EP2886499B1

EP2886499B1 - Safety control system for an elevator, escalator or moving walkway

Info

Publication number: EP2886499B1
Application number: EP14382521.4A
Authority: EP
Inventors: José María Martín Corral; Unai Iraola Iraola
Original assignee: Orona S Coop
Current assignee: Orona S Coop
Priority date: 2013-12-19
Filing date: 2014-12-16
Publication date: 2019-05-01
Anticipated expiration: 2034-12-16
Also published as: ES2727962T3; TR201908899T4; ES2538418B1; ES2538418A1; EP2886499A1

Description

Object of the Invention

The present invention relates to a safety control system for an elevator, escalator or moving walkway and is intended for providing a control system that can be easily scaled, i.e., it can be easily expanded by adding new similar electronic nodes that can be connected to those that already exist, and at the same time allows reducing installation wiring for the purpose of reducing installation costs and facilitating the assembly and maintenance thereof.

Background of the Invention

The safety chain of an elevator, escalator or similar machines is a safety element consisting of a set of contacts or sensors arranged in series, intended for preventing the elevator from being able to start up if any of these contacts or sensors is not properly closed.
The safety chain is based on acting on an elevator drive feeder which opens when there is a problem or when the elevator is in a state in which it should not move, for example when the doors are open. The safety chain is formed by all the safety contacts, switches and electromechanical elements of the installation connected in series, such that opening any of them means that the drive contactors are no longer powered. When these contactors are not powered, the machine brake drops (the machine stops) and the energy flow between the regulator and engine is cut off, i.e., torque is cancelled.
Said feeder has to travel to all the critical points of the elevator installation and therefore installation and maintenance costs are quite significant. One of the elements that increases the cost of the series of safeties is the inspection push-button box located in the car normally used by maintenance staff, which requires multiple electromechanical elements and wiring.
These installation costs would be even higher if an additional inspection push-button box, for example, had to be installed in the pit, which would make it necessary to extend the wiring to the location of said push-button box in the pit.
The integration of this new push-button box in the pit complicates the conventional solution, because it needs additional wiring (it increases the wiring, for example, 3 or 4 times the length of the shaft), which entails a significant increase in costs, while at the same time increasing assembly and maintenance phase complexity.
The design of the architecture of the safety chain of an elevator currently corresponds to a system made up of electromechanical devices which intrinsically have a number of associated problems. For example, a serious problem affecting such installations is generated when the contacts of a relay stick together, and the relay is no longer a safe element because it leaves the circuit of the safety chain closed until a technician detects the malfunction, which seriously compromises installation safety.
In recent years progress has been made in relay-based electromechanical safety devices, evolving into microcontroller-based electronic safety devices. However, the safety chain is one of the few elevator elements that have changed little to none in recent years.
Some of the elements of the series of safeties that have progressed the least are inspection push-button boxes and/or rescue push-button boxes.
Current push-button boxes consist of switches and buttons with manually assembled electromechanical contacts. Elevator operation systems today usually have 2 push-button boxes, a "rescue" push-button box located in the control panel and another "inspection" push-button box located in the ceiling of the elevator car, the latter being of a higher priority with respect to the rescue push-button box. All the rescue and inspection push-button boxes are arranged in series in the safety chain, acting directly thereon.
A conventional diagram from the state of the art is shown in Figure 1, where a series of safeties made up of a number of relays connected in series can be seen, such that if one of them is open movement of the elevator is prevented. The safe state is considered to be that in which the series of safeties is open, i.e., at least one of the relays that is part of the series of safeties is open. It can therefore be seen that if one of the relays is stuck together as discussed above, the series of safeties would be accidentally closed, allowing movement of the elevator. Since the relays are not monitored, it is only possible to detect a fault in the relay after the installation malfunctions, which means shutting down the installation until a technician can come to diagnose the malfunction.
More specifically, the diagram of Figure 1 shows that an inspection push-button box (1) is part of a safety chain (3) in a control installation, which is controlled by a central control unit (4). A rescue or emergency push-button box (2), which is part of the series of safeties, is also communicated with the central control unit (4).
It can be seen how each push-button box (1, 2) is formed by several buttons implemented by means of electromechanical elements and how each push-button box is individually communicated with the central control unit (4). Specifically, the inspection push-button box (1) is communicated with the central unit (4) by means of a communication bus (5) to which it is connected by means of a node (8).
To increase the number of push-button boxes, for example to add a second additional inspection push-button box located in the pit, the existing circuit diagram of the safety chain has to be modified to include said push-button box.
Therefore, some of the main problems detected in the state of the art include the following:

increase in the wiring as the number of push-button boxes increases,
difficulty in assembly,
reduced system scalability,
difficulty in maintenance and repair tasks.

