EP2807103B1 - Safety device and control method for a lift system - Google Patents

Description

• The invention relates to a method for monitoring travel movements of an elevator car, an electronic control device for monitoring travel movements of an elevator car and an elevator car with a corresponding control device.
• Dynamically moving objects, such as elevators in the present embodiment, or elevator cars, may generally not exceed predetermined accelerations and speeds for safety reasons, since otherwise injuries to the transported people as well as damage to the moving object itself can no longer be ruled out. Therefore, usually adapted to the object control device is provided which detects an excessive acceleration and the drive torque correspondingly reduced or activated at too high speeds a braking function.
• On the one hand, mechanical devices are known from the prior art in this connection, which activate an emergency brake system at high speeds. Likewise, electronic control devices are known which initiate a drive torque reduction or a brake function on the basis of a detected acceleration or speed sensor signal. For safety reasons, two different physical sensor sizes are often used to determine the speed or acceleration. In addition, it is known to additionally calculate an acceleration by means of the speed sensor signal, and conversely additionally to calculate a speed by means of the acceleration sensor signal.
• Out WO 2007/145613 A2 is a method for monitoring driving movements of an elevator car according to the prior Tecknik known.
• Of importance in such electronic control devices is that the detection of exceeding a safety-critical threshold is done quickly enough to prevent the occurrence of a risk of injury or damage appropriate countermeasures (eg drive torque reduction or activation of a Braking function) to initiate reliable. This is particularly important when used in elevators, as in this case, for example in the case of failure of suspension elements, free fall conditions can occur, which can lead to a rapid increase in a fall speed. The detection of exceeding the safety-critical threshold value is often combined with a plausibility check of the sensor signals and with electrical monitoring.
• lange Fehlererkennungszeiten und Plausibilisierungszeiten aufgrund vorausgehender (modellbasierter) Umrechnung des Beschleunigungssensorsignals in ein Geschwindigkeitssignal beziehungsweise umgekehrt,
• hohe Fehlererkennungsschwellen und damit spätes Einleiten notwendiger Gegenmassnahmen im Falle zu grosser Beschleunigung beziehungsweise zu grosser Geschwindigkeit und
• hoher Applikationsaufwand bei der Kalibrierung der Sensoren sowie der (modellbasierten) Umrechnungsalgorithmen.
Known plausibility checks of the acceleration sensor and the speed sensor signal are disadvantageous for the following reasons:
• long error detection times and plausibility times due to prior (model-based) conversion of the acceleration sensor signal into a speed signal or vice versa,
• high error detection thresholds and thus late initiation of necessary countermeasures in case of too high acceleration or too high speed and
• high application costs in the calibration of the sensors as well as the (model-based) conversion algorithms.
• According to an inventive idea it is therefore proposed to use at least two acceleration sensor signals and at least one speed sensor signal or one displacement sensor signal simultaneously for the plausibility check. Alternatively, at least one acceleration sensor signal and at least two speed sensor signals or two position sensor signals are used simultaneously for the plausibility check or at least two acceleration sensor signals and at least two speed sensor signals or two displacement sensor signals are used simultaneously for the plausibility check.
• This allows both a substantially fast error detection of a sensor signal and a substantially rapid initiation of a countermeasure when detecting an excessive speed or an excessive acceleration.
• Preferably, the motion quantities used are continuously subjected to a plausibility check and / or an error check. Thus autonomously operating devices can be created that can safely monitor travel movements.
• The respective sensor signals are preferably evaluated in an electronic control device (ECU). The ECU is advantageously arranged on the dynamically moving object, or on the elevator car.
• The elevator car is usually carried by suspension means. The support means are guided over pulleys, which are arranged on the elevator car. Thus, a required load capacity in the support means, according to a determined by an arrangement of the pulleys Umhängefaktor be reduced. Preferably, at least the speed sensors or displacement sensors for detecting the speed sensor signals or the displacement sensor signals are assembled with these deflection rollers or integrated in these. The pulleys are safely driven by the support means because of the high load and the corresponding speed sensor signals or Wegsensorsignale are correspondingly accurate and secure.
• Preferably, the electronic control device (ECU), or its processor unit with arithmetic unit for evaluating the detected speed sensor signals or path sensor signals, is also arranged in the immediate vicinity of the Ünlenkrollen. If necessary, sensor parts, for example an incremental sensor for detecting increment markings of the deflection roller, are arranged directly on a circuit board of the processor unit. Preferably, an acceleration sensor, or the redundant acceleration sensors, for detecting the acceleration sensor signals may also be arranged on this board. Thus, an entire error and plausibility check at the place of detection of the corresponding signals can be made.
• Preferably, in an elevator car with several pulleys, at least two pulleys are equipped with a corresponding processor unit with arithmetic unit . Thus, individual measured variables can be exchanged for error and plausibility checks or results of the individual arithmetic units can be compared.
• The inventive method preferably comprises a first activation stage, which allows a reduction, or an adjustment of the drive torque of the dynamically moving object, or the elevator car. To Advantageously, two acceleration sensors are used, which are preferably structurally integrated into the ECU, as described above. The monitoring of the two acceleration sensor signals a1 and a2 takes place for example by means of comparison of the two acceleration sensor signals. If the two acceleration signals are substantially the same, reliable values are available. Essentially the same can be determined by the inequality | a1 - a2 | <ε be judged. Is the amount | a1 - a2 | above a predetermined threshold ε, one of the two sensor signals is faulty. Once such an error is detected, for example, a warning signal is generated, on the basis of which, for example, a check can be made. Is the amount | a1 - a2 | however, below the predetermined threshold value ε, an acceleration can be reliably monitored with the acceleration sensor values. If the measured acceleration exceeds a predetermined threshold value for the acceleration, a safety information occurs due to which at most an adaptation of the drive torque can initially take place. The adaptation may be a reduction or an increase of the drive torque depending on a loading state and direction of travel of the elevator car. In many cases, however, this adaptation or regulation of the drive torque is perceived by a separate, a drive of the elevator car associated with, drive control, whereby this first activation stage can also be omitted. Regardless, of course, the measured values of the sensor signals for a drive control, for shaft information or for other driving information, the control of the entire elevator can be provided.
• A plausibility check of the acceleration signals with the speed signal or path signal can be carried out as previously carried out by direct comparison or by converting the other quantities of motion. This plausibility check preferably serves for the general monitoring of the sensor signals.
• Preferably, the at least two acceleration signals are evaluated directly and without previous conversion or processing. This results in the advantage that very sensitively and quickly on a speed change of the dynamically moving object, or the elevator car, can be concluded, since already the tendency to high speed is detected and the drive torque can be adjusted accordingly early.
• In the following, the term object is understood to mean the elevator car. A Object movement is thus an elevator car movement or an object speed is an elevator car speed, etc.
• A threshold value for the acceleration, at which an adaptation of the drive torque or a shutdown of the drive torque occurs, is preferably predetermined in such a way that an allowable maximum acceleration is previously exceeded. The measured acceleration must therefore be above the permissible acceleration in order to reduce or switch off the drive torque.
• Advantageously, when the security information is output, a second activation stage is additionally provided, which is preferably independent of the first activation stage. The second activation stage activates at least one brake device (e.g., an emergency brake system) and / or shuts off the drive torque. This is advantageously carried out on the basis of an excessively high actual speed v, possibly additionally combined with at least one too high actual acceleration a1, or a2. The checking of the sensor signals and their plausibility is preferably carried out as previously described.
• The already described acceleration monitoring on exceeding a threshold acceleration makes it possible to detect a multiplicity of faulty operating conditions, but not all faulty operating conditions. In particular, accelerations below the threshold acceleration can likewise lead to safety-critical exceedances of the threshold speed. Such threshold speed overshoots can be detected by monitoring a speed value.
• For example, as the speed value, the speed calculated from the acceleration sensor signal becomes low $$\mathrm{Va}=\mathrm{F}\left(\mathrm{a}\mathrm{1}.\mathrm{a}\mathrm{2}\right)$$

