EP3060509B1 - Safety system for a lift, lift system and method for operating such a safety system - Google Patents

Description

The present invention relates to a safety system for an elevator, an elevator installation and a method for operating such a safety system.

Modern elevators have a large number of safety mechanisms with which malfunctions and especially dangerous situations are to be recognized and rectified or at least mitigated as quickly and safely as possible. For example, they have sensors with which the position and speed of an elevator car are constantly monitored.

A generic security system known for this purpose is in the WO 00/51929 A1 disclosed. This safety system has a safety control unit, an elevator control unit for controlling an elevator and at least one data bus with several bus nodes, the safety control unit being able to receive data from the bus nodes via the data bus. The safety control unit can be operated in several different operating modes, for example in a normal operating mode, a maintenance mode or an emergency mode. In the normal operating mode, a corresponding measure should be taken, for example, when an error signal occurs. For example, the safety control unit is intended to initiate braking of this elevator car when a predefined critical speed of the elevator car is exceeded. Alternatively, it is conceivable that, in normal operating mode, the safety control unit interrupts operation of the elevator when the shaft or car doors are open, except when the elevator car is not at the level of a floor.

However, if maintenance is carried out in which, among other things, the functionality of the sensors is to be checked, at least some of the actions controlled by the safety control unit and / or the elevator control unit must be suppressed. For example, during maintenance, an open car door can also be desirable or even necessary in positions of the elevator car in which it is not at the level of a floor. This possibility can be provided in a maintenance mode.

To activate a maintenance mode, the WO 00/51929 A1 proposed a maintenance switch that can be switched on at the beginning of maintenance. However, this mechanism has some limitations. For example, such a maintenance switch can be manipulated relatively easily. If an unauthorized person has access to this maintenance switch, he can switch the maintenance switch on or off, which in each case can endanger not only the maintenance technician.

The JP2004099301 describes a control system for an elevator installation to which an authentication code can be sent by means of a mobile phone. When a correct authentication code is transmitted, the elevator installation is brought into a defined operating mode.

It is therefore an object of the present invention to provide a safety system for an elevator which u. a. is less easily manipulated - be it through inadvertent actions by a technician or an unauthorized person or through willful actions by an unauthorized person. In addition, at least in some embodiments, different subsets of the operating modes should be made available to different groups of people in a simple manner.

These and other objects are achieved in a first aspect by a safety system for an elevator that contains at least one control unit that can be operated in at least two different operating modes.

• bei bestehender Verbindung zwischen dem elektronischen Schlüssel und dem elektronischen Schloss nur in einem Betriebsmodus einer ersten Teilmenge der Betriebsmodi betreibbar ist und
• bei nicht bestehender Verbindung zwischen dem elektronischen Schlüssel und dem elektronischen Schloss nur in einem Betriebsmodus einer zweiten Teilmenge der Betriebsmodi betreibbar ist.

According to the invention, the security system has at least one electronic lock which is connected to the control unit and can be or is connected to at least one electronic key. Furthermore, according to the invention, the control unit is programmed such that it

• with an existing connection between the electronic key and the electronic lock can only be operated in one operating mode of a first subset of the operating modes and
• if there is no connection between the electronic key and the electronic lock, it can only be operated in one operating mode of a second subset of the operating modes.

The first subset and the second subset are different from one another. This means that at least one operating mode of the control unit that is available in principle is only contained in the first subset or only in the second subset. According to the invention, a maintenance mode is only available in the second subset of the operating modes. The control unit can therefore only be operated in a maintenance mode when the electronic key is removed from the electronic lock.

If an operating mode is only contained in the first subset, but not also in the second subset, this operating mode is available if the connection between the electronic key and the electronic lock exists. By disconnecting the connection between the electronic key and the electronic lock, the control unit can no longer be operated in this operating mode. Said operating mode can be, for example, a normal operating mode that a maintenance technician can activate by connecting the electronic key to the electronic lock. If he breaks the connection, the normal operating mode is no longer available. Due to the inventive use of an electronic lock and an electronic key, the security system is much more difficult to manipulate, since a suitable electronic key is required to activate the normal operating mode.

