EP3704048B1 - Safety monitoring device for monitoring of safety conditions in a device for transporting people and method for operating the same - Google Patents

Description

The present invention relates to a safety monitoring device for monitoring safety-relevant conditions in a passenger conveyor system. The invention also relates to a passenger conveyor system with such a safety monitoring device. The invention also relates to a method for monitoring the functionality of such a safety monitoring device. Passenger conveyor systems in the form of elevators, escalators or moving walks are used to move people within buildings. The passenger conveyor system is permanently installed in the structure. In the case of an elevator, an elevator car can be shifted vertically between different floors. In the case of escalators or moving walks, passengers can be transported standing on step units along inclined or horizontal driveways.

In order to be able to guarantee the safety of passengers, safety-relevant current states of several of them should be within a passenger conveyor system

Components are monitored in order, for example, to then operate or control other components of the passenger conveyor system in a suitable and safe manner. In order to be able to monitor such safety-relevant states of components of the passenger conveyor system, sensors and / or switches are usually provided on the corresponding components or at different points of the passenger conveyor system. Signals from such sensors or switches can be made available to a control of the passenger conveyor system so that it can take the signals into account when controlling functions of the passenger conveyor system and thus can bring about safe operation of the passenger conveyor system.

Examples of safety devices for passenger conveyor systems and their operation are in DE 19849238 , CN 102190216 , WO 2000/051929 , US 4977984 and

In the following, details of embodiments of the invention presented here are explained using the example of a passenger conveyor system in the form of an elevator.

Features of the elevator can, however, be transferred in an analogous manner to other passenger conveyor systems such as escalators or moving walks.

A so-called safety monitoring chain is conventionally used in an elevator in order to ensure safe operation of the elevator. The safety monitoring chain comprises a large number of sensors and / or switches, with the aid of which information about current safety-relevant states of components of the elevator can be determined.

For example, a door switch, which is closed as long as the respective door is closed, is typically provided on a car door and on each of a plurality of shaft doors. The multiple door switches are connected in series within the security monitoring chain, so that the security monitoring chain as a whole is only closed when each of the door switches is closed. An elevator control connected to the safety monitoring chain may or can, in this case, only move an elevator car within an elevator shaft if the safety monitoring chain is closed as a whole and it can therefore be assumed that all car and shaft doors are currently closed.

The safety monitoring chain can additionally comprise further switches and / or sensors. For example, a so-called car emergency limit switch (KNE switch) can be provided in the elevator, which is normally closed and which is actuated to open as soon as the elevator car is moved beyond a permissible travel path, for example in the direction of an elevator shaft ceiling or in the direction of an elevator shaft floor. Alternatively, a sensor system can be provided which enables the functionality of the KNE switch by using the sensor system to determine a current position of the elevator car within the elevator shaft and to recognize when the elevator car is moved beyond the permissible travel path and then causes it that the security surveillance chain is interrupted. This can be used to ensure that the security surveillance chain is interrupted as soon as the elevator car leaves its permissible travel path.

Furthermore, as an exception to a rule according to which the elevator car may never be moved as long as or as soon as the car door or one of the shaft doors is open, provisions can be provided in an elevator that make it possible to open such doors in predefined exceptional situations, while the elevator car is not standing still or moving the elevator car although at least one door is open. For example, it may be desired that doors begin to open shortly before the elevator car reaches a target position and stop there, in order to be able to accelerate door opening processes and to be able to reduce the length of stay at the target position. For this purpose, for example, a switchable connection can be provided in parallel to the door switches connected in series, which can be temporarily closed for temporarily bridging the doors (UET switch) in order to be able to open doors without interrupting the security monitoring chain. The UET switch can be closed, for example, and thus the area of the security monitoring chain comprising the door switch can be bridged as soon as a sensor system detects, for example, that the elevator car is sufficiently close to a desired target position, i.e. less than 20 cm or less than 10 cm from this is removed.

A safety-relevant state can be detected directly with the aid of a switch and this switch can be integrated into the safety monitoring chain.

Alternatively, the safety-relevant state can be monitored with a sensor system, for example. In this case, the sensor system can evaluate signals which reflect the safety-relevant state with the aid of a controller arrangement in order to then be able to operate a switch integrated in the safety monitoring chain in a suitable manner. For such an implementation, in particular relays can be used as switches integrated in the safety monitoring chain, which can be switched in the desired manner by means of control voltages suitably generated by the controller arrangement.

In order to be able to guarantee sufficient security in this case, both the controller arrangement and a relay arrangement are usually designed redundantly. For example, the relay arrangement comprises two relays connected in series, both of which have to be brought into closed states by the controller arrangement in order to complete an associated switching state within the safety monitoring chain.

The effort involved in implementing a safety monitoring device can be considerable, in particular due to the large number of components to be kept available and their interconnection.

Among other things, there may be a need for a safety monitoring device in which such an expense is reduced. Furthermore, there may be a need for a passenger conveyor system equipped with such a safety monitoring device. In addition, there may be a need for a method by means of which the functionality of such a safety monitoring device can be monitored.

Such a need can be met by the subject matter of one of the independent claims. Advantageous embodiments are defined in the dependent claims and the description below.

