EP3083478B1 - Safety circuit for a lift system - Google Patents

Description

The invention relates to a safety system and an elevator installation with this safety system and a method for operating the elevator installation with this safety system according to the independent patent claims.

Today's elevator systems are equipped with a safety system that includes a safety circuit. This consists of several switching contacts connected in series from different safety elements for shaft, door and rope monitoring. The opening of one of these switch contacts leads to the entire safety circuit being interrupted. This in turn causes the power supply for the main drive to be interrupted and thus a rest state to be assumed. For maintenance or testing purposes of the elevator system, one or more of these switching contacts must be bridged using bridging elements. For a buffer run, for example, a limit switch has to be bridged in order to be able to drive onto the buffer beyond the normal operating range in the shaft. Before the elevator system can safely resume normal operation, all bridging elements would have to be removed from the safety circuit. However, it cannot be ruled out that a maintenance technician will forget to remove a bridging element again. The reliability of the safety circuit is impaired accordingly, since a bridged switching contact may not be able to interrupt the safety circuit.

the US 5,487,448A relates to a monitoring device for a control device having a safety chain. According to the invention, the monitoring device has a testable switching device which is provided with input and output connections in such a way that a monitoring loop can be set up from a number of testable switching devices, via which a digital signal sequence in particular can be transmitted as a continuous signal, so that a "digital closed-circuit current loop" is obtained becomes.

the US 5,977,662A describes a circuit arrangement for monitoring a fault-free and for detecting a faulty state of a system, z. B. a cable car or chairlift system. The circuit arrangement has a plurality of switching devices and a control and evaluation unit, the switching devices being connected in series with one another and with the control and evaluation unit.

the U.S. 2011/036668 A1 describes a generic electronic safety system for an elevator with a controller coupled to a motor for driving an elevator car. The safety system includes a safety controller and a bus via which the controller communicates with bus nodes that receive data from a sensor. The controller is in communication with a safety circuit which can be brought into an open state by the safety controller, whereby the motor of the elevator is switched off.

It is therefore the object of the invention to create a safety system with a safety circuit for an elevator installation which only enables normal operation of an elevator installation when a previously inserted bridging element has been removed.

This object is achieved by a security system having the features of the independent patent claims.

A safety system for an elevator installation preferably includes a safety circuit with a plurality of switching contacts and a control unit. At least one first switching contact can be switched electronically and can be bridged using a conductive bridging element, in particular for maintenance or test purposes. In addition, the control unit is directly or indirectly connected to the safety circuit. The first switch contact is open -can be switched on the basis of an instruction from the control unit in order to achieve a change in the status of the safety circuit. In this case, the control unit is set up to detect the absence of the state change of the safety circuit when the at least one first switching contact is bridged by the bridging element.

A bridging element is to be understood here as meaning a conductive element for temporarily bridging a switching contact.

It is advantageous that a previously bridged first switching contact can be opened in a test, for example, and when the bridging element of the safety circuit is removed, the break in the safety circuit can be detected as expected. Such a change of state occurs only when the bridging element has been removed. Accordingly, the removal of a bridging element can be reliably detected by means of this test and the elevator installation can be released for operation. Optionally, this test can also be carried out during normal operation in order to detect an improperly inserted bridging element. In this case, the test can be carried out, for example, once a day.

An electronically switchable switch contact is to be understood here as meaning a switch contact that can be switched by an electronic processing unit, such as the aforementioned control unit. For this purpose, a signal is transmitted from the computing unit to the switching contact. The switching contact itself can be designed as an electronic component in the form of an analog switch or a semiconductor switch, such as field effect transistors, bipolar transistors, switching diodes, thyristors or the like. Alternatively, a switching contact can also be designed electromechanically, such as a relay, contactor or the like.

A control unit is understood to mean a unit with at least one processor which can output at least switching commands to an electronically switchable switching contact. Typically, the control unit also includes a data storage unit and a main memory unit. In a preferred embodiment, the control unit is designed as the main control of the elevator system. As an alternative to this, the control unit can also be designed as a separate safety control unit.

Operation of the elevator installation can be interrupted by the control unit if no change in the status of the safety circuit can be detected due to the instruction of the control unit to switch the first switching contact.

