EP3224174B1 - Lift system having a plurality of cars and a decentralised safety system - Google Patents

Description

The invention relates to an elevator installation comprising a plurality of cars, a shaft system enabling circulating operation of the cars, at least one drive system for moving the cars within the shaft system and a safety system having a plurality of safety nodes. The safety system of the elevator system is designed to convert the elevator system into a safe operating state upon detection of a mode of operation of the elevator system deviating from normal operation. The elevator cars of the elevator installation, the shaft system of the elevator installation and the at least one drive system of the elevator installation each form at least one functional unit.

Due to the fact that in such an elevator system several cars can be moved largely independently of each other in a common shaft of the shaft system, there is the problem in such elevator systems to ensure that a collision between adjacent cars is reliably prevented.

For this purpose, it is usually necessary that a plurality of operating parameters of an elevator system are detected and evaluated, in particular the current position of each car. The more cars an elevator system contains, the more extensive the amount of data to be processed and transmitted.

From the publication EP 1 562 848 B1 is an elevator system with at least one shaft in which at least two cars can be moved along a common lane known. In this elevator system the cars are each assigned a control unit, a drive and a brake. In order to prevent a collision between the cars of the elevator system, the distance between adjacent cars is monitored in each case. If a predetermined minimum critical distance is exceeded, it is provided that an emergency stop of the corresponding car is triggered.

From the publication EP 0 769 469 B1 Another elevator system is known in which a plurality of cars can be moved simultaneously in at least one shaft. In this elevator system, each car has its own drive and its own safety module. The security modules are designed to trigger the brake system of the respective car and other cars. For this purpose, it is provided that data acquired or evaluated by a security module is transmitted to all other security modules. One from the EP 0 769 469 B1 Known problem here is that the amount of data to be transmitted is so large that a current transmission and processing of these data by the security modules at least with reasonable technical effort is not possible, which is why the EP 0 769 469 B1 suggests working with a dynamic elevator model.

EP 0 499 254 A1 discloses an elevator installation according to the preamble of claim 1.

Against this background, it is an object of the present invention to improve an elevator system mentioned above. In particular, an elevator installation with an improved safety system is to be provided. Preferably, the elevator system should enable a security concept which utilizes a distributed system architecture and advantageously enables short reaction times. In this case, the communication load occurring to ensure the safe operation of an elevator installation should preferably be reduced in comparison to previously known elevator installations.

To solve the problem, we have an elevator system comprising a plurality of cars, a circulation system of the car enabling shaft system, at least one drive system for moving the cars and a security system with a plurality of security nodes, which is formed upon detection of a deviating from normal operation mode of the elevator system proposed to convert the elevator system into a safe operating state. The cars, the shaft system and the at least one drive system each form at least one functional unit. At least one of the security nodes is assigned to one of the functional units. Each functional unit thus advantageously has at least one security node. The security nodes are each connected to at least one of the further security nodes via at least one interface for transmitting data. In addition, the security nodes each comprise at least one sensor for detecting an operating parameter of the corresponding assigned functional unit. Furthermore, the security nodes each comprise at least one control unit which is designed to evaluate the operating parameters detected by the at least one sensor of the respective security node and, taking into account, that is to say in particular taking into account, the data transmitted by the at least one further security node to deviate from normal operating mode. Data transmitted by a security node are, in particular, operating parameters of that functional unit assigned to the security node, preferably already evaluated operating parameters.

Advantageously, the elevator installation according to the invention thus enables a decentralized monitoring of functional units of the elevator installation. In this case, operating parameters detected with regard to a functional unit need advantageously not first be transmitted to a central control unit but can be evaluated directly by the control unit of the safety node assigned to the functional unit. This advantageously reduces the amount of data to be transmitted and thus the communication load.

Moreover, since the elevator installation according to the invention advantageously makes it possible to determine an operating mode deviating from a normal operation at a safety node, in particular if a functional unit does not function as intended, for example a car can not be moved or is moved at too high a speed, advantageously short reaction times are required allows. As a result, the safety of an elevator system is advantageously further increased.

According to an advantageous embodiment of the elevator installation according to the invention, it is provided that the at least one drive system can be operated bay-wise, advantageously such that the cars can be moved independently of one another in defined sections of the shaft system, wherein preferably each of the defined sections is a functional unit of the drive system, which is assigned to at least one of the security nodes. The drive system preferably comprises at least one linear motor. For this purpose, the elevator installation preferably has rails as part of the linear drive, along which the cars can be moved separately. The rails are advantageously partially energized so that the drive system is formed bay portion operable. The rails of the elevator system can advantageously be moved independently of one another by the rails which can be supplied in sections. In this case, in particular, such an energizable rail section is a defined section of the shaft system which as such forms a respective functional unit of the drive system. The drive system as a functional unit thus advantageously again has a multiplicity of functional units, to which a safety node is advantageously assigned in each case.

In particular, it is provided that such an energizable rail section of the linear drive in each case forms a functional unit. Advantageously, a security node is assigned to each power-supplyable rail section or to a group of power-supplyable rail sections in each case as a functional unit. Sensors of this safety node advantageously check operating parameters relevant to the rail sections, in particular whether a rail section is functioning properly and / or whether a car of the elevator system is being moved along a rail section.

The control unit of such a safety node is advantageously designed to switch off different linear motor segments, in particular the aforementioned rail sections of the linear drive, depending on the current positions of the elevator cars, in particular to eliminate possible sources of error and, if necessary, the elevator system or the corresponding functional unit of the drive system into one to transfer safe operating state.

In particular, it is provided as a further advantageous embodiment that the control unit of a safety node assigned to a functional unit of the drive system can influence the control of the linear motor segments. In this case, it is provided in particular that a car moved on a linear motor segment can be braked if the collision danger assigned to the safety node assigned to this linear motor segment is signaled by the safety node assigned to this car. In order to enable such a data exchange, the security nodes are advantageously linked to one another via a communication interface, for example via a communication bus or an air interface, in particular using WLAN (WLAN: Wireless Local Area Network).

A further particularly advantageous embodiment of the elevator installation according to the invention provides that the shaft system of the elevator installation has at least two vertically extending transport paths along which the cars can be moved vertically, and at least two conversion means for converting the cars between the transport routes comprises. Each of the transfer devices is advantageously a functional unit of the shaft system, which is assigned in each case a security node. By means of the transfer devices, the cars can advantageously be moved in particular between shafts of the shaft system of the elevator system. A shaft can each represent a transport route. However, according to one embodiment variant, a shaft may also comprise a plurality of transport paths, preferably such that a plurality of cars can be moved simultaneously next to one another and behind one another in the shaft.

In particular, a possibility for a circulation operation of the elevator cars of the elevator installation is provided by the conversion device. In particular, such a circulation operation provides that the cars are moved along at least one transport path of the shaft system exclusively in one direction, for example upwards, and along at least one further transport path of the shaft system exclusively in another direction, for example downwards.

Characterized in that according to a preferred embodiment of the invention it is provided that the individual transfer means or a group of transfer means is assigned in each case a security node, advantageously monitoring of the proper function of the transfer means is provided directly to the transfer means. As a result, the amount of data to be transmitted is advantageously further reduced. If there is a fault in a conversion device, so that it can no longer be operated in normal operation, but is transferred to a safe operating state, this is advantageously communicated to other other functional units assigned security nodes. The elevator installation is advantageously designed in such a way that the elevator system can continue to be operated while the defective or inoperable converter is no longer approached by the cars.