According to a first aspect of the invention, a safety monitoring device for monitoring safety-relevant conditions in a passenger conveyor system is proposed. The safety monitoring device has a first and a second double contact relay and a first and a second controller. Both double contact relays are designed to switch a first normally open contact and a second normally open contact, as well as a feedback contact, synchronously with one another between an open and a closed relay state, controlled by a control voltage. The two controllers are designed to determine properties of the passenger conveyor system that correlate with a safety-relevant state and to generate the control voltages for the first and the second double contact relay depending on the properties determined. Here, by means of the two double contact relays and the two controllers, a first and a second safety monitoring switch arrangement is formed. The first safety monitoring switch arrangement is designed for monitoring a first safety-relevant state and for correspondingly switching a first switching state within a safety monitoring chain of the passenger conveyor system. The second safety monitoring switch arrangement is designed for monitoring a second safety-relevant state and for correspondingly switching a second switching state within the safety monitoring chain of the passenger conveyor system. Here, the first safety monitoring switch arrangement comprises the first working contact of the first double contact relay and, connected in series with this, the first working contact of the second double contact relay. The second safety monitoring switch arrangement comprises the second working contact of the first double contact relay and, connected in parallel to this, the second working contact of the second double contact relay.

According to a second aspect of the invention, a passenger conveyor system is proposed which has a safety monitoring device according to an embodiment of the first aspect of the invention.

1. (a) Variierens der von dem ersten und dem zweiten Kontroller generierten Steuerspannungen derart, dass abwechselnd eines des ersten und des zweiten Doppelkontaktrelais kurzzeitig in seinen geöffneten Relaiszustand und wieder zurück in seinen geschlossenen Relaiszustand geschaltet wird und dass stets zumindest eines des ersten und des zweiten Doppelkontaktrelais in seinem geschlossenen Relaiszustand ist, und
2. (b) Überwachens, ob die Feedbackkontakte der beiden Doppelkontaktrelais stets einen dem aktuell angesteuerten Relaiszustand angebenden Relaiszustand angeben.

According to a third aspect of the invention, a method for monitoring the functionality of a safety monitoring device according to an embodiment of the first aspect of the invention is proposed. The method comprises at least the following steps of

1. (a) Varying the control voltages generated by the first and the second controller in such a way that alternately one of the first and the second double contact relay is briefly switched to its open relay state and back to its closed relay state and that at least one of the first and the second double contact relay is always switched is in its relay closed state, and
2. (b) Monitoring whether the feedback contacts of the two double contact relays always indicate a relay state indicating the currently activated relay state.

Possible features and advantages of embodiments of the various aspects of the invention can be viewed, inter alia and without restricting the invention, as being based on the ideas and findings described below.

As already mentioned in the introduction, with conventional safety monitoring devices for passenger conveyor systems, in some cases, security monitoring switch arrangements are used to monitor a safety-relevant state within the passenger conveyor system, with a safety monitoring device being a controller for determining properties within the passenger conveyor system that correlate with the condition to be monitored, as well as relays for opening or closing a contact has within a security surveillance chain.

A safety monitoring switch arrangement with one or more separate controllers and relays is conventionally provided for each safety-relevant state to be monitored. To monitor particularly safety-critical conditions, two relays are connected in series in a redundant manner. Accordingly, at least one controller and one relay, but in many cases two controllers and two relays, must be provided for each safety-relevant state to be monitored.

A number of relays to be kept available in the passenger conveyor system can hereby become large, which can be associated with significant preparation and maintenance expenditure and corresponding costs.

In order to be able to reduce such effort and costs, it is proposed to use double contact relays instead of simple relays in a safety monitoring device and to interconnect them in an advantageous manner and to have them controlled by two controllers.

Similar to simple relays, a control voltage applied to the relay in a control circuit can be used to open or close the relay in a controlled manner like a switch. The control voltage can for example cause a current through a coil, whereby the coil generates a magnetic field which attracts or repels an armature. The armature moved in this way can then move arms of a normally open contact towards one another or away from one another. In the case of a simple relay, only a single normally open contact is opened or closed.

With a double contact relay, on the other hand, two working contacts are opened or closed simultaneously, i.e. synchronously with one another, moved by one and the same armature. The double contact relay can therefore not only open or close one switch in one working circuit but two switches in two different working circuits controlled by the control voltage and synchronized with one another.

The construction effort and the costs associated therewith are only slightly higher in the case of a double contact relay than in the case of a simple relay and are generally significantly lower than the corresponding effort and costs for two separate simple relays.

Similar to a simple relay, a so-called feedback contact, which is moved synchronously with the two normally open contacts, can also be provided in a double contact relay. The feedback contact can be used, for example, to check whether the working contacts were actually opened following the applied control voltage. Accordingly, it can be recognized, for example by monitoring the feedback contact, when the double contact relay has a defect and no longer switches correctly. In particular, it can be recognized when adjacent arms of a normally open contact are, for example, inadvertently welded to one another or stick to one another and thus no longer open correctly despite a correspondingly applied control voltage.

In the safety monitoring device proposed here, the two double contact relays provided therein can advantageously be interconnected in such a way that they form two safety monitoring switch arrangements with the aid of which two different safety-relevant states can be monitored and associated switching states within the safety monitoring chain of the passenger conveyor system are switched accordingly. In contrast to conventional safety monitoring devices, a desired redundancy can be achieved when switching the switching states without at least two separate relays having to be provided for each switching state to be switched. Instead, the two double contact relays can be integrated into the safety monitoring chain of the passenger conveyor system, ie with other components of the Be connected to the safety monitoring chain so that all the desired switching states within the safety monitoring chain can be switched in response to the two monitored safety-relevant states with just two double contact relays.

