EP3224174A1

EP3224174A1 - Lift system having a plurality of cars and a decentralised safety system

Info

Publication number: EP3224174A1
Application number: EP15791305.4A
Authority: EP
Inventors: Eduard STEINHAUER; Matthias Glück; Bankole ADJIBADJI
Original assignee: ThyssenKrupp AG; ThyssenKrupp Elevator AG
Current assignee: TK Elevator Innovation and Operations GmbH
Priority date: 2014-11-27
Filing date: 2015-11-10
Publication date: 2017-10-04
Anticipated expiration: 2035-11-10
Also published as: CN107000985A; EP3599208B8; CN107000985B; US10464782B2; WO2016083114A1; KR20170087947A; ES2891002T3; DE102014017486A1; KR102006558B1; EP3599208B1; EP3599208A1; EP3224174B1; US20170327345A1

Abstract

The invention relates to a lift system (1) comprising a plurality of cars (2), a shaft system (3), a drive system for separately moving the cars (2) within the shaft system (3), and a safety system having a plurality of safety nodes, which safety system is designed to transfer the lift system (1) into a safe operating state when an operating state of the lift system (1) deviating from the normal operation is established. The cars (2), the shaft system (3) and the drive system thereby form a respective functional unit. One of the safety nodes is assigned a respective one of the functional units, wherein the safety nodes are each connected to at least one of the further safety nodes via an interface for transmitting data. The safety nodes each comprise at least one sensor for determining an operating parameter of the corresponding assigned functional unit, and a control unit that is designed to evaluate the operating parameter determined by the at least one sensor of the respective safety node, and to make an establishment relating to an operating state deviating from the normal operation, based on the data transmitted from the at least one further safety node.

Description

Elevator installation with a plurality of cars and a decentralized security system

The invention relates to an elevator installation comprising a plurality of cars, a shaft system enabling circulating operation of the cars, at least one drive system for moving the cars within the shaft system and a safety system having a plurality of safety nodes. The safety system of the elevator system is designed to detect normal operation

deviating operating state of the elevator system to transfer the elevator system in a safe operating condition. The elevator cars of the elevator installation, the shaft system of the elevator installation and the at least one drive system of the elevator installation each form at least one functional unit.

Due to the fact that in such an elevator system several cars can be moved largely independently of each other in a common shaft of the shaft system, there is the problem in such elevator systems to ensure that a collision between adjacent cars is reliably prevented.

For this purpose, it is usually necessary that a plurality of operating parameters of an elevator system are detected and evaluated, in particular the current position of each car. The more cars an elevator system contains, the more extensive the amount of data to be processed and transmitted.

Publication EP 1 562 848 B1 discloses an elevator installation with at least one shaft in which at least two cars can be moved along a common roadway. In this elevator system the cars are each assigned a control unit, a drive and a brake. In order to prevent a collision between the cars of the elevator system, the distance between adjacent cars is monitored in each case. If a predetermined minimum critical distance is exceeded, it is provided that an emergency stop of the corresponding car is triggered.

From document EP 0 769 468 B1 a further elevator installation is known in which several cars can be moved simultaneously in at least one shaft. In this elevator system, each car has its own drive and its own safety module. The security modules are designed to trigger the brake system of the respective car and other cars. For this purpose, it is provided that data acquired or evaluated by a security module is transmitted to all other security modules. A problem known from EP 0 769 468 B1 is that the amount of data to be transmitted is so great that ongoing transmission and processing of these data by the security modules is not possible, at least with reasonable technical effort, which is why EP 0 769 468 B1 proposes to work with a dynamic elevator model. Against this background, it is an object of the present invention, an aforementioned

Improve elevator system. In particular, an elevator installation with an improved safety system is to be provided. Preferably, the elevator system should enable a security concept which utilizes a distributed system architecture and advantageously enables short reaction times. In this case, the communication load occurring to ensure the safe operation of an elevator installation should preferably be reduced in comparison to previously known elevator installations.

To solve the problem, we have an elevator system comprising a plurality of cars, a circulation system of the car enabling shaft system, at least one drive system for moving the cars and a security system with a plurality of security nodes, which is formed upon detection of a deviating from normal operation of the elevator system proposed to convert the elevator system into a safe operating state. The cars, the

The shaft system and the at least one drive system each form at least one functional unit. At least one of the security nodes is assigned to one of the functional units. Each functional unit thus advantageously has at least one security node. The security nodes are each connected to at least one of the further security nodes via at least one interface for transmitting data. In addition, the security nodes each comprise at least one sensor for detecting an operating parameter of the corresponding assigned functional unit. Furthermore, the security nodes each comprise at least one control unit, which is designed to detect the one of the at least one sensor of the respective security node

Evaluate operating parameters and, taking into account, that is, in particular, with additional consideration, to make the data transmitted by the at least one further security node a statement regarding a deviating from normal operation mode. Data transmitted by a security node are, in particular, operating parameters of that functional unit assigned to the security node, preferably already evaluated operating parameters.

Advantageously, the elevator installation according to the invention thus enables a decentralized monitoring of functional units of the elevator installation. In this case, operating parameters detected with regard to a functional unit need advantageously not first be transmitted to a central control unit but can be evaluated directly by the control unit of the safety node assigned to the functional unit. This advantageously reduces the amount of data to be transmitted and thus the communication load.

Moreover, since the elevator installation according to the invention advantageously makes it possible, in each case at one

Safety node to determine a mode deviating from normal operation,

In particular, if a functional unit does not work as intended, that is, for example, a car can not be moved or is moved at too high a speed, advantageously short reaction times are made possible. As a result, the safety of an elevator system is advantageously further increased. According to an advantageous embodiment of the elevator installation according to the invention, it is provided that the at least one drive system can be operated bay-wise, advantageously such that the cars can be moved independently of one another in defined sections of the shaft system, wherein preferably each of the defined sections forms a functional unit of the

Drive system, which is assigned in each case at least one of the security nodes. The

Drive system preferably comprises at least one linear motor. For this purpose, the elevator installation preferably has rails as part of the linear drive, along which the cars can be moved separately. The rails are advantageously partially energized so that the drive system is formed bay portion operable. The rails of the elevator system can advantageously be moved independently of one another by the rails which can be supplied in sections. In this case, in particular, such an energizable rail section is a defined section of the shaft system which as such forms a respective functional unit of the drive system. The drive system as a functional unit thus advantageously again has a multiplicity of functional units, to which a safety node is advantageously assigned in each case.

