EP2807103A1

EP2807103A1 - Method and control device for monitoring travelling movements of a lift cabin

Info

Publication number: EP2807103A1
Application number: EP13701254.8A
Authority: EP
Inventors: Stefan STÖLZL; Thomas Schmidt; Michael Degen; Dominik DÜCHS; Frank Schreiner; Erich Bütler; Michael Geisshüsler; Nicolas Gremaud
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2012-01-25
Filing date: 2013-01-24
Publication date: 2014-12-03
Anticipated expiration: 2033-01-24
Also published as: HUE027471T2; BR112014017973A8; WO2013110693A1; CA2861399A1; US20150014098A1; JP2015508367A; PL2807103T3; ES2566386T3; RU2014134594A; CO7010799A2; EP2807103B1; SI2807103T1; ZA201405388B; KR20140128343A; BR112014017973A2; MX2014008910A

Abstract

The invention relates to a method for monitoring travelling movements of a lift cabin, to an electronic control device for monitoring travelling movements of a lift cabin, and to a lift cabin having a corresponding control device. Travelling movements (s, v, a) of a lift cabin are substantially travels (s), speeds (v) or accelerations (a) of the lift cabin. At least some travelling movements are detected redundantly for the purpose of monitoring. Here, either the travels (s) or the speeds (v) are detected redundantly and the accelerations (a) are detected singly, or alternatively, the accelerations (a) are detected redundantly and the travels(s) or the speeds (v) are detected singly, or preferably, the travels (s) or the speeds (v) and the accelerations (a) can be detected redundantly. The electronic control device is preferably arranged in the region of supporting rollers of the lift cabin.

Description

Method and control device for monitoring travel movements of a

car

description

The invention relates to a method for monitoring travel movements of an elevator car, an electronic control device for monitoring travel movements of an elevator car and an elevator car with a corresponding control device.

Dynamically moving objects, such as elevators in the present embodiment, or elevator cars, may generally not exceed predetermined accelerations and speeds for safety reasons, since otherwise injuries to the transported people as well as damage to the moving object itself can no longer be ruled out. Therefore, usually adapted to the object control device is provided which detects an excessive acceleration and the drive torque correspondingly reduced or activated at too high speeds a braking function.

On the one hand, mechanical devices are known from the prior art in this connection, which activate an emergency brake system at high speeds. Likewise, electronic control devices are known which initiate a drive torque reduction or a brake function on the basis of a detected acceleration or speed sensor signal. For safety reasons, two different physical sensor sizes are often used to determine the speed or acceleration. In addition, it is known to additionally calculate an acceleration by means of the speed sensor signal, and conversely additionally to calculate a speed by means of the acceleration sensor signal.

Of importance in such electronic control devices is that the detection of exceeding a safety-critical threshold value is sufficiently fast to counteract the occurrence of a risk of injury or damage appropriate countermeasures (eg., Drive smomentreduktion o activating a Braking function) to initiate reliable. This is particularly important when used in elevators, as in this case, for example in the case of failure of suspension elements, free fall conditions can occur, which can lead to a rapid increase in a fall speed. The detection of exceeding the safety-critical threshold value is often combined with a plausibility check of the sensor signals and with electrical monitoring.

Known plausibility checks of the acceleration sensor and the speed sensor signal are disadvantageous for the following reasons:

long error detection times and plausibility times due to the preceding (model-based) conversion of the acceleration sensor signal into a speed signal or vice versa,

high error detection thresholds and thus late initiation of necessary countermeasures in case of too high acceleration or too high speed and

- High application costs in the calibration of the sensors and the (model-based) conversion algorithms.

According to an inventive idea it is therefore proposed to use at least two acceleration sensor signals and at least one speed sensor signal or one displacement sensor signal simultaneously for the plausibility check. Alternatively, at least one acceleration sensor signal and at least two speed sensor signals or two position sensor signals are used simultaneously for the plausibility check or at least two acceleration sensor signals and at least two speed sensor signals or two displacement sensor signals are used simultaneously for the plausibility check.

This allows both a substantially fast error detection of a sensor signal and a substantially rapid initiation of a countermeasure when detecting an excessive speed or an excessive acceleration.

Preferably, the used movement variables are continuously subjected to a plausibility check and / or an error check. Thus autonomously operating devices can be created that can safely monitor travel movements. The respective sensor signals are preferably evaluated in an electronic control device (ECU). The ECU is advantageously arranged on the dynamically moving object, or on the elevator car.