As a particularly preferred embodiment of the elevator system according to the invention it is provided that the transport paths of the shaft system rails are along which the cars are moved by means of at least one linear drive as a drive system. Each rail is advantageously formed with at least one rotatable to the vertical transport segment segment as a conversion device, said rotatable segments can be aligned with each other so that a car of the elevator system along the segments between the rails can be moved.

According to a further particularly advantageous embodiment of the elevator installation according to the invention, the functional units of the elevator installation each have at least one safety device. This at least one safety device can advantageously convert the respective functional unit into a safe operating state by triggering. Furthermore, it is advantageously provided that the at least one safety device can be triggered directly by the control unit of the safety node assigned to the respective functional unit for triggering. As a security device of a car is in particular a brake or a safety gear intended. As a safety device of a functional unit of the drive system, in particular, a switching unit is provided, for example, a contactor circuit, which can set the functional unit de-energized. As a security device of a converter as a functional unit of the shaft system in particular a locking mechanism is provided, which can fix the transfer device in a defined position.

Advantageously, the security nodes are arranged on the functional units, preferably such that the control unit, the at least one sensor and the at least one securing device are arranged together on a functional unit. As a result, decisions to transfer a functional unit and thus the elevator installation to a safe operating state can advantageously be made locally and decentrally. This advantageously leads to an increased robustness of the security system. In addition, security-relevant decisions can advantageously be made simultaneously. For example, a car can be brought to a halt by triggering the brake of the car and at the same time the corresponding functional unit of the drive system, which was responsible for a method of this car, are disabled. In addition, a high scalability of the system is achieved by the proposed elevator system. Adjustments to the safety system, for example, to a larger number of cars, thereby advantageously comparatively small.

A further particularly advantageous embodiment of the elevator installation according to the invention provides that a plurality of monitoring rooms is defined for the shaft system of the elevator installation, each monitoring room being assigned a plurality of functional units, the safety nodes of the functional units located in a monitoring room being connected via at least one interface to the elevator system Transferring data is connected. The monitoring rooms are not structurally or structurally separate areas but rather defined with respect to the security system space segments that may overlap in particular. As a result of the definition of these monitoring spaces, the elevator installation is advantageously subdivided into subsystems with respect to the monitoring of the normal operation of the elevator installation, wherein each subsystem is advantageously monitored with regard to an operating mode deviating from normal operation. A monitoring space is advantageously assigned at least one car, at least one functional unit of the shaft system and at least one functional unit of the drive system. Particularly preferably, a monitoring space is also associated with the cars directly adjacent to a car, in particular a preceding car and a subsequent car. A car is advantageously assigned in each case at least two monitoring rooms, namely once as a car, which is surrounded by two adjacent cars and once as to a car adjacent car.

An advantageous embodiment variant of the invention provides that the interstitial spaces are assigned spatially fixed, preferably via spatial coordinates that represent positions within the shaft system of the elevator system. For this purpose, in particular the shaft system by a permanently assigned Raster are represented. A basically suitable grid is for example from the document EP 1 719 727 B1 known.

As a further advantageous embodiment variant, it is provided that in each case a specific area containing a car is defined as a monitoring space, so that this monitoring space is quasi moved together with the car. If a further car is moved into this monitoring space, it is advantageously monitored with respect to a deviation from a normal operation. In particular, it is provided that the monitoring space in this embodiment are always associated with at least one functional unit of the shaft system and at least one functional unit of the drive system, the associated functional units can change when moving the car.

In particular, each of one of the cars of the elevator system approachable shaft area of the shaft system is assigned to at least one monitoring room.

Advantageously, an exchange of operating parameters between safety nodes, which are required for determining a deviating from a normal operation operating state of the elevator system exclusively within the respective monitoring space. Only when a different operating state from a normal operation is detected, this information is advantageously also transferred beyond the monitoring room to other security nodes.

According to a further advantageous embodiment of the invention, the elevator installation is designed to be partially deactivatable, in particular in such a way that individual functional units or groups of functional units, in particular individual cars and / or functional units of the drive system, can be deactivated, the elevator installation being not further developed deactivated functional units continue to operate.

Advantageously, it is further provided that in each case a section of the shaft system having at least one shaft door is a functional unit to which at least one security node is assigned. The security node is advantageously designed to monitor whether this functional unit is working properly. For this purpose, the safety node advantageously has sensors for detecting operating parameters of this functional unit. Furthermore, it is provided, in particular, that the security node of a control unit is designed for evaluating the operating parameters and for evaluating data received from security nodes of other functional units, for example operating parameters of a car.

In accordance with a further advantageous aspect of the invention, the safety node assigned to the at least one shaft door section of the shaft system as a functional unit has at least one sensor which is designed to detect an operating state of this functional unit which deviates from normal operation. Advantageously, the elevator installation, Preferably, the security system of the elevator installation, in particular of the security node of the security system assigned to this functional unit, is designed to deactivate this functional unit when detecting such an operating mode deviating from normal operation. The elevator installation, preferably the safety system of the elevator system, is advantageously further designed to move the elevator cars of the elevator system exclusively outside this section of the shaft system which has at least one landing door.

In particular, an opening of the shaft doors deviating from normal operation is provided as such an operating state deviating from normal operation. In order to monitor this, in particular a sensor which monitors the opening and closing of the shaft doors is provided. Since, for example, a method of a car in a shaft section with open shaft doors represents a danger potential for the users of the car, this section is advantageously deactivated. The elevator system is advantageously designed to move the cars no longer within this section of the shaft, but to bring the cars maximally up to this shaft section.

In accordance with a further particularly preferred embodiment of the elevator installation according to the invention, the control unit of a safety node assigned to a car as a functional unit is configured to predict a first stop point for a first direction of travel of the car and / or to predict a second stop point for a second direction of travel of the car. The respective stop point indicates the position at which the car in the respective direction of travel stop if necessary, that is, stop, can. The stopping points are thereby predicted by evaluation of operating parameters detected by the sensors. The prediction is advantageously based on a predictor model executed by means of a computer, in particular a computer of the control unit. Preferably, operating parameters detected by the sensor are evaluated, which belong to the same safety node. In addition, it is provided in particular that operating parameters transmitted to the security node are likewise taken into account in the evaluation. Operating parameters taken into account in the evaluation are, in particular, the speed of the car, the position of the car in the shaft system, the acceleration of the car, the load of the car and the state of the brakes of the car. These operating parameters and the predicted stop points are preferably determined in predefined discrete time intervals of, for example, 5 ms to 50 ms (ms: milliseconds). As a result, an ongoing prediction of the stopping points is made possible.

Advantageously, the safety node assigned to a driving node is thus configured to run for this car, that is to say essentially continuously, to calculate the stop point for the first direction of travel and the stop point for the second direction of travel. In particular, this stop point provides information about where this car would come to a stop or a stop in the event of braking, in particular emergency braking. Operating parameters of the other cars, in particular driving parameters of the other cars advantageously need not be considered in this determination of the stopping points. As a result, the communication load is advantageously further reduced.

As a particularly advantageous development of the elevator system it is provided that the safety node assigned to a car as a functional unit is also designed to transmit the predicted first stop points via the interface in each case at least to the safety node assigned to the car adjacent in the first direction of travel, and predicted to transmit second stop points via the interface in each case at least to the security node, which is assigned to the car adjacent in the second direction of travel. Thus, the security node assigned to a car advantageously also knows, in addition to the stop points of this car, the stop points of the cars adjacent to this car in the respective direction of travel of this car.