In order, for example, to monitor two different safety-relevant states and to be able to switch corresponding switching states within the safety monitoring chain in a redundant manner, at least four relays are not required, as was previously the case, but only two double-contact relays. In this way, a design effort as well as a cost-related effort can be reduced significantly.

In order to enable relays to be saved in this way, the first working contact of the first double contact relay is connected in series with the first working contact of the second double contact relay to form the first safety monitoring switch arrangement. To form the second safety monitoring switch arrangement, the second working contact of the first double contact relay and the second working contact of the second double contact relay are connected in parallel to one another.

By suitably controlling each of the two double contact relays, various switching states can be generated in the desired manner by such an interconnection in the two safety monitoring switch arrangements. For example, the first safety monitoring switch arrangement is only completely closed when both of the series-connected first working contacts of the two double contact relays are closed, ie when both controllers control the two double contact relays to close. In contrast to this, the second safety monitoring switch arrangement is already closed when only one of the second working contacts connected in parallel is closed, that is, when at least one of the double contact relays is actuated to close by one of the controllers, and only opened when both of the second working contacts of the two Double contact relays are open.

According to one embodiment, the safety monitoring device is set up to take into account that the monitoring of the first safety-relevant state requires a higher safety integrity level than the monitoring of the second safety-relevant state.

In other words, the special circuit of the two double contact relays proposed here can be used particularly advantageously in a constellation in which two different safety-relevant states are to be monitored with the aid of the safety monitoring device within the passenger conveyor system, which are significantly different in terms of their safety integrity level. The first safety monitoring switch arrangement with the two series-connected first working contacts of the first and second double contact relay can ensure a higher level of safety integrity than the second safety monitoring switch arrangement in which the two second working contacts of both double contact relays are connected in parallel to one another.

A safety integrity level, which is also sometimes referred to as the safety requirement level or SIL (Safety Integrity Level), is a term from the field of functional safety, as described, for example, in the international standardization IEC 62508 / IEC61511. A safety integrity level is used to assess electrical, electronic or programmable electronic systems with regard to their reliability of safety functions. The desired level results in safety-related construction principles, for example, which must be adhered to in order to be able to minimize the risk of malfunctions. In general, according to the international standard, a distinction is made between four levels of safety integrity levels SIL 1 to SIL4, with SIL4 being the safest level.

In particular, according to one embodiment, the safety monitoring device can be set up to take into account that the monitoring of the second safety-relevant state requires a safety integrity level SIL1 and the monitoring of the first safety-relevant state requires at least one safety integrity level SIL2.

In other words, the first safety monitoring switch arrangement used to monitor the first safety-relevant state can be designed in such a way that it can perform its monitoring function in accordance with the higher requirements of a safety integrity level SIL2 or even SIL3, whereas the second safety monitoring switch arrangement used to monitor the second safety-relevant state can be designed in such a way that it can only perform its monitoring function in accordance with the lower requirements of a safety integrity level SIL1.

According to one embodiment, the first safety-relevant state can indicate whether parts of the safety monitoring chain which monitor the closed states of doors of the passenger conveyor system may be temporarily short-circuited. In this case, the parts of the safety monitoring chain which monitor the closed states of doors of the passenger conveyor system can then be temporarily short-circuited by closing switching of the first switching state.

In other words, the first safety-relevant state monitored by the first safety monitoring switch arrangement can contain information about whether, for example, there are currently conditions in which the actual closed states of the car door and shaft doors may be temporarily ignored and the elevator car may be moved, for example, despite the car door or shaft door being open . For example, such a safety-relevant state can exist when the car is very close (e.g. <20 cm) to a target position, i.e. for example at a floor stop, and the respective door may already be opened before the target position is actually reached. This can be recognized, for example, by analyzing the current position of the elevator car within the elevator shaft. In this case, the information about the current position of the car can be interpreted as indicating a safety-relevant state, in which the closed states of the doors of the passenger conveyor system can be temporarily ignored and thus parts of the safety monitoring chain that monitor these closed states can be temporarily short-circuited.

If the mentioned condition was recognized, the first and second controller can control the two double contact relays appropriately so that both double contact relays in their override closed relay state. The first two working contacts of the two double contact relays are then closed, so that a closed state also results overall for their series connection within the framework of the first safety monitoring switch arrangement. In this closed state, the first safety monitoring switch arrangement can close a circuit that runs parallel to the part of the safety monitoring chain that monitors the closed states of the doors of the passenger conveyor system, and can thus temporarily short-circuit the monitoring of the doors in the form of a UET contact as in a bypass.

According to a further embodiment, the second safety-relevant state can indicate whether an elevator car has been moved beyond a permissible movement range. In this case, the safety monitoring chain can be interrupted by opening the second switching state.

In other words, the second safety-relevant state monitored by the second safety monitoring switch arrangement can include information about the current position of the elevator car, so that it can be determined whether the elevator car is currently within its permissible travel range, that is, for example, between an uppermost permissible end position and a lowermost permissible end position inside the elevator shaft, or whether the elevator car has left its permissible travel range, for example due to a malfunction, and has been moved beyond the upper permissible end position or below the lower permissible end position, for example.

If this condition has been recognized, the first and second controller can control the two double contact relays appropriately so that both double contact relays switch to their open relay state. The two second working contacts of the two double contact relays are then both open, so that an open state also results overall for the parallel connection within the scope of the second safety monitoring switch arrangement. In this open state, the second safety monitoring switch arrangement, for example if it is connected in series with a remainder of the safety monitoring chain of the passenger conveyor system, can act like an open switch and thus the safety monitoring chain temporarily interrupt. As a result, operation of the elevator or, in particular, further movement of the elevator car beyond a respective end position is prevented.

