EP2022742A1 - Lift system - Google Patents

Abstract

The system has a lift car (12) movable inside a lift shaft (11), and a decentralized control system including an evaluation unit (21) that is assigned to the lift car. The decentralized control system includes another evaluation unit (23) that is assigned to the lift shaft, where the two evaluation units are connected together by a bus connection (22). A signal transmission occurs over the bus connection under the utilization of a safety protocol such that a security-relevant data transmission is enabled between the evaluation units. Independent claims are also included for the following: (1) a method for controlling a lift system (2) a computer program with program code for performing a method for controlling a lift system.

Description

The present invention relates to an elevator system with an elevator shaft and at least one elevator car movable in the elevator shaft. In particular, the present invention relates to an elevator system with a decentralized elevator control with a safety-related recognition and processing of signals and data detected in the elevator system.

Elevator systems with decentralized control concepts have been known in elevator construction for many years. A typical elevator control of this type comprises a signal and data acquisition device in an elevator car, which is connected by cables to a control console, which is usually arranged in the region of the uppermost stop of the elevator shaft and accessible from the outside. On the control console are next to an on-off switch necessary for the initiation of emergency aid facilities. Often the control panel is communicatively connected to a control center which may be located inside or outside the building. In addition, a wiring between the control panel and the drive motor with frequency converter in the elevator shaft and the elevator car is provided. Also common is a cable connection of the control panel with safety devices in the stops and the pit of the elevator shaft.

From the U.S. Patent 5,360,952 For example, an elevator system with a LAN elevator network is known. This network includes a A pair of redundant field buses for exchanging signals with an elevator control system, a pair of redundant group buses for exchanging signals between individual elevators, and a pair of redundant building buses for message exchange with a building controller. The communication between all the nodes of the individual buses takes place by means of a single protocol. This arrangement is based on the problem of reducing the average communication time for a message between different nodes in a LAN elevator network.

From the KR9309006 (Abstract) It is known to provide a elevator with a signal transmission system comprising a bus transeiver for converting the CPU's 8-bit address signals into data signals and a data communication interface for receiving 8-bit serial data signals, thereby simplifying the installation of signal transmission lines and the installation costs should be reduced.

From the JP 02075583 A (Abstract) An elevator arrangement is known in which, in order to reduce the number of communication lines, a connection of the individual elevators takes place by means of a serial transmission path via buses.

In modern, complex elevator systems, the large signal flow with safety-relevant signals leads to a very large amount of cabling, which becomes very expensive and becomes a considerable cost factor, especially in state-of-the-art elevator systems in which two or more elevator cars are moved and controlled independently in a shaft.

In contrast, an elevator system with an elevator shaft and at least one elevator car which can be moved in the elevator shaft is proposed according to the invention a control system comprises, which is designed safety-oriented according to the invention.

The elevator system comprises a number of safety modules, which are interconnected by means of a bus connection, so that a signal exchange between the safety modules via the bus connection is possible.

The safety modules are assigned to different areas of the elevator system and have signal inputs via which signals, for example, can be safely received by safety switches or sensors. These signals can either be safely read in as safe, non-redundant signals, or read in as unsafe redundant signals and further processed on the safety module to form a safe signal. By means of an interface for the bus connection, the safety modules are connected to the bus connection.

The bus connection, together with the number of security groups, thus constitutes a virtual security circuit which replaces and functionally expands the previously known, discretely wired safety circuit of known elevator systems. In contrast to this known, discretely wired safety circuit, which has series-connected safety switches that interrupt the safety circuit in the event of an open safety switch, the safety switches are connected in parallel to the respective safety module in the virtual safety circuit. There, the incoming signals are processed and, for example, evaluated according to a current defined operating state or triggered a specific action according to the results of the evaluation.

The use of the virtual safety circuit leads in addition to the advantage of reduced wiring costs to a more information, since it is now known in the case of using serial bit data, which switch is due to a fault. This provides an improved diagnostic capability and allows for more sophisticated responses to disturbances.

The safety modules include, for example, a first safe evaluation unit and a second secure evaluation unit, wherein the first safe evaluation unit is assigned to the at least one elevator car of the elevator system and the second safe evaluation unit is assigned to the elevator shaft, for example the upper stop of the elevator shaft. Furthermore, the safety modules comprise third evaluation units, which may be assigned to the individual stops of the elevator car.

The safety modules each comprise, in addition to the interface for the bus connection, data inputs for secure signal detection of safety switches or sensors, as well as data outputs for the secure control of, for example, a braking device and a catching device. Furthermore, the safety modules can each have an unsecure subarea for evaluating the unsafe signals. The first evaluation unit additionally comprises an interface for redundant signal detection of sensors, for example the position and the speed of the elevator car.