The elevator car is usually carried by suspension means. The support means are guided over pulleys, which are arranged on the elevator car. Thus, a required load capacity in the support means, according to a determined by an arrangement of the pulleys Umhängefaktor be reduced. Preferably, at least the speed sensors or displacement sensors for detecting the speed sensor signals or the displacement sensor signals are assembled with these deflection rollers or integrated in these. The pulleys are safely driven by the support means because of the high load and the corresponding speed sensor signals or Wegsensorsignale are correspondingly accurate and secure.

Preferably, the electronic control device (ECU), or its processor unit with arithmetic unit for evaluating the detected speed sensor signals or path sensor signals, also arranged in the immediate vicinity of the deflection rollers. If necessary, sensor parts, for example an incremental sensor for detecting increment markings of the deflection roller, are arranged directly on a circuit board of the processor unit. Preferably, an acceleration sensor, or the redundant acceleration sensors, for detecting the acceleration sensor signals may also be arranged on this board. Thus, an entire error and plausibility check at the place of detection of the corresponding signals can be made.

Preferably, in an elevator car with a plurality of pulleys, at least two pulleys with a corresponding processor unit with calculator equips out. It is also possible to exchange individual measured variables for the error and plausibility check or to compare the results of the individual arithmetic units.

The inventive method preferably comprises a first activation stage, which allows a reduction, or an adjustment of the drive torque of the dynamically moving object, or the elevator car. To Advantageously, two acceleration sensors are used, which are preferably structurally integrated into the ECU, as described above. The monitoring of the two acceleration sensor signals al and a2 takes place for example by means of comparison of the two acceleration sensor signals. If the two acceleration signals are substantially the same, reliable values are available. Substantially the same can be calculated from the inequality | al - a2 | <ε be judged. If the amount | a1-a2 | is above a predetermined threshold value ε, then one of the two sensor signals is faulty. Once such an error is detected, for example, a warning signal is generated, on the basis of which, for example, a check can be made. Is the amount | al - a2 | however, below the predetermined threshold value ε, an acceleration can be reliably monitored with the acceleration sensor values. If the measured acceleration exceeds a predetermined threshold value for the acceleration, a safety information occurs due to which at most an adaptation of the drive torque can initially take place. The Anpas solution may be a reduction or increase of the drive torque depending on a loading condition and direction of travel of the elevator car. In many cases, however, this adaptation or regulation of the drive torque is perceived by a separate, a drive of the elevator car associated with, drive control, whereby this first activation stage can also be omitted. Regardless, of course, the measured values of the sensor signals for a drive control, for shaft information or for other driving information, the control of the entire elevator can be provided.

A plausibility check of the acceleration signals with the speed signal or path signal can be carried out as previously carried out by direct comparison or by converting the other quantities of motion. This plausibility check preferably serves for the general monitoring of the sensor signals.

Preferably, the at least two acceleration signals are evaluated directly and without previous conversion or processing. This results in the advantage that very sensitively and quickly on a speed change of the dynamically moving object, or the elevator car, can be concluded, since already the tendency to high speed is detected and the drive torque can be adjusted accordingly early.

In the following, the term object is understood to mean the elevator car. A Object movement is thus an elevator car movement or an object speed is an elevator car speed, etc.

A threshold value for the acceleration, at which an adaptation of the drive torque or a shutdown of the drive torque occurs, is preferably predetermined in such a way that an allowable maximum acceleration is previously exceeded. The measured acceleration must therefore be above the permissible acceleration in order to reduce or switch off the drive torque.

Advantageously, when the security information is output, a second activation stage is additionally provided, which is preferably independent of the first activation stage. The second activation stage activates at least one brake device (for example an emergency brake system) and / or switches off the drive torque. This is advantageously carried out on the basis of an excessively high actual speed v, possibly additionally combined with at least one too high actual acceleration a1 or a2. The verification of the sensor signals and their plausibility is preferably carried out as previously described.

The already described acceleration monitoring on exceeding a threshold acceleration makes it possible to detect a multiplicity of faulty operating conditions, but not all faulty operating conditions. In particular, accelerations below the threshold acceleration can likewise lead to safety-critical exceedances of the threshold speed. Such threshold speed overshoots can be detected by monitoring a speed value.