In particular, it is provided that such an energizable rail section of the linear drive in each case forms a functional unit. Advantageously, a security node is assigned to each power-supplyable rail section or to a group of power-supplyable rail sections in each case as a functional unit. Sensors of this security node check advantageously for the

Rail sections relevant operating parameters, in particular whether a rail section is working properly and / or whether a car of the elevator system along a rail section is moved.

The control unit of such a safety node is advantageously designed to switch off different linear motor segments, in particular the aforementioned rail sections of the linear drive, depending on the current positions of the elevator cars, in particular to eliminate possible sources of error and, if necessary, the elevator system or the corresponding functional unit of the drive system into one to transfer safe operating state.

In particular, it is provided as a further advantageous embodiment that the control unit of a safety node assigned to a functional unit of the drive system can influence the control of the linear motor segments. It is particularly envisaged that one on one

Linear motor segment moved car can be braked, if this

Linear motor segment assigned security node of this car assigned

Security node is signaled a collision hazard. In order to enable such a data exchange, the security nodes are advantageously linked to one another via a communication interface, for example via a communication bus or an air interface, in particular using WLAN (WLAN: Wireless Local Area Network).

A further particularly advantageous embodiment of the elevator installation according to the invention provides that the shaft system of the elevator installation has at least two vertically extending transport paths along which the cars can be moved vertically, and at least two conversion means for converting the cars between the transport routes comprises. Each of the transfer devices is included

Advantageously, a functional unit of the shaft system, which is assigned in each case a security node. By means of the transfer devices, the cars can advantageously be moved in particular between shafts of the shaft system of the elevator system. A shaft can each represent a transport route. However, according to one embodiment variant, a shaft may also comprise a plurality of transport paths, preferably such that a plurality of cars can be moved simultaneously next to one another and behind one another in the shaft.

In particular, a possibility for a circulation operation of the elevator cars of the elevator installation is provided by the conversion device. In particular, such a circulation operation provides that the cars are moved along at least one transport path of the shaft system exclusively in one direction, for example upwards, and along at least one further transport path of the shaft system exclusively in another direction, for example downwards.

Characterized in that according to a preferred embodiment of the invention it is provided that the individual transfer means or a group of transfer means is assigned in each case a security node, advantageously monitoring of the proper function of the transfer means is provided directly to the transfer means. As a result, the amount of data to be transmitted is advantageously further reduced. If there is an error in a conversion device, so that they are no longer in the

Normal operation can be operated, but is transferred to a safe operating state, this is advantageously communicated to other other functional units assigned security nodes. The elevator installation is advantageously designed in such a way that the elevator system can continue to be operated while the defective or inoperable converter is no longer approached by the cars.

As a particularly preferred embodiment of the elevator system according to the invention it is provided that the transport paths of the shaft system rails are along which the cars are moved by means of at least one linear drive as a drive system. Each rail is advantageously formed with at least one rotatable to the vertical transport segment segment as a conversion device, said rotatable segments can be aligned with each other so that a car of the elevator system along the segments between the rails can be moved.

According to a further particularly advantageous embodiment of the elevator installation according to the invention, the functional units of the elevator installation each have at least one safety device. This at least one safety device can advantageously convert the respective functional unit into a safe operating state by triggering. Furthermore, it is advantageously provided that the at least one safety device can be triggered directly by the control unit of the safety node assigned to the respective functional unit for triggering. When

Safety device of a car is in particular a brake or a safety gear intended . As a safety device of a functional unit of the drive system, in particular, a switching unit is provided, for example, a contactor circuit, which can set the functional unit de-energized. As a security device of a converter as a functional unit of the shaft system in particular a locking mechanism is provided, which can fix the transfer device in a defined position.

Advantageously, the security nodes are arranged on the functional units, preferably such that the control unit, the at least one sensor and the at least one securing device are arranged together on a functional unit. As a result, decisions to transfer a functional unit and thus the elevator installation to a safe operating state can advantageously be made locally and decentrally. This advantageously leads to an increased robustness of the security system. In addition, security-relevant decisions can advantageously be made simultaneously. For example, a car can be brought to a halt by triggering the brake of the car and at the same time the corresponding functional unit of the drive system, which was responsible for a method of this car, are disabled. In addition, a high scalability of the system is achieved by the proposed elevator system. Adjustments to the safety system, for example, to a larger number of cars, thereby advantageously comparatively small.

A further particularly advantageous embodiment of the elevator installation according to the invention provides that a plurality of monitoring rooms is defined for the shaft system of the elevator installation, each monitoring room being assigned a plurality of functional units, the safety nodes of the functional units located in a monitoring room being connected via at least one interface to the elevator system Transferring data is connected. The interstices are not structurally or constructively separate areas but rather defined with respect to the security system

Space segments that can overlap in particular. By defining this

Surveillance is the elevator system with respect to the monitoring of the normal operation of the

Elevator system advantageously subdivided into subsystems, each subsystem is advantageously monitored with respect to an operating mode deviating from normal operation. a

Surveillance space is advantageously assigned at least one car, at least one functional unit of the shaft system and at least one functional unit of the drive system. Particularly preferred are a monitoring room also directly adjacent to a car

Assigned to cars, in particular a preceding car and a subsequent car. A car is advantageously assigned in each case at least two monitoring rooms, namely once as a car, which is surrounded by two adjacent cars and once as to a car adjacent car.

An advantageous embodiment variant of the invention provides that the interstitial spaces are assigned spatially fixed, preferably via spatial coordinates that represent positions within the shaft system of the elevator system. For this purpose, in particular the shaft system by a permanently assigned Raster are represented. A basically suitable grid is for example from the

Publication EP 1 719 727 B1 known.

As a further advantageous embodiment variant, it is provided that in each case a specific area containing a car is defined as a monitoring space, so that this monitoring space is quasi moved together with the car. If a further car is moved into this monitoring space, it is advantageously monitored with respect to a deviation from a normal operation.

In particular, it is provided that the monitoring space in this embodiment are always associated with at least one functional unit of the shaft system and at least one functional unit of the drive system, the associated functional units can change when moving the car.

In particular, each of one of the elevator cars of the elevator system approachable shaft area of the

Well system assigned at least one monitoring room.

Advantageously, an exchange of operating parameters between safety nodes, which are required for determining a deviating from a normal operation operating state of the elevator system exclusively within the respective monitoring space. Only if one of a

Normal operation deviating operating state is detected, this information is advantageously transmitted beyond the interstitial space addition to other security nodes.

According to a further advantageous embodiment of the invention, the elevator installation is designed to be partially deactivatable, in particular in such a way that individual functional units or groups of functional units, in particular individual cars and / or functional units of the drive system, can be deactivated, the elevator installation being not further developed deactivated functional units continue to operate.