Patent US-6.173.814 B1 refers to an electronic safety system for elevators for preventing unsafe elevator operation has a central controller which monitors a variety of sensors, contacts, and switches over an electronic safety bus. A plurality of bus nodes are distributed throughout the elevator system and are in constant communication with the central controller over the safety bus.

Description of the Invention

The present invention solves the drawbacks of the state of the art discussed above by providing a safety control system for an elevator, escalator or moving walkway, whereby reducing installation wiring, reducing costs thereof, while at the same time facilitating the assembly, scalability and maintenance thereof.
The safety control system developed in this invention comprises a central control unit and at least one electronic safety node, such that the different nodes are capable of two-way communication with one another and with the central control unit by means of a secure communication bus.
The system further comprises a plurality of safety switches connected in series forming a safety chain, as well as at least one state detector of at least one of the components of the elevator, escalator or moving walkway. Each electronic safety node is functionally associated with at least one safety switch which is part of said chain, such that the node controls activation of the switch.
At least one electronic safety node is communicated with at least one state detector of a component of the installation and is programmed for processing a signal received from said detector.
The electronic safety nodes are programmed for transmitting to one another and to the central control unit, by means of the secure communication bus, information relating to the state of at least one safety switch associated with a node, and information relating to at least one signal received from at least said state detector of a component.
Furthermore, each safety node is programmed for controlling its associated safety switch depending on the information received from another safety node and on the information received from its own detectors, such that in case of fault of a first safety node (for example due to the fault of its associated switch), a second safety node would detect that fault situation, and depending on the state of the detectors of the first node, would open the safety chain, i.e., the second node could, if need be, eventually replace the functionality of the first node should the first node suffer a fault.
On the other hand, the central control unit is programmed for acting on the driving means of the elevator, escalator or moving walkway, depending on the information it receives from the electronic safety nodes.
Each safety node can include a push-button box associated with a programmable electronic device, such that the control system of the invention, implements the push-button boxes, for example rescue and inspection push-button boxes, by means of programmable electronic devices, and this means that these push-button boxes are part of the safety chain and that they act directly on the chain, opening or closing the chain depending on the state of the push-button box itself and of the rest of the push-button boxes.
Given that the push-button boxes and central control unit are communicated with one another by means of a secure communication bus, the installation cost is lower and the assembly phase time, as well as costs associated with maintenance, are reduced.
The invention reduces the number of electromechanical elements in the safety chain, and those which are used are diverse safety elements, so the typical problems associated with any electromechanical element are avoided, and it furthermore provides a diversified system such that when a component of a node deteriorate, since there are several nodes communicated with and operatively complementing one another, installation safety is assured even if one of them should fail, whereby increasing overall installation safety.
The invention provides a control system whereby it is possible to easily redefine the functionality of the push-button boxes by simply modifying the corresponding program, which would not be possible by means of electromechanical components which would make it necessary to replace these components. If the design has to be modified, for example, if an already existing installation implemented according to this invention has to be updated to incorporate one or more additional push-button boxes, this update could be done easily without replacing already installed equipment.
Furthermore, the system of the invention allows monitoring safety nodes, which in turn facilitates installation maintainability, because the existence of a malfunction can be detected remotely, and the faulty component and the type of fault can be located.
Another aspect of the invention relates to an elevator, escalator or moving walkway incorporating a safety control system such as the one described above. In the case of an elevator, a first electronic safety node is arranged in an elevator car and moves with the car, and a second electronic safety node is located at a fixed point of the elevator installation, for example in the pit.

Description of the Drawings

To complement the description being made and for the purpose of aiding to better understand the features of the invention according to a preferred practical embodiment thereof, a set of drawings is attached as an integral part of said description where the following is depicted with an illustrative and non-limiting character:

Figure 1 shows a circuit diagram of a safety chain of an elevator, corresponding to the state of the art, in which the control push-button boxes are implemented by means of electromechanical devices.
Figure 2 shows a circuit diagram of a safety chain according to the present invention.
Figure 3 shows an electronic diagram corresponding to each of the three electronic safety nodes shown in Figure 2.
Figure 4 shows a flowchart corresponding to the iterative process that each safety node performs for communicating with the remaining nodes and acting on the series of safeties.