The safety modules, in particular the first and the second evaluation unit and the third evaluation units are connected to each other by means of the bus connection, wherein a signal transmission via the bus connection using a security protocol, so that a security relevant Data transmission between the safety modules is possible. At the same time, non-secure data can also be transmitted via the same bus connection using a non-secure protocol.

"Safe" in the sense of the present application is an evaluation unit or another programmable device if it complies with DIN EN ISO 61508. Preferably, the term "safe" means a device that meets at least the safety integrity level (Safety Integrity Level) SIL 3 of said standard.

According to the invention, bus connections for the transmission of data in the elevator control are thus designed security-relevant. The data transmission takes place using a security protocol that ensures that possible transmission errors are detected and traceable and that any data corruption is displayed, so that security-relevant data can also be transmitted via the bus connection.

With the embodiment according to the invention a significant reduction of the wiring effort is achieved in modern elevator systems. This has an effect particularly on elevator systems with larger delivery heights and in elevator systems with two or more elevator cars per shaft, in which previously a transfer of safety-relevant data was done exclusively via a discrete wiring, otherwise there was no possibility, the at least two elevator cabins safety-oriented, but independently to control.

A bus connection in the context of the present application is a connection for transferring data and signals between multiple functional units of one technical system, each having a processor-based data processing device. The design of the bus connection is at the discretion of the skilled person, and this can fall back on a variety of known design options. For example. In the context of the invention, a bus connection is designed as a serial bus connection. The connection can be realized by means of physical cables, but it can also be designed wirelessly. As a further variant, the connection can also be modulated onto an already existing cable, for example a power cable (eg 240 volt cable). Furthermore, depending on the configuration, the bus connection may have a bus controller. The design of necessary interfaces is known in the art. It should be emphasized that, in the context of the invention, it is fundamentally to be distinguished between a secure bus connection which operates according to the invention with a suitable security protocol and a "normal" bus connection without any special requirements for the security of the unadulterated data transmission. These systems are inventively integrated into a secure connection.

The safety modules are designed in such a way that they can read out and process signals from the connected sensors. The results can be sent via the bus connection to other safety modules. Specifically, the first evaluation unit can determine by means of the sensors, for example, a safe position and a safe speed of the elevator car and monitor the current position and speed according to defined specifications of a current operating state. Furthermore, it can also monitor and control the safety switches, an inspection and a so-called electrical return control. In general, the safety modules are also able to provide a targeted, in case of defined events Stop and / or cause an immediate stop or emergency stop of the elevator car by triggering the braking device or the catch device by means of trigger signals to the corresponding device. In this case, the trigger signals can be transmitted for example via the bus connection or sent directly to the brake and the safety gear, if they are connected according to another embodiment of the elevator system directly with data outputs of the respective safety module or especially the first trip unit and the second trip unit.

For example, the catcher may comply with EN81-1, 9.8, and 9.9 and includes a speed limiter, which may constitute another safety subassembly, processing the tripping signals received from the other safety subassemblies, and a safety gear. The overspeed governor may either trigger stop of the elevator drive in response to this received trip signal or if the speed of the elevator car deviates from a defined trip speed of the overspeed governor.

In the event of an emergency stop, disconnection of the drive and the brakes of the elevator car from the power supply, whereby the drive is switched off and the brake is actuated. The emergency stop can be triggered, for example, due to an open safety switch from the associated safety module or from the first or second evaluation unit due to certain events.

Furthermore, if the speed of the elevator car deviates upwards or downwards from a defined release speed, so-called emergency braking can be carried out. This allows a controlled stop the elevator car with a higher than in normal operation occurring delay or a lower delay than the delay of an emergency stop or when using the catcher.

According to another embodiment of the present elevator system, each of the safety modules may each comprise two independent interfaces for bus connections. Thus, the described single bus connection can also be designed as a redundant double bus connection with two individual bus connections or channels, wherein the channels can transmit identical signals. The security devices have a number of processors corresponding to the number of channels, so that the multiple signals received simultaneously through the various channels can be read and processed by the processors. This allows a cross-check of the intermediate and final results of the processed signals, with each processor being able to trigger certain events depending on the results and independently of the other processor. These events can represent, for example, the triggering of the braking device or the catching device by at least one of the processors of the respective safety module.

For processing the signals, predefined limit values are stored in an internal memory of the safety modules. In the first evaluation unit, a set of limit curves is additionally stored, which are calculated according to the current operating state. This set of limit curves includes, for example, a limit curve for triggering the braking device (triggering limit curve of the braking device) and a limit curve that defines the stopping point of the elevator car when the braking device is actuated (stopping limit curve of the braking device). Furthermore, the set of limit curves includes a limit curve for triggering the catcher (Trip limit curve of the catching device) and a limit curve that defines the breakpoint of the elevator car upon actuation of the catching device (Halbegrenzkurve the catcher). The individual limit curves each describe a speed profile over the length (or height) of the elevator shaft and thus assign a maximum speed value to each position of the travel path of the elevator car. The first evaluation unit reads in the redundant speed and position signals provided by the corresponding sensors and determines from these signals the safe speed and the position of the elevator car. Depending on the current operating state, the first evaluation unit selects the corresponding trip limit curve and checks whether it is exceeded.