It is advantageous here that operation is not enabled when a bridging element is present. Thus, a safe start of the operation of the elevator system is ensured. The elevator system can only be put into operation when the bridging element has been removed and switching of the first switching contact has an influence on the state of the safety circuit or opening of the first switch can cause an interruption in the safety circuit.

The safety circuit has at least one second electronically switchable switching contact, the second switching contact being switchable by the control unit when no change in the state of the safety circuit can be detected due to the control unit's instruction to switch the first switching contact.

In this way, the safety circuit can be interrupted in a simple manner by switching or opening the second switching contact. Accordingly, the supply of a drive and/or the main control of the elevator installation is interrupted and the elevator installation is put into an idle state.

Alternatively or in addition to this, the control unit can bring itself into a safety mode in which the control unit can no longer execute travel commands and/or can no longer accept car calls.

An error signal can preferably be stored on a data storage unit, preferably a data storage unit of the control unit, if no change in the status of the safety circuit can be detected due to the instruction of the control unit to switch the first switching contact.

An error signal is understood to mean a signal that reflects a negative test result. The control unit expects a status change in the switching process of the first switching contact Safety circuit. If no status change can be detected in the safety circuit, the control unit evaluates the test as negative and stores an error signal in accordance with this result on a data storage unit. The error signal can preferably also contain characteristic information about the first switching contact that was switched. Such characteristic information carries, for example, a value that can be clearly assigned to the first switching contact. The first switching contact is thus clearly identifiable.

This has the advantage that when reading out the data storage unit, a maintenance technician is simply and quickly informed of the cause of the standstill of the elevator installation and does not waste any time troubleshooting. The characteristic information about the first switching contact that was switched, with which the bridged first switching contact can be localized particularly quickly, is particularly advantageous.

The first switching contact can preferably be switched back after the instruction to switch by the control unit after a predetermined period of time, the period of time being at least 1 ms, preferably no longer than 30 s and particularly preferably between 500 ms and 10 s.

The period of time must last long enough for a voltage drop or power failure in the safety circuit to be reliably detectable and depends primarily on the response time of the first switching contact. In the case of a semiconductor switch, this period of time can also be less than 1 ms. Likewise, the period of time for switching back should not last too long in order not to unnecessarily delay the operation of the elevator installation.

If the test result is positive, after the first switching contact has switched back, operation of the elevator installation can be started. If the test result is negative, however, the test must be repeated after the first switching contact has switched back.

The downshifting is preferably carried out autonomously by the first switching contact. For this purpose, the first switching contact has a reset unit. This reset unit is designed as a timing relay, monoflop or the like, which triggers the switching back of the first switching contact.

The safety system preferably includes a further control unit which is connected to the safety circuit. This additional control unit is assigned in particular to a shaft information system. The further control unit is designed in such a way that it switches the first switching contact on the basis of an instruction from the control unit.

If the additional control unit is present, it can trigger the switching back of the first switching contact. In this embodiment, the resetting can take place not only on the basis of the expiry of the specified period of time, but also on the basis of a check of specified conditions.

The additional control unit is preferably assigned an overspeed switch contact or a limit switch contact, which interrupts the safety circuit in the event of overspeed or a permissible end position in the shaft being passed. Of course, the overspeed switching contact and the limit switching contact can preferably be designed as first switching contacts.

In the case of an overspeed switching contact, a condition for downshifting is met, for example, if the further control unit determines that no overspeed of the car can be detected at the time of downshifting. Accordingly, a limit switch contact can be switched back when the car is in a permissible position between the two end positions. The further control unit can obtain both pieces of information, car speed and car position, via the shaft information system. Based on this information, the additional control unit decides whether a condition for switching back the at least one first switching contact is met and switches back the respective first switching contact if the condition is met.

In a preferred embodiment, the first electronically switchable switching contact can be assigned its own further control unit.

A further aspect of the invention relates to an elevator system with the safety circuit described above.

• Schalten mindestens eines ersten elektronisch schaltbaren Schaltkontakts eines Sicherheitskreises unter Anwendung einer Steuereinheit zum Erzielen einer Zustandsänderung des Sicherheitskreises; und
• Detektieren des Ausbleibens einer Zustandsänderung des Sicherheitskreises durch die Steuereinheit, wenn der erste Schaltkontakt von einem Überbrückungselement überbrückt ist.