Conversely, if an operating mode is only contained in the second subset, but not also in the first subset, this operating mode is only available if there is no connection between the electronic key and the electronic lock. If the connection is re-established, the control unit can no longer be operated in this operating mode. Said operating mode can be, for example, a maintenance mode: if the technician carries out maintenance work in the elevator shaft, for example, it may be necessary to deactivate the normal operating mode in order to prevent the elevator car from jamming him. For this purpose, he can separate the electronic key from the electronic lock, which in this example is preferably also arranged in the elevator shaft. If he re-establishes the connection, the normal operating mode is available again. Thus, in this variant too, due to the inventive use of an electronic lock and an electronic key, the risk of life-threatening incorrect manipulation during maintenance work can also be reduced.

The first and / or the second subset can each contain one or more of the operating modes of the control unit that are basically available. In particular, it is conceivable that both the first subset contains one or more first operating modes that the second subset does not contain and the second subset also contains one or more second operating modes that the first subset does not contain.

• Bei Vorliegen des gleichen Zustandes der Aufzugsanlage kann die Steuereinheit, insbesondere eine Aufzugssteuereinheit der Steuereinheit, den Aufzug in einem ersten Betriebsmodus anders steuern als in einem zweiten Betriebsmodus. Insbesondere kann sie in einem ersten Betriebsmodus eine bestimmte Steueranweisung an den Aufzug oder eine oder mehrere seiner Bestandteile senden, aber in einem zweiten Betriebsmodus eine andere oder keine solche Steueranweisung senden.
• Bei Vorliegen des gleichen Zustandes der Aufzugsanlage kann die Steuereinheit in einem ersten Betriebsmodus eine Warnmeldung ausgeben, aber in einem zweiten Betriebsmodus eine andere oder gar keine solche Warnmeldung ausgeben.

The various operating modes can differ from one another in one, more, or all of the following behaviors:

• When the elevator system is in the same state, the control unit, in particular an elevator control unit of the control unit, can control the elevator differently in a first operating mode than in a second operating mode. In particular, it can send a specific control instruction to the elevator or one or more of its components in a first operating mode, but send a different or no such control instruction in a second operating mode.
• If the elevator installation is in the same state, the control unit can output a warning message in a first operating mode, but output a different warning message or no such warning message at all in a second operating mode.

The above-mentioned state of the elevator system can in particular include sensor data from the sensors described in detail below.

The operating modes in which the safety control unit can be operated can include at least one operating mode selected from the group consisting of at least one normal operating mode, at least one maintenance mode, at least one configuration mode and at least one installation mode.

In a normal operating mode, for example, the operation of the elevator can be prevented when the car door is open, except when the elevator car is currently at the level of a floor.

In a maintenance mode, one or more contacts can be bridged and, as a result, reactions of the control unit that would be carried out in normal operating mode can be prevented. For example, door contacts can be bridged, which allows the elevator car to move when the door is open in maintenance mode. Alternatively, limit switches can be bridged which, in a normal operating mode, prevent the elevator car from being located below the lowest floor or above the uppermost floor or from moving there. By bridging these limit switches, so-called buffer runs can be made possible, in which the lowest and highest physically possible position of the elevator car can be approached until the buffers arranged there are touched. Alternatively, in a maintenance mode, the traveling speed of the elevator car can also be reduced compared to a normal operating mode.

In a configuration mode, the elevator can be reprogrammed, for example. For example, it is conceivable that the elevator should be able to move to further floors after an addition to a high-rise building and, for example, further shaft doors should be monitored.

The above-mentioned first subset of the operating modes, in which the safety control unit can only be operated when there is an existing connection, can only consist of the normal operating mode. Alternatively, the above-mentioned second subset of the operating modes, in which the safety control unit can only be operated when there is no connection, can only consist of the maintenance mode.

The safety system can contain at least one safety control unit which can be operated in the at least two different operating modes, as well as at least one elevator control unit for controlling the elevator. In this preferred embodiment, the at least one electronic lock is connected to the security control unit, and the security control unit can be operated in the first or second subset of the operating modes depending on the existence or non-existence of the connection between the electronic key and the electronic lock.

The term "connection" used above and below does not only include physical connections in which there is a mechanical contact between the electronic key and the electronic lock. Contactless connections are also included. Electronic key and electronic lock are to be understood in the present case in particular in an abstract, functional manner.

