Elevator control device

Abstract

Provided is an elevator control device that can further improve the reliability of a safety-related unit. A control device (8) has a safety-related unit (28) and a not-safety-related unit (29). The safety-related unit (28) includes a safety command unit (30) that outputs a shutoff command. One of a primary side and a secondary side of a photocoupler (Ca) and a photocoupler (Cb) is included in one of the safety-related unit (28) and the not-safety-related unit (29) of the control device (8). Each photocoupler (C) transmits signals between the primary side and the secondary side, which are electrically separated, and does not transmit signals when the shutoff command has been outputted. The photocoupler (Ca) and the photocoupler (Cb) are connected in series between the safety command unit (30) and a safety ground (32). The secondary side of the photocoupler (Ca) is connected to a switching element of an apparatus of an elevator (1) so as to be capable of outputting a switching signal that transmits a switching command from the not-safety-related unit (29).

Description

Elevator control device

[0001] The present disclosure relates to a control device for an elevator.

[0002] Patent Document 1 discloses an example of an elevator control device. When the brake is not operating normally, the control device maintains three switching elements on the positive side of the inverter that drives the electric motor in an open state and three switching elements on the negative side in a closed state. At this time, a closed circuit including the field winding of the electric motor is formed. When the car moves, the electromotive force generated in the field winding generates regenerative power energy, which is consumed in the field winding as the regenerative power current flows through the closed circuit. This applies a braking force to the electric motor, causing it to stop in a short period of time.

[0003] Japanese Patent Application Publication No. 2008-56428

[0004] The control device in Patent Document 1 does not adequately separate the safety-related part, which outputs commands such as stopping the motor and activating the brakes in the event of an abnormality, from the non-safety-related part, which controls the operation of the elevator, etc. Therefore, if an abnormality occurs in the non-safety-related part, the influence of the abnormality may spread to the safety-related part.

[0005] The present disclosure relates to solving such problems, and provides an elevator control device that can further improve the reliability of safety-related parts.

[0006] The elevator control device according to the present disclosure is an elevator control device having a safety-related section including a redundant safety command section that outputs a shutoff command, and a non-safety-related section including an inverter that drives a motor and a control command section that outputs a switching command to the inverter, wherein the elevator control device includes a first isolator whose primary side is included in the safety-related section and whose secondary side is included in the non-safety-related section, transmitting a signal between the electrically separated primary and secondary sides and not transmitting a signal when the shutoff command is output, and a second isolator whose primary side is included in the non-safety-related section and whose secondary side is included in the safety-related section, transmitting a signal between the electrically separated primary and secondary sides and not transmitting a signal when the shutoff command is output. a second isolator that does not transmit a signal when the primary side of the first isolator and the secondary side of the second isolator are connected in series, the safety command unit is connected to the primary side of the first isolator so as to be able to output the shut-off command, the secondary side of the second isolator is connected to a safety earth of the safety-related part, the control command unit is connected to the primary side of the second isolator so as to be able to output the switching command, and the secondary side of the first isolator is connected to an inverter switching element of the inverter so that the second isolator and the first isolator can output a switching signal that has transmitted the switching command.

[0007] According to the elevator control device of the present disclosure, the reliability of safety-related parts can be further improved.

[0008] FIG. 1 is a configuration diagram of an elevator according to embodiment 1. FIG. 2 is a diagram showing an example of the circuit configuration of an inverter according to embodiment 1. FIG. 3 is a diagram showing an example of the circuit configuration of a brake according to embodiment 1. FIG. 4 is a diagram showing an example of the circuit configuration of a control device according to embodiment 1. FIG. 5 is a diagram showing an example of the circuit configuration of a control device according to embodiment 1. FIG. 6 is a diagram showing another example of the circuit configuration of a control device according to embodiment 1. FIG. 7 is a diagram showing another example of the circuit configuration of a control device according to embodiment 1.

[0009] The following describes embodiments of the subject matter of the present disclosure with reference to the accompanying drawings. In each drawing, identical or corresponding parts are designated by the same reference numerals, and redundant explanations are appropriately simplified or omitted. Note that the subject matter of the present disclosure is not limited to the following embodiments, and any component of the embodiments may be modified or omitted within the scope of the gist of the present disclosure.

[0010] First Embodiment Fig. 1 is a configuration diagram of an elevator 1 according to a first embodiment.

[0011] The elevator 1 is applied to a building having multiple floors. A hoistway 2 for the elevator 1 is provided in the building. The hoistway 2 is a vertically long space that spans multiple floors. The elevator 1 includes a hoisting machine 3, a main rope 4, a car 5, a counterweight 6, a brake 7, and a control device 8.

[0012] The hoisting machine 3 is disposed, for example, at the upper or lower part of the hoistway 2. For example, if a machine room of the elevator 1 is provided above the hoistway 2, the hoisting machine 3 may be disposed in the machine room. The hoisting machine 3 includes a motor 9 and a sheave 10. The motor 9 of the hoisting machine 3 is a device that generates drive torque. In this example, the motor 9 is a three-phase motor that operates under PWM control (Pulse Width Modulation). The sheave 10 of the hoisting machine 3 is a device that rotates by the drive torque generated by the motor of the hoisting machine 3.

[0013] The main ropes 4 are wound around the sheaves 10. The main ropes 4 support the load of the car 5 on one side of the sheaves 10. The main ropes 4 support the load of the counterweight 6 on the other side of the sheaves 10. The main ropes 4 move as the sheaves 10 rotate, causing either side of the sheaves 10 to be wound up.

[0014] The car 5 is a device that transports passengers of the elevator 1 between multiple floors by traveling up and down the hoistway 2. The car 5 travels up and down the hoistway 2 in conjunction with the movement of the main rope 4 caused by the rotation of the sheave 10.