Exceeds the instantaneous speed of the elevator car at the current point of the elevator shaft through the limit curve for triggering the catcher or the braking device predetermined limit value of the speed, the respective device is actuated within a defined reaction time. The elevator car is thus stopped within the respective retention curve, this pretending the breakpoint upon actuation of the respective device.

According to a further embodiment, a check of the evaluation calculations of the first evaluation unit can also be made in the second evaluation unit. For this purpose, the second evaluation unit is also equipped with the described functions of the first evaluation unit and the stored limit values and limit curves, and the data evaluated by the first evaluation unit is transmitted to the second evaluation unit.

In this way, it can be ensured that, in the case of a safety-related malfunction, for example in the case of too high a speed of the elevator car at the determined position, corresponding safety devices are actuated by one of the two evaluation units in order (in the case of the example mentioned) Actuate braking device of the elevator system and / or trigger the catching device of the elevator system. For this purpose, the first and / or the second evaluation with the security devices in communication technology connection and allow reading the security devices to the evaluation. A suitable control device circuit is, for example, in the EP 1 679 279 A1 the same applicant described. With the safely determined position and speed of the elevator car, the control according to the invention is thus capable of using the described limit curves for position and speed, usually required limit switches, inspection limit switches, deceleration control circuits, door zone monitors, anti-sag devices as well as elevator car and counterweight buffers through (certified) secure software evaluations to replace.

It is also possible to reliably detect the so-called uncontrolled leaving the bus stop by the elevator car and to take appropriate measures. This may mean that in the case of a failure of assemblies is not (exclusively) trying to achieve the safe condition of a lift by switching off the drive and applying the brake, as is common practice today. In the event of a defect in the brake, the shutdown of the drive causes the elevator car to spin away from the stop and a dangerous overspeed is quickly achieved, especially in the upward direction. Here can be a safe software evaluation according to the invention To increase safety by the drive, after such a dangerous situation is detected, in contrast to today's approach is switched on again and the elevator car is driven specifically in the final stop, in which they would be drawn by the weight ratios. In this final stop either the elevator car or the counterweight is placed on a fixed end stop, which again a safe state is achieved. If there are persons in the elevator car, further suitable measures must be taken depending on the load situation in order not to bring about a renewed dangerous condition by reversing the load conditions.

In one possible embodiment, for example, a normal mode, an inspection mode or an electrical return mode can be defined as operating states.

In normal operation, the triggering limit curve for the braking device ends at the position of the virtual limit switches and the course of the triggering curve is calculated on the basis of a maximum nominal speed occurring during normal operation. As described above, this course gives a specific maximum speed profile for the approach of the elevator car to the virtual limit switches. As a result, in contrast to today's limit switches, the emergency stop is triggered earlier than in conventional elevator systems when the trip limit curve is exceeded. If the emergency stop does not slow down the elevator car sufficiently, the safety device will be triggered. This ensures that the elevator car can not move beyond the capture curve of the capture device because the capture device is a certified safety assembly.

As long as the elevator car is in a stop during normal operation, the limit curves are scaled such that the triggering and the holding limit curve of the braking device are limited by the door zone. The limit curves are calculated in this case using a Nachregelgeschwindigkeit or a so-called "relevelling speed". It describes the maximum speed used to readjust the position of the elevator car. This readjustment is necessary for load changes, such as occur when entering and exiting passengers in the stop. Depending on the length and the diameter of the tether of the elevator car thereby changing the rope elongation, causing the elevator car is unbündig with the opening of the stop and thus can create a step.

In the inspection mode, the limit curve for triggering the braking device ends at the positions of the virtual inspection limit switches. These, in accordance with the present invention, replace the common inspection limit switches commonly located at these locations. With the help of these defined ends of the limit curves of the range of motion of the elevator car can be limited, so that in the inspection operation, a sufficiently large space is ensured within the shaft between a nearby shaft end and the elevator car for maintenance personnel. The corresponding limit curve for the inspection operation is calculated based on the maximum speed of the inspection operation. This course also provides a certain maximum speed curve for approaching the virtual inspection limit switches, as described above. As a result, in contrast to today's usual inspection limit switches the emergency stop earlier than in conventional elevator systems already triggered when the trip curve. If the emergency stop the elevator car does not decelerate sufficiently, the catcher is triggered. This guarantees that the elevator car can not move beyond the stopping limit curve of the catcher since the catcher is a certified safety assembly. In contrast, the conventional inspection limit switches of today's elevator systems do not constitute safety assemblies or safety switches, as this solution always requires a secure virtual inspection limit switch. If the elevator car is stopped at the position of the virtual inspection limit switch, it can not be moved further in the direction of the nearby shaft end but only in the opposite direction. This ensures that a sufficiently large space for the maintenance personnel is maintained between the shaft end and the elevator car.

