CN113495510A - Control unit for an elevator system - Google Patents

Abstract

The invention relates to a control unit for an elevator installation having a movable car and a drive unit for driving the car between floors, the control unit comprising at least one interface and being formed to interact with a safety circuit which is formed by a plurality of safety switches connected in series and which can be switched between an open state interrupting the driving state and a closed state allowing said driving state, the safety circuit comprising at least one safety switch, an intermediate tap arranged in the safety circuit for tapping an intermediate voltage, a functional unit having a fuse element which can be controlled by the safety circuit, the control unit having monitoring means and intervention means, the intervention means being connected to the safety circuit, the intervention means being designed and arranged, such that the first separating element is connected in series with the safety switch, the safety switch and the first separating element can be bridged by at least one further separating element.

Description

Control unit for an elevator system

Technical Field

The invention relates to a control unit for an elevator installation according to the preamble of claim 1.

The invention also relates to an elevator installation having a control unit according to the invention.

Background

It is generally known in the prior art to use a safety circuit for monitoring the elevator installation, which safety circuit is laid along the elevator shaft and consists of a plurality of safety switches connected in series. Each safety switch in the safety circuit is in an open and closed state and monitors safety-relevant operating variables of the elevator installation. Thus, for example, when maintenance work is performed by safety personnel, a safety switch arranged in the safety circuit is placed in an open state and thereby interrupts the safety circuit. Since the safety circuit is in operative connection with the safety element, which in turn influences the operating state of the drive unit of the elevator installation, it can be ensured that a travel of the car of the elevator installation is not possible in the event of an interruption of the safety circuit. For this purpose, a safety circuit is usually connected to the control input of the mains contactor (main contactor), so that in the event of an interruption of the safety circuit the mains contactor is triggered and the mains voltage is separated from the drive unit.

Furthermore, it is also known in the prior art to monitor the closed state of the car door and/or of the landing door of the elevator installation by means of safety switches, respectively, in order to always prevent the car from traveling with the car door or landing door open or not completely closed, since this involves a great risk of potential injury to passengers.

It is generally known, however, that safety switches arranged in the safety circuit for monitoring the closing state of the car doors and/or the landing doors can be bridged by means of switch groups, so that the opening of the doors can only be initiated if the car travels into the stopping position (in the landing), without the drive unit having to be deactivated for safety reasons due to the interruption of the safety circuit. This results in a shorter travel time for the passengers, at least subjectively. In addition, the bridging of the safety switches arranged to monitor the closed state of the car doors and/or the landing doors also makes it possible to move the car into the stopping position during the boarding and disembarking of passengers, since a change in the load acting on the car in the stopping position can form a step between the car floor and the landing floor. However, these additional switch sets are very complex to implement, which in turn leads to high costs. Furthermore, in the event of a failure of the switching group, a dangerous situation for the passengers may occur due to the failed component, since the safety circuit is at least partially bridged by the switching group.

Disclosure of Invention

For this reason, the object of the invention is to provide a control unit which is in operative connection with a safety circuit so that, on the one hand, the required functions can be provided and, on the other hand, the disadvantages known from the prior art can be overcome. The object of the invention is therefore, in particular, to provide a control unit which is designed not only to detect the open or closed state of the car door and/or the floor door, but also to additionally influence the safety circuit so that the car can also be driven with the safety switch open. In this case, however, it should be possible to interrupt the safety circuit even if a fault occurs.

In addition, the object of the invention is to provide an elevator installation which comprises such a control unit according to the invention.

The object in respect of the control unit for an elevator is achieved by the features of claim 1 in that the intervention device is designed and provided such that the first separating element, in particular by means of the second interface, is arranged in series with a safety switch for monitoring the closing state of the car door and/or the landing door, wherein the safety switch for monitoring the closing state of the car door and/or the landing door and the first separating element can be bridged by at least one further separating element, preferably two separating elements interconnected in series or anti-series (in particular the second separating element and the third separating element), more preferably four separating elements interconnected in series or anti-series, in particular pairs of separating elements, which are connected to the first interface, in particular on the input side, and to the fourth interface on the output side.

In the case of an elevator installation, this object is achieved by the features of claim 13.

Advantageous embodiments of the invention are specified in the dependent claims.

Combinations of at least two of the features disclosed in the description, the claims and/or the drawings are also within the scope of the invention.

The idea of the invention is that the intervention device is designed in such a way and is operatively connected to the safety circuit via at least one interface, in that the separating element (in particular the first separating element) is arranged in particular on the output side via the interface (in particular via the first interface) and is arranged in series with a safety switch of the safety circuit, which is provided for monitoring the closed state of the car door and/or the landing door. In addition, the intervention device comprises at least one further separating element, which is operatively connected to the safety circuit via a further interface (in particular via the first interface and the fourth interface), wherein a safety switch for monitoring the closed state of the door is provided and the first separating element is bridged by an accessible path comprising the further separating element.

In connection therewith, it is further provided that for redundancy reasons ((n-1) safety) two or four separating elements arranged in series or in anti-series with each other are provided for a further separating element or for a first separating element, so that one separating element is formed. In addition, in a particularly preferred embodiment, two separating elements are each connected directly in series with one another, wherein the two additional separating elements are also arranged in anti-series fashion with respect to the two first separating elements, so that in a safety circuit with an alternating voltage as supply voltage having a positive and a negative half-wave by means of the AC component, the function with respect to the blocking capability of the separating elements is ensured by the paired arrangement. Alternatively, it is also possible to form a switch pair by two separating elements interconnected in anti-series, wherein preferably the two switch pairs are electrically connected to each other in series to form (n-1) security.

This embodiment advantageously makes it possible for safety switches provided in the safety circuit for monitoring the closed state of the car doors and/or landing doors to be temporarily bridged, so that opening of the doors is already initiated, for example, before the car reaches the stop position, without the safety circuit being interrupted by the corresponding safety switch being switched from the closed state to the open state. This advantageously reduces the waiting time for passengers in the car.

