ARRANGEMENT AND PROCEDURE FOR SAFE SHUTDOWN

Abstract

Safety circuit (SC) coupled between a first DC circuit (POW1) and a second DC circuit (POW2), wherein the first DC circuit (POW1) supplies current to the second DC circuit (POW2), the safety circuit (SC) comprising: - a first series circuit between positive poles of the first and second DC circuits (POW1, POW2), wherein the first series circuit comprises a first diode (D1) with an anode coupled to the first DC circuit (POW1) and a cathode coupled to a first terminal of a first controllable switch (S1) and a second diode (D2) with an anode coupled to a second terminal of the first controllable switch (S1) and a cathode coupled to the second DC circuit (POW2), - a second series connection between the negative poles of the first and second DC circuits (POW1, POW2), wherein the second series connection comprises a third diode (D3) with an anode coupled to the second DC circuit (POW2) and a cathode coupled to a second terminal of a second controllable switch (S2) and a fourth diode (D4) with an anode coupled to a first terminal of the second controllable switch (S2) and a cathode coupled to the first DC circuit (POW1), - a first energy storage device (C1) coupled between the positive pole of the second DC circuit (POW2) and the first terminal of the second controllable switch (S2), - a second energy storage device (C2) coupled between the negative pole of the second DC circuit (POW2) and the first terminal of the first controllable switch (S1), - a first feedback circuit that provides a first feedback signal (S _F ) to indicate an active state of the first controllable switch, and - a second feedback circuit that provides a second feedback signal (S _F ) to indicate an active state of the second controllable switch (S2).

Description

Field of invention

[0001] The present invention relates to functional reliability in a power electronics device. General state of the art

[0002] The purpose of functional safety is to ensure freedom from an unacceptable risk of physical injury or impairment of people's health, either directly or indirectly. The principles governing how safety functions are to be implemented are covered by international standards; for example, IEC 61508 provides the requirements for electrical systems.

[0003] An example of functional safety is the so-called STO (Save Turn-Off) function, which, in the context of power electronics devices, means that it must be possible to reliably switch off the output power. The reliability requirement typically means that the design of the electrical circuit arrangement between the operator (i.e., a person pressing the on / off button) and the actuator (i.e., the power electronics component that switches the output power on / off) must be reliable and its functionality must be testable.

[0004] In modern power electronics equipment, controllable power semiconductor switches, such as IGBTs (Insulated Gate Bipolar Transistors), are typically used as power switches in main circuits. In a STO (Safety-Off) situation, it is essential to ensure that all power switches remain in the off state. One safe way to achieve this is to disconnect the auxiliary voltage that supplies power to the gate drivers to generate control pulses for the controllable power semiconductor switches. A problem with using this method is that the safety function test interrupts the operation of the equipment, which is undesirable in many continuously running processes.

[0005] Document WO 2017 / 171540 A1 discloses a power electronic switching converter that uses a cross-coupled charge pump topology to generate high positive and negative switching voltages. The circuit comprises several capacitive stages and at least one switching or coupling unit, which alternately connects these stages depending on a pulse-modulated drive signal. This achieves the addition of partial voltages without requiring a galvanically isolated voltage source for each stage. The topology is designed for largely symmetrical switching behavior with similar rise and fall times. Various embodiments with cascaded and parallel-connected stages allow for adjustment of voltage level and power. The system is particularly suitable for high-frequency PWM applications in the high-voltage range. Brief description of the invention

[0006] The object of the present invention is to provide a novel arrangement and a novel method for ensuring that the functionality of the output power shutdown circuit arrangement can be tested. According to the invention, the operating condition of critical safety components in a DC auxiliary power supply system can be regularly tested during the operation of a power electronics device without interrupting its operation. The following is a brief description to provide a basic understanding of some aspects of various embodiments of the invention; a more detailed description of exemplary embodiments follows later. The object of the invention is achieved by what is specified in the independent claims; other preferred embodiments are disclosed in the dependent claims.