According to a further advantageous development of the elevator system, it is provided that the control unit of a safety node assigned to a car as a functional unit is designed to determine the distance from the first stop point of this car to the second stop point of the car adjacent in the first direction of travel. Furthermore, this control unit is advantageously designed to determine the distance from the second stop point of this car to the first stop point of the car adjacent in the second direction of travel. The safety system of the elevator system is advantageously designed to transfer the elevator system at a determined negative distance in a safe operating condition.

By balancing a stop point of a car for one direction of travel with the stop point of an adjacent car can thereby advantageously detect a risk of collision. In this embodiment, therefore, advantageously only stop points are transmitted and, in particular, no further car-related operating parameters, so that the amount of data to be transmitted is advantageously low. Since it is provided in particular that only the stopping points of adjacent cars are matched with one another, the data volume to be transmitted is advantageously further reduced.

A current stop point for a direction of travel of a car is based on the current position of the car in particular the distance that the car needs in this direction to stop. Preferably, the distance is applied by a safety distance, preferably a fixed safety distance, so that the stop point is correspondingly further away from the car. Depending on the current operating parameters of a car of the elevator system, the distance between the car and the stop point thus also changes for each direction of travel. In particular, increases with the speed with which a car is moved, and the distance of the corresponding stop point to the car.

The minimum distance that two adjacent cars can assume relative to each other is dependent on a plurality of operating parameters, in particular the current position of the cars in the shaft system, the speeds of the cars, the accelerations of the cars, the payloads of the cars and / or the states of the brakes of the cars , In each case, these operating parameters are preferably recorded individually only for each car in order to determine from these operating parameters for each car for the car at least one direction of travel to determine the respective stop point. By adjusting the stopping points of adjacent cars is thereby advantageously checked that a minimum distance between the cars is maintained, this minimum distance is advantageously adjusted dynamically by the ongoing investigation of the stop points and their adjustment.

If a negative distance is determined when determining the distances of the predicted stop points of adjacent cars, that is, if the stop point of a car is further from this car than the stop point of an adjacent car, the elevator system is advantageously transferred to a safety mode, in particular in which the corresponding adjacent cars whose stopping points have a negative distance, braked and thus brought to a stop, in particular by triggering safety devices of these cars. It should be noted that the term "negative distance" refers to the case where the stop point of a considered car is farther from this considered car than the stop point of an adjacent car, in particular a preceding or following car. Whether the distance is actually negative in the sense of a negative number depends on the reference system used. For example, a "negative distance" in a corresponding reference system can also be expressed by a positive number.

Advantageously, both horizontal and vertical movements of the cars are taken into account and corresponding stopping points are predicted. Advantageously, rapid detection of possible collisions is provided.

According to a particularly advantageous embodiment of the invention, it is provided that the stop point of each car is predicted in each case assuming the at least one safety device of the elevator system at the latest taking place stops the respective car. In this case, the prediction is thus advantageously conservative. The distance between adjacent cars is thereby sometimes larger than absolutely necessary, but a collision of adjacent cars is reliably prevented. Safety devices of the elevator installation are, in particular, braking devices, such as, for example, safety gears of the cars and / or braking devices provided by the drive system. If the drive system of the elevator installation comprises at least one linear drive, in particular also the partial disconnection of a line of the linear drive is provided as the intervention of at least one safety device.

A further advantageous embodiment of the invention provides that the stopping points are each predicted on the assumption of a worst-case scenario in order to reliably prevent a collision of adjacent cars in each case. In particular, it is provided that the stop point of each car is predicated on the additional assumption that the respective car is accelerated before the intervention of the at least one safety device of the elevator system with the maximum possible acceleration by the elevator system. For a holding car, which can be moved in a shaft up and down, thus the stop point in the direction of travel "up" under the Assumption predicts that the car is first accelerated maximally in the direction of travel "up" and then brought to a stop by intervention of at least one safety device. In the direction of travel "below" advantageously the stop point in the direction of travel "down" is predicted on the assumption that the car is initially maximally accelerated in the direction of travel "down" and then brought to a stop by intervention of at least one safety device. Due to the force acting on the car gravity, which is advantageously taken into account in the prediction of the stop points, the distance of the stop point in the direction of travel "up" to the upper end of the car is less than the distance of the stop point in the direction of travel "down" to the lower end of the car.

In particular, it is provided that in a vertically extending shaft of the shaft system of the elevator system, in which at least three cars are moved, an upper stop point and a lower stop point are predicted for each car. Thus, apart from the car located furthest in the shaft and the car located furthest down in the shaft, all the cars have an upper adjacent car and a car adjacent to one another. In this case, it is advantageously provided that in each case the distance of the upper stop point of a car to the lower stop point of the upper adjacent car is determined. Advantageously, the distance of the lower stop point of a car to the upper stop point of the lower adjacent car is further determined.

The stopping points are advantageously defined via a grid permanently assigned to the shaft system. A basically suitable grid is for example from the document EP 1 719 727 B1 known.

With such a fixed grid, the lowest point that a car can approach via the shaft system is preferably assigned the value 0. The highest point that a car can approach via the shaft system is preferably assigned a corresponding maximum value. If the cars can also be moved laterally, the stopping points can be represented in particular as coordinates (x, y) or (x, y, z). In this case, only the corresponding coordinate is preferably taken into account for a current direction of travel, for example, only the coordinate x for the direction of travel x. Particularly in the areas in which the direction of travel changes, for example, from the direction of travel x in the direction of travel y, it is advantageously provided that more than one coordinate is taken into account here for a corresponding section comprising the transition area, that is to say in relation to the example given above Coordinates (x, y).

With such a definition of a fixed grid, there is a risk of collision if the upper stop point of a car is greater than the lower stop point of the car driving above this car. The elevator system is in this case transferred to a safety mode, in particular by at least one of the two cars is brought to a stop. The same applies accordingly if the lower stop point of a car is smaller than the upper stop point of the car moving below this car.

Possible collision risks of a car with an upper adjacent car and / or a lower adjacent car are thus reliably detected, namely by checking whether a determined distance is negative, so have the intersected stop points have an overlap area. If a negative distance is determined, the elevator installation is advantageously transferred from normal operation into a safety mode, in particular by the affected cars being stopped. The other cars will advantageously continue in limited operation process, the stopped cars define a restricted area to which the further operated cars may only approach to a predefined distance. Preferably, the cars stopped in a safety mode as part of the transfer of the elevator system receive fix assigned stop points, so that in particular a collision of cars with the stopped cars with the application of the same method continues to be prevented.

Each control unit associated with a car advantageously calculates the stop points for the at least one direction of travel of this car, in particular an upper and a lower stop point, and exchanges these with those of the control units of the adjacent cars. Instead of calculating the distances between adjacent cars, the stopping points are advantageously compared with each other, as already explained above. As long as the stop points do not overlap, ie the negative distance is determined, there is no danger of collision.

Preferably, the control unit of a car triggers a safety device of this car when determining a negative distance of the stop points, wherein it is provided in particular that a triggering of the safety device brings the car to stop. In particular, the actuation of a brake of the car is provided as triggering a safety device of the car. Advantageously, the control device associated with a car is responsible for triggering safety devices only for the safety device of this car and advantageously does not have to slow down other cars. As a result, the amount of data to be transmitted is advantageously further reduced.

