EP4121383B1 - Control unit for a lift system - Google Patents

Description

The invention relates to a control unit for an elevator system according to the preamble of claim 1, with a car that can be moved along an elevator shaft between floors and a drive unit for moving the car between floors, the control unit for interacting with a safety circuit, in particular laid through the elevator shaft is designed, which is formed by a plurality of safety switches connected in series, which can be switched between an open state that interrupts the driving operation and a closed state that enables the driving operation, depending on safety-relevant operating conditions of the elevator system, the safety circuit, in particular at least one safety switch, for maintenance and/or repair work can be bridged in sections by electrically contacting a maintenance bridge, with intermediate taps arranged in the safety circuit for tapping an intermediate voltage, with a safety element, in particular a main contactor, which can be controlled by the safety circuit in such a way that an error condition occurs in the interrupted safety circuit the safety element is activated in order to switch off the drive unit, in particular to separate the supply voltage from the drive unit, and that in the closed safety circuit an active state of the safety element is activated in order to activate the drive unit to realize the driving operation; in particular to connect the drive unit to the supply voltage, having monitoring means for measuring and evaluating intermediate voltages and intervention means which are operatively connected to the safety circuit in such a way that the safety circuit can be interrupted by means of at least one separating element which can be switched between a closed and an open switching position and / or at least one safety switch can be bridged, the monitoring means and engagement means for carrying out a test action are set up and designed to detect at least one intermediate voltage depending on a switching position of the at least one separating element.

The invention also relates to an elevator system with a control unit according to the invention and the use of a control unit according to the invention for operating an elevator system.

It is generally known from the prior art that a safety circuit is used to monitor an elevator system, which is laid along the elevator shaft and is formed by a plurality of safety switches connected in series. Each safety switch in the safety circuit has an open and a closed state and monitors a safety-relevant operating variable of the elevator system. Thus, for example when security personnel are carrying out maintenance work, a safety switch arranged in the safety circuit is set to the open state, and the safety circuit is thus interrupted. Since the safety circuit is operatively connected to a safety element, which in turn can influence the operating state of the drive unit of the elevator system, it is ensured that if the safety circuit is interrupted, moving (moving) the car of the elevator system is not possible. For this purpose, the safety circuit is often connected to the control input of a power contactor (main contactor). If the safety circuit is interrupted, the power contactor trips and the supply voltage is separated from the drive unit.

WO 2015/090809 discloses a security system with a safety circuit for an elevator system.

Furthermore, it is also known from the prior art that the closed state of car doors and/or landing doors is monitored by a safety switch in each case in order to prevent the car from moving an open or not completely closed car door or landing door should be avoided under all circumstances, as this represents a great potential for injury to passengers.

However, for maintenance and/or repair work, it is necessary for individual safety switches and/or groups of safety switches in the safety circuit to be bridged by electrically contacting maintenance bridges, in order to facilitate troubleshooting for defective components and/or necessary maintenance work on the elevator system, for example in the elevator shaft. However, it often happens that the maintenance bridges, which are only intended to carry out maintenance work temporarily, are left in the safety circuit on the one hand intentionally to temporarily set up a (usually only planned temporary) operation of the elevator system or, on the other hand, unintentionally purely due to the carelessness of the service personnel.

For this reason, control measurements are carried out at regular intervals in elevator systems to check the proper operating condition of the elevator system. In addition to maintenance bridges that have been left behind in an inadmissible manner, fault-related short circuits in the safety circuit can also be detected. To carry out the control measurement, the known control units have monitoring means that are designed to measure and detect intermediate voltages of the safety circuit and engagement means that include separating elements that can be connected between a closed and an open switching position. The engagement means are operatively connected to the safety circuit in such a way that either individual or groups of safety switches can be bridged by means of a path that can be switched on by the separating elements or that the safety circuit can be interrupted by opening a separating element. However, with the known control units, it occurs when carrying out the necessary control measurements Test actions in which at least one intermediate voltage is detected depending on a switch position of at least one separating element lead to an interruption of the safety circuit, which has a negative effect on the operation of the elevator system. Furthermore, in elevator systems with a main contactor (power contactor) as a safety element, the energy supply is separated from the elevator system by interrupting the safety circuit. Therefore, the necessary control measurements can only be carried out when the elevator system is at rest, i.e. in particular only when no passengers want to use the elevator. Furthermore, it is disadvantageous that the triggering of a power contactor due to the mechanical disconnection and connection of the contacts is associated with loud switching noises, which are perceived as disturbing, for example in a home and/or office environment.

For this reason, it is the object of the present invention to overcome the disadvantages known from the prior art and to provide an improved control unit for elevator systems. Furthermore, it is a particular object of the present invention to develop a control unit for an elevator system in such a way that, despite regular monitoring of the safety circuit for impermissible operating states, a complete disconnection of the drive unit from the supply voltage can be prevented.

Furthermore, the task is to specify an elevator system that includes such a control unit according to the invention.

The object is achieved with regard to the control unit for an elevator with the features of claim 1, ie in that the at least one separating element is designed such that the safety circuit is for less than 5msec, preferably less than 2.5msec, more preferably less than 1. 3msec can be interrupted in the active state of the security element, in particular the main contactor or the functional unit of the drive unit, to detect the proper operating state of the elevator system, in particular a maintenance bridge contacted in the safety circuit and/or an error-related short circuit, by at least one test action.

With regard to the elevator system, the task is solved with the features of claim 14.

Advantageous developments of the invention are specified in the subclaims.

All combinations of at least two of the features disclosed in the description, the claims and/or the figures fall within the scope of the invention.

The invention is based on the idea that the monitoring and intervention means are designed in such a way that in the active state of the safety element, i.e. in particular the main contactor, the proper operating state of the elevator system, in particular a maintenance bridge electrically contacted in the safety circuit and/or an error-related one, is verified by at least one test action Short circuit can be detected.

