EP3704048A1

EP3704048A1 - Safety monitoring device for monitoring safety-relevant states in a person-transporting system, and method for operating same

Info

Publication number: EP3704048A1
Application number: EP18779406.0A
Authority: EP
Inventors: Eric Birrer
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2017-10-31
Filing date: 2018-10-05
Publication date: 2020-09-09
Anticipated expiration: 2038-10-05
Also published as: CN111295350B; CN111295350A; WO2019086205A1; US11618648B2; EP3704048B1; US20200346893A1

Abstract

The invention relates to a safety monitoring device (67) for monitoring safety-relevant states in a person-transporting system (1). Said device has: a first and a second double-contact relay (69, 71), both of which, controlled by a control voltage, switch a first working contact (77, 79) and a second working contact (81, 83) and a feedback contact (85, 87) synchronously with each other between an open and a closed relay state; and a first and a second controller (89, 91) for determining properties of the person-transporting system (1) which correlate with a safety-relevant state and for generating the control voltages for the first and second double-contact relays (69, 71) depending on the properties determined. A first safety monitoring switch assembly (93) for monitoring a first safety-relevant state and for correspondingly switching a first switching state in a safety monitoring chain (41) of the person-transporting device (1), and a second safety monitoring switch assembly (95) for monitoring a second safety-relevant state and for correspondingly switching a second switching state in the safety monitoring chain (41) of the person-transporting system (1) are formed by means of the two double-contact relays (69, 71) and the two controllers (89, 91). The first safety monitoring switch assembly (93) comprises the first working contact (77) of the first double-contact relay (69) and, connected in series with the latter, the first working contact (79) of the second double-contact relay (71). The second safety monitoring switch assembly (95) comprises the second working contact (81) of the first double-contact relay (69) and, connected in parallel with the latter, the second working contact (83) of the second double-contact relay (71).

Description

Safety monitoring device for monitoring safety-relevant conditions in a passenger conveyor system and method for operating the same

description

The present invention relates to a security monitoring device for monitoring security-relevant conditions in a passenger transport system. Furthermore, the invention relates to a passenger conveyor system with such a safety monitoring device. Moreover, the invention relates to a method for

Monitoring a functionality of such a security monitoring device.

Passenger conveyors in the form of elevators, escalators or moving walkways serve to transport persons within buildings. The passenger conveyor system is permanently installed in the building. In the case of an elevator, an elevator car can be moved vertically between different floors. In case of

Escalators or moving walkways can carry passengers standing on tread units along sloped or horizontal driveways.

In order to be able to ensure a safety of passengers, safety-relevant current conditions of quite a few of them should be within a passenger conveyor system

Components are monitored in order then, for example, then operate other components of the passenger conveyor system suitable and safe or to be able to control. In order to be able to monitor such safety-relevant states of components of the passenger conveyor system, sensors and / or switches are usually provided at the corresponding components or at different points of the passenger conveyor system. Signals from such sensors or switches can be made available to a control of the passenger conveyor system so that it can take into account the signals when controlling functions of the passenger conveyor system and thus can bring about safe operation of the passenger conveyor system.

Examples of safety devices for passenger conveyor systems and their operation are described inter alia in DE 19849238, CN 102190216, WO 2000/051929 and

WO 2017/008849 specified. Details of embodiments of the invention presented herein will be explained below using the example of a passenger conveyor in the form of a lift. However, features of the elevator may be analogous to others

Passenger conveyors such as escalators or moving walks are transmitted.

In a lift, a so-called safety monitoring chain is conventionally used to ensure safe operation of the elevator. The

Security monitoring chain includes a variety of sensors and / or switches, with the help of which information about current safety-related conditions of components of the elevator can be determined.

For example, a door switch is typically provided on a car door and on each of a plurality of shaft doors, which is closed as long as the respective door is closed. The several door switches are inside the

Safety monitoring chain connected in series so that the safety monitoring chain as a whole is closed only when each of the door switches is closed. An elevator control connected to the security monitoring chain may or may in this case relocate an elevator car within an elevator shaft only if the safety monitoring chain as a whole is closed and it can therefore be assumed that all the cabin and shaft doors are currently closed.

The security monitoring chain can additionally comprise further switches and / or sensors. For example, a so-called Kabinenendotendschalter (KNE switch) may be provided in the elevator, which is normally closed and which is operated opening, as soon as the elevator car beyond a permissible travel, for example, in the direction of a lift shaft ceiling or in the direction of

Elevator shaft floor is relocated. Alternatively, a sensor system may be provided, which allows the functionality of the KNE switch by using the sensor, a current position of the elevator car can be determined within the elevator shaft and can be detected when the elevator car is moved beyond the allowable travel and which then causes in that the security monitoring chain is interrupted. This can ensure that the security Monitoring chain is interrupted as soon as the elevator car leaves its permissible travel.

Furthermore, as an exception to a rule according to which the elevator car may never be moved, as long as the car door or one of the shaft doors is open, provision can be made in an elevator for opening such doors in predefined exceptional situations, while the elevator car is not stationary or to move the elevator car, although at least one door is open. For example, doors may already be desired to open just before the elevator car reaches and stops a destination position in this manner

Accelerate door opening operations and reduce dwell time at the target position. For this purpose, for example, be provided in parallel to the series-connected door switches a switchable connection, which can be temporarily closed for temporary bridging of the doors (UET switch) to open doors without interrupting the security monitoring chain. The UET

For example, the switch can be closed and thus the area of the safety monitoring chain comprising the door switches can be bypassed, as soon as it is e.g. is detected by means of a sensor that the elevator car is sufficiently close to a desired target position, i. for example less than 20cm or less than 10cm away from it.

