EP2930134B1

EP2930134B1 - Safety system and method for testing safety critical components in an elevator system

Info

Publication number: EP2930134B1
Application number: EP14164094.6A
Authority: EP
Inventors: Risto Jokinen
Original assignee: Kone Corp
Current assignee: Kone Corp
Priority date: 2014-04-09
Filing date: 2014-04-09
Publication date: 2018-05-30
Anticipated expiration: 2034-04-09
Also published as: EP2930134A1

Description

FIELD OF THE INVENTION

The invention relates to a device and a method for testing safety critical components in an elevator system.

BACKGROUND OF THE INVENTION

Nearly every elevator system comprises components that are liable for a safe operation of the elevator system. These safety-critical components, such as sensors and actuators, are configured to monitor and control safety-critical functions in this elevator system and provide a safety processing system with this information. While this processing system could just be a red light indicating an error, it generally comprises a computing system, since the number of sensors rises with the complexity of the elevator system and the desire for optimum safety. Generally the components of an elevator system that are reliable for the safety of this elevator system could be designated as "safety system".
The sensors of the safety system may be for example safety contacts disposed in elevator shaft doors for monitoring intrusion within the elevator shaft, or safety contacts disposed in overspeed governor or safety gear for monitoring their operation, respectively. Other possible sensors are for example door zone sensors, car speed sensors, motor speed sensors etc. Actuators may be for example elevator brakes or safety gear.
To ensure a safe operation of the safety system, high reliability is required from nearly all components of the safety system, especially the sensors. Many devices trust that sensors connected to the device are reliable when the Safety Integrity Level (SIL) gets higher. This results in an increasing number of self test diagnostic components that are needed to ensure a high SIL, i.e. to ensure that all sensors work properly.
However, if the number of safety-critical components (i.e. also the number of diagnostic components) is increasing as the elevator systems become more complex with additional functionality, it becomes more and more difficult to ensure that all safety-critical components are always working properly. This is one of the main drawbacks of the present safety systems.
Furthermore, these diagnostic components usually control the communication of the sensors with the processing system. For example, as this is the case in prior art document WO 2012/080560 A1 , the wires between a sensor and a computing unit of the processing system are connected with an additional diagnostic signal generator sending special signals through this wire to check the connection or to emulate check-sensor signals.
US 5,487,448 A discloses a safety chain according to which a magnetic sensor is monitored to function faultlessly by arranging a test magnetic coil into the measurement range of the sensor and to create a test exciting current through the coil to stimulate an artificial false situation and to monitor whether or not the sensor switched over.

AIM OF THE INVENTION

The aim of the present invention is to to provide a safety system for an elevator system which is highly reliable also in critical states and a method for controlling an elevator system comprising such a safety system.