  

  where F is a suitably chosen calculation rule of the time-dependent accelerations a1, or a1 and a2. F is preferably an integral rule. This results in the advantage that the first and the second activation stage based on the same sensor signal (advantageously the acceleration) and thereby according to the first activation stage and the the second activation level. A plausibility check and thus monitoring of the speed value obtained from the acceleration sensors with the speed sensor signal V preferably takes place via the relationship $$\left|\mathrm{Va}-\mathrm{V}\right|<\mathrm{\epsilon }\mathrm{1.}$$

  
• Alternatively, the plausibility check and thus monitoring of the speed value obtained from the acceleration sensors can also take place with the displacement sensor signal s. In this case, the speed sensor signal V from the travel sensor signal s is preferably calculated via a differentiation rule D as follows $$\mathrm{V}=\mathrm{D}\left(\mathrm{s}\right).$$

  

  The plausibility check and thus the monitoring of the speed value obtained from the acceleration sensors with the displacement sensor signal s is thus preferably effected via the relationship $$\left|\mathrm{Va}-\mathrm{V}\right|<\mathrm{\epsilon }\mathrm{1}.\mathrm{respectively}\left|\mathrm{Va}-\mathrm{D}\left(\mathrm{s}\right)\right|<\mathrm{\epsilon }\mathrm{1.}$$

  
• If the threshold value ε1 is exceeded, then the sensor signals are no longer plausible and the system must be transferred directly to a safe state in an emergency.
• Thus, the speed sensor signal or the displacement sensor signal preferably has the task of monitoring the speed signal calculated from the acceleration sensor signals. By converting the acceleration sensor signals on the speed signal and the possibly continuous conversion of the displacement sensor signals in the speed signal, a direct speed comparison can be performed. By filtering the signals and (model-based) conversion of the signal values, however, a time delay can occur here in comparison to purely acceleration-sensor-based monitoring. Fast motion changes are thus safely detected by monitoring the acceleration value, and slow motion changes can be detected by monitoring the speed value.
• Is characterized by the monitoring of the threshold value ε for the threshold acceleration from a faulty behavior of the sensors, it can by the use of three sensors ( two acceleration sensors and a Speed sensor or a displacement sensor), yet fault tolerance can be maintained. In addition, the following conversion is preferably carried out: $$\mathrm{Va}1=\mathrm{F}\left(\mathrm{a}\mathrm{1}\right)\mathrm{and\; Va}2=\mathrm{F}\left(\mathrm{a}\mathrm{2}\right)$$

  

1. 1) Liegen Va1 und V in einem vorgegebenen Toleranzband, Va2 und V hingegen ausserhalb des vorgegebenen Toleranzbands, so ist a2 fehlerhaft.
2. 2) Liegen Va2 und V in einem vorgegebenen Toleranzband, Va1 und V hingegen ausserhalb des vorgegebenen Toleranzbandes, so ist a1 fehlerhaft.
3. 3) Liegen a1 und a2 in einem vorgegebenen Toleranzband, Va1 und V sowie Va2 und V hingegen ausserhalb des vorgegebenen Toleranzbandes, so ist V fehlerhaft.

