EP4146576A1

EP4146576A1 - Method for operating a passenger conveyor system by reliably configuring an electronic safety device

Info

Publication number: EP4146576A1
Application number: EP21718889.5A
Authority: EP
Inventors: David Michel
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2020-05-08
Filing date: 2021-04-16
Publication date: 2023-03-15
Also published as: WO2021223982A1; CN115515878A; US20230219785A1

Abstract

The invention relates to a method for operating a passenger conveyor system (1) and to a passenger conveyor system which is suitable for carrying out said method. The passenger conveyor system comprises a controller (11) for controlling functionalities of the passenger conveyor system, and a safety device (17) for checking a safety-relevant function of the passenger conveyor system. The safety device can be configured into a configured state by inputting a target configuration parameter (47), in order to check the safety-relevant function according to particular specifications. The method comprises: receiving, by the controller, a first configuration parameter (41) and a second configuration parameter (43) generated independently of said first configuration parameter; transmitting the first and the second configuration parameter to the safety device, wherein the first configuration parameter (41) and the second configuration parameter (43) concern the same target configuration parameter (47); comparing the first and the second configuration parameter in the safety device; and, in the event that the first and the second configuration parameter match within a specified tolerance, inputting a corresponding target configuration parameter (47) into the safety device and transmitting the target configuration parameter and/or a configured signal (49) from the safety device to the controller. The controller controls the functionalities of the passenger conveyor system on the basis of whether the target configuration parameter (47) and/or the configured signal (49) have been received by said controller.

Description

Method for operating a passenger transport system by reliable

Configure an electronic security device

The present invention relates to a method for operating a passenger transportation system and a passenger transportation system configured to carry out this method, a computer program product and a computer-readable medium.

Passenger transport systems such as elevators, escalators or moving walks are used as devices permanently installed in buildings to transport people and / or objects.

Aspects and embodiments of the invention are described below predominantly with reference to a passenger transport system designed as an elevator system. However, the aspects and embodiments described can also be implemented for other types of passenger transport systems.

Passenger transport systems generally have to meet high safety requirements. For this purpose, several safety devices are typically provided in passenger transportation systems, with the aid of which safety-relevant functions of the passenger transportation system can be controlled, i.e. actively controlled or at least passively monitored. Such safety-relevant functions can include, for example, measurement processes with the aid of which a current state or current conditions within the passenger transport system can be determined, so that information obtained in the process can be taken into account when the passenger transport system is operated.

For example, a safety device in the form of a door sensor or door switch in an elevator system can be used to determine whether an elevator door is correctly closed, so that an elevator controller based on the information provided by several such safety devices on different elevator doors of the Elevator system are transmitted, can decide whether an elevator car may be moved or whether this is temporarily not permitted due to the fact that at least one elevator door is not correctly closed.

Other safety devices can be configured to provide information about the position at which an elevator car is currently located in an elevator shaft and / or how fast the elevator car is currently moving through the elevator shaft. For this purpose, for example, a sensor can be moved through the elevator shaft together with the elevator car and read out local information held stationary within the elevator shaft, from which conclusions can then be drawn about the current position of the elevator car and the current speed of the elevator car. Based on this information, an elevator controller can move the elevator car precisely to the desired positions. Such a safety device can also monitor that a configurable maximum speed of the elevator car is not exceeded and trigger appropriate safety measures when an excess is detected.

Another type of safety device can be used to detect whether an elevator car is located within a tolerance range above and below a stop position on a floor. Based on this information, the elevator control can, for example, decide that elevator doors may already be opened before the elevator car has actually reached a targeted stop position, i.e. while the elevator car is still moving within the tolerance range (so-called pre-opening). In addition, contrary to an otherwise applicable rule that the elevator car may not be moved as long as an elevator door is not completely closed, an elevator control can exceptionally permit a slow movement of the elevator car as long as the elevator car is within the tolerance range around the stop position, thereby for example a To be able to effect level adjustment (so-called relevelling) when passengers enter or leave the elevator car and thereby the load and ultimately the position of the elevator car change.