[0015] Counterweight 6 is a device provided to balance the loads acting on both sides of sheave 10 between sheave 10 and car 5. Counterweight 6 travels in hoistway 2 on the opposite side of car 5 in the vertical direction in conjunction with the movement of main rope 4 caused by the rotation of sheave 10.

[0016] The brake 7 is a device that brakes the running of the car 5, for example, by braking the rotation of the sheave 10 of the hoisting machine 3. In this example, two brakes 7 are provided on the sheave 10. The brakes 7 operate so as to be switchable between a braked state and a released state. In the released state, the brake 7 does not hinder the rotation of the sheave 10. On the other hand, in the braked state, the brake 7 suppresses the rotation of the sheave 10. The brake 7 requires energy such as electricity to maintain the released state, and is configured to enter the braked state when no energy is supplied.

[0017] The control device 8 is a device that controls the operation of the elevator 1. The operation of the elevator 1 includes the travel of the car 5. The control device 8 is disposed, for example, at the upper or lower part of the hoistway 2. The control device 8 may be composed of multiple parts. The control device 8 receives power from an external power source 11. The external power source 11 is, for example, a commercial power source. In this example, the external power source 11 supplies three-phase AC power. The control device 8 includes a control command unit 12 and an inverter 13. The control command unit 12 is a part that has a function of outputting commands regarding normal operations of the elevator 1, such as the travel of the car 5, so as to realize the transportation service provided by the elevator 1. The inverter 13 is a device that converts power input from the external power source 11 in response to a control signal from the control command unit 12. In this example, the inverter 13 is a PWM inverter that outputs three-phase AC power. The power converted by the inverter 13 is output to the motor 9 of the hoisting machine 3.

[0018] The control device 8 controls the running of the car 5, for example, as follows: When the car 5 is stopped at any floor, the control device 8 puts the brake 7 into a braking state. When the car 5 departs from that floor, the control device 8 switches the brake 7 into a released state. The control device 8 controls the drive torque of the motor 9 using the inverter 13, and causes the car 5 to run from the departure floor to the destination floor. After the car 5 arrives at the destination floor, the control device 8 switches the brake 7 into a braking state.

[0019] The control device 8 is equipped with STO (Safe Torque Off) and SBC (Safe Brake Control) functions as safety functions. The control device 8 outputs an STO command when an abnormality occurs in the elevator 1. The STO command is a command to cut off the power supply to the motor 9. The STO command is an example of a cut-off command. The control device 8 outputs an SBC command when an abnormality occurs in the elevator 1. The SBC command is a command to put the brake 7 into a braking state. The SBC command is an example of a cut-off command. The control device 8 may be equipped with both the STO and SBC functions, or may be equipped with only one of the STO and SBC functions.

[0020] Fig. 2 is a diagram illustrating an example of a circuit configuration of the inverter 13 according to embodiment 1. In each of the drawings of the present disclosure, including Fig. 2, some elements, such as resistors, may be omitted from illustration in order to facilitate understanding of the circuit configuration.

[0021] The inverter 13 includes an inverter power supply 14 and a bridge 15 .

[0022] The inverter power supply 14 is a DC power supply circuit that converts three-phase AC power input from the external power supply 11 into DC power. The inverter power supply 14 includes a converter circuit 16 and a smoothing circuit 17. The converter circuit 16 is a circuit that rectifies the three-phase AC power input from the external power supply 11 into DC. The smoothing circuit 17 is a circuit that smoothes the DC rectified by the converter circuit 16.

[0023] The bridge 15 converts the DC supplied from the inverter power supply 14. In this example, the bridge 15 converts the supplied DC into three-phase AC. The bridge 15 includes three legs 18 corresponding to the three phases. Each of the three legs 18 is connected between a positive bus P and a negative bus N. A bus voltage is applied between the positive bus P and the negative bus N. Each leg 18 includes two arms. One arm is an upper arm 19a connected to the positive bus P. The other arm is a lower arm 19b connected to the negative bus N. Each arm has a switching element SI. The switching element SI is an element that switches on or off based on a switching command input to a drive-side terminal from the control command unit 12 or the like. The switching element SI is, for example, an insulated gate bipolar transistor (IGBT), a metal-oxide-semiconductor field effect transistor (MOSFET), a bipolar transistor, or other element. The driving side terminal is, for example, a base terminal or a gate terminal. The switching element SI is an example of an inverter switching element. Furthermore, one of the upper arm 19a and the lower arm 19b is an example of a first arm. The other of the upper arm 19a and the lower arm 19b is an example of a second arm.

[0024] The bridge 15 of the inverter 13 switches the switching elements SI of each arm on and off based on a switching command output by the control command unit 12. As a result, power converted by PWM is output from the bridge 15 to each of the three phases.

[0025] FIG. 3 is a diagram showing an example of a circuit configuration of the brake 7 according to the first embodiment.

[0026] The brake 7 includes an operating unit 20, a power supply unit 21, a control unit 22, and an applying unit 23. In this example, the two brakes 7 have the same configuration. An example of the configuration of one of the brakes 7 is shown in Figure 3.

[0027] The action unit 20 is a part that brakes the rotation of the sheave 10, for example, by applying a frictional force. The action unit 20 includes, for example, a member having a friction surface that generates a frictional force through contact, such as a brake pad or a brake disc. For example, in a braking state, the action unit 20 generates a frictional force for braking by bringing the frictional surfaces into contact and pressing them together using the elastic force of a spring or the like. In a released state, the action unit 20 uses supplied energy to separate the frictional surfaces from each other against the elastic force of the spring or the like, thereby preventing the rotation of the sheave 10 from being hindered. The action unit 20 may separate the frictional surfaces from each other using the magnetic force of an electromagnet, such as a brake coil, for example.