Advantageously, the following cases are distinguished:

1. 1) If Va1 and V lie within a specified tolerance band, whereas Va2 and V are outside the specified tolerance band, then a2 is faulty.
2. 2) If Va2 and V are within a specified tolerance band, whereas Va1 and V are outside the specified tolerance band, then a1 is faulty.
3. 3) If a1 and a2 are within a specified tolerance band, Va1 and V and Va2 and V are outside the specified tolerance band, V is faulty.

This case distinction is preferably carried out when common-cause errors (so-called common-cause errors) of the redundantly present sensors can be excluded. If this is not ruled out, then about a1 and a2 could deliver values within a predefined tolerance band due to unrecognized common deviations from an initial calibration, but Va1 and V as well as Va2 and V are each outside the specified tolerance band. In this case, it would not be V, but a1 and a2 would be flawed. Therefore, per se known error system algorithms are preferably executed to detect common cause errors of (any) two of the three sensors, or different sensor makes are used to exclude common cause based errors.

Such or generic error handling makes it possible to maintain a basic functionality despite a detected error until the end of a maintenance interval appropriate to the particular application. This can also provide an improved diagnosis (eg whether a speed sensor or an acceleration sensor needs to be replaced). For example, a detection of a faulty sensor may trigger a maintenance request.

Furthermore, it is possible and preferred that speed sensor signals be used to calculate an acceleration signal. In this case, instead of a Integral specification preferably uses a differentiation rule for calculating the acceleration signal from the speed sensor signal. The described processing and use of the speed signals and the acceleration signals is correspondingly reversed.

Preferably, instead of fixed threshold values, it is also possible to work with dynamic threshold values. The threshold values in this case are dependent on the respective operating conditions of the object, e.g. the speed of the object or even a distance of the object to an obstacle or a track end.

Furthermore, it is preferred that the sensors are subjected to a calibration method which is known per se once prior to their use, at defined time intervals during their use, irregularly or as required. A self-regulating calibration method is possible and preferred. Likewise, any combinations of said calibration methods are possible and preferred.

Preferably, a mutual monitoring of all sensors used with each other takes place.

Preferably, the safety device according to the invention is also used for applications in which a minimum acceleration or minimum speed is generally required, so that if the minimum acceleration or the minimum speed are not adhered to, suitable safety measures can also be initiated.

Further preferred embodiments will become apparent from the subclaims and the following description of exemplary embodiments with reference to figures.

Figur 1

einen schematischen Aufbau einer Sicherheitsvorrichtung,

Figur 2

einen ersten beispielhaften Ablauf des Verfahrens zur Überwachung von Fahrbewegungen einer Aufzugskabine,

Figur 3

einen weiteren beispielhaften Ablauf des Verfahrens zur Überwachung von Fahrbewegungen einer Aufzugskabine, und

Figur 4

eine schematische Ansicht einer Aufzugskabine mit einer Sicherheitsvorrichtung.

Show it:

FIG. 1

a schematic structure of a safety device,

FIG. 2

a first exemplary sequence of the method for monitoring travel movements of an elevator car,

FIG. 3

a further exemplary sequence of the method for monitoring travel movements of an elevator car, and

FIG. 4

a schematic view of an elevator car with a safety device.

Equivalent parts and functions are provided with the same reference numerals.

In FIG. 1 an electronic control device 11 (ECU 11) is shown, which includes acceleration sensors 12 and 13 and a speed sensor 14 or a displacement sensor 14.1. The ECU 11 is part of the control electronics of an electrically operated elevator, or an elevator car. The acceleration sensors 12 and 13 are disposed directly in the ECU 11, while the speed sensor 14 or the displacement sensor 14.1 is located outside the ECU 11 and continues only a speed sensor signal v or a displacement signal s to a first microprocessor 16 in the ECU 11. If necessary, the first microprocessor 16 calculates the speed sensor signal v from the path signal s.

A second microprocessor 15 receives the acceleration sensor signals a1 and a2 from the acceleration sensors 12 and 13 and checks them for plausibility. At the same time, the second microprocessor 15 calculates a speed Va1 from the acceleration sensor signals a1 and a2 by means of an integral rule and executes an error system algorithm in order to detect any common cause errors of the acceleration sensors a1 and a2.

The speed Va1 is output to the first microprocessor 16, which compares the speed Va1 with the speed v and thus checks for plausibility. In addition, the first microprocessor 16 calculates an acceleration av by means of a differentiation rule and forwards the acceleration av to the second microprocessor 15. The second microprocessor 15 now compares the acceleration av with the acceleration sensor signals a1 and a2 for plausibility. If a faulty sensor is detected on the basis of the plausibility analysis, a corresponding warning signal W can be generated, or the elevator car can be shut down, for example after completion of a drive cycle.

Further, the second microprocessor 15 and the first microprocessor 16 constantly compare the acceleration values av, a1 and a2 and the velocity values v and Va1 with predetermined threshold values. The second microprocessor 15 compares the values a1, a2 and av with predetermined threshold values while the first microprocessor 16 compares the values va1 and v with predetermined threshold values. If one of the values av, a1, a2, v or va1 exceeds a predetermined threshold and a sensor error is excluded, or a faulty signal can not be identified beyond doubt, a safety information Sk for reducing the drive torque, or for initiating a braking process, of the one Microprocessor output, which has detected the exceeding of the threshold.

Exceeding the threshold usually leads in a first activation stage to a reduction of the drive torque or to a controlled shutdown of the elevator car, while exceeding the threshold in a second activation stage leads to the initiation of a braking operation.

