EP3774628A1

EP3774628A1 - Elevator system

Info

Publication number: EP3774628A1
Application number: EP19716340.5A
Authority: EP
Inventors: Richard Thum; Florian SCHOFFER
Original assignee: ThyssenKrupp Elevator Innovation and Operations GmbH
Current assignee: TK Elevator Innovation and Operations GmbH
Priority date: 2018-04-13
Filing date: 2019-04-03
Publication date: 2021-02-17
Also published as: DE102018205633A1; CN112004768A; WO2019197226A1

Abstract

An elevator system is shown, having a car that is accommodated so as to be able to travel within an elevator shaft. It also has a drive, which is configured to move the car in the elevator shaft, and a brake unit, which is configured to brake the car within the elevator shaft. A control unit is furthermore configured to control the brake unit.

Description

elevator system

description

The disclosure relates to an elevator installation with a brake unit, which first builds up a first force for releasing the brake unit and later a second (lower) force in order to obtain braking readiness. Furthermore, the disclosure relates to an elevator installation with a control unit having a first and a second

Redundancy mode, wherein the first redundancy mode allows increased availability of the elevator installation and the second redundancy mode allows an accelerated braking effect. In other words, an elevator installation with a reduced maximum possible (maximum) reaction time (worst case reaction time) is shown.

In drive technology and also in brake systems in elevator systems can

Reaction times of the system can be improved in three areas, in the sensors, the actuators and the controller, so the processing of the sensor data and the control of the actuators. The reaction times in the sensors and the control are already a few microseconds to a few milliseconds while the reaction times in the actuators are many times greater and are typically in the range of 100ms and above.

However, every millisecond can decide on life and death, especially in brake systems, so there is a need for development in all areas.

The object of the present invention is therefore to provide an improved concept for reducing reaction times for brake units in elevator systems.

The object is solved by the subject matter of the independent patent claims. Further advantageous embodiments are the subject of the dependent claims.

Embodiments show an elevator system with a car that is movably received within a hoistway. It also has a drive, which is designed to move the car in the elevator shaft and a brake unit, which is designed to brake the car within the elevator shaft. A

Control unit is further configured to control the brake unit. Further embodiments show the elevator system with the car, which is movably received within the elevator shaft. The elevator installation has the drive (for example a linear drive), which is designed to move the car in the elevator shaft. The brake unit is configured to decelerate the car within the elevator shaft, wherein the brake unit is a brake element and a so

cooperating brake partner, in particular a brake rail having. Furthermore, the elevator installation comprises the control unit, which is designed to control a force action of the brake unit, wherein the control unit is designed to control the force action with a first strength in order to release the brake element from the brake partner and after the brake element has released from the brake partner has to control the force action with a second strength, wherein in particular the first strength is greater than the second strength.

Here the initially required force to release the brake of the car is reduced after release. In the de-energized state (idle state), the brake unit is configured to brake, i. the brake element is pressed onto the brake partner. As a brake partner is called a rigid part of the brake unit, whereas the

Brake element denotes a part of the brake unit which is movable to the brake partner, and e.g. may have a brake pad. The pressing is done for example by means of a (pressure) spring. For releasing the brake, therefore, it is first necessary to essentially overcome a spring force, but also to force further forces, e.g. Adhesive forces, the release of the

Brake elements counteract the brake partner. After releasing the brake, it is sufficient to overcome the spring force to open the brake, i. the brake element spaced from the brake partner to hold. The release of the brake is usually by means of an electromagnetic actuator, e.g. a current-carrying coil causes. However, as usual when braking, the current flow through the abruptly

interrupted electromagnetic actuator, builds up a self-induction voltage, which initially drops the current flow through the electromagnetic actuator only slowly. Thus, it is advantageous to reduce the flow of current even before the actual braking process so far that the brake element has no or only a slight contact with the brake partner (second force) but could not necessarily solve the brake element of the brake (first force).