A safety-relevant state can be detected directly with the aid of a switch and this switch can be integrated into the safety monitoring chain. Alternatively, the safety-relevant state can be monitored, for example with a sensor. In this case, the sensor system signals, which the

safety-relevant state, evaluate it with the aid of a controller arrangement in order then to be able to actuate a switch integrated in the safety monitoring chain in a suitable manner. For such an implementation, in particular relays can be used as switches integrated into the security monitoring chain, which can be switched in the desired manner by means of control voltages generated suitably by the controller arrangement. In order to be able to ensure sufficient security, usually both the controller arrangement and a relay arrangement is redundant. For example, the relay assembly includes two series-connected relays, both of which must be brought into closed states by the controller assembly so as to complete an associated switching state within the security monitoring chain.

An effort for implementing a security monitoring device can be considerable, in particular due to a large number of components and their interconnection.

There may be, inter alia, a need for a safety monitoring device in which such an expense is reduced. Furthermore, there may be a need for a passenger conveyor system equipped with such a safety monitoring device. In addition, there may be a need for a method by which to monitor the operability of such a safety monitoring device.

Such a need can be met by the subject matter of any of the independent claims. Advantageous embodiments are the dependent ones

Claims and the following description defined.

According to a first aspect of the invention, a security monitoring device for monitoring security-relevant states in one

Passenger conveyor proposed. The safety monitoring device has a first and a second double contact relay and a first and a second control he on. Both double contact relays are configured, in each case controlled by a control voltage, to switch a first normally open contact and a second normally open contact as well as a feedback contact synchronously between an open and a closed relay state. The two controls he are designed to determine each correlated with a safety-related state properties of the passenger conveyor system and to generate the control voltages for the first or the second double contact relay depending on the determined properties. Here are by means of the two double contact relays and the two controllers a first and a second safety monitoring switch arrangement is formed. The first

Safety monitoring switch arrangement is for monitoring a first safety-relevant state and for corresponding switching of a first

Switching state configured within a safety monitoring chain of passenger transport system. The second safety monitoring switch arrangement is configured to monitor a second safety-relevant state and to correspondingly switch a second switching state within the safety monitoring chain of the passenger conveyor system. In this case, the first safety monitoring switch arrangement comprises the first normally open contact of the first double contact relay and, connected in series therewith, the first normally open contact of the second double contact relay. The second safety monitoring switch arrangement comprises the second normally open contact of the first double contact relay and, connected in parallel therewith, the second normally open contact of the second double contact relay.

According to a second aspect of the invention, a passenger conveyor system is proposed which comprises a security monitoring device according to a

Embodiment of the first aspect of the invention.

According to a third aspect of the invention, a method for monitoring a functionality of a security monitoring device according to a

Embodiment of the first aspect of the invention proposed. The method comprises at least the following steps of the

(a) varying the rates generated by the first and second controllers

Control voltages such that alternately one of the first and the second

Double contact relay is briefly switched to its open relay state and back to its closed relay state and that always at least one of the first and second double contact relay is in its closed relay state, and

(b) monitoring whether the feedback contacts of the two double contact relays always indicate a relay state indicating the currently driven relay state.

Possible features and advantages of embodiments of the various aspects of the invention may be considered, inter alia, and without limiting the invention, as being based on the ideas and findings described below. As already mentioned in the introduction, conventional safety monitoring devices for passenger conveyor systems sometimes use safety monitoring switch arrangements in order to establish a safety-relevant state within the passenger car

Monitoring a passenger conveyor system, wherein a security monitoring device controller for determining correlated with the monitored condition properties within the passenger conveyor system and relays for opening or closing a contact within a security monitoring chain has.

Conventionally, in each case a safety monitoring switch arrangement with one or more own controllers and relays is provided for each safety-relevant state to be monitored. Especially for monitoring

In safety-critical states, two relays are connected in series in a redundant manner. Accordingly, at least one controller and one relay, but in many cases two controllers and two relays, must be provided for each safety-related condition to be monitored.

As a result, a number of relays to be provided in the passenger conveyor system can become large, which can be accompanied by significant provisioning and maintenance costs and corresponding costs.

In order to be able to reduce such expenses and costs, it is proposed to use double contact relays in a safety monitoring device instead of simple relays and to interconnect them in an advantageous manner and to be triggered by two controllers.

Similar to simple relays, a control voltage applied to the relay in a control circuit can be used to open or close the relay as a switch. For example, the control voltage may cause a current through a coil, causing the coil

Magnetic field generates, which attracts or repels an anchor. The armature moved in this way can then move arms of a working contact towards or away from each other. In a simple relay this is only a single

Normally open or closed. In a double contact relay, however, two working contacts simultaneously, ie synchronously with each other, moves open and closed by one and the same anchor. The double contact relay can thus not only a switch in a working circuit but two switches in two different working circuits controlled by the control voltage synchronized open or close each other.

A design effort and thus associated costs are only slightly higher in a double contact relay as a simple relay and are generally much lower than the corresponding cost and expense for two separate simple relay.

Similar to a simple relay can be supplemented with a

Double contact relay may be provided a so-called feedback contact, which is moved synchronously with the two working contacts. The feedback contact can be used, for example, to check whether the normally open contacts have been opened following the applied control voltage. Accordingly, it can be detected by monitoring the feedback contact, for example, if the double contact relay has a defect and no longer switches correctly. In particular, it can be recognized if adjacent arms of a work contact, for example, are unintentionally welded together or stick together and thus no longer open properly despite appropriately applied control voltage.