If necessary, the second microprocessor 15 is subdivided into a first partial processor 15.1 and a second partial processor 15.2, so that an evaluation and comparison in connection with the one acceleration sensor 12 is perceived by the first partial processor 15.1 and an evaluation and comparison in connection with the other acceleration sensor 13 is perceived by the second part processor 15.2. As a result, any errors in the area of the processors can be detected.

Preferably, the second microprocessor 15 processes sensor output information of at least one acceleration sensor 12, 13, and the second electronic calculating unit 16 evaluates sensor output information of at least one speed sensor 14 or a displacement sensor 14.1.

In FIG. 2 is a possible flow of a process in the form of a flow chart to see. In method step 21, the acceleration value a1 is read. Regardless of this, two speed values v1 and v2 are read in at the same time in method step 22. In step 24, a comparison of the acceleration value a1 with a predetermined acceleration threshold a takes place. If the acceleration value a1 exceeds the predetermined acceleration threshold value as, corresponding safety information Sk is output, and accordingly, the driving torque which causes the acceleration is reduced or braking is initiated. If the acceleration value a1 does not exceed the predefined acceleration threshold, no further reaction takes place in step 24. Simultaneously with step 24, in step 23, the Acceleration value a1 converted by means of an integral validation in the speed value Va. In method step 25, a plausibility check and error check of the read speed values v1 and v2 takes place. If the speed values v1 and v2 are plausible and no error is detected, the process continues in steps 26 and 27. Otherwise, for example, the warning signal W is output.

In method step 26, a comparison is made of speed values v1 and v2 with a threshold value vs for the speed. If at least one of the speed values v1 or v2 exceeds the predetermined threshold value vs for the speed, the safety information Sk is output and, accordingly, the drive torque that drives the elevator car is adjusted or a braking operation is initiated. If none of the speed values v1 and v2 exceeds the preset threshold value for the speed, no further reaction takes place. At the same time, in step 27, speed values v1 or v2 are converted into a mean acceleration a by means of a differentiation rule. Finally, in method step 28, a plausibility check and error check are carried out on the speed values v1 and v2 read in step 22 with the speed value Va calculated in step 23. In parallel, in step 29, a plausibility check and error check is performed on the acceleration value a1 read in in step 21 and on the in Step 27 calculated acceleration value a performed. If an implausibility or an error is detected in one of the steps 28 and 29, a corresponding warning signal W is output and the elevator car is shut down immediately or after completion of the drive cycle.

In FIG. 3 an alternative or supplementary variant of a possible sequence of a method is shown. The ECU 11 is composed of a first microprocessor 30 and a second microprocessor 36. The acceleration sensors 12 and 13 are associated with the first microprocessor 30, and the speed sensor 14 or the displacement sensor 14.1 is associated with the second microprocessor 36.

In a first step 31.1, 31.2, in the first microprocessor 30, the acceleration sensor signals a1 and a2 of the two acceleration sensors 12 and 13 are compared with an acceleration threshold value as. If one of the two acceleration sensor signals exceeds the threshold value, ie a1, or a2> (greater than) as is , the safety information sk is output and Accordingly, the drive torque, which drives the elevator car, adapted or a braking operation is initiated.

In a further step 32.1, 32.2, a plausibility check and error check of the read-in acceleration sensor signals a1 and a2 takes place. If the acceleration sensor signals a1 and a2 are plausible, that is, if a difference of the two values lies below an error threshold value ε and thus no error is detected, a status signal is set to ok. Otherwise, the warning signal W is output. Thus, for example, a service is requested, or depending on further, later described assessments, the elevator system continues to operate, shut down or operated only in a reduced mode.

In another step 33.1, 33.2, the acceleration sensor signals a1 and a2 are converted into speed values Va1 and Va2 by means of an integral function, Va1,2 = Fa1,2, and these calculated speed values Val and Va2 are compared with each other in steps 34.1, 34.2. If a difference between the two acceleration sensor signals a1 and a2 is below an error threshold value ε, the status signal is set to ok. Otherwise, the warning signal W is output. Of course, the error threshold ε is related in each case to the values to be compared, such as speed, acceleration, etc.

Furthermore, in a next step 35.1, 35.2 the speed values Val and Va2 are compared with a speed threshold value Vs. If one of the two speed values exceeds the speed threshold value Vs, ie Va1 or Va2> (greater than) Vs, the safety information sk is output.

Preferably, the first microprocessor 30 is divided into two sub-processors 30.1 and 30.2, wherein the two acceleration sensors 12 and 13 are divided between the two sub-processors 30.1, 30.2. The two sub-processors can execute the comparison and calculation steps in parallel, with which any processor errors can be detected. The plausibility check and error check in steps 32.1, 32.2 and 34.1, 34.2 can also be performed mutually redundantly in the two sub-processors 30.1, 30.2, or they can be adopted by one of the sub-processors.

In the second processor 36, the speed sensor signal V of the speed sensor 14 is detected or detected. In an alternative (shown in dashed lines), a speed value V is detected, for example by means of a tachometer. Preferably, however, a displacement sensor 14.1 is used which, for example, detects a path difference s by means of path increments, from which the velocity value V is derived or determined by means of a calculation routine 14.2.

In a test step 39, the speed value V is further compared with a speed threshold value Vs. If the speed value V exceeds the threshold value, ie V> (greater than) Vs, the safety information sk is output.