In particular, it is provided that the stopping points are each predicted from current operating parameters of the respective car. According to an advantageous embodiment variant, it is provided that stop points are predefined for all the quantized combinations of operating parameters. An assignment of the stop points to such a combination of operating parameters is carried out according to an advantageous embodiment via lookup table. In particular, according to another advantageous embodiment variant, such an allocation is provided as a plausibility check of stop points predicted by real-time calculations. Advantageously, the elevator system is also converted into a safety mode upon detection of a predefined deviation from associated stop points and predicted stop points.

In particular, the elevator installation according to the invention, in particular the respective components of the elevator installation, is designed to carry out method steps described in connection with the invention.

Fig. 1

in einer vereinfachten schematischen Darstellung ein Ausführungsbeispiel für eine erfindungsgemäße Aufzuganlage;

Fig. 2

in einer vereinfachten schematischen Darstellung ein Ausführungsbeispiel für eine Zuordnung von Sicherheitsknoten zu den funktionalen Einheiten bei einer Ausgestaltungsvariante einer erfindungsgemäßen Aufzuganlage;

Fig. 3

in einer vereinfachten schematischen Darstellung einen Ausschnitt eines Ausführungsbeispiels für eine erfindungsgemäße Aufzuganlage;

Fig. 4

in einer vereinfachten schematischen Darstellung ein weiteres Ausführungsbeispiel für eine erfindungsgemäße Aufzuganlage; und

Fig. 5

in einer vereinfachten schematischen Darstellung ein Ausführungsbeispiel für einen Fahrkorb zur Verwendung in einer in Fig. 4 dargestellten Aufzuganlage, mit beispielhaft dargestellten Stoppunkten.

Further advantages, features and design details of the invention will be explained in more detail in connection with the exemplary embodiments illustrated in the figures. Showing:

Fig. 1

in a simplified schematic representation of an embodiment of an elevator system according to the invention;

Fig. 2

in a simplified schematic representation of an embodiment of an assignment of security nodes to the functional units in a design variant of an elevator system according to the invention;

Fig. 3

in a simplified schematic representation of a section of an embodiment of an elevator system according to the invention;

Fig. 4

in a simplified schematic representation of a further embodiment of an elevator system according to the invention; and

Fig. 5

in a simplified schematic representation of an embodiment of a car for use in a in Fig. 4 illustrated elevator system, with exemplary illustrated stop points.

In Fig. 1 is a lift system 1 with a plurality of cars 2 and a shaft system 3 shown simplified. The cars 2 can be moved separately from each other in a first direction of travel 6 (shown symbolically by a single arrow 6) and in a second direction of travel 7 (shown symbolically by a double arrow 7), that is largely independent of each other. The cars 2 each form a functional unit of the elevator installation 1. The shaft system 3 of the elevator installation 1 is designed in such a way that a circulation operation of the elevator cars 2 is made possible. This means that the cars 2 can be moved in particular all in the first direction of travel 6 or all in the second direction of travel 7.

In the Fig. 1 shown elevator installation 1 has for moving the cars 2 to a linear drive with a plurality of linear motor segments 4, wherein the linear motor segments 4 are each a functional unit of the drive system of the elevator system 1. By these linear motor segments 4, which are formed individually activated and deactivated, the drive system of the elevator system 1 is advantageously designed bay sections operable, in particular such that the cars 2 can be moved independently of each other in defined sections of the shaft system, each of the Linear motor segments 4 forms such a defined section and is each a functional unit of the drive system.

The shaft system 3 of the elevator installation 1 comprises a plurality of shaft doors 5, wherein the sections of the shaft system 3 comprising a shaft door 5 each form a functional unit of the elevator installation 1.

In the Fig. 1 illustrated elevator installation 1 further comprises a security system (in Fig. 1 not explicitly shown) with a plurality of security nodes (in Fig. 1 not explicitly shown). At least one of the security nodes is in each case assigned to one of the functional units, that is to say in each case in particular a car 2, at least one linear motor segment 4 and a shaft section comprising at least one landing door 5. The security nodes are advantageously each connected to at least one of the further security nodes via at least one interface for transmitting data, for example a communication bus or wirelessly via an air interface. The security nodes each comprise at least one sensor (in Fig. 1 not explicitly shown) for detecting an operating parameter of the corresponding assigned functional unit. For example, it is provided that the position, the speed, the acceleration and the payload of a car are detected as operating parameters.

Furthermore, it is provided that the security nodes each have at least one control unit (in Fig. 1 not explicitly shown), which is designed to evaluate the operating parameters detected by the at least one sensor of the respective safety node. The control unit is advantageously further designed, taking into account this evaluation and the data transmitted by the at least one further security node, to make a determination with respect to a different operating state from normal operation.

Thus, the security system of the elevator system 1 is advantageously designed to convert the elevator system into a safe operating state upon detection of a deviating from normal operation operating state of the elevator system 1. The normal operation is in particular a fault-free operation. A safe operating state of the elevator installation 1 is an operating condition in which the elevator installation 1 is transferred in the event of a fault and / or danger. In particular, it is provided in such a safe operating state that at least one of the functional units of the elevator installation 1 is deactivated. For example, at least one linear motor segment 4 can be switched off here and / or at least one car 2 can be stopped by triggering emergency braking and / or a shaft section of the shaft system 3 comprising at least one shaft door 5 can no longer be approached by the cars 2.

With reference to Fig. 2 the security system of an elevator system designed according to the invention is explained in greater detail. These are in Fig. 2 schematically a plurality of cars 2 as functional units of the elevator system, a plurality of manhole sections 8, each forming a functional unit of the manhole system, and a plurality of Umsetzzeinrichtungen 9, which for converting of cars 2 between different transport routes, in particular different shafts of the shaft system are formed, shown as further functional units of the shaft system.

The functional units 2, 8, 9 each have a security node 10, 10 ', 10 ", these security nodes 10, 10', 10" being part of the security system of the elevator installation. The security nodes 10, 10 ', 10 "are for transmitting data (in Fig. 2 symbolically represented by arrows 26) via an interface 11 connected to each other, wherein for the transmission 26 preferably a security protocol is provided.

The safety nodes 10, 10 ', 10 "respectively comprise sensors for detecting operating parameters of the respective functional unit, operating parameters detected by the sensors 12, 13, 14, 15, 19, 20, 21 of a safety node 10, 10', 10" data transmitted to a security node to other security nodes are sent to a control unit (in Fig. 2 not explicitly shown) of the security node. The control unit, for example a suitably programmed microcontroller circuit, evaluates the data. Furthermore, the control unit is designed to trigger a safety device associated with the respective functional unit 2, 8, 9, and thus to transfer the elevator installation to a safe operating state. The transmission of data occurring in a functional unit 2, 8, 9 is in Fig. 2 symbolically represented by the arrows 27. In this case, data transmission can also be bidirectional, ie also counter to the arrow direction of the arrows 27.

Advantageously, the safety components, in particular safety devices and the control units triggering the safety devices, are placed locally on the functional units 2, 8, 9, preferably directly on the actuators and sensors. This advantageously avoids real-time communication over long distances.

Advantageously, security nodes in particular are distributed in vertical and horizontal shafts of the shaft system of an elevator installation. These advantageously record the states of the shaft components. With regard to the functional unit shaft section 8, to which a safety node 10 'is assigned in each case, the states of the shaft doors are detected, for example, by means of sensors 15.