Advantageously, it is further provided that in each case a section of the shaft system having at least one shaft door is a functional unit to which at least one security node is assigned. The security node is advantageously designed to monitor whether this functional unit is working properly. For this purpose, the safety node advantageously has sensors for detecting operating parameters of this functional unit. Furthermore, it is provided in particular that the

Security node of a control unit for evaluating the operating parameters and for the evaluation of data received from security nodes of other functional units data, for example

Operating parameters of a car, is formed.

According to a further advantageous aspect of the invention, the safety node assigned to the at least one shaft door section of the shaft system has at least one sensor which is designed as a functional unit and deviates from normal operation

To record the operating status of this functional unit. Advantageously, the elevator installation, Preferably, the security system of the elevator installation, in particular of the security node of the security system assigned to this functional unit, is designed to deactivate this functional unit when detecting such an operating mode deviating from normal operation. The elevator installation, preferably the safety system of the elevator system, is advantageously further designed to move the elevator cars of the elevator system exclusively outside this section of the shaft system which has at least one landing door.

In particular, an opening of the shaft doors deviating from normal operation is provided as such an operating state deviating from normal operation. In order to monitor this, in particular a sensor which monitors the opening and closing of the shaft doors is provided. Since, for example, a method of a car in a shaft section with open shaft doors represents a danger potential for the users of the car, this section is advantageously deactivated. The elevator system is advantageously designed to move the cars no longer within this section of the shaft, but to bring the cars maximally up to this shaft section.

In accordance with a further particularly preferred embodiment of the elevator installation according to the invention, the control unit of a safety node assigned to a car as a functional unit is configured to predict a first stop point for a first direction of travel of the car and / or to predict a second stop point for a second direction of travel of the car. The respective stop point indicates the position at which the car in the respective direction of travel stop if necessary, that is, stop, can. The stopping points are thereby predicted by evaluation of operating parameters detected by the sensors. The prediction is advantageously based on a predictor model executed by means of a computer, in particular a computer of the control unit.

Preferably, operating parameters detected by the sensor are evaluated, which are the same

Security node heard. In addition, it is provided in particular that operating parameters transmitted to the security node are likewise taken into account in the evaluation. Operating parameters taken into account in the evaluation are, in particular, the speed of the car, the position of the car in the shaft system, the acceleration of the car, the load of the car and the state of the brakes of the car. These operating parameters and the predicted stop points are preferably determined in predefined discrete time intervals of, for example, 5 ms to 50 ms (ms: milliseconds). As a result, an ongoing prediction of the stopping points is made possible.

Advantageously, the safety node assigned to a driving node is thus configured to run for this car, that is to say essentially continuously, to calculate the stop point for the first direction of travel and the stop point for the second direction of travel. In particular, this stop point provides information about where this car would come to a stop or a stop in the event of braking, in particular emergency braking. Operating parameters of the other cars, in particular

Driving parameters of the other cars advantageously need not be considered in this determination of the stopping points. As a result, the communication load is advantageously further reduced. As a particularly advantageous development of the elevator system it is provided that the safety node assigned to a car as a functional unit is also designed to transmit the predicted first stop points via the interface in each case at least to the safety node assigned to the car adjacent in the first direction of travel, and predicted to transmit second stop points via the interface in each case at least to the security node, which is assigned to the car adjacent in the second direction of travel. Thus, the security node assigned to a car advantageously also knows, in addition to the stop points of this car, the stop points of the cars adjacent to this car in the respective direction of travel of this car.

According to a further advantageous development of the elevator system, it is provided that the control unit of a safety node assigned to a car as a functional unit is designed to determine the distance from the first stop point of this car to the second stop point of the car adjacent in the first direction of travel. Furthermore, this control unit is advantageously designed to reduce the distance from the second stop point of this car to the first stop point in the second

Direction of travel adjacent car to determine. The safety system of the elevator system is advantageously designed to transfer the elevator system at a determined negative distance in a safe operating condition.

By balancing a stop point of a car for one direction of travel with the stop point of an adjacent car can thereby advantageously detect a risk of collision. In this embodiment, therefore, advantageously only stop points are transmitted and, in particular, no further car-related operating parameters, so that the amount of data to be transmitted is advantageously low. Since it is provided in particular that only the stopping points of adjacent cars are matched with one another, the data volume to be transmitted is advantageously further reduced.

A current stop point for a direction of travel of a car is based on the current position of the car in particular the distance that the car needs in this direction to stop. Preferably, the distance is about a safety distance, preferably a fixed

Safety distance applied so that the stop point is further away from the car accordingly. Depending on the current operating parameters of a car of the elevator system, the distance between the car and the stop point thus also changes for each direction of travel.

In particular, increases with the speed with which a car is moved, and the distance of the corresponding stop point to the car.

The minimum distance that two adjacent cars can assume relative to each other is dependent on a plurality of operating parameters, in particular the current position of the cars in the shaft system, the speeds of the cars, the accelerations of the cars, the payloads of the cars and / or the states of the brakes of the cars , In each case, these operating parameters are preferably recorded individually only for each car in order to determine from these operating parameters for each car for the car at least one direction of travel to determine the respective stop point. By adjusting the stopping points of adjacent cars is thereby advantageously checked that a minimum distance between the cars is maintained, this minimum distance is advantageously adjusted dynamically by the ongoing investigation of the stop points and their adjustment.

If a negative distance is determined when determining the distances of the predicted stop points of adjacent cars, that is, the stop point of a car is further away from this car than the stop point of an adjacent car, the elevator system is advantageously in a

Safety mode transferred, in particular in which the corresponding adjacent cars whose stopping points have a negative distance, braked and thus stopped, in particular by triggering safety devices of these cars. It should be noted that the term "negative distance" refers to the case where the stop point of a considered car is farther from this considered car than the stop point of an adjacent car, in particular a preceding or following car In this case, the meaning of a negative number depends on the reference system used, for example, a "negative distance" for a corresponding reference system can also be expressed by a positive number.

Advantageously, both horizontal and vertical movements of the cars are taken into account and corresponding stopping points are predicted. Advantageously, rapid detection of possible collisions is provided.

According to a particularly advantageous embodiment of the invention, it is provided that the stop point of each car is predicted in each case assuming the at least one safety device of the elevator system at the latest taking place stops the respective car. In this case, the prediction is thus advantageously conservative. The distance between adjacent cars is thereby sometimes larger than absolutely necessary, but a collision of adjacent cars is reliably prevented. Safety devices of the elevator system are in particular

Braking devices, such as the safety gear of the car and / or on the part of

Drive system provided braking devices. If the drive system of the elevator installation comprises at least one linear drive, in particular also the partial disconnection of a line of the linear drive is provided as the intervention of at least one safety device.