[0028] The power supply unit 21 supplies power as energy to the action unit 20. The power supply unit 21 is an example of a brake power supply. The power supply unit 21 includes a switching element SB1, a chopper terminal 24, and a power transformer 25. The switching element SB1 is an element that switches on or off based on a switching command input to a drive-side terminal from the control command unit 12 or the like. The switching element SB1 is, for example, an IGBT, a MOSFET, a bipolar transistor, or other element. The switching element SB1 is an example of a brake power supply switching element. The chopper terminal 24 is connected to the drive-side terminal of the switching element SB1. The power supply unit 21 is chopper-controlled by the control command unit 12 or the like. The power supply unit 21 switches the switching element SB1 on and off based on a switching command input from the control command unit 12 or the like via the chopper terminal 24. The power transformer 25 converts the power output by switching the switching element SB1 on and off and supplies it to the action unit 20.

[0029] The control unit 22 includes a switching element SB2 and a control terminal 26. The switching element SB2 is an element that switches on or off based on a control command input to a drive-side terminal from the control command unit 12 or the like. The switching element SB2 is, for example, an IGBT, a MOSFET, a bipolar transistor, or other element. The control terminal 26 is a portion that connects to the drive-side terminal of the switching element SB2. The switching element SB2 is connected to a closed circuit including the power supply unit 21 and the action unit 20. In the on state, the switching element SB2 transmits power supplied from the power supply unit 21 to the action unit 20, and in the off state, it cuts off the power supply from the power supply unit 21 to the action unit 20. The switching element SB2 operates as a constant current source by switching between the on state and the off state at appropriate intervals, thereby releasing the brake. The control unit 22 switches the switching element SB2 on and off based on a control command input through the control terminal 26 from the control command unit 12 or the like. The control command input to the control terminal 26 is, for example, a command to release the brake 7 when the car 5 is running under normal circumstances.

[0030] The closing unit 23 includes a switching element SB3 and a closing terminal 27. The switching element SB3 is an element that switches on or off based on a control command input to a drive-side terminal from the control command unit 12 or the like. The switching element SB3 is, for example, an IGBT, a MOSFET, a bipolar transistor, or other element. The closing terminal 27 is a portion that connects to the drive-side terminal of the switching element SB3. The switching element SB3 is connected to a closed circuit including the power supply unit 21 and the operating unit 20. When in the on state, the switching element SB3 transmits power supplied from the power supply unit 21 to the operating unit 20, and when in the off state, the switching element SB3 cuts off the supply of power from the power supply unit 21 to the operating unit 20. The closing unit 23 switches the switching element SB3 on or off based on a control command input through the closing terminal 27 from the control command unit 12 or the like. The control command input to the closing terminal 27 is, for example, a command to apply the brake 7 when stopping the car 5 in an emergency. A signal is input to the switching element SB3 so that the switching element SB3 is in an on state under normal circumstances. The control command to the input unit 23 is, for example, a command to cut off the supply of power to the action unit 20 by cutting off the signal.

[0031] Fig. 4 is a diagram showing an example of the circuit configuration of the control device 8 according to the first embodiment. Fig. 4 shows an example of the circuit configuration of a portion that realizes the function of the STO. Fig. 4 also shows the circuit configuration of a portion corresponding to one of the phases of the three-phase AC. The STO function is realized for each phase of the three-phase AC by a similar circuit configuration.

[0032] The control device 8 includes a safety-related unit 28 and a non-safety-related unit 29. The safety-related unit 28 is a unit including programmable electronic devices that are introduced in addition to the transportation services provided by the elevator 1 to improve the safety of users of the elevator 1. The safety-related unit 28 includes, for example, an Unintended Car Movement Protection (UCMP) device or an Emergency Terminal Slowdown (ETS) device. The safety-related unit 28 is required to reduce risks to an acceptable level based on the concept of "functional safety" of the international standard IEC 61508, for example. The acceptable level is a predetermined safety level, such as a safety integrity level (SIL) required for each safety function. The non-safety-related part 29 is a part other than the safety-related part 28 that is related to the transportation services provided by the elevator 1. The non-safety-related part 29 includes, for example, the control instruction part 12 and the inverter 13. The safety-related part 28 and the non-safety-related part 29 are separated to an extent that the influence of an abnormality occurring in the non-safety-related part 29 does not spread to the safety-related part 28. The safety-related part 28 and the non-safety-related part 29 are separated, for example, by electrical insulation.

[0033] The safety-related section 28 includes a safety command section 30. The safety command section 30 is a section that has a function of outputting a shutoff command such as an STO command.

[0034] The safety command unit 30 includes a microcomputer 31a and a microcomputer 31b. The microcomputers 31a and 31b have similar configurations. When there is no need to distinguish between the microcomputers 31a and 31b, they may be simply referred to as the microcomputer 31. Each microcomputer 31 has hardware, such as a processing circuit including a processor and memory. The processor may be, for example, a CPU, an arithmetic unit, a microprocessor, or a microcomputer. The memory may be, for example, a non-volatile or volatile semiconductor memory such as RAM, ROM, flash memory, EPROM, or EEPROM, or other storage media. The memory stores, for example, programs as software or firmware. The microcomputer 31 performs pre-set processing by executing the programs stored in the memory with the processor, thereby realizing each function as a result of the collaboration between the hardware and software. The program may be a program package including multiple subprograms, modules, or libraries. The program may also be referred to as a program product. Each function of the microcomputer 31 may be realized by a dedicated processing circuit. Alternatively, some or all of the functions of the microcomputer 31 may be implemented as a dedicated processing circuit. The processing circuit may be implemented as, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, or an FPGA, or a combination thereof. The microcomputer 31a is an example of a first processing circuit. The microcomputer 31b is an example of a second processing circuit.

[0035] The safety command unit 30 includes a switching element SC1a and a switching element SC1b. The switching elements SC1a and SC1b have the same configuration. Here, when there is no particular need to distinguish between the switching elements SC1a and SC1b, they may be simply referred to as the switching element SC1. The switching element SC1a and the microcomputer 31a correspond to each other. The switching element SC1b and the microcomputer 31b correspond to each other. The switching element SC1a is an example of a first switching element. The switching element SC1b is an example of a second switching element.

