EP3599208B1 - Lift system having a plurality of cars and a decentralised safety system - Google Patents

Description

The invention relates to an elevator installation comprising a plurality of cars, a shaft system that enables circulating operation of the cars, at least one drive system for moving the cars within the shaft system, and a safety system with a plurality of safety nodes. The safety system of the elevator installation is designed to transfer the elevator installation to a safe operating state when it detects an operating state of the elevator installation that deviates from normal operation. The cars of the elevator installation, the shaft system of the elevator installation and the at least one drive system of the elevator installation each form at least one functional unit.

Due to the fact that in such an elevator system several cars can be moved largely independently of one another in a common shaft of the shaft system, the problem with such elevator systems is to ensure that a collision between adjacent cars is reliably prevented.

To this end, it is usually necessary for a large number of operating parameters of an elevator system to be recorded and evaluated, in particular the current position of each elevator car. The more cars an elevator system comprises, the more extensive the amount of data to be processed and transmitted becomes.

From the pamphlet EP 1 562 848 B1 an elevator system with at least one shaft, in which at least two cars can be moved along a common track, is known. In this elevator system, a control unit, a drive and a brake are assigned to each elevator car. In order to prevent a collision between the cars of the elevator system, the distance between neighboring cars is monitored. If a predetermined critical minimum distance is not reached, it is provided that an emergency stop of the corresponding car is triggered.

From the pamphlet EP 0 769 469 A1 Another elevator system is known in which several cars can be moved simultaneously in at least one shaft. In this elevator system, each car has its own drive and its own safety module. The safety modules are designed to trigger the brake system of the respective car and other cars. For this purpose, it is provided that data recorded or evaluated by a security module are transmitted to all other security modules. One from the EP 0 769 469 A1 A known problem here is that the amount of data to be transmitted is so large that ongoing transmission and processing of this data by the security modules is not possible, at least with justifiable technical effort, which is why the EP 0 769 469 A1 suggests working with a dynamic elevator model EP 0 769 469 A1 discloses an elevator installation according to the preamble of claim 1.

Against this background, it is an object of the present invention to improve an elevator installation mentioned at the beginning. In particular, an elevator installation with an improved safety system is to be provided. The elevator installation should preferably enable a safety concept which uses a distributed system architecture and advantageously enables short response times. The communication load that occurs to ensure safe operation of an elevator system should preferably be reduced compared to previously known elevator systems.

To solve the problem, we use an elevator system comprising a plurality of cars, a shaft system that enables the cars to circulate, at least one drive system for moving the cars and a safety system with a plurality of safety nodes, which is designed when an operating state of the elevator system that deviates from normal operation is detected to transfer the elevator system into a safe operating state is proposed. The cars, the shaft system and the at least one drive system each form at least one functional unit. At least one of the safety nodes is assigned to one of the functional units. Each functional unit thus advantageously has at least one security node. The security nodes are each connected to at least one of the further security nodes via at least one interface for transmitting data. In addition, the safety nodes each include at least one sensor for detecting an operating parameter of the corresponding assigned functional unit. Furthermore, the security nodes each include at least one control unit, which is designed to evaluate the operating parameter detected by the at least one sensor of the respective security node and, taking into account, i.e. in particular taking additional consideration, the data transmitted by the at least one further security node, a determination is made with regard to a to meet an operating state deviating from normal operation. Data transmitted by a safety node are in particular operating parameters of the functional unit that is assigned to the safety node, preferably operating parameters that have already been evaluated.

The elevator system according to the invention thus advantageously enables decentralized monitoring of functional units of the elevator system. Operating parameters recorded with regard to a functional unit advantageously do not have to first be transmitted to a central control unit, but can be evaluated directly by the control unit of the safety node assigned to the functional unit. This advantageously reduces the amount of data to be transmitted and thus the communication load.

Since the elevator system according to the invention also advantageously makes it possible to determine an operating state deviating from normal operation at a safety node, in particular if a functional unit does not work as intended, for example a car cannot be moved or is moved at too high a speed, short reaction times are advantageous enables. This advantageously further increases the safety of an elevator system.

According to an advantageous embodiment of the elevator system according to the invention, it is provided that the at least one drive system is designed to be operable in shaft sections, advantageously in such a way that the cars can be moved independently of one another in defined sections of the shaft system, with each of the defined sections preferably being a functional unit of the drive system, which is assigned to at least one of the security nodes. The drive system preferably comprises at least one linear motor. For this purpose, the elevator system preferably has rails as part of the linear drive, along which the cars can be moved separately. The rails can advantageously be energized in sections, so that the drive system can be operated in sections of the shaft. As a result of the rails that can be energized in sections, the cars of the elevator installation can advantageously be moved independently of one another. In this case, such a rail section that can be energized is in particular a defined section of the shaft system which, as such, forms a functional unit of the drive system. The drive system as a functional unit thus advantageously itself again has a multiplicity of functional units, each of which is advantageously assigned a safety node.

In particular, it is provided that such a rail section of the linear drive that can be energized forms a functional unit in each case. A safety node is advantageously assigned as a functional unit to each rail section that can be energized or to a group of rail sections that can be energized. Sensors of this safety node advantageously check operating parameters relevant to the rail sections, in particular whether a rail section is functioning properly and / or whether a car of the elevator system is being moved along a rail section.

The control unit of such a safety node is advantageously designed to switch off different linear motor segments, in particular the aforementioned rail sections of the linear drive, depending on the current positions of the cars of the elevator system, in particular to eliminate possible sources of error and, if necessary, to combine the elevator system or the corresponding functional unit of the drive system into one to transfer safe operating state.

In particular, it is provided as a further advantageous embodiment that the control unit of a safety node assigned to a functional unit of the drive system can influence the control of the linear motor segments. In particular, it is provided that a car moved on a linear motor segment can be braked if a risk of collision is signaled to the safety node assigned to this linear motor segment by the safety node assigned to this car. In order to enable such a data exchange, the security nodes are advantageously linked to one another via a communication interface, for example via a communication bus or an air interface, in particular using WLAN (WLAN: Wireless Local Area Network).

Another particularly advantageous embodiment of the elevator system according to the invention provides that the shaft system of the elevator system has at least two vertically extending transport paths along which the cars can be moved vertically, as well as at least two relocating devices for relocating the cars between the transport routes. Each of the relocating devices is advantageously a functional unit of the shaft system to which a safety node is assigned in each case. By means of the relocating devices, the cars can advantageously be moved, in particular, between shafts of the shaft system of the elevator installation. Each shaft can represent a transport route. According to an embodiment variant, a shaft can, however, also comprise several transport routes, preferably such that several cars can be moved simultaneously next to one another and one behind the other in the shaft.