According to a further embodiment, the safety monitoring device furthermore has a plurality of third safety monitoring switch arrangements connected in series for monitoring third safety-relevant states.

In other words, in addition to the first and second safety monitoring switch arrangements already discussed, which implement tasks of a UET switch and a KNE switch, for example, the safety monitoring device can have further safety monitoring switch arrangements with the aid of which other tasks or functionalities can be implemented.

These third safety monitoring switch arrangements can be door switches, for example, with the aid of which the closed states of elevator doors, in particular the car door or one of the shaft doors, can be monitored. The several third safety monitoring switch arrangements can be connected in series so that they can form part of the safety monitoring chain of the passenger conveyor systems. In the cited example of implementing the third safety monitoring switch arrangements as a door switch, a series connection ensures that all doors, and thus all door switches, must be closed so that the cited part of the security monitoring chain is closed as a whole.

In such a configuration of the safety monitoring device, the first safety monitoring switch arrangement can be connected in parallel to the series of third safety monitoring switch arrangements and the second safety monitoring switch arrangement can be connected in series with the series of third safety monitoring switch arrangements.

In other words, the first safety monitoring switch arrangement with its two series-connected first working contacts of the two double contact relays can be connected in parallel to the series circuit of third safety monitoring switch arrangements. As soon as both first working contacts are closed in this case, ie As soon as the first switching state is closed, the first safety monitoring switch arrangement thus forms a bypass running parallel to the series circuit comprising third safety monitoring switch arrangements and can thus bridge this series circuit in a controlled manner like a UET switch.

The second safety monitoring switch arrangement with its two second working contacts of the two double contact relays connected in parallel can be connected in series with the series connection of third safety monitoring switch arrangements. As long as at least one of the double contact relays is closed, the second switching state also remains closed, so that overall that part of the safety chain formed by the third safety monitoring switch arrangements and the second safety switch monitoring arrangement remains closed. This part of the safety chain is only opened when both double contact relays are open at the same time and the second switching state is therefore also open. The second safety monitoring switch arrangement can thus temporarily interrupt a safety chain in a controlled manner like a KNE switch.

According to one embodiment, the first and the second controller can each be designed as safety-related, programmable logic controllers.

A programmable logic controller (PLC) is a device that can usually be used to control or regulate a system or a machine. Programmable logic controllers are increasingly replacing conventional hard-wired, connection-programmed controllers. The fact that a PLC can be programmed on a digital basis and thus adapted to various tasks can be used to advantage. In the simplest case, a PLC has inputs, outputs, an operating system and, if necessary, an interface via which a user program can be loaded. The user program can program how the outputs are to be switched depending on the inputs, so that the system or machine functions in the desired manner. The operating system can be kept up-to-date in the form of firmware, for example. In addition to its core tasks of control or regulation, a PLC can also perform other tasks such as the visualization of data, a design as Interface, for example in the form of a man-machine interface, take over an alarm and / or a recording of operational messages (data logging).

A safety-related PLC (SSPS) is a special implementation of a PLC. A safety-related PLC has a largely redundant design of its components and is usually designed in such a way that the safety-related PLC in the event of a failure of a component or a Conflict between redundant components is transferred to a predetermined safe state.

In terms of architecture, inputs and outputs, safety-related PLCs differ significantly from conventional PLCs. For example, a conventional PLC typically has a microprocessor that executes a program, non-volatile memory for storing the program, volatile memory (RAM) for performing calculations, ports for data communication and I / O connections for to detect and control a system or machine. A safety-related PLC, on the other hand, generally has at least two of the respective components which continuously monitor each other or are monitored by what is known as a watch dog circuit.

The inputs of a conventional PLC typically do not have any means for testing the functionality of an input circuit. In contrast to this, safety-related PLCs usually have an internal output circuit that is assigned to each input and with which the respective input can be tested.

Similarly, conventional PLCs typically have only one output switching device, whereas safety-related PLCs generally have a test point after each of two safety switches located after an output driver and a third test point downstream of the output driver. Each of two safety switches are generally controlled by a single microprocessor. If a fault in one of the two safety switches is due, for example, to a fault in the switch or the Microprocessor or at the test point downstream of the output driver is detected, the operating system of the safety-related PLC will automatically detect a system error and the safety-related PLC is transferred to a predefined state in which a system can be shut down properly, for example.

Because the two controllers are designed as safety-related PLCs, they are suitable, on the one hand, for being able to be adapted to different elevator types as retrofit devices, for example. On the other hand, the controllers or the safety monitoring device equipped with them can guarantee a high level of safety for the passenger conveyor systems equipped with them.

According to one embodiment, the security monitoring device can be set up to execute or control a method according to an embodiment of the third aspect of the invention.

For this purpose, for example, the first and second controllers of the safety monitoring device, which are designed as PLCs or safety-related PLCs, can be programmed in such a way that the control voltages generated by them are varied in such a way that at least one of the two double contact relays is always in its closed relay state, but one of the two double contact relays is briefly put into its open relay state and back into its closed relay state. It is always monitored whether the associated feedback contact of a double contact relay follows the generated control voltage, i.e. whether the feedback contact indicates the relay state that was actually controlled by the associated controller, or whether, for example, due to a malfunction within the double contact relay, an actual relay state does not correspond to the desired controlled relay state is equivalent to.