In addition, the control unit according to the invention also achieves that a step between the floor and the car floor can be formed in the stopping position of the car, which step is produced as a result of load changes caused by the ingress and egress of passengers, which can be compensated for by controlling the drive unit. Advantageously, therefore, an additional adjusting device is superfluous, which would otherwise require a safety circuit to be bridged and/or a drive unit to be controlled in order to compensate for the step by the travel of the car.

In one embodiment within the scope of the invention, provision is made that in the activated state of the safety element (in particular the main contactor), a defined operating state of the elevator installation, in particular a service bridge of the electrical contacts in the safety circuit and/or a fault-related short circuit and/or a closed state of the car door and/or the landing door, can be detected by means of at least one checking action.

In other words, it is further provided that the control unit enables the checking action to be carried out in the activated state of the safety element (i.e. in particular while the car is travelling). In this case, the fuse element is not allowed to switch into an error state or the safety circuit is not allowed to be influenced and/or interrupted by the test action, so that this is recognized and/or detected by the fuse element, so that no error state is activated. However, it is also possible to check and/or detect a defined operating state of the elevator installation by evaluating the detected intermediate voltage, which is dependent on the operating position of the separating element, by means of at least one checking action, in order to detect maintenance bridges which are not allowed to remain in the safety circuit and/or to detect short circuits (in particular due to faulty components) or to detect the open state of the car door and/or the floor door.

For this purpose, it is provided within the scope of the present embodiment that the separating element is provided and can be controlled in such a way that the safety circuit can be interrupted for less than 5 milliseconds, preferably for less than 2.5 milliseconds, more preferably for less than 1.3 milliseconds, wherein the securing element is not designed and/or provided for detecting such short interruptions.

The safety element is preferably designed as a main contactor, meaning that the supply voltage is connected to the drive unit via the switchable power contact of the main contactor, wherein the control input of the main contactor is in operative connection with the safety circuit. Since the control input of the main contactor includes a time delay section

This results in the main contactor remaining in the closed state during the execution of the checking action. On the one hand, the invention advantageously utilizes the relatively short control times of the contactor (low switching dynamics) and the existing line inductance and/or capacitance effects in the safety circuit, which prevent dynamic control of the contactor. Furthermore, a specially provided delay section, in particular a capacitor, can also be arranged at the control input.

In addition, in the closed state of the main contactor, by checking and/or evaluating the safety circuit, an adverse switching noise of the main contactor can be avoided, which can be particularly advantageously used for control purposes in elevator installations in offices and/or living areas.

Alternatively, the securing element can also be designed as an integrated component and/or functional unit of the drive unit, wherein the drive unit comprises a converter with a control and monitoring input for receiving and/or electrically contacting the safety circuit. The control input advantageously enables monitoring of the safety loop, wherein, under definable voltage level conditions, the supply voltage drops to 0V as a result of the open safety loop, an error state can be triggered. In this case, it can also be provided that a delay section, in particular a capacitor, is additionally arranged on the control and monitoring input in order to implement the adjustment of the detection speed of the functional unit directly in hardware. In this case, the aging process in the capacitor advantageously leads to a reduction in the delay time, so that the protection plan is delayed without safety-related problems.

Within the scope of the present invention, "checking action" is understood to mean that a specific working position is produced and/or generated by the intervention device by means of at least one separating element, and that at least one intermediate voltage is detected in the safety circuit at least one intermediate voltage tap by the monitoring device.

The expression "in an activated state" of the safety element is to be understood as meaning an operating state of the elevator installation in which the elevator installation is in an operating state ready for travel, i.e. the car can travel between two floors according to a passenger command.

The maintenance bridge can be a fixedly installed circuit which can be activated by a maintenance person during maintenance work, so that a bypass circuit is activated to bridge the safety switches (individual safety switches and/or groups of safety switches) of the safety circuit, wherein the disconnection portion of the safety circuit is preferably disconnected from the safety circuit on the input side by opening the contact elements. Alternatively, the service bridge can also be formed by a conductor, in particular a wire, which is operatively connected to the safety circuit for bridging the safety switch.

The monitoring of the safety circuit in the activated state of the safety element enables an improvement of the control unit, since the safety circuit can now be evaluated not only in the standstill and/or stationary phase of the elevator installation but also at any point in time (i.e. in particular during normal driving operation of the elevator installation). This significantly increases the number of tests (tests consisting of at least one test action), so that impermissible situations and/or fault shorts can be detected earlier.

In a preferred embodiment, the separating elements are designed and controllable by means of a corresponding drive circuit to operate at a switching frequency of between 0.5kHz and 30kHz, preferably between 0.5kHz and 16kHz, more preferably between 0.5kHz and 9kHz, more particularly preferably between 0.5kHz and 2 kHz. Preferably, this enables the use of standardized separating elements and corresponding drive circuits, which leads to low costs. Furthermore, a correspondingly designed separating element allows the safety circuit to be interrupted and/or broken in a short period of time, so that this short period of time is not detected by the fuse element and at least one checking action can still be carried out.

In this case, it is further provided that the separating element provided and/or arranged in the separating device is designed as a switchable semiconductor component. In this case, advantageous designs of the semiconductor components are particularly preferably MOSFETs, IGBTs and/or thyristors, since these switching technologies can be operated with high switching frequencies and low losses. This enables a low-cost separating element, which is relevant for circuit designs verified and/or already verified on standardized components.

In connection with this, it is particularly advantageous that a high switching speed can be achieved by modern semiconductor components, so that despite a (very brief) interruption of the safety circuit during the execution of the checking action, the safety element (in particular the power supply contactor or the main contactor) does not switch into the error state during the wiring and/or cabling due to the inertia associated with the component and/or the existing line inductance. This not only enables the corresponding checking action to be carried out in the activated state of the safety element, but thus an increase in the number of corresponding checking and/or test measurements (a sequence of different checking actions) to be carried out in the normal driving operation of the elevator installation, since the elevator is no longer required to be in a stationary phase during the execution of the checking and/or test measurements (i.e. no passenger is transported at this moment).