In the safety monitoring device proposed here, the two double contact relays provided therein can advantageously be connected in such a way that they form two safety monitoring switch arrangements, by means of which two different safety-relevant states can be monitored and associated switching states within the safety monitoring chain of the passenger conveyor system can be switched accordingly. In contrast to conventional safety monitoring devices, a desired redundancy can be achieved when switching the switching states without having to provide at least two separate relays for each switching state to be switched. Instead, the two double contact relays can be so in the safety monitoring chain of

Personenförderanlage be integrated, ie with other components of the Security monitoring chain be interconnected with that only two

Double contact relay all desired switching states within the

Security chain in response to the monitored two

safety-relevant states can be switched.

In order to monitor, for example, two different safety-relevant states and to be able to switch corresponding switching states within the safety monitoring chain in a redundant manner, it is therefore not necessary to use at least four relays, but only two double contact relays. Hereby a constructive as well as a costly effort can be significantly reduced.

In order to allow such a saving of relays, the first normally open contact of the first is to form the first safety monitoring switch assembly

Double contact relay connected in series with the first normally open contact of the second double contact relay. To form the second safety monitoring switch arrangement, the second normally open contact of the first double contact relay and the second normally open contact of the second double contact relay are connected in parallel with one another.

By suitable activation of each of the two double contact relays, different switching states can be generated in the desired manner by such an interconnection in the two safety monitoring switch arrangements. For example, the first safety monitoring switch arrangement is only completely closed when both series-connected first working contacts of the two double contact relays are closed, i. when both control he the two double contact relays to close. In contrast to this, the second safety monitoring switch arrangement is already closed when only one of the second normally open contacts connected in parallel to one another is closed, i. when at least one of the double contact relays is driven by one of the controllers to close, and only opened when both second normally open contacts of the two

Double contact relays are opened. According to one embodiment, the security monitoring device is arranged to take into account that the monitoring of the first safety-relevant state requires a higher safety integrity level than the monitoring of the second safety-relevant state.

In other words, the special circuit proposed herein of the two double contact relays can be advantageously used in particular in a constellation in which two different safety-related conditions are to be monitored by means of the safety monitoring device within the passenger conveyor, which differ significantly in terms of their safety integrity level. The first safety monitoring switch arrangement with the two series-connected first working contacts of the first and second double contact relay can guarantee a higher level of safety integrity than the second safety monitoring switch arrangement in which the two second working contacts of both double contact relays are connected in parallel.

Under a security integrity level, which is sometimes called

Safety Integrity Level (SIL) is a term used in the field of functional safety, such as that described in international standard IEC 62508 / IEC61511. On

Safety Integrity Level is used to assess electrical, electronic or programmable electronic systems for their reliability

Security features. The desired level, for example, results in safety-related design principles that must be adhered to in order to minimize the risk of malfunctions. In general, according to the international standard, four levels are distinguished from safety integrity levels SIL 1 to SIL4, with SIL4 representing the safest level.

In particular, according to one embodiment, the safety monitoring device can be set up to take into account that the monitoring of the second safety-relevant state requires a safety integrity level SIL1 and monitoring of the first safety-relevant state requires at least one safety-related state

Safety Integrity Level SIL2 required. In other words, the first safety monitoring switch arrangement used for monitoring the first safety-relevant state can be configured such that it fulfills its monitoring function to meet the higher requirements of a

Safety Integrity Level SIL2 or even SIL3 can perform accordingly, whereas the second safety monitoring switch assembly used to monitor the second safety-related condition can be configured so that their monitoring function only the minor requirements of

Safety integrity level SIL1.

According to one embodiment, the first safety-relevant state can specify whether parts of the safety monitoring chain which monitor closing states of doors of the passenger conveyor system may be temporarily short-circuited. In this case, by closing switching the first switching state, the parts of

Security monitoring chain, which closed states of doors of the

Monitor passenger conveyor system, then short-circuit temporarily.

In other words, the first safety-relevant state monitored by the first safety monitoring switch arrangement may contain information as to whether, for example, there are currently conditions in which the actual closed states of the car door and the shaft doors may be temporarily ignored and

Elevator cabin may be moved, for example, despite the car door or shaft door open. For example, such a safety-related condition may exist when the car is very close (e.g., <20 cm) at a target position, i. for example, at a floor stop, and the respective door may already be opened before the target position is actually reached. This can be detected, for example, by an analysis of the current position of the elevator car within the elevator shaft. In this case, the information about the current position of the car can be interpreted as indicating a safety-relevant state in which the closing states of the doors of the passenger conveyor may be temporarily ignored and thus parts of the safety monitoring chain which monitor these closed states may be temporarily short-circuited.

If the above condition has been detected, the first and second controllers can appropriately control the two double contact relays so that both double contact relays are in place pass closed relay state. The two first normally open contacts of the two double contact relays are then closed so that, overall, a closed state results for their series connection as part of the first safety monitoring switch arrangement. In this closed state, the first safety monitoring switch assembly may close a circuit that is parallel to the part of the safety monitoring chain that monitors the closing states of the doors of the personal request system, and thus may temporarily short-circuit the monitoring of the doors in the form of a UET contact such as in a bypass.

According to another embodiment, the second safety-relevant state can indicate whether an elevator car has been moved beyond a permissible travel range. In this case, the security monitoring chain can be interrupted by opening the second switching state.