A further advantageous embodiment of the invention provides that the stopping points are each predicted on the assumption of a worst-case scenario in order to reliably prevent a collision of adjacent cars in each case. In particular, it is provided that the stop point of each car is predicated on the additional assumption that the respective car is accelerated before the intervention of the at least one safety device of the elevator system with the maximum possible acceleration by the elevator system. For a holding car, which can be moved in a shaft up and down, thus the stop point in the direction of travel "up" under the Assumption predicts that the car is first accelerated maximally in the direction of travel "upwards" and then brought to a halt by intervention of at least one safety device in the direction of travel "below" is advantageously predicted the stop point in the direction of travel "below" on the assumption that the car is first accelerated maximally in the direction of travel "down" and then brought to a stop by intervention of at least one safety device. Due to the force acting on the car gravity, which is advantageously taken into account in the prediction of the stop points, the distance of the stop point in the direction of travel "up" to the upper end of the car is less than the distance of the stop point in the direction of travel "down" to the lower end of the car.

In particular, it is provided that in a vertically extending shaft of the shaft system of the elevator system, in which at least three cars are moved, an upper stop point and a lower stop point are predicted for each car. Thus, apart from the car located furthest in the shaft and the car located furthest down in the shaft, all the cars have an upper adjacent car and a car adjacent to one another. In this case, it is advantageously provided that in each case the distance of the upper stop point of a car to the lower stop point of the upper adjacent car is determined. Advantageously, the distance of the lower stop point of a car to the upper stop point of the lower adjacent car is further determined.

The stopping points are advantageously defined via a grid permanently assigned to the shaft system. A grid suitable for this purpose is known, for example, from document EP 1 719 727 B1.

With such a fixed grid, the lowest point that a car can approach via the shaft system is preferably assigned the value 0. The highest point that a car can approach via the shaft system is preferably assigned a corresponding maximum value. If the cars can also be moved laterally, the stopping points can be represented in particular as coordinates (x, y) or (x, y, z). In this case, only the corresponding coordinate is preferably taken into account for a current direction of travel, for example, only the coordinate x for the direction of travel x. Particularly in the areas in which the direction of travel changes, for example, from the direction of travel x in the direction of travel y, it is advantageously provided that more than one coordinate is taken into account here for a corresponding section comprising the transition area, that is to say in relation to the example given above Coordinates (x, y).

With such a definition of a fixed grid, there is a risk of collision if the upper stop point of a car is greater than the lower stop point of the car driving above this car. The elevator system is in this case transferred to a safety mode, in particular by at least one of the two cars is brought to a stop. The same applies accordingly if the lower stop point of a car is smaller than the upper stop point of the car moving below this car. Possible collision risks of a car with an upper adjacent car and / or a lower adjacent car are thus reliably detected, namely by checking whether a determined distance is negative, so have the intersected stop points have an overlap area. If a negative distance is determined, the elevator installation is advantageously transferred from normal operation into a safety mode, in particular by the affected cars being stopped. The other cars will advantageously continue in limited operation process, the stopped cars define a restricted area to which the further operated cars may only approach to a predefined distance. Preferably, the cars stopped in a safety mode as part of the transfer of the elevator system receive fixed assigned

Stop points, so that in particular a collision of cars with the stopped cars with the application of the same method continues to be prevented.

Each control unit associated with a car advantageously calculates the stop points for the at least one direction of travel of this car, in particular an upper and a lower stop point, and exchanges these with those of the control units of the adjacent cars. Instead of calculating the distances between adjacent cars, the stopping points are advantageously compared with each other, as already explained above. As long as the stop points do not overlap, ie the negative distance is determined, there is no danger of collision.

Preferably, the control unit of a car triggers a safety device of this car when determining a negative distance of the stop points, wherein it is provided in particular that a triggering of the safety device brings the car to stop. In particular, the actuation of a brake of the car is provided as triggering a safety device of the car. Advantageously, the control device associated with a car is in terms of the triggering of

Safety devices only responsible for the safety device of this car and advantageously does not have to slow down other cars. As a result, is to be transferred

Data volume advantageously further reduced.

In particular, it is provided that the stopping points are each predicted from current operating parameters of the respective car. According to an advantageous embodiment variant, it is provided that stop points are predefined for all the quantized combinations of operating parameters. An assignment of the stop points to such a combination of operating parameters is carried out according to an advantageous embodiment via lookup table. In particular, according to another advantageous embodiment variant, such an allocation is provided as a plausibility check of stop points predicted by real-time calculations. Advantageously, the elevator system is also converted into a safety mode upon detection of a predefined deviation from associated stop points and predicted stop points. In particular, the elevator installation according to the invention, in particular the respective components of the elevator installation, is designed to carry out method steps described in connection with the invention.

Further advantages, features and design details of the invention will be explained in more detail in connection with the exemplary embodiments illustrated in the figures. Showing:

Fig. 1 in a simplified schematic representation of an exemplary embodiment of a

elevator installation according to the invention;

Fig. 2 shows in a simplified schematic representation an exemplary embodiment for an assignment of security nodes to the functional units in a design variant of an elevator installation according to the invention;

Fig. 3 is a simplified schematic representation of a section of an exemplary embodiment of an elevator installation according to the invention;

Fig. 4 in a simplified schematic representation of a further embodiment of a

elevator installation according to the invention; and

Fig. 5 shows in a simplified schematic representation an exemplary embodiment of a car for use in an elevator system shown in FIG. 4, with examples shown

Stop points.

In Fig. 1 shows a lift installation 1 with a plurality of cars 2 and a shaft system 3 in simplified form. The cars 2 can be separated from each other in a first direction of travel. 6

(symbolically represented by a single arrow 6) and in a second direction of travel 7 (symbolically represented by a double arrow 7) are moved, that is largely independent of each other. The cars 2 each form a functional unit of the elevator installation 1. The shaft system 3 of the elevator installation 1 is designed in such a way that a circulation operation of the elevator cars 2 is made possible. This means that the cars 2 can be moved in particular all in the first direction of travel 6 or all in the second direction of travel 7.

The in Fig. 1 illustrated elevator system 1 has for the process of moving the car 2 to a linear drive with a plurality of linear motor segments 4, wherein the linear motor segments 4 are each a functional unit of the drive system of the elevator system 1. By these linear motor segments 4, which are formed individually activated and deactivated, the drive system of the elevator system 1 is advantageously designed bay sections operable, in particular such that the cars 2 can be moved independently of each other in defined sections of the shaft system, each of the Linear motor segments 4 forms such a defined section and is each a functional unit of the drive system.