[0036] The switching element SC1 is an element that switches on or off based on a signal input to a driving terminal from the corresponding microcomputer 31. The switching element SC1 may be, for example, an IGBT, a MOSFET, a bipolar transistor, or some other element. The driving terminal of the switching element SC1 is connected to the corresponding microcomputer 31 so as to receive the signal input. The switching element SC1 has the driving terminal as an input and the positive and negative terminals as outputs. That is, the switching element SC1 switches the connection between the positive and negative terminals on and off in response to the signal input to the driving terminal. For example, one of the positive and negative terminals may be an emitter terminal or a source terminal, and the other may be a collector terminal or a drain terminal. The switching elements SC1a and SC1b are connected in series with one positive terminal and the other negative terminal. In this example, the switching elements SC1a and SC1b are connected in series, and the emitter terminal of the switching element SC1a is connected to the collector terminal of the switching element SC1b. The collector terminal of the switching element SC1a is connected to a DC power supply terminal, and the emitter terminal of the switching element SC1b outputs a shutoff command to the outside of the safety command unit 30. The emitter terminal of each switching element SC1b is connected to the corresponding microcomputer 31 so as to be able to output a readback signal.

[0037] Each microcomputer 31 outputs, for example, an STO command when a safety-related abnormality occurs in the elevator 1. The STO command output by each microcomputer 31 is an example of an individual shutoff command. Each microcomputer 31 outputs an STO command, for example, when the UCMP detects that the elevator is running with the doors open or when the ETS detects excessive speed at the terminal floor. In this example, the microcomputer 31a outputs a signal DSTO_A to turn the switching element SC1a on during normal operation. The microcomputer 31b outputs a signal DSTO_B to turn the switching element SC1b on during normal operation. At this time, the STO command output by the microcomputer 31a is a command to turn the switching element SC1a off. That is, the microcomputer 31a outputs the STO command by shutting off the output of the signal DSTO_A. Similarly, the microcomputer 31b outputs the STO command by shutting off the output of the signal DSTO_B to turn the switching element SC1b off.

[0038] Under normal conditions, the microcomputer 31a inputs a signal DSTO_A to the base terminal of the switching element SC1a, and the microcomputer 31b inputs a signal DSTO_B to the base terminal of the switching element SC1b. As a result, both the switching elements SC1a and SC1b are in the ON state, and the composite signal STO_AB is output to the outside of the safety command unit 30. At this time, the microcomputer 31a receives an input of a readback signal RB1_A. The microcomputer 31a diagnoses whether the signal output from the microcomputer 31a is normal by checking the consistency between the output state of the signal DSTO_A and the input state of the readback signal RB1_A. The microcomputer 31b also receives an input of a readback signal RB1_AB. Because the switching elements SC1a and SC1b are connected in series on the output side, the readback signal RB1_AB reflects the signal output states from both the microcomputers 31a and 31b. Therefore, the microcomputer 31b diagnoses whether the signals from the microcomputers 31a and 31b are being output normally by checking the consistency between the output state of the signal DSTO_B and the input state of the readback signal RB1_AB. When outputting a command to turn off the signal DSTO_B, the microcomputer 31b may check whether the readback signal RB1_AB is in the off state in accordance with the signal DSTO_B, and whether the microcomputer 31a has output a command to turn off the signal DSTO_A. Furthermore, when the readback signal RB1_AB is in the off state, the microcomputer 31b may check whether it has output a command to turn off the signal DSTO_B or whether the microcomputer 31a has output a command to turn off the signal DSTO_A. Similarly, when the microcomputer 31a outputs a command to turn off the signal DSTO_A, the microcomputer 31a may check whether the readback signal RB1_A is in the OFF state in accordance with the signal DSTO_A, and whether the microcomputer 31b has output a command to turn off the signal DSTO_B. In this way, the information on the status of the individual shutoff commands is exchanged between the microcomputers 31a and 31b, thereby further improving the accuracy of the diagnosis of the individual shutoff commands.

[0039] When an abnormality occurs in elevator 1, microcomputer 31a cuts off signal DSTO_A, and microcomputer 31b cuts off signal DSTO_B. Because switching element SC1a and switching element SC1b are connected in series on the output side, if at least one of switching elements SC1 is turned off, composite signal STO_AB is cut off. Cutting off composite signal STO_AB is an example of a cutoff command from redundant safety command unit 30.

[0040] The control device 8 includes a photocoupler C1a and a photocoupler C1b. Here, when there is no need to distinguish between the photocouplers C1a and C1b, they may be simply referred to as photocoupler C1. The photocoupler C1 is an example of an isolator that transmits a signal from the primary side to the secondary side between electrically separated primary and secondary sides. The photocoupler C1a is an example of a first isolator. The photocoupler C1b is an example of a second isolator. The primary side of the photocoupler C1a is included in the safety-related section 28. The secondary side of the photocoupler C1a is included in the non-safety-related section 29. The primary side of the photocoupler C1b is included in the non-safety-related section 29. The secondary side of the photocoupler C1b is included in the safety-related section 28. The primary side of the photocoupler C1a and the secondary side of the photocoupler C1b are connected in series. The primary side of the photocoupler C1a is connected to the safety command section 30 so as to receive a shut-off command. In this example, the primary side of the photocoupler C1a is connected to the emitter terminal of the switching element SC1b. The secondary side of the photocoupler C1a is connected to the switching element SI of the inverter 13. In this example, the secondary side of the photocoupler C1a is connected to the switching element SI of the upper arm 19a. The primary side of the photocoupler C1b is connected to the control instruction unit 12 so as to be able to receive switching commands. The secondary side of the photocoupler C1b is connected to the safety earth 32 of the safety-related unit 28. Note that the switching element SI of the lower arm 19b of the inverter 13 is directly connected to the control instruction unit 12 so as to be able to receive switching commands.