A further development provides that the intervention device for interrupting the safety circuit designed as a dc voltage circuit and for bridging a safety switch or a group of safety switches comprises at least two or preferably three switchable separating elements or semiconductor components, which are preferably designed as bipolar transistors, MOSFETs, IGBTs and/or thyristors, wherein for switching off the thyristors, a quenching circuit known from the prior art is preferably used.

Alternatively, combinations of the semiconductor components mentioned are also conceivable. In this case, for reasons of redundancy, it can furthermore be provided that, in order to ensure the function of the safety circuit (i.e. to ensure the interruption of the safety circuit), at least three or preferably five switchable semiconductor components, in particular MOSFETs, IGBTs and/or thyristors, are used, so that the safety switches which are fixedly assigned to the safety circuit and are designed for interrupting the safety circuit are doubled.

The monitoring and bridging of the safety switch according to the invention for monitoring the closed state of the car door and/or the landing door means that at least two separating elements are required in order to interrupt the safety circuit by opening a first separating element, wherein the safety switch for monitoring the closed state of the car door and/or the landing door and the first separating element can be bridged by a second separating element. Furthermore, the second separating element may also be formed by two separating elements interconnected in series for redundancy reasons.

Advantageously, this enables (n-1) safety, so that, in particular in the event of a malfunction of a separating element, and in the operating position of the respective separating element, which may be permanently closed, an interruption of the safety circuit can still be achieved. However, it is also conceivable for the intervention device to comprise a total of ten semiconductor components in order to use the control unit according to the invention for a dc voltage-based and an ac voltage-based safety circuit. The design of the intervention device according to the invention means that the first separation element is formed by two separation elements (in particular MOSFETs) interconnected in anti-series and the second separation element is formed by a total of four separation elements, wherein each two separation elements are interconnected in series and interconnected in anti-series.

Furthermore, an embodiment of the invention is also preferred in which the control unit is designed to interact with a safety circuit having an alternating current power supply as the supply voltage. The intervention device advantageously comprises at least three, preferably five, switchable separating elements or semiconductor components, wherein the separating elements or semiconductor components which are designed to interrupt the safety circuit are arranged in a double, in particular anti-serial interconnection, in order to completely block the positive and negative half waves of the supply voltage or to avoid the generation of an undesired current path via the anti-parallel body diodes of the MOSFETs. In connection with this, it is advantageous to use the self-extinguishing characteristic of the thyristor in combination with a supply voltage designed as an alternating voltage.

The design according to the invention of the intervention device for the interruption and/or partial bridging of the safety circuit means that a total of 3 separating elements or semiconductor elements are required.

In addition, it is provided in this connection that, for reasons of redundancy, i.e. to increase the safety or to ensure (n-1) safety, additional separating elements or semiconductor components are provided, so that in particular the separating elements or semiconductor components designed for interrupting the safety circuit are doubled, i.e. arranged in series with one another. In this case, corresponding to the implementation of the dc voltage circuit, a safe interruption of the safety circuit can still be achieved if the semiconductor element fails and is permanently switched off. In other words, the control unit or the intervention device comprises a total of ten semiconductor components, wherein the control unit should comprise a total of not more than 20 separating elements or semiconductor components, preferably less than 16 separating elements or semiconductor components, more preferably less than 11 separating elements or semiconductor components.

In addition, according to a further preferred embodiment of the invention, five intermediate voltages are detected and evaluated by the monitoring device, wherein a total of four intermediate voltages, preferably three intermediate voltages, are evaluated in order to detect the closed state of the car door and/or the landing door.

For this purpose, the intermediate voltage is connected to the intermediate taps of the safety circuit, so that the measured value of the supply voltage is detected as a function of the position of the respective tap. The measured value can output a voltage or no voltage. Advantageously, this enables the position of the open safety switch in the safety circuit to be located and/or the operating state of the elevator installation to be substantially checked or detected. It is thereby possible to detect a maintenance bridge of electrical contact in the safety circuit and/or to identify a fault-related short circuit in the safety circuit (in particular due to a faulty safety switch or a faulty separating element) and/or to identify the open state of the car door and/or the floor door.

Further, by detecting the opening state of the car door and/or the floor door, the control unit can also detect a loss of the drive capability of the elevator installation, wherein an emergency system (e.g. a machinery brake) can be activated to prevent further damage. In a corresponding embodiment of the control unit according to the invention, the adjusting device is therefore also redundant in this respect.

In addition, a further embodiment of the invention provides that the control unit is designed and configured such that the safety circuit is in operative connection with the monitoring device and/or the intervention device via a total of six interfaces. In this case, the bypass is switched via the interface to the safety switch of the safety circuit by the control unit or by the intervention device, so that it bridges. Alternatively, the safety circuit can be designed in sections via the interface pair, so that the safety circuit is completely interrupted by a separating element arranged in this section. Furthermore, it is also conceivable that the interface is used only for forming a tap for voltage measurement. The design of the intervention device according to the invention means that a total of four interfaces are required to effectively connect the control unit to the safety circuit in order to implement the function according to the invention.

In addition, within the scope of a further preferred embodiment of the unit, the control unit is designed and arranged such that the first intermediate voltage SR1_ out can be measured in order to detect the potential at a first intermediate tap which is arranged in the safety circuit at the positive contact pin or the positive connection terminal of the safety circuit, in particular the voltage at the control input of the main contactor.

Furthermore, provision may additionally or alternatively be made for a second intermediate voltage ACD1 to be detectable in order to detect the voltage at a second intermediate tap, which is arranged at the negative contact pin/connection terminal of the at least one safety switch for monitoring the closed state of the car door, and/or for a third intermediate voltage SCD1 to be detectable in order to detect the voltage at a third intermediate tap, which is arranged between the at least one safety switch for monitoring the closed state of the at least one floor door and the at least one safety switch for monitoring the closed state of the at least one car door.