For example, as the speed value, the speed calculated from the acceleration sensor signal becomes low

Va = F (al, a2)

where F is a suitably chosen calculation rule of the time-dependent accelerations al, or al and a2. F is preferably an integral rule. This results in the advantage that the first and the second activation stage based on the same sensor signal (advantageously the acceleration) and thereby according to the first activation stage and the the second activation level. A plausibility check and thus monitoring of the speed value obtained from the acceleration sensors with the speed sensor signal V preferably takes place via the relationship

| Va - V | <el.

Alternatively, the plausibility check and thus monitoring of the speed value obtained from the acceleration sensors can also take place with the displacement sensor signal s. In this case, the speed sensor signal V from the travel sensor signal s is preferably calculated via a differentiation rule D as follows: V = D (s), and

The plausibility check and thus the monitoring of the speed value obtained from the acceleration sensors with the displacement sensor signal s is thus preferably effected via the relationship

| Va - V | <εΐ, or | Va - D (s) | <εΐ.

If the threshold value εΐ is exceeded, then the sensor signals are no longer plausible and the system must be transferred directly to a safe state in an emergency.

Thus, the speed sensor signal or the displacement sensor signal preferably has the task of monitoring the speed signal calculated from the acceleration sensor signals. By converting the

Acceleration sensor signals on the speed signal and the possibly continuous conversion of the displacement sensor signals in the speed signal, a direct speed comparison can be performed. By filtering the signals and (model-based) conversion of the signal values, however, a time delay can occur here in comparison to purely acceleration-sensor-based monitoring. Fast movement changes are thus detected safely by monitoring the acceleration value and slow movement changes can be detected by monitoring the speed value.

If an erroneous behavior of the sensors is distinguished by the overestimation of the threshold value ε for the threshold acceleration, then by using three sensors (two acceleration sensors and one acceleration sensor) Speed sensor or a displacement sensor), yet fault tolerance can be maintained. In addition, the following conversion is preferably carried out:

Val = F (a1) and Va2 = F (a2)

Advantageously, the following cases are distinguished:

1) If Val and V are within a specified tolerance band, whereas Va2 and V are outside the specified tolerance band, then a2 is faulty.

2) If Va2 and V are within a specified tolerance band, whereas Val and V are outside the specified tolerance band, then al is faulty.

3) If al and a2 are within a given tolerance band, Val and V and Va2 and V are outside the specified tolerance band, V is faulty.

This case distinction is preferably carried out when common-cause errors (so-called common-cause errors) of the redundantly present sensors can be excluded. If this is not ruled out, al and a2 could deliver values within a given tolerance band due to unrecognized common deviations from an initial calibration, but Val and V as well as Va2 and V could each lie outside the specified tolerance band. In this case, it would not be V, but al and a2 would be flawed. Therefore, per se known error system algorithms are preferably executed to detect common cause errors of (any) two of the three sensors, or different sensor makes are used to exclude common cause based errors.

Such or generic error handling makes it possible to maintain a basic functionality despite a detected error until the end of a maintenance interval appropriate to the particular application. This can also provide an improved diagnosis (e.g., whether a speed sensor or an acceleration sensor needs to be replaced). For example, a faulty sensor may trigger a maintenance request.

Furthermore, it is possible and preferred that speed sensor signals be used to calculate an acceleration signal. In this case, instead of a Integral specification preferably uses a differentiation rule for calculating the acceleration signal from the speed sensor signal. The described processing and use of the speed signals and the acceleration signals is correspondingly reversed.

Preferably, instead of fixed threshold values, it is also possible to work with dynamic threshold values. The threshold values in this case are dependent on the respective operating conditions of the object, e.g. the speed of the object or even a distance of the object to an obstacle or a track end.

Furthermore, it is preferred that the sensors are subjected to a calibration method which is known per se once prior to their use, at defined time intervals during their use, irregularly or as required. A self-regulating calibration method is possible and preferred. Likewise, any combinations of said calibration methods are possible and preferred.

Preferably, a mutual monitoring of all sensors used with each other takes place.

Preferably, the safety device according to the invention is also used for applications in which a minimum acceleration or minimum speed is generally required, so that if the minimum acceleration or the minimum speed are not adhered to, suitable safety measures can also be initiated.

Further preferred embodiments will become apparent from the subclaims and the following description of exemplary embodiments with reference to figures.

Show it:

FIG. 1 shows a schematic structure of a safety device,

FIG. 2 shows a first exemplary sequence of the method for monitoring

Traveling movements of an elevator car,

FIG. 3 shows another exemplary sequence of the method for monitoring

Driving movements of an elevator car, and Figure 4 is a schematic view of an elevator car with a safety device.

Equivalent parts and functions are provided with the same reference numerals.