In particular, the relocating device provides a possibility for circulating operation of the cars of the elevator installation. Such a circulating operation provides in particular that the cars are moved exclusively in one direction, for example upwards, along at least one transport path of the shaft system, and are moved exclusively in another direction, for example downwards, along at least one further transport path of the shaft system.

The fact that, according to a preferred embodiment of the invention, it is provided that the individual conversion devices or a group of conversion devices are each assigned a safety node, the proper functioning of the conversion devices is advantageously monitored directly at the conversion devices. This advantageously further reduces the amount of data to be transmitted. If there is a fault in a conversion device so that it can no longer be operated in normal operation, but is converted into a safe operating state, this is advantageously communicated to further safety nodes assigned to other functional units. The elevator system is advantageously designed in such a way that the elevator system can continue to be operated, the defective or non-operational converter being no longer approached by the elevator cars.

As a particularly preferred embodiment of the elevator system according to the invention, it is provided that the transport routes of the shaft system are rails along which the cars can be moved by means of at least one linear drive as a drive system. Each rail is advantageously designed with at least one segment that can be rotated relative to the vertical transport path as a transfer device, these rotatable segments being able to be aligned with one another in such a way that a car of the elevator system can be moved along the segments between the rails.

According to a further particularly advantageous embodiment of the elevator system according to the invention, the functional units of the elevator system each have at least one safety device. This at least one safety device can advantageously transfer the respective functional unit to a safe operating state when triggered. Furthermore, it is advantageously provided that the at least one safety device can be actuated for triggering directly by the control unit of the safety node assigned to the respective functional unit. In particular, a brake or a safety device is used as the safety device of a car intended. In particular, a switching unit, for example a contactor circuit, which can de-energize the functional unit, is provided as a safety device for a functional unit of the drive system. In particular, a locking mechanism is provided as the safety device of a transfer device as a functional unit of the shaft system, which can fix the transfer device in a defined position.

The safety nodes are advantageously arranged on the functional units, preferably in such a way that the control unit, the at least one sensor and the at least one safety device are arranged together on a functional unit. As a result, decisions about transferring a functional unit and thus the elevator system to a safe operating state can advantageously be made locally and decentrally. This advantageously leads to an increased robustness of the security system. In addition, safety-relevant decisions can advantageously be made at the same time. For example, a car can be brought to a standstill by releasing the brake of the car and at the same time the corresponding functional unit of the drive system that was responsible for moving this car can be deactivated. In addition, the proposed elevator system achieves a high degree of scalability for the system. Adaptations of the safety system, for example to a larger number of cars, advantageously turn out to be comparatively small.

A further particularly advantageous embodiment of the elevator system according to the invention provides that a plurality of monitoring rooms is defined for the shaft system of the elevator system, with a plurality of functional units being assigned to each monitoring room, the safety nodes of the functional units located in a monitoring room via at least one interface to the Transferring data are connected. The monitoring spaces are not structurally or structurally separate areas, but rather space segments which are defined with regard to the security system and which in particular can also overlap. By defining these monitoring spaces, the elevator installation is advantageously subdivided into subsystems with regard to the monitoring of normal operation of the elevator installation, each subsystem advantageously being monitored with regard to an operating state that deviates from normal operation. At least one car, at least one functional unit of the shaft system and at least one functional unit of the drive system are advantageously assigned to a monitoring space. In addition, the cars immediately adjacent to a car, in particular a preceding car and a following car, are particularly preferably assigned to a monitoring space. A car is advantageously assigned to at least two monitoring spaces, namely once as a car which is surrounded by two adjacent cars and once as a car that is adjacent to a car.

An advantageous embodiment variant of the invention provides that the monitoring spaces are permanently assigned spatially, preferably via spatial coordinates that represent positions within the shaft system of the elevator installation. For this purpose, the shaft system in particular can be assigned a permanently assigned Grid are represented. A grid that is basically suitable for this is, for example, from the publication EP 1 719 727 B1 known.

As a further advantageous embodiment variant, it is provided that in each case a specific area containing a car is defined as the monitoring space, so that this monitoring space is quasi moved together with the car. If another car is moved into this monitoring space, it is advantageously also monitored with regard to a deviation from normal operation. In particular, it is provided that in this embodiment, too, at least one functional unit of the shaft system and at least one functional unit of the drive system are always assigned to the monitoring space, the assigned functional units being able to change when the car is moved.

In particular, each shaft area of the shaft system that can be approached by one of the elevator cars is assigned to at least one monitoring space.

Advantageously, an exchange of operating parameters between security nodes takes place exclusively within the respective monitoring space, which parameters are required for determining an operating state of the elevator system that deviates from normal operation. Only if an operating state deviating from normal operation is determined is this information advantageously also transmitted to further security nodes beyond the monitoring area.

According to a further advantageous embodiment of the invention, the elevator system is designed to be partially deactivatable, in particular in such a way that individual functional units or groups of functional units, in particular individual cars and / or functional units of the drive system, can be deactivated, the elevator system being further developed with not deactivated functional units to continue to operate.

It is advantageously also provided that in each case a section of the shaft system having at least one shaft door is a functional unit to which at least one safety node is assigned. The safety node is advantageously designed to monitor whether this functional unit is functioning properly. For this purpose, the safety node advantageously has sensors for detecting operating parameters of this functional unit. Furthermore, it is provided in particular that the safety node of a control unit is designed to evaluate the operating parameters and to evaluate data received from safety nodes of other functional units, for example operating parameters of a car.

According to a further advantageous aspect of the invention, the safety node assigned to the section of the shaft system having at least one shaft door as a functional unit has at least one sensor which is designed to detect an operating state of this functional unit that deviates from normal operation. The elevator system is advantageously Preferably the safety system of the elevator installation, in particular the safety node of the safety system assigned to this functional unit, is designed to deactivate this functional unit when such an operating state deviating from normal operation is detected. The elevator installation, preferably the safety system of the elevator installation, is advantageously further designed to move the elevator cars of the elevator installation exclusively outside of this section of the shaft system which has at least one shaft door.

In particular, as such an operating state that deviates from normal operation, an opening of the shaft doors that deviates from normal operation is provided. In order to monitor this, a sensor monitoring the opening and closing of the shaft doors is provided in particular. Since, for example, moving a car in a shaft section when the shaft doors are open represents a potential hazard for the users of the car, this section is advantageously deactivated. The elevator installation is advantageously designed not to move the cars within this shaft section, but rather to move the cars up to this shaft section at most.

