Protection device, drive system, protection method, and program

Abstract

This protection device comprises: a determination unit that determines, on the basis of input signals input from a magnetic geared motor, an inverter, a rotation angle sensor, a current sensor, a main control device, and an inverter control device, whether a failure mode of a drive system is a heavy failure indicating a failure in which the magnetic geared motor of the magnetic geared motor cannot be controlled or a light failure indicating a failure in which the magnetic geared motor can be controlled; and a resynchronization processing unit that resynchronizes the rotations of a high-speed rotor and a low-speed rotor when it is determined that the failure mode is the heavy failure and only step-out occurs.

Description

Protection device, drive system, protection method, and program

[0001] This application claims priority to Japanese Patent Application No. 2024-091457, filed on June 5, 2024, the contents of which are incorporated herein by reference.

[0002] FIG. 12 is a diagram showing the configuration of a drive system according to the prior art. As shown in FIG. 12, the drive system 9 includes a magnetic-geared motor PDD that rotates a load machine LD (such as a propeller or a wheel). The magnetic-geared motor PDD includes a high-speed rotor HSR and a low-speed rotor PPR. The high-speed rotor HSR and the low-speed rotor PPR transmit torque in a non-contact manner via a magnetic spring. This magnetic spring causes the low-speed rotor PPR to rotate synchronously with the high-speed rotor HSR at a predetermined reduction ratio. The rotation of the low-speed rotor PPR rotates the load machine LD, which is connected via a coupling JT and a rotating shaft (not shown).

[0003] For example, if a load torque greater than the maximum transmission torque of the magnetic spring occurs, or if the rotation speed of the high-speed rotor HSR suddenly changes, the high-speed rotor HSR and the low-speed rotor PPR will no longer be able to rotate in synchronization. This phenomenon is called step-out. When step-out occurs, it becomes difficult to continue operation safely, and therefore the operation of the magnetic-geared motor PDD must be stopped.

[0004] Fig. 13 is a diagram showing an example of measured values ​​when a step-out occurs in the conventional technology. Fig. 13 shows a time series of (a) the rotation speed [rpm] of the high-speed rotor HSR, (b) the rotation speed [rpm] of the low-speed rotor PPR, (c) the torsion angle [deg] (the difference in rotation angle between the high-speed rotor HSR and the low-speed rotor), (d) the motor torque [Nm], (e) the load torque [Nm], and (f) the torsional torque [Nm] of the joint. In the example of Fig. 13, an overload occurs at time t1, and a step-out occurs at time t2.

[0005] During a loss of synchronization, the magnetic-geared motor PDD generates an alternating torque whose amplitude is the maximum transmission torque and whose frequency fluctuates in proportion to the speed difference between the high-speed rotor HSR and the low-speed rotor PPR. Conventional techniques detect loss of synchronization, for example, based on the rotational speed deviation or torsion angle between the high-speed rotor HSR and the low-speed rotor PPR. When loss of synchronization is detected, the magnetic-geared motor PDD is rapidly braked, for example, by applying regenerative braking. However, because the load machine LD cannot immediately stop due to inertia, as shown in the example of Figure 13, the low-speed rotor PPR may continue to rotate in conjunction with the load machine LD even after the motor torque becomes zero, potentially causing the alternating torque to continue. Resonance occurs when the frequency of this alternating torque matches the torsional eigenvalue of the rotating shaft, etc. As this resonance grows, excessive torsional torque is generated at the joint JT, as shown in Figure 13 (f), potentially damaging various devices in the drive system 9 (the joint JT and surrounding mechanical components). Therefore, an interlock logic for safely stopping the magnetic-geared motor PDD and the load machine LD is important so as not to damage the equipment.

[0006] For example, Patent Document 1 describes an interlock control for emergency braking of a train.

[0007] Japanese Patent No. 6254576

[0008] In the drive system 9, it is necessary to safely stop the magnetic-geared motor PDD and the load machine LD so as not to damage the mechanical components, not only when a step-out occurs but also when devices essential for controlling the magnetic-geared motor PDD, such as sensors and inverters, fail. However, in the prior art, a mechanism for safely stopping the magnetic-geared motor PDD and the load machine LD has not been adequately considered. Furthermore, it is desirable to attempt to eliminate the step-out of the magnetic-geared motor (resynchronization) before stopping the magnetic-geared motor PDD and the load machine LD, thereby suppressing a decrease in the availability of the drive system 9.

[0009] An object of the present disclosure is to provide a protection device, a drive system, a protection method, and a program that can resynchronize a magnetic-geared motor and suppress a decrease in the availability of the drive system.

[0010] According to one aspect of the present disclosure, a protection device includes a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine, an inverter that supplies current to the magnetic-geared motor, a rotation angle sensor that measures the rotation angles and rotation speeds of the high-speed rotor and the low-speed rotor, a current sensor that measures current flowing from the inverter to the magnetic-geared motor, a main control device that outputs a torque command to control the torque of the magnetic-geared motor, and an inverter that outputs a current command to adjust the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current. and an inverter control device, the protection device for a drive system comprising: a determination unit that determines whether the failure mode of the drive system is a major failure of the magnetic-geared motor indicating a failure in which the magnetic-geared motor cannot be controlled, or a minor failure indicating a failure in which the magnetic-geared motor can be controlled, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control device, and the inverter control device; and a resynchronization processing unit that resynchronizes the rotation of the high-speed rotor and the low-speed rotor when the failure mode is determined to be a major failure and only step-out has occurred.

[0011] According to one aspect of the present disclosure, a drive system includes a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine, an inverter that supplies current to the magnetic-geared motor, a rotation angle sensor that measures the rotation angle and rotation speed of the high-speed rotor and the low-speed rotor, a current sensor that measures current flowing from the inverter to the magnetic-geared motor, a main control device that outputs a torque command to control the torque of the magnetic-geared motor, and a control unit that controls the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current. a determination unit that determines whether the failure mode is a major failure of the magnetic-geared motor indicating a failure that makes it impossible to control the magnetic-geared motor, or a minor failure that indicates a failure that makes it possible to control the magnetic-geared motor, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control unit, and the inverter control unit; and a resynchronization processing unit that resynchronizes the rotation of the high-speed rotor and the low-speed rotor when the failure mode is determined to be a major failure and only step-out has occurred.

[0012] According to one aspect of the present disclosure, a protection method includes a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine, an inverter that supplies current to the magnetic-geared motor, a rotation angle sensor that measures the rotation angles and rotation speeds of the high-speed rotor and the low-speed rotor, a current sensor that measures current flowing from the inverter to the magnetic-geared motor, a main control device that outputs a torque command to control the torque of the magnetic-geared motor, and an inverter that outputs a current command to adjust the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current. and an inverter control device, the method comprising: determining whether a failure mode of the drive system is a major failure of the magnetic-geared motor indicating a failure in the magnetic-geared motor that makes it impossible to control the magnetic-geared motor, or a minor failure indicating a failure in the magnetic-geared motor that makes it possible to control the magnetic-geared motor, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control device, and the inverter control device; and if the failure mode is determined to be a major failure and only step-out has occurred, resynchronizing the rotation of the high-speed rotor and the low-speed rotor.