In other words, the second safety-relevant state monitored by the second safety monitoring switch arrangement can include information about the current position of the elevator car, so that it is possible to determine whether the elevator car is currently within its permissible travel range, i. for example, between a highest permissible end position and a lowest permissible one

End position within the hoistway, or whether the elevator car has left, for example, due to a malfunction their allowable driving range and, for example, was moved beyond the upper allowable end position or below the lower allowable end position.

If this condition has been detected, the first and second controls can suitably control the two double contact relays so that both double contact relays switch to their open relay state. The two second working contacts of the two double contact relays are then both open, so that there is also an overall open state for the parallel connection in the context of the second safety monitoring switch arrangement. In this open state, the second safety monitoring switch arrangement, for example, if it is connected in series with a remainder of the safety monitoring chain of the passenger conveyor, act as an open switch and thus the safety monitoring chain temporarily interrupt. As a result, operation of the elevator or, in particular, a further method of the elevator car beyond a respective end position is prevented.

According to a further embodiment, the security monitoring device furthermore has a plurality of series-connected third security monitoring switch arrangements for monitoring third safety-relevant states.

In other words, in addition to the first and second safety monitoring switch arrangements already discussed, which implement, for example, tasks of a UET switch and a KNE switch, the safety monitoring apparatus may comprise further safety monitor switch arrangements by means of which other tasks or functionalities can be implemented.

These third safety monitoring switch arrangements can be, for example, door switches with which closing states of elevator doors, in particular of the car door or one of the shaft doors, can be monitored. The several third safety monitoring switch arrangements can be connected in series, so that they can form part of the safety monitoring chain of the passenger conveyor systems. In the mentioned example of an implementation of the third safety monitoring switch arrangements, each as a door switch, it is ensured by a series connection that all doors, and thus all door switches, must be closed so that the said part of the safety monitoring chain as a whole is closed.

In such an embodiment of the safety monitoring device, the first safety monitoring switch arrangement can be connected in parallel to the series of third safety monitoring switch arrangements and the second

Safety monitoring switch assembly in series with the series of third

Safety monitoring switch assemblies be interconnected.

In other words, the first safety monitoring switch arrangement with its two series-connected first working contacts of the two double contact relays can be connected in parallel to the series circuit of third safety monitoring switch arrangements. As soon as both first working contacts are closed in this case, ie As soon as the first switching state is closed, the first safety monitoring switch arrangement thus forms one of the series circuit of third

Safety monitoring switch assemblies parallel bypass and can thus bridge this series circuit controlled as a UET switch.

The second safety monitoring switch arrangement with its two parallel-connected second working contacts of the two double contact relays can be connected in series with the series circuit of third safety monitoring switch arrangements. As long as at least one of the double contact relay is closed, in this case also the second switching state remains closed, so that in total of the third

Safety monitoring switch arrangements and the second

Safety switch monitoring arrangement formed part of the safety chain remains closed. This part of the safety chain is only opened when both double contact relays are open at the same time and thus also the second switching state is opened. The second safety monitoring switch arrangement can thus, like a KNE switch, temporarily interrupt a safety chain.

According to one embodiment, the first and the second control can each be designed as a safety-related programmable logic controller.

A programmable logic controller (SPS)

Controller - PLC) is a device that can usually be used to control or regulate a plant or a machine. Programmable controllers are increasingly replacing conventional hardwired, interconnected programmable controllers. It can be used to advantage that a PLC can be programmed on a digital basis and thus adapted to different tasks. In the simplest case, a PLC has inputs, outputs, an operating system and optionally an interface via which a user program can be loaded. The user program can program how the outputs in

Depend on the inputs to be switched so that the plant or machine works in a desired manner. The operating system can be kept up-to-date, for example, in the form of firmware. In addition to its core tasks of control, a PLC can also perform other tasks such as, for example, visualization of data, design as Take over interface, for example in the form of a man-machine interface, an alarm and / or recording of operational messages (data logging).

A safety-related PLC (SSPS) is a special implementation of a PLC. A safety-related PLC has a largely redundant configuration of its components and is usually designed so that the safety-related PLC can be switched off in the event of a component failure Conflict between redundant components is converted into a predetermined safe state.

Regarding the architecture, entrances and exits differ

safety-related PLC significantly from conventional PLC. For example, a conventional PLC typically has a microprocessor executing a program, a non-volatile memory for storing the program, a volatile memory (RAM) for performing calculations, ports for data communication, and I / O ports, for example. to detect and control a plant or machine. By contrast, a safety-oriented PLC generally has at least two of the respective components which continuously monitor one another or are monitored by a so-called watch dog circuit.

The inputs of a conventional PLC typically do not have means for testing a functionality of an input circuit. In contrast, safety-related PLCs usually have an internal output circuit, which is assigned to each input and by means of which the respective input can be tested.

Similarly, conventional PLCs typically have only one

Output switching device, whereas safety-related PLC generally have a test point behind each of two safety switches, which are arranged behind a Ausgabetreib he, and a third test point downstream of the output driver. Each of two safety switches is generally controlled by a single microprocessor. If a mistake in one of the two

Safety switch, for example due to a fault in the switch or the Microprocessor or detected at the test point downstream of the output driver, the operating system of the safety-related PLC will automatically detect a system error and the safety-related PLC is transferred to a predefined state in which a system can be properly shut down, for example.

Due to the design of the two controllers as safety-related PLCs, these are on the one hand suitable for being able to be adapted to different elevator types, for example as retrofit devices. On the other hand, the controllers or the security monitoring device equipped therewith can guarantee a high degree of security for the passenger conveyor systems equipped therewith.