According to a further particularly preferred embodiment of the elevator system according to the invention, the control unit of a safety node assigned to a car as a functional unit is designed to continuously predict a first stop point for a first direction of travel of the car and / or to continuously predict a second stop point for a second direction of travel of the car. The respective stop point indicates the position at which the car can stop, that is to say stop, if necessary in the respective direction of travel. The stop points are predicted by evaluating the operating parameters recorded by the sensors. The prediction is advantageously based on a predictor model executed by means of a computing unit, in particular a computing unit of the control unit. Operating parameters which are recorded by the sensor and which belong to the same safety node are preferably evaluated. In addition, it is provided in particular that operating parameters transmitted to the security node are also taken into account in the evaluation. The operating parameters taken into account in the evaluation are in particular the speed of the car, the position of the car in the shaft system, the acceleration of the car, the load on the car and the state of the car's brakes. These operating parameters and the stop points predicted from them are preferably determined in predefined discrete time intervals of, for example, 5 ms to 50 ms (ms: milliseconds). As a result, an ongoing prediction of the stop points is made possible, as it were.

The safety node assigned to a travel node is thus advantageously designed to continuously, that is to say essentially continuously, calculate the stop point for the first travel direction and the stop point for the second travel direction for this elevator car. This stop point provides information about where this car would come to stop or stop in the event of braking, in particular emergency braking. Operating parameters of the other cars, in particular travel parameters of the other cars, advantageously do not need to be taken into account in this determination of the stop points. This advantageously further reduces the communication load.

As a particularly advantageous development of the elevator system, it is provided that the safety node assigned to a car as a functional unit is also designed to transmit the predicted first stop points via the interface at least to the safety node assigned to the car adjacent in the first direction of travel and the to transmit the predicted second stop points via the interface at least to the safety node assigned to the car adjacent in the second direction of travel. Thus, the safety node assigned to a car advantageously knows at a point in time, in addition to the stop points of this car, also the stop points of the cars adjacent to this car, which are located in the respective direction of travel of this car.

According to a further advantageous development of the elevator system, it is provided that the control unit of a safety node assigned to a car as a functional unit is designed to determine the distance from the first stop point of this car to the second stop point of the car adjacent in the first direction of travel. Furthermore, this control unit is advantageously designed to determine the distance from the second stop point of this car to the first stop point of the car that is adjacent in the second direction of travel. The safety system of the elevator installation is advantageously designed to transfer the elevator installation into a safe operating state when a negative distance is determined.

By comparing a stop point of a car for one direction of travel with the stop point of an adjacent car, a risk of collision can advantageously be reliably identified. In this embodiment, only stop points are thus advantageously transmitted and in particular no further car-related operating parameters, so that the amount of data to be transmitted is advantageously small. Since it is provided in particular that only the stop points of adjacent cars are compared with one another, the amount of data to be transmitted is advantageously further reduced.

A current stop point for a direction of travel of a car is, based on the current position of the car, in particular the distance that the car needs to stop in this direction of travel. A safety distance, preferably a fixed safety distance, is preferably applied to the distance, so that the stop point is correspondingly further away from the car. Depending on the current operating parameters of a car of the elevator installation, the distance between the car and the stop point also changes for each direction of travel. In particular, with the speed at which a car is moved, the distance between the corresponding stop point and the car also increases.

The minimum distance that two adjacent cars can occupy depends on several operating parameters, in particular the current position of the cars in the shaft system, the speeds of the cars, the accelerations of the cars, the loads on the cars and / or the status of the car brakes . Preferably, these operating parameters are only recorded individually for each car in order to use these operating parameters for each car for the at least one direction of travel to determine the respective stop point. By comparing the stop points of adjacent cars, it is advantageously checked that a minimum distance between the cars is maintained, this minimum distance advantageously being dynamically adapted by the ongoing determination of the stop points and their comparison.

If a negative distance is determined when determining the distances between the predicted stop points of neighboring cars, that is, if the stop point of a car is further away from this car than the stop point of an adjacent car, then the elevator system is advantageously switched to a safety mode, in particular in the corresponding one neighboring cars, the stop points of which have a negative distance, are braked and thus brought to a stop, in particular by triggering safety devices of these cars. It should be noted that the term "negative distance" denotes the case that the stop point of a car under consideration is further away from this car under consideration than the stop point of an adjacent car, in particular a car traveling ahead or behind. Whether the distance is actually negative in the sense of a negative number depends on the reference system used. For example, a "negative distance" can also be expressed in particular by a positive number in the case of a corresponding reference system.

Both horizontal and vertical movements of the cars can advantageously be taken into account and corresponding stop points can be predicted. Rapid detection of possible collisions is advantageously provided.

According to a particularly advantageous embodiment of the invention, it is provided that the stop point of each car is predicted, assuming that the respective car will stop at the latest when at least one safety device of the elevator system intervenes. The prediction is thus advantageously designed to be conservative. The distance between neighboring cars is sometimes larger than absolutely necessary, but a collision between neighboring cars is reliably prevented. Safety devices of the elevator system are in particular braking devices, such as, for example, safety devices for the elevator cars and / or braking devices provided by the drive system. If the drive system of the elevator installation comprises at least one linear drive, in particular the section-wise disconnection of a line of the linear drive is provided as the intervention of at least one safety device.

A further advantageous embodiment of the invention provides that the stop points are each predicted assuming a worst case scenario in order to reliably prevent a collision between adjacent cars in any case. In particular, it is provided that the stop point of each car is predicted under the additional assumption that the respective car is accelerated with the maximum possible acceleration on the part of the elevator system before the intervention of the at least one safety device of the elevator system. For a stopping car that can be moved up and down in a shaft, the stop point in the "up" direction of travel is therefore more advantageous under the Assumption predicts that the car is initially accelerated maximally in the "up" direction of travel and is then brought to a stop by the intervention of at least one safety device. In the "down" direction of travel, the stop point in the "down" direction of travel is advantageously predicted on the assumption that the car is initially accelerated to a maximum in the "down" direction of travel and is then brought to a stop by at least one safety device intervening. Due to the force of gravity acting on the car, which is advantageously taken into account in the prediction of the stop points, the distance of the stop point in the "up" direction of travel to the upper end of the car is less than the distance of the stop point in the "down" direction of travel to the lower end of the car.

In particular, it is provided that in a vertical shaft of the shaft system of the elevator installation in which at least three cars are moved, an upper stop point and a lower stop point are continuously predicted for each car. Except for the car located furthest up in the shaft and the car located furthest down in the shaft, all of the cars thus have an upper, adjacent car and a lower, adjacent car. It is advantageously provided here that the distance between the upper stop point of one car and the lower stop point of the upper adjacent car is determined. The distance between the lower stop point of a car and the upper stop point of the lower adjacent car is advantageously determined.

The stop points are advantageously defined using a grid that is permanently assigned to the shaft system. A grid that is basically suitable for this is, for example, from the publication EP 1 719 727 B1 known.