Within the scope of the inventive design of the intervention device, the function of the separating element provided in the safety circuit for bridging the safety switch for monitoring the closed state of the car door and/or the landing door can be checked by detecting and evaluating the intermediate voltage SR1_ out. For this purpose, in the (partially) bridged operating state (i.e. when the car is always driven to the stop position and the doors are already to be opened), the separating element is briefly opened and it is checked whether SR1_ out has no output voltage. If this is not the case, a faulty separating element (which causes a short circuit) can be identified, or it can be identified that the car door and/or the landing door are not open, so that all safety switches provided for monitoring the closed state of the car door and/or the landing door are closed or faulty (short circuit).

Therefore, if the voltage can be measured with SR1_ out, the first separation element in series with the safety switch for monitoring the closed state of the car door and/or the floor door will briefly open to measure the intermediate voltage ACD 1. If a voltage can be detected in this case, the corresponding safety switch is closed or fails. If no voltage is measured, a faulty separating element can be detected, which is arranged in a parallel (i.e. bridged) path.

In addition, provision is made for a fourth intermediate voltage OC _ out to be detected at a fourth intermediate tap, the fourth intermediate tap being arranged in the safety circuit on the output side relative to the upper interface pair, in particular directly at the fifth interface.

Finally, the monitoring device can be designed to detect a fifth intermediate voltage OC _ in at a fifth intermediate tap of the safety circuit, wherein the fifth intermediate tap is arranged on the input side relative to the pair of upper interfaces, in particular at the sixth interface.

In addition or alternatively, a fourth intermediate tap can also be arranged at the positive contact pin/positive connection terminal of the safety switch which is initially arranged in the safety circuit, wherein the fifth intermediate tap is separated from the safety circuit, together with a safety switch or safety switch group, by the coupled switches, in particular by contacting a preferably fixedly mounted service bridge.

The term "positive contact pin/positive connection terminal/positive contact pin" is understood to mean a connection terminal of a safety switch or fuse element, which is arranged closer to the supply voltage. The negative contact pin/negative connection terminal/negative contact pin of the safety switch therefore refers to the connection terminal of the fuse element, which is remote from the supply voltage (i.e. at a negative potential) in the safety circuit and is therefore arranged closer to the fuse element or the main contactor.

Advantageously, the detection and evaluation of the intermediate voltage defined above enables the detection of the state of the intermediate circuit and the detection of the safety-loop-related operating state of the elevator installation, wherein during the active state of the safety element, a contacting service bridge and/or a fault-related short circuit in the safety loop can advantageously be detected.

It is additionally provided that the intervening device is designed and arranged such that the first intermediate tap can be connected to the second intermediate tap by means of the first separating element. It is furthermore provided that the first intermediate tap is connected to the fourth intermediate tap by a second separating element, preferably by two separating elements interconnected in series or anti-series, more preferably by four separating elements interconnected in series or anti-series, in particular in pairs. It is furthermore preferably provided that the fourth intermediate tap and the fifth intermediate tap are connected to each other by three separating elements (preferably via two separating elements interconnected in series or anti-series, more preferably four separating elements interconnected in series or anti-series, in particular pairs of separating elements). By switching the separating element on or off and thus switching the parallel path on and/or interrupting the safety circuit at different locations, the safety circuit can be influenced in an advantageous manner, i.e. by detecting the state of the safety circuit for analysis. This can be achieved by means of the intermediate voltage, so that the state of the safety circuit can be evaluated by detecting the intermediate voltage, wherein advantageously safety switches bridged by the service bridge and/or short circuits associated with faults can be detected.

Furthermore, a preferred design of the control unit according to the invention comprises monitoring means and intervention means which are designed and arranged to carry out a test of a plurality of checking actions or a fixed sequence of checking actions every 60 seconds, preferably every 30 seconds, more preferably every 10 seconds, in order to monitor the operating state of the elevator installation, in particular in order to detect electrically contacted service bridges and/or fault-related short circuits in the safety circuit. In this case, within the scope of the invention, the number of measurements for checking the functionality of the separating element is advantageously reduced, since the relay can only check the functionality once every 24 hours, for example due to aging and/or wear effects during the use of the mechanical switch. This has the advantage that faults can be identified earlier.

Further, the monitoring device and the intervention device are designed such that, for monitoring the operating state of the elevator installation, in particular for detecting an electrically contacted service bridge and/or a fault-related short circuit in the safety circuit, the respective sequence of predefined checking actions lasts for a maximum of 1 second, preferably 500 milliseconds, more preferably 250 milliseconds, more particularly preferably 100 milliseconds. In connection with this, it is provided within the scope of the invention that the respective sequences of predefined checking actions are combined in such a way that the interruption time of the safety circuit is not longer than the above-defined value. Advantageously, in connection with the safety loop with the alternating voltage, a quadrature zero and/or a zero crossing of the supply voltage is used to generate the standstill, wherein in particular the first checking action is initiated in response to a detection of the quadrature zero and/or the zero crossing.

In one development of the control unit according to the invention, a counter unit is also included, whose output value, counter value and/or sensor output signal can be activated in response to the result of a checking action (for example a fault voltage at the intermediate tap). In addition, in one embodiment, the control unit further comprises a communication device which is designed and/or arranged to transmit a sensor output signal, wherein the sensor output signal can be influenced directly or indirectly by the counter unit or can be derived therefrom. The effect achieved by this development is based on the realization of a temporary (i.e. permitted only for a specific period of time) travel operation, in particular at a limited travel speed of the car, in order to travel to a specific intermediate position.

Within the scope of the invention, the use of the control unit according to the invention for operating an elevator installation and for monitoring the operating state of an elevator installation, in particular for detecting maintenance bridges and/or fault-related short circuits of impermissible contacts in the safety circuit of an elevator installation and/or the closed state of the car doors and/or floor doors, is also claimed.

The invention also relates to a system comprising an elevator installation and a control unit according to the invention.