FIG. 1 shows an electronic control unit 11 (ECU 11) which includes acceleration sensors 12 and 13 as well as a speed sensor 14 or a displacement sensor 14.1. The ECU 11 is part of the control electronics of an electrically operated elevator, or an elevator car. The acceleration sensors 12 and 13 are disposed directly in the ECU 11, while the speed sensor 14 or the displacement sensor 14.1 is located outside the ECU 11 and continues only a speed sensor signal v or a displacement signal s to a first microprocessor 16 in the ECU 11. If necessary, the first microprocessor 16 calculates the speed sensor signal v from the path signal s.

A second microprocessor 15 receives the acceleration sensor signals a1 and a2 from the acceleration sensors 12 and 13 and checks them for plausibility. At the same time, the second microprocessor 15 calculates a speed Val from the acceleration sensor signals a1 and a2 by means of an integral rule and executes an error system algorithm in order to detect any common cause errors of the acceleration sensors a1 and a2.

The speed Val is output to the first microprocessor 16, which compares the speed Val with the speed v and thus checks for plausibility. In addition, the first microprocessor 16 calculates an acceleration av by means of a differentiation rule and forwards the acceleration av to the second microprocessor 15. The second microprocessor 15 now compares the acceleration av with the acceleration sensor signals al and a2 for plausibility. If a faulty sensor is detected on the basis of the plausibility analysis, a corresponding warning signal W can be generated, or the elevator car can be shut down, for example after completion of a drive cycle.

Further, the second microprocessor 15 and the first microprocessor 16 constantly compare the acceleration values av, al and a2 and the speed values v and Val with predetermined threshold values. The second microprocessor 15 compares the values a1, a2 and av with predetermined threshold values, while the first microprocessor 16 compares the values val and v with predetermined threshold values. If one of the values av, al, a2, v or val exceeds a predetermined threshold value and a sensor error is ruled out or a faulty signal can not be unequivocally identified, safety information Sk for reducing the drive torque or for initiating a braking process is used Microprocessor output, which has detected the exceeding of the threshold.

Exceeding the threshold usually leads in a first activation stage to a reduction of the drive torque or to a controlled shutdown of the elevator car, while exceeding the threshold in a second activation stage leads to the initiation of a braking operation.

If necessary, the second microprocessor 15 is subdivided into a first partial processor 15.1 and a second partial processor 15.2, so that an evaluation and comparison in connection with the one acceleration sensor 12 is perceived by the first partial processor 15.1 and an evaluation and comparison in connection with the other acceleration sensor 13 is perceived by the second part processor 15.2. As a result, any errors in the area of the processors can be detected.

Preferably, the second microprocessor 15 processes sensor output information of at least one acceleration sensor 12, 13, and the second electronic calculating unit 16 evaluates sensor output information of at least one speed sensor 14 or a displacement sensor 14.1.

FIG. 2 shows a possible sequence of a method in the form of a flow chart. In method step 21, the acceleration value al is read in. Regardless of this, two speed values vi and v2 are read in at the same time in method step 22. In step 24, a comparison of the acceleration value a1 with a predetermined acceleration threshold a takes place. If the acceleration value al exceeds the predetermined acceleration threshold value as, corresponding safety information Sk is output, and accordingly, the driving torque which causes the acceleration is reduced or a braking operation is initiated. If the acceleration value al does not exceed the predetermined acceleration threshold, no further reaction takes place in step 24. Simultaneously with step 24, in step 23, the Acceleration value al converted by means of an integral function in the speed value Va. In method step 25, a plausibility check and error check of the read speed values vi and v2 takes place. If the velocity values vi and v2 are plausible and no error is detected, the process continues in steps 26 and 27. Otherwise, for example, the warning signal W is output.

In method step 26, a comparison is made of speed values vi and v2 with a threshold value vs for the speed. If at least one of the speed values vi or v2 exceeds the predetermined threshold value vs for the speed, the safety information Sk is output, and accordingly, the drive torque that drives the elevator car is adjusted or a braking operation is initiated. If none of the speed values vi and v2 exceeds the preset speed threshold, no further response occurs. At the same time, in step 27, speed values vi or v2 are converted into a mean acceleration a by means of a differentiation rule. Finally, in method step 28, a plausibility check and error check are carried out on the speed values vi and v2 read in step 22 with the speed value Va calculated in step 23. Simultaneously, in step 29, a plausibility check and error check are made of the acceleration value a1 read in in step 21 and of the Step 27 calculated acceleration value a performed. If an implausibility or an error is detected in one of the steps 28 and 29, a corresponding warning signal W is output and the elevator car is shut down immediately or after completion of the drive cycle.