With such a fixed grid, the lowest point that a car can approach via the shaft system is preferably assigned the value 0. A corresponding maximum value is preferably assigned to the highest point that a car can approach via the shaft system. If the cars can also be moved laterally, the stop points can in particular be represented as coordinates (x, y) or (x, y, z). In this case, only the corresponding coordinate is preferably taken into account for a current direction of travel, for example only the x coordinate for direction of travel x. Particularly in the areas in which the direction of travel changes, for example from direction of travel x to direction of travel y, it is advantageously provided that more than one coordinate is taken into account for a corresponding section comprising the transition area, i.e. in relation to the example given above, the Coordinates (x, y).

With such a definition of a fixed grid there is a risk of collision if the upper stop point of a car is greater than the lower stop point of the car moving above this car. In this case, the elevator installation is switched to a safety mode, in particular in that at least one of the two cars is brought to a stop. The same applies accordingly if the lower stop point of a car is smaller than the upper stop point of the car moving below this car.

Possible dangers of collision of a car with an upper neighboring car and / or a lower neighboring car are thus reliably detected, namely by checking whether a determined distance is negative, i.e. whether the stop points compared with one another have an overlap area. If a negative distance is determined, the elevator installation is advantageously transferred from normal operation to a safety mode, in particular by stopping the affected cars. The other cars are advantageously continued to move in restricted operation, the stopped cars defining a restricted area which the cars that are still being operated are only allowed to approach up to a predefined distance. The cars stopped during the transfer of the elevator system to a safety mode are preferably assigned fixed stop points, so that in particular a collision of cars with the stopped cars is still prevented using the same method.

Each control unit assigned to a car advantageously calculates the stop points for the at least one direction of travel of this car, in particular an upper and a lower stop point, and exchanges these with those from the control units of the adjacent cars. Instead of calculating the distances between adjacent cars, the stop points are advantageously compared with one another, as already explained above. As long as the stop points do not overlap, i.e. a negative distance is determined, there is no risk of collision.

The control unit of a car preferably triggers a safety device of this car when a negative distance between the stop points is determined, with provision being made in particular that triggering the safety device brings the car to a stop. In particular, the actuation of a brake of the car is provided as a triggering of a safety device of the car. Advantageously, the control device assigned to a car is only responsible for the safety device of this car with regard to the triggering of safety devices and advantageously does not have to brake other cars as well. This advantageously further reduces the amount of data to be transmitted.

In particular, it is provided that the stop points are each predicted from current operating parameters of the respective car. According to an advantageous embodiment, it is provided that stop points are predefined for all quantized combinations of operating parameters. According to an advantageous embodiment, the stop points are assigned to such a combination of operating parameters via a lookup table. In particular, according to a further advantageous embodiment variant, such an assignment is provided as a plausibility check of stop points predicted by real-time calculations. When a predefined deviation from assigned stop points and predicted stop points is detected, the elevator system is also advantageously transferred to a safety mode.

In particular, the elevator system according to the invention, in particular the respective components of the elevator system, is designed to carry out method steps described in connection with the invention.

Fig. 1

in einer vereinfachten schematischen Darstellung ein Ausführungsbeispiel für eine erfindungsgemäße Aufzuganlage;

Fig. 2

in einer vereinfachten schematischen Darstellung ein Ausführungsbeispiel für eine Zuordnung von Sicherheitsknoten zu den funktionalen Einheiten bei einer Ausgestaltungsvariante einer erfindungsgemäßen Aufzuganlage;

Fig. 3

in einer vereinfachten schematischen Darstellung einen Ausschnitt eines Ausführungsbeispiels für eine erfindungsgemäße Aufzuganlage;

Fig. 4

in einer vereinfachten schematischen Darstellung ein weiteres Ausführungsbeispiel für eine erfindungsgemäße Aufzuganlage; und

Fig. 5

in einer vereinfachten schematischen Darstellung ein Ausführungsbeispiel für einen Fahrkorb zur Verwendung in einer in Fig. 4 dargestellten Aufzuganlage, mit beispielhaft dargestellten Stoppunkten.

Further advantages, features and design details of the invention are explained in more detail in connection with the exemplary embodiments shown in the figures. It shows:

Fig. 1

in a simplified schematic representation, an embodiment for an elevator installation according to the invention;

Fig. 2

in a simplified schematic representation, an exemplary embodiment for an assignment of safety nodes to the functional units in an embodiment variant of an elevator installation according to the invention;

Fig. 3

in a simplified schematic representation, a section of an exemplary embodiment for an elevator installation according to the invention;

Fig. 4

in a simplified schematic representation of a further exemplary embodiment for an elevator installation according to the invention; and

Fig. 5

in a simplified schematic illustration an embodiment of a car for use in a in Fig. 4 shown elevator system, with exemplary shown stop points.

In Fig. 1 an elevator installation 1 with a plurality of cars 2 and a shaft system 3 is shown in simplified form. The cars 2 can be moved separately from one another in a first direction of travel 6 (symbolically represented by a single arrow 6) and in a second direction of travel 7 (symbolically represented by a double arrow 7), that is to say largely independently of one another. The cars 2 each form a functional unit of the elevator installation 1. The shaft system 3 of the elevator installation 1 is designed in such a way that the cars 2 can be operated in a circulating manner. This means that the cars 2 can in particular all be moved in the first direction of travel 6 or all of them in the second direction of travel 7.

In the Fig. 1 The illustrated elevator installation 1 has a linear drive with a plurality of linear motor segments 4 for moving the cars 2, the linear motor segments 4 each being a functional unit of the drive system of the elevator installation 1. By means of these linear motor segments 4, which can be activated and deactivated individually, the drive system of the elevator installation 1 is advantageously designed to be operable in shaft sections, in particular in such a way that the cars 2 can be moved independently of one another in defined sections of the shaft system, each of the Linear motor segments 4 forms such a defined section and is in each case a functional unit of the drive system.

The shaft system 3 of the elevator installation 1 comprises a plurality of shaft doors 5, the sections of the shaft system 3 comprising a shaft door 5 each forming a functional unit of the elevator installation 1.

In the Fig. 1 The elevator installation 1 shown also includes a safety system (in Fig. 1 not explicitly shown) with a plurality of security nodes (in Fig. 1 not explicitly shown). At least one of the safety nodes is assigned to one of the functional units, that is to say in particular to a car 2, at least one linear motor segment 4 and a shaft section comprising at least one shaft door 5. The security nodes are advantageously each connected to at least one of the further security nodes via at least one interface for transmitting data, for example a communication bus or wirelessly via an air interface. The security nodes each include at least one sensor (in Fig. 1 not explicitly shown) to record an operating parameter of the corresponding assigned functional unit. For example, it is provided that the position, the speed, the acceleration and the load of a car are recorded as operating parameters.