In electric return mode, the limit curves are calculated on the basis of a maximum return speed, whereby the limit curves are not limited by limit switches. In the electrical return operation, the elevator car is moved by means of an electrical return control. This is operated via the usual energy supply of the elevator and can be additionally connected to a backup power supply to be operable in emergency situations.

The electrical return operation and individual test conditions represent the only operating conditions in which the elevator car can be moved beyond the position of the virtual limit switches. In these operating conditions, the limit curves do not describe an arcuate shape, but essentially straight-line curves which allow the elevator car to drive onto the buffers at a so-called electrical return speed or a movement of the elevator car beyond the limit switch.

As shown above, a first safe evaluation unit is provided in the elevator car of the elevator system. In the case of an elevator system with two or more elevator cars which can be moved independently of one another in an elevator shaft, each of the elevator cars can have such a first safe evaluation unit. In addition, a second safe evaluation unit is provided, which is assigned to the elevator shaft and, for example, connected to a (designed as a human-machine interface) control panel (intervention panel). The first evaluation unit in the elevator car can be analogously connected to a car operator panel (car operation panel) designed as a human-machine interface. In the case of an elevator system with a plurality of elevator shafts, each elevator shaft preferably has its own second evaluation unit.

The first evaluation unit assigned to the at least one elevator car can, as described, be connected according to the invention to sensors for secure position detection of the elevator car. A suitable system for safely determining the state of motion of an elevator car is, for example, in EP 1 621 504 A1 the same applicant described. On the basis of the signals provided by the sensors for safe position detection, the first evaluation unit calculates the speed of the elevator car at the determined position and evaluates whether this speed is within a specified interval. The evaluated data are also transmitted via the secure bus connection provided according to the invention as serial bit data to the second evaluation unit, which is connected to a control console. In addition, the second evaluation unit, for example, be connected to an external control room or a control center (in this context, the To understand the term "headquarters" as any in connection with an elevator system possible or useful central facility, so for example. An emergency call center, a remote maintenance center, a building management center, etc.).

By means of the described transmission of the evaluated data from the first evaluation unit to the second evaluation unit, according to the invention the second evaluation unit can perform the described checking of the evaluation calculations of the first evaluation unit of the elevator car.

Due to the safety-related transmission of the data via the bus connection according to the invention with a safety protocol, it can be accurately reproduced in the second evaluation unit at which point a malfunction occurs in the elevator system. This is done with significantly reduced cabling, which is particularly advantageous in the case of a modern elevator system with several independently movable elevator cabins in a hoistway. In particular, by means of the invention, each elevator car can be controlled independently of remaining elevator cars in the same elevator shaft and each of the remaining elevator cars can be moved in a section of the elevator shaft that is at least currently unused by the other elevator cars. This allows that in a malfunction that occurs only on an elevator car, the affected elevator car can be clearly identified and appropriate measures (such as, in extreme cases, the triggering of the braking device or a safety gear) can be initiated without the operation of the remaining, So the unaffected elevator car (s) must be completely adjusted. If, for example, the lower of two elevator cars in an elevator shaft is blocked at a determined position (eg on the third floor), then the elevator car above can block still operate the remaining floors above the blocked position of the lower elevator car. To achieve such a functionality with a conventional control technology, an immense wiring effort would be necessary, which would be associated with complex lift systems with multiple elevator shafts and a variety of floors with very high costs.

Not in all situations in which malfunctions occur, the elevator car must be blocked immediately. In many cases, a change in the control of the elevator car is sufficient. Thus, in the case of an unfastened shaft door in the area under this door, the elevator car can still be moved and carry out evacuation trips there, especially in emergency situations, since the position of the door which is no longer locked is known locally with the aid of the additional safety modules. In an embodiment, the elevator car can be moved to the stop below the unlocked shaft door, whereby the risk of injury can be reduced by falls into the shaft.

In yet other cases safety devices are to be operated, e.g. are arranged in a pit of the elevator shaft. This activation can also take place via the second evaluation unit. Of course, a communication-technical connection between the third evaluation unit and the safety devices is conceivable, which makes it possible to read in information from the safety devices to the third evaluation unit.

If, as illustrated above, more than one elevator car is provided in the same shaft, then according to a further embodiment, a device for collision prevention can be provided be used. This device ensures that two adjacent elevator cars do not collide and sufficient room is made available to a person on the roof when the second elevator car approaches a relative distance from above. To achieve this, each elevator car has a respective safety zone, compliance with which is ensured by means of the braking device or the safety device. For this purpose, the respective first evaluation units of the various elevator cars are connected to each other via the secure bus connection. By means of the secure bus connection, the respective first evaluation units exchange the boundaries of the associated safety zones. As soon as a safety zone of a first elevator car overlaps with a safety zone of a second elevator car, the respective braking device and / or the safety device of one or both elevator cars is triggered.