[0013] According to one aspect of the present disclosure, a program includes a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine, an inverter that supplies current to the magnetic-geared motor, a rotation angle sensor that measures the rotation angles and rotation speeds of the high-speed rotor and the low-speed rotor, a current sensor that measures current flowing from the inverter to the magnetic-geared motor, a main control device that outputs a torque command to control the torque of the magnetic-geared motor, and a current command that adjusts the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current. and an inverter control device, the protection device for the drive system executes the steps of: determining whether the failure mode of the drive system is a major failure of the magnetic-geared motor indicating a failure in which the magnetic-geared motor cannot be controlled, or a minor failure indicating a failure in which the magnetic-geared motor can be controlled, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control device, and the inverter control device; and if the failure mode is determined to be a major failure and only step-out has occurred, resynchronizing the rotation of the high-speed rotor and the low-speed rotor.

[0014] According to the above aspect, the magnetic-geared motor is resynchronized, and a decrease in the availability of the drive system is suppressed.

[0015] 1 is a diagram showing an overall configuration of a drive system according to a first embodiment. FIG. 2 is a block diagram showing a functional configuration of a protection device according to the first embodiment. FIG. 3 is a diagram showing an example of a failure mode according to the first embodiment. FIG. 4 is a flowchart showing an example of interlock control of the drive system according to the first embodiment. FIG. 5 is a diagram showing an example of step-out limit information according to the first embodiment. FIG. 6 is a diagram for explaining the function of the drive system according to the first embodiment. FIG. 7 is a first diagram (prior art) showing an example of measured values ​​when a major failure occurs. FIG. 8 is a diagram showing an example of load characteristics. FIG. 9 is a second diagram (technology of the first embodiment) showing an example of measured values ​​when a major failure occurs. FIG. 10 is a block diagram showing a functional configuration of a protection device according to a second embodiment. FIG. 11 is a flowchart showing an example of interlock control of the drive system according to the second embodiment. FIG. 12 is a diagram showing the configuration of a drive system according to a prior art. FIG. 13 is a diagram showing an example of measured values ​​when step-out occurs according to a prior art.

[0016] First Embodiment Hereinafter, an embodiment will be described in detail with reference to the drawings.

[0017] (Overall configuration of drive system) FIG. 1 is a diagram showing the overall configuration of a drive system according to a first embodiment. The drive system 1 is a system for driving a load machine LD. The drive system 1 is applied, for example, to a propulsion device for a vehicle (such as a train) or a ship, or a wind turbine for wind power generation. The load machine LD is a wheel, a fan, a propeller, or the like. Note that, depending on the application of the drive system 1, the component depicted by the dashed line (contactor 11) may not be used. In this case, this component may be omitted.

[0018] As shown in FIG. 1 , the drive system 1 includes an inverter 10 , a contactor 11 , a magnetic-geared motor 12 , a braking device 13 , a main control device 2 , an inverter control device 3 , and a protection device 4 .

[0019] The inverter 10 has a semiconductor switch 101 having a plurality of switching elements such as an IGBT (Insulated Gate Bipolar Transistor) and a MOSFET (Metal-Oxide-Semiconductor Field Effect Transistor). The inverter 10 switches the switching pattern of the semiconductor switch 101 to supply a current commanded by the inverter control device 3 to the magnetic-geared motor 12.

[0020] The contactor 11 is provided between the inverter 10 and the magnetic-geared motor 12. The contactor 11 cuts off or supplies current to the magnetic-geared motor 12 by opening or closing a power line 102 between the inverter 10 and the magnetic-geared motor 12. Note that the contactor 11 may not be used except for specific applications (for example, a train propulsion device). In such cases, the drive system 1 may omit the contactor 11.

[0021] The magnetic-geared motor 12 has a high-speed rotor HSR and a low-speed rotor PPR. When current supplied from the inverter 10 flows through a stator winding (not shown), the high-speed rotor HSR rotates due to the magnetomotive force of the winding. Motor torque (electrical torque) applied to the high-speed rotor HSR is transmitted to the low-speed rotor PPR via a magnetic spring. As a result, the low-speed rotor PPR rotates in synchronization with the high-speed rotor HSR at a predetermined reduction ratio. At this time, the low-speed rotor PPR rotates at a slower speed than the high-speed rotor HSR in accordance with the reduction ratio. In addition, a load machine LD is connected to a rotating shaft 121 of the low-speed rotor PPR via a coupling JT. Output torque (magnetic spring torque) generated by the magnetic-geared motor 12 is transmitted to the load machine LD via the rotating shaft 121. As a result, the load machine LD rotates.

[0022] The brake device 13 is a device for braking the load machine LD. For example, when the drive system 1 is applied to a vehicle propulsion device, the brake device 13 is a mechanical brake mechanism that uses friction, such as a tread brake or a disc brake. When the drive system 1 is applied to a ship propulsion device or a fluid machine such as a wind turbine, the brake device 13 is a mechanism that changes the blade angle of a variable pitch propeller, a control valve that reduces or cuts off the flow rate of the working fluid, or the like.

[0023] A current sensor 15 is provided on the power line 102 between the inverter 10 and the magnetic-geared motor 12. The current sensor 15 measures the motor current supplied to the magnetic-geared motor 12. A temperature sensor 16 is provided on the magnetic-geared motor 12. The temperature sensor 16 measures, for example, the temperature of the windings of the magnetic-geared motor 12. A rotation angle sensor 17 is provided on the magnetic-geared motor 12. The rotation angle sensor 17 includes a high-speed rotation angle sensor 17A that measures the rotation angle and rotation speed of the high-speed rotor HSR, and a low-speed rotation angle sensor 17B that measures the rotation angle and rotation speed of the low-speed rotor PPR (rotating shaft 121). A sensor 18 is provided on the load machine LD. The sensor 18 is, for example, a rotation angle sensor that measures the rotation angle and rotation speed of the load machine LD.

[0024] The main control device 2 calculates the torque to be output by the magnetic-geared motor 12 based on the rotation speed command given by a higher-level device (not shown) and the measured value of the rotation speed of the magnetic-geared motor 12, and outputs a torque command to the inverter control device 3.

[0025] The inverter control device 3 outputs a current command for obtaining the motor torque commanded by the main control device 2, based on the torque command input from the main control device 2, the motor current supplied to the magnetic-geared motor 12 (measurement value of the current sensor 15), and measurement values ​​of the rotation angles of the high-speed rotor HSR and low-speed rotor PPR of the magnetic-geared motor 12 (measurement value of the rotation angle sensor 17). The inverter 10 generates a voltage based on the command received from the inverter control device 3, and adjusts the current supplied to the magnetic-geared motor 12.

[0026] The protection device 4 is a device for safely stopping the magnetic-geared motor 12 and the load machine LD when a failure or step-out occurs in the drive system 1 .

[0027] (Functional Configuration of Protection Device) Fig. 2 is a block diagram showing the functional configuration of the protection device according to the first embodiment. As shown in Fig. 2, the protection device 4 includes a processor 40, a memory 41, a storage 42, and a communication interface 43.

[0028] The processor 40 operates in accordance with a predetermined program to function as a determination unit 401, a stop processing unit 402, and a brake processing unit 403.

[0029] The determination unit 401 determines the failure mode of the drive system 1 based on input signals received from the magnetic-geared motor 12, the inverter 10, the rotation angle sensor 17, the current sensor 15, the main control device 2, and the inverter control device 3. The determination unit 401 also determines the failure mode of the drive system 1 based on status notification signals from the main control device 2 and the inverter control device 3. The input signals include the status notification signals from the magnetic-geared motor 12, the inverter 10, the main control device 2, and the inverter control device 3, the sensor signals (measured values) from the rotation angle sensor 17 and the current sensor 15, etc.