In embodiments, the elevator installation has a detection unit which

is designed to detect a dangerous condition in which the elevator system requires increased braking readiness. The control unit is then designed, the

Force action (only then) with the second strength to control when the detection unit detected the dangerous condition. As a dangerous condition comes, for example, the approaching end of the elevator shaft or, in particular in the direction of travel, located in the vicinity of another car or, in particular in elevator systems with linear drive a conversion unit for implementing the car in another elevator shaft into consideration. The detection unit can therefore have a proximity sensor. Alternatively, the detection unit can also recognize the dangerous condition from a driving profile and / or the current position of the car, in particular the position of the car relative to the end of the elevator shaft or the further car. Also a combination of software (driving profile and position determination) and hardware sensors (eg

Proximity sensor) is possible, for example, to obtain a redundancy or a fallback system (usually the hardware sensors).

The use of the detection unit is advantageous, since thus the force effect of

Brake elements is only reduced if the elevator system i. For example, the brake unit (control with the force of the second strength) and / or the control unit (operation in the second redundant mode) to be placed in an increased braking readiness (ie when a dangerous condition is detected) to brake the car as quickly as possible. If the elevator installation has a plurality of cars, the increased braking readiness of the elevator installation can also be produced only for those cars (i.e., a selection of the several cars) which are in a dangerous situation. If the danger condition is detected, the force effect can be further reduced (compared to a permanent reduction of the force effect), for example to the extent that there is only a minimal distance or even a slight contact between the brake unit and the brake partner, but without them leads to a noticeable deceleration of the car. Conversely, the

Control unit, if the danger condition no longer exists, the force effect again with the first strength steer, so the brake completely (with maximum force) to solve.

Alternatively, the control unit in embodiments, a position of

Determine brake elements relative to the brake partner and when detected danger condition, the force effect of the second strength such that the brake element is held in a constant position to the brake partner. The control allows a precise positioning of the brake element with a minimum distance relative to the brake partner, so that the brake element and the brake partner even at an external

Force, for example, by jolts or blows that are triggered, for example, by persons or moving objects in the car, not or only briefly touch. It is even possible to adjust the regulation such that the Slightly touch the brake element and the brake partner, but without any noticeable braking effect. In the event of an external force, the control makes it possible that the light touch does not noticeably change. If the distance is set so that the brake unit and brake partner do not touch, a permanent control to a minimum distance is possible, without the regulation only starts when the

Hazardous condition is detected.

In one embodiment, the force of the second strength by the

Controlled control unit explicitly such that the braking element exerts a partial force on the brake partner, which is less than a maximum force that can exert the brake element on the brake partner. In this case, the reaction time, in which the braking effect begins, is reduced to a minimum. There are two main reasons for this. First, the distance between the brake element and the brake partner is already so low (or no longer available), so that such a distance does not need to be overcome if the braking effect is to start suddenly. Further, the self-inductance of the electromagnetic actuator, e.g. the current-carrying coil, the

Brake element releases from the brake partner, reduced to a minimum, so that the

Magnetization of the electromagnetic actuator is degraded as quickly as possible.

Embodiments show the elevator system, comprising the car, which is movably received within the elevator shaft and the drive, which is designed to move the car in the elevator shaft. Furthermore, the elevator system has the

Brake unit, which is designed to brake the car within the elevator shaft. A detection unit is designed to detect a hazardous condition in which the elevator system requires increased braking readiness. The elevator installation also comprises a redundant control unit, which is designed to control the brake unit and in the dangerous condition from a first redundancy mode to a second

Switch redundancy mode.

This embodiment is advantageous for reducing the response times in the controller by switching between redundancy designed for availability of the elevator equipment (first redundancy mode) and redundancy designed for fast response time (second redundancy mode) becomes. Switching is initiated by detecting the hazardous condition. The detection unit therefore does not differ in the various embodiments of the

Lift system. In embodiments, the control unit has a multiplicity of arithmetic units (ie at least three arithmetic units). In the first redundancy mode, any selection of at least two arithmetic units of the plurality of arithmetic units redundantly controls the braking unit, whereas in the second redundancy mode, a predetermined selection of exactly two arithmetic units from the plurality of arithmetic units drives the braking unit. In other words, the control unit has, for example, three (independent) computing units. In the first redundancy mode, it suffices if two of the three arithmetic units output a matching signal that the car is allowed to drive in order to maintain the operation of the elevator system. It does not matter which two of the three controllers output the matching signal. This increases the

Resilience of the elevator system, but it costs a few microseconds time for communication between the three computing units.