[0007] The fundamental characteristic feature of the safety shutdown arrangement according to the present invention is that a DC auxiliary voltage of a functional unit, which ensures the safety of the output connection of a power electronics device when unenergized, is supplied via the safety circuit, which comprises the following features: - Each pole of the DC auxiliary voltage can be disconnected separately, - if only one DC pole is disconnected, an energy storage device keeps the output voltage of the safety circuit arrangement above a limit value for at least a predefined period of time, - when both DC poles are disconnected, the output voltage drops below a limit without delay, and - The safety shutdown circuit generates component-specific feedback signals that indicate the operating states of those critical components that perform the DC pole isolation.

[0008] In a safety shutdown arrangement, comparing operating instructions and corresponding feedback signals provides a reliable indication of the functionality of the safety-critical DC circuit-disconnecting components, which is a requirement for meeting the requirements of safety standards, e.g., IEC 61508. This comparison can be performed in any control block that monitors the functional safety of a power electronics device, e.g., in the control unit of a frequency converter.

[0009] The component used to disconnect a DC auxiliary voltage pole can be, for example, a MOSFET transistor, a bipolar transistor, a mechanical switch, etc. The feedback signal for monitoring the functionality of the disconnecting component can be generated, for example, using an optocoupler.

[0010] In a method according to the present invention, the functionality of the safety circuit arrangement can be regularly tested by short disconnection periods of a DC auxiliary voltage pole. The test period can be selected such that it is sufficiently short that the output voltage of the safety circuit arrangement remains above a minimum operating level of the load circuit during the test pulse.

[0011] In a safety shutdown situation, both poles of the DC auxiliary voltage are disconnected simultaneously.

[0012] The arrangement and method according to the present invention enable the functionality of a safety shutdown circuit to be tested during the operation of the power electronics device without interrupting its normal operation. In a safety shutdown situation, the circuit disconnects the auxiliary voltage, thereby ensuring that the energizing of the output terminals of the power electronics device is quickly prevented. Description of drawings

[0013] The invention is explained in more detail below using examples and with reference to the accompanying figures. These show Fig. 1 a main circuit of a frequency converter drive, Fig. 2 an auxiliary voltage arrangement, Fig. 3 a safety circuit, Fig. 4 the work of the safety circuit, Fig. 5 a flowchart showing an example test algorithm for the safety circuit, and Fig. 6 an auxiliary voltage arrangement containing a safety circuit. Detailed description of the invention

[0014] Fig. Figure 1 presents the main circuit diagram of a variable-speed motor drive as an example of a power electronics device, wherein a functional safety circuit arrangement according to the present invention is applicable. In the figure, a frequency converter FC is used to control the shaft speed of an AC motor M. In this example, the frequency converter FC includes a rectifier REC, which converts the three-phase supply voltage U L in a through a capacitor C DC filtered constant DC intermediate circuit voltage rectified, and a three-phase inverter unit INU, which provides an adjustable three-phase output voltage U MThe INU generates a voltage to power the motor M. It consists of controllable power semiconductor switches, typically IGBTs (not shown), and freewheeling diodes (not shown). The frequency converter FC also includes a control unit CU and an auxiliary power supply POW, which converts an input voltage from the DC link into several lower-level DC output voltages, for example, for the control unit CU and the gate driver unit of the INU (not shown).

[0015] In a STO situation, the rotation of a motor shaft induced by the output voltage of the frequency converter should be prevented. This objective can be achieved by ensuring that all controllable power semiconductor switches of the INU remain in an off state.

[0016] Fig. Figure 2 presents a simplified example of a control and auxiliary power supply system in a frequency converter. The first auxiliary power supply, POW1, converts the DC intermediate circuit voltage U. DC into a first lower voltage U CU for the control unit CU and into a second lower voltage U GD for the gate driver unit GD. Within the gate driver unit GD, a second auxiliary voltage power supply POW2 converts the U GD -Voltage into separate auxiliary voltages for each gate driver GD1, GD2, ... which convert the control signals of the inverter-controlled power semiconductor switches (only V1 is presented) according to the control signals V received by the control unit CU _G trains.

