EP3046863B1 - Method for operating a lift control device - Google Patents

Description

The invention primarily relates to a method for operating an elevator control device in an installation, initialization or maintenance mode or the like. Furthermore, the invention also relates to a computer program for implementing the method and a computer program product with such a computer program and a device, namely for example an elevator control device, with such a computer program as a means for executing the method.

In the case of modern elevator control devices, access to these is possible by means of a device referred to below as a programming device, without waiving further general validity. The term access is to be understood here preferably as the activation or deactivation of elevator functions as well as temporary or permanent changes in the program sequence or in setting parameters of the elevator control device. Access can be local if qualified personnel are present on site with an appropriate programming device. Access can also be from a remote station, for example via the Internet. It goes without saying that in the event of remote access to the elevator control device, individual functions of the elevator control device, such as the opening of storey doors, must not be accessible for security reasons. pamphlet JP 2004 099 301 A discloses a programmer according to the preamble of claim 11.

Accordingly, one object of the present invention is to specify a method for operating an elevator control device that allows reliable detection of local access to the elevator control device.

According to the invention, this object is achieved with a method for operating an elevator control device with the features of claim 1 . For this purpose, with such a method, in which the elevator control device has an interface for wireless and/or wired access to the elevator control device using a programming device, the following is provided: When accessing or in connection with the access to the elevator control device using the programming device, an identifier is automatically sent sent to the programmer. For example, the identifier can be sent from the elevator control device to the programming device. It is just as possible, for example, that when the elevator control device is accessed using the programming device, an identifier is sent by a third device to the programming device and also to the elevator control device. Based on the sent identifier, the elevator control device expects an input of the previously sent identifier within a predetermined or predeterminable input time period a control panel, wherein the control panel is arranged in the area of the elevator system, interacts with the elevator control device and allows the identifier to be entered only by touching it or from a short distance. A control panel is preferably used for this purpose, as is provided in an elevator system on the individual floors (floor control panel; landing operating panel—LOP), or a control panel of an elevator car (cabin control panel; cabin operating panel—COP). The elevator control device automatically checks the entered identifier by comparing it to match or at least adequate match with the previously sent identifier, and the elevator control device automatically enables access to the elevator control device if the previously sent identifier was entered correctly within the input period. If the elevator control device does not send the identifier itself, it is provided that the elevator control device also receives the identifier sent externally to the programming device and can therefore check the subsequent input of the identifier. Transmission of the identifier by the elevator control device is understood to mean direct transmission by the elevator control device, but also indirect transmission, namely under the control of the elevator control device, with a suitable device in the elevator car acting as the transmitter, for example.

Normally, a comparatively short time value is chosen as the input time period, for example a time value of the order of a few seconds, for example thirty seconds. This ensures that access to the elevator control device is not enabled if the identifier is not entered within the input time period. Activation is therefore only possible in close temporal relation to the transmission of the identifier by the elevator control device. This prevents an erroneous release if the identifier that may have been sent out by the elevator control device days or weeks ago is accidentally guessed as a result of inputs on a control panel. However, a comparatively large time value can also be selected as the input time period, for example a time value on the order of several minutes. A very large time value, for example a time value on the order of months or years, means that there is no monitoring at all as to whether the identifier was entered in a temporal context with the transmission of the identifier. In this respect, it can be assumed for the interpretation of the description that the monitoring of the input period can also be omitted.

The invention is based on the consideration that when there is local access to the elevator control device, specialist personnel are present on site in order to carry out the commissioning, initialization, maintenance, etc. of the elevator installation. The qualified personnel ensure that the measures taken during commissioning, initialization, maintenance, etc. do not endanger people. Therefore, with such a local access to the elevator control device functions can also be made accessible which may not be available with remote access to the elevator control device. An example of such a function is the previously mentioned opening of the storey doors.

In order to reliably detect local access to the elevator control device, it is therefore necessary to provide evidence that specialist personnel are on site. Because the elevator control device sends an identifier to the device with which the access attempt was triggered when an attempt is made to access the elevator control device, whereupon the device - in this case the programming device - causes the identifier to be output directly or indirectly, the specialist personnel can send the received identifier to enter a control panel of the elevator control device arranged in the area of the elevator system. If the entry is correct, it is ensured that qualified personnel is on site. Then the expanded, local access to the elevator control device can be enabled.