In modern passenger transport systems, the safety devices can be adapted to specific situation-specific and / or system-specific operating conditions and / or properties of the passenger transport system are adapted. Such safety devices can thus be referred to as configurable safety devices. For this purpose, the safety devices can be configured by entering configuration parameters in a state in which they control the function to be controlled by them according to certain specifications. Such a state is hereinafter referred to as the configured state. Before a safety device has not been put into this configured state by entering the configuration parameters required by it in a situation-specific or system-specific manner, the safety device must not be operated in the passenger transport system, so that the entire passenger transport system is usually not yet ready for operation.

In modern passenger transport systems, safety devices are increasingly being implemented using electronic and / or programmable circuits. On the one hand, this can lead to the safety devices being able to be adapted to different operating conditions and / or ambient conditions, for example by being able to individually adapt the functions to be monitored in a predetermined manner by storing system-specific and / or situation-specific configuration parameters to control. The safety devices can work particularly reliably, be inexpensive and / or can be easily serviced. On the other hand, it can be a challenge to ensure that the configuration parameters used to program the safety devices are correct.

WO 2019/011828 A1 describes a method for configuring safety-relevant configuration parameters in a passenger transport system. In the patent application EP 19179416, which was filed by the applicant of this application at an earlier point in time, a method for operating a passenger transport system with an electronically sealable safety device is described.

Among other things, there may be a need for an alternative approach in order to be able to configure safety devices in passenger transport systems in the simplest and most reliable way possible. There may also be a need for a passenger transport system, which is designed to carry out such an approach. Finally, there may be a need for a computer program product designed to carry out the approach presented and a computer-readable medium that stores it.

Such a need can be met by the subject matter according to one of the independent claims. Advantageous embodiments are defined in the dependent claims and the description below.

According to a first aspect of the invention, a method for operating a passenger transport system is proposed. The passenger transportation system has a controller for controlling functionalities of the passenger transportation system and at least one safety device for controlling a safety-relevant function of the passenger transportation system. The safety device can be configured in a configured state by storing a target configuration parameter in order to control the safety-relevant function according to certain specifications. The method has at least the following steps, preferably in the specified order:

The controller receives a first configuration parameter and a second configuration parameter created independently of the first configuration parameter, the first configuration parameter and the second configuration parameter relating to the same target configuration parameter;

- Transmission of the first configuration parameter and the second configuration parameter to the safety device; and

- Comparing the first configuration parameter and the second configuration parameter in the safety device and, in the event that the first and the second configuration parameter match within a predetermined tolerance, storing a target configuration parameter corresponding to the first and second configuration parameter in the security device and transmitting the target - Configuration parameters and / or a configured signal from the safety device to the controller. The controller controls the functionalities of the passenger transport system depending on whether the target configuration parameter and / or the configured signal has been received from it.

It is possible here for several first configuration parameters and several second configuration parameters to be transmitted to one or more safety devices and for several target configuration parameters to be derived therefrom, which are stored in one or more of the safety devices.

According to a second aspect of the invention, a passenger transportation system is proposed which has a controller for controlling functionalities of the passenger transportation system and at least one safety device for controlling a safety-relevant function of the passenger transportation system. The safety device can be configured in a configured state by storing a configuration parameter in order to control the safety-relevant function according to certain specifications. The controller and the safety device are configured to carry out or control the method according to an embodiment of the first aspect of the invention.

According to a third aspect of the invention, a computer program product is described which, when it is executed in a processor-controlled controller for controlling functionalities of a passenger transport system and a processor-controlled safety device for controlling a safety-relevant function of the passenger transport system, instructs the latter to use the method according to an embodiment of the first aspect of the invention execute or control.

According to a fourth aspect of the invention, a computer-readable medium is described on which the computer program product according to an embodiment of the third aspect of the invention is stored.