According to an embodiment, the security monitoring device may be configured to execute or control a method according to an embodiment of the third aspect of the invention.

For this purpose, for example, the first and second controllers of the safety monitoring device, which are designed as PLCs or safety-related PLCs, can be programmed in such a way that the control voltages generated by them are varied such that at least one of the two double contact relays is always in its closed relay state, but alternately one of the two both

Double contact relay is briefly put into its open relay state and back to its closed relay state. It is always monitored whether the associated feedback contact of a double contact relay follows the generated control voltage, i. whether the feedback contact indicates that relay state that was actually actuated by the associated controller, or whether, for example due to a malfunction within the double contact relay, an actual relay state does not correspond to the desired triggered relay state.

According to one embodiment of the method, the two controllers can be used in the event that the feedback contacts of the two double contact relays do not indicate a relay state indicating the currently actuated relay state

Generate control voltages such that both the first and the second Double contact relays are switched to their open relay state.

In other words, in the event that by monitoring the feedback contacts, it can be concluded that at least one of the double contact relays does not correctly follow the control effected by the respective controller and thus assume a defect within the double contact relay, a response can be interpreted that both control he belongs to each of them

Double contact relay to switch to its open relay state. In this way, the passenger conveyor system can be transferred to a largely secure state even in the event of a defect in the double contact relay of their safety monitoring device.

According to one embodiment, in the proposed method, each of the two controllers monitors the feedback contacts of each of the two double contact relays.

In other words, the first and second controllers should not just be the

Feedback contacts of their respective assigned, i. controlled by you,

Monitor double contact relays. Instead, each controller should monitor the feedback contact of its associated dual contact relay as well as the feedback contact of the other double contact relay. In this way, a redundancy can be created, which further increases the security of the security monitoring device and, in particular, drastically increases the likelihood that malfunctions will be recognized correctly at their double contact relays.

According to one embodiment, the proposed method is carried out before, during or after each individual journey of the passenger transport installation.

In other words, the process by which the functionality of the

Safety monitoring device is tested, in principle, at any time or triggered by any events are executed. However, it is considered advantageous to carry out the method at least when a ride is performed by the passenger transport system. This can ensure that the functionality of the safety monitoring device is checked sufficiently frequently. It should be noted that some of the possible features and advantages of the invention herein with respect to different embodiments of the

Safety monitoring device on the one hand and a method for monitoring their operability on the other hand are described. One skilled in the art will recognize that the features may be suitably combined, adapted or replaced to provide further embodiments of the invention.

Hereinafter, embodiments of the invention will be described with reference to the accompanying drawings, wherein neither the drawings nor the

Description are to be construed as limiting the invention.

Fig. 1 shows a passenger transport system according to the invention.

Fig. 2 shows a security monitoring chain of an inventive

Passenger transportation system.

3 shows details of a security monitoring device according to the invention.

FIG. 4 a shows activated relay states and resulting switching states in the safety monitoring device according to the invention.

FIG. 4 b illustrates a variation of triggered relay states in the context of a method according to the invention for monitoring the functioning of a safety monitoring device.

The figures are only schematic and not to scale. The same reference numerals designate the same or gl cally acting features in the various figures.

Fig. 1 shows a passenger conveyor system 1 in the form of an elevator. The elevator comprises an elevator car 5 and a counterweight 7, which can be displaced vertically within a lift shaft 3 by means of belts 9 driven by a drive machine 11. It can also be a brake 12 for braking the prime mover 11 and the direct braking of the elevator car 5 may be provided. An operation of the engine 11 and / or the brake 12 is controlled by an elevator controller 13. The

Elevator controller 13 may e.g. the drive machine 1 1 controlled thereby supply electrical power from an electrical power source 15.

The elevator car 5 can be moved between different floors 17. At each floor 17 while a shaft door 19 is provided and to the elevator car 15, a car door 21 is provided.

In the passenger conveyor system 1, a plurality of safety monitoring switch arrangements 23 are provided by means of which safety-relevant conditions within the passenger conveyor system 1 can be monitored.

For example, door switches 25 are provided on each of the shaft doors 19 and on the car door 21, by means of which it can be monitored whether the respective shaft or cabin door 19, 21 is currently correctly closed or at least partially open. Further, in a pit area of the hoistway 3, a

Head presence switch 27 is provided, by means of which the presence and correct arrangement of a conductor 29 can be monitored. Both in the case of the door switch 25 and the conductor presence switch 27 Sicherheitsüberwachungs- switch assemblies 23 may be provided, for example, as a simple, mechanically operated switch.

In addition, the passenger conveyor 1 can also be constructed more complex

Safety monitoring switch assemblies 23 have. For example, by means of a magnetic tape 33 extending vertically along the elevator shaft 3 and a magnetic tape reader 31 attached to the elevator car 5, an absolute position sensor 35 can be formed by means of which information about a current position of the elevator car 5 within the elevator shaft 3 can be obtained. Based on this information, safety-relevant states can then be monitored.

For example, it can be detected whether the elevator car 5 is currently opposite or at least near one of the shaft doors 19 and thus the car door 21 and / or the opposite shaft door 19 may be opened. Furthermore, based on this information, it is possible to detect whether the elevator car 5 is within an allowable travel or travel within the elevator shaft 3 or whether it has been inadvertently moved out of this permissible movement range 37.

Data or signals can be transmitted from the various safety monitoring switch arrangements 23 to a safety monitoring device 39, for example by wire or wireless.