The safety nodes are advantageously designed to deactivate functional units of the elevator installation via corresponding control units and safety devices, in particular to switch off drives. This can be done for example with respect to the functional unit shaft section 8 via the triggering of safety devices 18, 18 '. The safety devices 18 provide a so-called "Safe Toque Off" (STO) functionality that switches the drive powerless. The safety devices 18 'advantageously provide a functionality that shuts off the drive by a motor protection.

Security nodes assigned to functional units of the shaft system are preferably wired directly to the shaft components.

In particular, a transfer device 9 is provided for the horizontal transfer of a car from one shaft to another shaft. Such a conversion device 9 is advantageously monitored by a security node 10 "assigned to the respective conversion device 9. Position limit switches 19, devices for detecting the state of a locking mechanism 20 and an absolute position sensor 21 continuously record operating parameters of the conversion device 9 in the exemplary embodiment as sensors of the security node an operating mode deviating from the normal operation by the safety node 10 "or a control unit of the safety node 10" is advantageously triggered by one of the safety devices associated with the conversion device 9, preferably a service brake 17 with a coupled drive shut-off 17 ', which in particular is called "Safe Toque Off" (STO ) Functionality can be realized.

The security nodes 10 assigned to the cars 2 comprise in particular sensors 12, 13, 14 for detecting operating parameters with regard to the respective car 2, in particular a sensor 12 for detecting the position of the car, a sensor 13 for detecting the state of the car doors, in particular the states " closed "/" open ", a sensor 14 for detecting the payload of the car 2. Further operating parameters are advantageously transmitted from other security nodes to the respective security node 10 of a car. By evaluating the operating parameters, the security node 10 makes a determination with regard to a different operating state from normal operation. If an operating mode deviating from normal operation is detected, safety devices 16, 16 'of the elevator car 2 are advantageously triggered by the safety node 10 or the control unit of this safety node 10. As a result, the elevator system is transferred to a safe operating state. In particular, a service brake 16 and a redundant safety gear 16 'are provided as safety units of the car.

In order to further reduce the computational load per security node, provision is made in particular to avoid or at least reduce multiply identical computations and multiple decisions within the security system of the elevator installation. Therefore, the security nodes 10, 10 ', 10 "are advantageously designed to make decisions, in particular decisions regarding the triggering of a security device, locally and to transmit the corresponding results, states and / or decisions to the other security nodes.

Advantageously, the safety nodes 10, 10 ', 10 "of the functional units 2, 8, 9 are each provided with at least the following information or operating parameters.

• X, Y, Z-Position, Geschwindigkeit und Beschleunigung des Fahrkorbs;
• Zuladung des Fahrkorbs;
• Zustand der Fahrkorbtür;
• Zustand Aktorik beziehungsweise Sicherheitseinrichtung, insbesondere Betriebsbremse und Fangvorrichtung;
  wobei diese vorstehenden Informationen beziehungsweise Betriebsparameter vorteilhafterweise durch die Sensoren des Sicherheitsknotens bereitgestellt werden;
• Zustand der Schachttüren;
  wobei diese Information vorzugsweise durch den Sicherheitsknoten 10' der funktionalen Einheit 8 des Schachtsystems bereitgestellt wird;
• Informationen über eine mögliche Kollision anderer Fahrkörbe 2;
  wobei zur Generierung dieser Information vorteilhafterweise dem Sicherheitsknoten 10 Betriebsparameter von Sicherheitsknoten 10 benachbarter Fahrkörbe 2 bereitgestellt werden, vorzugsweise Stoppunkte (wie obenstehend und nachfolgend unter Bezugnahme auf Fig. 4 und Fig. 5 erläutert); und
• Zustand der Umsetzeinrichtung 9;
  wobei diese Information vorzugsweise von dem der Umsetzeinrichtung 9 zugewiesenen Sicherheitsknoten 10" bereitgestellt wird.

The security node 10 of the car 2 advantageously has access to the following operating parameters:

• X, Y, Z position, speed and acceleration of the car;
• Load of the car;
• Condition of the car door;
• State actuator or safety device, in particular service brake and safety gear;
  wherein said above information or operating parameters are advantageously provided by the sensors of the security node;
• Condition of shaft doors;
  this information is preferably provided by the security node 10 'of the functional unit 8 of the manhole system;
• Information about a possible collision of other cars 2;
  wherein, to generate this information, operating parameters of security nodes 10 of adjacent cars 2 are advantageously provided to the security node 10, preferably stop points (as described above and below with reference to FIGS Fig. 4 and Fig. 5 explained); and
• State of the transfer device 9;
  this information is preferably provided by the security node 10 "assigned to the conversion device 9.

The interaction of security nodes, in particular of security nodes within a defined monitoring space (as explained above), is explained in more detail below with reference to two examples. For better understanding, it is based on in Fig. 1 and Fig. 2 illustrated elements.

• Jeder Sicherheitsknoten 10, der einem Fahrkorb 2 als funktionaler Einheit zugewiesen ist, erstellt auf der Grundlage eigener Sensoren 12, 13, 14 Informationen hinsichtlich einer möglichen Kollision und verteilt diese Informationen über die Schnittstelle 11 an alle andere Sicherheitsknoten, die einem Fahrkorb als funktionale Einheit zugewiesen sind.
• Jeder Sicherheitsknoten 10, der einem Fahrkorb 2 als funktionaler Einheit zugewiesen ist, prüft die Kollisionsgefahr anhand der empfangenen Informationen von anderen Sicherheitsknoten, die einem Fahrkorb 2 als funktionaler Einheit zugewiesen sind. Wenn eine mögliche Kollision erkannt wird, wird - vorteilhafterweise ausgelöst durch die Steuereinheit des entsprechenden Sicherheitsknotens 10 - ein sicherer Zustand des Fahrkorbs 2 eingeleitet.
• Solange kein sicherer Zustand erreicht werden soll beziehungsweise muss, erteilt der Sicherheitsknoten 10, der einem Fahrkorb 2 als funktionaler Einheit zugewiesen ist, allen Sicherheitsknoten, die einer funktionalen Einheit 4 des Antriebssystem zugewiesen sind, die Erlaubnis, die entsprechenden funktionalen Einheiten 4 des Antriebssystems zu aktivieren. Ein Aktivieren von funktionalen Einheiten 4 des Antriebssystems kann bei einem Linearantrieb als Antriebssystem beispielsweise ein Bestromen der entsprechenden Linearmotorsegmente sein.
• Soll der Fahrkorb 2 in einen sicheren Betriebszustand überführt werden, so teilt der diesem Fahrkorb 2 zugewiesene Sicherheitsknoten 10 vorteilhafterweise allen Sicherheitsknoten, die funktionalen Einheiten 4 des Antriebssystems zugeordnet sind, mit, dass die für diesen Fahrkorb 2 zuständigen funktionalen Einheiten 4 des Antriebssystems zu deaktivieren sind, also beispielsweise bei einem Linearantrieb als Antriebssystem die entsprechenden Linearmotorsegmente abzuschalten sind.
• Alle Sicherheitsknoten, die funktionalen Einheiten 4 des Antriebssystems zugewiesen sind, prüfen anhand der von dem Sicherheitsknoten 10, der dem Fahrkorb 2 zugewiesen ist, über die Schnittstelle 11 übertragenen Informationen ihre Zuständigkeit für diesen Fahrkorb 2. Abhängig von dem Ergebnis dieser Überprüfung deaktivieren oder aktivieren sie die entsprechenden funktionalen Einheiten 4 des Antriebssystems.