Possible features and advantages of embodiments of the invention can be viewed, inter alia and without restricting the invention, as being based on the ideas and findings described below. As already briefly stated in the introduction, modern passenger transport systems generally have several safety devices in order to be able to control safety-relevant functions and thus ensure safe operation of the passenger transport system. The safety devices can be configured individually in order to be able to take into account the properties of the individual passenger transport system and / or the operating conditions prevailing there. At least one of the mentioned individual configurations of the safety device takes place when the safety device to be configured is already installed in its final position in the passenger transport system.

Before putting the passenger transport system into operation, its safety devices must be configured correctly. For this purpose, suitable configuration parameters are conventionally created individually for each safety device and transmitted to the respective safety device. The respective configuration parameters can, for example, be entered by a technician on a human-machine interface. The man-machine interface can, for example, correspond to the elevator control or be integrated into it. Alternatively, the configuration parameters can be called up e.g. from the elevator control or a device connected to it, e.g. from an electronic data source. The configuration parameters are then sent from the elevator control to the respective safety device. The safety device saves the received configuration parameters and can then be operated configured accordingly. In order to be able to check whether the safety device has received and stored the correct configuration parameters, it can be provided that the configuration parameters are transmitted from the safety device back to the elevator control or the man-machine interface parts connected to it. There the configuration parameters transmitted back can then be checked by the technician or compared with setpoint values.

However, it was recognized that the configuration process described above can lead to errors. For example, when data is transmitted from the human-machine interface to the elevator controller and / or from the elevator controller to the safety device, the data to be transmitted can occur Data are modified accidentally or as a result of a systematic error, so that the data that actually reach the safety device are incorrect.

In the worst case, systematic errors can occur during the data transmission to the safety device and the subsequent return transmission of data back to the elevator control or the human-machine interface such that modifications of the data carried out during the data transmission on the way there are subsequently transmitted back when the data is retransmitted to the elevator control or the human-machine interface and thus cannot be recognized by a checking technician, for example.

In addition, it was recognized that when configuring the safety devices, considerable effort has to be made in order to enter the configuration data on the one hand and, on the other hand, in particular to check the consistency of the information transmitted back by the respective safety devices about the stored configuration data.

In order to be able to eliminate the deficits of conventional configuration processes described, an approach is briefly described for the method proposed here, in which on the one hand two configuration parameters created independently of one another are received in the controller and transmitted to the safety device and in which on the other hand these two configuration parameters are directly are compared with each other in the safety device and only if the two configuration parameters match sufficiently, a target configuration parameter corresponding to them is stored in the safety device. The target configuration parameter and / or a configured signal is then transmitted back from the safety device to the controller in order to signal to the controller that the safety device has been correctly configured and / or to finally check the target configuration parameter, for example by a technician or through a comparison with target specifications.

The first and the second configuration parameter both relate to the same setpoint parameter for which a predetermined value in the safety device should be saved. The setpoint parameter can, for example, specify a size of an above-mentioned tolerance range around a stop position on a floor or an above-described maximum speed of the elevator car. In other words, the first and the second configuration parameters should ideally be identical or at most deviate from one another by a predetermined tolerance. However, the two configuration parameters should be created independently of each other. This means that each of the two configuration parameters is created without knowing the other of the configuration parameters. For example, the two configuration parameters can be created using different data sources. In this way it can be achieved that the probability that both configuration parameters do not correctly reflect the target configuration and still match is extremely low.

The two configuration parameters are then transmitted from the control to the safety device. The two configuration parameters are compared with one another in the safety device. If the two configuration parameters received are identical or at least agree sufficiently within the specified tolerance, this is viewed as an indicator that the two configuration parameters correctly reflect the target specifications. A corresponding target configuration parameter, which either corresponds to the two identical configuration parameters or which is at least within the specified tolerance around the two configuration parameters, is then stored in the safety device. It is also possible for one of the two configuration parameters to be adopted as the target configuration parameter in the case in which the two configuration parameters at least sufficiently match within the specified tolerance. Which of the two configuration parameters is adopted can be specified.