[0030] 3 is a diagram showing an example of a failure mode according to the first embodiment. As shown in FIG. 3, the failure mode is classified into two types: (A) a major failure and (B) a minor failure.

[0031] (A) Major Failure A major failure is a failure or abnormality that makes it impossible to arbitrarily control the rotation speed or output torque of the magnetic-geared motor 12. Specifically, major failures include the following failures and abnormalities:

[0032] (A1) Failure of the main control unit 2 If the main control unit 2 fails, it will be unable to output an appropriate torque command, resulting in an inability to control the magnetic-geared motor 12. The determination unit 401 determines that the main control unit 2 has failed, for example, when it receives a status notification signal indicating a failure from the main control unit 2 or when the watchdog timer times out.

[0033] (A2) Failure of inverter control device 3 If the inverter control device 3 fails, it will be unable to output the correct current command and voltage command to obtain the torque commanded by the main control device 2, and will therefore be unable to control the magnetic-geared motor 12. The determination unit 401 determines that the inverter control device 3 has failed, for example, when a state notification signal indicating a failure is received from the inverter control device 3 or when the watchdog timer times out.

[0034] (A3) Failure of inverter 10 If the inverter 10 fails, it will be unable to output the current and voltage commanded by the inverter control device 3, and will therefore be unable to control the magnetic-geared motor 12. The determination unit 401 receives a status notification signal indicating the presence or absence of a failure from, for example, a diagnostic device (not shown) provided in the inverter 10, and determines the presence or absence of a failure in the inverter 10 based on this.

[0035] (A4) Failure of current sensor 15 If the current sensor 15 fails, the inverter control device 3 will be unable to output the correct current command and voltage command to obtain the torque commanded by the main control device 2, and will therefore be unable to control the magnetic-geared motor 12. The determination unit 401 determines that the current sensor 15 has failed, for example, when the sensor signal from the current sensor 15 is interrupted.

[0036] (A5) Failure of rotation angle sensor 17 If the rotation angle sensor 17 fails, the inverter control device 3 will not be able to output the correct current command or voltage command to obtain the torque commanded by the main control device 2, and will therefore not be able to control the magnetic-geared motor 12. For example, if the sensor signal from the rotation angle sensor 17 is interrupted, the determination unit 401 determines that the rotation angle sensor 17 has failed.

[0037] (A6) Opening or Short Circuit in Winding of Magnetic-Geared Motor 12 If an opening or short circuit occurs in the winding of the magnetic-geared motor 12, the specified current will not flow in the winding even if voltage is applied from the inverter 10, making it impossible to control the magnetic-geared motor 12. The determination unit 401 monitors the power command output by the inverter control device 3 and the motor current measured by the current sensor 15, and determines that an opening or short circuit in the winding has occurred if the motor current does not flow as commanded even though the inverter 10 is operating normally.

[0038] (A7) Loss of Synchronism When the magnetic coupling between the high-speed rotor HSR and the low-speed rotor PPR is released, motor torque (electrical torque) cannot be transmitted from the high-speed rotor HSR to the low-speed rotor PPR via the magnetic spring, making it impossible to control the magnetic-geared motor 12. At this time, the average value of the magnetic spring torque becomes 0. However, if no failures of (A1) to (A6) above have occurred, it is possible to control the motor torque. The determination unit 401 determines whether loss of synchronism has occurred based on the measured values ​​of the rotation speeds of the high-speed rotor HSR and the low-speed rotor PPR measured by the rotation angle sensor 17. Specifically, the judgment unit 401 judges that a loss of synchronization has occurred when the rotation speed deviation between the rotation speed of the high-speed rotor HSR, converted into the rotation speed of the low-speed rotor PPR based on the reduction ratio, and the rotation speed of the low-speed rotor PPR exceeds a predetermined rotation speed threshold (for example, 10 to 50 rpm), and the rotation angle difference (torsion angle) between the high-speed rotor HSR and the low-speed rotor PPR exceeds a predetermined torsion angle threshold (for example, 90 degrees).

[0039] (B) Minor Fault A minor fault is a fault other than a major fault, and although some kind of fault or abnormality has occurred, it is a fault at a level that allows control of the magnetic-geared motor 12. For example, the determination unit 401 determines that a minor fault has occurred when the winding temperature of the magnetic-geared motor 12 exceeds a temperature threshold value or when a sensor signal from a sensor not used to control the magnetic-geared motor 12 (such as the temperature sensor 16) is lost.

[0040] When it is determined that the failure mode is a major failure, the stop processing unit 402 stops the current flowing from the inverter 10 to the magnetic-geared motor 12. At this time, the stop processing unit 402 outputs a command to the inverter 10 to turn off (gate block) the semiconductor switch 101. When a contactor 11 is provided, the stop processing unit 402 may also output a command to open the contactor 11. Note that the stop processing unit 402 may also execute the same processing as in the case of a major failure when an emergency stop operation is performed by the operator of the drive system 1.

[0041] Furthermore, when it is determined that the failure mode is not a major failure (a minor failure), the stop processing unit 402 adjusts the torque command or the current command in stages until the motor torque becomes equal to or less than a predetermined torque specified value. Note that the stop processing unit 402 may also execute the same processing as in the case of a minor failure when a normal stop operation is performed by the operator of the drive system 1.

[0042] After executing the processing of the stop processing unit 402, the brake processing unit 403 outputs a brake command to the brake device 13 when the motor torque becomes equal to or less than a predetermined torque specified value or when the current flowing through the magnetic-geared motor 12 becomes equal to or less than a predetermined current specified value. Note that the brake processing unit 403 may also execute the same processing when a normal stop operation or an emergency stop operation is performed by the operator of the drive system 1.

[0043] The predetermined program executed by the processor 40 is stored on a computer-readable recording medium. Computer-readable recording media include magnetic disks, magneto-optical disks, CD-ROMs, DVD-ROMs, and semiconductor memories. The computer program may be distributed to a computer via a communication line, and the computer that receives the distribution may execute the program. The program may also be a program for implementing some of the above-described functions. Furthermore, the program may be a so-called differential file (differential program) that can realize the above-described functions in combination with a program already stored in the computer system.

[0044] The memory 41 has a memory area necessary for the operation of the processor 40 .

[0045] The storage 42 is a so-called auxiliary storage device, such as a hard disk drive (HDD), a solid state drive (SSD), etc. The storage 42 stores data that each part of the processor 40 acquires, generates, and references during processing.

[0046] The communication interface 43 transmits and receives signals (control commands, measurement values, status notification signals, etc.) to and from each device.

[0047] (Processing flow of the protection device) Fig. 4 is a flowchart showing an example of interlock control of the drive system according to the first embodiment. Hereinafter, the flow of interlock control of the drive system 1 will be described with reference to Fig. 4. In this embodiment, the protection device 4 performs the interlock control of the drive system 1.

[0048] First, the determination unit 401 determines whether or not a minor fault has occurred in the drive system 1 (step S101). If a minor fault has occurred (step S101; YES), the protection device 4 executes a process for a minor fault (step S102). The process for a minor fault will be described in detail later.

[0049] If a minor fault has not occurred (step S101; NO), the determination unit 401 further determines whether a major fault has occurred in the drive system 1 (step S103). If a major fault has not occurred (step S103; NO), the protection device 4 returns to step S101 and continues to monitor the drive system 1. On the other hand, if a major fault has occurred (step S103; YES), the protection device 4 executes the process for a major fault (steps S104 to S107). The process for a major fault will be described in detail later.