In particular, several of the safety monitoring switch arrangements 23 can be connected to one another, in particular connected to one another in series, in order to form parts of a safety monitoring chain 41. For example, the door switch 25 and the conductor presence switch 27 can be connected in series, so that the part of the security monitoring chain 41 formed thereby is closed as a whole only when all the door switch 25 and the conductor presence switch 27 are closed.

The security monitoring device 39 may communicate with or be part of the elevator controller 13 and may affect functions of the elevator controller 13. In particular, the safety monitoring device 39 can actuate one or more main relay arrangements 43, for example one

To be able to interrupt power supply between the elevator control 13 and the drive machine 11 and / or to activate the brake 12 for braking the elevator car 5 or to be able to solve this.

Fig. 2 illustrates details of a security monitoring chain 41. Several

Safety monitor switch assemblies 23 (also referred to as "third safety monitor switch assemblies" hereinafter) in the form of door switches 25 and other safety monitor switch assemblies 23, for example in the form of a conductor presence switch 27 or the like, are connected in series.

One of these further safety monitoring switch arrangements 23 acts as Kabinenennotendschalter 28 (K E switch). This Kabinenennotendschalter 28 is opened when the elevator car 5 is moved beyond its allowable travel range 37 addition.

The part of the security monitoring chain 41 formed by the series-connected safety monitoring switch arrangements 23 is connected in series with the main relay arrangement 43. The main relay arrangement 43 comprises a first main double contact relay 45 having a coil 49, a first make contact 53, a second make contact 57 and a feedback contact 61 and a second main double contact relay 47 with a coil 51, a first normally open contact 55, a second normally open contact 59 and a feedback contact 63. The main relay assembly 43 is hereby normal, ie when the coils 49, 51 are not energized, opened. Accordingly, the main relay assembly 43 includes an electrical connection between the power supplying means serially through the first normally open contacts 53, 55 of the first and second main double contact relays 45, 47

Elevator control 13 and the prime mover 11 only when their two coils 49, 51 are energized due to a completely closed security monitoring chain 41. Similarly, the brake 12 is energized and thus released only when the main relay assembly 43 closes a connection between a power source and the brake 12 due to a fully closed safety monitoring chain 41.

In order to allow the car door 21 and / or one of the hoistway doors 19 to be opened under predetermined conditions, although the engine 11 displaces the elevator car 5, a so-called UET switch 65 is provided in parallel to the series connection of door switches 25. This UET switch 65 also forms a safety monitor switch assembly 23 and may only be closed when the predetermined conditions are met, i.

For example, if the elevator car 5 has already approached a target floor position to within a few centimeters and is already to be started to open the doors 19, 21 before the elevator car 5 has finally stopped at the destination floor position. By closing the UET switch 65, the part of the security monitoring chain 41 formed by the door switches 25 is thus temporarily bridged. In order to meet the high safety requirements applicable to passenger conveyor systems 1, both the KNE switch 28 and the UET switch 65 have so far been implemented in a redundant manner, each with two simple relays. For example, in the case of the UET switch 65, the two simple relays were connected in series so that a switching state of the UET switch 65 was closed only when both relays were closed at the same time, ie, both relays were in their closed relay state.

However, accordingly, four simple relays had to be used for the two functions to be implemented with the KNE switch 28 and the UET switch 65.

FIG. 3 illustrates a security monitoring device 67 according to the invention, which can be implemented as forming part of a security monitoring chain 41 of a passenger conveyor system 1 in order to detect security-relevant conditions in the

Monitor passenger conveyor 1. The safety monitoring device 67 can in particular implement the functions of a KNE switch 28 and a UET switch 65.

The safety monitoring device 67 comprises a first double contact relay 69 and a second double contact relay 71. Both double contact relays 69, 71 are designed as normally opened relays ("normally opened") and each have coils 73, 75 which, when supplied with a control voltage, Each of the double contact relays 69, 71 also has a feedback contact 85, 87. In each of the double contact relays 69, 71, that is, the respective coil 73, 75 is displaced, ie opens and closes, the respective contactors 77, 79 first and second normally-open contacts 77, 79, 81, 83 and their feedback contact 85, 87 in synchronism with each other and can thus be switched controlled by the control voltage in an open or closed relay state.

The safety monitoring device 67 further comprises a first and a second control he 89, 91. The two control he 89, 91 are designed to

Characteristics of the passenger conveyor 1 to determine that with a

safety-related condition correlate, and then appropriate control voltages for generate the first and the second double contact relay 69, 71 as a function of the determined properties. The two controls he 89, 91 can communicate with each other or control each other. In particular, the control he 89, 91 may be designed as safety-related programmable logic controllers (SSPS).

In the example shown receive the two control he 89, 91 of the

Absolute position sensor 35 information about the current position of the elevator car 5 within the elevator shaft 3. From this information, the controllers 89, 91 on the one hand derive whether the elevator car 5 currently within the permissible

Traversing 37 is or whether she has left this. Depending on which of these two cases applies, the controllers 89, 91 can generate different control voltages for the two double contact relays 69, 71 in order to emulate the function of a KNE switch 28 with the safety monitoring device 67. On the other hand, the inspectors 89, 91 can infer from the information whether the elevator car 5 is currently sufficiently close to a target floor position so that it seems permissible to temporarily bridge the part of the security surveillance chain 41 formed by the door switches 25 with the security monitoring device 67 to emulate the function of a UET switch.

The safety monitoring device 67 forms, with its double contact relays 69, 71 and its controllers 89, 91, safety monitoring switch arrangements 23 in the form of a first and a second safety monitoring switch arrangement 93, 95.