Drawings

Further advantages, features and details of the invention can be taken from the description of preferred embodiments and with the aid of the drawings. Wherein the content of the first and second substances,

fig. 1 is a schematic view of a preferred embodiment of a control unit according to the invention for an elevator installation,

fig. 2 is a schematic view of an operating state, which is executed by the control unit 1 according to the invention during a test comprising several checking actions,

FIG. 3 is a schematic diagram of an operating state implemented during another test comprising several checking actions, and

fig. 4 is a further illustration of a further test which is carried out during operation of the elevator installation with the car door and the floor door closed.

Detailed Description

Fig. 1 shows a schematic structure of a preferred embodiment of a control unit 1 according to the invention. The control unit 1 shown is designed to interact with a safety circuit 3 formed by a plurality of safety switches 4 connected in series. The safety switch 4 switches between an open state, in which the travel operation is prohibited, and a closed state, in which the travel operation is permitted, depending on safety-relevant operating conditions of the elevator installation.

The safety circuit 3 is supplied on the input side with a supply voltage 10, which supply voltage 10 can be designed as an alternating voltage or as a direct voltage, wherein in the embodiment shown in fig. 1 the supply voltage is a direct voltage.

The safety circuit 3 is operatively connected on the output side to a fuse element 7, which fuse element 7 is designed in the present exemplary embodiment as a main contactor 8, the control input of which is connected to the safety circuit 3. As soon as the safety circuit 3 is interrupted and there is no voltage on the control input of the main contactor 8, the main contactor 8 opens and disconnects the drive unit 2 connected via the power supply contact of the main contactor 8 from its power supply. This ensures that the car does not run when the safety circuit 3 is disconnected, since the drive unit 2 cannot be driven without energy supply or without supply voltage.

In addition, a service bridge 5 can be integrated in the safety circuit 3, in particular for carrying out service work and/or repair work, in order to bridge individual safety switches 4 or groups of safety switches 4 by switching in parallel paths.

In fig. 1, the respective service bridge 5 is realized by a fixedly mounted circuit which, by actuating the switch 17, opens a bypass to the safety circuit 3 which bridges all safety switches (not shown) of the first group of safety switches 18.

The safety switches (not shown) of the first set of safety switches 18 monitor the not shown safety gear in order to mechanically fix the car in the elevator shaft in the event of a failure. The interruption by the safety circuit 3 ensures that the drive unit 2 is separated from the power supply. To reset the safety brake device, the open safety switch must first be bridged by switching on the service bridge 5, which is realized by a fixedly mounted circuit. Since in this operating state all safety switches of the first group of safety switches 18 are bridged, this results in a safety-relevant critical operating state of the elevator installation. In order to keep the drive still interrupted, all separating elements in the safety circuit 3 are open, so that the securing element 7 can still advantageously be in the error state in order to switch off the drive unit 2.

In addition to the first set of safety switches 18, the safety circuit 3 also comprises further safety switches 41, 42 which monitor the closed state of at least one car door and the closed state of at least one floor door. For the sake of clarity, fig. 1 shows only one safety switch for the functions relating to all floor doors and all car doors of the elevator installation. However, it can be seen from the illustration that the safety circuit 3 is interrupted by the opening of a door (car door or floor door) in order to prevent the car from traveling with the door open.

Furthermore, the illustrated control unit 1 comprises a monitoring device 9 and an intervention device 11, wherein the monitoring device 9 is used to measure and evaluate intermediate voltages tapped at different intermediate taps 6 of the safety circuit 3, and the intervention device 11 is operatively connected to the safety circuit 3 such that the safety circuit 3 is interrupted by means of at least one separating element 12 and/or individual safety switches 4 or groups of safety switches 4 can be bridged by closing the separating element 12. For this purpose, the separating element 12 is designed to be able to be switched between a closed switching position and an open switching position.

The control of the separation element 12 and the evaluation of the intermediate voltage are carried out by two microcontrollers, which are not shown in fig. 1. The corresponding measuring and control signal flows are schematically shown in fig. 1 by means of the separating element 12 and small arrows on the intermediate taps 6.

Advantageously, the monitoring means 9 and the intervention means 11 are arranged and designed to perform an inspection action. In the context of the present invention, an inspection action is understood to mean the detection of at least one intermediate voltage as a function of the operating position of at least one separating element 12, wherein a series of a plurality of inspection actions can also be carried out to determine the operating state of the elevator installation.

The detection and evaluation of the intermediate voltage (checking action) in dependence on the different operating positions of the separating element 12 advantageously enables the detection of the service bridge 5 of the electrical contacts in the safety circuit 3 and/or fault-related short circuits. This allows the elevator installation to be checked for a defined operating state.

According to the invention, the monitoring device 9 and the intervention device 11 are designed such that in the activated state of the safety element 7 (i.e. when the main contactor 8 is in the closed operating position), at least one checking action can be carried out in order to monitor a defined operating state of the elevator installation and in particular to detect an electrically contacted service bridge 5 and/or a fault-related short circuit in the safety circuit 3.

The control unit 1 is furthermore shown in operative connection with the safety circuit 3 of the elevator installation via six interfaces 51, 52, 53, 54, 55, 56. The upper port pair 19 formed by the fifth port 55 and the sixth port 56 forms the safety circuit 3 in part, wherein a separating element 12 designed to interrupt the safety circuit 3 is arranged in the part of the safety circuit 3 formed by the control unit 1.

The control unit 1 shown in fig. 1 comprises a total of five separating elements 12, which separating elements 12 are designed as switchable semiconductor components 13 in a preferred embodiment of a field effect transistor (MOSFET) 14. Since the control unit 1 shown is designed to interact with the safety loop 3 supplied by a direct voltage, it does not comprise any anti-series interconnected MOSFETs 14. However, for redundancy reasons, two MOSFETs 14 are arranged in series with one another, so that the safety circuit 3 can also be interrupted in the event of a failure of one MOSFET 14.