[0017] Fig. Figure 3 presents an example of a safety circuit SC according to the present invention. The circuit SC is located between a first auxiliary voltage power supply POW1 with a DC output voltage U. GD1with a positive pole U GD1+ and a negative pole U GD1- and a second auxiliary power supply POW2 with a DC input voltage U GD2 with a positive pole U GD2+ and a negative pole U GD2- The safety circuit includes the following: - a series circuit consisting of a first diode D1, a first switch S1 and a second diode D2 between U GD1+ and U GD2+ , so that the forward direction of both diodes is U GD2+ is switched on, - a series circuit consisting of a third diode D3, a second switch S2 and a fourth diode D4 between U GD1- and U GD2- , so that the forward direction of both diodes is U GD1- is switched on, - a first energy storage device, advantageously a capacitor C1, between U GD2+ and switched the anode connection of D4, - a second energy storage device, advantageously a capacitor C2, between the cathode terminals of D1 and U GD2- switched, - a first feedback circuit comprising a series circuit of a resistor R1 and a light-emitting photodiode of an optocoupler H1, connected between the anode terminals of D2 and D4, so that the forward direction of the optocoupler light-emitting diode is switched to S2, and - a second feedback circuit comprising a series circuit of a resistor R2 and a light-emitting photodiode of an optocoupler H2, connected between the cathode terminals of D1 and D3, so that the forward direction of the optocoupler light-emitting diode is switched to S2.

[0018] Fig. 4 illustrates the operation of the in Fig. Figure 3 presents a safety circuit. The purpose of the curves is to illustrate simple operating principles; they are not drawn to scale relative to each other. Signals S and H indicate the operation of switches S1 and S2 and the operating states of feedback signals H1 and H2, such that a high signal indicates a closed switch and an active feedback signal.

[0019] In a normal working situation, before time t1 both switches S1, S2 are in a closed state, which means that U GD1+ via diodes D1, D2 with U GD2+ , connected is and U GD1- via diodes D3, D4 with U GD2- is connected. Thus, the input voltage U GD2 from POW2 close to the output voltage U GD1from POW1. Furthermore, when both switches S1, S2 are in the closed state, a current flows through both optocouplers H1, H2, indicating the normal functionality of the safety circuit SC.

[0020] At time t1, switch S1 changes to an open state. Since current cannot flow to the optocoupler H1 from either the first auxiliary power supply POW1 (due to the open switch S1) or the second auxiliary power supply POW2 (due to the blocking diode D2), the feedback signal from H1, which indicates the operating state of S1, changes to an inactive state. In the open state of S1, U GD1+ no longer with U GD2+ connected, but due to the energy stored in C1 before t1, its voltage U C1 and also the voltage U GD2 at a limited rate. S1 switches back to the closed state at time t2, before U GD2the smallest operating voltage limit (predefined safety limit) U LIM POW2 has reached its operating state. Therefore, POW2 can continue its normal operation during the time period t1-t2, and at the same time the feedback signal H1 indicates that the switch S1 is operational.

[0021] A similar operating condition test, as described above for S1, is performed for S2 during the time period t3-t4. Analogous to C1 above, during the test the energy of capacitor C2 prevents the voltage U from rising. GD2 below the limit (predefined safety limit) U LIM falls. As in Fig. As shown in Figure 4, switch S2 changes to an open state at time t3. Since the current from the optocoupler H2 cannot flow to either the first auxiliary power supply POW1 (due to the open switch S2) or the second auxiliary power supply POW2 (due to the blocking diode D3), the feedback signal from H2, which indicates the operating state of S2, changes to an inactive state. In the S2 open state, U GD1+ no longer with U GD2+ connected, but due to the energy stored in C2 before t3, its voltage takes on u C2 and also the voltage U GD2 at a limited rate. S2 is switched back to the closed state at time t4, before U GD2 the smallest operating voltage limit U LIM POW2 has reached its operating state. Therefore, POW2 can continue its normal operation during the time period t3-t4, and at the same time the feedback signal H2 indicates that the switch S1 is operational.

[0022] At time t5, both switches S1 and S2 are switched to the open state as a consequence of an STO command. The open switches now prevent direct connections via diodes D1-D4 between U GD1 and U GD2 And the open switches also prevent the fully charged capacitors C1 and C2 from supplying energy to POW2. Thus, the voltage U drops. GD2 immediately to 0, which means that if POW2 is no longer able to supply auxiliary voltages for the gate drivers in an arrangement such as in Fig. 2 is presented to deliver. The lack of an auxiliary voltage prevents the gate drivers from generating turn-on pulses for the power semiconductor switches controlled by the main circuit, which is the goal in a safety shutdown situation. It should also be noted that in the event of a switch component failure, i.e., S1 or S2 remaining in the closed state, the condition for a safe shutdown will be met, but with a delay due to the stored energy of C1 or C2.