First example - Emergency stop of the car when detecting a collision hazard:

• Each security node 10 assigned to a car 2 as a functional unit, based on its own sensors 12, 13, 14, provides information regarding a possible collision and distributes this information via the interface 11 to all other security nodes assigned to a car as a functional unit are.
• Each security node 10, which is assigned to a car 2 as a functional unit, checks the risk of collision on the basis of the received information from other security nodes, which are assigned to a car 2 as a functional unit. If a possible collision is detected, a safe state of the car 2 is initiated, advantageously triggered by the control unit of the corresponding safety node 10.
• As long as no secure state is to be achieved, the security node 10, which is assigned to a car 2 as a functional unit, gives permission to all safety nodes, which are assigned to a functional unit 4 of the drive system, to activate the corresponding functional units 4 of the drive system , Activating functional units 4 In the case of a linear drive as drive system, the drive system can be, for example, an energizing of the corresponding linear motor segments.
• If the car 2 is to be transferred to a safe operating state, the safety node 10 allocated to this car 2 advantageously notifies all safety nodes assigned to the functional units 4 of the drive system that the functional units 4 of the drive system responsible for this car 2 are to be deactivated Thus, for example, in a linear drive as a drive system, the corresponding linear motor segments are to be turned off.
• All security nodes assigned to functional units 4 of the propulsion system check their responsibility for that car 2 based on the information transmitted by the security node 10 assigned to the car 2 via the interface 11. Depending on the result of this check, they deactivate or activate them the corresponding functional units 4 of the drive system.

• Jeder Sicherheitsknoten 10", der einer Umsetzeinrichtung 9 als funktionaler Einheit des Schachtsystems zugewiesen ist, erstellt auf der Grundlage eigener Sensoren 19, 20, 21 die Information über den aktuellen Zustand der Umsetzeinrichtung 9 und übermittelt diese an alle andere Sicherheitsknoten 10, die einem Fahrkorb 2 als funktionale Einheit zugewiesen sind.
• Jeder Sicherheitsknoten 10, der einem Fahrkorb 2 als funktionale Einheit zugewiesen ist, prüft die Kollisionsgefahr mit einer Umsetzeinrichtung 9 anhand der empfangenen Informationen von den Sicherheitsknoten 10", die den jeweiligen Umsetzeinrichtungen 9 zugewiesen sind. Wenn eine mögliche Kollision erkannt wird, wird der Fahrkorb 2 in einen sicheren Betriebszustand überführt.
• Solange eine Überführung in einen sicheren Betriebszustand nicht erforderlich ist, erteilt der dem Fahrkorb 2 zugewiesene Sicherheitsknoten 10 allen Sicherheitsknoten, die einer funktionalen Einheit 4 des Antriebssystems zugeordnet sind, die Erlaubnis, die entsprechenden funktionalen Einheiten 4 des Antriebssystems zu aktivieren, also beispielsweise bei einem Linearantrieb als Antriebseinheit die Erlaubnis, die Linearmotorsegmente bestromen zu können.
• Soll der Fahrkorb 2 in einen sicheren Zustand überführt werden, so überträgt der dem Fahrkorb 2 zugewiesene Sicherheitsknoten 10 an alle Sicherheitsknoten, die einer funktionalen Einheit 4 des Antriebssystems zugewiesen sind, die Information, die für diesen Fahrkorb 2 zuständigen funktionalen Einheiten 4 des Antriebssystems zu deaktivieren. Bei einem Linearantrieb als Antriebseinheit wird somit beispielsweise die Information übertragen, die Linearmotorsegmente abzuschalten.
• Alle Sicherheitsknoten, die einer funktionalen Einheit 4 des Antriebssystems zugewiesen sind, prüfen anhand der Informationen ihre Zuständigkeit für diesen Fahrkorb 2 und deaktivieren die entsprechende funktionale Einheit 4 des Antriebssystems, also beispielsweise das Linearmotorsegment, oder erlauben es, die entsprechende funktionale Einheit 4 des Antriebssystems, also beispielsweise das Linearmotorsegment, zu aktivieren. Sollte eine Änderung des Zustandes einer Umsetzeinrichtung 9 eine Gefahr für den Fahrkorb 2 beziehungsweise die mit diesem Fahrkorb beförderten Personen darstellen, so erlaubt der Sicherheitsknoten 10", der dieser Umsetzeinrichtung 9 zugewiesen ist, keine Zustandsänderung der Umsetzeinrichtung 9. Vorzugsweise wird eine Sicherheitseinrichtung 17, 17' aktiviert, die eine Zustandsänderung der Umsetzeinrichtung 9 verhindert. Eine solche Sicherheitseinrichtung 17' ist insbesondere ein Verriegelungsmechanismus.

Second example - entry of a car into a transfer device:

• Each security node 10 ", which is assigned to a transfer device 9 as a functional unit of the shaft system, generates on the basis of own sensors 19, 20, 21 the information about the current state of the transfer device 9 and transmits it to all other security nodes 10, the car 2 assigned as a functional unit.
• Each security node 10, which is assigned to a car 2 as a functional unit, checks the risk of collision with a transfer device 9 on the basis of the received information from the security nodes 10 "assigned to the respective transfer devices 9. If a possible collision is detected, the car 2 becomes transferred to a safe operating condition.
• As long as a transition to a safe operating state is not required, assigned to the car 2 security node 10 gives all security nodes that are assigned to a functional unit 4 of the drive system, the permission to activate the corresponding functional units 4 of the drive system, so for example in a linear drive as a drive unit the permission to energize the linear motor segments.
• If the car 2 is to be transferred to a safe state, then the safety node 10 assigned to the car 2 transmits to all safety nodes, which are assigned to a functional unit 4 of the drive system, the information to deactivate the functional units 4 of the drive system responsible for this car 2 , In a linear drive as a drive unit thus, for example, the information is transmitted to turn off the linear motor segments.
• All safety nodes assigned to a functional unit 4 of the drive system use the information to check their responsibility for this car 2 and disable the corresponding functional unit 4 of the drive system, for example the linear motor segment, or allow the corresponding functional unit 4 of the drive system, So for example, the linear motor segment to activate. If a change in the state of a transfer device 9 represents a hazard for the car 2 or the persons transported with this car, then the security node 10 "assigned to this transfer device 9 does not allow a change in state of the transfer device 9. Preferably, a safety device 17, 17 'activated, which prevents a change in state of the transfer device 9. Such a safety device 17' is in particular a locking mechanism.

At the in Fig. 3 elevator installation 1 shown in detail is a part of the shaft system 3, in which cars 2 can be moved separately, that is to say essentially independently of one another, together with two cars 2. The shaft system 3 in this case has a shaft door 5 having section 8 of the shaft system 3 as a functional unit. This shaft section 8 is a security node (in Fig. 3 not explicitly shown). This security node includes a sensor (in Fig. 3 not explicitly shown), which is designed to detect an operating mode deviating from normal operation of this functional unit 8, wherein the elevator system 1 is designed to disable this functional unit 8 upon detection of such operating mode deviating from normal operation and the cars 2 of the elevator system 1 advantageously exclusively outside of this at least one landing door 5 having section 8 of the shaft system 3 to proceed.