If an elevator car loses the connection to the secure bus connection, the relevant elevator car is stopped with an emergency stop or the safety device. The elevator car remains within its safety zone, so that the other elevator cars, for example, can be moved to the nearest stop to be shut down there. Passengers in the elevator cars can thus leave the respective elevator cabins without being trapped. The collision avoidance device is an additional device, but in no way replaces the described trip limit curves. It also ensures that even in the return mode the distance between the elevator cars can never become zero.

Another possible embodiment relates to the monitoring of the shaft doors. Is the elevator in normal operation and the shaft door, for example. From a Technicians unlocked and manually opened, there is usually a risk that people fall into the shaft or can be injured by a passing elevator car and falling objects. In this case, with the described elevator system, the affected shaft doors can be determined and the limit curves suitably adjusted, so that the elevator car can not pass the affected area. If the elevator car is located below the open shaft door, it is possible to continue to operate the elevator car in normal operation. The travel is limited in this case, however, to the area below the open shaft door.

Another possible device of the elevator system is the Absinkverhinderungseinrichtung. This is, for example, activated when the elevator car is stopped. If this device recognizes that the elevator car has moved downwards by a defined distance with respect to the position at which the fall prevention device was activated, the catching device is triggered. If the elevator car is to be moved following a stop, the anti-sink device must first be deactivated.

The door zone monitoring at the stop is provided according to a further embodiment. By activating the door zone monitoring, for example, the trip limit curves for the brake or safety gear can be reduced to the area of an unlocking zone after the elevator car has reached the desired position. The unlocking zone describes a section of the elevator shaft in the area of a stop in which the doors can be opened automatically while the car is still approaching this stop. Thus, the opening of the door can already be initiated before the elevator car in a flush with the Shaft door final position is so that it allows the passengers to get out without delay. Should an unintentional movement of the elevator car occur which exceeds the value of the unlocking zone, then the braking device and / or the catching device is triggered. If the device is activated while the elevator car is stopped outside the unlocking zone, for example in the inspection mode, a zone corresponding to the values of the unlocking zone can be monitored by the same device in order to secure the holding position of the elevator car.

The present description of the provided elevator system is illustrative and purely by way of example with reference to an elevator system of a cable lift. Of course, the described elevator system can also be used in other elevator types. These include in particular hydraulic lifts, linear actuators, lifts without rope and lifts without counterweight.

The invention also encompasses a computer program that is configured such that it can execute the control measures and the operation according to the invention of an elevator system when it runs on a suitable computing device, as well as a computer-readable medium with the computer program stored thereon. The instructions for the inventive control measures and for the operation according to the invention can also be implemented on a programmable logic, such as on a so-called user-specific integrated circuit (ASIC) or a so-called "Field Programming Gate Array" (FPGA). Such a programmable logic is thus also an object of the invention. Under a computing device in this context is each Control unit, evaluation or any other connected to the elevator system computer to understand.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings. It is understood that the features mentioned above and those yet to be explained below can be used not only in the respectively specified combination but also in other combinations or in isolation, without departing from the scope of the present invention.

Figur 1

zeigt in stark schematisierter Darstellung ein Aufzugsystem mit einem Aufzugschacht und einer in dem Aufzugschacht verfahrbaren Aufzugkabine.

Figur 2

zeigt ein schematisches Blockdiagramm der erfindungsgemäßen Busverbindung zwischen einer ersten Auswerteeinheit und einer zweiten Auswerteeinheit.

Figur 3

zeigt ein schematisches Blockdiagramm der ersten Auswerteeinheit der Erfindung und deren Verbindung mit anderen Komponenten des Aufzugsystems.

Figur 4

zeigt ein schematisches Blockdiagramm der zweiten Auswerteeinheit der Erfindung und deren Verbindung mit anderen Komponenten des Aufzugsystems.

Figur 5

zeigt den Verlauf verschiedener erfindungsgemäßer Grenzkurven, die jeweils einen bestimmten Geschwindigkeitsverlauf über die Höhe des Aufzugschachtes definieren.

Figur 6

zeigt den Verlauf von Grenzkurven bei Verwendung von zwei Aufzugkabinen und einer Vorrichtung zur Kollisionsverhinderung sowie die den Aufzugkabinen zugeordneten Sicherheitszonen.

The invention is illustrated schematically with reference to an embodiment in the drawing and will be described below in detail with reference to the drawings.

FIG. 1

shows a highly schematic representation of an elevator system with an elevator shaft and a movable in the elevator shaft elevator car.