In the second redundancy mode, two of the three arithmetic units are preselected to control the elevator system. The third processor is not needed in this mode. In each case a controlled switch of both arithmetic units can then be connected in series, wherein the switch represents the signal state that the car is allowed to drive (or not). This eliminates the need for communication between the two

selected (predetermined) computing units. However, a failure can be a

Computing unit can not be compensated. Optionally, however, it is possible to select the two functional computing units in the event of a failure of a computing unit in the first redundancy mode for the second redundancy mode. The predetermined selection can therefore be variable insofar as the one defective arithmetic unit, which is actually intended for the second redundancy mode, by the actually not provided

Replace arithmetic unit. A change of the arithmetic units can also be cyclic, e.g. to load all computing units evenly. When changing from the first to the second redundancy mode, however, it is clear which of the two

Arithmetic units, the function of the redundant control unit in the second

Adopt redundancy mode. As soon as the dangerous state no longer exists, the redundant control unit can switch back to the first redundancy mode.

Further, it is possible to combine the above embodiments. Such

Elevator system has, for example, the following features: the car, which is movably received within the elevator shaft; the drive, which is adapted to move the car in the elevator shaft; the brake unit configured to decelerate the car within the hoistway, the brake unit including the brake member and the brake partner; the detection unit that is formed, the danger state to detect, in which the elevator system requires increased braking readiness; the redundant control unit, which is designed to control the brake unit and switch over from a first redundancy mode to a second redundancy mode in the dangerous state, wherein the redundant control unit is designed to control the force action of the brake unit, wherein the redundant control unit is designed

To control force action with the first strength to release the brake member from the brake partner and after the brake member has released from the brake rail to control the force of the second strength, in particular the first strength is greater than the second strength. In this embodiment, both the processing of the sensor data and the control of the actuator system is improved.

The detection unit can in all embodiments, in particular in the direction of travel, a safety distance, in particular a distance between two cars, i. between the car and a neighboring car, and / or between the car

Determine the car and the transfer unit to implement the car in another slot and detect the dangerous condition when the safety distance falls below a threshold. The limits can be fixed or

be speed dependent. Thus, a hazardous condition may be more likely to occur during a fast ride of the car, i. occur at a greater distance to the object that has triggered the dangerous condition than when driving slowly.

Furthermore, a method for controlling an elevator installation is disclosed with the following steps: method of a car inside a hoistway; Controlling a brake unit to decelerate the car within the elevator shaft.

Furthermore, a method for controlling an elevator installation is disclosed with the following steps: method of a car inside a hoistway with a drive; Controlling a force effect of a brake unit, a brake element and a

Bremspartner has, with a first strength to the brake element of the

To release the brake partner; Controlling the force effect with a second strength after the brake member has released from the brake partner, in particular, the first strength is greater than the second strength.

Furthermore, a method for controlling an elevator installation is disclosed with the following steps: method of a car inside a hoistway with a drive; Driving a brake unit to brake the car within the hoistway with a redundant control unit in a first redundancy mode; Detect a Hazardous condition in which the elevator system requires increased braking readiness; Switching the redundancy mode from the first redundancy mode to a second redundancy mode when the danger condition is detected.

Another method discloses the following steps: method of a car inside a hoistway with a drive; Controlling a force action of a brake unit having a brake element and a brake partner with a first magnitude to release the brake element from the brake partner, wherein the control is performed with a redundant control unit in a first redundancy mode; Controlling the force effect with a second strength after the brake member has released from the brake partner, in particular the first strength is greater than the second strength; Detecting a hazardous condition in which the elevator system requires increased braking readiness; Switching the redundancy mode of the redundant control unit of the first

Redundancy mode in a second redundancy mode when the dangerous condition is detected.

Preferred embodiments of the present invention will be explained below with reference to the accompanying drawings. Show it:

Fig. 1: a schematic representation of an elevator system according to a

Embodiment;

FIG. 2 is a schematic circuit diagram of a circuit of the brake unit according to FIG

Embodiments;

3 shows a schematic representation of the elevator installation of an embodiment with redundant control units that can be switched over in two redundancy modes.