The advantage of the invention consists above all in the simple manner in which local access to the elevator control device is recognized. There is no need to evaluate device identifiers and the like, or to keep a list of permitted devices, or runtime measurements for data exchanged between the programming device and the elevator control device. The detection of the local access to the elevator control device can thus be implemented easily and is nevertheless secure.

Advantageous configurations of the invention are the subject matter of the dependent claims. References used here indicate the further development of the subject matter of the main claim through the features of the respective dependent claim. They are not to be understood as a waiver of the achievement of independent, objective protection for the feature combinations of the dependent claims. Furthermore, with regard to an interpretation of the claims in the case of a more detailed specification of a feature in a subordinate claim, it must be assumed that such a restriction does not exist in the respective preceding claims.

In one embodiment of the method, the enabling of access to the elevator control device ends automatically after a predetermined or predeterminable access time period. This avoids security risks that can arise if access to the elevator control device is not released manually when it is no longer required by the specialist personnel.

Access to the elevator control device can be terminated by the specialist personnel entering a corresponding identifier on a control panel. If the professional staff If the operator actions on the elevator control device ended with such an input, it is ensured that the activation of the local access to the elevator control device has ended.

A particularly simple way of entering the identifier received from the elevator control device in the elevator control device is for the specialist personnel to manually enter the identifier using a keypad included in the elevator control device or assigned to the elevator control device. However, the term input is to be interpreted broadly and includes any form in which the identifier can be communicated to the elevator control device. In this respect, an automatic evaluation can also be considered. Examples in this regard are an optically analyzable identifier and an acoustically analyzable identifier.

One embodiment of the method therefore provides that the programming device includes an actuator, in particular optical, acoustic or haptic, for outputting the received identifier in a form that can be evaluated automatically, that the control panel includes a sensor system for detecting the identifier sent to the programming device, and that the programming device in is brought into the detection range of the sensor system and the sensor system detects the identifier sent to the programming device and output by means of the actuator system. The output of the identifier received from the elevator control device in an automatically evaluable form and the detection and subsequent evaluation with a suitable sensor system has the advantage that, for example, input errors, such as are possible when entering the identifier manually via a keypad or the like, are avoided will. Nevertheless, even with such an "input" of the identifier on the control panel, the presence of specialist personnel on site can be reliably detected, because the respective actuators must be brought into the detection range of the respective sensors by the specialist personnel.

In a special variant of this embodiment of the method, the programming device comprises, as an actuator, means for optically displaying the identifier, in particular in the form of a barcode. The identifier received from the elevator control device is displayed by means of the actuators in a way that can be optically sensed. As a sensor system, the control panel includes means for optically detecting the identifier displayed in this way, in particular a camera. To "enter" the identifier, the programming device, ie at least the respective actuator, is brought into the detection range of the sensor system and the optical representation of the identifier is detected by the sensor system.

In an alternative or additional variant of the above-described special embodiment of the method, the programming device, as an actuator, comprises means for acoustically displaying the identifier, in particular for displaying/outputting the identifier in the form of a sequence of tones. The control panel comprises, as a sensor system, means for acoustically detecting the identifier “represented” in this way, in particular a sound transducer, namely a microphone, for example. To "enter" the identifier, the programming device, ie at least the respective actuator, is brought into the detection range of the sensor system and the acoustic representation of the identifier is detected by the sensor system.

The above-mentioned object is also achieved with an elevator control device and a programming device that are set up to carry out the method and individual or all configurations of the method. The invention is preferably implemented in software. The invention is therefore on the one hand also a computer program with program code instructions that can be executed by a computer, namely the elevator control device and the programming device, as well as a storage medium with such a computer program, i.e. a computer program product with program code means, and finally also an elevator control device and a programming device, in whose memory as means for Carrying out the method and its refinements, such a computer program is loaded or loadable. The method described here and in the following is carried out automatically in part by the elevator control device and in part by the programming device. If the text does not expressly refer to a different situation, each described method step is to be read in such a way that it is automatically carried out by the elevator control device or the programming device on the basis and under the control of a control program executed by it.

An exemplary embodiment of the invention is explained in more detail below with reference to the drawing.

Corresponding objects or elements are provided with the same reference symbols in all figures.

