embodiment 1 where the first switch needs to be closed before the second switch can be diagnosed.

Claims

1. A safe torque off circuit, comprising: The application relates to a safety circuit for an elevator drive, comprising: a channel circuit configured to obtain a safety signal from a safety circuit of the elevator, and in response to a safety signal state, cut off the power supply of an isolation drive unit of an upper bridge arm switch tube or a lower bridge arm switch tube; a diagnosis circuit receiving an output state of the channel circuit, and when a diagnosis abnormality occurs, cutting off the driving signal of the upper bridge arm switch tube or the lower bridge arm switch tube.

2. The safety torque off circuit of claim 1, wherein, The channel circuit is two, comprising a first channel circuit and a second channel circuit, and the first channel circuit or the second channel circuit can cut off the power supply of the isolation drive unit; or the first channel circuit or the second channel circuit cuts off the enablement or power supply of a buffer.

3. The safety torque off circuit of claim 2, wherein, The first channel circuit or the second channel circuit is configured to obtain a safety signal from a safety circuit of the elevator, and in response to a safety signal state, cut off the power supply of an isolation drive unit of an upper bridge arm switch tube or a lower bridge arm switch tube.

4. The safety torque off circuit of claim 3, wherein, The first channel circuit and the second channel circuit each comprise a channel input circuit, a logic circuit and a switch; the channel input circuit is configured to be connected to a safety circuit of the elevator to receive a safety signal, and an output end is connected to a first input end of the logic circuit; an output end of the logic circuit outputs an on-off signal to a control end of the switch, so that when the safety signal is disconnected, the switch is cut off, thereby cutting off the power supply of the isolation drive unit on the upper bridge arm switch tube or the lower bridge arm switch tube.

5. The safety torque off circuit of claim 4, wherein, An input end of the diagnosis circuit receives the output state of the channel input circuit and the switch.

6. The safety torque off circuit of claim 5, wherein, The input end of the diagnosis circuit also receives the output state of the logic circuit.

7. The safety torque off circuit of claim 6, wherein, The output state of the first channel circuit or the second channel circuit is different from each other at least in a given period.

8. The safety torque off circuit of claim 7, wherein, An output end of the diagnosis circuit outputs an on-off signal to a second input end of the logic circuit of the first channel circuit and the second channel circuit respectively.

9. The safety torque off circuit of claim 8, wherein, The logic circuit of the first channel circuit or the second channel circuit adopts an or logic circuit to generate a control signal for cutting off the switch, so that when the channel input circuit receives the safety signal to be disconnected, or the diagnosis circuit outputs the off signal, the switch is cut off.

Images