According to one embodiment of the method, in the event that the feedback contacts of the two double contact relays do not indicate a relay state indicating the currently activated relay state, the two controllers can generate control voltages in such a way that both the first and the second Double contact relays are switched to their open relay state.

In other words, in the event that by monitoring the feedback contacts it can be concluded that at least one of the double contact relays is not correctly following the activation caused by the respective controller and a defect within the double contact relay can therefore be assumed, a reaction can be designed to that both controllers control their respective double contact relay to switch to its open relay state. As a result, the passenger conveyor system can be transferred to a largely safe state even in the event of a defect in the double contact relays of their safety monitoring device.

According to one embodiment, in the proposed method, each of the two controllers monitors the feedback contacts of each of the two double contact relays.

In other words, the first and the second controller should not only monitor the feedback contacts of the double contact relay assigned to them, i.e. controlled by you. Instead, each controller should monitor the feedback contact of its assigned double contact relay as well as the feedback contact of the other double contact relay. In this way, redundancy can be created which further increases the safety of the safety monitoring device and, in particular, drastically increases the probability that malfunctions will be correctly recognized in its double contact relay.

According to one embodiment, the proposed method is carried out before, during or after each individual journey of the passenger transport system.

In other words, the method with which the functionality of the safety monitoring device is checked can in principle be carried out at any time or triggered by any events. However, it is considered advantageous to carry out the method at least when the passenger transport system is driving. It can thus be ensured that the functionality of the safety monitoring device is checked sufficiently frequently.

It is pointed out that some of the possible features and advantages of the invention are described herein with reference to different embodiments of the security monitoring device on the one hand and a method for monitoring its functionality on the other hand. A person skilled in the art recognizes that the features can be combined, adapted or exchanged in a suitable manner in order to arrive at further embodiments of the invention.

• Fig. 1 zeigt eine erfindungsgemäße Personentransportanlage.
• Fig. 2 zeigt eine Sicherheitsüberwachungskette einer erfindungsgemäßen Personentransportanlage.
• Fig. 3 zeigt Details einer erfindungsgemäßen Sicherheitsüberwachungsvorrichtung.
• Fig. 4a zeigt angesteuerte Relaiszustände und daraus resultierende Schaltzustände in der erfindungsgemäßen Sicherheitsüberwachungsvorrichtung.
• Fig. 4b veranschaulicht ein Variieren von angesteuerten Relaiszuständen im Rahmen eines erfindungsgemäßen Verfahrens zum Überwachen der Funktionsfähigkeit einer Sicherheitsüberwachungsvorrichtung.

Embodiments of the invention are described below with reference to the accompanying drawings, wherein neither the drawings nor the description are to be interpreted as restricting the invention.

• Fig. 1 shows a passenger transport system according to the invention.
• Fig. 2 shows a security monitoring chain of a passenger transport system according to the invention.
• Fig. 3 shows details of a security monitoring device according to the invention.
• Figure 4a shows activated relay states and the resulting switching states in the safety monitoring device according to the invention.
• Figure 4b illustrates a variation of activated relay states in the context of a method according to the invention for monitoring the functionality of a safety monitoring device.

The figures are only schematic and not true to scale. In the various figures, the same reference symbols denote the same or equivalent features.

Fig. 1 shows a passenger conveyor system 1 in the form of an elevator. The elevator comprises an elevator car 5 and a counterweight 7, which can be displaced vertically within an elevator shaft 3 by means of belts 9 driven by a drive machine 11. There can also be a brake 12 for braking the drive machine 11 or for direct braking of the elevator car 5 can be provided. Operation of the drive machine 11 and / or the brake 12 is controlled by an elevator control 13. The elevator control 13 can, for example, supply the drive machine 11 with electrical power from an electrical power source 15 in a controlled manner.

The elevator car 5 can be moved between different floors 17. A shaft door 19 is provided on each floor 17 and a car door 21 is provided on the elevator car 15.

A plurality of safety monitoring switch arrangements 23 is provided in the passenger conveyor system 1, with the aid of which safety-relevant states within the passenger conveyor system 1 can be monitored.

For example, door switches 25 are provided on each of the shaft doors 19 and on the car door 21, with the aid of which it can be monitored whether the respective shaft or car door 19, 21 is currently correctly closed or at least partially open. Furthermore, a ladder presence switch 27 is provided in a pit area of the elevator shaft 3, with the aid of which the presence and correct arrangement of a ladder 29 can be monitored. In the case of the door switch 25 as well as the conductor presence switch 27, safety monitoring switch arrangements 23 can be provided, for example, as simple, mechanically operated switches.

In addition, the passenger conveyor system 1 can also have more complex safety monitoring switch arrangements 23. For example, with the help of a magnetic tape 33 extending vertically along the elevator shaft 3 and a magnetic tape reading device 31 attached to the elevator car 5, an absolute position sensor 35 can be formed, with the aid of which information about a current position of the elevator car 5 within the elevator shaft 3 can be obtained. Based on this information, safety-relevant states can then be monitored.

For example, it can be recognized whether the elevator car 5 is currently located opposite or at least close to one of the shaft doors 19 and thus the car door 21 and / or the opposite shaft door 19 may be opened. Furthermore, based on this information, it can be recognized whether the elevator car 5 is located within a permissible travel range 37 within the elevator shaft 3 or whether it was unintentionally moved out of this permissible travel range 37.

Data or signals can be transmitted from the various safety monitoring switch arrangements 23 to a safety monitoring device 39, for example in a wired or wireless manner.