Before embodiments of the present invention are explained in more detail below with reference to the drawings, it is pointed out that identical,

functionally identical or equivalent elements, objects and / or structures in the different figures are provided with the same reference numerals, so that the description of these elements shown in different embodiments is interchangeable or can be applied to each other.

1 shows a schematic representation of an elevator installation 2. The elevator installation 2 has a car 4, a drive 6, a brake unit 8 and a control unit 10. The car 4 is movably received within a hoistway 12. The drive 6 can move the car 4 in the hoistway 12. When drive 6 comes

For example, linear drive or a cable drive into consideration. The brake unit 8 can brake the car 4 within the hoistway 12. It has a brake element 14 and a brake rail 16 as a brake partner. Thus, the brake unit 8 is designed as a mechanical, (friction) brake. The exact design of the brake is not significant for this disclosure. In particular, in the figures, a simplified representation for ease of presentation was selected. Only it is advantageous if the

Brake unit in the unactuated, for example, tension-free, state brakes, i. a maximum force of the brake member 14 is exerted on the brake rail 16 and in the actuated state, the car can be moved, i. the brake element is removed from the brake rail. This functionality of the brake unit 14 is already off

safety point of view advantageous. To ensure this functionality, the brake element 14 can be pressed by means of a (pressure) spring element 18 against the brake rail. To release the brake element of the brake rail can be a

Counterforce to the spring are constructed, which the brake element against the

Contact pressure of the spring releases from the brake rail. This can e.g. done by means of a current-carrying electromagnetic actuator.

The control unit 10 can control a force action of the brake unit 8, in particular on the brake element 14. First, the force effect can be controlled with a first strength to release the brake member 14 of the brake rail 16. After the brake element 14 has released from the brake rail 16, the force action can be controlled with a second strength, wherein the first strength is greater than the second strength.

The release of the brake element 14 from the first strength force rail 16 may be accomplished by means of an electromagnetic actuator, e.g. a coil, done. Accordingly, the electromagnetic actuator can be acted upon by a first current which generates in the electromagnetic actuator a magnetic field which is sufficient to release the brake element 14 from the brake rail 16. After the brake member 14 has disengaged from the brake rail 16, i. the brake unit is open, the current through the electromagnetic actuator can be reduced, the resulting

Magnetic field should keep the brake element 14 spaced from the brake rail 16. In Fig. 1, the control of the brake unit is symbolized by the arrow 20. This will be specified below. Double arrow 22 indicates that the brake element 14 is arranged to be movable. FIG. 2 shows a schematic circuit diagram of a circuit 23 of the brake unit 8 according to exemplary embodiments. In addition to a first switch 24 for switching off the elevator system, the circuit 23 has a second switch 26, which can switch the force effect of the brake unit 8 from the first strength to the second strength (release of the brake unit). Switching is done by opening the second switch 26. The switching of the force of the second strength to the force of the first strength is done by closing the second switch 26. The switching can be done by the control unit 10, represented by the operating line 34. When opened the second switch 26 is a

Resistance element 28 at which a voltage drops, e.g. a diode upstream of the brake unit 8, so that a portion of the energy which drops completely at the brake unit 8 when the second switch 26 is closed, already drops at the resistance element 28. For adjusting the energy dropped at the brake unit, the resistive element 28 may be connected in parallel with an adjustable resistive element 30, or the adjustable resistive element 30 may be substituted for (ie without) the resistive element 28 directly. When the electromagnetic actuator is used for releasing the brake member from the brake rail, the energy at the electromagnetic actuator can be reduced, and thus also that built by the electromagnetic actuator

Magnetic field can be reduced. Likewise, the self - inductance of the

electromagnetic actuator, whereby when switching off the elevator system, e.g. by the first switch 24, the magnetic field of the electromagnetic actuator is degraded faster and the brake element thus dissolves faster from the electromagnetic actuator. The first switch 24 may be implemented in hardware e.g. as an emergency stop switch or in software for initiating braking if it is detected by means of the control software executed. The latter is illustrated by the operating line 35.