In other words, the control unit according to the invention enables test actions to be carried out in the active state of the security element, i.e. in particular at the same time as the car is moving. The safety element must therefore not change to the error state or the safety circuit must not be influenced and/or interrupted by the test actions in such a way that this is recognized by the safety element, so that the error state is not activated. Nevertheless, it should be possible for the correct operating condition to be ensured through at least one test action of the elevator system is checked and/or detected by evaluating the detected intermediate voltages depending on the switching positions of the separating elements in order to detect inadmissible maintenance bridges in the safety circuit and/or to detect short circuits that can be attributed in particular to faulty components.

For this purpose, it is provided within the scope of the present invention that the separating element is set up and controllable in such a way that the safety circuit can be interrupted for less than 5 msec, preferably less than 2.5 msec, more preferably less than 1.3 msec, whereby the safety element does not do this is designed and/or set up to detect such a short interruption.

In connection with the preferred design of the fuse element as a main contactor, this means that the supply voltage is connected to the drive unit via the switchable power contacts of the main contactor, with the control input of the main contactor being in operative connection with the safety circuit. Since the control input of the main contactor includes a time delay element, this results in the main contactor remaining in the closed state when the test actions are carried out. On the one hand, the comparatively short activation time of a contactor (low switching dynamics) as well as existing line inductances and/or capacitive effects in the safety circuit are advantageously exploited according to the invention, which prevent the dynamic activation of the contactor. In addition, a specially provided delay element, in particular a capacitor, can also be arranged at the control input.

Furthermore, checking and/or analyzing the safety circuit according to the invention in the closed state of the main contactor makes it possible to avoid disadvantageous switching noises from the main contactor, which This is particularly advantageous when using the control system for elevator systems in office and/or residential areas.

Alternatively, the security element can also be designed as an integrated component and/or as a functional unit of the drive unit, the drive unit comprising a converter with a control monitoring input for receiving and/or electrically contacting the safety circuit. The control input advantageously enables the safety circuit to be monitored, whereby the error condition can be triggered directly in the converter at a definable voltage level, such as a drop in the supply voltage due to an open safety switch to 0V. In this context, it can also advantageously be provided that a delay element, in particular a capacitor, is additionally arranged at the control monitoring input in order to thereby realize an adjustment in the detection speed of the functional unit directly in the hardware. Advantageously, aging processes in the capacitor lead to a shortening of the delay times, which is why no safety-relevant problems arise due to the protection concept being undermined.

In the context of the present invention, a “test action” is understood to mean the generation and/or creation of a specific switch position by means of the at least one separating element by the engagement means and the detection of at least one intermediate voltage at at least one intermediate voltage tap in the safety circuit by the monitoring means.

The expression “in the active state” of the safety element is understood to mean an operating state of the elevator system in which the elevator system is in a ready-to-use operating state, i.e. the car is dependent can be moved between the individual floors according to passenger specifications (driving operation).

A maintenance bridge can be a permanently installed circuit that can be activated by service personnel during maintenance work to activate a bypass for bridging safety switches (individual safety switches and / or groups of safety switches) of the safety circuit, whereby the separated part of the safety circuit is preferably separated from the safety circuit at least on the input side by opening a contact element. Alternatively, a maintenance bridge can also be formed by a conductor, in particular a conductive wire, which is brought into operative connection with the safety circuit to bridge the safety switches.

Thus, within the scope of the present invention, it should be possible for the car to only be moved at a reduced speed as a result of the detection of a maintenance bridge.

Monitoring the safety circuit in the active state of the security element enables an improvement in the control unit, since an analysis of the safety circuit can now be carried out not only when the elevator system is at a standstill and/or in a resting phase, but also at any time, in particular during regular operation of the elevator system Elevator system. This means that the number of tests (test that consists of at least one test action) can be increased significantly, which is why inadmissible situations and/or error-related short circuits can be detected earlier.

In a preferred embodiment, the separating elements are designed and can be controlled by appropriate driver circuits so that a switching frequency between 0.5 kHz to 30 kHz, preferably 0.5 kHz to 16 kHz, more preferably 0.5kHz to 9kHz, very particularly preferably 0.5kHz to 2kHz can be operated. This advantageously enables the use of standardized isolating elements and corresponding driver circuits, which leads to low costs. Furthermore, correspondingly designed separating elements enable the safety circuit to be interrupted and/or disconnected for such short periods of time that it is not detected by the safety element in order to advantageously carry out at least one test action according to the invention.

In a further development, it is also provided in this context that the separating element, which is provided and/or arranged in the engagement means, is designed as a switchable semiconductor component. In this context, an advantageous design of the semiconductor component as a MOSFET, IGBT and/or thyristor is particularly preferred, since these switch technologies can be operated with low losses at a high switching frequency. This enables the separating element to be implemented cost-effectively, since standardized components and/or already tried-and-tested circuit concepts can be used.

It is particularly advantageous to mention in this context that high switching speeds can be achieved using modern semiconductor components, so that despite the (very brief) interruption of the safety circuit when carrying out a test action, the safety element, in particular the power contactor or main contactor, due to component-related inertia and/or existing line inductances in the wiring and/or supply line do not switch to the error state. This not only makes it possible to carry out the corresponding test action in the active state of the safety element and thus in normal operation of the elevator system, but also makes it possible to increase the number of corresponding test and / or test measurements (sequence of different test actions), since it is now no longer necessary for the Elevator is in a resting phase when carrying out the inspection and/or test measurements, i.e. not currently transporting a passenger.

In a further development, it is provided that the engagement means for interrupting a safety circuit designed as a DC voltage circuit and for bridging one of the safety switches or a group of safety switches comprise at least three separating elements or switchable semiconductor components, which are preferably designed as a bipolar transistor, MOSFET, IGBT and / or thyristor. In connection with the design of thyristors, a preferred use of an extinguishing circuit known from the prior art is provided in order to bring the thyristor back into the blocking state. Alternatively, a combination of the semiconductor components mentioned is also conceivable. In this context, for reasons of redundancy, it can also be further provided that at least five separating elements or switchable semiconductor components, in particular MOSFETs, IGBTs and / or thyristors, are used to ensure the functionality of the safety circuit, i.e. to ensure that the safety circuit is interrupted The safety switch is permanently assigned to the safety circuit and is therefore designed to interrupt the safety circuit.