[0041] Under normal circumstances, a composite signal STO_AB is output from the safety command unit 30. Therefore, a voltage is applied to the secondary side of the photocoupler C1b from the DC power supply terminal. The primary side of the photocoupler C1b receives a switching command COM_SW from the control command unit 12. This switching command COM_SW switches the secondary side of the photocoupler C1b on and off. In response to the switching on and off of the secondary side of the photocoupler C1b, the conduction of the primary side of the photocoupler C1a is switched. In response to the conduction of the primary side of the photocoupler C1a, the secondary side of the photocoupler C1a is switched on and off. In response to the switching on and off of the secondary side of the photocoupler C1a, a switching signal SIG_SW is input to the switching element SI of the upper arm 19a of the inverter 13. In this way, the switching command COM_SW from the control command unit 12 to the upper arm 19 a is input to the switching element SI as a switching signal SIG_SW via the photocoupler C1 b and the photocoupler C1 a. On the other hand, the switching command from the control command unit 12 to the lower arm 19 b is input directly to the switching element SI. In this way, the switching command from the control command unit 12 is input directly or indirectly to the inverter 13, so that the control device 8 can control the motor 9 of the hoisting machine 3 via the inverter 13.

[0042] On the other hand, when an abnormality occurs in the elevator 1, the safety command unit 30 outputs an STO command by interrupting the composite signal STO_AB. Because the composite signal STO_AB is interrupted, no voltage is applied from the DC power supply terminal to the secondary side of the photocoupler C1b. Therefore, even if a switching command COM_SW is input from the control command unit 12, no signal is transmitted from the primary side to the secondary side of the photocoupler C1b. At this time, no signal is transmitted to the photocoupler C1a either, so the switching signal SIG_SW is not input to the switching element SI of the upper arm 19a. Therefore, the power supply from the inverter 13 to the motor 9 is interrupted, and the STO function is realized.

[0043] Furthermore, when an abnormality occurs in the elevator 1, the control command unit 12 outputs a switching command to close the switching element SI of the lower arm 19b, i.e., to turn it on. At this time, a phase-to-phase short circuit occurs in the motor 9 and the inverter 13, forming a closed circuit including the field winding of the motor 9. As a result, the rotation of the sheave 10 is consumed in the field winding as regenerative power of the motor 9, thereby realizing the function of a dynamic brake.

[0044] Signals such as the STO command from the safety command unit 30, as well as the switching command COM_SW and switching signal SIG_SW, are transmitted through the photocouplers C1a and C1b. In this way, the safety-related unit 28 and the non-safety-related unit 29 are electrically isolated from each other by being insulated, so that even if an abnormality occurs in the non-safety-related unit 29, the influence of the abnormality will not spread to the safety-related unit 28.

[0045] Fig. 5 is a diagram showing an example of the circuit configuration of the control device 8 according to the first embodiment. Fig. 5 shows an example of the circuit configuration of a portion that realizes the SBC function. Fig. 5 also shows the circuit configuration of a portion corresponding to one of the brakes 7. The SBC function is realized for each brake 7 by a similar circuit configuration.

[0046] The safety command unit 30 of the safety-related unit 28 has a function of outputting a shutdown command such as an SBC command. The safety command unit 30 includes a switching element SC2a and a switching element SC2b. The switching elements SC2a and SC2b have the same configuration. Here, when there is no need to distinguish between the switching elements SC2a and SC2b, they may be simply referred to as the switching element SC2. When there is no need to distinguish between the switching elements SC1 and SC2, they may be simply referred to as the switching element SC. When there is no need to distinguish between the switching elements SC1a and SC2a, they may be simply referred to as the switching element SCa. Similarly, when there is no need to distinguish between the switching elements SC1b and SC2b, they may be simply referred to as the switching element SCb. The microcomputer 31a and the switching element SC2a correspond to each other. The microcomputer 31b and the switching element SC2b correspond to each other. The switching element SC2a is an example of a first switching element. The switching element SC2b is an example of a second switching element.

[0047] The switching element SC2 is an element that switches on or off based on a signal input to a driving terminal from the corresponding microcomputer 31. The switching element SC2 may be, for example, an IGBT, a MOSFET, a bipolar transistor, or some other element. The driving terminal of the switching element SC2 is connected to the corresponding microcomputer 31 so as to receive the signal input. The switching element SC2 has the driving terminal as an input and the positive and negative terminals as outputs. That is, the switching element SC2 switches the connection between the positive and negative terminals on and off in response to the signal input to the driving terminal. For example, one of the positive and negative terminals may be an emitter terminal or a source terminal, and the other may be a collector terminal or a drain terminal. The switching elements SC2a and SC2b are connected in series with one positive terminal and the other negative terminal. In this example, the switching elements SC2a and SC2b are connected in series, and the emitter terminal of the switching element SC2a is connected to the collector terminal of the switching element SC2b. The collector terminal of the switching element SC2a is connected to a DC power supply terminal, and the emitter terminal of the switching element SC2b outputs a shutoff command to the outside of the safety command unit 30. The emitter terminal of each switching element SC2b is connected to the corresponding microcomputer 31 so as to be able to output a readback signal.

[0048] Each microcomputer 31 outputs, for example, an SBC command when a safety-related abnormality occurs in the elevator 1. The SBC command output by each microcomputer 31 is an example of an individual shutoff command. Each microcomputer 31 outputs an SBC command, for example, when UCMP detects that the elevator is running with the doors open or when SETS detects excessive speed at the terminal floor. In this example, the microcomputer 31a outputs a signal DSBC_A to turn the switching element SC2a on during normal operation. The microcomputer 31b outputs a signal DSBC_B to turn the switching element SC2b on during normal operation. At this time, the SBC command output by the microcomputer 31a is a command to turn the switching element SC2a off. In other words, the microcomputer 31a executes the output of the SBC command by shutting off the output of the signal DSBC_A. Similarly, the microcomputer 31b outputs an SBC command by cutting off the output of the signal DSBC_B so as to turn off the switching element SC2b.

