EP2493802B1 - Safety circuit in a lift assembly - Google Patents

Description

The present invention relates to an elevator installation, in which at least one elevator car and at least one counterweight are moved in opposite directions in an elevator shaft, wherein the at least one elevator car and the at least one counterweight run along guide rails, carried by one or more support means. The one or more suspension elements are guided over a traction sheave of a drive unit which has a drive brake. Furthermore, the elevator system has a safety circuit which, among other things, activates the drive brake in an emergency and includes a bridging of the door contacts so that the safety circuit remains closed when the doors are opened. The present invention particularly relates to the safety circuit.

In conventional elevator systems, electromechanical switches are used to bridge the door contacts. In particular, in elevator systems in office buildings, however, the number of trips the elevator car can be more than 1000 per working day, with the bridging of the door contacts takes place twice each trip. This results in a number of about 520,000 circuits per year for the electromechanical switches. This number is so high that the electromechanical switches become the main limiting factor for the reliability of the door contacts bridging.

Due to the high number of circuits and the high requirements, the bridging of the door contacts is classified as a so-called high-demand safety function. In general, the IEC 61508 standard defines high-demand safety functions as functions that, on average, switch over more than once a year in trouble-free normal operation of the elevator system, while low-demand safety functions designate such functions as are provided only for emergencies of the elevator system or only for an emergency operation of the elevator system, in which there is a fault and switch on average less frequently than once a year.

An essential element of this international standard IEC 61508 is the determination of the safety integrity level (SIL, there is SIL1 to SIL4). This is a measure of the necessary or achieved risk-reducing effectiveness of the safety functions, with SIL1 having the lowest requirements. Essential calculation parameters for the reliability of the safety function of equipment or systems are the calculation bases for PFH (probability of dangerous failure per hour) and PFD (probability of dangerous failure on demand). The first parameter PFH refers to high-demand systems, ie those with a high demand rate, and the second parameter PFD to low-demand systems, the time of their service life is virtually not operated. From these parameters, the SIL can be read off.

Another definition of Low-Demand Mode and High-Demand Mode (High-Demand-Mode or Continuous Mode) available in specialized media based on this standard (IEC 61508-4, Section 3.5.12) ) specifies their distinction not only on the basis of the low or high (continuous) request rate, but as follows: A (low-demand) safety function operating in the request mode is executed only on request and brings the system to be monitored into a defined safe state. The executing elements of this low-demand security feature do not affect the system being monitored before a request to the security function occurs. By contrast, a (high-demand) safety function that operates in continuous mode always keeps the system to be monitored in its normal safe state. The elements of this high-demand security feature thus constantly monitor the system to be monitored. A failure of the elements of this (high-demand) safety function immediately leads to a hazard if no other safety-related systems or external measures for risk reduction take effect. Furthermore, there is a low-demand safety function if the request rate is not more than once a year and is not greater than twice the frequency of the retest. On the other hand, a high-demand safety function or continuous safety function is provided when the demand rate is more than once a year or greater than twice the frequency of the retest (see also IEC 61508-4, section 3.5.12).

EP 1 535 896 A2 discloses an elevator installation with a safety circuit, wherein the door contacts of the safety circuit of the safety circuit can be bridged by the elevator control

The object of the present invention is to propose a safety circuit for an elevator installation, which comprises a more reliable and safer fulfillment of a frequently switching high-demand safety function such as the bridging of the door contacts and thus the safety, but also the cost efficiency and the low maintenance of the entire elevator system elevated.

The solution of the problem is initially in the targeted replacement by electronic solid state switch that conventional electromechanical switch, which are claimed by a large number of circuits (high-demand safety function). Such a high-demand safety function is, for example, the bridging of the door contacts, but there are also other, connected in trouble-free normal operation safety features into consideration, in particular those that are frequently switched.

Such semiconductor switches, such as Metal Oxide Semiconductor Field Effect Transistor (MOSFET) MOSFETs, are generally based on transistors that can withstand millions of switching cycles per day. The disadvantage is only their tendency in case of failure to cause a short circuit, which would result in a permanent bridging of all door contacts. In other words, if for redundancy reasons, preferably two semiconductor switches (to meet the security level SIL2) are provided for bridging the door contacts, and these two semiconductor switches should fail because of a short circuit, enters the high risk situation that the elevator car and the counterweight with open shaft - and / or cabin doors can be moved because the semiconductor short-circuit simulates closed doors.