Furthermore, it is provided that the security nodes each have at least one control unit (in Fig. 1 not explicitly shown), which is designed to evaluate the operating parameters detected by the at least one sensor of the respective safety node. The control unit is advantageously further designed, taking into account this evaluation and the data transmitted by the at least one further security node, to make a determination with regard to an operating state that deviates from normal operation.

The safety system of the elevator installation 1 is thus advantageously designed to transfer the elevator installation to a safe operating state when an operating state of the elevator installation 1 deviating from normal operation is detected. Normal operation is, in particular, error-free operation. A safe operating state of the elevator installation 1 is an operating state into which the elevator installation 1 is transferred in the event of a fault and / or danger. In particular, it is provided in such a safe operating state that at least one of the functional units of the elevator installation 1 is deactivated. For example, at least one linear motor segment 4 can be switched off and / or at least one car 2 can be stopped by triggering emergency braking and / or a shaft section of the shaft system 3 comprising at least one shaft door 5 can no longer be approached by the cars 2.

With reference to Fig. 2 the safety system of an elevator installation designed according to the invention is explained in more detail. To do this, in Fig. 2 schematically, a plurality of elevator cars 2 as functional units of the elevator installation, a plurality of shaft sections 8, which each form a functional unit of the shaft system, and a plurality of transfer devices 9 which are used for transferring of cars 2 between different transport routes, in particular different shafts of the shaft system, are shown as further functional units of the shaft system.

The functional units 2, 8, 9 each have a safety node 10, 10 ', 10 ", these safety nodes 10, 10', 10" being part of the safety system of the elevator installation. The security nodes 10, 10 ', 10 "are used for the transmission of data (in Fig. 2 symbolically represented by arrows 26) are connected to one another via an interface 11, a security protocol preferably being provided for the transmission 26.

The safety nodes 10, 10 ', 10 "each include sensors for detecting operating parameters of the respective functional unit. Operating parameters detected by the sensors 12, 13, 14, 15, 19, 20, 21 of a safety node 10, 10', 10" as well as operating parameters Data transmitted from other security nodes to a security node are transferred to a control unit (in Fig. 2 not explicitly shown) of the security node. The control unit, for example a suitably programmed microcontroller circuit, evaluates the data. Furthermore, the control unit is designed to trigger a safety device assigned to the respective functional unit 2, 8, 9, and thus to transfer the elevator installation to a safe operating state. The transmission of data taking place in a functional unit 2, 8, 9 is in Fig. 2 symbolically represented by the arrows 27. Data transmission can also take place bidirectionally, that is to say also against the direction of the arrow of the arrows 27.

The safety components, in particular safety devices and the control units triggering the safety devices, are advantageously placed locally on the functional units 2, 8, 9, preferably directly on the actuators and sensors. This advantageously avoids real-time communication over long distances.

In particular, safety nodes are advantageously distributed in vertical and horizontal shafts of the shaft system of an elevator installation. These advantageously record the states of the manhole components. With regard to the functional unit shaft section 8, to which a safety node 10 'is assigned, the states of the shaft doors are recorded, for example, by means of sensors 15.

The safety nodes are advantageously designed to deactivate functional units of the elevator installation, in particular to switch off drives, via appropriate control units and safety devices. This can take place, for example, with regard to the functional unit of the shaft section 8 by triggering safety devices 18, 18 '. The safety devices 18 provide what is known as a "Safe Toque Off" (STO) functionality that switches the drive powerless. The safety devices 18 'advantageously provide a functionality that switches off the drive by means of a motor protection device.

Safety nodes assigned to functional units of the shaft system are preferably wired directly to the shaft components.

For the horizontal transfer of a car from one shaft to another shaft, a transfer device 9 is provided in particular. Such a relocating device 9 is advantageously monitored by a safety node 10 "assigned to the respective relocating device 9. Position limit switches 19, devices for detecting the state of a locking mechanism 20 and an absolute position sensor 21 continuously detect operating parameters of the relocating device 9 as sensors of the safety node in the exemplary embodiment If an operating state deviating from normal operation is detected by the safety node 10 "or a control unit of the safety node 10", one of the safety devices assigned to the conversion device 9 is advantageously triggered, preferably a service brake 17 with a coupled drive switch-off 17 ', which is in particular called "Safe Toque Off" (STO ) Functionality can be realized.

The safety nodes 10 assigned to the cars 2 include in particular sensors 12, 13, 14 for detecting operating parameters with regard to the respective car 2, in particular a sensor 12 for detecting the position of the car, a sensor 13 for detecting the state of the car doors, in particular the states " closed "/" open ", a sensor 14 for detecting the loading of the car 2. Further operating parameters are advantageously transmitted from further safety nodes to the respective safety node 10 of a car. By evaluating the operating parameters, the safety node 10 makes a determination with regard to an operating state that deviates from normal operation. If an operating state deviating from normal operation is determined, safety devices 16, 16 ′ of the car 2 are advantageously triggered by the safety node 10 or the control unit of this safety node 10. This puts the elevator system into a safe operating state. In particular, a service brake 16 and a redundant safety gear 16 'are provided as safety units for the car.

In order to further reduce the computational load per safety node, provision is made, in particular, to avoid or at least reduce multiple identical calculations and multiple identical decisions within the safety system of the elevator installation. The security nodes 10, 10 ′, 10 ″ are therefore advantageously designed to make decisions, in particular decisions regarding the triggering of a security device, locally and to transmit the corresponding results, states and / or decisions to the other security nodes.

For this purpose, the safety nodes 10, 10 ′, 10 ″ of the functional units 2, 8, 9 are each advantageously provided with at least the information or operating parameters listed below.

• X, Y, Z-Position, Geschwindigkeit und Beschleunigung des Fahrkorbs;
• Zuladung des Fahrkorbs;
• Zustand der Fahrkorbtür;
• Zustand Aktorik beziehungsweise Sicherheitseinrichtung, insbesondere Betriebsbremse und Fangvorrichtung;
  wobei diese vorstehenden Informationen beziehungsweise Betriebsparameter vorteilhafterweise durch die Sensoren des Sicherheitsknotens bereitgestellt werden;
• Zustand der Schachttüren;
  wobei diese Information vorzugsweise durch den Sicherheitsknoten 10' der funktionalen Einheit 8 des Schachtsystems bereitgestellt wird;
• Informationen über eine mögliche Kollision anderer Fahrkörbe 2;
  wobei zur Generierung dieser Information vorteilhafterweise dem Sicherheitsknoten 10 Betriebsparameter von Sicherheitsknoten 10 benachbarter Fahrkörbe 2 bereitgestellt werden, vorzugsweise Stoppunkte (wie obenstehend und nachfolgend unter Bezugnahme auf Fig. 4 und Fig. 5 erläutert); und
• Zustand der Umsetzeinrichtung 9;
  wobei diese Information vorzugsweise von dem der Umsetzeinrichtung 9 zugewiesenen Sicherheitsknoten 10" bereitgestellt wird.