This advantageously enables the implementation of (n-1) safety, in order to still enable the safety circuit to be interrupted, particularly in the event of a defect in a separating element and a possible permanent closed switching position of the corresponding separating element. In a further development, however, it is also conceivable that the engagement means comprise a total of ten separating elements or semiconductor components in order to use the control unit according to the invention for both DC-based and AC-based safety circuits.

Furthermore, an embodiment of the present invention is also preferred, in which the control unit is designed to interact with a safety circuit with an alternating voltage as the supply voltage. Here, the engagement means advantageously comprise at least five switchable semiconductor components, the semiconductor components designed to interrupt the safety circuit being arranged twice, in particular in anti-series to one another, in order to completely block the positive and the negative half-wave of the supply voltage and to avoid that, in particular via an anti-parallel body diode MOSFETs create an unwanted current path. In this context, the self-extinguishing property of a thyristor can be advantageously exploited in connection with supply voltages designed as alternating voltage.

Furthermore, in this context, it can also be further provided that additional separating elements or semiconductor components are provided here for reasons of redundancy, i.e. to increase safety or to ensure (n-1) safety, in particular the separating elements or. designed to interrupt the safety circuit Arrange semiconductor components twice, i.e. in series with one another. In accordance with the comments on the DC voltage circuit, a safe interruption of the safety circuit can still be achieved in the event of a semiconductor element failure and a permanently closed state. In other words, it is provided in this context that the control unit or the engagement means comprise a total of ten semiconductor components, the control unit comprising a total of no more than 20 separating elements or semiconductor elements, preferably less than 16 separating elements or semiconductor elements, more preferably less than 11 separating elements or semiconductor elements should.

In addition, according to a further preferred embodiment of the present invention, it is advantageously provided that at least five intermediate voltages are detected and evaluated by the monitoring means.

For this purpose, the intermediate voltages are connected to intermediate taps of the safety circuit in order to record a measured value of the supply voltage depending on the position of the corresponding intermediate tap. This advantageously makes it possible to locate the position of an open safety switch in the safety circuit and/or to generally check or record the operating state of the elevator system. This means that maintenance bridges that are electrically contacted in the safety circuit can be detected and/or an error-related short circuit in the safety circuit, in particular due to a defective safety switch or defective separating element, can be detected.

In addition, as part of a further development of the invention, it is provided that the control unit is designed and set up in such a way that the safety circuit is in operative connection with the monitoring and/or intervention means via a total of six interfaces. Here, a bypass to safety switches of the safety circuit can be switched via an interface either by the control unit or by the intervention means in order to bridge them. Alternatively, the safety circuit can also be formed in sections using a pair of interfaces in order to completely interrupt the safety circuit by separating elements arranged in the section. Furthermore, it is also conceivable that an interface is only used to form an intermediate tap for voltage measurement.

For reasons of redundancy, it is preferably provided that the separating elements arranged in sections in the safety circuit are in pairs are arranged in the formed section of the safety circuit. In this way, if a separating element is defective, the second separating element can interrupt the safety circuit and thus trigger the fault state of the safety element. Furthermore, it is also further advantageous in this context if, especially when using MOSFETs or IGBTs as a separating element, a total of four separating elements are arranged in the section of the safety circuit, the separating elements then being connected in pairs in series and anti-series to one another.

Furthermore, it is particularly preferred if safety switches are arranged in the safety circuit, which monitor the closed state of the at least one elevator car and/or landing door, in which case the monitoring means and the intervention means are designed and set up in such a way that the switching state of the corresponding safety switches is carried out the evaluation of, in particular at least three, intermediate voltages can be detected as a function of switching positions of, in particular at least three, separating elements.

This advantageously makes it possible to further develop the control unit according to the invention in such a way that the closed state of the landing and/or car doors can be monitored at any time, which is why no additional testing and/or detection means need to be provided for this.

In a further development, the engagement means are designed such that a separating element, in particular a first separating element, is arranged via an interface, in particular via a first interface, on the output side to the safety switches of the safety circuit, which are used to monitor the closed state of the car and/or landing doors . Furthermore, the engagement means also include a further separating element, in particular a second and a third separating element, which are in operative connection with the safety circuit via interfaces, in particular via the first and the fourth interface, wherein the safety switches provided for monitoring the closed state of the doors and the first separating element can be bridged through this switchable path.

In a further development, it is also provided here that for reasons of redundancy ((n-1) security), two or four separating elements can also be provided, which are arranged either in series or anti-serial to one another. In addition, an embodiment is particularly preferred in which two separating elements are connected directly to one another in series, with two separating elements additionally being arranged in anti-series to the first two separating elements in order to ensure the functionality in terms of the blocking ability of the separating element through the paired arrangement in a safety circuit an alternating voltage as the supply voltage, which has a positive and negative half wave due to the AC component. Alternatively, a pair of switches can also be formed by two separating elements connected in anti-series, in which case two pairs of switches are then preferably electrically connected in series to one another in order to form the (n-1) security.

Such a configuration advantageously makes it possible for the safety switches provided in the safety circuit to monitor the closed car and/or landing doors to be temporarily bypassed, for example in order to initiate the opening of the doors before the car reaches its end position, without this being due to the switching the corresponding safety switch goes from the closed to the open state, causing the safety circuit to be interrupted. This advantageously makes it possible to shorten the waiting time for passengers in the car.

Furthermore, such a development of the control unit also makes it possible for a step which is formed between the floor and the car floor in a stopping position of the car, which arises due to a change in load caused by the boarding and alighting of passengers, to be advantageously compensated for by activating the drive unit . This advantageously eliminates the need for additional control devices that would otherwise be required to bridge the safety circuit and/or to control the drive unit in order to compensate for the step caused by the movement of the car.

In this context, it should also be mentioned that a loss of propulsion capability of the elevator system can also be detected by the control unit, in which case emergency systems, such as a mechanical brake, can then be activated in order to avoid further damage. Thus, with a corresponding development of the control unit according to the invention, relevant control devices also become unnecessary.