In addition, the invention also relates to a method for checking the safety system of an elevator installation, having the steps:

• Switching at least one first electronically switchable switching contact of a safety circuit using a control unit to achieve a change in the state of the safety circuit; and
• Detecting the absence of a change in the status of the safety circuit by the control unit when the first switching contact is bridged by a bridging element.

A further step relates to the interruption of the operation of the elevator system by the control unit when it is detected that the state of the safety circuit has not changed. Accordingly, a bridging element can still be plugged in and the first switching contact can be bridged.

A further step relates to the switching of a second electronically switchable switching contact using an instruction from the control unit to interrupt the operation of the elevator system when the failure of the safety circuit to change state is detected.

A further step preferably relates to the storage of an error signal on a data storage unit, preferably a data storage unit of the control unit, when the failure of the safety circuit to change state is detected.

Another step preferably relates to the switching back, in particular the autonomous switching back of the first switched switching contact after a predetermined period of time, the period of time being at least 1 ms, preferably not longer than 30 s and particularly preferably between 500 ms and 10 s.

Finally, a last step preferably relates to the switching of the first switching contact using an instruction from a further control unit which is assigned in particular to a shaft information system. In this case, it is optionally possible to switch back the first switching contact using an instruction from the further control unit after a predetermined condition has been checked.

Figur 1

schematisch einen Schaltplan des erfindungsgemässen Sicherheitssystems umfassend einen Sicherheitskreis einer ersten Ausgestaltung mit einer Steuereinheit; und

Figur 2

schematisch einen Schaltplan des erfindungsgemässen Sicherheitssystems umfassend einen Sicherheitskreis einer zweiten Ausgestaltung mit einer weiteren Steuereinheit.

The invention is better described below with reference to exemplary embodiments. Show it:

figure 1

a schematic circuit diagram of the safety system according to the invention comprising a safety circuit of a first embodiment with a control unit; and

figure 2

schematically shows a circuit diagram of the safety system according to the invention, comprising a safety circuit of a second embodiment with a further control unit.

the figure 1 shows a security system comprising a security circuit 1 with a plurality of switching contacts 10.1, 10.2, 11, 12.1, 12.2, which are connected in series. The switching contacts 10.1, 10.2, 12.1, 12.2 monitor a status of a safety-relevant component of the elevator, such as a shaft door, a car door, a speed limit system, an emergency stop switch or a shaft limit switch. In the example shown, the safety circuit 1 includes five switching contacts 10.1, 10.2, 11, 12.1, 12.2. Of course, the number of switching contacts in safety circuit 1 is variable and dependent on the number of safety-related components to be monitored. The safety circuit 1 is then in a safe state when all switching contacts 10.1, 10.2, 11, 12.1, 12.2 are closed.

The safety circuit 1 is powered by a 24V source, for example. When the safety circuit 1 is in a safe state, a corresponding current flows via the switching contacts 10.1, 10.2, 11, 12.1, 12.2. A contactor 13 is connected at the end of the safety circuit 1 to the same and to a 0V conductor. The contactor 13 includes a switching magnet 13.1 and a switch 13.2, the latter being integrated in a power supply 20 of a main drive 21. The switching magnet 13.1 switches the associated switch 13.2 according to a switching state of the safety circuit 1. The energized switching magnet 13.1 keeps the switch 13.2 closed. As soon as a switching contact 10.1, 10.2, 11, 12.1, 12.2 of the safety circuit 1 is open and the flow of current in the safety circuit 1 is interrupted, the power supply to the switching magnet 13.1 is also interrupted. As a result, the associated switch 13.2 is opened and the power supply 20 to the main drive 21 is interrupted.

In the illustration shown, two bridging elements 14.1, 14.2 are plugged in, which bridge the two switching contacts 10.1, 10.2. This is done, for example, for testing or maintenance purposes of the elevator installation, in order to allow certain travel states that are otherwise not permitted in a normal operating mode. After such tests or maintenance work have been completed, the bridging elements must be removed again in order to ensure safe operation of the elevator installation in a normal mode. Before the elevator system can be operated in normal mode again, it is checked whether the bridging elements 14.1, 14.2 have actually been removed.