The safety node 10 of the car 2 advantageously has access to the following operating parameters:

• X, Y, Z position, speed and acceleration of the car;
• Payload of the car;
• Condition of the car door;
• State of actuators or safety equipment, in particular service brake and safety gear;
  wherein this above information or operating parameters are advantageously provided by the sensors of the safety node;
• Condition of the landing doors;
  this information is preferably provided by the safety node 10 'of the functional unit 8 of the shaft system;
• Information about a possible collision of other cars 2;
  in order to generate this information, operating parameters of safety nodes 10 of adjacent cars 2 are advantageously provided to safety node 10, preferably stop points (as above and below with reference to FIG Fig. 4 and Fig. 5 explained); and
• State of the converting device 9;
  this information is preferably provided by the security node 10 ″ assigned to the conversion device 9.

The interaction of security nodes, in particular security nodes within a defined monitoring space (as explained above), is explained in more detail below with the aid of two examples. For a better understanding, in Fig. 1 and Fig. 2 Reference is made to the elements shown.

First example - emergency stop of the car when a risk of collision is detected:

Each safety node 10 that is assigned to a car 2 as a functional unit creates information regarding a possible collision on the basis of its own sensors 12, 13, 14 and distributes this information via the interface 11 to all other safety nodes that are assigned to a car as a functional unit are.

Each safety node 10 that is assigned to a car 2 as a functional unit checks the risk of collision on the basis of the information received from other safety nodes that are assigned to a car 2 as a functional unit. If a possible collision is detected, a safe state of the car 2 is initiated - advantageously triggered by the control unit of the corresponding safety node 10.

As long as no safe state should or must be achieved, the safety node 10, which is assigned to a car 2 as a functional unit, gives permission to all safety nodes assigned to a functional unit 4 of the drive system to activate the corresponding functional units 4 of the drive system . Activation of functional units 4 of the drive system can, in the case of a linear drive as the drive system, be, for example, energizing the corresponding linear motor segments.

If the car 2 is to be brought into a safe operating state, the safety node 10 assigned to this car 2 advantageously notifies all the safety nodes assigned to functional units 4 of the drive system that the functional units 4 of the drive system responsible for this car 2 are to be deactivated , so for example with a linear drive as the drive system, the corresponding linear motor segments are to be switched off.

All safety nodes assigned to functional units 4 of the drive system check their responsibility for this car 2 based on the information transmitted via interface 11 from safety node 10 assigned to car 2. Deactivate or activate them depending on the result of this check the corresponding functional units 4 of the drive system.

Second example - entry of a car into a transfer device:

Each safety node 10 ″, which is assigned to a relocation device 9 as a functional unit of the shaft system, creates the information about the current status of the relocation device 9 on the basis of its own sensors 19, 20, 21 and transmits this to all other safety nodes 10 that are associated with a car 2 are assigned as a functional unit.

Each safety node 10, which is assigned to a car 2 as a functional unit, checks the risk of collision with a transfer device 9 on the basis of the information received from the safety nodes 10 ″, which is assigned to the respective transfer devices 9 transferred to a safe operating state.

As long as it is not necessary to transfer to a safe operating state, the safety node 10 assigned to the car 2 gives permission to all the safety nodes assigned to a functional unit 4 of the drive system to activate the corresponding functional units 4 of the drive system, for example in the case of a linear drive as a drive unit the permission to be able to energize the linear motor segments.

If the car 2 is to be transferred to a safe state, the safety node 10 assigned to the car 2 transmits the information to deactivate the functional units 4 of the drive system responsible for this car 2 to all safety nodes assigned to a functional unit 4 of the drive system . In the case of a linear drive as the drive unit, the information to switch off the linear motor segments is transmitted, for example.

All safety nodes that are assigned to a functional unit 4 of the drive system use the information to check their responsibility for this car 2 and deactivate the corresponding functional unit 4 of the drive system, for example the linear motor segment, or allow the corresponding functional unit 4 of the drive system, for example to activate the linear motor segment. If a change in the state of a relocating device 9 poses a risk for the car 2 or the people transported in this car, the safety node 10 ″ to which this relocating device 9 is assigned does not allow any change in the status of the relocating device 9. A safety device 17, 17 is preferably used 'is activated, which prevents a change in the state of the relocating device 9. Such a safety device 17' is in particular a locking mechanism.

At the in Fig. 3 The elevator installation 1 shown in detail is a part of the shaft system 3 in which cars 2 can be moved separately, that is to say essentially independently of one another, together with two cars 2. The shaft system 3 has a section 8 of the shaft system 3 that has a shaft door 5 as a functional unit. A safety node (in Fig. 3 not explicitly shown). This security node includes a sensor (in Fig. 3 not explicitly shown), which is designed to detect an operating state of this functional unit 8 that deviates from normal operation, the elevator system 1 being designed to deactivate this functional unit 8 and advantageously exclusively the cars 2 of the elevator system 1 when such an operating state deviating from normal operation is detected to move outside this section 8 of the shaft system 3 which has at least one shaft door 5.

In the in Fig. 3 The illustrated embodiment monitors a sensor with respect to the shaft section 8, in particular the proper opening and closing of the shaft doors. As exemplified in Fig. 3 shown, the sensor detects a failure to close the shaft door 5 to the safety node or to the control unit of the security node of the shaft section 8 as an operating parameter, the control unit advantageously deactivates this shaft section 8. This has the consequence that this shaft section 8 is no longer from the Cars 2 can be approached. This information is transmitted to the signal nodes (in Fig. 3 not explicitly shown) of the cars 2 transferred. The elevator installation 1 or the safety system of the elevator installation 1 is namely advantageously set up in such a way that all the safety nodes located therein exchange information with one another in a defined monitoring space. Corresponding monitoring spaces are advantageously defined for the entire shaft system 3.

By deactivating the shaft section 8, the elevator car 2 traveling in the upward direction of travel 6 can approach the lower limit area of the section 8 identified by the line 29. The car 2 moving in the downward direction of travel 7 can at most Drive up to the upper limit area of section 8 marked by line 29 '. Otherwise, the elevator installation 1 is advantageously still ready for operation.

In the Fig. 4 The elevator installation 41 shown here, which is not shown to scale for reasons of clarity, comprises a shaft system 42 with two vertical shafts 412 and two connecting shafts 413. Furthermore, the elevator installation 41 comprises a plurality of elevator cars 43 (in Fig. 4 e.g. eight cars), which can be moved separately in the shaft system 42 in a subsequent operation, that is to say that several cars 43 can be moved in one shaft 412 or one shaft 413.