In a first possible embodiment, the electronic lock comprises at least one RFID reader, and the electronic key contains at least one RFID tag, which can be read out by means of the RFID reader. Alternatively, the electronic key can contain at least one magnetic strip and the electronic lock can contain at least one reading device suitable for reading out the magnetic strip, with which this magnetic strip can be read. Furthermore, alternatively, the electronic key can contain at least one optical code, such as at least one barcode, and the electronic lock can contain at least one optical reading device suitable for reading, such as at least one barcode reader. In yet another embodiment, the electronic key can contain at least one chip and the electronic lock can contain at least one reading device suitable for reading out the chip.

The electronic lock can be arranged in, on, on or under an elevator car. For example, it can be arranged in the vicinity of the control unit or one of its components, such as in a door frame of the elevator car. The electronic lock can also be arranged in the vicinity of a manual control located on the elevator car, for example. Furthermore, alternatively, the electronic lock can be arranged in or on a wall or a head of an elevator shaft or also in a machine room, in particular outside an elevator car.

In advantageous embodiments, the security system contains at least one data bus with several bus nodes, the control unit, in particular the security control unit, being able to receive data from the bus nodes via the data bus and the electronic lock being connected to one of the bus nodes.

It is conceivable and within the scope of the invention that the control unit, in particular the security control unit, is programmed in such a way that it can only operate after the connection between the electronic key and the electronic lock has been established and at least one further predefined action has been carried out in all operating modes of the first Subset of the operating modes is operable. In addition to establishing the connection between the electronic key and the electronic lock, a further action must then be carried out so that at least one further operating mode is available.

Analogously, alternatively or additionally, the control unit, in particular the security control unit, can be programmed in such a way that it can only be operated in all operating modes of the second subset of operating modes after the connection between the electronic key and the electronic lock has been disconnected and at least one further predefined action has been carried out in a coordinated manner. In addition to separating the connection between the electronic key and the electronic lock, another action must then be carried out so that at least one further operating mode is available.

The further predefined action can be, for example, pressing a reset button or touching a touch-sensitive screen. The reset button or the touch-sensitive screen is preferably connected to a bus node of a data bus mentioned above. In advantageous embodiments, the reset button or the touch-sensitive screen is in close proximity to the electronic Lock arranged, in particular at a distance of at most 2 m, preferably at most 1 m.

A “time-coordinated implementation” is understood in this context to mean that both the connection between the electronic key and the electronic lock and the further predefined action must be carried out within a predefined maximum time interval. The predefined maximum time interval can depend on the arrangement of the components, in particular the electronic lock, and the dimensions of the elevator system. For example, if the reset button is in close proximity to the electronic lock, this time interval can be less than 10 s, preferably less than 5 s. If, on the other hand, the electronic lock is in the head of the elevator shaft in a high-rise building and the reset button is on the ground floor, the time interval can also be up to 5 minutes, 10 minutes or even 15 minutes.

Alternatively or additionally, the control unit, in particular the security control unit, can be programmed in such a way that it can only be operated in the first subset of the operating modes after the connection between the electronic key and the electronic lock has been established and a predefined condition is present in a coordinated manner. This predefined condition can be a state of the elevator system that is determined by at least one sensor of the elevator system. For example, the predefined condition can be that a sensor indicates the removal of a balustrade that was temporarily installed on the elevator car during maintenance. The predefined condition can also consist in the fact that a sensor detects the removal of a support that was temporarily positioned under a counterweight for the elevator car during maintenance. In a further variant, the predefined condition can be that at least one bolt has been retracted which was temporarily extended during maintenance in order to limit the movement of the elevator car.

Alternatively or additionally, the control unit, in particular the security control unit, can be programmed in such a way that it can only be operated in the second subset of the operating modes after the connection between the electronic key and the electronic lock has been disconnected and when a predefined condition is present in a coordinated manner. This predefined condition can be a state of the elevator system that is determined by at least one sensor of the elevator system. For example, the predefined condition be that a sensor indicates the installation of a balustrade, which was temporarily brought into operating position on the elevator car during maintenance. The predefined condition can also consist in the fact that a sensor detects the erection of a support that was temporarily brought into operating position under a counterweight for the elevator car during maintenance. In a further variant, the predefined condition can be that at least one bolt has been deployed that was temporarily brought into the operating position during maintenance in order to limit the movement of the elevator car.