The fact that the two configuration parameters created independently of one another are only compared with one another within the safety device itself can minimize the risk that the configuration parameters will be incorrectly modified during their data transmission to the safety device and then stored in the safety device in a correspondingly incorrect manner. If the configuration parameters are modified during this data transfer, this leads this has a high probability that when the configuration parameters received are compared in the safety device, a lack of correspondence is recognized and incorrect configuration parameters are then prevented from being saved.

Only in the event that the two configuration parameters created independently of one another also match sufficiently after their transfer from the control to the safety device, on the one hand the corresponding target configuration parameter is stored in the safety device so that it is then configured correctly. On the other hand, it is only in this case that the target configuration parameter or a configured signal is transmitted from the safety device to the controller in order to inform the controller that the safety device has been configured correctly.

The controller is designed in such a way that it controls the functionalities of the passenger transport system as a function of whether it has previously received the target configuration parameter or the configured signal. This is to be understood here as meaning that the controller controls the passenger transport system differently after receiving the target configuration parameter or the configured signal than before the said reception. The controller can, for example, control the passenger transportation system prior to the reception mentioned in such a way that moving parts of the passenger transportation system, such as an elevator car of an elevator system, are not moved at all or only very slowly, i.e. only more slowly than in normal operation of the passenger transportation system. Moving parts are only moved at normal speed after the reception mentioned. In addition, further controls of the passenger transport system are conceivable as a function of the reception mentioned.

In the event that the target configuration parameter has been transmitted back to the controller, it can be finally checked there or in a device corresponding to the controller in order to further increase the reliability of the method described Target configuration parameters can be compared manually or automatically with target specifications. In particular, the controller is designed so that it controls the functionalities of the passenger transport system, which is designed as an elevator system, so that an elevator car of the passenger transport system is only moved in an elevator shaft after it has received the target configuration parameter and / or the configured signal. This ensures that the elevator car is only moved after the safety device has been configured. This enables particularly safe operation of the elevator system.

The controller can in particular be designed to control the functionalities of the passenger transport system to a limited extent, if necessary, before receiving the specified configuration parameter or the configured signal, and to control the functionalities of the passenger transport system to a full extent after receiving the aforementioned. The specified limited scope can be referred to, for example, as a commissioning or maintenance mode and the specified full scope as a normal mode.

According to one embodiment, the controller can receive the first configuration parameter or the second configuration parameter on the basis of a manual input to be carried out by a person on a human-machine interface.

In other words, one of the configuration parameters to be received by the controller can be obtained by a person such as an authorized technician entering this configuration parameter on a human-machine interface. Such a man-machine interface can be an integral part of the control system. Alternatively, the human-machine interface can be provided as a separate device and, for example, temporarily or permanently coupled to the interface.

The human-machine interface parts can have an input device via which the person can enter data which reproduce the configuration parameters. For example, the human-machine interface parts can have a keyboard, a touch-sensitive screen or the like for this purpose. In addition, the human-machine interface can have an output device to convert data into a for to be able to output the person in a perceptible way. For example, a screen, a loudspeaker or the like can be used for this.

As part of a configuration process, the person can thus transmit one of the independently created configuration parameters to the controller via the human-machine interface.

Alternatively or additionally, according to one embodiment, the controller can receive the first configuration parameter or the second configuration parameter by retrieving data from a remotely arranged database.

In other words, one of the independently established parameters can be obtained by retrieving it from a database. The database can be stored remotely from the controller and in particular also remotely from the entire passenger transport system, for example on a server or in a data cloud. The controller or a device communicating with it can be connected to this database for data transmission, for example by wired or wireless data transmission.

According to a specific embodiment, data can be called up in the database that were created during a conceptualization process and / or when the passenger transport system was commissioned and that contain the first configuration parameter and / or the second configuration parameter or from which the first configuration parameter and / or the second Configuration parameters can be derived.