In addition, as part of a further preferred embodiment of the control unit, it is provided that the monitoring means are designed and set up in such a way that a first intermediate voltage SR1_out can be measured in order to detect the voltage potential at a first intermediate tap, which is in the safety circuit on the positive contact pin or positive Connection of the fuse element is arranged, so in particular the voltage at the control input of the main contactor is detected.

Furthermore, it is additionally or alternatively also provided that a second intermediate voltage ACD1 can be detected in order to detect the voltage at a second intermediate tap, which is on the negative contact pin/connection of the at least one safety switch for monitoring the closed state of the car door is arranged and / or that a third intermediate voltage SCD1 can be detected in order to detect the voltage at a third intermediate tap, the third intermediate tap between the at least one safety switch for monitoring the closed state of the at least a landing door and the at least one safety switch for monitoring the closed state of the at least one car door is arranged.

In addition, it is also provided in this context that a fourth intermediate voltage OC_out is detected at a fourth intermediate tap, the fourth intermediate tap being arranged in the safety circuit on the output side of the upper interface pair, in particular directly at the fifth interface.

Finally, the monitoring means can also be designed such that a fifth intermediate voltage OC_in can be detected at a fifth intermediate tap of the safety circuit, the fifth intermediate tap being arranged on the input side of the upper pair of interfaces, in particular at the sixth interface.

In a further development or in addition, the fourth intermediate tap can also be provided on the positive contact pin/connection of the safety switch first arranged in the safety circuit, in particular by contacting a, preferably permanently installed, maintenance bridge, the fifth intermediate tap is coupled together with the one safety switch or the group of safety switches Switch is disconnected from the safety circuit.

The designation positive contact pin / positive connection / positive contacting pin indicates the connection of the safety switch or security element understood, which is arranged closer to the supply voltage. Thus, the negative contacting pin/negative connection/negative contact pin of a safety switch is the connection of the safety element which faces away from the supply voltage in the safety circuit, i.e. is at the negative potential and is therefore arranged in particular closer to the safety element or in particular to the main contactor.

The detection and evaluation of the intermediate voltages defined above advantageously makes it possible to detect the state of the intermediate circuit and thus the safety-relevant operating status of the elevator system, whereby a maintenance bridge contacted in the safety circuit and/or a fault-related short circuit can also advantageously be detected during the active state of the safety element.

In addition, it is further provided that the engagement means are designed and set up in such a way that the first can be connected to the second intermediate tap by a first separating element. Furthermore, it is further provided that the first can be connected to the fourth intermediate tap by a second separating element, preferably via two separating elements connected in series or anti-series to one another, more preferably via four separating elements, in particular in pairs, connected in series or anti-serial. Furthermore, it is also preferably provided if the fourth and fifth intermediate taps can be connected to one another by a third separating element, preferably via two separating elements connected in series or anti-series, more preferably via four separating elements, in particular in pairs, connected in series or anti-series. By switching the separating elements on or off and thus connecting a parallel path and/or interrupting the safety circuit at different points, the safety circuit can be advantageously influenced in such a way that by detecting the intermediate voltages the state of the safety circuit can be analyzed, whereby it is advantageously possible for safety switches bridged by maintenance bridges and/or error-related short circuits to be detected.

Furthermore, a preferred embodiment of the control unit according to the invention includes monitoring and intervention means which are designed and set up in such a way that a test of several test actions or a fixed sequence of test actions for monitoring the operating state of the elevator system, in particular for detecting maintenance bridges and/or electrically contacted in the safety circuit or a fault-related short circuit is/are carried out every 60 seconds, preferably every 30 seconds, more preferably every 10 seconds. Within the scope of the present invention, the number of measurements for checking the functionality of the separating elements can advantageously be reduced, since it has previously been common practice, for example due to aging and/or wear effects when using mechanical switches, such as preferably relays functionality could only be checked every 24 hours. This has the advantageous effect that malfunctions can be detected much earlier.

In a further development, the monitoring and intervention means are designed such that a corresponding sequence of predefined test actions for monitoring the operating state of the elevator system, in particular for detecting maintenance bridges electrically contacted in the safety circuit and / or an error-related short circuit, lasts a maximum of 1sec, preferably 500msec, more preferably 250msec, completely particularly preferably lasts 100msec. In this context, it is provided within the scope of the invention that the sequence of predefined test actions is combined in such a way that the safety circuit is not interrupted for longer than the value defined above. Advantageous in connection with safety circuits With an alternating voltage, the positive and/or negative zero crossing of the supply voltage is used to generate the pauses, with the first test action being started in particular in response to the detection of a positive and/or negative zero crossing.

In addition, a further development of the present control unit includes a counter unit whose output value, counter value and/or sensor output signal can be started in response to the result of a test action, for example a missing voltage at an intermediate tap. Furthermore, the further developed control unit also includes communication means that are designed and/or set up to transmit a sensor output signal, whereby the sensor output signal can be influenced either indirectly or directly by the counter unit or can result from it. The effect that results from this development is based on the realization of a temporary driving operation, i.e. only permitted for a certain period of time, in particular with a limited travel speed of the car, in particular in order to approach intermediate positions.

In the context of the present invention, however, protection is also claimed for the use of the control unit according to the invention for operating an elevator system and for monitoring the operating state of the elevator system, in particular for detecting maintenance bridges that are inadmissibly contacted in the safety circuit of the elevator system and/or a fault-related short circuit.

Furthermore, the present invention also claims protection for a system comprising an elevator system and a control unit according to the invention.

Further advantages, features and details of the invention result from the following description of preferred exemplary embodiments and from the drawings.

Fig. 1:

eine schematische Darstellung einer bevorzugten Ausführungsform der erfindungsgemäßen Steuereinheit für eine Aufzugsanlage,

Fig. 2:

eine schematische Darstellung von Schaltzuständen, die bei einem Test umfassend mehrere Prüfaktionen von der erfindungsgemäßen Steuereinheit 1 durchgeführt werden,

Fig. 3:

eine schematische Darstellung von Schaltzuständen, die bei einem weiteren, mehrere Prüfaktionen umfassenden Test ausgeführt werden, und

Fig. 4:

eine weitere schematische Darstellung eines weiteren Tests, der im Betrieb der Aufzugsanlage bei geschlossenen Fahrkorb- und Etagentüren ausgeführt wird.