The shaft system 3 of the elevator installation 1 comprises a plurality of shaft doors 5, the sections of the shaft system 3 comprising a shaft door 5 each having a functional unit

Form elevator system 1.

The in Fig. 1 also includes a security system (not explicitly shown in FIG. 1) with a plurality of security nodes (not explicitly shown in FIG. 1). At least one of the security nodes is in each case one of the functional units, that is to say one each in particular

Car 2, at least one linear motor segment 4 and at least one landing door 5

comprehensive shaft section assigned. The security nodes are advantageously each connected to at least one of the further security nodes via at least one interface for transmitting data, for example a communication bus or wirelessly via an air interface. The security nodes each comprise at least one sensor (not explicitly illustrated in FIG

Detecting an operating parameter of the corresponding assigned functional unit. For example, it is provided that the position, the speed, the acceleration and the payload of a

Car as operating parameters are detected.

Furthermore, it is provided that the security nodes in each case comprise at least one control unit (not explicitly illustrated in FIG. 1) which is designed to evaluate the operating parameter detected by the at least one sensor of the respective security node. The control unit is

advantageously further formed, taking into account this evaluation and the data transmitted by the at least one further security node, to make a determination with respect to a different operating state from normal operation.

Thus, the security system of the elevator system 1 is advantageously designed to convert the elevator system into a safe operating state upon detection of a deviating from normal operation operating state of the elevator system 1. The normal operation is in particular a fault-free operation. A safe operating state of the elevator installation 1 is an operating condition in which the elevator installation 1 is transferred in the event of a fault and / or danger. In particular, it is provided in such a safe operating state that at least one of the functional units of the elevator installation 1 is deactivated. For example, at least one linear motor segment 4 can be switched off here and / or at least one car 2 can be stopped by triggering emergency braking and / or a shaft section of the shaft system 3 comprising at least one shaft door 5 can no longer be approached by the cars 2.

With reference to FIG. 2, the security system of an inventively designed

Lift system explained in more detail. For this purpose, in Fig. 2 shows schematically a plurality of cars 2 as functional units of the elevator installation, a plurality of manhole sections 8, which each form a functional unit of the manhole system, and a plurality of conversion devices 9, which are used for transferring of cars 2 between different transport routes, in particular different shafts of the shaft system are formed, shown as further functional units of the shaft system.

The functional units 2, 8, 9 each have a security node 10, 10 ', 10 ", these security nodes 10, 10', 10" being part of the security system of the elevator installation. The security nodes 10, 10 ', 10 "are connected to each other for the transmission of data (in Fig. 2 symbolically represented by arrows 26) via an interface 11, wherein for the transmission 26 is preferably a

Security protocol is provided.

The safety nodes 10, 10 ', 10 "respectively comprise sensors for detecting operating parameters of the respective functional unit, operating parameters detected by the sensors 12, 13, 14, 15, 19, 20, 21 of a safety node 10, 10', 10" In this case, data transmitted to a security node to other security nodes is sent to a control unit (not explicitly shown in FIG

Transmitted security node. The control unit, for example, a suitably programmed

Microcontroller circuit, evaluates the data. Furthermore, the control unit is designed to trigger a safety device associated with the respective functional unit 2, 8, 9, and thus to transfer the elevator installation to a safe operating state. The transmission of data occurring in a functional unit 2, 8, 9 is shown symbolically in FIG. 2 by the arrows 27. A

Data transmission can also be bidirectional, ie also counter to the arrow direction of the arrows 27th

Advantageously, the safety components, in particular safety devices and the control units triggering the safety devices, are placed locally on the functional units 2, 8, 9, preferably directly on the actuators and sensors. This is advantageously a

Avoid real-time communication over long distances.

Advantageously, security nodes in particular are distributed in vertical and horizontal shafts of the shaft system of an elevator installation. These advantageously record the states of the shaft components. With respect to the functional unit shaft section 8, which each one

Security node 10 'is assigned, for example by means of sensors 15, the states of the

Shaft doors detected.

The security nodes are advantageously formed via corresponding control units and

To disable safety devices functional units of the elevator system, in particular to shut down drives. This can be done for example with respect to the functional unit shaft section 8 via the triggering of safety devices 18, 18 '. The safety devices 18 provide a so-called "Safe Toque Off" (STO) functionality that switches the drive powerless

Safety devices 18 'advantageously provide a functionality that shuts off the drive by a motor protection. Security nodes assigned to functional units of the shaft system are preferably wired directly to the shaft components.

For moving a car horizontally from one bay to another bay

in particular, a conversion device 9 is provided. Such a conversion device 9 is advantageously monitored by a security node 10 "assigned to the respective conversion device 9.

Position limit switches 19, devices for detecting the state of a locking mechanism 20 and an absolute position sensor 21 detect in the embodiment as sensors of the

9. If a mode deviating from normal operation is detected by the safety node 10 "or a control unit of the safety node 10", one of the conversion devices 9 associated safety devices is advantageously triggered, preferably a service brake 17 with a coupled one

Drive shutdown 17 ', which can be implemented in particular as a "Safe Toque Off" (STO) functionality.

The security nodes 10 assigned to the cars 2 comprise in particular sensors 12, 13, 14 for detecting operating parameters with regard to the respective car 2, in particular a sensor 12 for detecting the position of the car, a sensor 13 for detecting the state of the car doors, in particular the states " closed "/" open ", a sensor 14 for detecting the payload of the car 2. Further operating parameters are advantageously transmitted from other security nodes to the respective security node 10 of a car. By evaluating the operating parameters, the security node 10 makes a determination with regard to a different operating state from normal operation. If a mode of operation deviating from normal operation is detected, then advantageously this is done by the safety node 10 or the control unit

Security node 10 safety devices 16, 16 'of the car 2 triggered. As a result, the elevator system is transferred to a safe operating state. In particular, a service brake 16 and a redundant safety gear 16 'are provided as safety units of the car.

In order to further reduce the computational load per security node, provision is made in particular for multiple identical calculations and multiple decisions within the security system

Avoid or at least reduce elevator installation. Therefore, the security nodes 10, 10 ', 10 "are advantageously designed to make decisions, in particular decisions regarding the triggering of a security device, locally and to transmit the corresponding results, states and / or decisions to the other security nodes.

Advantageously, the safety nodes 10, 10 ', 10 "of the functional units 2, 8, 9 are each provided with at least the following information or operating parameters.