[0049] Under normal conditions, the microcomputer 31a inputs a signal DSBC_A to the base terminal of the switching element SC2a, and the microcomputer 31b inputs a signal DSBC_B to the base terminal of the switching element SC2b. As a result, both the switching elements SC2a and SC2b are in the ON state, and a composite signal SBC_AB is output to the outside of the safety command unit 30. At this time, the microcomputer 31a receives an input of a readback signal RB2_A. The microcomputer 31a diagnoses whether the signal output from the microcomputer 31a is normal by checking the consistency between the output state of the signal DSBC_A and the input state of the readback signal RB2_A. The microcomputer 31b also receives an input of a readback signal RB2_AB. Because the switching elements SC2a and SC2b are connected in series on the output side, the readback signal RB2_AB reflects the signal output states from both the microcomputers 31a and 31b. Therefore, the microcomputer 31b diagnoses whether the signals from the microcomputers 31a and 31b are being output normally by checking the consistency between the output state of the signal DSBC_B and the input state of the readback signal RB2_AB. When outputting a command to turn off the signal DSBC_B, the microcomputer 31b may check whether the readback signal RB2_AB is also in the off state in accordance with the signal DSBC_B, and whether the microcomputer 31a has output a command to turn off the signal DSBC_A. Furthermore, when the readback signal RB2_AB is in the off state, the microcomputer 31b may check whether it has output a command to turn off the signal DSBC_B or whether the microcomputer 31a has output a command to turn off the signal DSBC_A. Similarly, when the microcomputer 31a outputs a command to turn off the signal DSBC_A, the microcomputer 31a may check whether the readback signal RB2_A is in the OFF state in accordance with the signal DSBC_A, and whether the microcomputer 31b has output a command to turn off the signal DSBC_B. In this way, the information on the status of the individual shutoff commands is exchanged between the microcomputers 31a and 31b, thereby further improving the accuracy of the diagnosis of the individual shutoff commands.

[0050] When an abnormality occurs in elevator 1, microcomputer 31a cuts off signal DSBC_A, and microcomputer 31b cuts off signal DSBC_B. Because switching element SC2a and switching element SC2b are connected in series on the output side, if at least one of switching elements SC2 is turned off, composite signal SBC_AB is cut off. Cutting off composite signal SBC_AB is an example of a cutoff command from redundant safety command unit 30.

[0051] The control device 8 includes photocouplers C2a, C2b, and C2c. Here, when there is no need to distinguish between photocouplers C2a, C2b, and C2c, they may be simply referred to as photocoupler C2. When there is no need to distinguish between photocouplers C1 and C2, they may be simply referred to as photocoupler C. When there is no need to distinguish between photocouplers C1a and C2a, they may be simply referred to as photocoupler Ca. Similarly, when there is no need to distinguish between photocouplers C1b and C2b, they may be simply referred to as photocoupler Cb. Photocoupler C2 is an example of an isolator that transmits a signal from the primary side to the secondary side between electrically separated primary and secondary sides. Photocoupler C2a is an example of a first isolator. Photocoupler C2b is an example of a second isolator. Photocoupler C2c is an example of a third isolator. The primary side of photocoupler C2a is included in the safety-related section 28. The secondary side of photocoupler C2a is included in the non-safety-related section 29. The primary side of photocoupler C2b is included in the non-safety-related section 29. The secondary side of photocoupler C2b is included in the safety-related section 28. The primary side of photocoupler C2c is included in the safety-related section 28. The secondary side of photocoupler C2c is included in the non-safety-related section 29. The primary side of photocoupler C2a and the secondary side of photocoupler C2b are connected in series. The primary side of photocoupler C2a is connected to the safety command section 30 so as to be able to receive a shut-off command. In this example, the primary side of photocoupler C2a is connected to the emitter terminal of switching element SC2b. The secondary side of photocoupler C2a is connected to switching element SB1 of the power supply section 21 via chopper terminal 24 of the brake 7. The primary side of photocoupler C2b is connected to control command unit 12 so as to be able to receive switching commands. The secondary side of photocoupler C2b is connected to safety earth 32 of safety-related unit 28. The primary side of photocoupler C2c is connected to safety command unit 30 so as to be able to receive shut-off commands. In this example, one side of the primary side of photocoupler C2c is connected to the emitter terminal of switching element SC2b. The other side of the primary side of photocoupler C2c is connected to safety earth 32 of safety-related unit 28.The secondary side of the photocoupler C2c is connected to the switching element SB3 of the making unit 23 through the making terminal 27 of the brake 7.

[0052] Under normal circumstances, a composite signal SBC_AB is output from the safety command unit 30. Therefore, a voltage is applied to the secondary side of the photocoupler C2b from the DC power supply terminal. The primary side of the photocoupler C2b receives a switching command COM_CH for chopper control of the power supply unit 21 from the control command unit 12. This switching command COM_CH switches the secondary side of the photocoupler C2b on and off. In response to the switching on and off of the secondary side of the photocoupler C2b, the conduction of the primary side of the photocoupler C2a is switched. In response to the conduction of the primary side of the photocoupler C2a, the secondary side of the photocoupler C2a is switched on and off. In response to the switching on and off of the secondary side of the photocoupler C2a, a switching signal SIG_CH is input to the switching element SB1 of the power supply unit 21 through the chopper terminal 24 of the brake 7. In this way, the chopper control switching command COM_CH from the control command unit 12 is input to the switching element SB1 as the switching signal SIG_CH via the photocoupler C2b and the photocoupler C2a. Since the switching command from the control command unit 12 is input indirectly to the power supply unit 21 in this way, the control device 8 can supply power from the power supply unit 21 to the operating unit 20 in the brake 7.