[0023] Fig. Figure 5 is a flowchart illustrating an example test algorithm for the safety circuit. The flowchart begins with the safety circuit in normal operating mode (where switches S1 and S2 are closed and optocouplers H1 and H2 are in an active state). Next, switch S1 is opened, and it is determined whether optocoupler H1 changes to an inactive state. If so, the algorithm proceeds to the next step; otherwise, it terminates by reporting an error. In the next step, switch S1 is closed, and switch S2 is opened, and it is determined whether optocoupler H2 has changed state. If so, the algorithm terminates by indicating that the circuit is operating normally; otherwise, it terminates by reporting an error.

[0024] Fig. Figure 6 presents an otherwise similar simplified example of a control and auxiliary voltage supply system in a frequency converter, as in Fig. 2 is presented, but with an added safety circuit SC. In this example, the first auxiliary voltage is U. GD1 wired via a safety circuit SC, according to the circuit of Fig. 3, to obtain the final auxiliary voltage U GD2 to train the gate driver unit GD. The control unit CU generates the control signals S_c for the switches (S1, S2 in Fig. 3) receives the feedback signals S _F , which indicate the operating states of the switches, and performs the logic operations required to meet the functional safety requirements. The feedback signals S _F may contain the output of the optocoupler phototransistors.

[0025] The phototransistor components of the aforementioned optocouplers H1 and H2 are in Fig.Figure 6 is shown only in a highly schematic form. Advantageously, the phototransistors are connected to a safety logic circuit (which may form part of the control unit CU and may be separate from the control unit CU) belonging to a safety arrangement according to the present invention, wherein the functionality of the safety-critical components is continuously monitored in the arrangement by comparing the operating instructions of switches S1, S2 and the corresponding feedback signals from the optocouplers H1, H2. Note that an optocoupler is used above simply as an example of an advantageous component; other commercially available signal-transmitting devices exist with isolation between the transmitter (corresponding to a photodiode above) and the receiver (corresponding to a phototransistor above).

[0026] The specific examples provided in the description above are not exhaustive unless expressly stated otherwise, nor should they be construed as limiting the scope of protection and / or the applicability of the attached claims. The features listed in the attached dependent claims may be freely combined with one another unless expressly stated otherwise. The verbs "comprise" and "contain" are used in this document as open limitations that neither exclude nor require the existence of features not listed. Furthermore, the use of "a / an / an," i.e., a singular form, in this document should be understood as not precluding multiple features. REFERENCE MARK U LIM Operating voltage limit (limit or predefined safety limit) U DC DC intermediate circuit voltage U M Three-phase output voltage INU Three-Phase Inverter Unit U L Three-phase supply voltage D1-D4 diodes FC frequency converter REC rectifier GD Gate Driver Unit U GD1 first auxiliary voltage (DC input voltage or output voltage) U GD2 second (final) auxiliary voltage (DC input voltage or input voltage) POW1, POW2 Auxiliary power supply (auxiliary voltage power supply) C1, C2, C DC Energy storage device, capacitors V1 Power semiconductor switch M Motors (AC motor) U CU first lower voltage U GD second lower voltage H1, H2 optocouplers S _F feedback signal S1, S2 switch (control switch) SC safety circuit S, H signals CU control unit S_c, V_ GControl signal R1, R2 resistors