In other words, one of the configuration parameters to be received by the controller can be created based on data that were previously created when the passenger transportation system was conceptualized or when the passenger transportation system was commissioned. With such a conception or commissioning, the safety devices to be installed in the passenger transport system are also regularly selected and planned with regard to their configuration. Accordingly, detailed information about a target configuration of the individual safety devices can be found in the data created in this way Have a passenger transport system found. These data are typically stored in databases, for example at a manufacturer of the passenger transport system and / or the safety devices, and can thus be called up by the controller if required.

According to one embodiment, the controller can receive the first configuration parameter and / or the second configuration parameter from a mobile, processor-controlled data processing device which can be temporarily coupled for data exchange with the controller.

In other words, the controller can be coupled at least temporarily to a mobile, processor-controlled data processing device and received via this configuration parameter. The data processing device can be, for example, an intelligent telephone (e.g. smartphone), a portable computer (e.g. laptop) or a similar portable device equipped with a processor for data processing. The data processing device can, for example, be carried along by an authorized technician and / or coupled to the controller. For example, the data processing device can be a technician's smartphone on which a special application (app) has been installed. A data transmission between the data processing device and the control can take place in a wired or wireless manner. In addition to its processor, the data processing device can also have a data memory in which data can be stored and / or data interfaces via which data can be exchanged with other devices. Furthermore, the data processing device can have a man-machine interface, via which data can be entered by a person and / or data can be output in a manner that is perceptible to the person.

After its coupling with the control, the data processing device can serve as human-machine interface parts for the control. For example, data which reproduce one of the configuration parameters can be entered by a person on the data processing device, for example by means of its keyboard or its touch-sensitive screen. This data can then be forwarded to the controller. As an alternative or in addition, the data processing device can be used to retrieve data which reproduce one of the configuration parameters, for example from a remote database, and then to forward this to the controller.

According to a further embodiment, the controller can receive the first configuration parameter or the second configuration parameter from a data memory which is coupled to the controller for data exchange.

In contrast to the data processing device described above, the data memory itself does not need to be able to process data, i.e. it does not need its own processor. Instead, the data memory can only store data and make it available to the controller for retrieval when required. In contrast to the data processing device, the data memory mostly does not have its own power supply either. The data memory can be a volatile or non-volatile memory. For example, the data memory can be a flash memory, e.g. in the form of a SIM card or SD card.

The data stored on the data memory can reflect configuration parameters. This data can have been created independently of data reproducing configuration parameters that are made available to the controller via other channels. For example, the data stored in the data memory can have been determined and stored in advance by a manufacturer of the safety device or a manufacturer of the controller.

After the safety device has compared the two configuration parameters transmitted to it by the controller and originating from different sources and, if the two configuration parameters match sufficiently, has stored the target configuration parameter, the security device can send the configured signal to the confirmation for this storage of the target configuration parameter Submit control. As an alternative or in addition, the safety device can transmit the target configuration parameters to the controller itself. The control can evaluate the mere receipt of this target configuration parameter as an indication that the safety device has been configured correctly. Alternatively, the target configuration parameter can be analyzed, for example to identify whether it corresponds to predetermined target specifications. This can be done, for example, within the controller itself.

Alternatively or in addition, according to one embodiment, the controller can transmit the target configuration parameter to a mobile, processor-controlled data processing device.

The data processing device can be the same device as was described above and was used to input one of the configuration parameters. Alternatively, a different data processing device can also be provided for this, which structurally and / or functionally can be designed to be identical or similar to the data processing device described above.

The data processing device can then serve, for example, as a human-machine interface, e.g. to output the transmitted target configuration parameters in a manner that the technician can perceive. Alternatively, the data processing device can use its data communication interfaces to transmit the received target configuration parameters, for example, to external devices such as a monitoring device for monitoring functionalities of the elevator system.

According to a specific embodiment, the data processing device can output the target configuration parameter to a person and, if the person confirms that the target configuration parameter is correct, can transmit a sealed signal to the controller. The controller can be configured to control the functionalities of the passenger transport system to a limited extent, if necessary, before receiving the sealed signal, and to control the functionalities of the passenger transport system to a full extent after receiving the sealed signal.