The or each embodiment is not to be construed as limiting the invention. Rather, changes and modifications are also possible within the scope of the present disclosure, for example by combining or modifying individual features or elements or process steps for the described in connection with the general or specific part of the description and contained in the claims and / or the drawing Those skilled in the art can be inferred with regard to solving the problem and, through combinable features, lead to a new object or to new method steps or method step sequences.

Fig. 1

eine Aufzugsanlage mit einer Aufzugssteuerungseinrichtung,

Fig. 2

die Aufzugssteuerungseinrichtung mit weiteren Details sowie ein zum Zugriff auf die Aufzugssteuerungseinrichtung vorgesehenes Programmiergerät,

Fig. 3

ein Flussdiagramm zu einer Teilfunktionalität eines von der Aufzugssteuerungseinrichtung ausgeführten Aufzugssteuerungsprogramms und

Fig. 4

eine verallgemeinerte Darstellung der Aufzugsteuerungseinrichtung und des Programmiergeräts aus Fig. 2.

Show it

1

an elevator system with an elevator control device,

2

the elevator control device with further details and a programming device provided for access to the elevator control device,

3

a flowchart for a partial functionality of an elevator control program executed by the elevator control device and

4

presents a generalized representation of the elevator controller and programmer 2 .

The representation in 1 shows a schematically simplified elevator installation 10 in a building (not shown) with at least one elevator car 14 that can be moved in at least one elevator shaft 12 and an elevator control device 16 provided at a central location in the building. The elevator control device 16 is used in a manner known per se to control the elevator installation 10 provided. The or each elevator car 14 can be moved in a manner known per se in the elevator shaft 12 or in the respective elevator shaft 12, so that different floors 18 of the building can be reached.

Different control panels 20, 22 are provided for a user of the elevator system 10, namely at least one cabin control panel 20 (COP) and one control panel on each floor 18; Floor Control Panel 22 (LOP). Data lines and the like between the control panels 20, 22 and the elevator control device 16 are shown in FIG 1 Not shown. The user of the elevator system 10 transmits a respective travel request to the elevator control device 16 by operating actions on a control panel 20, 22, and as soon as the travel request can be fulfilled, the elevator control device 16 initiates a corresponding movement of the elevator car 14.

The present invention relates to access to the elevator control device 16, as is required, for example, during commissioning, during regular maintenance, in the event of service or the like. Such access to the elevator control device 16 is carried out by appropriately trained specialist personnel, ie not by the user mentioned above.

When accessing the elevator control device 16 by the technical staff, it is often necessary for example for the elevator car 14 to be moved or for floor doors (not shown) or car doors (not shown) of the elevator car 14 to be opened or closed. Measures of this kind, which are only mentioned here as examples, harbor security risks. For example, a landing door on one of the 18th floors of the building must not be readily opened if doing so would create a hazard to occupants of the building.

Skilled personnel can recognize such or similar dangers and counteract them accordingly. However, this normally only applies if the specialist staff is present on site. With the description presented here, a solution is accordingly proposed as to how, when accessing the elevator control device, it can be recognized that specialist personnel are on site.

The representation in 2 16 shows the elevator control device 16, still schematically simplified, but with further details. According to this, the elevator control device 16 comprises, in a manner known per se, a processing unit 24 in the form of or in the manner of a microprocessor and a memory 26. An elevator control program 28 is loaded into the memory 26, which program controls the functionality of the elevator installation 10 ( 1 ) definitely.

To access the elevator control device 16, it comprises at least one interface 30, 32. In the illustration in 2 two independent interfaces 30, 32, namely a first interface 30 and a second interface 32, are shown for a simple illustration of the relationships. It is also possible that the elevator control device 16 includes only one interface or more than two interfaces. Then the following explanations relate to one and the same interface of the elevator control device 16.

It should be assumed here that the elevator control device 16 comprises two independent interfaces 30, 32 and that the first interface 30 enables wired access to the elevator control device 16, for example. Such wired access using the first interface 30 can also be carried out by specialist personnel from a remote location, so that the wired access includes, for example, data transmission via the Internet or the like and the elevator control device 16 using the first interface 30 in a suitable manner connected to a communication medium that permits such remote access.