FIG. 2

shows a schematic block diagram of the bus connection according to the invention between a first evaluation and a second evaluation.

FIG. 3

shows a schematic block diagram of the first evaluation unit of the invention and its connection with other components of the elevator system.

FIG. 4

shows a schematic block diagram of the second evaluation unit of the invention and its connection with other components of the elevator system.

FIG. 5

shows the course of various inventive limit curves, each having a certain velocity profile define over the height of the elevator shaft.

FIG. 6

shows the course of limit curves when using two elevator cabins and a device for collision prevention and the security zones associated with the elevator cars.

Detailed description of the drawings

FIG. 1 shows an elevator system 10 with an elevator shaft 11 and an elevator shaft 11 in the elevator shaft movable in the vertical direction elevator car 12. The elevator car 12 is connected via a tether 14 with a drive 15 and a counterweight 16, wherein the drive 15, the tether 14 drives and the Elevator car depending on the drive direction of the tether 14 moves up or down. The counterweight 16 is moved in the opposite direction accordingly. The elevator shaft 11 further includes a plurality of stops 13a and 13b. At these, the elevator car 12 can be stopped to allow entry and exit into the elevator car 12 to pass. The lower end of the elevator shaft 11 forms the pit 17.

FIG. 2 shows a schematic block diagram of a secure bus connection 22 according to the invention. The secure bus connection 22 essentially connects a first evaluation unit 21, a second evaluation unit 23, wherein the first evaluation unit 21 of the elevator car 12 and the other components are associated with the elevator shaft 11. To the first evaluation unit 21 is a car console 32 as a human-machine interface, sensors 33 for position and speed determination of the elevator car, and optionally a catcher 35 and a braking device 34th connected. From the signals from the sensors 33, the first evaluation unit 21 calculates the instantaneous position and speed of the elevator car and compares these with stored limit curves and limit values. If a limit curve or the limit values are exceeded, the first evaluation unit triggers either the catching device 35 or the braking device 34 in order to stop or decelerate the elevator car. The choice of each triggered device is dependent on the evaluation and a measure assigned to the evaluation result. Furthermore, safety modules 26 and 29 are attached to the secure bus connection 22. They are associated, for example, the individual stops 13a and 13b and each have a plurality of parallel-connected safety switches 27 and 28 or 30 and 31. The signals of the safety switches 27, 28, 30 and 31 are received and processed in the respectively connected safety module 26 and 29. According to a predetermined measure signals can be sent via the secure bus connection 22 to the other components connected to the secure bus connection 22. For example, in this way the first or second evaluation unit 21, 23 can be informed about opened safety switches 27, 28, 30, 31 and appropriate countermeasures can be taken. Furthermore, the first and second evaluation unit 21, 23 can exchange signals via the bus connection 23, as a result of which, for example, the signals processed by the first evaluation unit 21 can be checked in the second evaluation unit 23. The second evaluation unit 23 can also trigger the catching device 35 or the braking device 34 as a measure of the check results. In addition, the second evaluation unit is connected to a control center 24.

FIG. 3 shows a block diagram of a possible elevator car subsystem 39 of the elevator system. The first evaluation unit 21 is via the secure bus connection communication technology with the elevator shaft 11 associated second evaluation unit 23 accordingly FIG. 2 coupled. In the area of the elevator car or within the elevator car subsystem 39, the first evaluation unit 21 is connected to the car console 32, which comprises a plurality of components such as an inspection end switch 32a, an emergency stop switch 32b and a control panel 32c. Hereby functions can be controlled, which are to be made accessible only to the maintenance personnel, but not to the ordinary passenger. Furthermore, in the illustrated embodiment, a plurality of safety switches 36 are communicatively connected to the first evaluation unit 21, so that reading the safety switches 36 to the first evaluation unit 21 is made possible. These safety switches 36 include, for example, a car door lock switch 36a, a catch switch 36b, an elevator car roof monitor switch 36c, and an elevator car railing monitor switch 36d. These safety switches monitor the state of the elevator car and, in the event of an irregularity or danger, send a signal to the first evaluation unit 21 which can initiate suitable measures. The sensors 33 connected to the evaluation unit 21 include, for example, two sensors 33a, 33b for detecting the position of the elevator car 21. Furthermore, an emergency call unit 37 is connected to the secure bus connection 22. This can include, for example, emergency call signaling units 37a and a voice converter 37b, or additional units necessary for issuing an emergency call. Via a so-called gateway 38a, additional devices 38 can be connected to the secure bus connection 22. These include, for example, devices for load measurement 38b, a door drive 38c, a voice announcement 38d as well as control and display elements 38e for informing the passengers.