[0050] (1) Processing in the Event of a Minor Fault First, the processing in the event of a minor fault (step S101; YES) will be described. The stop processing unit 402 performs processing to gradually change the torque command so that the rotation of the magnetic-geared motor 12 and the load machine LD safely and quickly stops (torque becomes 0) (step S102).

[0051] FIG. 5 is a diagram showing an example of out-of-step limit information according to the first embodiment. In the event of a minor fault, if a large negative torque (regenerative braking) is suddenly applied to the magnetic-geared motor 12 in an attempt to immediately stop the rotation of the magnetic-geared motor 12, there is a possibility that the magnetic-geared motor 12 may actually lose synchronization. This is due to the magnetic spring characteristics of the magnetic-geared motor 12. The negative torque that leads to out-of-step is expressed, for example, as shown in FIG. 5 , by the relationship between the immediately preceding motor torque (initial torque) (horizontal axis) and the negative torque (vertical axis). The magnetic-geared motor 12 loses synchronization when a negative torque greater than the out-of-step limit L (motor torque less than the out-of-step limit L) is applied. Therefore, to prevent out-of-step, it is necessary to keep the motor torque commanded to the magnetic-geared motor 12 within a stable region R1 that is equal to or greater than the out-of-step limit L.

[0052] Furthermore, the step-out limit L varies depending on the ratio of the moments of inertia of the high-speed rotor HSR and the load machine LD. Specifically, the smaller the moment of inertia of the high-speed rotor HSR is compared to the moment of inertia of the load machine LD, the less likely step-out will occur even if a large negative torque is applied. Furthermore, the moment of inertia of the load machine LD may vary depending on the state of the load machine LD (for example, in the case of a vehicle, the state of wheel slippage, the weight of the load, etc.).

[0053] Since the inertia moment ratio changes in accordance with changes in the moment of inertia of the load machine LD, the out-of-step limit L also changes. Here, the inertia moment ratio is "moment of inertia of the high-speed rotor HSR / moment of inertia of the low-speed rotor PPR+moment of inertia of the load machine LD." Therefore, in step S102, the stop processing unit 402 must determine an appropriate out-of-step limit L in accordance with the moment of inertia ratio and adjust the torque command so that as large a negative torque as possible can be applied within a range that does not cause the magnetic-geared motor 12 to step out.

[0054] Fig. 6 is a diagram for explaining the function of the drive system according to the first embodiment. Specific processing by the stop processing unit 402 in the event of a minor fault (step S102) will be described with reference to Fig. 6. As shown in Fig. 6, when a minor fault occurs, the stop processing unit 402 first outputs a minor fault stop command to the inverter control device 3. The inverter control device 3 receives this minor fault stop command and switches the limit value of the torque command from the normal torque limit value to the minor fault torque limit value.

[0055] The stop processing unit 402 also stores out-of-step limit information D1 (such as the graph or table shown in FIG. 5 ) in which out-of-step limits L1, L2, ... for each moment of inertia ratio are preset through testing, simulation, etc. The stop processing unit 402 then calculates the negative torque limit value (torque limit value in the event of a minor failure) based on the out-of-step limit information D1, inertia ratio information D2 of the high-speed rotor HSR and the load machine LD, and the initial torque (the value of the previous final torque command).

[0056] The inertia ratio information D2 is the inertia moment ratio obtained by "moment of inertia of the high-speed rotor HSR / moment of inertia of the low-speed rotor PPR+moment of inertia of the load machine LD." The inertia moments of the high-speed rotor HSR and the low-speed rotor PPR are values ​​obtained from the specifications of the magnetic-geared motor 12, etc. The inertia moment of the load machine LD is a value that is sequentially acquired based on the specifications and state of the load machine LD. The method of acquiring the inertia moment of the load machine LD may utilize various known techniques.

[0057] The stop processing unit 402 outputs the calculated negative torque limit value to the inverter control device 3. The inverter control device 3 generates a final torque command that limits the torque command (regenerative braking amount) for quickly stopping the magnetic-geared motor 12 to be equal to or greater than the negative torque limit value received from the stop processing unit 402. The torque command (regenerative braking amount) for stopping the magnetic-geared motor 12 may be, for example, the torque command provided to the inverter control device 3 by the stop processing unit 402. In another embodiment, the stop processing unit 402 may generate the final torque command and output it to the inverter control device 3. Furthermore, the inverter control device 3 adjusts the current command to be output to the inverter 10 so that the motor torque matches the final torque command.

[0058] The stop processing unit 402 also acquires the final torque command generated by the inverter control device 3 and records it as the initial torque to be used when calculating the next load torque limit value.

[0059] 4, if the motor torque becomes equal to or less than the specified torque value and the rotation speeds of the high-speed rotor HSR and the low-speed rotor PPR become equal to or less than the specified rotation speeds (step S108; YES), the stop processing unit 402 determines that the drive system 1 is in an operation stop state and ends the processing. Note that the motor torque used in this determination is an estimated value estimated from the motor current measured by the current sensor 15.

[0060] On the other hand, if the motor torque is not below the specified torque value, or if the rotation speeds of the high-speed rotor HSR and the low-speed rotor PPR are not below the specified rotation speeds (step S108; NO), the stop processing unit 402 returns to step S102.

[0061] In this way, the stop processing unit 402 can suppress step-out and perform sudden braking by constantly calculating the negative torque limit value and limiting the amount of regenerative braking so that the motor torque does not change abruptly during a minor fault. This reduces the rotation speeds of the high-speed rotor HSR and the low-speed rotor PPR in conjunction with each other, allowing the magnetic-geared motor 12 and the load machine LD to safely stop.

[0062] While FIG. 6 illustrates an example in which the stop processing unit 402 suddenly brakes the magnetic-geared motor 12 by regenerative braking (negative torque), the present invention is not limited to this. In other embodiments, the stop processing unit 402 may gradually decrease the torque command at a predetermined decrease rate so that the motor torque gradually approaches zero, rather than applying regenerative braking to the magnetic-geared motor 12. Furthermore, the stop processing unit 402 may gradually decrease a current command at a predetermined decrease rate instead of a torque command. In this case, the inverter control device 3 controls the inverter 10 based on the current command output from the stop processing unit 402. Alternatively, the stop processing unit 402 may directly output a current command to the inverter 10. For example, when the magnetic-geared motor 12 and the load machine LD do not need to be stopped quickly due to the required specifications of the drive system 1 or the nature of a minor fault, the magnetic-geared motor 12 and the load machine LD can be stopped safely in conjunction with each other simply by performing the simple process of gradually decreasing the torque command or current command.

[0063] (2) Processing in the Event of a Major Fault Next, processing in the event of a major fault (step S103; YES) will be described. When a major fault occurs, the stop processing unit 402 first performs processing to set the motor torque to 0 (steps S104 to S105).

[0064] Specifically, if the inverter control device 3 has failed, the stop processing unit 402 outputs a gate block command to the inverter 10 (step S104). In response, the inverter 10 turns off all of the switching elements of the semiconductor switch 101 to cut off the motor current. By forcibly setting the motor current to zero in this way, the motor torque can be set to zero.