In contrast, the second interface 32 allows access to the elevator control device 16 by means of a device provided for this purpose, which is referred to below as a programming device 34 without waiving further generality and which is located in the immediate vicinity of the elevator control device 16 for access (local access). Such a programming device 34 is shown in the schematically simplified representation in 2 shown in the lower area. The programming device 34 has a programming device interface 36 that matches the second interface 32 of the elevator control device 16, so that data can be exchanged between the elevator control device 16 and the programming device 34. In addition, the programming device 34 has a processing unit 38 in the form of or in the manner of a microprocessor and a memory 40 in a manner known per se. Into memory 40 is a programmer control program 42 that determines the functionality of the programmer 34 is loaded.

To illustrate the access to the elevator control device 16 by means of the programming device 34, the illustration in 2 wavefronts emanating from the respective interfaces 32, 36 are shown. The interfaces 32, 36 thus enable, for example, wireless communication between the programming device 34 and the elevator control device 16. Equally, the elevator control device 16 can be accessed by means of the programming device 34 in a wired manner. Then the interfaces 32, 36 are designed accordingly.

What is not shown is that additionally or alternatively, individual or all control panels 20, 22 can also have an interface 30, 32 for access to the elevator control device 16, namely at least one interface 32 for local access to the elevator control device 16. If in the following according to the representation in 2 When we talk about an interface 32 for accessing the elevator control device 16 using the programming device 34, this means access to the elevator control device 16 using an interface 32 included in the elevator control device 16 itself, and access to the elevator control device 16 using one of a control panel 20, 22 included interface (not shown) be included.

The following is about local access by means of a programming device 34 to the elevator control device 16. Because the programming device 34 is operated by specialist personnel, the relevant specialist personnel is present at the location of the elevator system 10 when accessing the elevator control device 16 locally. Local access to the elevator controller 16 may therefore allow execution of functions not available with remote access. In this context, opening the floor doors already mentioned above should be mentioned as an example. In the case of remote access, it must not be possible to open the storey doors, because this results in a danger to users of the building - as can be seen immediately. In the case of local access, it may be necessary to open the storey doors for maintenance purposes and the like, and the associated fundamental danger remains manageable because the specialist staff is on site and can take suitable measures to protect and inform the users of the building.

The elevator control device 16, which, as part of its elevator control program 28, includes the functionalities, for example for opening the storey doors, independently of the type of access, must therefore choose between local access and remote access can distinguish so that certain functions that are not accessible with remote access become accessible with local access.

For this purpose, it is provided that when the programming device 34 accesses the elevator control device 16 , the elevator control device 16 automatically sends an identifier 44 to the programming device 34 - ie due to a corresponding partial functionality of the elevator control program 28 . The elevator control device 16 then expects within a predetermined or specifiable input period for the previously sent identifier 44 to be input on a control panel 20, 22 included in the elevator control device 16 or assigned to the elevator control device 16. If the previously sent identifier 44 was entered correctly within the input period, the Elevator control device 16 access, namely local access, to the elevator control device 16 freely.

The identifier 44 is typically a variable identifier 44 which cannot easily be guessed and which, moreover, changes from time to time, so that opportunities for misuse are largely eliminated. In a special embodiment, the identifier 44 is an identifier 44 that is newly formed individually each time the elevator control device 16 is accessed by means of a programming device 34, for example in the form of or based on a random number.

If the identifier 44 sent by the elevator control device 16 to the programming device 34 in connection with the access to the elevator control device 16 by means of the programming device 34 is then correctly entered on the elevator control device 16 or one of the control panels 20, 22, specifically within the specified or specifiable input time period is evaluated to the effect that specialist personnel who used the programming device 34 to access the elevator control device 16 are present at the location of the elevator system 10, so that the expanded local access to the elevator control device 16 can be granted.

So that the specialist personnel can recognize the identifier 44 sent to the programming device 34 and then enter it in the elevator control device 16 or one of the control panels 20, 22, different means for outputting the identifier 44 sent by the elevator control device 16 are required on the part of the programming device 34, as well as different means for Registration of the entered identifier 44 possible.