In general, to avoid or detect a short circuit in a semiconductor switch usually complicated and costly solutions for the so-called failsafe proposed.

The publication font EP-A2-1 535 876 discloses a drive which is connected to a power semiconductor having electronic device, wherein between the drive and the electronic device at least one main contactor is provided, which is connected to a safety circuit comprising series-connected door switch. These serially connected door switches are in turn bridged with switches when opening the doors. Although this publication thus discloses the use of semiconductors - power semiconductors in an electronic device of the drive, but not within the safety circuit, as well as no failsafe solution to avoid the short-circuit tendency of the semiconductor, but rather serving the noise avoidance of the at least one main contactor and a check of the latter by a timer and / or a counter.

In a safety circuit according to the present application, according to the invention, no separate failsafe solution for the respective electronic semiconductor switches is provided, but an otherwise existing one, otherwise Electromechanical safety relay is involved in the prevention or detection of a possible short circuit in one of the electronic semiconductor switch. This means according to the invention that, in the event of a short circuit in one of the electronic semiconductor switches, which according to the invention and for reasons of redundancy (safety level SIL2) are provided twice for bridging the door contacts, for the time being nothing is happening. However, if the second electronic solid-state switch breaks, too - which can be done more quickly due to possible overload peaks - does not specifically designed for this purpose Failsafe solution or do not use specially provided safety relay to open the safety circuit, but at least one existing anyway electromechanical Safety relay that would open the safety circuit as part of another safety function if there was an irregularity within this latter safety function. Alternatively, the opening of the safety circuit can take place even in the event of the failure of the first semiconductor switch.

This - at least one - other, electromechanical safety relay of the first safety-related function of the elevator system is preferably provided for a so-called low-demand safety function, i. for a safety function, which is subject to a few switching processes, for example, switching only in emergencies outside of normal operation. (See Low and High Demand Mode Definition in paragraphs [003] - [005]).

According to the invention, such another safety relay may be, for example, a so-called ETSL relay circuit, where ETSL stands for Emergency Terminal Speed Limiting, ie for a speed-dependent emergency shaft end delay control. Such ETSL relay circuits are known from the prior art. This ETSL relay circuit is a so-called low-demand safety component used in the Normal operation is not needed. It occurs only very rarely in function, namely only if the elevator car should go beyond its normal range. This ETSL relay circuit is electromechanical, that is, it has no semiconductors, but relay contacts and electromechanical safety relays and according to the invention is integrated in addition to its ancestral shaft end delay control function in the monitoring of the semiconductor switch. These semiconductor switches are used according to the invention for a high-demand safety function, for example, for the bridging of the door contacts, but generally for a series connection of contacts that are closed in trouble-free normal operation, however, be opened under certain operating conditions and then bridged, so that the entire Safety circuit remains active.

In other words, the elements of the electromechanical relay circuit - or at least parts thereof - according to the invention are used, in the case of a short circuit of one or both semiconductor switches, to open the safety circuit.

The monitoring of the semiconductor switch is carried out according to the invention by means of a monitoring circuit which is processor-controlled. If the monitoring reveals that the semiconductor switches are short-circuited, the processor (s) according to the invention are able to open the safety circuit of the elevator installation, preferably via an otherwise existing electromechanical relay circuit, for example an ETSL relay circuit.

In a first solution, it is provided that at least one processor, on the one hand, is capable of controlling the semiconductor switches (for example for bridging the door contacts) and, at the same time, monitoring the semiconductor switches. On the other hand, the at least one processor according to the invention is capable of simultaneously a detected due to the monitoring short circuit directly on this in turn connected in series relay contacts or directly to one or more electromechanical safety relay of the otherwise electromechanical relay circuit controlled. In other words, it is inventively preferred that the other relay circuit itself no longer own any processor and the above-mentioned at least one processor controls both the semiconductor switches, as well as their monitoring, as well as the traditional function of the electromechanical relay circuit.

That is, in the example case that the electromechanical relay circuit perceives the ETSL function of the elevator system, it means that the ETSL function no longer has its own or no own processors. The at least one processor for the semiconductor switches and their monitoring also takes over the ETSL function. This requires only appropriate lines and the corresponding circuit with the now both safety-relevant functions exporting processor and results in a significant cost advantage.