In the in Fig. 3 illustrated embodiment, a sensor with respect to the manhole section 8 monitors in particular the proper opening and closing of the shaft doors. Will, as exemplified in Fig. 3 shown by the sensor as an operating parameter, a non-successful closing the shaft door 5 detected at the safety node or to the control unit of the safety node of the shaft section 8, the control unit advantageously disables this shaft section 8. This has the consequence that this shaft section 8 no longer of the Rails 2 can be approached. This information is thereby at the latest when retracting the cars 2 in the defined monitoring space 28 to the signal nodes (in Fig. 3 not explicitly shown) of the cars 2 transmitted. The elevator installation 1 or the safety system of the elevator installation 1 is in fact advantageously set up in such a way that all security nodes located therein exchange information with one another in a defined monitoring space. Advantageously, 3 corresponding monitoring rooms are defined for the entire shaft system.

By deactivating the shaft section 8, the elevator car 2 traveling in the upward direction of travel 6 can approach maximum to the lower limit region of the section 8 marked by the line 29. The driving in the downward direction of travel 7 car 2 can maximum until approaching the upper limit region of the section 8 marked by the line 29 '. Otherwise, the elevator system 1 is advantageously still ready for operation.

In the Fig. 4 illustrated elevator installation 41, which is not shown to scale for the sake of clarity, comprises a shaft system 42 with two vertical shafts 412 and two connection shafts 413. Furthermore, the elevator installation 41 comprises a plurality of cars 43 (in Fig. 4 For example, eight cars), which can be moved separately in the shaft system 42 in a subsequent operation, that is, a plurality of cars 43 in a shaft 412 or a shaft 413 can be moved.

The cars 43 can be moved in the shafts 412 in a first direction of travel 44 upwards (in Fig. 4 symbolically represented by the arrow 44) and in a second direction of travel 45 are moved down (in Fig. 4 symbolically represented by the arrow 45). In the connecting shafts 413, via which the cars 43 can change between the shafts 412, the cars are also laterally in a third direction of travel 410 (in Fig. 4 symbolically represented by the arrow 410) and in a fourth direction of travel 411 (in Fig. 4 symbolically represented by the arrow 411) can be moved.

In particular, it is provided that the elevator system comprises as drive system at least one linear motor (in Fig. 4 not shown explicitly), by means of which the cars 43 are moved within the shaft system 42.

In the Fig. 4 shown elevator system 41 is thereby operated such that for each car 43 continuously for the first possible direction of travel, a first stop point 46 and for the second possible direction of travel, a second stop point 47 is predicted. Thus, a stop point is predicted for each car 43 at least for one direction of travel. Thus, an upper stop point is predicted as the first stop point 46 for cars 43 located in the vertical shafts 412, and a lower stop point is predicted as the second stop point 47. In the connecting shafts 413, a stop point 46 'located in the direction of travel of the respective car 43 is predicted as the stop point 46' and a second stop point located opposite the direction of travel of the respective car 43 as the stop point 47 '.

In particular, the stopping points can be defined by means of coordinates (x, y), whereby lateral stopping points are defined via the x-coordinates and stop points lying vertically above the y-coordinates. The point A in Fig. 4 can be assigned as an example the coordinate (0, 0).

The two stop points 46, 47 and 46 ', 47' indicate starting from the current position of the respective car 43 for each of the possible directions of travel 44, 45 or 410, 411 respectively the point at which the car 43 assuming a worst case Case scenarios can stop at the latest. In particular, for an upwardly moving car 43 'taking into account current operating parameters, such as direction, speed and payload of the car 43', an upper stop point 46 predicts, that is, predetermined, where the car 43 'would stop when the Car 43 'would accelerate maximally in the direction of travel and would then slowed down. As the lower stop point 47 of the car 43 'is predicated on the worst-case assumption that the drive fails, the car 43' due to which sags and the car 43 'would only be slowed down.

Corresponding predictions are continuously made for the other cars 43 of the elevator system. For this purpose, the cars 43 each advantageously have a control unit, for example a microcontroller circuit designed as a control unit (in FIG Fig. 4 not explicitly shown).

For each car 43, which has a neighboring first car in a first direction of travel, the distance from the first stop point 6 of this car to the second stop point 47 of the second car is determined. In addition, the distance from the second stop point 47 of this car to the first stop point 46 of the second car is determined for each car 43, which has an adjacent second car in the second direction.

For example, for the car 43 ', which has a neighboring car 43 "in the direction of travel 44, the distance 48 from the upper stop point 46 of the car 43' to the lower stop point 47 of the car 43" determined. For this purpose, the lower stop point 47 of the elevator car 43 "is advantageously connected to a control unit (in FIG Fig. 4 not explicitly shown) of the car 43 'transferred. The determined distance 48 is positive in this example. With respect to the cars 43 'and 43 "there is thus no danger of collision.

In addition, the car 43 'has an adjacent car 43 "in the further direction of travel 45. Therefore, for the car 43', the distance 49 is determined from the lower stop point 47 of the car 43 'to the upper stop point 46 of the car 43'" , For this purpose, the upper stop point 46 of the elevator car 43 '"is advantageously connected to a control unit (in FIG Fig. 4 not explicitly shown) of the car 43 'transferred. The determined distance 49 is negative in this example, that is to say the upper stop point 46 of the car 43 '"lies above the lower stop point 47 of the car 43. With regard to the cars 43' and 43 '", there is thus a danger of collision. Due to the negative distance 49 of the lower stop point 46 of the car 43 'and the upper stop point 47 of the car 43'", the elevator system is transferred to a safety mode, in particular by activating car side brakes of these cars, preferably triggered by the respective cars 43 'and 43 'associated control units.

Since only one stop point is transmitted to a car 43 by the two adjacent cars, the communication load in the method used is advantageously low.

To further explain the stopping points that are predicted for a car 43 according to a method according to the invention, becomes Fig. 5 Referenced. In Fig. 5 In this case, a car 43 with a total car height 417 and an entry threshold 420 is shown.

For in the direction of travel 44 and in direction 45 (in Fig. 5 the direction of travel is symbolically represented by arrows 44, 45) movable car 43 is for each direction 44, 45 each an example predicted stop point 46, 47. For the direction of travel 44 while the upper stop point 46 is shown for the direction of travel 45 and the lower stop point 47th

The upper stop point 46 indicates the point where the car 43 can stop with the upper end of the car 421 starting from current operating parameters and assuming a worst-case scenario at the latest in the direction of travel 44. The distance between the stop point 46 and the upper end of the car 421 results in the illustrated embodiment from the sum of an optional settable minimum distance 415 to the car 43, which must not be fallen below, and one of the current driving parameters assuming a worst case Scenarios calculated braking distance 418. The calculation of the stopping points, for example, by means of a correspondingly configured predictor model.

The lower stop point 47, however, indicates the point where the car 43 can stop with the lower end of the car 422 starting from current operating parameters and assuming a worst-case scenario at the latest in the direction of travel 45. The distance between the stop point 47 and the lower end of the car 422 results in the illustrated embodiment from the sum of an optional predeterminable minimum distance 416 to the lower end of the car 422, which must not be fallen below, and one of the current driving parameters assuming a worst case Scenarios predicted braking distance 419.

The positions of the stop points vary depending on the current driving parameters. When the car is parked, the stop points will move closer to the car. If the car is traveling at high speed, ie in the direction of travel 44, the upper stop point will be higher. In this case, in particular even at very high speed, the case may occur that the lower stop point 47 is determined lying at the position 414, since in this case a movement in the direction of travel 45 can be excluded even in the worst case scenario.