The control unit furthermore comprises a lower interface pair 20, which lower interface pair 20 is formed by the first interface 51 and the fourth interface 54 and is in operative connection with the safety circuit 3 in such a way that the safety switches 41, 42 can be bridged by the separating element in the closed operating position, wherein the safety switches 41, 42 are provided for monitoring the closed state of the car and floor doors.

In addition, in order to perform at least one checking action, the monitoring device 9 is designed so as to be able to detect a total of five intermediate voltages.

This first achieves that a first intermediate voltage SR1_ out is detected at the first intermediate tap 21, which first intermediate voltage SR1_ out is the voltage at the positive contact pin of the fuse element 7. In the present case, the control voltage of the main contactor 8 is detected on the input side, whereby the operating state of the elevator installation can always be determined.

Furthermore, a second intermediate voltage ACD1 is detected at the second intermediate tap 22, wherein the second intermediate tap 22 is arranged on the negative contact pin of at least one safety switch 42, which safety switch 42 monitors the closed state of the car door.

The third intermediate voltage SCD1 is detected at a third intermediate tap 23, which third intermediate tap 23 is arranged between at least one safety switch 41 for monitoring the closed state of the floor doors and at least one safety switch 42 for monitoring the closed state of the car doors.

A fourth intermediate tap 24 for contacting the fourth intermediate voltage OC _ out is also provided, wherein the fourth intermediate tap 24 is arranged on the output side with respect to the pair of upper interfaces 19, i.e. directly at the fifth interface 55.

A fifth intermediate voltage OC _ in is measured at a fifth intermediate tap 25 of the safety circuit 3, wherein the fifth intermediate tap 25 is arranged on the input side with respect to the upper interface pair 19, i.e. at the sixth interface 56.

Furthermore, it can also be seen from the circuit of the control unit 1 shown that the first intermediate tap 21 can be connected to the second intermediate tap 22 via a first separating element 31, which is designed as a MOSFET 14.

Furthermore, it can also be seen that the first connection 51 is connected to the fourth connection 54 via the second separating element 32 and the third separating element 33, wherein the second separating element 32 and the third separating element 33 are connected to one another in series.

In addition, the fourth intermediate tap 24, which is at the potential of the fifth interface 55, may be connected with the fifth intermediate tap 25 (sixth interface 56) via the fourth dividing element 34 and the fifth dividing element 35, wherein the fourth dividing element 34 and the fifth dividing element 35 are connected in series with each other.

Furthermore, the shown control unit 1 comprises a purely schematically shown counter unit 15, which can be controlled in response to the result of the checking action. The control unit 1 also has a communication device 16 in order to transmit control variables to a communication partner, not shown, as a function of the sensor output signals of the counter unit 15 and/or the detected intermediate voltage, in order to achieve, for example, a travel operation of the elevator installation at a reduced travel speed and/or a changed stopping position (end position) of the car in the elevator installation within a limited time.

In the operation of the elevator installation, the control unit 1 according to the invention performs a series of checking actions every 10 seconds in order to monitor the operating state of the elevator installation. Advantageously, for the timing of the checking action, the quadrature zero is detected and used to start the checking action.

The separating element 12, which is realized as a MOSFET14, advantageously enables the safety circuit 3 to be interrupted for a short period of time due to the high switching speed without causing the main contactor 8 to be triggered.

To illustrate the checking actions carried out by the control unit 1 according to the invention, fig. 2 shows a schematic representation of the monitoring device 9 and the intervention device 11, wherein the operating positions of the fourth separating element 34 and the fifth separating element 35 represent four checking actions.

In the first checking action shown in the area a, the fourth separating element 34 and the fifth separating element 35 are first closed by the intervening device 9 and then the intermediate voltage OC _ in at the fourth intermediate tap 24 and the intermediate voltage OC _ out at the fifth intermediate tap 25 are detected. The measurement results are then compared with empirical values, wherein the intermediate voltage OC _ in and the intermediate voltage OC _ out must have a positive measurement value in relation to the supply voltage 10 for a defined operating state of the safety circuit 3 and/or a defined operating state of the elevator installation.

In a second checking action, shown in region B, the fifth separation element 35 is opened and the two intermediate voltages are again detected and evaluated. The measurement results are now examined to determine whether no voltage is measured at the intermediate voltage OC _ out, wherein OC _ in still has to have a voltage value. If this is not the case, an error is generated.

In a third checking action shown in region C, the fourth separating element 34 and the fifth separating element 35 are opened, wherein only the intermediate voltage OC _ in has a voltage value during the subsequent voltage measurement.

Finally, in a fourth checking action, shown in the region D, only the fourth separating element 34 is opened and the two intermediate voltages OC _ in and OC _ out are again detected and it is evaluated whether a voltage value is detected only at the above-mentioned intermediate voltage OC _ in.

If the detected intermediate voltage does not correspond to the empirical value, a short circuit of the fourth separation element 34 or the fifth separation element 35 may be detected. Alternatively, the connection of the service bridge 5 shown in fig. 2 can also be recognized, or if no voltage value is measured at all, a missing supply voltage or a defect in the measuring device can be detected. Furthermore, other maintenance devices ("inspection controls") not shown in detail in fig. 1 may also be the reason why the voltage cannot be measured.

The above exemplary sequence of four checking actions illustrates the design of the control unit 1 according to the invention. Due to the disconnection of the fourth separating element 34 or the fifth separating element 35, the safety circuit 3 is interrupted, so that it is important to achieve the respective operating position in a very short time. It can thus be ensured that the fuse element 7 (not shown in fig. 2) is still in the active state despite the interruption of the safety circuit 3. For this purpose, it is expedient to insert artificial pauses between the individual checking actions, which can prevent, in particular, dynamic influences and/or the formation of fluctuations in the safety circuit. It is essential in this case that an operating position of the separating element 12 is achieved during the pause, in which operating position the safety circuit 3 is not interrupted.