The security node 10 of the elevator car 2 advantageously has access to the following

Operating parameters: • X, Y, Z position, car speed and acceleration;

• payload of the car;

• Condition of the car door;

• State actuator or safety device, in particular service brake and

Catcher;

wherein said above information or operating parameters are advantageously provided by the sensors of the security node;

• Condition of the shaft doors;

this information is preferably provided by the security node 10 'of the functional unit 8 of the manhole system;

Information about a possible collision of other cars 2;

wherein for generating this information advantageously the security node 10th

Operating parameters are provided by security nodes 10 of adjacent cars 2, preferably stop points (as explained above and below with reference to FIGS. 4 and 5); and

• state of the conversion device 9;

this information is preferably assigned to that of the conversion device 9

Security node 10 "is provided.

The interaction of security nodes, in particular of security nodes within a defined monitoring space (as explained above), is explained in more detail below with reference to two examples. For better understanding, reference is made to FIG. 1 and FIG. 2 illustrated elements reference.

First example - Emergency stop of the car when detecting a collision hazard:

Each security node 10 assigned to a car 2 as a functional unit, based on its own sensors 12, 13, 14, provides information regarding a possible collision and distributes this information via the interface 11 to all other security nodes assigned to a car as a functional unit are.

Each security node 10, which is assigned to a car 2 as a functional unit, checks the risk of collision on the basis of the received information from other security nodes, which are assigned to a car 2 as a functional unit. If a possible collision is detected, a safe state of the car 2 is initiated, advantageously triggered by the control unit of the corresponding safety node 10.

As long as no secure state is to be achieved, the security node 10, which is assigned to a car 2 as a functional unit, gives permission to all safety nodes, which are assigned to a functional unit 4 of the drive system, to activate the corresponding functional units 4 of the drive system , Activating functional units 4 In the case of a linear drive as drive system, the drive system can be, for example, an energizing of the corresponding linear motor segments.

If the car 2 is to be transferred to a safe operating state, the safety node 10 allocated to this car 2 advantageously notifies all safety nodes assigned to the functional units 4 of the drive system that the functional units 4 of the drive system responsible for this car 2 are to be deactivated Thus, for example, in a linear drive as a drive system, the corresponding linear motor segments are to be turned off.

All security nodes assigned to functional units 4 of the propulsion system check their responsibility for that car 2 based on the information transmitted by the security node 10 assigned to the car 2 via the interface 11. Depending on the result of this check, they deactivate or activate them the corresponding functional units 4 of the

Drive system.

Second example - entry of a car into a transfer device:

Each security node 10 ", which is assigned to a transfer device 9 as a functional unit of the shaft system, generates on the basis of own sensors 19, 20, 21 the information about the current state of the transfer device 9 and transmits it to all other security nodes 10, the car 2 assigned as a functional unit.

Each security node 10, which is assigned to a car 2 as a functional unit, checks the risk of collision with a transfer device 9 on the basis of the received information from the security nodes 10 "assigned to the respective transfer devices 9. If a possible collision is detected, the car 2 becomes transferred to a safe operating condition.

As long as a transition to a safe operating state is not required, assigned to the car 2 security node 10 gives all security nodes that are assigned to a functional unit 4 of the drive system, the permission to activate the corresponding functional units 4 of the drive system, so for example in a linear drive as a drive unit the permission to energize the linear motor segments.

If the car 2 is to be transferred to a safe state, then the safety node 10 assigned to the car 2 transmits to all safety nodes, which are assigned to a functional unit 4 of the drive system, the information to deactivate the functional units 4 of the drive system responsible for this car 2 , In a linear drive as a drive unit thus, for example, the information is transmitted to turn off the linear motor segments. All safety nodes assigned to a functional unit 4 of the drive system use the information to check their responsibility for this car 2 and disable the corresponding functional unit 4 of the drive system, for example the linear motor segment, or allow the corresponding functional unit 4 of the drive system, So for example that

Linear motor segment, to activate. If a change in the state of a transfer device 9 represents a hazard for the car 2 or the persons transported with this car, the safety node 10 "assigned to this transfer device 9 does not permit any

Change of state of the transfer device 9. Preferably, a safety device 17, 17 'is activated, which prevents a change in state of the transfer device 9. Such

Safety device 17 'is in particular a locking mechanism.

In the case of the elevator installation 1 shown in detail in FIG. 3, a part of the shaft system 3, in which the cars 2 can be moved separately, that is to say essentially independently of each other, is shown together with two cars 2. The shaft system 3 in this case has a shaft door 5 having section 8 of the shaft system 3 as a functional unit. In this case, a safety node (not explicitly shown in FIG. 3) is assigned to this shaft section 8. This safety node comprises a sensor (not explicitly shown in FIG. 3), which is designed to detect an operating mode deviating from normal operation of this functional unit 8, the elevator system 1 being designed to detect this functional unit 8 when detecting such an operating state deviating from normal operation disable and the cars 2 of the elevator system 1 advantageously

excluding outside this at least one landing door 5 having section 8 of the

Shaft system 3 to proceed.

In the in Fig. 3 embodiment, a sensor with respect to the shaft section 8 monitors in particular the proper opening and closing of the shaft doors. If, as exemplified in Fig. 3, detected by the sensor as an operating parameter not a successful closing the shaft door 5 to the safety node or to the control unit of the safety node of the shaft section 8, the control unit advantageously disables this shaft section 8. This has the consequence that this shaft section 8 no longer the cars 2 can be approached. These

In this case, information is transmitted to the signal nodes (not explicitly shown in FIG. 3) of the cars 2 at the latest when the cars 2 are moved into the defined monitoring space 28. The elevator installation 1 or the safety system of the elevator installation 1 is in fact advantageously set up in such a way that all security nodes located therein exchange information with one another in a defined monitoring space. Advantageously, 3 corresponding monitoring rooms are defined for the entire shaft system.

By deactivating the shaft section 8, the elevator car 2 traveling in the upward direction of travel 6 can approach maximum to the lower limit region of the section 8 marked by the line 29. The driving in the downward direction of travel 7 car 2 can maximum until approaching the upper limit region of the section 8 marked by the line 29 '.

Otherwise, the elevator system 1 is advantageously still ready for operation.

The in Fig. 4 elevator system 41, which for reasons of clarity not

To scale, comprises a shaft system 42 with two vertical shafts 412 and two connection shafts 413. Furthermore, the elevator system 41 includes a plurality of cars 43 (in FIG. 4 by way of example eight cars), which are moved separately in the shaft system 42 in a subsequent operation can, that is, a plurality of cars 43 can be moved in a slot 412 or a shaft 413.