In particular, several of the safety monitoring switch arrangements 23 can be connected to one another, in particular connected to one another in series, in order to form parts of a safety monitoring chain 41. For example, the door switches 25 and the conductor presence switch 27 can be connected in series so that the part of the security monitoring chain 41 formed thereby is only closed as a whole when all the door switches 25 and the conductor presence switch 27 are closed.

The safety monitoring device 39 can communicate with the elevator control 13 or be part of the same and influence functions of the elevator control 13. In particular, the safety monitoring device 39 can actuate one or more main relay arrangements 43, for example to be able to interrupt a power supply between the elevator control 13 and the drive machine 11 and / or to activate or release the brake 12 for braking the elevator car 5.

Fig. 2 illustrates details of a safety monitoring chain 41. Several safety monitoring switch arrangements 23 (which are also referred to below as "third safety monitoring switch arrangements") in the form of door switches 25 and further safety monitoring switch arrangements 23, for example in the form of a conductor presence switch 27 or the like, are connected in series.

One of these further safety monitoring switch arrangements 23 acts as a cabin emergency limit switch 28 (KNE switch). This cabin emergency limit switch 28 is opened when the elevator car 5 is moved beyond its permissible travel range 37.

The part of the safety monitoring chain 41 formed by the safety monitoring switch arrangements 23 connected in series is connected in series with the main relay arrangement 43. The main relay arrangement 43 comprises a first main double contact relay 45 with a coil 49, a first normally open contact 53, a second normally open contact 57 and a feedback contact 61 and a second main double contact relay 47 with a coil 51, a first make contact 55, a second make contact 59 and a feedback contact 63. The main relay arrangement 43 is normally open, ie when the coils 49, 51 are not energized. Accordingly, the main relay arrangement 43 closes an electrical connection running in series through the first working contacts 53, 55 of the first and second main double contact relays 45, 47 between the power-supplying elevator control 13 and the drive machine 11 only when its two coils 49, 51 are completely closed Safety monitoring chain 41 are energized. In a similar way, the brake 12 is only energized and thus released when a connection between a power source and the brake 12 is closed with the aid of the main relay arrangement 43 as a result of a completely closed safety monitoring chain 41.

In order to enable the car door 21 and / or one of the shaft doors 19 to be opened under predetermined conditions, although the drive machine 11 moves the elevator car 5, a so-called UET switch 65 is provided in parallel to the series connection of door switches 25. This UET switch 65 also forms a safety monitoring switch arrangement 23 and may only be closed when the predetermined requirements are met, ie for example when the elevator car 5 has already approached a target floor position within a few centimeters and has already begun is to open the doors 19, 21 before the elevator car 5 has finally stopped at the destination floor position. By closing the UET switch 65, the part of the security monitoring chain 41 formed by the door switches 25 is temporarily bridged.

In order to meet the high safety requirements applicable to passenger conveyor systems 1, both the KNE switch 28 and the UET switch 65 have so far been implemented in a redundant manner, each with two simple relays. In the case of the UET switch 65, for example, the two simple relays were connected in series, so that a switching state of the UET switch 65 was only closed when both relays were closed at the same time, i.e. both relays were in their closed relay state.

However, a total of four simple relays had to be used accordingly for the two functions that were to be implemented with the KNE switch 28 and the UET switch 65.

Fig. 3 illustrates a safety monitoring device 67 according to the invention, which can be implemented as part of a safety monitoring chain 41 of a passenger conveyor system 1 in order to monitor safety-relevant states in the passenger conveyor system 1. The safety monitoring device 67 can in particular implement the functions of a KNE switch 28 and a UET switch 65.

The safety monitoring device 67 comprises a first double contact relay 69 and a second double contact relay 71. Both double contact relays 69, 71 are designed as normally opened relays and each have coils 73, 75 which, when a control voltage is applied to them, first work contacts 77, 79 and second work contacts 81, 83 close. Each of the double contact relays 69, 71 also has a feedback contact 85, 87. In each of the double contact relays 69, 71, the respective coil 73, 75 shifts, ie opens and closes, its first and second working contacts 77, 79, 81, 83 and their feedback contact 85, 87 synchronously with one another and can thus be controlled by the control voltage in an open or closed relay state can be switched.

The safety monitoring device 67 further comprises a first and a second controller 89, 91. The two controllers 89, 91 are designed to determine properties of the passenger conveyor system 1 that correlate with a safety-relevant state, and then suitable control voltages for to generate the first or the second double contact relay 69, 71 as a function of the properties determined. The two controllers 89, 91 can communicate with one another or control one another. In particular, the controllers 89, 91 can be designed as safety-related programmable logic controllers (SSPS).

In the example shown, the two controllers 89, 91 receive information about the current position of the elevator car 5 within the elevator shaft 3 from the absolute position sensor 35 is located or whether it has left it. Depending on which of these two cases applies, the controllers 89, 91 can generate different control voltages for the two double contact relays 69, 71 in order to emulate the function of a KNE switch 28 with the safety monitoring device 67. On the other hand, the controllers 89, 91 can infer from the information whether the elevator car 5 is currently sufficiently close to a destination floor position so that it appears permissible to temporarily bypass the part of the safety monitoring chain 41 formed by the door switches 25 in order to be able to use of the security monitoring device 67 to emulate the function of a UET switch.

The safety monitoring device 67, with its double contact relays 69, 71 and their controllers 89, 91, forms safety monitoring switch arrangements 23 in the form of a first and a second safety monitoring switch arrangement 93, 95.