[0053] Furthermore, under normal circumstances, the safety command unit 30 outputs a composite signal SBC_AB, so that the secondary side of the photocoupler C2c is in the ON state. A signal SIG_SH is input to the switching element SB3 via the secondary side of the photocoupler C2c and the input terminal 27, so that the switching element SB3 is in the ON state. Since the switching element SB3 is in the ON state and power is supplied to the application unit 20 from the power supply unit 21, the control device 8 can switch the application unit 20 of the brake 7 between the applied state and the released state in response to a control signal sent via the control terminal 26 of the control command unit 12.

[0054] On the other hand, when an abnormality occurs in elevator 1, safety command unit 30 outputs an SBC command by interrupting composite signal SBC_AB. Because composite signal SBC_AB is interrupted, no voltage is applied from the DC power supply terminal to the secondary side of photocoupler C2b. Therefore, even if switching command COM_CH is input from control command unit 12, no signal is transmitted from the primary side to the secondary side of photocoupler C2b. At this time, no signal is transmitted to photocoupler C2a either, so no switching signal SIG_CH is input to switching element SB1 of power supply unit 21. Therefore, the power supply from power supply unit 21 to operating unit 20 is interrupted. Furthermore, because composite signal SBC_AB is interrupted, the secondary side of photocoupler C2c is turned off. At this time, signal SIG_SH, which keeps switching element SB3 on, is interrupted, so the power supply to operating unit 20 is interrupted even if power supply unit 21 is operating. In this way, by cutting off the supply of power to the operating portion 20, the brake 7 transitions to the braking state, and the SBC function is realized.

[0055] Signals such as the SBC command, the switching command COM_CH and switching signal SIG_CH, and the signal SIG_SH from the safety command unit 30 are transmitted through the photocouplers C2a, C2b, and C2c. In this way, the safety-related unit 28 and the non-safety-related unit 29 are electrically isolated from each other by being insulated, so that even if an abnormality occurs in the non-safety-related unit 29, the influence of the abnormality does not spread to the safety-related unit 28.

[0056] As described above, the control device 8 of the elevator 1 according to the first embodiment has a safety-related unit 28 and a non-safety-related unit 29. The safety-related unit 28 includes a redundant safety command unit 30 that outputs a shutoff command such as an STO command or an SBC command. The non-safety-related unit 29 includes the inverter 13 that drives the motor 9 and the control command unit 12. The control command unit 12 outputs a switching command to the inverter 13. The control command unit 12 outputs a switching command for chopper control of the power supply unit 21 of the brake 7. The control device 8 includes a photocoupler Ca and a photocoupler Cb. Each photocoupler C transmits a signal between electrically separated primary and secondary sides and does not transmit a signal when a shutoff command is output. The primary side of the photocoupler Ca is included in the safety-related unit 28. The secondary side of the photocoupler Ca is included in the non-safety-related unit 29. The primary side of the photocoupler Cb is included in the non-safety-related unit 29. The secondary side of photocoupler Cb is included in the safety-related unit 28. The primary side of photocoupler Ca and the secondary side of photocoupler Cb are connected in series. The safety command unit 30 is connected to the primary side of photocoupler Ca so as to be able to output a shut-off command. The secondary side of photocoupler Cb is connected to a safety earth 32 of the safety-related unit 28. The control command unit 12 is connected to the primary side of photocoupler Cb so as to be able to output a switching command. The secondary side of photocoupler Ca is connected to the switching element SI of the inverter 13 or the switching element SB1 of the power supply unit 21 of the brake 7 so that photocouplers Cb and Ca can output a switching signal that transmits the switching command.

[0057] With this configuration, shutoff commands, switching commands, and the like from the safety command unit 30 are transmitted through the photocouplers Ca and Cb. In this way, the safety-related unit 28 and the non-safety-related unit 29 are electrically isolated by being insulated, so that even if an abnormality occurs in the non-safety-related unit 29, the influence of the abnormality does not spread to the safety-related unit 28. This further improves the reliability of the safety-related unit 28. Furthermore, because the non-safety-related unit 29 is isolated from the safety-related unit 28, the elements included in the safety-related unit 28 are kept to a minimum. Since it is no longer necessary to apply the standards required for the safety-related unit 28 to the classification and inspection of each element of the non-safety-related unit 29, costs for manufacturing and inspecting the control device 8 are reduced. Furthermore, because the scope included in the safety-related unit 28 is kept to a minimum, costs required to demonstrate that the safety-related unit 28 meets the required safety level are reduced.

[0058] The safety command unit 30 also includes redundant microcomputers 31a and 31b, and switching elements SCa and SCb. Each switching element SC has a drive-side terminal as an input and a positive and negative terminal as an output. The switching elements SCa and SCb are connected in series on the output side. The positive terminal of the switching element SCa is connected to the negative terminal of the switching element SCb. Each microcomputer 31 outputs an individual shutoff command to the drive-side terminal of the corresponding switching element SC. The switching element SCb outputs a redundant shutoff command from its negative terminal in response to the individual shutoff command from the microcomputer 31a and the individual shutoff command from the microcomputer 31b.

[0059] With this configuration, the safety command unit 30 is made redundant, so that even if an abnormality occurs in one of the microcomputers 31, the function of the safety command unit 30 is not impaired. This further improves the reliability of the safety-related unit 28.

[0060] The microcomputer 31a receives an input from the negative terminal of the switching element SCa and diagnoses the individual shutoff command output by the microcomputer 31a. The microcomputer 31b receives an input from the negative terminal of the switching element SCb and diagnoses the individual shutoff commands output by the microcomputers 31a and 31b.

[0061] The microcomputer 31 can self-diagnose the soundness of its own functions. This allows for early response to an abnormality even if one of the microcomputers 31 experiences an abnormality. This further improves the reliability of the safety-related part 28.