In some embodiments, the first and / or the second subset of operating modes can be activated or deactivated only by a single electronic key or by several electronic keys of the same type. Several electronic keys are considered to be of the same type, in particular, if they have the same code. However, it is also conceivable and within the scope of the invention that the first and / or the second subset of operating modes can be activated or deactivated by several different types of electronic keys. For example, the electronic keys can have different codes. With the different types of electronic keys, different subsets of operating modes of the control unit can be activated or deactivated. For example, it is conceivable that only a normal operating mode can be activated with a first electronic key and that a configuration mode can also be activated with a second electronic key. This means that the configuration mode can only be activated with the second key. This allows different subsets of the operating modes to be made available to different groups of people in a simple manner.

A sensor can be connected to the control unit, which sensor can send sensor data to the control unit, in particular to the safety control unit, these sensor data characterizing a state of the elevator. The sensor can be connected to the safety system directly or indirectly via the data bus, in which case the sensor data can be sent via the data bus. The sensor can be, for example, a position sensor, a speed sensor, a limit switch for the detection of the top and bottom permitted position of the elevator car, a sensor for an above-mentioned balustrade or a sensor for an above-mentioned bolt.

A second aspect of the invention is an elevator installation which contains at least one elevator and at least one safety system as described above.

Another aspect of the invention relates to a method for operating a security system as described above. This method includes a step in which a connection between the electronic key and the electronic lock is at least temporarily established or disconnected. Due to the properties of the safety system according to the invention, this has the effect that the control unit, in particular the safety control unit, can then no longer be operated in at least one additional operating mode and / or in at least one operating mode. In particular, the connection between the electronic key and the electronic lock can therefore be established or disconnected in order to activate a normal operating mode or a maintenance mode.

In a second step, the connection between the electronic key and the electronic lock can be restored or disconnected. This can ensure that the control unit, in particular the safety control unit, can then no longer be operated again in at least one operating mode and / or in at least one operating mode, in particular in a maintenance mode or in a normal operating mode.

Optionally, at least one further predefined action can be carried out in a time-coordinated manner for the first and / or second step. In particular, a reset button can be operated or a touch-sensitive screen can be touched.

As above, “time-coordinated” is understood to mean that the separation or establishment of the connection between the electronic key and the electronic lock and the further predefined action must take place within a predefined time interval.

Figur 1:

ein Blockschaltbild eines erfindungsgemässen Sicherheitssystems für einen Aufzug.

The invention is explained in more detail below with reference to a drawing. It shows

Figure 1:

a block diagram of a safety system according to the invention for an elevator.

Figure 1 shows a block diagram of a safety system 1 according to the invention for an elevator 2. The safety system 1 contains a safety control unit 3 for monitoring the elevator 2 and a data bus 5 with four bus nodes 6. An elevator control unit 4 is also provided for controlling the elevator 2. In particular, the elevator control unit 4 can control the position and the speed of an elevator car (not shown here) or the opening and closing of the doors of this elevator car. The safety control unit 3 can receive data from the bus node 6 via the data bus 5. The security system 1 also has an electronic lock 7 which is connected to one of the bus nodes 6. The electronic lock 7 contains an RFID reading device 9. It can be or is connected to an electronic key 8 which contains an RFID tag 10 which can be read out by means of the RFID reading device 9.

The security control unit 3 is programmed in such a way that it can only be operated in a maintenance mode if there is no connection between the electronic key 7 and the electronic lock 8. In this maintenance mode, the elevator 2 can be inspected. For example, in this maintenance mode, doors of the elevator car can also be opened and / or remain open when the elevator car is not at the level of a floor without an alarm being output.

Only after the connection between the electronic key 7 and the electronic lock 8 has been re-established is at least one operating mode that deviates from the maintenance mode available, in particular a normal operating mode. This effectively prevents the normal operating mode from being activated by unauthorized persons who do not have access to the electronic key 7.

A sensor 11 is connected to one of the bus nodes 6 and can send sensor data to the safety control unit 3 via the data bus 5. The sensor data characterize a condition of the elevator, for example its position or its speed. For this purpose, the sensor 11 can be designed, for example, as a position sensor or speed sensor.