SUMMARY OF THE INVENTION

The elevator system and the method according to the invention as also preferred embodiments are characterized by the claims. Some further inventive embodiments are also presented in the descriptive section and in the drawings of the present application. The features of the various embodiments of the invention can be applied within the scope of the basic inventive concept in conjunction with other embodiments.
The invention refers to a safety system of an elevator system comprising a sensor system wherein the safety system further comprises at least one sensor-test system that is designed to stimulate at least one measurement module of at least one of the sensors of the sensor system.
The invention also refers to a method performed with this safety system, wherein an artificial signal that is produced by a sensor-test system is measured by at least one of the sensors of the sensor system.
The sensor system comprises at least one sensor designed to measure safety-critical measurement categories of the respective elevator system. As already said above, the sensors of the safety system may be for example safety contacts disposed in elevator shaft doors for monitoring an intrusion in the elevator shaft, or safety contacts disposed in overspeed governor or safety gear for monitoring their operation, door zone sensors, car speed sensors, motor speed sensors, movement sensors of the hoisting machine, brakeshoe or prong of the car brake, etc.
Every sensor comprises at least one measurement module and optionally (e.g. in the case that a measurement module is not able to convert the measured value in an electronic signal), a unit to convert the measured value in a suitable electronic signal. For example, may an electric eye that monitors if the door zone is free or blocked comprise a photo-diode as measurement module and a signal amplifier/shaper to convert the photo current of the photo-diode in a suitable electronic signal for a processing unit.
The sensor-test system especially comprises at least one testing-component that is designed to stimulate at least one of the sensors of the sensor system. In difference to the known systems that are checking the physical connection of the sensors or producing artificial sensor signals as test-signals, the sensors are stimulated by the present invention by directly stimulating at least one of the respective sensors' measurement modules. Thus, the testing-component of a certain sensor is designed to produce signals that can be measured by this sensor. This results in the fact that the sensors are forced to measure an (artificial) disturbance or value that gives direct information about the functionality and the operational readiness of the sensor.
An additional advantage of this invention is the fact that the operation of the components of the sensor test system can be tested with the sensors themselves, because the sensors are measuring the output of the components of the sensor-test system. Thus, no additional components for testing are necessary.
In the following, an artificial signal stimulating the measurement module of a sensor is also referred to as "stimulating-signal".
In general, suitable components that are able to cause a measurement signal of certain sensors are well known by the skilled person. Especially, radiation emitting components are suitable to stimulate radiation measuring sensors, vibrators are suitable to stimulate vibration-measuring sensors, moved planes are suitable to stimulate proximity sensors, force exerting components are suitable to stimulate pressure-sensitive sensors and electromagnets are suitable to stimulate magnetic field sensors.
Thus, the stimulation of the sensors is to produce an artificial signal that can be directly measured by the sensors as it would be a natural signal or a change of environment.
The testing-component may be controlled by a central unit, preferably, the unit controlling the sensor-test system. There are also preferred embodiments, where a group of testing components or at least one testing component is controlled by a separate controller that comprises especially data contact with a controlling system of the sensor-test system.
Signals of the main controller are preferably sent to the testing component via a receiving unit that can be a separate controller/processor or even a simple wire.
In a preferred embodiment, at least one sensor of the sensor-test system is designed such that the testing-component for a certain sensor is integrated in this sensor. In the above example of an electric eye, the testing component may be a LED that is integrated in the sensor such that it is able to send light into the photo-diode directly or via a semitransparent mirror. Thus, a processing unit may send an electric pulse to the LED and wait for the signal measured with the photo-diode of the electric eye. Since the response time is well known, any artificial test-signal can be easily identified and filtered compared to the natural signals.
In a preferred embodiment, the stimulation results in an artificial change of the environment. This is especially done by arranging a testing-component between the measured environment and the measurement module of the respective sensor. For example, if a pressure-sensor is tested, the testing component produces an additional force on the measurement module of the sensor and alters the force when stimulating the sensor. In other examples, the testing component is able to add a magnetic field of an electromagnet to the external magnetic field. This provides the advantage that even sensors which are measuring a static environment and/or which are sending static signals are able to be tested and monitored.
In a preferred embodiment the artificial stimulation is made such that controlled 'errors' are produced by exceeding the given tolerances of the measured values. Thus, the testing components are designed to provide signals that are intense enough to produce a sensor response that exceeds the given tolerances. This provides the advantage that even the ability of the sensors to measure critical states can be tested.
Due to the artificial stimulating of the sensors, the sensors can be tested even if they do not provide any useful data due to the environment not stimulating the sensor. Thus, the present invention also prevents cases when false error messages are produced due to a lack of sensor signals (e.g. of a velocity sensor in the case that the elevator car does not move for a long time).
In a preferred embodiment, the stimulating-signal is sent periodically to at least one sensor or is at least sent once in a certain time period. Useful time periods depend on the sort of sensors, their relevance concerning safety and the disturbance of the sensor data due to the stimulating-signals.
A preferred time period for sending at least one stimulating signal is one day or shorter, especially one hour or shorter, such as once per minute, once per second or even more often.
In a preferred embodiment, a testing-component is designed to perform one or more of the following actions that lead to a signal or other artificial change of environment that can be measured by a sensor:

alter a magnetic field,
alter the temperature (e.g. by a heater),
alter pressure,
alter acceleration (e.g. due to vibration).

In a preferred embodiment, the safety-system additionally comprises a vibration or solenoid unit connected to a sensor and/or to the housing of other safety-critical components (e.g. encoder mechanics) to cause controlled 'error' or signal vibration which can be then used to verify the operational readiness of electronics and wiring.
In a preferred embodiment, the components of the safety system are designed as safety critical components by implementing the corresponding design rules as required by new elevator code EN 81-20 for programmable safety controllers (PESSRAL).
The safety system may comprise additional other components, especially a controlling unit to control the signals of the sensor test system and/or to control the signals measured by the sensors and/or to filter the artificial pulses from the real data.
Additionally, the testing system is designed such, that a malfunction of any testing component does not cause a malfunction of the elevator safety functions tested. This can be realized by that the malfunctioning test signal source is then isolated from the system. A relay could accomplish this function.