However, as a further alternative, it is also possible to continue to use the controlling processor (s) of the electromechanical relay circuit and to relay the controlling processor (s) of the semiconductor switch to open the safety circuit due to a short circuit of the semiconductor switches to the controlling processor (s) of the electromechanical relay circuit.

Furthermore, it would also be possible to continue to use the controlling processor or processors of the electromechanical relay circuit, but not to relay the control command of the processors for the semiconductor switches to open the safety circuit to the controlling processor or processors of the electromechanical relay circuit, but rather to let the processors of the semiconductor switches directly access the relay contacts or related electromechanical safety relays.

As already mentioned, the bridging of the series connection of contacts can be an often switching high-demand function, for example the bridging of the door contacts, which takes place according to the invention with semiconductor switches. Despite this use of semiconductor switches, however, the same level of safety as with electromechanical safety relays is achieved by preferably using the ETSL safety relay (s) in case of failure (short circuit) to bridge the door contacts to reopen the safety circuit and avoid dangerous situations.

In order to achieve at least the same or an increased level of security, it is basically necessary to consider only those electromechanical safety relays in the inventive integration for the circumvention of a short circuit out of function bridging the door contacts by means of semiconductor switch into consideration, with respect to their circuits, their Design and its safety level (so-called SIL level, where SIL stands for Safety Integrity Level, see paragraph [004]) are provided for a non-bypassable safety function during machine operation. That is, the electromechanical safety relay must at least be designed to cover a safety function that is so crucial that it can be intentionally bypassed or even bridged only during manual operation.

As already mentioned, according to the invention, the two conventional electromechanical relays for bridging the door contacts are replaced, for example, by two MOSFETs. Furthermore, according to the invention, the two MOSFETs are each provided with a processor or microprocessor and a monitoring circuit or test circuit is monitored by taking a voltage measurement at one input and one output of the MOSFET, separately for each channel. If one or both of the MOSFETs should be defective (which in most cases means short circuits for such switches), the respective processor will detect this condition and open the ETSL relay contact (s). Another advantage is thus that even both MOSFETs can be defective at the same time; in this way, the device or the elevator system but still safe.

Furthermore, according to the invention, a display is provided which provides information if a short circuit in one of the semiconductor switches is bypassed by one of the electromechanical safety relays or their contacts.

The MOSFETs are normally always closed when the doors are open. Accordingly, it is provided that the respective processor at a regular interval of a few seconds, the MOSFET opens briefly to check the voltage drop across the MOSFET, without the safety relay of the safety circuit drops and thus opens the corresponding relay contact of the safety circuit. According to the invention, this switch-off period is short enough to measure the voltage drop, but not so long as to allow the relay of the safety circuit to drop.

A person skilled in the art is free to implement the test just described not by means of the measurement of the voltage drop, but by means of a measurement of the current intensity, preferably inductive and non-contact.

The present invention thus presents a hybrid solution that combines the proven safety of electromechanical relays with the high reliability - in particular with regard to the number of switching cycles - of Transistors combined in a cost effective manner.

A bypass circuit according to the invention thus preferably comprises semiconductor switches for frequently switching high-demand safety functions - such as the bridging of the door contacts - and a processor-controlled test circuit for these semiconductor switches, and preferably the integration of an electromechanical safety relay, normally responsible for another, rarely switching low-end Demand safety function, to bypass the semiconductor switches in case of a semiconductor short circuit and opening the safety circuit.

In addition, the safety circuit includes the usual features and switching arrangements, as they correspond to today's elevator systems - not least because of the applicable standards - and are familiar to a person skilled in the field of elevator installation. Such features include, for example, the serial arrangement of all shaft door contacts, the serial arrangement of the car door contacts or the monitoring of the path of the elevator car with limit switches (KNE - contact emergency end), monitoring the speed of movement of the elevator car with sensors at the shaft end (ETSL), brake contacts, as well as at least one emergency stop switch.

Further or advantageous embodiments of an inventive safety circuit form the subject of the dependent claims.

The invention will be explained symbolically and by way of example with reference to figures. The figures are described coherently and comprehensively. The same reference symbols denote the same components, reference symbols with different indices indicate functionally identical or similar components.