The first safety monitoring switch arrangement 93 comprises the first working contact 77 of the first double contact relay 69 and the first normally open contact 79 of the second double contact relay 71, which are connected to one another in series. With this first safety monitoring switch assembly 93 emulates the

Safety monitoring devices 67, the function of the UET switch at a first output 97th

The second safety monitoring switch arrangement 95 comprises the second working contact 81 of the first double contact relay 69 and the second working contact 83 of the second double contact relay 71, which are connected in parallel. With this second safety monitoring switch assembly 95 emulates the

Safety monitoring devices 67 the function of the KNE switch at a second output 99.

An actually assumed relay state of each of the double contact relays 69, 71 can be determined by the controllers 89, 91 via the respective feedback contact 85, 87 of the associated double contact relay 69, 71. As a result, it can be monitored whether a relay state controlled by a controller 89, 91 is in the assigned state

Double contact relay 69, 71 has led to the adoption of the desired relay state or whether a defect has prevented this. Each of the two feedback contacts 85, 87 can transmit a feedback signal to each of the two controllers 89, 91.

FIG. 4a illustrates in tabular form possible control voltages K1, K2 generated by the two controllers 89, 91 for controlling the first and second double contact relays 69, 71 in an open relay state (K1 = "0" or K2 = "0", ie no control voltage) the coil applied) or a closed relay state (Kl = "1" or K2 = "1", ie control voltage applied to the coil) and resulting switching states UET, KNE at the two outputs 97, 99 of the safety monitoring device 67 formed first output 97 for implementing the function of the UET switch 65 and the second output 99 is designed to implement the function of the KNE switch 28.

It can be seen that the UET switching state emulated by the first safety monitoring switch arrangement 93 is closed exclusively ("closed") when both double contact relays 69, 71 have been triggered by the two controllers 89, 91 in their closed relay state ("1") , On the other hand, that of the second

Safety monitoring switch assembly 95 emulated KNE switching state only open ("open") when both double contact relays 69, 71 were driven by the two control 89, 91 in their open relay state ("0").

With the presented safety monitoring device 67, the function of the UET switch 65 via the first safety monitoring switch assembly 93 with a required for this very high safety integrity level of SIL2 or even Implement SIL3. The function of the KNE switch 28 can be implemented via the second safety monitoring switch arrangement 95 at least with the safety integrity level of SIL1 sufficient for this purpose.

Finally, with reference to Fig. 4b is an imple mentation form of a

Explained method, by means of which a functionality of the safety monitoring device 67 can be monitored.

At regular intervals, i.e., for example, periodically, or triggered by certain events, such as the beginning or the end of a journey, the normal operation of the safety monitoring devices 67, in which the safety-relevant conditions in the passenger conveyor 1 are monitored, is briefly interrupted. Instead, the control voltages generated by the first and second controllers 89, 91 are varied such that on the one hand alternately one of the two double contact relays 69, 71 briefly in its open relay state (Kx = "0") and back to its closed relay state (Kx = " 1 ") is switched, and on the other hand always at least one of the two double contact relays 69, 71 is in its closed relay state.

Through such a variation of the control voltages, on the one hand it can be achieved that each of the two double contact relays 69, 71 is actuated at least once for opening and subsequent closing. On the other hand, it is ensured that although the first safety monitoring switch arrangement 93 effecting the UET function is briefly opened and closed again, the second safety monitoring switch arrangement 95 effecting the KNE function always remains closed. Thus, the entire security monitoring chain 41 remains during this

Variation of the control voltages always closed.

While the method described is carried out, it is not only possible to vary the control voltages by means of the control means 89, 91, for example, but also to monitor which actual relay state the control unit is

Specify feedback contacts 85, 87 of both double contact relays 69, 71. As long as the double contact relays 69, 71 are functioning properly, the one of the

Feedback contacts 85, 87 Feedback status confirmed with the control 89, 91 controlled relay state match. If this no longer applies at a time to, a defect in one of the double contact relays 69, 71 can be assumed. This can be effected for example by the fact that arms of one of the working contacts 77, 79, 81, 83 were glued or welded together.

For this case it can be provided that both control he 89, 91 generate control voltages such that both the first and the second double contact relay 69, 71 are switched to their open relay state. This can ensure that at least the extremely safety-critical UET function of the first safety monitoring switch arrangement 93 is reliably switched to its open state, so that a dangerous procedure of the elevator car 5 with open doors 19, 21 is avoided in any case.

With the safety monitoring device 67 described herein or the

Method for monitoring their operability can be opened for the suitably equipped passenger conveyor 1 the possibility of cost reduction, since only two double contact relays instead of conventionally four simple relays are needed to implement them. Furthermore, overall a higher reliability can be achieved, since only two instead of four safe relays are needed. Also a complexity of an electronic circuit for the

Safety monitoring device 67 may be simpler than conventional ones

Devices fail because fewer components need to be controlled.