Claims

[1] Safety circuit (SC) coupled between a first DC circuit (POW1) and a second DC circuit (POW2), wherein the first DC circuit (POW1) supplies current to the second DC circuit (POW2), the safety circuit (SC) comprising: - a first series circuit between positive poles of the first and second DC circuits (POW1, POW2), wherein the first series circuit comprises a first diode (D1) with an anode coupled to the first DC circuit (POW1) and a cathode coupled to a first terminal of a first controllable switch (S1) and a second diode (D2) with an anode coupled to a second terminal of the first controllable switch (S1) and a cathode coupled to the second DC circuit (POW2), - a second series connection between the negative poles of the first and second DC circuits (POW1, POW2), wherein the second series connection comprises a third diode (D3) with an anode coupled to the second DC circuit (POW2) and a cathode coupled to a second terminal of a second controllable switch (S2) and a fourth diode (D4) with an anode coupled to a first terminal of the second controllable switch (S2) and a cathode coupled to the first DC circuit (POW1), - a first energy storage device (C1) coupled between the positive pole of the second DC circuit (POW2) and the first terminal of the second controllable switch (S2), - a second energy storage device (C2) coupled between the negative pole of the second DC circuit (POW2) and the first terminal of the first controllable switch (S1), - a first feedback circuit that provides a first feedback signal (S_F ) to indicate an active state of the first controllable switch, and - a second feedback circuit that provides a second feedback signal (S _F ) to indicate an active state of the second controllable switch (S2). [2] Safety circuit (SC) according to claim 1, wherein the first energy storage device (C1) is dimensioned such that the voltage level of the second DC circuit (POW2) during the opening of the first switch (S1) is above a predefined safety limit (U) for a predefined test pulse period LIM ) is held. [3] Safety circuit (SC) according to claim 1 or 2, wherein the second energy storage device (C2) is dimensioned such that the voltage level of the second DC circuit (POW2) during the opening of the second controllable switch (S2) is above a predefined safety limit (U) for a predefined test pulse period LIM ) is held. [4] Safety circuit (SC) according to one of claims 1 to 3, wherein the first and second energy storage device are capacitors (C1, C2). [5] Safety circuit (SC) according to any preceding claim, wherein - the first feedback circuit is connected between the second terminal of the first switch (S1) and the first terminal of the second switch (S2), and - the second feedback circuit is connected between the first terminal of the first switch (S1) and the second terminal of the second switch (S2). [6] Safety circuit (SC) according to claim 5, wherein: - the first feedback circuit comprises a series circuit consisting of a first resistor (R1) and a transmitter of a first signal transformer, and - the second feedback circuit comprises a series circuit consisting of a second resistor (R2) and a transmitter of a second signal transmitter. [7] Safety circuit (SC) according to claim 6, wherein a first and second optocoupler (H1, H2) are used as the first and second signal transmitters respectively, wherein each optocoupler (H1, H2) contains a photodiode which acts as a transmitter and is coupled such that the forward direction of the photodiode is to the second switch (S2). [8] Safety shutdown arrangement comprising a safety circuit (SC) according to any one of claims 1 to 7, and a control device for monitoring the functional safety of a power electronics device, wherein the control device is designed to control the operation of the controllable switches (S1, S2) in the safety circuit, to receive the feedback signals (S _F ) from the safety circuit, for comparing the control signals (S_c, V) _G ) the controllable switches (S1, S2) and the feedback signals (S _F) and to use the comparison results as indicators for the functionality of safety-critical components. [9] Power electronic device comprising a safety circuit (SC) or a safety shutdown arrangement according to any of the preceding claims, wherein the second DC circuit (POW2) supplies current to gate driver units (GD), wherein the gate driver units (GD) control the operation of controllable power electronic switches which form an output voltage (U) GD1 ) of the power electronics unit. [10] Method for operating a safety circuit (SC) according to any one of claims 1 to 7, a safety shutdown arrangement according to claim 8 or a power electronics device according to claim 9, wherein the method comprises: - Working in a normal mode in which both the first and second control switches (S1, S2) are closed, - Opening one of the first and second controllable switches (S1, S2) and, if the corresponding feedback signal (S _F ) remains in an active state, determining that the safety circuit (SC) is faulty. [11] The method of claim 10, further comprising: - Opening the other of the first and second controllable switches (S1, S2), and if the corresponding feedback signal (S _F ) remains in an active state, determining that the safety circuit (SC) is faulty. [12] Method according to claim 10 or 11, wherein the relevant controllable switch (S1, S2) is opened for a predefined period during which the voltage of the second DC circuit (POW2) does not fall below a predefined minimum operating level. [13] Method according to any one of claims 10 to 12, further comprising opening the first and second controllable switches (S1, S2) in a safety shutdown mode.

Images