These show in:

Fig. 1:

a schematic representation of a preferred embodiment of the control unit according to the invention for an elevator system,

Fig. 2:

a schematic representation of switching states that are carried out by the control unit 1 according to the invention in a test comprising several test actions,

Fig. 3:

a schematic representation of switching states that are carried out in a further test comprising several test actions, and

Fig. 4:

Another schematic representation of another test that is carried out while the elevator system is in operation with the car and landing doors closed.

The Fig. 1 shows the schematic structure of a preferred embodiment of a control unit 1 according to the invention. The control unit 1 shown is designed to interact with a safety circuit 3, which is formed by a large number of safety switches 4 connected in series. The safety switches 4 are switched between an open state, which prohibits travel, and a closed state, which enables travel, depending on the safety-relevant operating conditions of the elevator system.

The safety circuit 3 is fed on the input side by a supply voltage 10, which can be designed either as an alternating voltage or as a direct voltage, which is the case in Fig. 1 Embodiment shown is a direct voltage.

The safety circuit 3 is in operative connection on the output side with a safety element 7, which in the present case is designed as a main contactor 8, the control input of which is connected to the safety circuit 3. As soon as the safety circuit 3 is interrupted and there is no voltage at the control input of the main contactor 8, the main contactor 8 opens and disconnects the drive unit 2, which is connected via the power contacts of the main contactor 8, from its energy supply. This ensures that the car does not move when the safety circuit 3 is open, since the drive unit 2 is not ready to drive without a power supply or without a supply voltage.

In addition, maintenance bridges 5 can be integrated into the safety circuit 3, in particular for carrying out maintenance and/or repair work, in order to bridge individual safety switches 4 or groups of safety switches 4 by connecting a parallel path.

A corresponding maintenance bridge 5 is in the Fig. 1 realized by a permanently installed circuit, which by actuating a switch 17 switches on a bypass to the safety circuit 3, which bridges all safety switches of a first group of safety switches 18, not shown in detail.

A safety switch (not shown) of the first group of safety switches 18 monitors a safety gear, not shown, in order to mechanically fix the car in the elevator shaft in the event of a fault.

Interrupting the safety circuit 3 ensures that the drive unit 2 is separated from the energy supply. To reset the safety gear, the open safety switch must first be bridged by switching on the maintenance bridge 5 implemented by the permanently installed circuit. Since all safety switches of the first group 18 are bridged in this operating state, this leads to a safety-relevant critical operating state of the elevator system. In order to interrupt a journey, all separating elements in the safety circuit 3 are opened, which means that the safety element 7 can still advantageously be put into the error state in order to switch off the drive unit 2.

In addition to the safety switches of the first group 18, the safety circuit 3 also includes further safety switches 41, 42 which monitor the closed state of the at least one car door and the closed state of the at least one landing door. For reasons of clarity, in the Fig. 1 only a safety switch is shown for the corresponding functionality in relation to all floor doors and all car doors of the elevator system. However, it is clear from the illustration that the safety circuit 3 is interrupted by opening a door (car door or landing door) in order to prevent the car from moving when the door is open.

Furthermore, the control unit 1 shown comprises monitoring means 9 for measuring and evaluating intermediate voltages which are tapped at various intermediate taps 6 of the safety circuit 3 and engagement means 11 which are operatively connected to the safety circuit 3 in such a way that the safety circuit 3 is interrupted by means of at least one separating element 12 can and/or individual safety switches 4 or groups of safety switches 4 can be bridged by closing a separating element 12. The separating elements 12 are like this for this purpose designed so that they can be switched between a closed and an open switching position.

The separating elements 12 are controlled and the intermediate voltages are evaluated with two, not one Fig. 1 microcontroller shown. The corresponding measurement and control signal flows are in the Fig. 1 schematically sketched using small arrows on the separating elements 12 and the intermediate taps 6.

The monitoring means 9 and the intervention means 11 are advantageously set up and designed to carry out a test action. In the context of the present invention, a test action is understood to mean that at least one intermediate voltage is detected depending on a switching position of the at least one separating element 12, and a sequence of several test actions can also be carried out to determine the operating state of the elevator system.

The detection and evaluation of intermediate voltages depending on different switching positions of the separating elements 12 (testing action) advantageously enables electrically contacted maintenance bridges 5 and/or a fault-related short circuit in the safety circuit 3 to be detected. This allows the proper operating condition of the elevator system to be checked.

According to the invention, the monitoring means 9 and the engagement means 11 are advantageously designed in such a way that in the active state of the safety element 7, i.e. when the main contactor 8 is in the closed switching position, at least one test action can be carried out in order to monitor the proper operating state of the elevator system and in particular in order to electrically contacted in safety circuit 3 To detect maintenance bridges 5 and/or an error-related short circuit.

Furthermore, the control unit 1 shown is in operative connection with the safety circuit 3 of the elevator system via six interfaces 51, 52, 53, 54, 55, 56. Here, the safety circuit 3 is formed in sections by the upper interface pair 19, which is formed by the fifth interface 55 and the sixth interface 56, with separating elements 12 designed to interrupt the safety circuit 3 being arranged in the section of the safety circuit 3 formed by the control unit 1 .

The ones in the Fig. 1 Control unit 1 shown comprises a total of five separating elements 12, which are designed as switchable semiconductor components 13 in the preferred embodiment of a field effect transistor (MOSFET) 14. Since the control unit 1 shown is designed to interact with the safety circuit 3 powered by a DC voltage, it does not include MOSFETs 14 connected in anti-series. However, for reasons of redundancy, two MOSFETs 14 are arranged in series with one another in order to still be able to disconnect the safety circuit 3 in the event of a fault in one MOSFET 14 make possible.