[0065] Furthermore, when the inverter control device 3 is operating normally, the stop processing unit 402 may output a torque command to the inverter control device 3, instead of the gate block command, for setting the motor torque to 0 (step S104). At this time, the stop processing unit 402 may output a current command to set the motor current to 0, instead of the torque command.

[0066] Furthermore, if the drive system 1 is equipped with the contactor 11, the stop processing unit 402 outputs a contactor open command to the contactor 11 (step S105). In response to this, the contactor 11 opens the power line 102 between the inverter 10 and the magnetic-geared motor 12 to interrupt the motor current. In this way, the motor current can be interrupted even if the inverter 10 fails.

[0067] Next, the brake processing unit 403 determines whether the motor torque has become equal to or less than a specified torque value (step S106). The motor torque used in this determination is an estimated value estimated from the motor current measured by the current sensor 15. The brake processing unit 403 may determine whether the motor current has become equal to or less than a specified current value, instead of the motor torque. If the motor torque (or motor current) has not become equal to or less than the specified value (step S106; NO), the brake processing unit 403 returns to step S106 and continues monitoring the motor torque (or motor current). On the other hand, if the motor torque (or motor current) has become equal to or less than the specified value (step S106; YES), the brake processing unit 403 outputs a brake command to the brake device 13 (step S107).

[0068] Next, the operation of the interlock control when a serious failure occurs will be described. First, as a comparative example, an example of conventional control (stopping the motor operation) when a serious failure (lost synchronization) occurs will be described with reference to Figures 7 and 8.

[0069] FIG. 7 is a first diagram (prior art) showing an example of measured values ​​when a major failure occurs. FIG. 8 is a diagram showing an example of load characteristics. FIG. 7 shows an example of a time series of measured values ​​when a step-out occurs. In FIG. 7, (a) is the rotation speed [rpm] of the high-speed rotor HSR, (b) is the rotation speed [rpm] of the low-speed rotor PPR, (c) is the torsion angle [deg] (the difference in rotation angle between the high-speed rotor HSR and the low-speed rotor), (d) is the motor torque [Nm], (e) is the load torque [Nm], and (f) is the torsional torque [Nm] of the joint. Furthermore, as shown in FIG. 8, the load machine LD has multiple load characteristics 1, 2, ...

[0070] For example, if the load machine LD is a wheel and slippage occurs due to debris on the track (road surface), the load characteristics may temporarily change. For example, as shown in (e) of FIG. 7 , assume that at time t21, load characteristic 1 ( FIG. 8 ) changes to load characteristic 2 ( FIG. 8 ). Also, assume that at time t22, load characteristic 2 returns to load characteristic 1. After switching back to load characteristic 1 at time t22, a primary torsional vibration eigenvalue is excited, causing instability in the drive system. As a result, as shown in (c) of FIG. 7 , a phase difference occurs between the rotational speed fluctuations of the high-speed rotor HSR and the low-speed rotor PPR, increasing the fluctuation in the torsion angle. As a result, in the example of FIG. 7 , at time t23, the rotational speed deviation and rotational angle difference (torsion angle) of the high-speed rotor HSR and the low-speed rotor PPR exceed the rotational speed threshold and torsion angle threshold, respectively, and it is determined that a loss of synchronism has occurred. In actual operation, the threshold value for determining a step-out may be set with a margin, so that a step-out does not necessarily occur at time t23. In the example of Fig. 7, by setting the threshold value with a margin, a state immediately before a step-out occurs (a state that is a sign of a step-out) is detected at time t23.

[0071] Also, for example, suppose that at time t23, only control is performed to stop the motor normally (setting the motor torque to zero). This causes the rotation speed of the high-speed rotor HSR to gradually approach zero. Meanwhile, the low-speed rotor PPR continues to rotate due to the inertia of the load machine LD. Even if the motor torque is set to zero, the characteristics of the high-speed rotor HSR do not immediately switch to synchronize with the rotation of the low-speed rotor PPR due to its own inertia. As a result, the rotation speed deviation and torsion angle between the high-speed rotor HSR and the low-speed rotor PPR continue to increase, resulting in an actual loss of synchronization at time t24 (loss of synchronization). Because the load torque only decreases in accordance with the decrease in the rotation speed of the low-speed rotor PPR, excessive torsion torque is generated after time t24 in the example of FIG. 7 . This is because loss of synchronization generates an alternating torque whose amplitude is the maximum transmission torque between the high-speed and low-speed rotors, and the frequency of the alternating torque increases as the rotational speed deviation between the high-speed rotor HSR and the low-speed rotor PPR (load side) increases, exciting an eigenmode of the rotating shaft system.

[0072] In this way, in order to prevent the transition from a premonition state of out-of-step to an actual out-of-step state, in this embodiment, a series of interlock controls shown in Fig. 4 are performed. The operation of this interlock control will be described with reference to Fig. 9.

[0073] Fig. 9 is a second diagram (technology of the first embodiment) showing an example of measurement values ​​when a major fault occurs. Fig. 9 shows a time series of measurement values ​​when a loss of synchronism (a sign of loss of synchronism) is detected due to a temporary change in load characteristics similar to that of Fig. 7 and the protection device 4 according to this embodiment performs interlock control (Fig. 4). Fig. 9 shows a time series of measurement values ​​when (a) the rotation speed [rpm] of the high-speed rotor HSR, (b) the rotation speed [rpm] of the low-speed rotor PPR, (c) the torsion angle [deg] (the difference in rotation angle between the high-speed rotor HSR and the low-speed rotor), (d) the motor torque [Nm], (e) the load torque [Nm], and (f) the torsional torque [Nm] of the joint.

[0074] For example, as shown in (e) of FIG. 9 , assume that at time t31, load characteristic 1 ( FIG. 8 ) changes to load characteristic 2 ( FIG. 8 ). Also, assume that at time t32, load characteristic 2 returns to load characteristic 1. Here, as in the example of FIG. 7 , the drive system becomes unstable in the example of FIG. 9 due to a temporary change in the load characteristic. As a result, as shown in (c) of FIG. 9 , at time t33, the rotation speed deviation and rotation angle difference (torsion angle) of the high-speed rotor HSR and the low-speed rotor PPR exceed the rotation speed threshold and torsion angle threshold, respectively, and thus a loss of synchronism (a sign of a loss of synchronism) is detected. The determination unit 401 determines that a loss of synchronism (a serious malfunction) has occurred at time t33 (step S103; YES).

[0075] In response to this, the stop processing unit 402 outputs, for example, a torque command to the inverter control device 3 to set the motor torque to 0 (step S104). The inverter control device 3 performs control to set the motor torque to 0 by stopping the supply of motor current.

[0076] Note that the determination unit 401 determines that a loss of synchronism has occurred at time t33, but as described above, the threshold value is set with a margin of error in actual operation, so that it is not necessarily the case that a loss of synchronism has actually occurred at this time. Here, as in the example of Figure 7, it is assumed that at time t33, the state has not yet reached the state where a loss of synchronism has actually occurred, but is in a state immediately before a loss of synchronism occurs (a state that is a precursor to a loss of synchronism).

[0077] As explained with reference to Figure 7, simply setting the motor torque to zero may make it difficult to prevent a transition from a pre-synchronization state to a synchronism-loss state. For this reason, it may be possible to set the motor torque to zero and apply the brakes to the load machine. However, if the load machine is braked when a pre-synchronization state (a state in which a synchronism-loss has not actually occurred) and the motor torque remains, this has the same effect as applying an overload and may actually cause a synchronism-loss. Therefore, the timing of applying the brakes to the load machine is also important.