FIG. 3 shows an alternative or supplementary variant of a possible sequence of a method. The ECU 11 is composed of a first microprocessor 30 and a second microprocessor 36. The acceleration sensors 12 and 13 are associated with the first microprocessor 30, and the speed sensor 14 or the displacement sensor 14.1 is associated with the second microprocessor 36.

In a first step 31.1, 31.2, in the first microprocessor 30 the acceleration sensor signals a1 and a2 of the two acceleration sensors 12 and 13 are compared with an acceleration threshold value as. If one of the two acceleration sensor signals exceeds the threshold value, that is, al, or a2> (greater than) as, the safety information sk is output and Accordingly, the drive torque, which drives the elevator car, adapted or a braking operation is initiated.

In a further step 32.1, 32.2, a plausibility check and error check of the read-in acceleration sensor signals a1 and a2 take place. If the acceleration sensor signals a1 and a2 are plausible, that is, if a difference of the two values lies below an error threshold value ε and thus no error is detected, a status signal is set to ok. Otherwise, the warning signal W is output. Thus, for example, a service is requested, or depending on further, later described assessments, the elevator system continues to operate, shut down or operated only in a reduced mode.

In another step 33.1, 33.2, the acceleration sensor signals a1 and a2 are converted into speed values Val and Va2, respectively, by means of an integral function, Val, 2 = Fal, 2, and these calculated speed values Val and Va2 are compared with one another in steps 34.1, 34.2. If a difference of the two acceleration sensor signals al and a2 is below an error threshold ε, the status signal is set to ok. Otherwise, the warning signal W is output. Of course, the error threshold ε is related in each case to the values to be compared, such as speed, acceleration, etc.

Furthermore, in a next step 35.1, 35.2 the speed values Val and Va2 are compared with a speed threshold value Vs. If one of the two speed values exceeds the speed threshold value Vs, ie Val, or Va2> (greater than) Vs, the safety information sk is output.

Preferably, the first microprocessor 30 is divided into two sub-processors 30.1 and 30.2, wherein the two acceleration sensors 12 and 13 are divided between the two sub-processors 30.1, 30.2. The two sub-processors can execute the comparison and calculation steps in parallel, with which any processor errors can be detected. The plausibility check and error check in steps 32.1, 32.2 and 34.1, 34.2 can also be performed mutually redundantly in the two sub-processors 30.1, 30.2, or they can be adopted by one of the sub-processors. In the second processor 36, the speed sensor signal V of the speed sensor 14 is detected or detected. In an alternative (shown in dashed lines), a speed value V is detected, for example by means of a tachometer. Preferably, however, a displacement sensor 14.1 is used which detects, for example by means of path increments, a path difference s from which the velocity value V is derived or determined by means of a calculation routine 14.2.

In a test step 39, the speed value V is further compared with a speed threshold value Vs. If the speed value V exceeds the threshold value, ie V> (greater than) Vs, the safety information sk is output.

Furthermore, in a comparison step 37, on the one hand, it is checked whether the status signals of the plausibility checking and error checking steps 32.1, 32.2, 34.1, 34.2 are set to ok by the first microprocessor, or whether a warning signal W has been output. Further, the speed value V is compared with the speed values Val and Va2 calculated by the first microprocessor 30. If a difference of the respective calculated speed values Val and Va2 to the speed value V is below an error threshold value ε, the status signal is set to ok. Otherwise, the warning signal W is output.

If it is determined in comparison step 37 that all the status signals of the plausibility check and error checking steps 32.1, 32.2, 34.1, 34.2 and 37 are set to ok, the monitoring device or the electronic control device 11 continues to operate. Otherwise, another error analysis 38 is started.

If, according to step 38.1 of the error analysis 38, the speed values Va2 and V in the predetermined tolerance band, Val and V outside the predetermined tolerance band, it can be determined that the acceleration sensor signal al or the associated calculation routine is faulty.

If, according to step 38.2, the velocity values Val and V in the specified tolerance band, Va2 and V are outside the specified tolerance band, it can be determined that the acceleration sensor signal a2 or the associated calculation routine is faulty.

However, according to step 38.3, the acceleration sensor signals a1 and a2 are in predetermined tolerance band but the speed comparison values Va2 to V and Val to V, however, outside the specified tolerance band, it can be determined that the speed signal V or possibly the associated calculation routine is faulty.