• Fig. 1 eine schematische Darstellung einer beispielhaften Aufzugsanlage;
• Fig. 1a eine schematische Darstellung des Sicherheitskreises aus der Fig. 1 und
• Fig. 2 eine schematische Darstellung einer erfindungsgemässen Anordnung von zwei Halbleiterschaltern zur Überbrückung einer Serieschaltung von Kontakten, eines Überwachungs-Schaltkreises für diese zwei Halbleiterschalter, eines elektromechanischen Relaiskreises und die erfindungsgemässe Integrierung dieser Anordnung in einen herkömmlichen Sicherheitskreis gemäss Fig. 1 bzw. Fig. 1a und den sich somit ergebenden erfindungsgemässen Sicherheitskreis.

It show here

• Fig. 1 a schematic representation of an exemplary elevator installation;
• Fig. 1a a schematic representation of the safety circuit of the Fig. 1 and
• Fig. 2 a schematic representation of an inventive arrangement of two semiconductor switches for bridging a series connection of contacts, a monitoring circuit for these two semiconductor switches, an electromechanical relay circuit and the inventive integration of this arrangement in a conventional safety circuit according to Fig. 1 respectively. Fig. 1a and the resulting safety circuit according to the invention.

The Fig. 1 shows an elevator system 100, for example in illustrated 2: 1 support means guide. In an elevator shaft 1, an elevator car 2 is movably arranged, which is connected via a support means 3 with a movable counterweight 4. The support means 3 is driven during operation by means of a traction sheave 5 of a drive unit 6, which are arranged for example in the uppermost region of the elevator shaft 1 in a machine room 12. The elevator car 2 and the counterweight 4 are guided by means of guide rails 7a, 7b and 7c extending over the shaft height.

The elevator car 2 can operate at a delivery height h a top floor with floor door 8, more floors with floor doors 9 and 10 and a bottom floor with floor door 11. The elevator shaft 1 is formed by shaft side walls 15a and 15b, a shaft ceiling 13 and a shaft bottom 14 on which a shaft bottom buffer 19a for the counterweight 4 and two shaft bottom buffers 19b and 19c for the elevator car 2 are arranged.

The support means 3 is attached to a fixed attachment point or Tragmittelfixpunkt 16 a to the shaft ceiling 13 and parallel to the shaft side wall 15a led to a support roller 17 for the counterweight 4. From here again via the traction sheave 5, to a first deflection or support roller 18a and a second deflection or support roller 18b, the elevator car 2 unterschlingend, and to a second stationary attachment point or Tragmittelfixpunkt 16b on the shaft ceiling 13th

A safety circuit 200 includes on each of the floors 8-11 a landing door contact 20a-20d, respectively, which are arranged in series in a hoistway door circuit 21. The shaft door circuit 21 is fed to a PCB (Printed Circuit Board) 22, which is arranged, for example, in the machine room 12. The PCB 22 is connected to the drive 6 or a drive brake 24 with only a symbolic connection 23, so that in case of error messages of the safety circuit 200, the drive of the drive unit 6 or the rotation of the traction sheave 5 can be stopped.

The connection 23 is to be understood only symbolically, because in reality it is much more complicated and as a rule includes the elevator control. It also has a relay 40 of the safety circuit 200 and connection points 41a and 41b. Between the latter, a dual-channel end-of-shaft delay control function 42 is typically implemented to fulfill the security level SIL2 by serially arranging a first ETSL channel and a second ETSL channel in the security circuit 200. The two ETSL channels are shown symbolically as switches 31a and 31b, but are switching relays with switching contacts.

Not only the hoistway doors have a hoist door circuit 21 for controlling the opening of the hoistway doors, but also the hoistway 2 has a car door circuit 25 for controlling the opening of two indicated car sliding doors 27a and 27b. This car door circuit 25 includes a car door contact 26. Signals from the car door circuit 25 are via Hanging cable 28 of the elevator car 2 passed to the PCB 22, where they are integrated in series with the shaft door contacts 20a-20d in the safety circuit 200.

The elevator installation 100 furthermore has a bridging circuit 29 for the shaft door contacts 20a-20d arranged in a series circuit 43 and also the car door contact 26 arranged serially. The bridging circuit 29 comprises switching relays, whose switching contacts are arranged in parallel between two further connection locations 41c and 41d symbolically represented as switches 30a and 30b.