Furthermore, in a comparison step 37, on the one hand, it is checked whether the status signals of the plausibility checking and error checking steps 32.1, 32.2, 34.1, 34.2 are set to ok by the first microprocessor, or whether a warning signal W was output. Further, the speed value V is compared with the speed values Va1 and Va2 calculated by the first microprocessor 30. If a difference of the respective calculated speed values Va1 and Va2 to the speed value V is below an error threshold value ε, the status signal is set to ok. Otherwise, the warning signal W is output.

If it is determined in comparison step 37 that all the status signals of the plausibility check and error checking steps 32.1, 32.2, 34.1, 34.2 and 37 are set to ok, the monitoring device or the electronic control device 11 continues to operate. Otherwise, another error analysis 38 is started.

If, according to step 38.1 of the error analysis 38, the speed values Va2 and V in the predetermined tolerance band, Va1 and V outside the predetermined tolerance band, it can be determined that the acceleration sensor signal a1 or the associated calculation routine is faulty.

If, according to step 38.2, the speed values Va1 and V in the predetermined tolerance band, Va2 and V are outside the predetermined tolerance band, it can be determined that the acceleration sensor signal a2 or the associated calculation routine is faulty.

However, according to step 38.3, the acceleration sensor signals a1 and a2 are in given tolerance band but the speed comparison values Va2 to V and Va1 to V, however, outside the specified tolerance band, it can be determined that the speed signal V or possibly the associated calculation routine is faulty.

Thus, the faulty signal can be specifically determined and a service technician can quickly replace the affected component. During an operating time until replacement of the component, the faulty signal can be suppressed or temporarily replaced by one of the two intact signals.

1. 1.) zumindest die Objektwege s, s1, s2, die Objektgeschwindigkeiten v, v1, v2 oder zumindest die Objektbeschleunigungen a, a1, a2 redundant erfasst werden.
2. 2.) die Objektwege s, s1, s2 redundant und die Objektbeschleunigungen a, a1, a2 einfach erfasst werden oder
   die Objektgeschwindigkeiten v, v1, v2 redundant und die Objektbeschleunigungen a, a1, a2 einfach erfasst werden oder
   dass die Objektbeschleunigungen a, a1, a2 redundant und die Objektgeschwindigkeiten v, v1, v2 oder die Objektwege s, s1, s2 einfach erfasst werden.
3. 3.) die Objektwege s, s1, s2 und/oder die Objektgeschwindigkeiten v, v1, v2 und/oder die Objektbeschleunigungen a, a1, a2 einer Plausibilitätsprüfung und/oder einer Fehlerprüfung unterzogen werden.
4. 4.) die Objektwege s, s1, s2 oder die Objektgeschwindigkeiten v, v1, v2 oder die Objektbeschleunigungen a, a1, a2 als plausibel erkannt werden, wenn die Bedingung |a1 - a2| < ε oder |v1 - v2| < ε1 oder |s1 - s3| < ε1 erfüllt ist, wobei ε, ε1und ε2 Maximalbeträge einer zulässigen Differenz sind.
5. 5.) die Fehlerprüfung mittels Fehlersystematik-Algorithmen ausgeführt wird, welche das Verhalten der redundant erfasster Objektwege s, s1, s2, Objektgeschwindigkeiten v, v1, v2 oder der redundant erfassten Objektbeschleunigungen a, a1, a2 untereinander oder deren errechnete gleichartige Werte zueinander vergleichen.
6. 6.) mittels Integralvorschriften aus den Objektbeschleunigungen a, a1, a2 Objektgeschwindigkeiten v, v1, v2 und/oder Objektwege s, s1, s2 errechnet werden.
7. 7.) mittels einer Differenziervorschrift aus den Objektwegen s, s1, s2 Objektgeschwindigkeiten v, v1, v2 und/oder Objektbeschleunigungen a, a1, a2 errechnet werden.
8. 8.) die Objektbeschleunigungen a, a1, a2 in einer ersten Aktivierungsstufe mit einem Schwellenwert für die Beschleunigung verglichen werden und bei Überschreiten des Schwellenwerts für die Beschleunigung eine Anpassung und/oder Abstellung des Antriebsmoments vorgenommen oder eine Bremsfunktion aktiviert wird.
9. 9.) die Objektgeschwindigkeiten v, v1, v2 in einer zweiten Aktvierungsstufe mit einem Schwellenwert für die Geschwindigkeit verglichen werden und bei Überschreiten des Schwellenwerts für die Geschwindigkeit eine Anpassung und/oder Abstellung des Antriebsmoments vorgenommen oder eine Bremsfunktion aktiviert wird.
10. 10.) die Objektgeschwindigkeiten v, v1, v2 in der zweiten Aktivierungsstufe aus den Objektbeschleunigungen a, a1, a2 errechnet werden.
11. 11.) die Objektbeschleunigungen a, a1, a2 mittels Beschleunigungssensorsignalen erfasst werden.
12. 12.) die Objektgeschwindigkeiten v, v1, v2 mittels Geschwindigkeitssensorsignalen, beispielsweise von Tachogeneratoren erfasst werden und / oder die Objektwege s, s1, s2 mittels Wegsignalen, wie von Inkrementalsensoren oder Encodern erfasst werden.
13. 13.) die Beschleunigungssensorsignale und/oder die Geschwindigkeitssensorsignale und/oder die Wege ohne vorausgehende Bearbeitung und/oder Filterung und/oder Umrechnung direkt ausgewertet werden.
14. 14.) der Schwellenwert für die Objektbeschleunigungen a, a1, a2 oberhalb einer objektabhängigen zulässigen Maximalbeschleunigung liegt und der Schwellenwert für die Objektgeschwindigkeiten v, v1, v2 oberhalb einer objektabhängigen zulässigen Maximalgeschwindigkeit liegt.
15. 15.) die Beschleunigungssensorsignale mittels Beschleunigungssensoren erfasst werden und/oder die Geschwindigkeitssensorsignale mittels Geschwindigkeitssensoren erfasst werden und/oder die Wegsensorsignale mittels Wegsensoren erfasst werden.
16. 16.) die Beschleunigungssensoren, die Geschwindigkeitssensoren und/oder die Wegsensoren einmalig oder wiederholt kalibriert werden.
17. 17.) die Beschleunigungssensorsignale mittels der Geschwindigkeitssensorsignale plausibilisiert werden, indem eine aus den Objektbeschleunigungen a, a1, a2 errechnete Objektgeschwindigkeit mit der mittels der Geschwindigkeitssensoren erfassten Geschwindigkeit oder mittels der aus den Wegsensorsignalen berechneten Geschwindigkeit verglichen wird.
18. 18.) eine gegenseitige Plausibilisierung aller vorhandenen Geschwindigkeitssensoren, oder Wegsensoren und Beschleunigungssensoren durchgeführt wird.
19. 19.) für die Fehlerprüfung vorgegebene Toleranzbänder verwendet werden, wobei Fehler anhand einer Positionierung der Objektbeschleunigungen a, a1, a2 und/oder der Objektgeschwindigkeiten v, v1, v2 a2 und/oder der Objektwege s, s1, s2 innerhalb und/oder ausserhalb der Toleranzbänder erkannt werden.
20. 20.) die für die Fehlerprüfung vorgegebenen Toleranzbänder nur dann verwendet werden, wenn Fehlfunktionen von redundant vorhandenen Sensoren ausgeschlossen werden können.