In embodiments, the control unit 10 receives a feedback signal 36 from the brake unit 8. The feedback signal 36 includes a position of the brake member to the brake rail. The position of the braking element to the brake rail can be measured in various ways, for example by measuring the inductance of the electromagnetic actuator (which changes when the brake unit is moved, for example by means of an iron core guided through the coil) and / or a probe (eg, a proximity sensor) etc., for example, in combination with a measurement of a (changing) thickness of the brake pad. Thus, the adjustable resistor 30 can be adjusted by the control unit 10, represented by the operating line 38, so that the position of the brake element to the brake rail remains unchanged, even if forces acting on the brake unit or the braking element or the brake element (eg by abrasion a brake pad) is changed in its extent, in particular reduced, is. The opening of the second switch 26 (actuating line 34) as well as the regulation of the adjustable resistance element 30 can each be carried out or started after the release of the brake element from the brake rail. Furthermore, the elevator installation can also have a detection unit 40, which detects a dangerous condition of the elevator installation. The detection unit may be embodied in hardware, for example as a sensor, which transmits the presence of the hazardous condition via a connection to the sensor unit 10. The detection unit can also be implemented in software and determine the dangerous condition, for example by determining the position of the car in the elevator shaft and / or relative to an adjacent car. A combination of hardware and software is possible.

The hazardous condition is a condition in which the elevator system is elevated

Brake standby is set to decelerate the car as a foreseeable event (e.g., reaching one end of the elevator shaft or approaching another car) may cause the car to brake soon. The second

Switch 26 and / or adjustable resistive element 30 may now be switched or regulated depending on the presence of a hazardous condition. The control 38 of the adjustable resistance element 30 can be designed such that the

Braking already exerts a partial force on the brake rail. That is, the electromagnetic actuator receives so much energy that it positions the brake element so that it already touches the brake rail or grinds on the same. In one embodiment, the brake unit typically has a response time (i.e.

Delay time) of 290ms until 90% of the maximum force is exerted by the brake element on the brake rail, this time is reduced to 80ms when the

Brake element already exerts 10% of the maximum force on the brake rail when the

Braking is initiated, i. e.g. when the first switch 24 is opened.

3 shows a schematic representation of the elevator installation 2 with a redundant control unit 10. The redundant control unit 10 has three arithmetic units 10a, 10b, 10c. Above the double arrow 46 a first redundancy mode of the control unit 10 is shown, whereas below the double arrow 46 a second redundancy mode is shown. In the first redundancy mode, the first switch 24 is driven by the arithmetic unit 10b, represented by the actuation line 35. The first switch 24 opens or closes a circuit between a power source 48, e.g. a voltage source, and the brake unit 8, in particular the electromagnetic actuator 44 (see, e.g., Fig. 2).

The arithmetic unit 10b can also receive relevant process data, for example information about the hazardous condition from the detection unit 40 via a connection 42 (if the Detection unit is not executed in the arithmetic unit itself) and forwards them via the connection 50, 50 'to the other arithmetic units 10a and 10c on. Alternatively, the process signals can also be distributed directly by the detection unit to all the arithmetic units 10a, 10b and 10c (not shown). The exchange via the connections 50, 50 'can then be omitted. The three computing units 10a, 10b, 10c each independently calculate whether the brake unit 8 is to be actuated. It suffices that two of the three computation units arrive at the same result. The failure of a computing unit can be compensated.

From this first redundancy mode, the control unit 10 can switch to a second redundancy mode. An embodiment is shown in Fig. 3 below the double arrow. One of the arithmetic units 10c is omitted as an example for a predetermined arithmetic unit, i. it is not needed for the second redundancy mode. In the second redundancy mode, each of the remaining arithmetic units 10a, 10b respectively drives a first switch 24, 24 ', represented by the actuation lines 35, 35'. The first switches 24, 24 'open or close the circuit between the power source 48 and the brake unit 8, in particular the electromagnetic actuator 44 (see, e.g., Fig. 2). The arithmetic units 10a, 10b may each separate the relevant process data, e.g.

Information on the dangerous state of the detection unit 40 via a connection 42, 42 '(if the detection unit is not implemented in the arithmetic unit itself)

receive. The two arithmetic units 10a, 10b each calculate independently

each other, whether the brake unit 8 is to be actuated. Once one of the two

Computing unit reaches the conclusion that the brake unit 8 is to be actuated or as soon as one of the two computing units fails, the circuit is interrupted and the brake unit is actuated. A failure of a computing unit is thus not compensated.