Finally, it should be noted that terms such as "comprising,""comprising," etc., do not exclude other elements or steps, and terms such as "a" or "an" do not exclude a variety. It should also be appreciated that features or steps described with reference to any of the above embodiments may also be used in combination with other features or steps of other embodiments described above. Reference signs in the claims are not to be considered as limiting. LIST OF REFERENCE NUMBERS

1 passenger conveyor

3 elevator shaft

5 elevator car

7 counterweight

9 straps

11 prime mover

12 brake

13 elevator control

15 power source

17 floor

19 shaft door

21 cabin door

23 safety monitoring switch arrangements

25 door switch

27 conductor presence switch

28 Cabin end limit switch (KNE switch)

29 conductors

31 magnetic tape reader

33 magnetic tape

35 absolute position sensor

37 permissible travel range

39 security monitoring device

41 security chain

43 Main relay arrangement

45 first main double contact relay

47 second main double contact relay

49 Coil of the first main double contact relay

51 Coil of the second main double contact relay

53 first working contact of the first main double contact relay

55 first working contact of the second main double contact relay

57 second working contact of the first main double contact relay

59 second normally open contact of the second main double contact relay 61 Feedback contact of the first main double contact relay

63 Feedback contact of the second main double contact relay

65 door override switch (UET switch)

67 Security monitoring device

69 first double contact relay

71 second double contact relay

73 Coil of the first double contact relay

75 Coil of the second double contact relay

77 first contact of the first double contact relay

79 first contact of the second double contact relay

81 second contact of the first double contact relay

83 second normally open contact of the second double contact relay

85 Feedback contact of the first double contact relay

87 Feedback contact of the second double contact relay

89 first controller

91 second controller

93 first safety monitoring switch arrangement

95 second safety monitoring switch arrangement

97 first output for UET function

99 second output for KNE function

Claims

Patent claims

A security monitoring device (67) for monitoring

safety-relevant conditions in a passenger conveyor system (1), comprising:

a first and a second double contact relay (69, 71), both of which are controlled by a control voltage, a first make contact (77, 79) and a second make contact (81, 83) and a feedback contact (85, 87) synchronous with each other between an open and switch to a closed relay state;

- A first and a second controller (89, 91) each for determining correlate with a safety-related state properties of the passenger conveyor system (1) and for generating the control voltages for the first and the second

Double contact relays (69, 71) depending on the determined characteristics;

wherein by means of the two double contact relays (69, 71) and the two controllers (89, 91) a first safety monitoring switch arrangement (93) for monitoring a first safety-relevant state and for corresponding switching of a first

Switching state within a security monitoring chain (41) of

Passenger conveyor system (1) and a second safety monitoring switch arrangement (95) for monitoring a second safety-relevant state and for corresponding switching of a second switching state within the

Safety monitoring chain (41) of the passenger conveyor (1) are formed;

wherein the first safety monitoring switch assembly (93) is the first

Normally open contact (77) of the first double contact relay (69) and connected in series therewith comprises the first normally open contact (79) of the second double contact relay (71); and wherein the second safety monitoring switch assembly (95) is the second

Working contact (81) of the first double contact relay (69) and connected in parallel to the second working contact (83) of the second double contact relay (71).

2. The security monitoring device of claim 1, wherein monitoring the first safety-relevant state requires a higher safety integrity level than monitoring the second safety-relevant state.

3. Security monitoring device according to one of the preceding claims, wherein the monitoring of the second safety-relevant state a

Safety Integrity Level SIL1 requires and monitoring the first one safety-relevant state requires at least one safety integrity level SIL2.

4. Security monitoring device according to one of the preceding claims, wherein the first safety-relevant state indicates whether parts of

Safety monitoring chain (41), which closing conditions of doors (19, 21) of the passenger conveyor system (1) monitor, may be short-circuited temporarily and wherein by closing switching the first switching state, the parts of the

Safety monitoring chain (41), which monitor closing conditions of doors (19, 21) of the passenger conveyor system (1) are temporarily short-circuited.

5. Safety monitoring device according to one of the preceding claims, wherein the second safety-relevant state indicates whether an elevator car (5) has been moved beyond an allowable travel range (37), and wherein by opening switching the second switching state, the safety monitoring chain (41) is interrupted.

A security guard according to any one of the preceding claims, further comprising a plurality of third connected in series

Safety monitoring switch arrangements (23) for monitoring third safety-relevant conditions.

7. Security monitoring device according to claim 6, wherein the first

Safety monitoring switch assembly (93) in parallel to the series of third safety monitoring switch assemblies (23) is connected and wherein the second safety monitoring switch assembly (95) in series with the series of third safety monitoring switch assemblies (23) is connected.

8. Security monitoring device according to one of the preceding claims, wherein the first and the second controller (89, 91) are each formed as a safety-oriented programmable logic controller.

Safety monitoring device according to one of the preceding claims, i the safety monitoring device (67) adapted to a method according to any one of claims 11 to 14 or to control.

10. Passenger conveyor system (1) with a safety monitoring device (67) according to one of claims 1 to 9.

11. A method for monitoring a functionality of a

A security monitoring device (67) according to any one of claims 1 to 9, wherein the method comprises:

Varying the generated by the first and the second controller (89, 91)

Control voltages such that alternately one of the first and the second

Double contact relay (69, 71) is briefly switched to its open relay state and back to its closed relay state and that always at least one of the first and the second double contact relay (69, 71) is in its closed relay state, and

Monitoring whether the feedback contacts (85, 87) of the two double contact relays (69, 71) always indicate a relay state indicating the currently activated relay state.

12. The method of claim 11, wherein for a case where the feedback contacts (85, 87) of the two double contact relays (69, 71) do not indicate a relay state indicating the currently driven relay state, the two controllers (89, 91) generate control voltages such that both the first and the second

Double contact relays (69, 71) are switched to their open relay state.

A method according to any one of the preceding claims 11 to 12, wherein each of the two controllers (89, 91) comprises the feedback contacts (85, 87) of each of the two

Double contact relay (69, 71) monitored.

14. The method according to any one of the preceding claims 11 to 13, wherein the method before, during or after each trip of the passenger transport system (1) is performed.