Preferred Embodiment of the Invention

Figure 2 shows an embodiment of a safety chain according to the present invention, suitable for controlling an elevator, escalator or moving walkway, where the system comprises three electronic safety nodes (1, 2, 6) which are communicated with one another by means of a secure two-way communication bus (5), and at the same time communicated with a central control unit (4) by means of said communication bus (5).
Each electronic safety node (1, 2, 6) is functionally associated with at least one safety switch (1', 2', 6') for controlling activation thereof, which in this case consist of safety relays. As can be seen in Figure 2, those three safety switches (1', 2', 6') are part of the safety chain (3) of the installation, and are therefore connected in series with one another and with the remaining switches forming the safety chain (3), which remaining switches can be conventional switches (10) operating independently with respect to the electronic safety nodes. One or more of those conventional switches (10) can, for example, consist of a state detector of one of the components of the elevator, escalator or moving walkway, such as a button, a limit, a door closing detector, etc.
It has been envisaged in the invention that at least one electronic safety node (1, 2, 6) is being communicated with at least one state detector of a component and programmed for processing a signal received from said detector. In the preferred embodiment of the invention, said detector can consist of the buttons (13) of the electronic push-button box, as shown in Figure 3.
Each electronic safety node (1, 2, 6) is programmed for transmitting to the other nodes and to the central control unit (4) information relating to the state of the safety switch (1', 2', 6') associated with each node, as well as information relating to at least one signal received from said state detector of a component of the installation.
The safety nodes and central control unit are communicated by means of the secure communication bus (5) which can be a Safety Bus CAN type, for example. The system of the invention thus allows reducing installation wiring and therefore reducing costs and facilitating assembly, because it is only necessary to arrange the communication bus (5) for communication between the different safety nodes and the central control unit, which can be separated by several meters.
According to the invention, each safety node (1, 2, 6) is programmed for controlling its associated safety switch (1', 2', 6') depending on the information received from another safety node and on the information received from its own detectors.
The central control unit (4) is programmed for acting on the driving means of the elevator (not depicted), escalator or moving walkway, in a manner that is already known, depending on its own program and depending on the information it receives from the safety nodes (1, 2, 6). However, the central control unit (4) only reads the information present in the bus (5), but it does not transmit anything through it.
The implementation of each safety node shown in Figure 3, where it can be seen that each safety node includes a programmable electronic device (11) and an electronic push-button box (8) formed by buttons and/or switches (13) corresponding to the possible operations: start-up, ascent, descent, etc.
The programmable electronic device (11) is programmed for electronically coding activation of the buttons and/or switches (13) of the push-button box (8), i.e., said device locally monitors the state of the buttons of the push-button box, as well as the state of the associated safety switch, generates a code containing that information and sends it through the safety bus (5).
Therefore, each electronic node (1, 2, 6) receives information relating to the state of the push-button boxes from other nodes (information about the state of inputs and outputs) through the safety bus (5), and processes said information by means of the program being run therein and accordingly acts on the safety chain depending on the state of the local buttons and on the state of the other push-button boxes. Once it makes the decision and correctly runs same, the corresponding node can inform the remaining nodes of the decision made.
For example, each electronic safety node (1, 2, 6) monitors operation of its associated safety relay and communicates the state of its relay and of its inputs (in this example, the buttons (13) of the push-button box) to the remaining nodes connected to the safety bus (5). At the same time, each node receives information about the state of the relays and inputs from other safety nodes connected to the bus (5). Based on this information, each electronic safety node (1, 2, 6) runs its program (safety function) and decides whether or not it is necessary to act on its safety switch to activate the safe state of the chain.
Therefore and in view of Figure 2, if the safety relay of one of the nodes, for example the relay (2') of a first electronic node (2) (node INSPECTION1) were to fail and be permanently closed, node INSPECTION1 would not be able to open the series of safeties (3) and assure the safe state. However, since the remaining the nodes in turn know the state of the relay of node INSPECTION1 through the safety bus (5), both the second safety node (6) (node INSPECTION2) and the third safety node (1) (node RESCUE) can open the series by opening its associated relay if necessary, and thereby assure the safe state, despite the fault of the relay of the node INSPECTION1.
This process of communication between safety nodes (1, 2, 6) is shown in Figure 4. Each safety node continuously monitors or reads (14) the state of its inputs and outputs, i.e., the state of its relay and of the associated buttons, and it sends said information to the remaining nodes (15). It also receives (16) that same type of information from the remaining nodes, calculates (17) if this is the case of a safe state and decides (18) whether or not to activate the safe state.
If it decides affirmatively, it opens (19) the relay of that node and checks (20) whether or not that relay has opened, and if it has not opened, it indicates (21) the malfunction condition and sends (22) a malfunction message.
Another added advantage is obtained when detecting which relay is defective because any node connected to the secure communication bus knows the state of inputs and outputs of each safety node, including its own, and the repair technician can be informed of exactly which relay is faulty.
On the other hand, given that the central control unit (4) is reading the secure communication bus (5), it is able to assess whether it should activate the drive.
The programmable device (11) can consist of a microcontroller, an FPGA or a microprocessor, for example, which is functionally associated with an electronic memory, housing a program implementing logic equations.
The safety switches (1', 2', 6') preferably consist of a relay, which can be redundant for improving system safety.
It can be seen by comparing Figures 1 and 2 that the present invention successfully replaces conventional push-button boxes formed by electromechanical components with electronic devices programmed for implementing (running a program in a processor) logic equations equivalent to the functions that were previously performed in a complex manner by means of electromechanical components. Installation wiring and assembly tasks are therefore simplified.
In the case of the embodiment of the invention shown in Figure 2, there are a first and second safety node (2, 6), including a first and second inspection push-button box (8, 9), respectively, such that one of said push-button boxes can be assembled in an elevator car and another one in the pit of the installation.
The mentioned inspection push-button boxes (8, 9) are preferably identical, i.e., they are implemented by means of the same electronic equipment and the same program (the same hardware and the same software), and they must each simply be assigned a different identification code for enabling communication between them and the central control unit. The system can therefore be easily scaled because additional electronic nodes identical to those already existing can be incorporated with minimal modification of the program for simply assigning a new identification code to the new nodes.
System operation can also be easily modified, for example, for being adapted to an elevator topology, by simply modifying the program to modify the logic equations it implements, without having to design new complex circuit diagrams, as occurred in the state of the art.
The third safety node (1) includes a rescue push-button box (7) which is implemented in this case by means of electronic equipment and a program that is slightly different from the inspection push-button boxes.
The safety nodes (2, 6) used to implement the push-button boxes of INSPECTION1 and INSPECTION2 (8, 9) include a mushroom-type emergency stop button (12) which is not monitored by the programmable device (11), but rather is integrated directly in the safety chain (3) for opening it directly.
The various embodiments and alternatives herein described can be combined with one another, giving rise to other embodiments, such as the embodiments obtained with the multiple combinations of the attached claims, for example.