It is shown in the illustration in 2 for example a situation in which the programming device 34 is assigned a display element 46 in the form of a monitor or the like in a manner known per se, provided that the programming device 34 does not already have such a display element 46 as a includes an integral part. By means of the display element 46, the identifier 44 received from the elevator control device 16 can be recognized in a manner for the human user, ie for the specialist personnel operating the programming device 34. The representation of identifier 44 by means of display element 46 is shown in FIG 2 illustrated by the character string "CODE" being shown as an example of an identifier 44 in the area of the display element 46 . The identifier 44 can be made up exclusively of alphanumeric characters, exclusively of numeric characters or combinations of alphanumeric and numeric characters, optionally combinations of alphanumeric and numeric characters and so-called special characters. The readable word "CODE" as identifier 44 is therefore expressly only an example and is above all to easily distinguish the representation of identifier 44 from the representation otherwise in 2 reference numbers used have been chosen. To enter the identifier 44 in the elevator control device 16, in particular on one of the control panels 20, 22, the respective control panel 20, 22 includes a keypad 48, not shown in detail.

The sequence of the method for obtaining local access to the elevator control device 16 by means of a programming device 34 present at the location of the elevator control device 16 is shown in FIG 3 schematically simplified using a flowchart for a part of the elevator control program 28 is shown. After that, when the elevator control program 28 is executed by the processing unit 24 of the elevator control device 16, an attempt to access the elevator control device 16 using a programming device 34 is recognized (first step 50). A branch is then made to a partial functionality of the elevator control program 28 in which, in a second step 52 , the elevator control device 16 sends an identifier 44 to the respective programming device 34 . The branching to this second step 52 does not have to take place immediately after the detection of the attempted access to the elevator control device 16 . Equally, it can also be provided that the elevator control program 28 continues to run first and reacts to the access attempt by branching to this second step 52 only later, namely at a suitable point in time, for example when the elevator system is in a specific configuration. In a third step 54, it is checked whether an entered identifier 44 matches the identifier 44 originally sent. If there is such a match, a fourth step 56 checks whether the input was made within the input time. If both conditions are met, local access to the elevator control device 16 can be enabled (fifth step 58). Thereafter, a branch is made back to the normal sequence of the elevator control program 28 .

At this point it should be pointed out that the representation of the flow chart is only a basic representation of the corresponding partial functionality of the elevator control program 28 . In a specific implementation, for example, the query whether the input within the input time has taken place, are omitted if, after the input time period has elapsed, a branch is automatically made to the normal sequence of the elevator control program 28 .

The representation in 4 is partly a repetition of the depiction 2 , where details of the elevator control device 16 and the programming device 34 are not reproduced again.

The representation in 4 is intended to show that the programming device 34 as an actuator 60 includes means for the optical representation of the identifier 44 and/or means for the acoustic "representation" (output) of the identifier. As an example of an actuator 60 for the visual representation of the identifier 44 was in 2 the display element 46 has already been shown. The display can also be made, for example, on a mobile device carried by the specialist staff, for example a mobile phone device, in that the elevator control device 16 or the programming device 34 sends the identifier 44 to such a mobile device. An example of an actuator 60 for acoustically displaying/outputting the identifier 44 is a loudspeaker that transmits the identifier 44 transmitted by the elevator control device 16 as a tone sequence with tones of different frequencies and/or a signal sequence with tone signals with the same frequency but different durations and/or with tones of different frequencies and/or different durations.

On the control panel 20, 22, for example, the keypad 48 already mentioned and generally referred to below as sensor system 62 functions as a sensor system 62 for detecting the identifier 44. The input of the identifier 44 using such a sensor system 62 has already been described. Alternatively or additionally, a sensor system 62 for optically detecting the identifier, for example a camera, can also be used to detect the identifier 44 . In this way, an image of the identifier 44 received from the elevator control device 16 can be detected on a respective display element 46 by means of the sensor system 62 and is detected when the identifier 44 is entered. Such an automatic detection of a representation of the identifier 44 transmitted by the elevator control device 16 enables the most diverse types of representation of the identifier 44, namely, for example, a representation of the identifier 44 in the form of a barcode, in the form of a 2D code, in the form of a flicker code and so on, i.e including representations that cannot be easily interpreted by specialist personnel. Furthermore, as an alternative or in addition, a sensor system 62 for acoustically detecting the identifier 44, in particular a sensor system 62 in the form of a sound transducer, can also be considered for detecting the identifier 44. Then, when the identifier 44 is detected, an acoustically output identifier 44 can be detected by the respective sensor system 62 and is detected by this sensor system 62 during operation.