Preferred methods for monitoring object paths s, s1, s2, object speeds v, v1, v2 and object accelerations a, a1, a2 are thus characterized by the fact that, in accordance with the illustrated embodiments

1. 1) at least the object paths s, s1, s2, the object speeds v, v1, v2 or at least the object accelerations a, a1, a2 are detected redundantly.
2. 2.) the object paths s, s1, s2 are redundant and the object accelerations a, a1, a2 are simply detected or
   the object speeds v, v1, v2 are redundant and the object accelerations a, a1, a2 are simply detected or
   the object accelerations a, a1, a2 are redundant and the object speeds v, v1, v2 or the object paths s, s1, s2 are simply detected.
3. 3.) the object paths s, s1, s2 and / or the object speeds v, v1, v2 and / or the object accelerations a, a1, a2 are subjected to a plausibility check and / or an error check.
4. 4.) the object paths s, s1, s2 or the object velocities v, v1, v2 or the object accelerations a, a1, a2 are recognized as plausible if the condition | a1 - a2 | <ε or | v1 - v2 | <ε1 or | s1 - s3 | <ε1 is satisfied, where ε, ε1 and ε2 are maximum amounts of a permissible difference.
5. 5.) the error check is carried out by means of error system algorithms which compare the behavior of the redundantly detected object paths s, s1, s2, object speeds v, v1, v2 or the redundantly detected object accelerations a, a1, a2 with one another or their calculated similar values.
6. 6.) by means of integral rules from the object accelerations a, a1, a2 object speeds v, v1, v2 and / or object paths s, s1, s2 are calculated.
7. 7.) by means of a differentiation rule from the object paths s, s1, s2 object speeds v, v1, v2 and / or object accelerations a, a1, a2 are calculated.
8. 8.) the object accelerations a, a1, a2 are compared in a first activation stage with a threshold value for the acceleration and made when exceeding the threshold value for the acceleration adjustment and / or shutdown of the drive torque or a braking function is activated.
9. 9.) the object speeds v, v1, v2 are compared in a second activation stage with a threshold value for the speed and made on exceeding the threshold value for the speed adjustment and / or shutdown of the drive torque or a brake function is activated.
10. 10.) the object speeds v, v1, v2 in the second activation stage are calculated from the object accelerations a, a1, a2.
11. 11.) the object accelerations a, a1, a2 are detected by means of acceleration sensor signals.
12. 12.) the object speeds v, v1, v2 are detected by means of speed sensor signals, for example from tachogenerators, and / or the object paths s, s1, s2 are detected by way signals, such as from incremental sensors or encoders.
13. 13.) the acceleration sensor signals and / or the speed sensor signals and / or the paths without prior processing and / or filtering and / or conversion are evaluated directly.
14. 14.) the threshold value for the object accelerations a, a1, a2 is above an object-dependent permissible maximum acceleration and the threshold value for the object speeds v, v1, v2 is above an object-dependent permissible maximum speed.
15. 15.) the acceleration sensor signals are detected by means of acceleration sensors and / or the speed sensor signals are detected by means of speed sensors and / or the displacement sensor signals are detected by means of displacement sensors.
16. 16.) the acceleration sensors, the speed sensors and / or the displacement sensors are calibrated once or repeatedly.
17. 17.) the acceleration sensor signals by means of the speed sensor signals be plausibilized by comparing an object velocity calculated from the object accelerations a, a1, a2 with the speed detected by means of the velocity sensors or by means of the velocity calculated from the displacement sensor signals.
18. 18.) a mutual plausibility check of all existing speed sensors, or displacement sensors and acceleration sensors is performed.
19. 19.) for the error checking given tolerance bands are used, wherein errors based on a positioning of the object accelerations a, a1, a2 and / or the object speeds v, v1, v2 a2 and / or the object paths s, s1, s2 within and / or outside the Tolerance bands are detected.
20. 20.) the tolerance bands specified for the error check are only used if malfunctions of redundant sensors can be excluded.