The first safety monitoring switch arrangement 93 comprises the first working contact 77 of the first double contact relay 69 and the first working contact 79 of the second double contact relay 71, which are connected to one another in series. With this first safety monitoring switch arrangement 93, the safety monitoring device 67 emulates the function of the UET switch at a first output 97.

The second safety monitoring switch arrangement 95 comprises the second normally open contact 81 of the first double contact relay 69 and the second normally open contact 83 of the second double contact relay 71, which are connected in parallel to one another. With this second safety monitoring switch arrangement 95, the safety monitoring device 67 emulates the function of the KNE switch at a second output 99.

An actually assumed relay state of each of the double contact relays 69, 71 can be determined by the controllers 89, 91 via the respective feedback contact 85, 87 of the associated double contact relay 69, 71. This makes it possible to monitor whether a relay state activated by a controller 89, 91 in the associated double contact relay 69, 71 has led to the desired relay state being assumed or whether a defect has prevented this. Each of the two feedback contacts 85, 87 can transmit a feedback signal to each of the two controllers 89, 91.

Figure 4a illustrates in table form possible control voltages K1, K2 generated by the two controllers 89, 91 for controlling the first and second double contact relays 69, 71 in an open relay state (K1 = "0" or K2 = "0", ie no control voltage applied to the coil ) or a closed relay state (K1 = "1" or K2 = "1", ie control voltage applied to the coil) and the resulting switching states UET, KNE at the two outputs 97, 99 of the safety monitoring device 67. The first output 97 is designed to implement the function of the UET switch 65 and the second output 99 is designed to implement the function of the KNE switch 28.

It can be seen that the UET switching state emulated by the first safety monitoring switch arrangement 93 is only "closed" when both double contact relays 69, 71 have been activated by the two controllers 89, 91 in their closed relay state ("1") . On the other hand, the KNE switching state emulated by the second safety monitoring switch arrangement 95 is only opened ("open") when both double contact relays 69, 71 have been activated by the two controllers 89, 91 in their open relay state ("0").

With the safety monitoring device 67 presented, the function of the UET switch 65 can be controlled via the first safety monitoring switch arrangement 93 with a very high safety integrity level of SIL2 or even required for this Implement SIL3. The function of the KNE switch 28 can be implemented via the second safety monitoring switch arrangement 95 at least with the sufficient safety integrity level of SIL1.

Finally, with reference to Figure 4b an embodiment of a method is explained with the aid of which the functionality of the safety monitoring device 67 can be monitored.

The normal operation of the safety monitoring devices 67, during which the safety-relevant states in the passenger conveyor system 1 are monitored, is briefly interrupted at predetermined time intervals, i.e., for example periodically, or triggered by certain events such as the beginning or the end of a journey. Instead, the control voltages generated by the first and second controller 89, 91 are varied in such a way that, on the one hand, one of the two double contact relays 69, 71 alternately briefly switches to its open relay state (Kx = "0") and back to its closed relay state (Kx = " 1 ") is switched, and that, on the other hand, at least one of the two double contact relays 69, 71 is always in its closed relay state.

By varying the control voltages in this way, it can be achieved, on the one hand, that each of the two double contact relays 69, 71 is activated at least once for opening and subsequent closing. On the other hand, it is ensured that the first safety monitoring switch arrangement 93 effecting the UET function is briefly opened and closed again, but the second safety monitoring switch arrangement 95 effecting the KNE function always remains closed. The entire safety monitoring chain 41 thus always remains closed during this variation of the control voltages.

While the described method is being carried out, not only can the control voltages be varied with the aid of, for example, the controllers 89, 91, but also the actual relay status indicated by the feedback contacts 85, 87 of both double contact relays 69, 71. As long as the double contact relays 69, 71 are working properly, the relay status reported by the feedback contacts 85, 87 should match that of the controllers 89, 91 controlled relay status match. If this no longer applies at a point in time to, a defect in one of the double contact relays 69, 71 can be assumed. This can be brought about, for example, by the fact that arms of one of the working contacts 77, 79, 81, 83 have been glued or welded to one another.

In this case it can be provided that both controllers 89, 91 generate control voltages in such a way that both the first and the second double contact relay 69, 71 are switched to their open relay state. It can thus be ensured that at least the extremely safety-critical UET function of the first safety monitoring switch arrangement 93 is reliably switched to its open state, so that a dangerous movement of the elevator car 5 when the doors 19, 21 are open is definitely avoided.

With the safety monitoring device 67 described herein or the method for monitoring its functionality, the possibility of cost reduction can be opened up for the appropriately equipped passenger conveyor system 1, since only two double contact relays are required for their implementation instead of the conventional four simple relays. Furthermore, a higher level of reliability can be achieved overall, since only two, instead of the previous four, safe relays are required. The complexity of an electronic circuit for the safety monitoring device 67 can also turn out to be simpler than in the case of conventional devices, since fewer components need to be controlled. Finally, it should be pointed out that terms such as “having”, “comprising”, etc. do not exclude any other elements or steps and that terms such as “a” or “an” do not exclude a plurality. Reference signs in the claims are not to be regarded as a restriction.