Although the invention has been illustrated and described in detail by the exemplary embodiment, the invention is not limited by the example or examples disclosed and others Variations can be derived from this by a person skilled in the art without departing from the scope of protection of the invention.

Individual aspects that stand in the foreground of the description submitted here can be summarized briefly as follows:
A method is specified for operating an elevator control device 16, in the course of which, when the elevator control device 16 is accessed by means of a programming device 34, the elevator control device 16 automatically sends an identifier 44 to the programming device 34, with the elevator control device 16 accepting an input of the previously sent identifier 44 is expected on a control panel 20, 22 included in the elevator control device 16 or assigned to the elevator control device 16 and wherein the elevator control device 16 enables access to the elevator control device 16 if the previously sent identifier 44 was entered correctly within the input time period.

Claims (12)

1. Method for operating an elevator control device (16),

   wherein the elevator control device (16) has an interface (30, 32) for wireless and/or wired access to the elevator control unit (16) by means of a programming device (34),

   wherein for access to the elevator control device (16) by means of the programming device (34) a code (44) is automatically sent to the programming device (34),

   wherein the elevator control device (16) expects, within a specified or specifiable entry time period, an entry of the previously sent code (44) at a control panel (20, 22) comprised by the lift control device (16) or assigned to the elevator control device (16), and

   wherein the elevator control device (16) enables access to the elevator control device (16) if the previously sent code (44) has been entered correctly, in particular entered correctly within the entry time period.
2. Method according to Claim 1, wherein the enabling of the access to the elevator control device (16) terminates automatically after a specified or specifiable access time period.
3. Method according to Claim 1 or 2, wherein the enabling of the access to the elevator control unit (16) is terminated by a corresponding code being entered at a control panel.
4. Method according to any one of the previous claims, wherein the control panel (20, 22) comprises a sensor system (62) for detecting the code (44) sent to the programming device (34), wherein the programming device (34) comprises an actuation system for outputting the received code (44) in a form that can be evaluated automatically and wherein the programming device (34) is placed in the detection range of the sensor system (62) and the sensor system (62) detects the code (44) sent to the programming device (34),
5. Method according to Claim 4, wherein as the actuator system (60) the programming device (34) comprises means for visually displaying the identifier (44), in particular in the form of a barcode, wherein the received code (44) is displayed by means of the actuator system (60) in a visually assimilable manner, wherein as the sensor system (62) the control panel (20, 22) has means for optically detecting the code (44), in particular a camera, and wherein a visual representation of the code (44) is detected by means of the sensor system (62).
6. Method according to Claim 4 or 5, wherein as the actuator system (60) the programming device (34) comprises means for acoustically representing the identifier (44), in particular in the form of a tone sequence, wherein the received code (44) is represented by means of the actuator system (60) in an acoustically assimilable manner, wherein as the sensor system (62) the control panel (20, 22) has means for acoustically detecting the code (44), in particular an acoustic transducer, and wherein an acoustic output of the code (44) is detected by means of the sensor system (62).
7. Computer program (28, 42) with program code means for carrying out all the steps of any one of the Claims 1 to 6, when the computer program (28, 42) is executed on an elevator control device (16) and on a programming device (34) for access to an elevator control device (16).
8. Computer program product with program code means that are stored on a computer-readable data medium in order to carry out the method according to any one of Claims 1 to 6, when the computer program product is executed on an elevator control device (16) and on a programming device (34) for access to an elevator control device (16).
9. Elevator control device (16) with a processing unit (24) and a memory (26), characterized in that a part of the computer program (28) according to Claim 7 is loaded into the memory (26), which is executed by the processing unit (24) in the operation of the elevator control device (16).
10. Elevator control device (16) with at least one control panel (20, 22) comprised by the elevator control device (16) or assigned to the elevator control device (16), wherein the control panel (20, 22) has means (48, 62) for detecting a code, in particular for automatically detecting a code (44) optically and/or acoustically.
11. Programming device (34) for access to an elevator control device (16) with a processing unit (38) and a memory (40), characterized in that a part of the computer program (42) according to Claim 7 is loaded into the memory (40), which is executed by the processing unit (38) in the operation of the programming device (34).
12. Programming device (34) according to Claim 11, having means (46, 60) for optically and/or acoustically outputting a code (44) received in operation.

Images