Furthermore, the control unit also includes a lower interface pair 20, which is formed by the first interface 51 and the fourth interface 54, and which is operatively connected to the safety circuit 3 in such a way that the safety switches 41 provided for monitoring the closed state of the car and landing doors , 42 can be bridged by separating elements that are in a closed switching position.

In addition, to carry out the at least one test action, the monitoring means 9 are designed so that a total of five intermediate voltages can be detected.

So it is initially possible for a first intermediate voltage SR1_out to be detected at a first intermediate tap 21, which is the voltage at the positive contacting pin of the fuse element 7. In the present case, the control voltage of the main contactor 8 is detected on the input side, whereby the operational state of the elevator system can always be determined.

Furthermore, a second intermediate voltage ACD1 is detected at a second intermediate tap 22, the second intermediate tap 22 being arranged on the negative contacting pin of the at least one safety switch 42, which monitors the closed state of the car door.

A third intermediate voltage SCD1 is detected at a third intermediate tap 23, which is arranged between the at least one safety switch 41 for monitoring the closed state of the landing door and the at least one safety switch 42 for monitoring the closed state of the at least one car door.

In addition, a fourth intermediate tap 24 is provided for contacting a fourth intermediate voltage OC_out, the fourth intermediate tap 24 being arranged on the output side of the upper interface pair 19, i.e. directly on the fifth interface 55.

A fifth intermediate voltage OC_in is measured at a fifth intermediate tap 25 of the safety circuit 3, the fifth intermediate tap 25 being arranged on the input side of the upper interface pair 19, i.e. at the sixth interface 56.

Furthermore, it is also clear from the illustrated circuit of the control unit 1 that the first intermediate tap 21 can be connected to the second intermediate tap 22 via a first separating element 31, this separating element being designed as a MOSFET 14.

Furthermore, it can also be seen that the first interface 51 is connected to the fourth interface 54 via a second separating element 32 and a third separating element 33, the second separating element 32 and the third separating element 33 being connected in series with one another.

In addition, the fourth intermediate tap 24, which is at the potential of the fifth interface 55, can be connected to the fifth intermediate tap 25 (the sixth interface 56) via a fourth separating element 34 and a fifth separating element 35, the fourth separating element 34 and the fifth separating element 35 are connected in series to each other.

Furthermore, the control unit 1 shown comprises a counter unit 15, shown purely schematically, which can be controlled in response to the result of a test action. In addition, the control unit 1 has communication means 16 in order to transmit a control variable to a communication partner, not shown, depending on a sensor output signal of the counter unit 15 and/or a detected intermediate voltage, for example in order to enable the elevator system to operate at a reduced travel speed and/or changed speed for a limited time To enable end positions of the car in the elevator system.

During operation of the elevator system, the control unit 1 according to the invention carries out a sequence of test actions every 10 seconds in order to monitor the operating status of the elevator system. It will be beneficial for that Timing of the test actions the positive zero crossing of the supply voltage 10 is recorded and used to start a test action.

Due to the high switching speed, the separating elements 12 implemented as MOSFETs 14 advantageously enable, according to the invention, the safety circuit 3 to be interrupted for such a short period of time that this does not trigger the main contactor 8.

The Fig. 2 shows a section of the monitoring means 9 and the engagement means 11 to illustrate the test actions carried out by the control unit 1 according to the invention, four test actions with corresponding switch positions of the fourth separating element 34 and the fifth separating element 35 being shown.

In a first test action shown in area A, the fourth separating element 34 and the fifth separating element 35 are first closed by the engagement means 9 and then the two intermediate voltages OC_in at the fourth intermediate tap 24 and OC_out at the fifth intermediate tap 25 are detected. The measurement result is then compared with empirical values, whereby for a proper operating state of the safety circuit 3 and/or the elevator system, the intermediate voltage OC_in and the intermediate voltage OC_out must have a positive measured value that is dependent on the supply voltage 10.

In the second test action shown in area B, the fifth separating element 35 is then opened and the two intermediate voltages are recorded and evaluated again. The measurement results are now checked to see whether no voltage was measured at the intermediate voltage OC_out, whereby OC_in must still have a voltage value. If this is not the case, an error is generated

In the third test action shown in area C, the fourth separating element 34 and the fifth separating element 35 are opened, with only the intermediate voltage OC_in being allowed to have a voltage value in the following voltage measurement.

Finally, in the fourth test action shown in area D, only the fourth separating element 34 is opened and the two intermediate voltages OC_in and OC_out are again recorded and evaluated to determine whether a voltage value was only recorded at the upper intermediate voltage OC_in.

If the detected intermediate voltages do not correspond to the empirical value, either a short circuit of the fourth separating element 34 or the fifth separating element 35 can be detected. Alternatively, the connection can also be made in the Fig. 2 Maintenance bridge 5 shown can be recognized or - if no voltage value is measured at all - a missing supply voltage or a defect in the measuring device can be detected. Furthermore, others can also be included Fig. 1 Maintenance facilities that are not shown in detail (“inspection control”) may be the cause of the unmeasurable voltages.

The sequence of four test actions described above as an example illustrates the inventive design of the control unit 1. Since the safety circuit 3 is interrupted by opening the fourth separating element 34 or the fifth separating element 35, it is important that a corresponding switching position is realized for a very short time becomes. It can thus be ensured that despite the safety circuit 3 being interrupted, the safety element 7, which is not in the Fig. 2 is shown, remains in the active state. For this purpose, it may make sense to insert artificial pauses between the individual test actions, which in particular prevent dynamic effects and/or the formation of a ripple in the safety circuit. It is essential that during a Pause a switching position of the separating elements (12) is realized in which the safety circuit 3 is not interrupted.

The Fig. 3 shows a further test comprising several test actions, which is carried out as part of the control unit 1 according to the invention. According to the one from the Fig. 2 known representation, a corresponding circuit diagram is shown in areas A to D for each test action, which shows the open or closed state of the safety switch 41, 42 in the safety circuit 3 and also shows the realized switching position of the separating elements 31, 32, 33 correspondingly integrated in the test .