Fig. 3 shows another test comprising several checking actions, which test is performed within the scope of the control unit 1 according to the invention. According to the representation already present in fig. 2, a corresponding circuit diagram is shown in the regions a to D of each test action, which circuit diagram shows the open or closed state of the safety switches 41, 42 in the safety circuit 3 and the realized operating position of the respectively embedded separating elements 31, 32, 33 during the test.

The illustrated checking action is always performed when bridging the safety switches 41, 42, wherein the safety switches 41, 42 monitor the closed state of at least one car door and the closed state of at least one floor door. Thus, there is always a corresponding working position when the car approaches a floor and before the car reaches the stopping position, so that opening of the car door and/or the floor door before reaching the stopping position can be avoided. In addition, pauses are inserted between the individual checking actions in order to avoid a failure state of the safety circuit 3 which could trigger the fuse element 7 or the main contactor 8. During the pause, the current checking action is understood to be the working position of the separating elements 32, 33 shown in the region a, since this does not lead to an interruption of the safety circuit 3.

In the operating state shown in the region a (which corresponds to the operating position in the state in which the safety switches 41, 42 are bridged), the safety switches 41, 42 of the safety circuit 3 are bridged by the second separating element 32 and the third separating element 33. The intermediate voltage SR1_ out is then detected and evaluated for the presence of a voltage.

During the second checking action shown in region B, the third separating element 33 and the first separating element 31 are opened within a short time in order to subsequently evaluate the intermediate voltage SR1_ out again to determine whether there is currently no voltage at the respective first intermediate tap 21.

In a third checking action shown in the region C, all separating elements 31, 32, 33 are now switched into an open operating state, in order to check again whether the voltage at the first intermediate tap 21 (intermediate voltage SR1_ out) is actually not detected.

Finally, a final checking action is carried out, in which the third separating element 33 is closed again and the intermediate voltage SR1_ out is checked again for the presence of a voltage.

In addition, within the scope of this or another checking action, additionally or alternatively the second intermediate voltage ACD1 on the second intermediate tap 22 and/or the third intermediate voltage SCD1 on the third intermediate tap 23 are detected and evaluated. It is advantageously achieved that: the state of opening or closing of the floor door and/or of the car door can be detected as a function of the operating position of the first partition element 31.

Another test is shown in fig. 4, which is characterized by two inspection actions. When the two safety switches 41, 42 are not bridged by the parallel-arranged separating elements 32, 33, a corresponding checking action is always carried out.

During this test, first the first separating element 31 is closed and checked whether there is a voltage at the first intermediate tap connection 21 in the safety circuit 3 (intermediate voltage SR1_ out) (compare area a).

The first divider 31 then opens for a short time and the intermediate circuit voltage SR1_ out is again detected and further evaluated to determine if there is now no voltage. If this is not the case, a fault in the circuit can be identified and the safety circuit 3 interrupted by opening all the separating elements 12.

The invention thus achieves in a surprisingly simple manner an optimization and an extension of the control units known from the prior art, so that the closed state of the car door and/or landing door and thus the safety circuit are monitored, in particular in a cost-effective manner, so that the elevator installation can be operated even with an open car door and/or landing door.

List of reference numerals

1 control unit

2 drive unit

3 safety circuit

4 safety switch

5 maintenance bridge

6 intermediate tap

7 safety element

8 main contactor

9 monitoring device

10 supply voltage

11 intervention device

12 separating element

13 switchable semiconductor component

14 MOSFET

15 counter unit

16 communication device

17 switch/push button

18 first set of safety switches

19 upper interface pair

20 lower interface pair

21 first intermediate tap

22 second intermediate tap

23 third intermediate tap

24 fourth intermediate tap

25 fifth intermediate tap

31 first separating element

32 second separating element

33 third separation element

34 fourth partition element

35 fifth partition element

41 safety switch for a floor door

42 safety switch for car door

51 first interface

52 second interface

53 third interface

54 fourth interface

55 fifth interface

56 sixth interface

Claims (13)

1. A control unit (1) for an elevator installation having a car movable along an elevator hoistway between floors and a drive unit (2) for driving the car between the floors,

wherein the control unit (1) comprises at least one interface (51, 52, 53, 54, 55, 56), via which the control unit (1) forms an interaction with a safety circuit (3), which safety circuit (3) is laid in particular in a manner passing through the elevator hoistway, which safety circuit (3) is formed by a plurality of safety switches (4) connected in series, which safety switches (4) can be switched between an open state interrupting a driving state and a closed state allowing the driving state depending on safety-relevant operating conditions of the elevator installation, wherein the safety circuit (3) comprises at least one safety switch (41, 42) for monitoring the closed state of a car door and/or a floor door, an intermediate tap (6, b) arranged in the safety circuit (3), 21. 22, 23, 24, 25) for tapping the intermediate voltage,

a functional unit having a safety element (7), in particular a main contactor (8), or a drive unit, the safety element (7) being controllable by the safety circuit (3) in such a way that an error state of the safety element (7) is activated by the interrupted safety circuit (3) in order to switch off the drive unit (2), in particular to separate a supply voltage from the drive unit (2), and an activation state of the safety element (7) is activated by the switched-off safety circuit (3) in order to drive the drive unit (2) into the driving mode, in particular to connect the drive unit (2) to the supply voltage,

wherein the control unit (1) has a monitoring device (9) for measuring and evaluating the intermediate voltage and an intervention device (11), wherein the intervention device (11) is operatively connected to the safety circuit (3) such that: the safety circuit (3) is interruptible and/or at least one safety switch (4) is jumpable by means of at least one separating element (12, 31, 32, 33, 34, 35) which can be switched between a closed operating position and an open operating position, wherein the monitoring device (9) and the intervention device (11) are provided and designed to carry out a checking action in order to detect at least one intermediate voltage as a function of the operating position of the at least one separating element (12, 31, 32, 33, 34, 35), characterized in that,

the intervention device (11) is designed and arranged such that a first separating element (31) is arranged in series, in particular by means of a second interface (52), with the safety switch (41, 42) for monitoring the closing state of the car door and/or landing door, wherein the safety switch (41, 42) for monitoring the closing state of the car door and/or landing door and the first separating element (31) can be bridged by at least one further separating element (12), wherein the at least one further separating element (12) is connected, in particular on the input side, to the first interface (51) and on the output side, to the fourth interface (54).