Thus, the faulty signal can be specifically determined and a service technician can quickly replace the affected component. During an operating time until replacement of the component, the faulty signal can be suppressed or temporarily replaced by one of the two intact signals.

Preferred methods for monitoring object paths s, sl, s2, object speeds v, vi, v2 and object accelerations a, a1, a2 are thus characterized by the fact that, in accordance with the illustrated embodiments

1) at least the object paths s, sl, s2, the object speeds v, vi, v2 or at least the object accelerations a, al, a2 are detected redundantly.

2.) the object paths s, sl, s2 redundant and the object accelerations a, al, a2 are simply detected or

the object velocities v, vi, v2 are redundant and the object accelerations a, a1, a2 are simply detected or

the object accelerations a, a1, a2 re dundant and the object speeds v, vi, v2 or the object paths s, sl, s2 are simply detected.

3.) the object paths s, sl, s2 and / or the object speeds v, vi, v2 and / or the object accelerations a, al, a2 are subjected to a plausibility check and / or an error check.

4.) the object paths s, sl, s2 or the object speeds v, vi, v2 or the

Object accelerations a, a1, a2 are recognized as plausible if the condition | a1 - a2 | <ε or | vl - v2 | < _z \ or | sl - s3 | <gi is satisfied, where ε, el and ε2 maximum amounts of a permissible difference.

5.) the error check is carried out by means of error system algorithms which compare the behavior of the redundantly detected object paths s, sl, s2, object speeds v, vi, v2 or the redundantly detected object accelerations a, a1, a2 with one another or their calculated similar values. by means of integral rules from the object accelerations a, al, a2

Object speeds v, vi, v2 and / or object paths s, sl, s2 are calculated. by means of a differentiation rule from the object paths s, sl, s2

Object speeds v, vi, v2 and / or object accelerations a, al, a2 are calculated.

the object accelerations a, al, a2 in a first activation stage with a

Threshold for the acceleration are compared and carried out when the acceleration threshold is exceeded, an adjustment and / or shutdown of the drive torque or a brake function is activated.

the object speeds v, vi, v2 in a second activation stage with a

Threshold for the speed are compared and made when adjusting the threshold for the speed adjustment and / or shutdown of the drive torque or a brake function is activated.

the object speeds v, vi, v2 in the second activation stage from the

Object accelerations a, al, a2 are calculated.

the object accelerations a, al, a2 are detected by means of acceleration sensor signals.

the object speeds v, vi, v2 are detected by means of speed sensor signals, for example from tachogenerators, and / or the object paths s, sl, s2 are detected by means of travel signals, such as from incremental sensors or encoders.

the acceleration sensor signals and / or the speed sensor signals and / or the paths without prior processing and / or filtering and / or conversion are evaluated directly.

the threshold value for the object accelerations a, a1, a2 is above an object-dependent permissible maximum acceleration and the threshold value for the object speeds v, vi, v2 is above an object-dependent permissible maximum speed.

the acceleration sensor signals are detected by means of acceleration sensors and / or the speed sensor signals are detected by means of speed sensors and / or the displacement sensor signals are detected by means of displacement sensors. the acceleration sensors, the speed sensors and / or the

Displacement sensors are calibrated once or repeatedly.

the acceleration sensor signals by means of the speed sensor signals be plausibilized by comparing an object velocity calculated from the object accelerations a, a1, a2 with the speed detected by means of the velocity sensors or by means of the velocity calculated from the displacement sensor signals.

18.) a mutual plausibility check of all existing speed sensors, or displacement sensors and acceleration sensors is performed.

19.) for the error checking predetermined tolerance bands are used, wherein errors based on a positioning of the object accelerations a, al, a2 and / or the object speeds v, vi, v2 a2 and / or the object paths s, sl, s2 within and / or outside of the Tolerance bands are detected.

20.) the tolerance bands specified for the error check are only used if malfunctions of redundant sensors can be excluded.

Preferred electronic control devices 11 for surveying object speeds v, vi, v2 and object accelerations a, a1, a2 comprise, for example, a first electronic arithmetic unit 15 or corresponding first processors 30, which performs sensor output information evaluation and, depending on a result of the sensor output information evaluation, a reduction of a drive torque and / or a shutdown of the drive torque and / or an activation of a braking device initiates, wherein the control device 11 performs a method as in the preceding examples 1 to 20 or a combination of these examples.