The test actions shown are always carried out when the safety switches 41, 42, which monitor the closed state of the at least one car door and the at least one landing door, are bypassed. Furthermore, breaks are inserted between the individual test actions in order to avoid that the interruption of the safety circuit 3 leads to the triggering of the error state of the security element 7 or the main contactor 8. During a break, the switching position of the separating elements 32, 33 shown in area A is understood in the present test operation, since the safety circuit 3 is not interrupted.

In the switching state shown in area A, which corresponds to the switching position when bridging the safety switches 41, 42, the safety switches 41, 42 of the safety circuit 3 are bridged by the second separating element 32 and the third separating element 33. The intermediate voltage SR1_out is then detected and evaluated to determine whether a voltage is present.

During the second test action shown in area B, the third separating element 33 and the first separating element 31 are opened for a very short time, in order to then evaluate the intermediate voltage SR1_out again to determine whether there is no voltage present at the corresponding first intermediate tap 21.

In a third test action, which is shown in area C, all separating elements 31, 32, 33 are now put into the open switching state in order to check again whether no voltage can actually be detected at the first intermediate tap 21 (intermediate voltage SR1_out).

Finally, the last test action follows, in which the third separating element 33 is closed again and the intermediate voltage SR1_out is checked again for absence of voltage.

Furthermore, as part of this test action or another test action, the second intermediate voltage ACD1 at the second intermediate tap 22 and/or the third intermediate voltage SCD1 at the third intermediate tap 23 can additionally or alternatively be detected and evaluated. This advantageously allows the open or closed state of the landing and/or car door to be detected depending on the switching position of the first separating element 31.

In the Fig. 4 Another test is shown, which is characterized by two test actions. The corresponding test actions are always carried out when the two safety switches 41, 42 are not bridged by the separating elements 32, 33 arranged in parallel.

During this test, the first separating element 31 is initially closed and it is checked whether there is a voltage in the safety circuit 3 at the first intermediate tap 21 (intermediate voltage SR1_out) (compare area A).

The first separating element 31 is then opened for a short period of time and the intermediate circuit voltage SR1_out is detected again and evaluated to determine whether it is now voltage-free. If this is not the case, a malfunction in the circuit can be detected and the safety circuit 3 can be interrupted by opening all of the separating elements (12).

As a result, the present invention enables the optimization of control units known from the prior art in a surprisingly simple manner in order to monitor the operating state of an elevator system in a particularly cost-effective manner by analyzing the safety circuit.

Reference symbol list

• 1 control unit
• 2 drive unit
• 3 safety circuit
• 4 safety switches
• 5 maintenance bridge
• 6 intermediate taps
• 7 safety element
• 8 main contactor
• 9 means of surveillance
• 10 supply voltage
• 11 means of intervention
• 12 separator
• 13 switchable semiconductor component
• 14 MOSFET
• 15 counter unit
• 16 means of communication
• 17 switches/buttons
• 18 first group of safety switches
• 19 upper pair of interfaces
• 20 lower interface pair
• 21 first intermediate tap
• 22 second intermediate tap
• 23 third intermediate tap
• 24 fourth intermediate tap
• 25 fifth intermediate tap
• 31 first separating element
• 32 second separating element
• 33 third separating element
• 34 fourth separating element
• 35 fifth separator
• 41 floor door safety switch
• 42 Car door safety switch
• 51 first interface
• 52 second interface
• 53 third interface
• 54 fourth interface
• 55 fifth interface
• 56 sixth interface

Claims (14)

1. A control unit (1) for an elevator installation,

   said control unit (1) having an elevator car movable between floors along an elevator shaft and a drive unit (2) for moving the elevator car between the floors,

   the control unit (1) being realized for interacting with a safety circuit (3) which is in particular laid through the elevator shaft and which is realized by a plurality of safety switches (4) which are interconnected in series and which are switchable between an open state interrupting the travel operation and a closed state enabling the travel operation as a function of safety-related operating conditions of the elevator installation, the safety circuit (3), in particular at least one safety switch (4, 18), being capable of being bypassed sectionally by contacting a maintenance bridge (5),

   having intermediate taps (6, 21, 22, 23, 24, 25) for tapping an intermediate voltage, said intermediate taps being disposed in the safety circuit (3),

   having a safety element (7), in particular a main contactor (8) or a functional unit of the drive unit, said safety element (7) being actuable by the safety circuit (3) to the effect

   that, in the case of the interrupted safety circuit (3), a fault state of the safety element (7) is activated in order to switch off the drive unit (2), in particular in order to disconnect the supply voltage from the drive unit (2), and that, in the case of the closed safety circuit (3), an active state of the safety element (7) is activated in order to operate the drive unit (2) for realizing the travel operation, in particular in order to connect the drive unit (2) to the supply voltage,

   having monitoring devices (9) for measuring and evaluating intermediate voltages and intervention devices (11) being in an active connection with the safety circuit (3) to the effect that the safety circuit (3) is interruptible and/or at least one safety switch (4) is capable of being bypassed by means of at least one disconnecting element (12, 31, 32, 33, 34, 35) which is switchable between a closed and an open switch position, the monitoring devices (9) and the intervention devices (11) being configured and realized to perform a test action in order to record at least one intermediate voltage as a function of a switch position of the at least one disconnecting element (12, 31, 32, 33, 34, 35),