Preferred electronic control devices 11 for monitoring object speeds v, v1, v2 and object accelerations a, a1, a2 comprise, for example, a first electronic arithmetic unit 15 or corresponding first processors 30, which performs sensor output information evaluation and, depending on a result of the sensor output information evaluation, a reduction of a drive torque and / or a shutdown of the drive torque and / or an activation of a braking device initiates, wherein the control device 11 performs a method as in the preceding examples 1 to 20 or a combination of these examples.

It further preferably comprises a second electronic calculating unit 16 or second processor 36, which exchanges information with the first calculating unit or processor. Preferably, the second arithmetic unit 16, or the second processor 36, likewise carries out a sensor output information evaluation and initiates the reduction of the drive torque and / or the shutdown of the drive torque and / or the activation of the braking device depending on the result of the sensor output information evaluation.

As in FIG. 4 The electronic control unit (ECU) 11 is shown in FIG Elevator installation, preferably mounted on the elevator car 40 to monitor their driving movements. In the example, the elevator car is supported and moved by means of suspension 41. The support means 41 are fixedly suspended at one end, for example in a building structure (not shown) attached. On the other hand, they are movable by a drive means, which is indicated by double arrows in the FIG. 4 is indicated. The support means are performed under the elevator car 40, wherein they are deflected by support rollers 43.1, 43.2, 43.3, 43.4. The elevator car is guided by means of guide rails 42. In the example, a respective suspension element is arranged on both sides of a guide plane determined by the guide rails 42. As a result, a symmetrical carrying the elevator car 40 is possible. Of course, a required number of support means 41 results from a required load and structural design of the elevator system. In the example, the electronic control device (ECU) 11 is associated with one of the support rollers 43.1, that is, an incremental encoder for detecting the path s of the elevator car is removed directly from a rotational movement of the support roller 43.1. The ECU 11 is implemented as explained in the preceding examples. Thus, the travel movements of the elevator car 40 can be safely and cost-optimally monitored. Driving the idlers is ensured by the high load capacity, which is transmitted by means of the support roller to the cabin. In addition, of course, another ECU 11.1 or at least some of the redundant sensors on another, preferably not driven by the same support means, support roller 43.3 are arranged (in FIG. 4 shown in dashed lines). Thus, the security can be additionally increased because, for example, a flaccid, single support means can lead to a movement disorder on the corresponding support roller, which can be detected by the complementary comparison routines. These comparison routines may be integrated into one of the ECU 11 or ECU 11.1, or a complementary comparison box may be provided.

The at least one acceleration sensor 12, 13 is preferably structurally integrated into an enclosure of the control device 11. A division of the sensors to different microprocessors and sub-processors can be selected by the expert.

Claims (18)