[0078] In consideration of these, the brake processing unit 403 according to this embodiment waits without outputting a brake command until the motor torque (or motor current) has sufficiently decreased (step S106; NO). Furthermore, at time t34, when it detects that the motor torque has become equal to or less than the specified torque value (or the motor current has become equal to or less than the specified current value) (step S106; YES), it outputs a brake command to the brake device 13 (step S107). As a result, as shown in (c) and (f) of Figure 9, the torsion angle and torsion torque gradually converge to zero, and the motor 12 and the load machine LD can be stopped safely in cooperation with each other.

[0079] (Effects) As described above, the protection device 4 according to this embodiment includes a determination unit 401 that determines whether the failure mode of the drive system 1 is a major failure or a minor failure, a stop processing unit 402 that stops the motor current when it is determined that the failure mode is a major failure, and a brake processing unit 403 that outputs a brake command to the brake device 13 when, after performing the process of stopping the motor current, the motor current falls below a predetermined current specified value or when the motor torque falls below a predetermined torque specified value.

[0080] In this way, when a major failure occurs, the protection device 4 can safely stop the magnetic-geared motor 12 and the load machine LD in cooperation with each other. Furthermore, even when the protection device 4 detects a sign of loss of synchronism as a major failure, it can safely stop the magnetic-geared motor 12 and the load machine LD while preventing the magnetic-geared motor 12 from actually losing synchronism.

[0081] In addition, when the failure mode is determined to be a minor failure, the stop processing unit 402 calculates a negative torque limit value based on the detuning limit information D1 that represents the relationship between the initial torque, which is the previous torque command, and the negative torque that becomes the detuning limit L, until the motor torque becomes equal to or less than a predetermined torque specified value, and changes the torque command so that the regenerative braking amount does not exceed the negative torque limit value.

[0082] In this way, the protection device 4 can simultaneously suppress step-out and apply sudden braking when a minor fault occurs. This reduces the rotation speeds of the high-speed rotor HSR and the low-speed rotor PPR in unison, allowing the magnetic-geared motor 12 and the load machine LD to safely stop.

[0083] Furthermore, when it is determined that the failure mode is a minor failure, the stop processing unit 402 may gradually reduce the torque command or current command at a predetermined reduction rate until the motor torque becomes equal to or less than a predetermined torque specified value.

[0084] In this way, the protection device 4 can safely stop the magnetic-geared motor 12 and the load machine LD in conjunction with each other by simply performing simple processing.

[0085] Second Embodiment Next, a second embodiment will be described with reference to Figures 10 and 11. Components common to the above-described embodiment will be assigned the same reference numerals, and detailed description thereof will be omitted.

[0086] In the first embodiment, an example was described in which control is performed to stop the magnetic-geared motor 12 and the load machine LD when a major fault occurs. In contrast, the protection device 4 according to this embodiment attempts to resynchronize the high-speed rotor HSR and the low-speed rotor PPR when control of the magnetic-geared motor 12 is possible (i.e., only loss of synchronism has occurred) even when a major fault occurs.

[0087] Fig. 10 is a block diagram showing the functional configuration of a protection device according to the second embodiment. As shown in Fig. 10, the protection device 4 according to this embodiment further includes a resynchronization processing unit 404. When the failure mode is a major failure and only loss of synchronism has occurred, the resynchronization processing unit 404 resynchronizes the rotation of the high speed rotor HSR and the low speed rotor PPR.

[0088] 11 is a flowchart showing an example of interlock control of a drive system according to the second embodiment. As shown in FIG. 11, the interlock control according to this embodiment adds steps S110 to S112 to the processing performed in the event of a major failure in the first embodiment (FIG. 4). Steps S101 to S107 are the same as in the first embodiment, so only the added steps S110 to S112 will be described here.

[0089] First, if the determination unit 401 determines that a major fault has occurred (step S103; YES), the resynchronization processing unit 404 determines whether control of the magnetic-geared motor 12 is possible (step S110). If a major fault other than loss of synchronism ((A1) to (A6) in FIG. 3) has occurred, the resynchronization processing unit 404 determines that control of the magnetic-geared motor 12 is difficult (step S110; NO). In this case, the protection device 4 proceeds to step S104 and performs the process of stopping the magnetic-geared motor 12 and the load machine LD (steps S104 to S107) as in the first embodiment.

[0090] On the other hand, if only step-out has occurred, the resynchronization processing unit 404 determines that control of the magnetic-geared motor 12 is possible (step S110; YES). In this case, the resynchronization processing unit 404 executes resynchronization processing to resynchronize the rotation of the high-speed rotor HSR and the low-speed rotor PPR (step S111).

[0091] Specifically, resynchronization processing unit 404 corrects the rotation speed of the low speed rotor PPR using the reduction ratio and sets the corrected value as the target rotation speed value for the high speed rotor HSR. Resynchronization processing unit 404 also generates a torque command corresponding to the target rotation speed value and outputs it to inverter control device 3. Inverter control device 3 controls inverter 10 based on the torque command issued by resynchronization processing unit 404. In other words, resynchronization processing unit 404 adjusts the rotation speed of the high speed rotor HSR to match that of the low speed rotor PPR so that the rotations of the high speed rotor HSR and the low speed rotor PPR are resynchronized.

[0092] Next, the resynchronization processing unit 404 determines whether resynchronization has been successful (step S112). For example, if the rotation speed deviation between the high speed rotor HSR and the low speed rotor PPR is equal to or less than the rotation speed threshold and the torsion angle is equal to or less than the torsion angle threshold, the resynchronization processing unit 404 determines that resynchronization has been successful (step S112; YES). In this case, the serious fault (loss of synchronization) is resolved, and the system enters a normal operating state, and the process returns to step S101.

[0093] On the other hand, if the rotation speed deviation between the high-speed rotor HSR and the low-speed rotor PPR exceeds the rotation speed threshold or if the state in which the torsion angle exceeds the torsion angle threshold continues, the resynchronization processing unit 404 determines that resynchronization has failed (step S112; NO). In this case, since the major fault (loss of synchronization) is not resolved, the process proceeds to step S104, and the process of stopping the magnetic-geared motor 12 and the load machine LD (steps S104 to S107) is performed as in the first embodiment.

[0094] As described above, the protection device 4 according to this embodiment further includes a resynchronization processing unit 404 that resynchronizes the rotation of the high-speed rotor HSR and the low-speed rotor PPR when the failure mode is determined to be a major failure and only loss of synchronism has occurred.

[0095] In this way, when only step-out occurs, the protection device 4 can resynchronize the high-speed rotor HSR and the low-speed rotor PPR to return the drive system 1 to a normal operating state, thereby suppressing damage to the drive system 1 due to step-out and improving the availability of the drive system 1.

[0096] Other Embodiments Although the embodiments have been described in detail above with reference to the drawings, the specific configuration is not limited to the above, and various design modifications are possible. That is, in other embodiments, the order of the above-described processes may be changed as appropriate. Furthermore, some processes may be executed in parallel.

[0097] In the above-described embodiments, examples have been described in which the protection device 4 performs interlock control, but this is not limiting. In other embodiments, the main control device 2 may perform interlock control similar to that of the protection device 4. For example, the main control device 2 includes the determination unit 401, stop processing unit 402, brake processing unit 403, and resynchronization processing unit 404 of the protection device 4. When the main control device 2 is operating normally, that is, when a minor fault occurs or a major fault other than (A1) in FIG. 3 occurs, the main control device 2 performs the interlock control shown in FIG. 4 or FIG. 11. Furthermore, in this case, the protection device 4 performs interlock control in place of the main control device 2 only when the main control device 2 fails.