However, the communication between the computing units, so that the

Shutdown process is initiated as soon as possible.

This functionality shown in Fig. 3 may e.g. through three separate

Programmable logic controllers (PLC) are met, which then together form the control unit 10, or by a programmable logic controller as a control unit 10, which can internally map the described functionality.

The invention is applicable to elevator systems with different drives, such as a cable drive. In the meantime, the linear drive has emerged as an alternative to cable drive in elevator construction. Such a linear drive comprises fixed stator units installed in the elevator shaft and at least one fixedly installed on the elevator car Rotor unit. The invention is applicable to an elevator installation which has a car and such a linear drive for driving the car. Elevator systems with a linear motor drive, wherein the primary part of the linear motor is provided by appropriately designed guide rails of the elevator system and the secondary part of the linear motor is provided by a carriage of a car, which includes the rotor of the linear motor, are for example from DE 10 2010 042 144 A1 A1 or DE 10 2014 017 357 A1.

The invention is applicable to elevator systems (elevator systems) with at least one elevator car (car), in particular a plurality of cars, which can be moved in a shaft via guide rails. At least one fixed first guide rail is fixedly arranged in the shaft and is aligned in a first, in particular vertical, direction. At least one fixed second guide rail is aligned in a second, in particular horizontal, direction in the shaft. The elevator car can be transferred via a transfer unit between two separate elevator shafts. Such a conversion unit can at least one with respect to the shaft rotatable third

Guide rail which is fixed to a rotary platform and is convertible between an orientation in the first direction and an orientation in the second direction. Such systems are basically described in WO 2015/144781 A1 and in German patent applications 10 2016 21 1 997.4 and 10 2015 218 025.5.

Although some aspects have been described in the context of a device, it should be understood that these aspects are also a description of the corresponding device

Represent method, so that a block or a component of a device is to be understood as a corresponding method step or as a feature of a method step. Similarly, aspects described in connection with or as a method step also represent a description of a corresponding block or detail or feature of a corresponding device.

Depending on particular implementation requirements, embodiments of the invention may be implemented in hardware or in software. The implementation may be performed using a digital storage medium, such as a floppy disk, a DVD, a Blu-ray Disc, a CD, a ROM, a PROM, an EPROM, an EEPROM or FLASH memory, a hard disk, or other magnetic disk or optical memory are stored on the electronically readable control signals, which can cooperate with a programmable computer system or cooperate, that the respective method is performed. That's why it can digital storage medium be computer readable. Thus, some embodiments according to the invention include a data carrier having electronically readable control signals capable of being coupled to a programmable computer system

cooperate to perform any of the methods described herein.

In general, embodiments of the present invention as

Computer program product with a program code implemented, the program code is effective. perform one of the procedures when the computer program product runs on a computer. The program code can also be stored, for example, on a machine-readable carrier. Other

Embodiments include the computer program for performing any of the methods described herein, wherein the computer program is stored on a machine-readable medium.

In other words, an embodiment of the method according to the invention is thus a computer program which has a program code for performing one of the methods described herein when the computer program runs on a computer. A further embodiment of the inventive method is thus a data carrier (or a digital storage medium or a computer-readable medium) on which the computer program is recorded for carrying out one of the methods described herein.

Another embodiment of the method according to the invention is thus a

A data stream or sequence of signals representing the computer program for performing any of the methods described herein. Of the

A data stream or the sequence of signals can be configured, for example, to be transferred via a data communication connection, for example via the Internet.

Another embodiment includes a processing device, such as a computer or a programmable logic device, that is configured or adapted to perform one of the methods described herein.

Another embodiment includes a computer on which the computer program is installed to perform one of the methods described herein. In some embodiments, a programmable logic device (eg, a field programmable gate array, an FPGA) may be used to perform some or all of the functionality of the methods described herein. In some embodiments, a field programmable gate array may cooperate with a microprocessor to perform one of the methods described herein. In general, in some embodiments, the methods are performed by any hardware device. This may be a universal hardware such as a computer processor (CPU) or hardware specific to the process, such as an ASIC.