FIG. 4 shows a block diagram with a possible arrangement of the second evaluation unit 23 and the associated components as subsystem 40 of the elevator system. The second evaluation unit 23 is communicatively coupled to the elevator car 12 associated first evaluation unit 21 via the secure bus connection 22 corresponding to FIG. The second evaluation unit 23 is further coupled to a return control 47, which comprises, for example, a return switch 47a for activating or deactivating the return operation and control switches 47b, 47c in order to move the elevator car 12 upwards or downwards. Furthermore, a main switch 41 is connected to the second evaluation unit 23 and allows the entire elevator system on or off. The connection to external panels 24 can be made according to an embodiment via a connection of a so-called firewall 42. This is coupled to the secure bus connection and forwards the signals from or to the external control panels. At the same time, the firewall 42 controls and protects the secure bus connection against inadmissible access from outside the bus connection. The secure bus connection thus ends at the firewall 42. The external panels include, for example, a center for the building management 44, an emergency call center 45 or a center for the remote maintenance 46 of the elevator system and can be located inside or outside the building. Furthermore, to the bus connection 22, for example, a so-called Bluetooth diagnostic node can be attached, which provides a wireless diagnostic function.

FIG. 5 shows by way of example the course of various inventive limit curves, each defining a speed profile over the height s of the elevator shaft. A curve 51 shows the arcuate course of the current Speed of the elevator car 12 and extends below a tripping limit curve 52 and a retention curve 53 of the braking device. The tripping limit curve 52 and the stop limit curve 53 of the braking device respectively terminate at a lower end 56 and an upper end 57. In this way, the elevator car 12 is stopped in these positions in a normal mode as well as in an inspection mode. In this way, real limit switches or inspection limit switches can be virtually replaced. Exceeds the curve 51 of the current speed curve, the trigger limit curve 52 of the braking device so the braking device is triggered and delays the elevator car, so that the curve 51 of the current speed curve does not exceed the retention curve 53 of the braking device. Should this case nevertheless occur, then a tripping limit curve 54 of the catching device and a holding limit curve 55 of the catching device are provided, which enclose the above-described curves. If the curve 51 of the instantaneous speed course exceeds the triggering limit curve 54 of the catching device, the catching device is triggered and the elevator car is stopped within the stop limit curve 55 of the catching device.

FIG. 6 shows the course of limit curves when using two elevator cars and when using a device for collision prevention and the elevator cars associated security zones. The two elevator cars are at any time at the two current cabin positions 61 and have a momentary speed 62. Each elevator car includes a safety area that terminates upwardly at location 63 depending on the current speed 62 and is secured by the braking device. Below the elevator car, the safety area ends depending on the current speed at the point 64. The two Positions 63 and 64 define the ends of the security areas necessary for stopping the elevator cars and for additionally maintaining a space between the two elevator cars. For this purpose, the elevator cars are braked according to retention curves 65 by means of the braking device, so that they have a sufficiently large distance to the respective end of the security area. If the elevator cars are not braked by the braking device, the safety gear is triggered and the elevator cars are brought to a standstill in accordance with the stopping curves of the safety gear 66. In this case too, sufficient space must still remain between the elevator cars and the elevator cars will be stopped at a defined distance from the respective ends 63 and 64 of the safety area. The lines 67 take into account the height of the elevator cars between their top and bottom points. The routes 68 and 69 describe the respective routes that are required for stopping the car by means of the catching device or the braking device with immediate release. The routes 70 indicate in this case the remaining security area of the respective elevator car.

Claims (29)