1. Method of monitoring travel movements (s, s1, s2, v, v1, v2, a, a1, a2) of a lift cage, wherein the travel movements are determined by travels (s, s1, s2), speeds (v, v1, v2) or accelerations (a, a1, a2) of the lift cage, characterised in that
   the accelerations (a, a1, a2) are detected redundantly and
   the travels (s, s1, s2) or the speeds (v, v1, v2) are detected singly or redundantly.
2. Method according to claim 1, characterised in that
   the detected travels (s, s1, s2) or the detected speeds (v, v1, v2) and the redundantly detected accelerations (a, a1, a2) continuously undergo a plausibility check and/or error check.
3. Method according to one of claims 1 and 2, characterised in that the redundantly detected accelerations (a, a1, a2) are compared in a first activation stage with a threshold value for the acceleration and, if the threshold value for the acceleration is exceeded, adaptation and/or shutting-off of the drive torque is undertaken or, if the threshold value for the acceleration is exceeded, a braking function is activated.
4. Method according to claim 3, characterised in that the detected or calculated speeds (v, v1, v2, v_(a), v_(a)1, v_(a)2, v_(s), v_(s)1, v_(s)2) are compared in a second activation stage with a threshold value for the speed and, if the threshold value for the speed is exceeded, adaptation and/or shutting-off of the drive torque is undertaken or, if the threshold value for the speed is exceeded, a braking function is activated,
   wherein if required the calculated speeds (v_(a), v_(a)1, v_(a)2) are calculated from the accelerations (a, a1, a2) by means of an integral rule or wherein if required the calculated speeds (v_(s), v_(s)1, v_(s)2) are calculated from the travels (s, s1, s2) by means of a differentiating rule.
5. Method according to claim 3 or 4, characterised in that the threshold value is a dynamic threshold value, wherein the dynamic threshold value is dependent on an operating condition of the lift cage.
6. Method of monitoring travel movements (s, s1, s2, v, v1, v2, a, a1, a2) of a lift cage, wherein the travel movements are determined by travels (s, s1, s2), speeds (v, v1, v2) or accelerations (a, a1, a2) of the lift cage, wherein at least the travels (s, s1, s2) or the speeds (v, v1, v2) or the accelerations (a, a1, a2) are detected redundantly, wherein the travels (s, s1, s2) or the speeds (v, v1, v2) are detected redundantly and the accelerations (a, a1, a2) are detected singly or the accelerations (a, a1, a2) are detected redundantly and the travels (s, s1, s2) or the speeds (v, v1, v2) are detected singly, or
   the travels (s, s1, s2) or the speeds (v, v1, v2) and the accelerations (a, a1, a2) are detected redundantly,
   characterised in that
   an error check is executed by means of error system algorithms, which compare behaviour of the redundantly detected travels (s, s1, s2) or speeds (v, v1, v2) or the redundantly detected accelerations (a, a1, a2) with one another or the calculated similar values thereof with respect to one another.
7. Method according to claim 6, characterised in that the speeds (v_(a), v_(a)1, v_(a)2) and/or the travels (s_(a), s_(a)1, s_(a)2) are calculated from the accelerations (a, a1, a2) by means of an integral rule, and/or
   the speeds (v_(s), v_(s)1, v_(s)2) and/or the accelerations (a_(s), a_(s)1, a_(s)2) are calculated from the travels (s, s1, s2) by means of a differentiating rule,
   and/or
   the accelerations (a_(v), a_(v)1, a_(v)2) are calculated from the speeds (v, v1, v2) by means of a differentiating rule.
8. Method according to claim 6 or 7, characterised in that
   a plausibility check by means of a comparison of the redundantly detected travels (s, s1, s2) or the redundantly detected or calculated speeds (v, v1, v2, v_(a), v_(a)1, v_(a)2, v_(s), v_(s)1, v_(s)2) or the redundantly detected accelerations (a, a1, a2) is carried out, wherein the detected movements are recognised as plausible when the condition |a1 - a2| < ε or |v1 - v2| < ε1 or |s1 - s2| < ε2 is fulfilled, wherein ε, ε1 and ε2 are maximum amounts of a permissible difference.
9. Method according to any one of claims 6 to 8, characterised in that the detected acceleration (a, a1, a2) is subject to determination of plausibility by means of the detected speed (v, v1, v2) in that a speed (v_(a), v_(a)1, v_(a)2) calculated from the accelerations (a, a1, a2) is compared with the detected speed (v, v1, v2) or
   the detected acceleration (a, a1, a2) is subject to determination of plausibility by means of the detected travels (s, s1, s2) in that a speed (v_(a), v_(a)1, v_(a)2) calculated from the accelerations (a, a1, a2) is compared with the speed (v_(s), v_(s)1, v_(s)2) calculated from the detected travels (s, s1, s2).
10. Method according to any one of claims 6 to 9, characterised in that the accelerations (a, a1, a2) are compared in a first activation stage with a threshold value for the acceleration and, if the threshold value for the acceleration is exceeded, adaptation and/or shutting-off of the drive torque is undertaken or, if the threshold value for the acceleration is exceeded, a braking function is activated.
11. Method according to any one of claims 6 to 10, characterised in that the detected or calculated speeds (v, v1, v2, v_(a), v_(a)1, v_(a)2, v_(s), v_(s)1, v_(s)2) are compared in a second activation stage with a threshold value for the speed and, if the threshold value for the speed is exceeded, adaptation and/or shutting-off of the drive torque is undertaken or, if the threshold value for the speed is exceeded, a braking function is activated.
12. Electronic control device (11) for monitoring travel movements (s, s1, s2, v, v1, v2, a, a1, a2) of a lift cage, wherein the travel movements are determined by travels (s, s1, s2), speeds (v, v1, v2) or accelerations (a, a1, a2) of the lift cage, comprising a first electronic computing means or processor (15, 30), which performs evaluation of sensor output information and in dependence on the result of the sensor output information evaluation initiates adaptation of a drive torque and/or shutting-off of the drive torque and/or activation of a braking device of the lift cage, characterised in that the control device (11) performs a method according to at least one of claims 1 to 11.
13. Electronic control device according to claim 12, characterised in that the control device (11) can be mounted on the lift cage and the control device can activate a braking device arranged at the lift cage.
14. Electronic control device according to claim 12 or 13, characterised in that the control device (11) comprises a second electronic computing means or processor (16, 36) which exchanges items of information with the first computing means or processor (15, 30), wherein the second computing means or processor (16, 36) similarly performs evaluation of sensor output information and in dependence on the result of the sensor output information evaluation initiates adaptation of the drive torque and/or discontinuation of the drive torque and/or activation of the braking device of the lift cage.
15. Control device according to any one of claims 12 to 14, characterised in that the at least one acceleration sensor (12, 13) is constructionally integrated in a housing of the control device (11).
16. Lift cage with a braking device and with an electronic control device (11) according to any one of claims 12 to 15, wherein the lift cage (40) includes at least one first deflecting roller (43.1) and at least one first support means (42) supports the lift cage (40) by means of the first deflecting roller (43.1), and wherein the first deflecting roller (43.1) includes or drives a first speed sensor, preferably a first tachogenerator, for generating a first speed sensor signal or a first travel sensor, preferably a first incremental sensor, for generating a first travel sensor signal.
17. Lift cage according to claim 16, wherein the lift cage (40) includes at least one second deflecting roller (43.2, 43.3, 43.4) and the first support means or a second support means conjunctively support the lift cage (40) by means of the second deflecting roller (43.2, 43.3, 43.4), and wherein the second deflecting roller (43.2, 43.3, 43.4) includes or drives a second control device (11.1) or a second speed sensor, preferably a second tachogenerator, for generating a second speed sensor signal or a second travel sensor, preferably a second incremental sensor, for generating a second travel sensor signal.
18. Lift cage according to claim 17, wherein the first speed sensor or the first travel sensor is connected with a first computing means or processor and in the case of an embodiment according to claim 13 the second speed sensor or the second travel sensor is connected with a second computing means or processor, wherein the first and if need be also the second computing means or processor are respectively connected with a first and a second acceleration sensor for detection of accelerations (a, a1, a2).

Images