For this purpose, the safety circuit 1 is connected to a control unit 30, preferably the main control unit of the elevator installation. The control unit 30 can, on the one hand, detect the state of the safety circuit 1 via the line 31 and, on the other hand, transmit control signals for switching the switching contacts 10.1, 10.2, 11. This action of the control unit 30 on the switching contacts 10.1, 10.2, 11 is in the figures 1 and 2 shown with dashed lines.

In a test, the two switching contacts 10.1, 10.2 are switched to an open state by the control unit 30. If the two bridging elements 14.1, 14.2 have been removed, this opening causes an interruption in the safety circuit 1. This interruption can be recognized by the control unit 30. Accordingly, the expectations of the control unit 30 were met and the elevator installation can be safely operated in normal mode. The switching contacts 10.1, 10.2 are preferably opened in a predetermined order in order to test each switching contact 10.1, 10.2 individually.

On the other hand, the expectations of the control unit are not met if an opening of the switching contacts 10.1, 10.2 does not lead to an interruption in the safety circuit 1. In such a case it must be assumed that one or both bridging elements 14.1, 14.2 have not been removed. Accordingly, opening the switching contacts 10.1, 10.2 has no effect on the state of the safety circuit 1. For safety reasons, this is unacceptable in the normal mode. Accordingly, the control unit 30 opens the safety contact 11 in order to prevent further operation of the elevator installation.

If the test result is negative, an error signal can be stored in a data storage unit of the control unit 30 . The error signal advantageously contains characteristic information, in particular a unique address, via the switch contact or contacts 10.1, 10.2 that are bridged. This enables a service technician to more quickly locate and remove a forgotten bridging element 14.1, 14.2.

The two switching contacts 10.1, 10.2 are switched back or closed after a predetermined period of time. The time span here is at least 1 ms and preferably at most 30 s. A particularly preferred duration of this period of time is 500 ms to 10 s. For resetting, the switching contacts 10.1, 10.2 include a resetting unit.

Such a reset unit is preferably designed as a timing relay or monoflop. In this case, the reset unit can be set to a certain period of time. After this period of time has elapsed, the reset unit triggers the switching back of the associated switching contact 10.1, 10.2.

Of course, the safety circuit 1 can also have additional switching contacts 12.1, 12.2 that cannot be switched by means of a control unit 30. Such non-switchable switching contacts 12.1, 12.2 preferably do not need to be bridged during maintenance work. These switching contacts 12.1, 12.2 monitor, for example, the status of shaft or car doors and an emergency switch. Accordingly, the safety circuit 1 is designed in such a way that, during maintenance, preferably only electronically switchable switching contacts 10.1, 10.2 are to be bridged by means of a bridging element 14.1, 14.2.

the figure 2 shows an alternative embodiment of the security system with an additional control unit 40. In contrast to the first embodiment figure 1 , the two switching contacts 10.1, 10.2 are controlled by the control unit 40. The control unit 40 is connected to the control unit 30 via a line 32 . The control unit 40 receives control signals from the control unit 30 via this line 32 .

In this alternative embodiment, the test of the switching contacts 10.1, 10.2 is also triggered by the control unit 30 by the control unit 30 via the line 32 Control signal for opening the switching contacts 10.1, 10.2 transmitted to the control unit 40. The control unit 40 opens the switching contacts 10.1, 10.2 accordingly in order to check whether the two bridging elements 14.1, 14.2 have been removed.

If a further control unit 40 is present, the resetting of the assigned switch 10.1, 10.2 can be triggered by the control unit 40. Therefore, when designing the safety system, the restoring units from the first exemplary embodiment can be dispensed with. By means of the further control unit 40, a resetting of the switching contacts 10.1, 10.2 can be triggered not only due to the elapse of a period of time, but alternatively or optionally also due to a check of a condition. Otherwise, the test runs analogously to the first exemplary embodiment.

The control unit 40 is assigned to a shaft information system, for example. The shaft information system has information on the speed and position of an elevator car. Accordingly, the switching contact 10.1 can be switched due to an overspeed of the elevator car and the switching contact 10.2 is designed as a limit switch. Switch contact 10.1 must be bridged for a safety brake test and switch contact 10.2 for a buffer drive test. Accordingly, a condition for switching back the switching contact 10.1 is linked to maintaining a permissible car speed and switching back the switching contact 10.2 to maintaining a permissible car position between two end positions in the shaft.