It further preferably comprises a second electronic calculating unit 16 or second processor 36, which exchanges information with the first calculating unit or processor. Preferably, the second arithmetic unit 16, or the second processor 36, also performs a sensor output information evaluation and she or he derives depending on the result of S oror output information evaluation, the reduction of the drive torque and / or stopping the drive torque and / or the activation of the braking device ,

As shown in Figure 4, the electronic control unit (ECU) 1 1 in a Elevator installation, preferably mounted on the elevator car 40 to monitor their driving movements. In the example, the elevator car is supported and moved by means of suspension 41. The support means 41 are fixedly suspended at one end, for example in a building structure (not shown) attached. At the other end they are movable by a drive means, which is indicated by double arrows in the figure 4. The support means are performed under the elevator car 40, wherein they are deflected by support rollers 43.1, 43.2, 43.3, 43.4. The elevator car is guided by means of guide rails 42. In the example, a respective suspension element is arranged on both sides of a guide plane determined by the guide rails 42. As a result, a symmetrical carrying the elevator car 40 is possible. Of course, a required number of support means 41 results from a required load and structural design of the elevator system. In the example, the electronic control device (ECU) 11 is associated with one of the support rollers 43.1, that is, an incremental encoder for detecting the path s of the elevator car is removed directly from a rotational movement of the support roller 43.1. The ECU 11 is implemented as explained in the preceding examples. Thus, the travel movements of the elevator car 40 can be safely and cost-optimally monitored. Driving the idlers is ensured by the high load capacity, which is transmitted by means of the support roller to the cabin. In addition, of course, another ECU 11.1 or at least some of the redundant sensors on another, preferably not driven by the same support means, support roller 43.3 are arranged (shown in dashed lines in Figure 4). Thus, the security can be additionally increased because, for example, a flaccid, single support means can lead to a movement disorder on the corresponding support roller, which can be detected by the complementary comparison routines. These comparison routines may be integrated into one of the ECU 11 or ECU 1.1 or a complementary comparison box may be provided.

The at least one acceleration sensor 12, 13 is preferably structurally integrated into an enclosure of the control device 11. A division of the sensors to different microprocessors and sub-processors can be selected by the expert.

Claims

claims

1. A method for monitoring travel movements (s, sl, s2, v, vi, v2, a, a1, a2) of an elevator car, wherein the travel movements through paths (s, sl, s2), speeds (v, vi, v2) or accelerations (a, al, a2) of the elevator car are determined, wherein at least the paths (s, sl, s2), or the speeds (v, vi, v2) or the accelerations (a, al, a2) are detected redundantly, characterized in that the paths (s, sl, s2) or the velocities (v, vi, v2) are redundant and the accelerations (a, al, a2) are simply detected, or

the accelerations (a, al, a2) are redundant and the paths (s, s l, s2) or the velocities (v, vi, v2) are simply detected, or

the paths (s, sl, s2) or the speeds (v, vi, v2) and the accelerations (a, al, a2) are detected redundantly.

2. The method according to claim 1, characterized

by means of an integral rule from the accelerations (a, a1, a2) the speeds (v ( _a ), V _(a) 1, V _(a) 2) and / or the paths (s ( _a ), S _(a) l , S _(a) 2), and / or

that by means of a differentiation rule from the paths (s, sl, s2) the speeds (( _S ), V _(S) 1, V _(S) 2) and / or the accelerations (a _(s) , a _(s) l, a _(s) 2), and / or

in that the accelerations (a _(v) , a _(v) 1, a _(v) 2) are calculated by means of a differentiation rule from the velocities (v, vi, v2).

3. The method according to claim 1 or 2, characterized

an error check is carried out by means of error-classification algorithms which show a behavior of the redundantly detected or calculated paths (s, sl, s2, s _(a) , s _(a) 1, s _(a) 2) or velocities (v, vi, compare v2, V ( _a ), V _(a) 1, V _(a) 2, V ( _S ), V _(S) 1, V _(S) 2) and the detected accelerations (a, al, a2), and or

in that a plausibility check is carried out by means of a comparison of the redundantly detected paths (s, sl, s2) or of the redundantly detected or calculated speeds (v, vi, v2, V ( _a ), V _(a) 1, V _(a) 2, V ( _S ), V _(s) 1, V _(s) 2) or the redundantly detected accelerations (a, a1, a2), the detected movements being recognized as plausible if the condition | a1-a2 | <ε or | vl - v2 | < _z \ or | sl - s2 | < _ε 2 is satisfied, where ε, εΐ and ε2 maximum amounts of a permissible difference.