LIST OF FIGURES

In the following, the invention will be described in detail by the aid of examples of its embodiments, wherein:

Fig. 1 presents a functional example of a preferred embodiment.

DETAILED DESCRIPTION OF THE INVENTION

Fig. 1 shows a sensor 1 that comprises a sending-unit 2 for sending measurement data to a controlling unit (not shown), a measurement module 3 that is able to measure values of the environment or of a body 4, a testing component 5 and a receiving unit 6 for the testing component 5.
The sensor 1 measures special characteristics of the body 4 via the measurement module 3 and sends specific data of these measurements via the sending unit 2 to a controlling unit (upper arrow). This sending unit 2 may be a separate controller or processor, however, it also can be a simple wire.
The testing component 5 is able to produce characteristic, artificial signals that can be measured by the measurement module 3 of the sensor 1. The testing unit receives information about the emitted artificial signals via the receiving unit (lower arrow). Like the sending unit 2, the receiving unit 6 may be a separate controller or processor, however, it also can be a simple wire.
For example, body 4 could comprise a number of magnets. The magnetic field of these magnets is measured by the measurement module 3. With the help of the testing component 5 (that is an electromagnet in this example), it is possible to stimulate measurement module 3 by producing an artificial magnetic field. The artificial signal of the testing component 5 measured by the sensor 1 is well known by the controlling unit, because it was initialized before and sent on behalf of the controlling unit. Thus, the time and shape of the sensor response of the artificial signal is well known and can easily be recognized and filtered from the real sensor data.
This magnetic field can have the shape of a magnetic pulse or be a static field that is altered from time to time, interfering with the field of body 4.
The body 4 may be movable in relation to the sensor 1 (e.g. the body is fixed to a guiderail and the sensor moves with the elevator car). Then, the test can also be made when the body 4 is not present.
Thus, it can be controlled if sensor 1 works properly by sending an artificial test signal to the sensor and it can be controlled if the testing component works properly with the same action.

Reference signs

1: sensor
2: sending-unit
3: measurement module
4: body
5: testing component
6: receiving unit

Claims

Safety system for an elevator system, wherein the safety system comprises at least one sensor-test system that is designed to stimulate a measurement module (3) of at least one sensor (1) of the sensor system, and the sensor-test system especially comprises at least one testing-component (5) that is designed to stimulate the at least one sensor (1) of the sensor system, wherein the sensor is stimulated by directly stimulating the sensors' measurement module (3), characterized in that the at least one sensor (1) of the sensor-test system is designed such that the testing-component (5) is integrated in this sensor.
Safety system as claimed in claim 1, characterized in that the sensor (1) of the safety system is selected from the group of safety contacts disposed in elevator shaft doors for monitoring intrusion into elevator shaft, safety contacts disposed in overspeed governor or safety gear for monitoring their operation, door zone sensors, car speed sensors, motor speed sensors and brake shoe movement sensors.
Safety system as claimed in one of the preceding claims, characterized in that the sensor test system comprises components (5) selected from the group radiation emitting components, vibrators, moved planes, electromagnets and force exerting components.
Safety system as claimed in one of preceding claims, characterized in that the at least one testing-component (5) is controlled by a central unit, preferably the unit controlling the sensor-test system, wherein signals of the main controller are preferably sent to the testing component (5) via a receiving unit (6) that can be a separate controller/processor or even a simple wire.
Safety system as claimed in one of the preceding claims, characterized in that the testing component (5) is designed to provide a signal which signal intensity is reduced to a minimum level that still has to be observed.
Safety system as claimed in one of the preceding claims, characterized in that the safety-system additionally comprises a vibration or solenoid unit connected to the sensor and/or to the housing of other safety-critical components to cause a controlled 'error' or signal vibration which can be then used to verify the operational readiness of electronics and wiring.
Method for controlling the safety of an elevator system with a safety system as claimed in one of the preceding claims, characterized in that the testing component (5) provides a signal which signal intensity is reduced to a minimum level that still has to be observed.