The cars 43 can be moved up in the shafts 412 in a first direction of travel 44 (in Fig. 4 symbolically represented by the arrow 44) and moved downwards in a second direction of travel 45 (in Fig. 4 symbolically represented by arrow 45). In the connecting shafts 413, via which the cars 43 can switch between the shafts 412, the cars are also laterally in a third direction of travel 410 (in Fig. 4 symbolically represented by the arrow 410) and in a fourth direction of travel 411 (in Fig. 4 symbolically represented by arrow 411).

In particular, it is provided that the elevator system comprises at least one linear motor as the drive system (in Fig. 4 not explicitly shown), by means of which the cars 43 are moved within the shaft system 42.

In the Fig. 4 The elevator installation 41 shown here is operated in such a way that a first stop point 46 is continuously predicted for each car 43 for the first possible direction of travel and a second stop point 47 is predicted for the second possible direction of travel. A stop point is thus continuously predicted for each car 43 for at least one direction of travel. Thus, for cars 43 located in the vertical shafts 412, an upper stop point is predicted as the first stop point 46 and a lower stop point is predicted as the second stop point 47. In the connecting shafts 413, a stop point located in the direction of travel of the respective car 43 is predicted as the stop point 46 'and a second stop point located opposite the direction of travel of the respective car 43 is predicted as the stop point 47'.

The stop points can in particular be defined using coordinates (x, y), with lateral stop points being defined using the x coordinates and stop points lying perpendicularly using the y coordinates. The point A in Fig. 4 For example, the coordinate (0, 0) can be assigned.

The two stop points 46, 47 or 46 ', 47' indicate, based on the current position of the respective car 43, for each of the possible directions 44, 45 or 410, 411 the point at which the car 43 assuming a worst Case scenarios can stop at the latest. In particular, an upper stop point 46 is predicted for an ascending car 43 ', taking into account current operating parameters such as the direction of travel, speed and load of the car 43', i.e. where the car 43 'would stop if the Car 43 'would accelerate maximally in the direction of travel and would then be braked. As the lower stop point 47 of car 43 ', under the worst-case assumption, it is predicted that the drive fails, car 43' sags as a result and car 43 'would only then be braked.

Corresponding predictions are continuously carried out for the other cars 43 of the elevator system. For this purpose, the cars 43 advantageously each have a control unit, for example a microcontroller circuit designed as a control unit (in Fig. 4 not explicitly shown).

For each car 43 which has an adjacent first car in a first direction of travel, the distance from the first stop point 6 of this car to the second stop point 47 of the second car is determined. In addition, the distance from the second stop point 47 of this car to the first stop point 46 of the second car is determined for each car 43, which has an adjacent second car in the second direction of travel.

For example, the distance 48 from the upper stop point 46 of the car 43 'to the lower stop point 47 of the car 43 "is determined for the car 43', which has an adjacent car 43" in the direction of travel 44. For this purpose, the lower stop point 47 of the car 43 ″ is advantageously sent to a control unit (in Fig. 4 not explicitly shown) of the car 43 'transmitted. The determined distance 48 is positive in this example. With regard to the cars 43 'and 43 "there is therefore no risk of collision.

The car 43 'also has an adjacent car 43'"in the further direction of travel 45. Therefore, the distance 49 from the lower stop point 47 of the car 43 'to the upper stop point 46 of the car 43'" is also determined for the car 43 ' . For this purpose, the upper stop point 46 of the car 43 '''is advantageously sent to a control unit (in Fig. 4 not explicitly shown) of the car 43 'transmitted. The determined distance 49 is negative in this example, that is, the upper stop point 46 of the car 43 '"is above the lower stop point 47 of the car 43'. There is therefore a risk of collision with the cars 43 'and 43"'. Due to the negative distance 49 between the lower stop point 46 of the car 43 'and the upper stop point 47 of the car 43'", the elevator system is switched to a safety mode, in particular by activating the car-side brakes of these cars, preferably triggered by the respective cars 43 'and 43 '"associated control units.

Since only one stop point is transmitted to a car 43 from the two adjacent cars, the communication load in the method used is advantageously low.

For a further explanation of the stop points that are predicted for a car 43 according to a method according to the invention, see Fig. 5 Referenced. In Fig. 5 a car 43 is shown with a total car height 417 and an entry threshold 420.

For the one in the direction of travel 44 and in the direction of travel 45 (in Fig. 5 the direction of travel is represented symbolically by arrows 44, 45) movable car 43 is an example for each direction of travel 44, 45 Predicted stop point 46, 47 shown. The upper stop point 46 is shown for the direction of travel 44 and the lower stop point 47 for the direction of travel 45.

The upper stop point 46 indicates the point at which the car 43 with the upper car end 421, based on current operating parameters and assuming a worst-case scenario, can stop in the direction of travel 44 at the latest. The distance between the stop point 46 and the upper end of the car 421 results in the illustrated embodiment from the sum of an optionally definable minimum distance 415 to the car 43, which must not be undershot, and one from the current travel parameters assuming a worst-case scenario. Braking distance 418 calculated in scenarios. The stop points are calculated, for example, by means of an appropriately configured predictor model.

The lower stop point 47, on the other hand, indicates the point at which the car 43 with the lower car end 422, based on current operating parameters and assuming a worst-case scenario, can stop in the direction of travel 45 at the latest. The distance between the stop point 47 and the lower end of the car 422 results in the illustrated embodiment from the sum of an optionally predeterminable minimum distance 416 to the lower end of the car 422, which must not be undershot, and one from the current travel parameters assuming a worst case -Scenarios predicted braking distance 419.

The positions of the stop points vary depending on the current driving parameters. If the car is stationary, the stop points will move closer to the car. If the car travels upwards at high speed, that is to say in the direction of travel 44, the upper stop point will be higher up. In particular, even at very high speeds, the case may arise that the lower stop point 47 is determined to be at position 414, since a movement in the direction of travel 45 can be excluded even in the worst case scenario.

For each such in Fig. 5 Such an upper stop point and a lower stop point are predicted in each case. The distance between the upper stop point 46 of a car and the lower stop point 47 'or 47 "of an adjacent car above this car and the distance between the lower stop point 47 of this car and the upper stop point 46' or 46" of one below this car are calculated neighboring car determined. In the case of non-critical operation, the distances 48 are positive, since 47 "is greater than 46 or 47 is greater than 46". If the distance is negative, however, there is a risk of collision. Such a negative distance results when 46 is greater than 47 'or 46' is greater than 47. If such a negative distance is determined, the elevator installation is transferred to a safe operating state, in particular to a safety mode.

The exemplary embodiments shown in the figures and explained in connection with them serve to explain the invention and are not restrictive for it. For the sake of clarity, the exemplary embodiments explained are not shown true to scale in the figures.