The cars 43 can be moved upwards in the shafts 412 in a first direction of travel 44 (shown symbolically in FIG. 4 by the arrow 44) and moved downwards in a second direction of travel 45 (symbolically in FIG. 4 by the arrow 45) shown). In addition, in the connection shafts 413, via which the cars 43 can change between the shafts 412, the cars are shown laterally in a third direction 410 (shown symbolically in FIG. 4 by the arrow 410) and in a fourth direction 411 (in FIG symbolically represented by the arrow 411) can be moved.

In particular, it is provided that the elevator installation comprises as drive system at least one linear motor (not explicitly shown in FIG. 4) by means of which the cars 43 are moved within the shaft system 42.

The in Fig. 4 elevator system 41 is operated such that for each car 43 continuously for the first possible direction of travel, a first stop point 46 and for the second possible direction of travel, a second stop point 47 is predicted. Thus, a stop point is predicted for each car 43 at least for one direction of travel. Thus, an upper stop point is predicted as the first stop point 46 for cars 43 located in the vertical shafts 412, and a lower stop point is predicted as the second stop point 47. In the connecting shafts 413, a stop point 46 'located in the direction of travel of the respective car 43 is predicted as the stop point 46' and a second stop point located opposite the direction of travel of the respective car 43 as the stop point 47 '.

In particular, the stopping points can be defined by means of coordinates (x, y), whereby lateral stopping points are defined via the x-coordinates and stop points lying vertically above the y-coordinates. The point A in FIG. 4 can be assigned the coordinate (0, 0) as an example.

The two stop points 46, 47 and 46 ', 47' indicate starting from the current position of the respective car 43 for each of the possible directions of travel 44, 45 or 410, 411 respectively the point at which the car 43 assuming a worst case Case scenarios can stop at the latest. In particular, for an upwardly moving car 43 'taking into account current operating parameters, such as direction, speed and payload of the car 43', an upper stop point 46 predicts, that is, predetermined, where the car 43 'would stop when the Car 43 'would accelerate maximally in the direction of travel and would then slowed down. As the lower stop point 47 of the car 43 'is predicated on the worst-case assumption that the drive fails, the car 43' due to which sags and the car 43 'would only be slowed down.

Corresponding predictions are continuously made for the other cars 43 of the elevator system. For this purpose, the cars 43 each advantageously have a respective control unit, for example a microcontroller circuit designed as a control unit (not explicitly shown in FIG. 4).

For each car 43, which has a neighboring first car in a first direction of travel, the distance from the first stop point 6 of this car to the second stop point 47 of the second car is determined. In addition, the distance from the second stop point 47 of this car to the first stop point 46 of the second car is determined for each car 43, which has an adjacent second car in the second direction.

For example, for the car 43 ', which has a neighboring car 43 "in the direction of travel 44, the distance 48 from the upper stop point 46 of the car 43' to the lower stop point 47 of the car 43" determined. For this purpose, the lower stop point 47 of the car 43 "is advantageously transmitted to a control unit (not explicitly shown in Figure 4) of the car 43. The determined distance 48 is positive in this example risk of collision.

The car 43 'also has an adjacent car 43 "' in the further direction of travel 45. Therefore, for the car 43 ', the distance 49 is also determined from the lower stop point 47 of the car 43' to the upper stop point 46 of the car 43" ' , For this purpose, the upper stop point 46 of the car 43 "'is advantageously transmitted to a control unit (not explicitly shown in Figure 4) of the car 43. The determined distance 49 is negative in this example, ie the upper stop point 46 of the car 43". 'is above the lower stop point 47 of the car 43'. There is thus a danger of collision with respect to the cars 43 'and 43 "' due to the negative distance 49 of the lower stop point 46 of the

Car 43 'and the upper stop point 47 of the car 43 "', the elevator system in a

Safety mode transferred, in particular by car-side brakes of these cars are activated, preferably triggered by the respective cars 43 'and 43 "' associated control units.

Since only one stop point is transmitted to a car 43 by the two adjacent cars, the communication load in the method used is advantageously low.

For further explanation of the stopping points which are predicated on a car 43 according to a method of the invention, reference is made to FIG. 5, reference is made. In Fig. FIG. 5 shows a car 43 with a total car height 417 and an entry threshold 420.

For the in the direction of travel 44 and 45 in the direction of travel (in Fig. 5, the direction of travel in each case by arrows 44, 45 symbolically shown) movable car 43 is for each direction 44, 45 each by way of example predicted stop point 46, 47. For the direction of travel 44 while the upper stop point 46 is shown for the direction of travel 45 and the lower stop point 47th

The upper stop point 46 indicates the point where the car 43 can stop with the upper end of the car 421 starting from current operating parameters and assuming a worst-case scenario at the latest in the direction of travel 44. The distance between the stop point 46 and the upper car end

421 results in the illustrated embodiment from the sum of an optionally definable minimum distance 415 to the car 43, which must not be fallen below, and a calculated from the current driving parameters assuming a worst-case scenario braking path 418. The calculation of the stop points for example, by means of a correspondingly configured

Prädiktormodells.

The lower stop point 47, however, indicates the point where the car 43 with the lower end of the car

422 based on current operating parameters and assuming a worst-case scenario at the latest in the direction of 45 can stop. The distance between the stop point 47 and the lower end of the car 422 results in the illustrated embodiment from the sum of an optional predeterminable minimum distance 416 to the lower end of the car 422, which must not be fallen below, and one of the current driving parameters assuming a worst case Scenarios predicted braking distance 419.

The positions of the stop points vary depending on the current driving parameters. When the car is parked, the stop points will move closer to the car. If the car is traveling at high speed, ie in the direction of travel 44, the upper stop point will be higher. In this case, in particular even at very high speed, the case may occur that the lower stop point 47 is determined lying at the position 414, since in this case a movement in the direction of travel 45 can be excluded even in the worst case scenario.

For each such car 43 shown in Fig. 5, such an upper stop point and a lower stop point are respectively predicted. In each case, the distance between the upper stop point 46 of a car and the lower stop point 47 'or 47 "of a car above this car and the distance between the lower stop point 47 of this car and the upper stop point 46' relationship meadow 46" one below this car adjacent car determined. In a non-critical operation, the distances 48 are positive, since 47 "greater 46 and 47 greater 46". With a negative distance, however, there is a risk of collision. Such a negative distance results when 46 larger 47 'and 46' larger 47th If such a negative distance is determined, the elevator system is transferred to a safe operating condition, in particular in one

Security mode. The exemplary embodiments illustrated in the figures and explained in connection therewith serve to explain the invention and are not restrictive of it. The illustrated embodiments are not reproduced to scale in the figures for reasons of clarity.