In other words, the data processing device can be used to enable, for example, an authorized technician to check the correctness of the target configuration parameters transmitted from the safety device to the control and further to the data processing device. Can do this the technician compares the information about the target configuration parameter output to him by the data processing device with other information available to him, for example information about target specifications. It can be provided that the elevator system may only be operated in its full functional scope when such a check has taken place by an authorized technician. In conventional elevator systems, it can be provided for this purpose that the safety device, after it has been checked by the technician, is sealed, that is to say, for example, provided with a lead seal. In the approach described here, sealing can be done electronically, that is, the control can be designed to only allow the full functional scope of the elevator system when the target configuration parameters stored by the safety device and then transmitted have been checked by the technician and confirmed that it is correct became.

For this purpose, the technician can, for example, make an input on the mobile data processing device to confirm the correctness, on the basis of which the sealed signal is then transmitted to the control of the elevator system. Only after receiving this sealed signal does the control switch from a restricted operating mode, in which the safety-relevant functionalities of the passenger transport system are only permitted to a limited extent, to a normal operating mode, in which all the safety-relevant functionalities of the passenger transport system are permitted and controlled by the controller.

According to a specific embodiment, the controller can transmit the sealed signal to the security device, the security device then changing to a sealed state after receiving the sealed signal. The safety device then transmits an acknowledged signal to the controller. The control is provided to control the functionalities of the passenger transport system before receiving the acknowledged signal, if necessary to a limited extent, and to control the functionalities of the passenger transport system to a full extent after receiving the acknowledged signal.

As soon as the security device is in the sealed state, changed configuration parameters can only be changed under increased security conditions, for example with Entering a special authorization code can be stored in the security device. In this way, unauthorized changes to the configuration parameters can be prevented particularly effectively, which enables particularly safe operation of the passenger transport system.

In the case of the electronic sealing described, techniques and / or method steps can be used as they were also described in a similar manner in the patent application EP 19179416 filed earlier by the applicant of this patent application.

According to one embodiment, the first configuration parameter and / or the second configuration parameter are each transmitted from the controller to the safety device together with a checksum characterizing the respective configuration parameter.

In other words, the respective configuration parameters are preferably not transmitted as sole data between the controller and the safety device, but rather the data reproducing a configuration parameter are supplemented by data which reproduce a checksum characterizing the respective configuration parameter.

Such a checksum can be used as part of a cyclic redundancy check and is therefore sometimes also referred to as CRC (cyclic redundant check). The cyclical redundancy check is a procedure in which a check value is determined for data in order to be able to detect errors in the transmission or storage of the data. In the ideal case, even received data can be corrected independently in the process in order to avoid retransmission. Before the data transmission or data storage, for example, an additional redundancy in the form of a so-called CRC value is added for a data block of useful data. The CRC value acts as a checksum and is a check value calculated according to a specific procedure, with the help of which errors that may have occurred during storage or transmission can be recognized. Correspondingly, by adding the Checksum minimizes the risk of undetected errors occurring when the configuration parameters are transferred from the control to the safety device.

According to one embodiment, the method proposed herein is designed in such a way that a data record reflecting the first configuration parameter and / or the second configuration parameter is not modified by the controller before it is transmitted to the safety device.

In other words, the control of the passenger transport system should, if possible, not process or modify the configuration data it has received in any way, but rather pass it on directly to the safety device in unchanged form. In this context, a data record reflecting a configuration parameter should be understood to mean the information technology representation of the configuration parameter. If, for example, a configuration parameter is transmitted to the controller in the form of a logical bit sequence, the controller forwards precisely this bit sequence to the safety device. It is possible here for the controller to transmit further information, for example an above-mentioned checksum, to the safety device immediately before or after the bit sequence mentioned.