[0098] In still another embodiment, the inverter control device 3 may include the determination unit 401, the stop processing unit 402, the brake processing unit 403, and the resynchronization processing unit 404 of the protection device 4. When the inverter control device 3 is operating normally and a fault detectable by the inverter control device 3 occurs, that is, when a minor fault or a major fault other than (A1) or (A2) in FIG. 3 occurs, the inverter control device 3 cooperates with the main control device 2 or the protection device 4 to perform the interlock control shown in FIG. 4 or FIG. 11 . For example, in the configuration example shown in FIG. 1 , the inverter control device 3 cannot directly control the brake device 13. Therefore, in step S107 of FIG. 4 , the brake processing unit 403 of the inverter control device 3 requests the main control device 2 or the protection device 4 to output a brake command. When the inverter control device 3 fails or when a major fault that the inverter control device 3 cannot detect occurs, the main control device 2 or the protection device 4 performs the interlock control instead of the inverter control device 3. It is possible to preset which of the main control device 2, the inverter control device 3, and the protection device 4 executes the interlock control depending on the type of the major fault.

[0099] In this way, by enabling a control device other than the protection device 4 to perform similar interlock control, it is possible to safely stop the magnetic-geared motor 12 and the load machine LD even in the unlikely event that the protection device 4 fails.

[0100] <Additional Notes> The protection device, drive system, protection method, and program described in the above-described embodiments can be understood, for example, as follows.

[0101] (1) According to the first aspect, the protection device 4 includes a magnetic-geared motor 12 having a high-speed rotor HSR and a low-speed rotor PPR that rotates in synchronization with the high-speed rotor HSR to rotationally drive a load machine LD, an inverter 10 that generates a voltage to drive the magnetic-geared motor 12, a rotation angle sensor 17 that measures the rotation angle and rotation speed of the high-speed rotor HSR and the low-speed rotor PPR, a current sensor 15 that measures a motor current flowing from the inverter 10 to the magnetic-geared motor 12, a main control device 2 that outputs a torque command to control the torque of the magnetic-geared motor 12, and a current command that adjusts the motor current based on the torque command, the measured value of the rotation angle, and the measured value of the motor current. and an inverter control device 3 that outputs to a main control device 2, the protection device 4 of the drive system 1 comprising: a determination unit 401 that determines whether the failure mode of the drive system 1 is a major failure of the magnetic-geared motor 12 that indicates a failure in which the magnetic-geared motor 12 cannot be controlled, or a minor failure that indicates a failure in which the magnetic-geared motor 12 can be controlled, based on input signals input from the magnetic-geared motor 12, the inverter 10, the rotation angle sensor 17, the current sensor 15, the main control device 2, and the inverter control device 3; and a resynchronization processing unit 404 that resynchronizes the rotation of the high-speed rotor HSR and the low-speed rotor PPR when the failure mode is determined to be a major failure and only step-out has occurred.

[0102] In this way, when only step-out occurs, the protection device 4 can resynchronize the high-speed rotor HSR and the low-speed rotor PPR to return the drive system 1 to a normal operating state, thereby suppressing damage to the drive system 1 due to step-out and improving the availability of the drive system 1.

[0103] (2) According to the second aspect, the protection device 4 according to the first aspect further includes a stop processing unit 402 that stops the current when it is determined that the failure mode is a major failure.

[0104] In this way, in the event of a serious failure, the protection device 4 can safely stop the magnetic-geared motor 12 and the load machine LD in cooperation with each other.

[0105] (3) According to the third aspect, the protection device 4 according to the second aspect further includes a brake processing unit 403 that outputs a brake command to the brake device 13 provided in the drive system 1 when, after performing a process to stop the current, the current falls below a predetermined current specified value or when the torque of the magnetic-geared motor 12 falls below a predetermined torque specified value.

[0106] In this way, when the protection device 4 detects a state that is a sign of loss of synchronism as a major failure, it can safely stop the magnetic-geared motor 12 and the load machine LD while preventing the magnetic-geared motor 12 from actually losing synchronism.

[0107] (4) According to the fourth aspect, in the protection device 4 relating to the second or third aspect, when the failure mode is determined to be a minor failure, the stop processing unit 402 calculates a negative torque limit value based on detuning limit information that represents the relationship between the initial torque, which is the previous torque command, and the negative torque that becomes the detuning limit, until the torque of the magnetic-geared motor 12 becomes equal to or less than a predetermined torque specified value, and adjusts the torque command so that the regenerative braking amount does not exceed the negative torque limit value.

[0108] In this way, the protection device 4 can simultaneously suppress step-out and apply sudden braking when a minor fault occurs. This reduces the rotation speeds of the high-speed rotor HSR and the low-speed rotor PPR in unison, allowing the magnetic-geared motor 12 and the load machine LD to safely stop.

[0109] (5) According to the fifth aspect, the drive system 1 includes a magnetic-geared motor 12 having a high-speed rotor HSR and a low-speed rotor PPR that rotates in synchronization with the high-speed rotor HSR to rotationally drive a load machine LD, an inverter 10 that generates a voltage to drive the magnetic-geared motor 12, a rotation angle sensor 17 that measures the rotation angle and rotation speed of the high-speed rotor HSR and the low-speed rotor PPR, a current sensor 15 that measures a motor current flowing from the inverter 10 to the magnetic-geared motor 12, a main control device 2 that outputs a torque command to control the torque of the magnetic-geared motor 12, and a motor current adjustment unit that adjusts the motor current based on the torque command, the measured value of the rotation angle, and the measured value of the motor current. a determination unit 401 that determines whether the failure mode of the drive system 1 is a major failure of the magnetic-geared motor 12 indicating a failure in which the magnetic-geared motor 12 cannot be controlled, or a minor failure that indicates a failure in which the magnetic-geared motor 12 can be controlled, based on input signals input from the magnetic-geared motor 12, the inverter 10, the rotation angle sensor 17, the current sensor 15, the main control unit 2, and the inverter control unit 3; and a resynchronization processing unit 404 that resynchronizes the rotation of the high-speed rotor HSR and the low-speed rotor PPR when the failure mode is determined to be a major failure and only step-out has occurred.

[0110] (6) According to a sixth aspect, a protection method includes a magnetic-geared motor 12 having a high-speed rotor HSR and a low-speed rotor PPR that rotates in synchronization with the high-speed rotor HSR to rotationally drive a load machine LD, an inverter 10 that generates a voltage to drive the magnetic-geared motor 12, a rotation angle sensor 17 that measures the rotation angle and rotation speed of the high-speed rotor HSR and the low-speed rotor PPR, a current sensor 15 that measures a motor current flowing from the inverter 10 to the magnetic-geared motor 12, a main control device 2 that outputs a torque command to control the torque of the magnetic-geared motor 12, and a current command that adjusts the motor current based on the torque command, the measured value of the rotation angle, and the measured value of the motor current, outputted from the inverter 10. and an inverter control device 3 that outputs to a magnetic-geared motor 10, the protection method comprising the steps of: determining whether a failure mode of the drive system 1 is a major failure of the magnetic-geared motor 12 that indicates a failure in which the magnetic-geared motor 12 cannot be controlled, or a minor failure that indicates a failure in which the magnetic-geared motor 12 can be controlled, based on input signals input from the magnetic-geared motor 12, the inverter 10, the rotation angle sensor 17, the current sensor 15, the main control device 2, and the inverter control device 3; and if the failure mode is determined to be a major failure and only step-out has occurred, resynchronizing the rotation of the high-speed rotor HSR and the low-speed rotor PPR.