Claims

Safety control system for an elevator, escalator or moving walkway, including driving means, where the control system comprises:
a central control unit (4),

at least one electronic safety node (1,2,6),

a secure communication bus (5) for two-way communication between two or more safety nodes (1,2,6), and for communicating the safety nodes (1,2,6) with the central control unit (4),

a plurality of safety switches (1',2',6') connected in series forming a safety chain (3),

at least one state detector of at least one of the components of the elevator, escalator or moving walkway,

wherein each electronic safety node (1,2,6) is functionally associated with at least one safety switch (1',2',6') for controlling the activation thereof,

characterized in that at least one electronic safety node (1,2,6) is communicated with at least one state detector of a component, and it is programmed for processing a signal received from said detector,

wherein the electronic safety nodes (1,2,6) are programmed for transmitting to one another and to the central control unit (4), by means of the secure communication bus (5), information relating to the state of at least one safety switch (1',2',6') associated with a safety node (1,2,6), and information relating to at least one signal received from at least said state detector of a component,

wherein each safety node (1,2,6) is programmed for controlling its associated safety switch (1',2',6') depending on the information received from another safety node (1,2,6) and depending on the information received from its own detectors, and

wherein the central control unit (4) is programmed for acting on the driving means of the elevator, escalator or moving walkway.
System according to claim 1, wherein the safety nodes (1,2,6) include a programmable electronic device (11) and a push-button box (8,9) formed by buttons and/or switches, wherein the programmable electronic device (11) is programmed for electronically coding activation of the buttons and/or switches of the push-button box (8,9).
System according to claim 1 or 2, wherein said safety switch is a relay, and wherein the programmable electronic device (11) is programmed for controlling the relay depending on the state of the respective push-button box (8,9).
System according to any of the preceding claims, wherein at least one state detector of one of the components of the elevator, escalator or moving walkway consists of: a button, a limit or a door closing switch.
System according to any of the preceding claims, wherein the programmable electronic device (11) of the electronic safety nodes (1,2,6) comprises a microprocessor functionally associated with an electronic memory having a program stored therein.
System according to any of the preceding claims, wherein at least one safety switch (1',2',6') is connected in the safety chain (3) for operating independently with respect to the electronic safety nodes (1,2,6).
Elevator, escalator or moving walkway incorporating a safety control system according to any of the preceding claims.
Elevator according to claim 7, comprising a first electronic safety node (2) located in an elevator car moving with the car, and at least a second electronic safety node (6) located at a fixed point of the elevator installation.
Elevator according to claims 7 and 8, comprising at least two electronic safety nodes, wherein one of them is an inspection station, and the other one is an electric rescue operation means.