List of reference symbols

1

Passenger conveyor system

3

Elevator shaft

5

Elevator cabin

7th

Counterweight

9

belt

11

Prime mover

12th

brake

13th

Elevator control

15th

Power source

17th

floor

19th

Landing door

21

Cabin door

23

Safety monitoring switch assemblies

25th

Door switch

27

Head presence switch

28

Cabin emergency limit switch (KNE switch)

29

ladder

31

Magnetic tape reader

33

Magnetic tape

35

Absolute position sensor

37

permissible travel range

39

Security monitoring device

41

Security surveillance chain

43

Main relay arrangement

45

first main double contact relay

47

second main double contact relay

49

Coil of the first main double contact relay

51

Coil of the second main double contact relay

53

first normally open contact of the first main double contact relay

55

first normally open contact of the second main double contact relay

57

second normally open contact of the first main double contact relay

59

second normally open contact of the second main double contact relay

61

Feedback contact of the first main double contact relay

63

Feedback contact of the second main double contact relay

65

Door Override Switch (UET Switch)

67

Security monitoring device

69

first double contact relay

71

second double contact relay

73

Coil of the first double contact relay

75

Coil of the second double contact relay

77

first normally open contact of the first double contact relay

79

first normally open contact of the second double contact relay

81

second normally open contact of the first double contact relay

83

second normally open contact of the second double contact relay

85

Feedback contact of the first double contact relay

87

Feedback contact of the second double contact relay

89

first controller

91

second controller

93

first safety monitoring switch arrangement

95

second safety monitoring switch arrangement

97

first output for UET function

99

second output for KNE function

Claims (14)

1. Safety monitoring device (67) for monitoring safety-related states in a passenger conveyor system (1), comprising:

   - a first and a second double contact relay (69, 71), both of which, in each case in a manner controlled by a control voltage, switch a first normally open contact (77, 79) and a second normally open contact (81, 83) as well as a feedback contact (85, 87) synchronously with one other between an open and a closed relay state;

   - a first and a second controller (89, 91) each for determining properties of the passenger conveyor system (1) correlated with a safety-related state and for generating the control voltages for the first and the second double contact relay (69, 71) depending on the determined properties;

   characterized in that

   a first safety monitoring switch arrangement (93) for monitoring a first safety-related state and for correspondingly switching a first switching state within a safety monitoring chain (41) of the passenger conveyor system (1) and a second safety monitoring switch arrangement (95) for monitoring a second safety-related state and for correspondingly switching a second switching state within the safety monitoring chain (41) of the passenger conveyor system (1) are formed by means of the two double contact relays (69, 71) and the two controllers (89, 91);

   the first safety monitoring switch arrangement (93) comprising the first normally open contact (77) of the first double contact relay (69) and, connected in series therewith, the first normally open contact (79) of the second double contact relay (71); and the second safety monitoring switch arrangement (95) comprising the second normally open contact (81) of the first double contact relay (69) and, connected in parallel therewith, the second normally open contact (83) of the second double contact relay (71).
2. Safety monitoring device according to claim 1, wherein monitoring the first safety-related state requires a higher safety integrity level than monitoring the second safety-related state.
3. Safety monitoring device according to any of the preceding claims, wherein monitoring the second safety-related state requires a safety integrity level SIL1 and monitoring the first safety-related state requires at least one safety integrity level SIL2.
4. Safety monitoring device according to any of the preceding claims, wherein the first safety-related state indicates whether parts of the safety monitoring chain (41) which monitor closed states of doors (19, 21) of the passenger conveyor system (1) may be temporarily short-circuited and wherein the parts of the safety monitoring chain (41) which monitor closed states of doors (19, 21) of the passenger conveyor system (1) are temporarily short-circuited by switching the first switching state to closed.
5. Safety monitoring device according to any of the preceding claims, wherein the second safety-related state indicates whether an elevator car (5) has been moved beyond a permissible movement range (37), and wherein the safety monitoring chain (41) is interrupted by switching the second switching state to open.
6. Safety monitoring device according to any of the preceding claims, further comprising a plurality of series-connected third safety monitoring switch arrangements (23) for monitoring third safety-related states.
7. Safety monitoring device according to claim 6, wherein the first safety monitoring switch arrangement (93) is interconnected in parallel with the series of third safety monitoring switch arrangements (23) and wherein the second safety monitoring switch arrangement (95) is interconnected in series with the series of third safety monitoring switch arrangements (23).
8. Safety monitoring device according to any of the preceding claims, wherein the first and the second controller (89, 91) are each in the form of a safety programmable logic controller.
9. Safety monitoring device according to any of the preceding claims, wherein the safety monitoring device (67) is set up to execute or to control a method according to any of claims 11 to 14.
10. Passenger conveyor system (1) comprising a safety monitoring device (67) according to any of claims 1 to 9.
11. Method for monitoring working order of a safety monitoring device (67) according to any of claims 1 to 9, wherein the method comprises:

    varying the control voltages generated by the first and the second controller (89, 91) such that one of the first and the second double contact relays (69, 71) is alternately switched briefly to its open relay state and back to its closed relay state, and such that always at least one of the first and the second double contact relay (69, 71) is in its closed relay state, and

    monitoring whether the feedback contacts (85, 87) of the two double contact relays (69, 71) always indicate a relay state indicating the currently activated relay state.
12. Method according to claim 11, wherein, in the event that the feedback contacts (85, 87) of the two double contact relays (69, 71) do not indicate a relay state indicating the currently driven relay state, the two controllers (89, 91) generate control voltages such that both the first and the second double contact relay (69, 71) are switched to their open relay state.
13. Method according to either of the preceding claims 11 to 12, wherein each of the two controllers (89, 91) monitors the feedback contacts (85, 87) of each of the two double contact relays (69, 71).
14. Method according to any of the preceding claims 11 to 13, wherein the method is implemented before, during or after each individual journey of the passenger transport system (1).

Images