Patent Publication Number: US-9422135-B2

Title: Elevator drive power supply control

Description:
BACKGROUND 
     Elevator systems include a variety of components for controlling movement of the elevator car. For example, an elevator drive is responsible for controlling the motor that causes movement of the elevator car. An elevator safety chain is associated with the elevator drive to prevent the motor from causing the elevator car to move if the elevator car doors or any of the doors along the hoistway are open, for example. The safety chain operates to prevent power flow to the drive and the motor. 
     Allowing the safety chain to control whether power is supplied to the elevator drive and the motor has typically been accomplished using high cost relays. Elevator codes require confirming proper operation of those relays. Therefore, relatively expensive, force guided relays are typically utilized for that purpose. The force guided relays are expensive and require significant space on drive circuit boards. Force guided relays are useful because they allow for monitoring relay actuation in a fail safe manner. They include two contacts, one of which is normally closed and the other of which is normally open. One of the contacts allows for the state of the other to be monitored, which fulfills the need for monitoring actuation of the relays. 
     Elevator system designers are always striving to reduce cost and space requirements. Force guided relays interfere with accomplishing both of those goals. 
     SUMMARY 
     An exemplary elevator control system includes an elevator drive. A safety chain is configured to monitor at least one condition of a selected elevator system component. A first switch is controlled by the safety chain for selectively providing power to the elevator drive depending on the monitored condition. A second switch is in series with the first switch. The second switch is controlled by the safety chain for selectively providing power to the elevator drive depending on the monitored condition. A monitoring device is configured to determine when the first and second switches should be in a power supplying condition for supplying power to the elevator drive. One such circumstance is when it is desirable to cause movement of the elevator car. The monitoring device determines that the first switch is in the power supplying condition before allowing the safety chain to control the second switch for supplying power to the elevator drive. The monitoring device determines whether the second switch is in a power supplying condition when the first switch is properly in the power supply condition. The monitoring device is configured to prevent the elevator drive from being powered whenever it determines that either the first switch or the second switch is not in a desired condition. 
     An exemplary method of controlling power supply to an elevator drive includes determining when first and second switches between a safety chain and a power connection to the elevator drive should be in a power supplying condition for supplying power to the elevator drive. A determination is made that the first switch is in the power supplying condition before allowing the second switch to be in the power supplying condition. A determination is made whether the second switch is in the power supplying condition when the first switch is properly in the power supplying condition. Power supply to the elevator drive is prevented if either the first switch or the second switch is not in a desired condition. 
     The various features and advantages of a disclosed example will become apparent to those skilled in the art from the following detailed description. The drawings that accompany the detailed description can be briefly described as follows. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  schematically illustrates an example elevator power supply control system designed according to an embodiment of this invention. 
         FIG. 2  is a flowchart diagram summarizing an example control approach. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  schematically shows an elevator control system  20 . An elevator drive  22  controls operation of a motor (not illustrated) for controlling movement of an associated elevator car (not illustrated). A safety chain  24  selectively controls whether the elevator drive  22  receives power from a power supply  26 . The safety chain  24  effectively controls whether a conductor  28  conducts power from the power supply  26  to the elevator drive  22 . 
     The safety chain  24  is configured to monitor at least one condition of at least one selected elevator system component. In one example, the safety chain  24  comprises a plurality of switches associated with door locks along a hoistway. Whenever any of the door locks indicates that a hoistway door is open, the safety chain  24  is configured to prevent the elevator drive  22  from receiving power. 
     The safety chain  24  controls a first switch  30  for controlling whether power from the power supply  26  can flow along the conductor  28  to the elevator drive  22 . The safety chain  24  also controls a second switch  32 . When both of the first switch  30  and the second switch  32  are in a power supplying condition (i.e., closed), the elevator drive  22  can receive power from the power supply  26 . The first switch  30  and the second switch  32  are separate from the inverter gate drive circuitry of the elevator drive  22 . 
     In the illustrated example, the first switch  30  and the second switch  32  comprise independent relay switches. In one example, both switches are a single pole single throw (SPST) relay switch. In another example, the first switch  30  and the second switch  32  each comprise a single pole double throw (SPDT) relay switch. Other examples include semiconductor type switches. 
     The first switch  30  and the second switch  32  do not provide a self-monitoring function. The example of  FIG. 1  includes a monitoring device  34  that is configured to determine whether the first switch  30  and the second switch  32  are appropriately actuated based upon the current condition of the associated elevator system. In one example, the monitoring device  34  comprises a microprocessor. The monitoring device  34  is programmed with software or firmware, for example, to determine when the first switch  30  and the second switch  32  should be in the power supplying condition. In another example, the monitoring device  34  comprises an ASIC that is configured to make the determinations regarding the condition of the switches. Another example monitoring device comprises discrete logic elements. 
     The monitoring device  34  is configured to determine whether the first switch  30  and the second switch  32  should be in the power supplying condition. If so, the monitoring device  34  utilizes a control component  36  (e.g., a solid state switch) to control a timing with which the first switch  30  and the second switch  32  are actuated by the safety chain  24 . The monitoring device  34  delays actuation of the second switch  32  until after the monitoring device  34  is able to confirm that the first switch  30  is appropriately in the power supplying condition. The monitoring device  34  then allows for the second switch  32  to be actuated by the safety chain  24  and confirms that it is appropriately in the power supplying condition under corresponding circumstances. 