Claims (11)

1. Safety system for an elevator system, comprising

   a safety circuit (1) having a plurality of switching contacts (10.n, 11, 12.n) connected in series, whereby opening one of these switching contacts (10.n, 11, 12.n) results in the entire safety circuit being interrupted, and

   a control unit (30) which is directly or indirectly connected to the safety circuit (1),

   the safety circuit (1) having at least one second switching contact (11) which can be switched by the control unit (30), and the safety circuit (1) thus being able to be interrupted, whereby a power supply of a drive (21) and/or a main controller (30) of the elevator system is interrupted and the elevator system is put into an idle state,

   characterized in that

   at least one first switching contact (10.n) is electronically switchable and can be bridged by means of a conductive bridging element (14.n) for maintenance or test purposes, the first switching contact (10.n) can be switched in response to an instruction from the control unit (30) to achieve a change in state of the safety circuit (1),

   the control unit (30) is configured to detect the absence of the change in state of the safety circuit (1) if the first switching contact (10.n) is bridged by a bridging element (14.n), and

   the control unit (30) is configured to switch the second switching contact (11) if no change in state of the safety circuit (1) can be detected in response to the instruction from the control unit (30) to switch the first switching contact (10.n).
2. Safety system according to claim 1, characterized in that
   an error signal can be stored on a data storage unit, preferably a data storage unit of the control unit (30), if no change in state of the safety circuit (1) can be detected in response to the instruction from the control unit (30) to switch the at least one first switching contact (10.n).
3. Safety system according to claim 1, characterized in that
   after the instruction from the control unit (30) to switch, the first switching contact (10.n) can be switched back after a predetermined period of time, in particular can be autonomously switched back, the time period being at least 1 ms, preferably lasting no longer than 30 s and particularly preferably being between 500 ms and 10 s.
4. Safety system according to any of the preceding claims, comprising a further control unit (40) which is assigned in particular to a shaft information system, characterized in that
   the safety circuit (1) is connected to the further control unit (40), the further control unit (40) being designed such that it switches the first switching contact (10.n) in response to an instruction from the control unit (30).
5. Safety system according to claim 2, characterized in that
   the error signal contains a characteristic piece of information about the first switching contact (10.n), the first switching contact (10.n) being clearly identifiable.
6. Safety system according to any of the preceding claims, characterized in that only the first switching contact (10.n), in particular for maintenance purposes, can be bridged by means of a bridging element (14.n).
7. Elevator system comprising a safety system according to any of the preceding claims.
8. Method for checking a safety system of an elevator system, the safety system comprising a safety circuit (1) having a plurality of switching contacts (10.n, 11, 12.n) connected in series, whereby opening one of these switching contacts (10.n, 11, 12.n) results in the entire safety circuit being interrupted, comprising the step of:

   - switching at least one second electronically switchable switching contact (11) by means of an instruction from the control unit (30) to interrupt the operation of the elevator system,
   characterized by the steps of

   - switching at least one first electronically switchable switching contact (10.n) of a safety circuit (1) by means of an instruction from the control unit (30) to achieve a change in state of the safety circuit (1);

   - detecting the absence of a change in state of the safety circuit (1) by the control unit (30) if the first switching contact (10.n) is bridged by a bridging element (14.n) and

   - switching at least the second electronically switchable switching contact (11) when the absence of the change in state of the safety circuit (1) is detected.
9. Method according to claim 8, comprising the step of

   - storing an error signal on a data storage unit, preferably a data storage unit of the control unit (30), when the absence of the change in state of the safety circuit (1) is detected.
10. Method according to claim 8, comprising the step of

    - switching back, in particular autonomously switching back, the first switched switching contact (lO.n) after a predetermined period of time, wherein the period of time is at least 1 ms, preferably lasts no longer than 30 s and particularly preferably is between 500 ms and 10 s.
11. Method according to any of claims 8 to 10, comprising the step of

    - switching the first switching contact (10.n) by means of an instruction from a further control unit (40) which is assigned in particular to a shaft information system.

Images