Elevator system (10) having an elevator shaft (11) and at least one elevator car (12) movable in the elevator shaft (11), the elevator system (10) further comprising a decentralized control system having one associated with each of the at least one elevator car (12) has first evaluation unit (21) and at least one the elevator shaft (11) associated second evaluation unit (23), and the first (21) and the second evaluation unit (23) by means of a bus connection (22) are interconnected, wherein a signal transmission via the Bus connection (22) using a security protocol is carried out so that a security-relevant data transmission between the evaluation units (21,23) is possible. Elevator system (10) according to claim 1, comprising two or more in an elevator shaft (11) independently movable elevator cars (12), each elevator car (12) is associated with its own first evaluation unit (21). Elevator system (10) according to claim 1 or 2, wherein the security protocol is designed such that a detection of transmission errors takes place. Elevator system (10) according to one of claims 1 to 3, wherein the security protocol is designed such that a data corruption is displayed. Elevator system (10) according to one of Claims 1 to 4, in which the first evaluation unit (21) assigned to the elevator car (12) is connected to sensors (33) for safe position and speed detection of the elevator car (12). Elevator system (10) according to one of Claims 1 to 5, in which the first evaluation unit (21) assigned to the elevator car (12) is connected to sensors (33) for reliable acceleration detection of the elevator car (12). Elevator system (10) according to one of Claims 1 to 6, in which the first evaluation unit (21) assigned to the elevator car (12) is connected in terms of communication with at least one safety switch (36) and an input of the at least one safety switch (36) to the first evaluation unit (21). Elevator system (10) according to one of Claims 1 to 7, in which the first evaluation unit (21) assigned to the elevator car (12) is connected in terms of communication with at least one safety device (34, 35) of the elevator system (10) and reading in of the safety device (34 , 35) to the first evaluation unit (21). Elevator system (10) according to one of claims 1 to 8, in which a control of safety devices (34,35) of the elevator system (10) via the first and / or second evaluation unit (21, 23) takes place. Elevator system (10) according to one of Claims 1 to 9, in which the second evaluation unit (23) is connected to a control console (25) designed as a man-machine interface. Elevator system (10) according to one of claims 1 to 10, wherein the second evaluation unit (23) is connected to a drive of the (15) elevator system (10). Elevator system (10) according to claim 11, wherein the second evaluation unit (23) is connected to a frequency converter of the drive (15). Elevator system (10) according to one of Claims 1 to 12, in which the second evaluation unit (23) is connected to safety devices in a shaft pit (17) of the hoistway (11). Elevator system (10) according to one of claims 1 to 13, wherein the second evaluation unit (23) is connected to an external control room or control center (24). An elevator system (10) according to any one of claims 1 to 14, wherein the bus connection (22) is a serial bus connection. Elevator system (10) according to one of claims 1 to 15, in which a number of third evaluation units (26, 29) are provided, each third evaluation unit (26, 29) of the number of third evaluation units (26, 29) having the bus connection (26). 22) is connected to the signal transmission and a control of safety devices (34,35) of the elevator system (10) allowed. Elevator system (10) according to one of Claims 1 to 16, in which the third evaluation unit (26, 29) is connected in terms of communication technology with safety devices (34, 35) and an input of the safety devices (34, 35) to the third evaluation unit (26, 29 ). Elevator system (10) according to one of claims 1 to 17, in which the bus connection (22) has at least two physically separate channels and the first evaluation unit (21), the second evaluation unit (23) and the number of third evaluation units (26, 29) are equipped with at least one of the number of channels corresponding number of processors. A method of controlling an elevator system (10) according to any one of claims 1 to 18, comprising the step of calculating at least one limit curve associating an associated speed with an arbitrary position of an elevator car (12) in a hoistway (11) and the elevator car according to respective values of the limit curve is controlled. A method of controlling an elevator system (10) according to claim 19, comprising the step of comparing the limit curve with measurements from sensors (33) for safe position and speed detection of the elevator car (12). A method of controlling an elevator system (10) according to claim 20, comprising the step of initiating predefined actions in response to comparing the limit curve with measurements from sensors (33) for safe position and speed detection of the elevator car (12). Method for controlling an elevator system (10) according to one of Claims 19 to 21, in which the at least one limit curve comprises at least one release curve (52, 54) and one retention limit curve (53, 55). Method for controlling an elevator system (10) according to one of Claims 19 to 22, in which the predefined measures include the triggering of safety devices (34, 35) as soon as the measured values of the sensors (33) for safe position and speed detection of the elevator car (12 ) exceed the limit curve or triggering (52, 54) or restraint curve (53, 55) at the respective position of the hoistway (11) so that the elevator car (12) is defined within one of the limitance curve (53, 55) Section of the elevator shaft (11) is stopped. A method of controlling an elevator system (10) according to claim 19 or 23, wherein the control of the elevator system (10) is by means of a bus connection (22) and the elevator system (10) comprises a plurality of elevator cars (12), each elevator car (12) being independent is controlled by the remaining elevator cars (12) and one of the plurality of elevator cars (12) is moved in a section of the elevator shaft (11) which is at least currently unused by the other elevator cars (12). Method for controlling an elevator system (10) according to claim 24, wherein in the case of a non-locked shaft door of a stop (13a, 13b) the elevator car (12) is moved only in a section of the elevator shaft (11) below the unlocked shaft door or Elevator car (12) is stopped in an area below the unlocked shaft door. A method of controlling an elevator system (10) according to claim 24 or 25, wherein the plurality of elevator cars (12) are controlled by calculating limit curves according to claims 19 and 23. A method for controlling an elevator system (10) according to claim 26, wherein the control of the elevator cars comprises a collision prevention, wherein a distance calculation of the plurality of elevator cars (12) to each other in the elevator shaft (11) and the at least one limit curve of each elevator car (12) Prevention of a collision of elevator cars is calculated. Method for controlling an elevator system (10) according to one of Claims 19 to 27, which comprises triggering safety devices (34, 35) of at least one associated elevator car (12) if the at least one elevator car (12) controls the connection to the bus connection (22 ) and the remaining elevator cars are moved to predetermined positions. Computer program with program code, which is suitable for executing a method for controlling an elevator system according to one of claims 19 to 28, when the computer program runs on a suitable computer, in particular a part of an elevator system according to one of claims 1 to 18 forming computer.

Images