In the Fig. 1a is the safety circuit 200 of the elevator system 100 from the Fig. 1 shown separately, so that its connections and circuits are clearer. The end-of-shaft delay control circuit 42 and the door contact bypass circuit 29 are independent of each other, they are only serially integrated into the safety circuit 200.

In the Fig. 2 is shown, on the one hand between the connection points 41c and 41d of the safety circuit 200 from the Fig. 1 an inventive bridging circuit 29a for bridging the contacts 20a-20d and 26 of the Fig. 1 1a is configured, and how, on the other hand, an electromechanical relay circuit 42a between the connection points 41a and 41b of the safety circuit 200 from the Fig. 1 is arranged according to the invention; how the bridging circuit 29a and the electromechanical relay circuit 42a are connected to one another according to the invention and thus result in a safety circuit 200 according to the invention and an elevator installation 100 according to the invention. The electromechanical relay circuit 42a preferably represents a relay circuit for performing a low-demand safety function of the elevator installation 100.

For the assumption of a high-demand safety function, such as the bridging function of the door contacts, a microprocessor 34c is connected in accordance with a semiconductor switch or transistor 36a in a first circuit 300a. The transistor 36a is exemplified as a MOSFET transistor, but other types of transistors are also suitable.

Furthermore, a monitoring circuit 37a is indicated, which is applied to an input 38a and an output 39a of the semiconductor switch 36a. The processor 34c controls the periodic cycles of measurement of the voltage or current at the input 38a and the output 39a. Of course, the connection point 38a may also represent the output of the semiconductor switch 36a and the connection point 39a may represent the input of the semiconductor switch 36a.

The bypass circuit 29a, as shown in FIG Fig. 1 1a or 1a, all door contacts 20a-20d, 26 are fed serially via the connection points 41c and 41d, is designed for redundancy reasons or for the fulfillment of the SIL2 security level two channels. The second channel comprises analogous to the first channel a circuit 300b, a semiconductor switch 36b, a monitoring circuit 37b for the semiconductor switch 36b, which is applied to an input 38b and an output 39b of the semiconductor switch 36b and is controlled by a microprocessor 34d. The microprocessors 34c and 34d are interconnected for bidirectional signal exchange. It can also be provided more than two channels.

The microprocessor 34c is further connected to an electromechanical relay 35c, a changeover contact 32c and a resistor 33c of a first ETSL channel or, after omission of any ETSL processor, the elements of an electromechanical relay circuit 42a remaining therefrom. The microprocessor 34d is in turn with a electromechanical relay 35d, a changeover contact 32d and a resistor 33d of a second ETSL channel. These two ETSL channels ensure the shaft end delay control function, which is thus accomplished on SIL2 security level, the necessary delay control circuit 42 between the connection points 41a and 41b of the safety circuit 200 from the Fig. 1 connected.

The well end delay control circuit 42 used for the tick according to the invention no longer has its own microprocessors because the control of the delay control circuit 42 is performed by the microprocessors 34c and 34d, in addition to the control of the bypass circuit 29a and in addition to the control of the monitoring circuits 37a and 37b.

Optionally, a single microprocessor arrangement is also possible which controls both the two illustrated channels of the bypass circuit 29a as well as the two illustrated channels of the electromechanical relay circuit 42a and the delay control circuit 42.

The Fig. 2 schematically illustrates an exemplary arrangement of a parallel, two-channel bridging of series door contacts (both the shaft door 20a-20d, as well as the car door contact 26) of the elevator system 100a, or in general a possible inventive combined perception of a first safety-relevant function, preferably a low-demand safety function (for example the shaft end delay control ETSL) and a second safety-relevant function, preferably a high-demand safety function (for example, the bridging of the door contacts).

Upon a check of the semiconductor switches 36a and 36b by means of the monitoring circuits 37a and 37b, which results in a defect or a short circuit of one of the semiconductor switches 36a or 36b or both semiconductor switches 36a and 36b, the microprocessors 34c and / or 34d according to the invention in the situation to drive the conventional electromechanical safety relays 35c and 35d of the electromechanical relay circuit 42a for opening the safety circuit 200. This takes place in addition to the originally intended shaft end delay of the elevator car 2, which could originally exercise the electromechanical relay circuit 42a. This originally intended safety function does not override due to the adopted opening function of the safety circuit 200, preferably because the microprocessors 34c and 34d both the shaft end delay control circuit of the elevator car 2 of the elevator installation 100, as well as the bridging circuit 29a with the semiconductor switches 36a and 36b also control the monitoring of the semiconductor switches 36a and 36b.