The embodiments described above are merely illustrative of the principles of the present invention. It will be understood that modifications and variations of the arrangements and details described herein will be apparent to others of ordinary skill in the art. Therefore, it is intended that the invention be limited only by the scope of the appended claims, not by the specific ones

Details limited to the description and explanation of the embodiments herein are limited.

LIST OF REFERENCE NUMBERS

Elevator installation 2

Car 4

Drive 6

Brake unit 8

Control unit 10

Computing unit 10a, 10b, 10c

Elevator shaft 12

Brake element 14

Brake rail 16

Spring element 18

Arrow (to control the brake unit) 20

Double arrow (to symbolize the possibility of movement of the brake element) 22 Wiring (of the brake unit) 23

first switch (for switching off the elevator installation) 24, 24 '

second switch (for switching the force effects) 26

Resistance element 28

adjustable resistance element 30

Arithmetic unit 32

Operating line 34, 35, 35 ', 38, 42, 42'

Feedback signal 36

Detection unit 40

Connection 42

electromagnetic actuator 44

Double arrow (to distinguish between the redundancy modes) 46

Energy source 48

Connection (between arithmetic units) 50, 50 '

Claims

claims

1. elevator installation (2) with the following features: a car, which is movably received within a hoistway (12); a drive (6) adapted to move the car (4) in the hoistway (12); a brake unit (8), which is designed to brake the car (4) within the hoistway (12), a control unit (10), which is designed to control the brake unit.

2. Elevator installation (2) according to claim 1, wherein the brake unit (8) has a brake element (14) and a cooperating brake partner (16), in particular a brake rail (16); wherein the control unit is configured to control a force action of the brake unit (8), wherein the control unit (10) is designed to control the force action with a first strength in order to release the brake element (14) from the brake partner (16), and after the brake element (14) has released from the brake partner (16), to control the force action with a second strength, wherein in particular the first strength is greater than the second strength.

3. elevator installation (2) according to claim 2, with a detection unit (40) which is adapted to detect a dangerous condition in which the elevator installation (8) requires an increased braking readiness; wherein the control unit (10) is configured to control the force of the second strength when the detection unit (40) detects the hazardous condition.

4. Elevator installation (2) according to claim 2, with a detection unit (40) which is designed to detect a dangerous condition in which the elevator installation (2) requires increased braking readiness; wherein the control unit (10) is designed to determine a position of the brake element (14) relative to the brake partner (16) and when the danger condition is detected

Force action of the second strength to be controlled so that the brake element (14) is held in a constant position to the brake partner (16).

5. elevator installation (2) according to claim 4, wherein the control unit (10) is adapted to regulate the force of the second strength such that the braking element (14) a

Partialkraft on the brake partner (16) exerts, which is less than a maximum force that can exert the brake element (14) on the brake partner (16).

6. elevator installation according to one of claims 2 to 5, wherein the force of the first strength is greater than the force of the second strength.

7. elevator installation (2) according to one of claims 1 to 6, comprising: a detection unit (40) which is adapted to detect a dangerous condition in which the elevator installation (2) requires increased braking readiness; wherein the control unit as a redundant control unit (10) is formed to the

Brake unit (8) in the hazardous state of a first redundancy mode switch to a second redundancy mode.

8. elevator installation (2) according to claim 7, wherein the redundant control unit (10) comprises a plurality of arithmetic units (10a, 10b, 10c), wherein in the first redundancy mode any selection of at least two arithmetic units (10a, 10b) of the plurality of Arithmetic units (10a, 10b, 10c) the

Brake unit (8) drives redundantly and wherein in the second redundancy mode, a predetermined selection of exactly two arithmetic units (10a, 10b) of the plurality of arithmetic units (10a, 10b, 10c) drives the brake unit (8).

9. elevator installation (2) according to one of claims 3 to 8, wherein the detection unit (40) is designed, in particular in the direction of travel, to determine a safety distance, in particular a distance between two cars or between the car (4) and the conversion unit for converting the car into another shaft and to detect the dangerous condition, if the

Safety distance falls below a limit.

10. A method for controlling an elevator installation (2) with the following steps:

Method of a car inside a hoistway (12);

Controlling a brake unit to decelerate the car within the elevator shaft.

1 1. Computer program with a program code for performing the method according to claim 10, when the computer program runs on a computer