[0062] The inverter 13 also has a leg 18 including an upper arm 19a and a lower arm 19b. Each arm includes a switching element SI. The switching element SI of the upper arm 19a is operated by a switching signal from the secondary side of the photocoupler C1a. The switching element SI of the lower arm 19b is operated by a switching command from the control command unit 12. The control command unit 12 closes the switching element SI of the lower arm 19b when the safety command unit 30 outputs a shutoff command.

[0063] This configuration allows the safety function of the STO and the safety function of the dynamic brake to be achieved at the same time, thereby further increasing the reliability of the safety of the elevator 1.

[0064] The control device 8 also includes a photocoupler C2c. The primary side of the photocoupler C2c is included in a safety-related section 28. The secondary side of the photocoupler C2c is included in a non-safety-related section 29. A safety command section 30 is connected to the primary side of the photocoupler C2c so as to be able to output a cut-off command. The primary side of the photocoupler C2c is connected to a safety earth 32. The secondary side of the photocoupler C2c is connected to an application section 23 that transitions the brake 7 to a braking state so that the brake 7 can transition to a braking state in response to a cut-off command.

[0065] With this configuration, the brake 7 transitions to the braking state via the input unit 23 in response to a shutoff command. Since the brake 7 transitions to the braking state via a system separate from the system that stops control of the power supply unit 21, the SBC function is realized more reliably. This further increases the reliability of the safety of the elevator 1.

[0066] 6 and 7 are diagrams showing other examples of the circuit configuration of the control device 8 according to the first embodiment. Fig. 6 shows an example of the circuit configuration of a portion that realizes the STO function. Fig. 7 shows an example of the circuit configuration of a portion that realizes the SBC function.

[0067] 6 and 7, each photocoupler C may be a totem-pole output photocoupler. In this example, photocouplers C1a and C1b are active-low output photocouplers. Photocoupler C2a is an active-high output photocoupler. Photocouplers C2b and C2c are active-low output photocouplers.

[0068] In the control device 8, other isolators may be used in place of each photocoupler C. An isolator is a device that transmits a signal from the primary side to the secondary side between electrically separated primary and secondary sides. In the control device 8, some or all of the photocouplers C may be replaced by, for example, digital isolators.

[0069] The control device according to the present disclosure can be applied to an elevator.

[0070] REFERENCE SIGNS LIST 1 elevator, 2 hoistway, 3 hoisting machine, 4 main rope, 5 cage, 6 counterweight, 7 brake, 8 control device, 9 motor, 10 sheave, 11 external power supply, 12 control command unit, 13 inverter, 14 inverter power supply, 15 bridge, 16 converter circuit, 17 smoothing circuit, 18 leg, 19a upper arm, 19b lower arm, 20 action unit, 21 power supply unit, 22 control unit, 23 closing unit, 24 chopper terminal, 25 power transformer, 26 control terminal, 27 closing terminal, 28 safety-related unit, 29 non-safety-related unit, 30 safety command unit, 31, 31a, 31b microcomputer, 32 safety earth SI, SB1, SB2, SB3, SC, SC1, SC1a, SC1b, SC2, SC2a, SC2b, SCa, SCb: Switching elements, C, C1, C1a, C1b, C2, C2a, C2b, C2c, Ca, Cb: Photocouplers

Claims

1. An elevator control device having a safety-related section including a redundant safety command section that outputs a shutoff command, and a non-safety-related section including an inverter that drives a motor and a control command section that outputs a switching command to the inverter, the control device comprising: a first isolator whose primary side is included in the safety-related section and whose secondary side is included in the non-safety-related section, transmitting signals between the electrically separated primary and secondary sides and not transmitting signals when the shutoff command is output; and a second isolator whose primary side is included in the non-safety-related section and whose secondary side is included in the safety-related section, transmitting signals between the electrically separated primary and secondary sides and not transmitting signals when the shutoff command is output; the primary side of the first isolator and the secondary side of the second isolator are connected in series; the safety command section is connected to the primary side of the first isolator so as to be able to output the shutoff command; the secondary side of the second isolator is connected to the safety earth of the safety-related section; and the control command section is connected to the primary side of the second isolator so as to be able to output the switching command. a secondary side of the first isolator connected to an inverter switching element of the inverter so that the second isolator and the first isolator can output a switching signal that transmits the switching command.

2. The elevator control device according to claim 1, wherein the safety command unit comprises: redundant first and second processing circuits; and first and second switching elements connected in series on the output side, with a drive side terminal as an input and a positive and negative terminal as outputs, wherein the negative terminal of the first switching element is connected to the positive terminal of the second switching element, the first processing circuit outputs an individual shut-off command to the drive side terminal of the first switching element, the second processing circuit outputs an individual shut-off command to the drive side terminal of the second switching element, and the second switching element outputs the redundant shut-off command from the negative terminal in response to the individual shut-off command from the first processing circuit and the individual shut-off command from the second processing circuit.

3. An elevator control device as described in claim 2, wherein the first processing circuit receives input from the negative terminal of the first switching element and diagnoses the individual shut-off command output by the first processing circuit, and the second processing circuit receives input from the negative terminal of the second switching element and diagnoses the individual shut-off commands output by the first processing circuit and the second processing circuit.

4. An elevator control device as described in claim 3, wherein when outputting an individual shutoff command, the second processing circuit diagnoses the individual shutoff command using information on whether or not the redundant shutoff command has been detected based on the input from the negative terminal of the second switching element, and information on whether or not the first processing circuit has output an individual shutoff command obtained from the first processing circuit.

5. An elevator control device as described in any one of claims 1 to 4, wherein the inverter has a leg including a first arm and a second arm, each of the first arm and the second arm includes an inverter switching element, the inverter switching element of the first arm operates in response to the switching signal from the secondary side of the first isolator, and the inverter switching element of the second arm operates in response to the switching command from the control command unit.

6. An elevator control device according to claim 5, wherein the control command unit closes the inverter switching element of the second arm when the safety command unit outputs the shutoff command.

Images