The bridging circuit 29a equipped with semiconductor switches 36a and 36b is not only suitable for often switching high-demand functions, but also for any low-demand functions, such as the KNE function, where KNE for contact emergency end, ie for a Wegbegrenzung the elevator car 2 by means of limit switches on their normal track is also out. The bridging circuit 29a, which according to the invention can be combined with an electromechanical relay circuit 42a as disclosed, is also used for example for the braking function or for the emergency evacuation.

Claims (10)

1. Safety circuit (200) in a lift installation (100) with at least one series connection (43) of safety-relevant contacts (20a-20d, 26) which are closed in case of disturbance-free operation of the lift installation (100), wherein at least one contact (20a-20d, 26) in the case of specific operating conditions in which this at least one contact (20a-20d, 26) is opened can be bridged over by means of semiconductor switches (36a, 36b) and wherein the semiconductor switches (36a, 36b) can be controlled by means of at least one processor (34c, 34d) and monitored with respect to a short-circuit by means of at least one monitoring circuit (37a, 37b), as well as with at least one electromechanical relay circuit (42a) with relay contacts (31 c, 31 d) connected in series with the contacts (20a-20d, 26) of the series connection (43) able to be bridged over, wherein the relay circuit (42a) is controllable by means of the at least one processor (34c, 34d) and the bridgeable-over series connection (43) can be interrupted by means of the relay contacts (31 c, 31 d) in the case of a short-circuit of the semiconductor switches (36a, 36b).
2. Safety circuit (200) according to claim 1, characterised in that the at least one processor (34c, 34d) is also provided for - apart from controlling and monitoring the semiconductor switches (36a, 36b) and the relay circuit (42a) - control of a further safety-relevant control connection (42) which interrupts the series connection (43) by means of the relay circuit (42a).
3. Safety circuit (200) according to one of the preceding claims, characterised in that the semiconductor switches (36a, 36b) are metal-oxide semiconductor field-effect transistors.
4. Safety circuit (200) according to any one of the preceding claims, characterised in that the voltage at an input (38a, 38b) and an output (39a, 39b) of the semiconductor switches (36a, 36b) is measurable in the monitoring circuit (37a, 37b).
5. Safety circuit (200) according to any one of the preceding claims 1 to 3, characterised in that the amperage at the input (38a, 38b) and the output (39a, 39b) of the semiconductor switches (36a, 36b) is measurable in the monitoring circuit (37a, 37b).
6. Safety circuit (200) according to any one of the preceding claims, characterised in that an indication of the bypassing of a short-circuit in one of the semiconductor switches (36a, 36b) is indicated by way of one of the relay contacts (31 c, 31 d) in the lift installation (100).
7. Lift installation (100) with at least one safety circuit (200) according to any one of the preceding claims 1 to 6.
8. Method of monitoring semiconductor switches (36a, 36b) of a lift installation (100) according to claim 7, comprising the following steps:

   a) periodically measuring the voltage or the amperage at the input (38a, 38b) and at the output (39a 39b) of the semiconductor switches (36a, 36b); and

   b) opening the series connection (43) of the safety circuit (200) by means of at least one relay contact (31 c, 31 d) if the measurement under step a) reveals a short-circuit.
9. Use of semiconductor switches (36a, 36b) for bridging over safety-relevant contacts (20a-20d, 26) of a series connection (43) of the lift installation (100), wherein in the case of a short-circuit of the semiconductor switches (36a, 36b) the bridgeable-over series connection (43) can be interrupted by means of an electromechanical relay circuit (42a) with relay contacts (31 c, 31 d).
10. Use according to claim 9, characterised in that the relay circuit (42a) is also usable, apart from the case of a short-circuit of the semiconductor switches (36a, 36b), for a further control connection (42) and in the case of impermissible operational states of the lift installation (1) the bridgeable-over series connection (43) can be interrupted by means of the relay contacts (31 c, 31 d) of the relay circuit (42a).

Images