   characterized in that

   the at least one disconnecting element (12, 31, 32, 33, 34, 35) is realized to the effect that the safety circuit (3) is interruptible for less than 5 msec, preferably less than 2.5 msec, further preferably less than 1.3 msec, in order to detect the regular operating state of the elevator installation, in particular a maintenance bridge (5) contacted in the safety circuit (3) and/or a short circuit due to a fault, in the active state of the safety element (7), in particular the main contactor (8) or the functional unit of the drive unit (2), by means of at least one test action.
2. The control unit according to claim 1,
   characterized in that
   the disconnecting element (12, 31, 32, 33, 34, 35) is realized to the effect that it is operable with a switching frequency between 0.5 kHz to 30 kHz, preferably 0.5 kHz to 16 kHz, further preferably 0.5 kHz to 9 kHz, most preferably 0.5 kHz to 2 kHz.
3. The control unit according to claim 1 or 2,
   characterized in that
   the disconnecting element (12, 31, 32, 33, 34, 35) is realized as a switchable semiconductor device (13), in particular as a bipolar junction transistor, MOSFET (14), IGBT and/or thyristor.
4. The control unit according to any one of claims 1 to 3,
   characterized in that
   the intervention devices (11) comprise at least three disconnecting elements (12, 31, 32, 33, 34, 35), preferably switchable semiconductor devices (13), further preferably MOSFETs (14), IGBTs and/or thyristors, for interrupting a safety circuit (3) realized as a DC voltage circuit and for bypassing the safety switches (4).
5. The control unit according to any one of claims 1 to 3,
   characterized in that
   the intervention devices (11) comprise at least five disconnecting elements (12, 31, 32, 33, 34, 35), preferably switchable semiconductor devices (13), further preferably MOSFETs (14), IGBTs and/or thyristors, for interrupting a safety circuit (3) realized as an AC voltage circuit and for bypassing the safety switches (4).
6. The control unit according to any one of claims 1 to 5,
   characterized in that
   the monitoring devices (9) are realized to the effect that at least five intermediate voltages are recorded and/or evaluated.
7. The control unit according to any one of claims 1 to 6,
   characterized in that
   the control unit (1) has at least six interfaces (51, 52, 53, 54, 55, 56) for interacting with the safety circuit (3), at least one disconnecting element (12), preferably two, in particular a fourth disconnecting element (34) and a fifth disconnecting element (35), further preferably four disconnecting elements (12), which are in particular interconnected in pairs, serially or anti-serially, being connectable to and/or capable of being integrated into the safety circuit (3) by means of an upper interface pair (19) of a fifth and a sixth interface (55, 56) in order to interrupt the safety circuit (3) in the case of an open switch position of the at least one disconnecting element (12).
8. The control unit according to any one of claims 1 to 7,
   characterized in that
   the intervention devices (11) are realized and configured to the effect that a first disconnecting element (31) is disposed, in particular by means of the second interface (52), on the output side with respect to the safety switches (41, 42) used to monitor the closed state of the elevator car door and/or floor door, the safety switches (41, 42) used to monitor the closed state of the elevator car door and/or floor door and the first disconnecting element (31) being capable of being bypassed by means of at least another disconnecting element (12), preferably two disconnecting elements, which are in particular a second disconnecting element (32) and a third disconnecting element (33) and which are interconnected serially or anti-serially, further preferably four disconnecting elements (32, 33), which are in particular interconnected in pairs, serially or anti-serially, said disconnecting element(s) being connected to the first interface (51) and the fourth interface (54) in particular on the input side and output side.
9. The control unit according to claim 7 or 8,
   characterized in that

   the monitoring devices (9) are realized and configured to the effect that a first intermediate voltage SR1_out for contacting a first intermediate tap (21) disposed on the positive contacting pin of the safety element (7), in particular at the control input of the main contactor (8), is measurable and/or

   that a second intermediate voltage ACD1 for contacting a second intermediate tap (22) disposed on the negative contacting pin of the at least one safety switch (42) for monitoring the elevator car door is measurable and/or

   that a third intermediate voltage SCD1 for contacting a third intermediate tap (23) disposed between the at least one safety switch (41) for monitoring the at least one floor door and the at least one safety switch (42) for monitoring the at least one elevator car door is measurable and/or

   that a fourth intermediate voltage OC_out for contacting a fourth intermediate tap (24) disposed on the output side with respect to the upper interface pair (19), in particular at the fifth interface (55), is measurable and/or

   that a fifth intermediate voltage OC_in for contacting a fifth intermediate tap (25) disposed on the input side with respect to the upper interface pair (19), in particular at the sixth interface (56), is measurable.
10. The control unit according to claim 9,
    characterized in that

    the intervention devices (11) are realized and configured to the effect that the first intermediate tap (21) is connectable to the second intermediate tap (22) via a first disconnecting element (31) and/or that the first intermediate tap (21) is connectable to the fourth intermediate tap (24) via a second disconnecting element (32), preferably via two disconnecting elements interconnected serially or anti-serially, further preferably via four disconnecting elements interconnected serially or anti-serially, and/or

    that the fourth intermediate tap (24) is connectable to the fifth intermediate tap (25) via a fourth disconnecting element (34), preferably via two disconnecting elements interconnected serially or anti-serially, further preferably via four disconnecting elements interconnected serially or anti-serially.
11. The control unit according to any one of claims 1 to 10,
    characterized in that

    the monitoring devices (9) and intervention devices (11) are realized to the effect that a test comprising a fixed sequence of test actions for monitoring the operating state of the elevator installation, in particular for detecting maintenance bridges (5) electrically contacted in the safety circuit (3) and/or a short circuit due to a fault, is carried out every 60 seconds, preferably every 30 seconds, further preferably every 10 seconds, and/or

    the monitoring devices (9) and intervention devices (11) are realized to the effect that a test comprising a fixed sequence of test actions for monitoring the operating state of the elevator installation, in particular for detecting maintenance bridges (5) electrically contacted in the safety circuit (3) and/or a short circuit due to a fault, takes maximally 1 sec, preferably 500 msec, further preferably 250 msec, most preferably 100 msec.
12. The control unit according to any one of claims 1 to 11,
    characterized by
    a counting unit (15) controllable in response to a result of a test action and communication devices (16) realized for transmitting a sensor output signal, which is capable of being influenced by the counting unit (15), in order to enable, in particular for a limited period of time, a travel operation of the elevator installation with a reduced travelling speed of the elevator car.
13. A use of a control unit (1) according to any one of claims 1 to 12 for monitoring the operating state of an elevator installation, in particular for detecting maintenance bridges (5) electrically contacted in the safety circuit (3) of the elevator installation and/or a short circuit due to a fault.
14. An elevator installation having a control unit (1) realized according to any one of claims 1 to 12.

Images