[0111] (7) According to a seventh aspect, the program includes a magnetic-geared motor 12 having a high-speed rotor HSR and a low-speed rotor PPR that rotates in synchronization with the high-speed rotor HSR to rotationally drive a load machine LD, an inverter 10 that generates a voltage to drive the magnetic-geared motor 12, a rotation angle sensor 17 that measures the rotation angle and rotation speed of the high-speed rotor HSR and the low-speed rotor PPR, a current sensor 15 that measures a motor current flowing from the inverter 10 to the magnetic-geared motor 12, a main control device 2 that outputs a torque command to control the torque of the magnetic-geared motor 12, and a current command that adjusts the motor current based on the torque command, the measured value of the rotation angle, and the measured value of the motor current. The protection device 4 of the drive system 1, which includes an inverter control device 3 that outputs to the magnetic-geared motor 10, executes the steps of determining whether the failure mode of the drive system 1 is a major failure of the magnetic-geared motor 12 that indicates a failure in which the magnetic-geared motor 12 cannot be controlled, or a minor failure that indicates a failure in which the magnetic-geared motor 12 can be controlled, based on input signals input from the magnetic-geared motor 12, the inverter 10, the rotation angle sensor 17, the current sensor 15, the main control device 2, and the inverter control device 3, and a step of resynchronizing the rotation of the high-speed rotor HSR and the low-speed rotor PPR when the failure mode is determined to be a major failure and only step-out has occurred.

[0112] According to the above aspect, the magnetic-geared motor is resynchronized, and a decrease in the availability of the drive system is suppressed.

[0113] REFERENCE SIGNS LIST 1 Drive system 10 Inverter 101 Semiconductor switch 102 Power line 11 Contactor 12 Magnetic geared motor HSR High speed rotor PPR Low speed rotor 121 Rotating shaft JT Joint 13 Brake device 15 Current sensor 16 Temperature sensor 17 Rotation angle sensor 17A High speed side rotation angle sensor 17B Low speed side rotation angle sensor 18 Sensor 2 Main control device 3 Inverter control device 4 Protection device 40 Processor 401 Determination unit 402 Stop processing unit 403 Brake processing unit 404 Resynchronization processing unit 41 Memory 42 Storage 43 Communication interface D1 Loss of synchronization limit information D2 Inertia ratio information

Claims

1. A protection device for a drive system comprising: a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine; an inverter that supplies current to the magnetic-geared motor; a rotation angle sensor that measures the rotation angle and rotation speed of the high-speed rotor and the low-speed rotor; a current sensor that measures the current flowing from the inverter to the magnetic-geared motor; a main control device that outputs a torque command to control the torque of the magnetic-geared motor; and an inverter control device that outputs a current command to adjust the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current, the protection device comprising: a determination unit that determines whether the failure mode of the drive system is a major failure of the magnetic-geared motor that is incapable of controlling the magnetic-geared motor, or a minor failure that is incapable of controlling the magnetic-geared motor, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control device, and the inverter control device; a resynchronization processing unit that resynchronizes the rotation of the high-speed rotor and the low-speed rotor when the failure mode is determined to be a major failure and only loss of synchronization has occurred.

2. The protection device according to claim 1, further comprising a stop processing unit that stops the current when the failure mode is determined to be a major failure.

3. The protection device according to claim 2, further comprising a brake processing unit that outputs a brake command to a brake device provided in the drive system when, after processing to stop the current, the current falls below a predetermined current specified value or when the torque of the magnetic-geared motor falls below a predetermined torque specified value.

4. A protection device as described in claim 2 or 3, wherein, when the failure mode is determined to be a minor failure, the stop processing unit calculates a negative torque limit value based on step-out limit information that indicates the relationship between the initial torque, which is the previous torque command, and the negative torque that becomes the step-out limit, until the torque of the magnetic-geared motor becomes equal to or less than a predetermined torque specified value, and adjusts the torque command so that the regenerative braking amount does not exceed the negative torque limit value.

5. A magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotate and drive a load machine; an inverter that supplies current to the magnetic-geared motor; a rotation angle sensor that measures the rotation angle and rotation speed of the high-speed rotor and the low-speed rotor; a current sensor that measures the current flowing from the inverter to the magnetic-geared motor; a main control unit that outputs a torque command to control the torque of the magnetic-geared motor; an inverter control unit that outputs a current command to adjust the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current; a determination unit that determines whether the failure mode is a major failure of the magnetic-geared motor that is incapable of controlling the magnetic-geared motor, or a minor failure that is incapable of controlling the magnetic-geared motor, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control unit, and the inverter control unit; and a resynchronization processing unit that resynchronizes the rotation of the high-speed rotor and the low-speed rotor when the failure mode is determined to be a major failure and only step-out has occurred. A drive system comprising:

6. A method for protecting a drive system comprising: a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine; an inverter that supplies current to the magnetic-geared motor; a rotation angle sensor that measures the rotation angle and rotation speed of the high-speed rotor and the low-speed rotor; a current sensor that measures the current flowing from the inverter to the magnetic-geared motor; a main control unit that outputs a torque command to control the torque of the magnetic-geared motor; and an inverter control unit that outputs a current command to adjust the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current, comprising the steps of: determining, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control unit, and the inverter control unit, whether the failure mode of the drive system is a major failure of the magnetic-geared motor that is incapable of controlling the magnetic-geared motor, or a minor failure that is incapable of controlling the magnetic-geared motor; and if the failure mode is determined to be a major failure and only loss of synchronism has occurred, resynchronizing the rotation of the high-speed rotor and the low-speed rotor.

7. A protection device for a drive system comprising: a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine; an inverter that supplies current to the magnetic-geared motor; a rotation angle sensor that measures the rotation angle and rotation speed of the high-speed rotor and the low-speed rotor; a current sensor that measures the current flowing from the inverter to the magnetic-geared motor; a main control device that outputs a torque command to control the torque of the magnetic-geared motor; and an inverter control device that outputs a current command to adjust the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current, the protection device for a drive system comprising: a magnetic-geared motor having a high-speed rotor and a low-speed rotor that rotates in synchronization with the high-speed rotor to rotationally drive a load machine; an inverter that supplies current to the magnetic-geared motor; a rotation angle sensor that measures the rotation angle and rotation speed of the high-speed rotor and the low-speed rotor; a main control device that outputs a torque command to control the torque of the magnetic-geared motor; and an inverter control device that outputs a current command to adjust the current supplied by the inverter based on the torque command, the measured value of the rotation angle, and the measured value of the current, the protection device comprising: a step of determining whether the failure mode of the drive system is a major failure of the magnetic-geared motor that is incapable of controlling the magnetic-geared motor, or a minor failure that is incapable of controlling the magnetic-geared motor, based on input signals input from the magnetic-geared motor, the inverter, the rotation angle sensor, the current sensor, the main control device, and the inverter control device; and when the failure mode is determined to be a major failure and only loss of synchronism has occurred, resynchronizing the rotation of the high-speed rotor and the low-speed rotor.

Images