2. The control unit according to claim 1, characterized in that the separating element (12, 31, 32, 33, 34, 35), in particular the first separating element (31) and/or the further separating element (32, 33), is designed such that the safety circuit (3) can be interrupted for less than 5 milliseconds, preferably less than 2.5 milliseconds, more preferably less than 1.3 milliseconds, in order to detect a defined operating state, in particular a fault-related short circuit, of the elevator installation by means of at least one checking action in the active state of the safety element (7), in particular in the active state of the main contactor (8) or in the active state of a functional unit of the drive unit (2).

3. The control unit according to any one of claims 1 to 2, characterized in that the separating element (12, 31, 32, 33, 34, 35) is designed to be operable at a switching frequency of between 0.5kHz and 30kHz, preferably between 0.5kHz and 16kHz, more preferably between 0.5kHz and 9kHz, more particularly preferably between 0.5kHz and 2 kHz.

4. The control unit according to any one of claims 1 to 3, characterized in that the separation elements (12, 31, 32, 33, 34, 35) are designed as switchable semiconductor construction elements (13), in particular formed as bipolar transistors MOSFETs (14), IGBTs and/or thyristors.

5. The control unit according to any one of claims 1 to 4, characterized in that the intervention device (11) comprises at least two separation elements (12, 31, 32, 33, 34, 35), preferably switchable semiconductor construction elements (13), more preferably MOSFETs (14), IGBTs and/or thyristors, in order to interrupt a safety circuit (3) designed as a DC circuit and to bridge the safety switches (41, 42).

6. The control unit according to any one of claims 1 to 4, characterized in that the intervention device (11) comprises at least three separation elements (12, 31, 32, 33, 34, 35), preferably switchable semiconductor structure elements (13), more preferably MOSFETs (14), IGBTs and/or thyristors, in order to interrupt a safety circuit (3) designed as an alternating current circuit and to bridge the safety switches (41, 42).

7. The control unit according to any one of claims 1 to 6, characterized in that the monitoring device (9) is designed to detect and/or evaluate at least five intermediate voltages.

8. The control unit according to any one of claims 1 to 7, characterized in that, for interacting with the safety circuit (3), the control unit (1) has at least six interfaces (51, 52, 53, 54, 55, 56), wherein at least one separating element (12), preferably two separating elements, in particular a fourth separating element (34) and a fifth separating element (35), more preferably four separating elements (12) in pairs interconnected in series or in anti-series, can be switched on and/or integrated into the safety circuit (3) by means of an upper interface pair (19) of the fifth and sixth interfaces (55, 56) in such a way that the safety circuit (3) is interrupted in an open operating position.

9. Control unit according to any of claims 1 to 8, characterized in that the monitoring device (9) is designed and arranged to: -being able to measure a first intermediate voltage SR1_ out for contacting a first intermediate tap (21), said first intermediate tap (21) being arranged at a positive contact pin of the fuse element (7), in particular at a control input of the main contactor (8); and/or

A second intermediate voltage ACD1 for contacting a second intermediate tap (22) can be measured, the second intermediate tap (22) being arranged at a negative contact pin of at least one safety switch (42) for monitoring the car door; and/or

-being able to measure a third intermediate voltage SCD1 for contacting a third intermediate tap (23), said third intermediate tap (23) being arranged between at least one safety switch (41) for monitoring at least one floor door and at least one safety switch (42) for monitoring at least one car door; and/or

A fourth intermediate voltage OC _ out for contacting a fourth intermediate tap (24) can be measured, the fourth intermediate tap (24) being arranged on the output side with respect to the upper interface pair (19), in particular at the fifth interface (55); and/or

A fifth intermediate voltage OC _ in for contacting a fifth intermediate tap (25) can be measured, which fifth intermediate tap (25) is arranged on the input side with respect to the upper interface pair (19), in particular at the sixth interface (56).

10. Control unit according to claim 9, characterized in that the intervention device (11) is designed and arranged to:

the first intermediate tap (21) being connectable with the second intermediate tap (22) via a first separation element (31); and/or

The first intermediate tap (21) is connectable with the fourth intermediate tap (24) via a second splitter element (32), preferably via two serial or anti-serial interconnected splitter elements, more preferably via four serial or anti-serial interconnected splitter elements; and/or

The fourth intermediate tap (24) can be connected with the fifth intermediate tap (25) via a fourth separating element (34), preferably via two separating elements interconnected in series or anti-series, more preferably via four separating elements interconnected in series or anti-series.

11. The control unit according to any one of claims 1 to 10, characterized in that the monitoring device (9) and the intervention device (11) are designed to perform a test comprising a fixed sequence of checking actions every 60 seconds, preferably every 30 seconds, more preferably every 10 seconds, for monitoring the operational state of the elevator installation, in particular for detecting a service bridge (5) of electrical contact in the safety circuit (3) and/or a fault-related short circuit; and/or

The monitoring device (9) and the intervention device (11) are designed such that a test comprising a fixed sequence of checking actions lasts for a maximum of 1 second, preferably 500 milliseconds, more preferably 250 milliseconds, more preferably 100 milliseconds, for monitoring the operating state of the elevator installation, in particular for detecting an electrical contact of the service bridge (5) and/or a fault-related short circuit in the safety circuit (3).

12. The control unit according to any one of claims 1 to 11, characterized in that a counter unit (15) which can be controlled in response to the result of the checking action and a communication device (16) which is designed for transmitting a sensor output signal, which can be influenced by the counter unit (15), are designed to effect a travel run of the elevator installation at a reduced travel speed of the car, in particular within a limited time period.

13. An elevator installation having a control unit (1) according to any one of claims 1 to 12.

Images