4. The method according to any one of claims 2 or 3, characterized in that the detected acceleration (a, al, a2) by means of the detected speed (v, vi, v2) are plausibilized by one of the accelerations (a, al, a2 calculated velocity ( _(a) , V _(a) 1, V _(a) 2) is compared with the detected velocity (v, vi, v2), or

in that the detected acceleration (a, a1, a2) is plausibilized by means of the detected paths (s, s1, s2) by calculating a speed (v _(a) , V _(a) l calculated from the accelerations (a, a1, a2) , V _(a) 2) is compared with the velocity (v _(S) , V _(S) 1, V _(S) 2) calculated from the detected paths (s, sl, s2).

5. The method according to any one of claims 1 to 4, characterized in that the accelerations (a, al, a2) are compared in a first activation stage with a threshold value for the acceleration and on exceeding the threshold value for the acceleration adjustment and / or shutdown of the drive torque is made or when the acceleration threshold is exceeded, a braking function is activated.

6. The method according to any one of claims 1 to 5, characterized in that the detected or calculated speeds (v, vi, v2, V ( _a ), V _(a) l, V _(a) 2, V ( _S ), V _(S) 1, _(S) 2) are compared in a second Activationstufe with a threshold for the speed and when the threshold value for the speed adjustment and / or shutdown of the drive torque is made or when exceeding the threshold for the speed of a brake function is activated.

7. The method according to any one of claims 1 to 6, characterized in that the accelerations (a, al, a2) are detected by means of acceleration sensors, and

the speeds (v, vi, v2) are detected by means of speed sensor signals, preferably by means of tachogenerators, and / or

the paths (s, sl, s2) are detected by means of displacement sensor signals, preferably by means of an incremental sensor.

8. Electronic control device (11) for monitoring travel movements (s, sl, s2, v, vi, v2, a, a1, a2) of an elevator car, the travel movements being represented by paths (s, sl, s2), speeds (v, vi, v2) or accelerations (a, al, a2) of the elevator car are determined, comprising a first electronic calculating unit or processor (15, 30), which performs sensor output information evaluation and depending on a result of the sensor output information evaluation, an adjustment of a drive torque and / or a shutdown the drive torque and / or activation of a braking device of the elevator car initiates, characterized

in that the control device (11) carries out a method according to at least one of claims 1 to 7.

9. Control device according to claim 8, characterized in that

in that the control device (11) can be attached to the elevator car and the control device can actuate a brake device arranged on the elevator car.

10. Control device according to one of claims 7 or 8, characterized in that the control device (11) comprises a second electronic arithmetic unit or processor (16, 36) which exchanges information with the first arithmetic unit or processor (15, 30), wherein the second arithmetic unit or processor (16, 36) also performs a Sensorausgangsinformationsauswertung and depending on the result of the sensor output information evaluation, the adjustment of the drive torque and / or stopping the drive torque and / or the activation of the brake device of the elevator car initiates.

11. Control device according to one of claims 9 to 10, characterized in that the at least one acceleration sensor (12, 13) structurally integrated into an enclosure of the control device (11)

12. elevator car with a braking device and with a control device (11) according to one of claims 8 to 11, wherein the elevator car (40) at least a first guide roller (43.1) includes and at least a first support means (42) by means of the first Deflection pulley (43.1) carries the elevator car (40), and wherein the first deflection roller (43.1) includes a first speed sensor, preferably a first tachogenerator, for generating a first speed sensor signal or a first displacement sensor, preferably a first incremental sensor, for generating a first displacement sensor signal or drives.

13. Elevator car according to claim 12, wherein the elevator car (40) at least one second guide roller (43.2, 43.3, 43.4) includes and the first support means or a second support means by means of the second guide roller (43.2, 43.3, 43.4) carries the elevator car (40) , and wherein the second deflection roller (43.2, 43.3, 43.4) includes a second control device (11.1) or a second speed sensor, preferably a second tachogenerator, for generating a second speed sensor signal or a second position sensor, preferably a second incremental sensor, for generating a second position sensor signal or drives.

14. Elevator car according to one of claims 12 or 13, wherein the first speed sensor or the first displacement sensor connected to a first arithmetic unit or processor and connected in an embodiment according to claim 13, the second speed sensor or the second displacement sensor to a second arithmetic unit or processor, wherein the first and, if necessary, the second arithmetic unit or processor with a first, or a second acceleration sensor, for detecting accelerations (a, al, a2) is connected.