     In the illustrated example, the monitoring device  34  monitors a voltage on the conductor  28  at an output of the first switch  30  between the first switch  30  and the elevator drive  22  as schematically shown at  38 . The voltage at the output of the first switch  30  (e.g., on the conductor  28  at  38 ) indicates whether the first switch  30  is in the power supplying condition. The second switch  32  is not allowed to be in a power supplying condition while the monitoring device  34  is determining whether the first switch  30  is in the power supplying condition to avoid a false positive determination regarding the condition of the first switch  30 . In one example, the monitoring device  34  also determines whether the second switch  32  has an appropriate voltage at the same time. 
     Once the proper actuation of the first switch  30  is confirmed, the monitoring device  34  allows the safety chain  24  to actuate the second switch  32 . The monitoring device  34  determines a voltage on a portion of the conductor  28  between the second switch  32  and the elevator drive  22  as schematically shown at  40 . In other words, the monitoring device  34  determines whether the voltage at the output of the second switch  32  indicates the desired switch condition. This allows the monitoring device  34  to determine the actuation state of the second switch  32 . 
     The monitoring device  34  in the illustrated example comprises a microprocessor and, therefore, isolation elements  42  are provided to protect the monitoring device  34  in the event of a high voltage condition on the conductor  28 . 
       FIG. 2  includes a flowchart diagram  50  that summarizes an example approach. At  52 , the elevator system is in an operating condition in which the elevator drive  22  is idle. This corresponds to, for example, a condition in which the elevator car has stopped at a landing to allow passengers to board the elevator car. In this condition, the switches  30  and  32  are open, which opens the DC power supply to the inverter gate drive circuitry of the elevator drive  22 . At  54 , the elevator drive  22  receives a run command indicating that the elevator car should move. At  56 , the safety chain  24  becomes active and attempts to actuate the first switch  30  and the second switch  32  (e.g., to close them) to allow power from the power supply  26  to be provided along the conductor  28  to the elevator drive  22 . 
     As shown at  58 , the monitoring device  34  allows for the first switch  30  to be actuated but prevents the second switch  32  from being actuated. The monitoring device  34  controls the switch  36  for this purpose, for example. At  60 , the monitoring device  34  determines the voltage at the output of the first switch  30  and the second switch  32  (e.g., determines a voltage at the locations  38  and  40  in  FIG. 1 ). 
     At  62 , a determination is made whether the voltages detected at  38  and  40  indicate that the first switch  30  is in the power supplying condition and the second switch  32  is not in the power supply condition. If both of those conditions are not satisfied, the safety chain  24  is disabled at  64  and the elevator drive  22  does not receive power so that the commanded run does not occur. In other words, the elevator car is prevented from moving if the first switch  30  and the second switch  32  are not operating in a manner consistent with a desired operation of those switches. 
     Assuming that the determination at  62  is favorable, the monitoring device  34  allows for the second switch  32  to be actuated at  66 . There is a delay between the steps  56  and  66 . That delay is controlled by the monitoring device  34  to allow for verifying that the first switch  30  is functioning properly. At  68 , the monitoring device  34  determines the voltage at the output of the second switch  32  (e.g., at  40  in  FIG. 1 ). 
     At  70 , a determination is made whether the voltage detected in step  68  is consistent with an expected voltage if the second switch  32  is properly in the power supplying condition. If not, the safety chain is disabled at  72  and the elevator drive  22  will not be able to control the motor for moving the elevator car. 
     Assuming that the determination made at  70  is positive, the elevator drive  22  receives power at  74  and the car moves as desired. At  76 , the elevator car has stopped and the doors have opened to allow the passengers to exit the elevator car. At that point, the safety chain  24  is disabled because it has detected that the doors are open. When the safety chain is disabled at  76 , the first switch  30  and the second switch  32  open at  78  so that no further power may be provided to the elevator drive  22  from the power supply  26 , which prevents further movement of the elevator car until the safety chain  24  later actuates the first switch  30  and second switch  32  to move them into the power supplying condition in a manner consistent with that described above. 
     The disclosed technique of delaying actuation of one of the switches  30 ,  32  until proper operation of the other has been confirmed allows for testing both switches at the beginning of each elevator run. The disclosed technique does not leave any failure condition of either switch  30 ,  32  or the control component  36  undetected. Additionally, the control component  36  does not have any effect on the safety chain  24  disabling either the first switch  30  or the second switch  32 . Therefore, the illustrated example maintains the necessary integrity of the system  20  while still allowing for monitoring the actuation state of the first switch  30  and the second switch  32 , respectively. 
     The illustrated example allows for realizing the necessary monitoring functions to satisfy elevator codes regarding the control over supplying power to an elevator drive. The illustrated example accomplishes that goal without requiring expensive components such as force controlled relay switches. Instead, relatively inexpensive SPST or SPDT relays can be used in conjunction with the monitoring device  34 . This saves cost and circuit board space. 
     The preceding description is exemplary rather than limiting in nature. Variations and modifications to the disclosed examples may become apparent to those skilled in the art that do not necessarily depart from the essence of this invention. The scope of legal protection given to this invention can only be determined by studying the following claims.