Reference number:

1 elevator system

2 car

3 shaft system

4 drive system

5 shaft door

6 first direction of travel (symbolized by single arrow)

7 second direction of travel (symbolized by double arrow)

8 at least one shaft door comprehensive shaft section as a functional unit of the shaft system

9 conversion device as a functional unit of the shaft system

10 security nodes

10 'security node

10 "security knot

11 interface

12 sensor

13 sensor

14 sensor

15 Sensor for detecting the state of the shaft door

16 safety device

16 'safety device

17 safety device

17 'safety device

18 safety device

18 'safety device sensor

sensor

Transfer of data between the security nodes

internal transmission of data at a security node

monitoring room

lower boundary area of a shaft section (8) (represented symbolically by a line) 'upper boundary area of a shaft section (8) (shown symbolically by a line) elevator installation

shaft system

car

'Car

"Car

first direction of travel

second direction of travel

first stop point

'first stop point

"first stop point

second stop point

'first stop point

"first stop point

positive distance of predicted stop points

negative distance of predicted stop points 10 third direction

411 fourth direction of travel

412 vertical shaft

413 connection shaft

414 Extreme position for a possible stop point

415 Minimum clearance to be maintained by the cab

416 Minimum clearance to be maintained by the cab

417 car height

418 predicted braking distance

419 predicted braking distance

420 entrance threshold

421 upper end of the car

422 lower end of the car

Claims

Claims:

1. Elevator installation (1) comprising

a plurality of cars (2),

a circulation system (3) enabling circulating operation of the cars (2),

at least one drive system, and

a security system having a plurality of security nodes (10),

which is formed upon detection of a deviating from normal operation

Operating state of the elevator system (1) to convert the elevator system (1) in a safe operating condition,

wherein the cars (2), the shaft system (3) and the at least one drive system each form at least one functional unit, and

wherein the at least one drive system is designed to be bay-wise operable such that the cars (2) can be moved independently of one another in defined sections of the shaft system (3), each of the defined sections being a functional unit (4) of the drive system,

characterized in that

at least one of the security nodes (10) is assigned in each case one of the functional units (2, 4, 8, 9), wherein

the security nodes (10) are each connected to at least one of the further security nodes via at least one interface (11) for transmitting data,

the security nodes (10) each have at least one sensor (12, 15, 19) for detecting a

Operating parameters of the corresponding assigned functional unit (2, 4, 8, 9) include, and

the security nodes (10) each comprise at least one control unit,

which is designed to evaluate the operating parameters detected by the at least one sensor (12, 15, 19) of the respective safety node (10) and

taking into account the data transmitted by the at least one further security node (10) to make a determination with respect to a different operating state from normal operation.

2. Elevator installation (1) according to claim 1, characterized in that the shaft system (3)

at least two vertically extending transport paths, along which the cars (2) can be moved vertically, and at least two transfer devices (9) for transferring the cars (2) between the transport routes, each of the transfer devices (9) being a functional unit of the shaft system (3), which in each case is assigned to at least one of the security nodes (10).

3. elevator installation (1) according to claim 2, characterized in that the transport paths are rails along which the cars (2) by means of at least one linear drive as a drive system are movable, and each rail with at least one to the vertical transport path

rotatable segment as a conversion device (9) is formed, these rotatable segments can be aligned with each other so that a car (2) of the elevator system (1) along the segments between the rails can be moved.

4. Elevator installation (1) according to one of the preceding claims, characterized in that the

Functional units (2, 8, 9) each have at least one securing device (16, 17, 18), which can be converted by triggering the respective functional unit (2, 8, 9) in a safe operating condition and directly from the control unit of the respective functional unit (2, 8, 9) assigned to securing node (10) can be triggered to trigger.

5. Elevator installation (1) according to one of the preceding claims, characterized in that for the

Shaft system (3) a plurality of monitoring spaces (28) is defined, wherein each

Surveillance space (28) is associated with a plurality of functional units (2, 8, 9), wherein the security nodes (10) in a monitoring space (28) located functional units (2, 8, 9) via at least one interface (11) for Transferring data is connected.

6. Elevator installation (1) according to claim 5, characterized in that the elevator installation (1) is designed to be partially deactivatable, such that individual functional units (2, 8, 9) or groups of functional units (2, 8, 9) can be deactivated are, wherein the elevator system (1) is further adapted to be operated with non-deactivated functional units (2, 8, 9) on.

7. Elevator installation (1) according to one of the preceding claims, characterized in that each at least one shaft door (5) exhibiting portion of the shaft system (3) is a functional unit (8), which is assigned a security node (10 ').

8. Elevator installation (1) according to claim 7, characterized in that the at least one

Shaft door (5) having portion of the shaft system (3) as a functional unit (8) assigned to safety nodes (10 ') at least one sensor (15) which is adapted to detect a non-normal operation mode of operation of this functional unit (8) the safety system of the elevator installation (1) is designed to deactivate this functional unit (8) upon detection of such an operating mode deviating from normal operation, and the cars (2) of the elevator installation (1) exclusively outside this section having at least one landing door (5) of the shaft system (3).

9. elevator installation (41) according to one of the preceding claims, characterized in that the

Control unit of a safety node (10) assigned to a car (43) as a functional unit is formed, for a first direction of travel (44) of the car (43) continuously a first stop point

(46) and to predict a second stop point (47) for a second direction of travel (45) of the car (43), wherein the respective stop point (46, 47) indicates the position at which the car (43) in the respective direction of travel (44, 45) can stop when needed.

10. Elevator installation (1) according to claim 9, characterized in that a car (43 ') assigned as a functional unit safety node (10) is formed, the predicted first stop points (46) via the interface (11) in each case at least at the security node (10) assigned to the car (43 ") adjacent in the first direction of travel (44) and to transmit the predicted second stopping points (47) via the interface (11) at least to the safety node (10) assigned to the car (43 "') adjacent in the second direction of travel (45).

11. Elevator installation (1) according to claim 10, characterized in that the control unit of a car (43 ') as a functional unit assigned safety node (10) is formed, the distance (48, 49) from the first stop point (46) of this car (43 ') to the second stop point

(47) of the in the first direction of travel (44) adjacent car (43 ") to determine and the distance (48, 49) from the second stop point (47) of this car (43 ') to the first stop point (46') of in the second direction of travel (45) adjacent car (43 "') to determine, the

Security system, the elevator system (1) at a determined negative distance (49) into a safe operating state.