For each such in Fig. 5 shown car 43 each such upper stop point and a lower stop point is predicted. In each case, the distance between the upper stop point 46 of a car and the lower stop point 47 'or 47 "of a car above this car and the distance between the lower stop point 47 of this car and the upper stop point 46' relationship meadow 46" one below this car adjacent car determined. In a non-critical operation, the distances 48 are positive, since 47 "greater 46 and 47 greater 46". With a negative distance, however, there is a risk of collision. Such a negative distance results when 46 greater 47 'or 46' greater 47. If such a negative distance is determined, the elevator system is transferred to a safe operating state, in particular in a safety mode.

The exemplary embodiments illustrated in the figures and explained in connection therewith serve to explain the invention and are not restrictive of it. The illustrated embodiments are not reproduced to scale in the figures for reasons of clarity.

Reference numerals:

1

elevator system

2

car

3

shaft system

4

drive system

5

shaft door

6

first direction of travel (symbolized by single arrow)

7

second direction of travel (symbolized by double arrow)

8th

at least one shaft door comprehensive shaft section as a functional unit of the shaft system

9

Conversion device as a functional unit of the shaft system

10

security node

10 '

security node

10 "

security node

11

interface

12

sensor

13

sensor

14

sensor

15

Sensor for detecting the state of the shaft door

16

safety device

16 '

safety device

17

safety device

17 '

safety device

18

safety device

18 '

safety device

19

sensor

20

sensor

21

sensor

26

Transfer of data between the security nodes

27

internal transmission of data at a security node

28

monitoring room

29

lower border area of a shaft section (8) (represented symbolically by a line)

29 '

Upper border area of a shaft section (8) (shown symbolically by a line)

41

elevator system

42

shaft system

43

car

43 '

car

43 "

car

43 " '

car

44

first direction of travel

45

second direction of travel

46

first stop point

46 '

first stop point

46 "

first stop point

47

second stop point

47 '

first stop point

47 "

first stop point

48

positive distance of predicted stop points

49

negative distance of predicted stop points

410

third direction of travel

411

fourth direction of travel

412

vertical shaft

413

connecting shaft

414

Extreme position for a possible stop point

415

from the cabin to be maintained minimum distance

416

from the cabin to be maintained minimum distance

417

Cabin height

418

predicted braking distance

419

predicted braking distance

420

entry threshold

421

upper end of the car

422

lower end of the car

Claims (11)

1. Lift system (1) comprising

   a plurality of cars (2),

   a shaft system (3) enabling a circulation operation of the cars (2),

   at least one drive system, and

   a safety system having a plurality of safety nodes (10),
   which is designed to transfer the lift system (1) into a safe operating state when an operating state of the lift system (1) deviating from the normal operation is established,

   wherein the cars (2), the shaft system (3) and the at least one drive system each form a functional unit in this, and

   wherein the at least one drive system is designed operable in a shaft section, such that the cars (2) can travel independently of each other in defined section of the shaft system (3), each of the defined section being a functional unit (4) of the drive system,

   characterized in that

   at least one of the safety nodes (10) is assigned to each one of the functional units (2, 4, 8, 9), and wherein the safety nodes (10) are each connected to at least one of the other safety nodes via at least one interface (11) for transmission of data,

   the safety nodes (10) each comprise at least one sensor (12, 15, 19) for detecting an operating parameter of the corresponding assigned functional unit (2, 4, 8, 9) and

   the safety nodes (10) each comprise at least one control unit,

   which is designed to evaluate the operating parameter detected by the at least one sensor (12, 15, 19) of the respective safety node (10) and

   to make a determination regarding an operating state deviating from the normal operation based on the data transmitted from the at least one other safety node (10).
2. Lift system (1) according to Claim 1, characterized in that the shaft system (3) comprises at least two vertically extending transport paths, along which the cars (2) can travel vertically, and at least two transfer mechanisms (9) for transfer of the cars (2) between the transport paths, each of the transfer mechanisms (9) being a functional unit of the shaft system (3), which is assigned to at least one of the safety nodes (10).
3. Lift system (1) according to Claim 2, characterized in that the transport paths are rails, along which the cars (2) are movable by means of at least one linear drive as the drive system, and each rail is advantageously designed with at least one segment which can be rotated relative to the vertical transport path as the transfer mechanism (9), and these rotatable segments can be oriented relative to each other so that a car (2) of the lift system (1) can travel along the segments between the rails.
4. Lift system (1) according to one of the preceding claims, characterized in that the functional units (2, 8, 9) the each have at least one securing mechanism (16, 17, 18), which can, by a triggering, transfer the respective functional unit (2, 8, 9) to a secure operating state and can be actuated for the triggering directly by the control unit of the securing node (10) assigned to the respective functional unit (2, 8, 9).
5. Lift system (1) according to one of the preceding claims, characterized in that a plurality of monitoring spaces (28) is defined for the shaft system (3), each monitoring space (28) being assigned a plurality of functional units (2, 8, 9), the safety nodes (10) of the functional units (2, 8, 9) located in a monitoring space (28) being connected by at least one interface (11) for the transmission of data.
6. Lift system (1) according to Claim 5, characterized in that the lift system (1) is designed to be partially deactivatable, such that individual functional units (2, 8, 9) or groups of functional units (2, 8, 9) are deactivatable, while the lift system (1) is further designed to continue in operation with non-deactivated functional units (2, 8, 9).
7. Lift system (1) according to one of the preceding claims, characterized in that each section of the shaft system (3) having at least one shaft door (5) is a functional unit (8), which is assigned to at least one safety node (10').
8. Lift system (1) according to Claim 7, characterized in that the safety node (10') assigned to the section of the shaft system (3) having at least one shaft door (5) as a functional unit (8) comprises at least one sensor (15), which is designed to detect an operating state of this functional unit (8) deviating from the normal operation, while the safety system of the lift system (1) is designed to deactivate this functional unit (8) upon detecting such an operating state deviating from the normal operation, and to move the cars (2) of the lift system (1) only outside of this section of the shaft system (3) having at least one shaft door (5).
9. Lift system (41) according to one of the preceding claims, characterized in that the control unit of a safety node (10) assigned to one car (43) as a functional unit is designed to predict a first stop point (46) for a first travel direction (44) of the car (43) in ongoing manner and to predict a second stop point (47) for a second travel direction (45) of the car (43) in ongoing manner, while the respective stop point (46, 47) indicates the position at which the car (43) can halt if need be in the respective travel direction (44, 45).
10. Lift system (1) according to Claim 9, characterized in that the safety node (10) assigned to one car (43') as a functional unit is designed to transmit the predicted first stop points (46) via the interface (11) each time to at least the safety node (10) assigned to the neighboring car (43") in the first travel direction (44), and to transmit the predicted second stop points (47) via the interface (11) each time to the safety node (10) assigned to the neighboring car (43"') in the second travel direction (45).
11. Lift system (1) according to Claim 10, characterized in that the control unit of a safety node (10) assigned to one car (43') as a functional unit is designed to determine the distance (48, 49) from the first stop point (46) of this car (43') to the second stop point (47) of the neighboring car (43") in the first travel direction (44) and the distance (48, 49) from the second stop point (47) of this car (43') to the first stop point (46') of the neighboring car (43''') in the second travel direction (45), and the safety system transfers the lift system (1) to a secure operating state upon determining a negative distance (49).

Images