Reference number:

1

Elevator system

2

Car

3

Shaft system

4th

Drive system

5

Landing door

6th

first direction of travel (symbolized by a single arrow)

7th

second direction of travel (symbolized by double arrow)

8th

shaft section comprising at least one shaft door as a functional unit of the shaft system

9

Transfer device as a functional unit of the shaft system

10

Security node

10 '

Security node

10 "

Security node

11

interface

12th

sensor

13th

sensor

14th

sensor

15th

Sensor for detecting the condition of the landing door

16

Security device

16 '

Safety device

17th

Security device

17 '

Security device

18th

Security device

18 '

Security device

19th

sensor

20th

sensor

21

sensor

26th

Transfer of data between the security nodes

27

internal transmission of data at a security node

28

Monitoring room

29

lower limit area of a shaft section (8) (symbolically represented by a line)

29 '

upper limit area of a shaft section (8) (symbolically represented by a line)

41

Elevator system

42

Shaft system

43

Car

43 '

Car

43 "

Car

43 "

Car

44

first direction of travel

45

second direction of travel

46

first stop point

46 '

first stop point

46 "

first stop point

47

second stop point

47 '

first stop point

47 "

first stop point

48

positive distance between predicted stop points

49

negative distance between predicted stop points

410

third direction of travel

411

fourth direction of travel

412

vertical shaft

413

Connection shaft

414

Extreme position for a possible stop point

415

Minimum distance to be observed from the cabin

416

Minimum distance to be observed from the cabin

417

Car height

418

predicted braking distance

419

predicted braking distance

420

Entry threshold

421

upper end of the car

422

lower end of the car

Claims (12)

1. Lift system (1) comprising a plurality of cars (2), a shaft system (3) enabling a circulation operation of the cars (2), at least one drive system for moving the cars (2) within the shaft system (3), and a safety system having a plurality of safety nodes (10), which is designed to transfer the lift system (1) into a safe operating state when an operating state of the lift system (1) deviating from the normal operation is established, wherein the cars (2), the shaft system (3) and the at least one drive system each form at least one functional unit, wherein the safety nodes (10) are each connected to at least one of the other safety nodes via at least one interface (11) for transmission of data, the safety nodes (10) each comprise at least one sensor (12, 15, 19) for detecting an operating parameter of the corresponding assigned functional unit (2, 8, 9), the safety nodes (10) each comprise at least one control unit, which is designed to evaluate the operating parameter detected by the at least one sensor (12, 15, 19) of the respective safety node (10) and to make a determination regarding an operating state deviating from the normal operation based on the data transmitted from the at least one other safety node (10), characterized in that at least one of the safety nodes (10) is assigned to each one of the functional units (2, 8, 9).
2. Lift system (1) according to Claim 1, characterized in that the at least one drive system is designed operable in a shaft section, such that the cars (2) can travel independently of each other in defined sections of the shaft system (3), wherein each of the defined sections is a functional unit (4) of the drive system, each of which is assigned to at least one of the safety nodes (10).
3. Lift system (1) according to either of the preceding claims, characterized in that the shaft system (3) comprises at least two vertically extending transport paths, along which the cars (2) can travel vertically, and at least two transfer mechanisms (9) for transfer of the cars (2) between the transport paths, wherein each of the transfer mechanisms (9) is a functional unit of the shaft system (3), each of which is assigned to at least one of the safety nodes (10).
4. Lift system (1) according to Claim 3, characterized in that the transport paths are rails, along which the cars (2) are movable by means of at least one linear drive as the drive system, and each rail is advantageously designed with at least one segment which can be rotated relative to the vertical transport path as the transfer mechanism (9), wherein these rotatable segments can be oriented relative to each other so that a car (2) of the lift system (1) can travel along the segments between the rails.
5. Lift system (1) according to one of the preceding claims, characterized in that the functional units (2, 8, 9) each have at least one securing mechanism (16, 17, 18), which can, by a triggering, transfer the respective functional unit (2, 8, 9) to a secure operating state and can be actuated for the triggering directly by the control unit of the securing node (10) assigned to the respective functional unit (2, 8, 9).
6. Lift system (1) according to one of the preceding claims, characterized in that a plurality of monitoring spaces (28) is defined for the shaft system (3), wherein each monitoring space (28) is assigned a plurality of functional units (2, 8, 9), wherein the safety nodes (10) of the functional units (2, 8, 9) located in a monitoring space (28) are connected by at least one interface (11) for the transmission of data.
7. Lift system (1) according to Claim 6, characterized in that the lift system (1) is designed to be partially deactivatable, such that individual functional units (2, 8, 9) or groups of functional units (2, 8, 9) are deactivatable, wherein the lift system (1) is further designed to continue in operation with non-deactivated functional units (2, 8, 9).
8. Lift system (1) according to one of the preceding claims, characterized in that in each case a section of the shaft system (3) having at least one shaft door (5) is a functional unit (8), to which is assigned a safety node (10').
9. Lift system (1) according to Claim 8, characterized in that the safety node (10') assigned to the section of the shaft system (3) having at least one shaft door (5) as a functional unit (8) comprises at least one sensor (15), which is designed to detect an operating state of this functional unit (8) deviating from the normal operation, wherein the safety system of the lift system (1) is designed to deactivate this functional unit (8) upon detecting such an operating state deviating from the normal operation, and to move the cars (2) of the lift system (1) only outside of this section of the shaft system (3) having the at least one shaft door (5).
10. Lift system (41) according to one of the preceding claims, characterized in that the control unit of a safety node (10) assigned to one car (43) as a functional unit is designed to predict a first stop point (46) for a first travel direction (44) of the car (43) in ongoing manner and to predict a second stop point (47) for a second travel direction (45) of the car (43) in ongoing manner, wherein the respective stop point (46, 47) indicates the position at which the car (43) can halt if need be in the respective travel direction (44, 45).
11. Lift system (1) according to Claim 10, characterized in that the safety node (10) assigned to one car (43') as a functional unit is designed to transmit the predicted first stop points (46) via the interface (11) in each case to at least the safety node (10) assigned to the neighboring car (43") in the first travel direction (44), and to transmit the predicted second stop points (47) via the interface (11) in each case to the safety node (10) assigned to the neighboring car (43"') in the second travel direction (45).
12. Lift system (1) according to Claim 11, characterized in that the control unit of a safety node (10) assigned to one car (43') as a functional unit is designed to determine the distance (48, 49) from the first stop point (46) of this car (43') to the second stop point (47) of the neighboring car (43") in the first travel direction (44) and to determine the distance (48, 49) from the second stop point (47) of this car (43') to the first stop point (46') of the neighboring car (43''') in the second travel direction (45), wherein the safety system transfers the lift system (1) to a secure operating state upon determining a negative distance (49).

Images