Claims (15)

1. Safety system (1) for an elevator (2), containing at least one control unit which can be operated in at least two different operating modes, characterized in that the safety system (1) has at least one electronic lock (7) which is connected to the control unit and can be or is connected to at least one electronic key (8), the control unit being programmed in such a way that,

   - when there is a connection between the electronic key (7) and the electronic lock (8), the control unit can only be operated in an operating mode of a first subset of the operating modes and

   - when there is no connection between the electronic key (7) and the electronic lock (8), the control unit can only be operated in an operating mode of a second subset of the operating modes,

   a maintenance mode only being available in the second subset of the operating modes.
2. Safety system (1) according to claim 1, characterized in that the control unit contains:

   - at least one safety control unit (3) which can be operated in the at least two different operating modes,

   - at least one elevator control unit (4) for controlling the elevator (2).
3. Safety system (1) according to either of the preceding claims, characterized in that it contains at least one data bus (5) having a plurality of bus nodes (6), the control unit, in particular the safety control unit (3), being able to receive data from the bus nodes (6) via the data bus (5), and the electronic lock (7) being connected to one of the bus nodes (6).
4. Safety system (1) according to any of the preceding claims, characterized in that the electronic lock (7) is arranged in, upon, on or under an elevator car, in or on a wall or a top of an elevator shaft or in a machine room, in particular outside an elevator car.
5. Safety system (1) according to any of the preceding claims, characterized in that the control unit, in particular the safety control unit (3), is programmed in such a way that it can be operated in an operating mode of the first subset of the operating modes only after the connection between the electronic key (7) and the electronic lock (8) has been established and at least one further predefined action has been carried out in a temporally coordinated manner.
6. Safety system (1) according to any of the preceding claims, characterized in that the control unit, in particular the safety control unit (3), is programmed in such a way that it can be operated in an operating mode of the second subset of the operating modes only after the connection between the electronic key (7) and the electronic lock (8) has been disconnected and at least one further predefined action has been carried out in a temporally coordinated manner.
7. Safety system (1) according to either claim 5 or claim 6, characterized in that the further predefined action is the actuation of a reset button or the touching of a touch-sensitive screen.
8. Safety system (1) according to any of the preceding claims, characterized in that the control unit, in particular the safety control unit (3), is programmed in such a way that it can be operated in an operating mode of the first subset of the operating modes only after the connection between the electronic key (7) and the electronic lock (8) has been established and when a predefined condition is present in a temporally coordinated manner.
9. Safety system (1) according to any of the preceding claims, characterized in that the control unit, in particular the safety control unit (3), is programmed in such a way that it can be operated in an operating mode of the second subset of the operating modes only after the connection between the electronic key (7) and the electronic lock (8) has been disconnected and when a predefined condition is present in a temporally coordinated manner.
10. Safety system (1) according to any of the preceding claims, characterized in that the operating modes in which the control unit, in particular the safety control unit (3), can be operated comprise at least one operating mode selected from the group consisting of at least one normal operating mode, at least one maintenance mode and at least one configuration mode.
11. Safety system (1) according to any of the preceding claims, characterized in that a sensor (11) is connected to the control unit, which sensor can transmit sensor data to the control unit, in particular to the safety control unit (3), which data characterize a state of the elevator (2), the sensor (11) in particular being selected from the group consisting of: position sensors, speed sensors, limit switches for detecting the uppermost and lowest permitted position of the elevator car, sensors for a balustrade which is temporarily installed during maintenance, and sensors for bolts which are temporarily installed during maintenance for limiting the movement of the elevator car.
12. Elevator system comprising at least one elevator (2) and at least one safety system (1) according to any of the preceding claims.
13. Method for operating a safety system (1) according to any of the preceding claims, comprising a first step in which a connection between the electronic key (7) and the electronic lock (8) is established or disconnected at least temporarily.
14. Method according to claim 13, characterized in that, in a second step, the connection between the electronic key (7) and the electronic lock (8) is disconnected again or re-established.
15. Method according to claim 14, characterized in that at least one further predefined action is carried out, in particular a reset button (11) is actuated or a touch-sensitive screen is touched, in a temporally coordinated manner with respect to the first or second step.

Images