Preferably, the controller should also not modify the data record that reproduces the target configuration parameter transmitted back from the safety device in any way before it is output, for example, on the human-machine interface.

This is intended in particular to prevent systematic errors which could occur during data processing within the controller from being able to result in incorrect forwarding of the configuration parameters received from the controller to the safety device. In particular, it should be avoided that both the first at least one configuration parameter and the second at least one configuration parameter are incorrectly processed in the same systematic manner and then both configuration parameters are recognized as the same on the safety device, but both configuration parameters are not correct. In the worst case, the target configuration parameters then transmitted back to the control by the safety device would be conversely, are incorrectly processed by the controller, so that the incorrect data modifications that have occurred in the meantime would be compensated and the storage of incorrect configuration parameters in the safety device cannot be noticed even during a check by the authorized technician.

In the passenger transport system according to the second aspect of the invention, its control and its at least one safety device are designed in such a way that they can carry out the method described herein and thus a correct configuration of the safety device is guaranteed.

The controller can be designed to exchange signals or data with various actuators and / or sensors within the passenger transport system. In particular, the controller can control operation of a drive machine of the passenger transport system. The controller can optionally also accept inputs from various human-machine interfaces in order to control the operation of the passenger transport system based thereon, or output information relating to a current state of the passenger transport system via human-machine interfaces. For example, such human-machine interface parts can include buttons, buttons, sensors, screens, loudspeakers and / or the like on control panels of an elevator installation. The control can, for example, have individual modules that communicate with one another, with one module taking on safety-relevant tasks and another module serving the human-machine interface and controlling a drive machine.

The safety device can be designed to control a safety-relevant function within the passenger transport system. For this purpose, the safety device can have one or more sensors in order to be able to detect physical quantities that correlate with the safety-relevant function. The safety device can possibly also have one or more actuators with which such physical variables can be influenced.

The safety device can also have a modular structure, that is to say it can have several different modules which have different functions. In particular, several modules can be configured and each control one safety-relevant function of the passenger transport system. The safety device then only transmits the configured signal or the sealed signal to the controller when all configurable modules have been configured.

For example, safety devices can be designed to detect a current opening state of an elevator door, to measure a current travel speed of an elevator car, to determine a current location of the elevator car within an elevator shaft, to recognize a load or acceleration currently acting on the elevator car, or the like.

By storing the target configuration parameter, the safety device can be adapted to properties of the passenger transport system and / or to the conditions prevailing in the passenger transport system.

The method described herein can be carried out by a processor-controlled control of a passenger transport system in cooperation with a processor-controlled safety device. Both the control and the safety device can execute a program code that is part of a computer program product according to the third aspect of the invention. The computer program product can thus instruct the controller and the safety device to execute or control the partial steps to be carried out by them in the method described herein. The computer program product can be formulated in any computer language.

Such a computer program product can be stored on a computer-readable medium according to the fourth aspect of the invention. Such a medium can be any volatile or non-volatile data storage medium. For example, the computer-readable medium can be a portable data storage device, for example in the form of a flash memory, a DVD, a CD or the like. The computer-readable medium can also be part of a further computer or server or part of a data cloud, from which the computer program product can be downloaded, for example via a network such as the Internet. It is pointed out that some of the possible features and advantages of the invention are described herein with reference to different embodiments of a method for operating a passenger transport system on the one hand and a suitably configured passenger transport system on the other hand. A person skilled in the art will recognize that the features can be combined, adapted or exchanged in a suitable manner in order to arrive at further embodiments of the invention.

Embodiments of the invention are described below with reference to the accompanying drawings, wherein neither the drawings nor the description are to be interpreted as restricting the invention.

1 shows an elevator installation according to an embodiment of the present invention.

FIG. 2 shows a diagram to illustrate data transmissions and data processing within the scope of a method according to an embodiment of the present invention.

The figures are only schematic and not true to scale. In the various figures, the same reference symbols denote the same or equivalent features

It is described below that only one target configuration parameter is determined from a first and a second configuration parameter and stored in a security device. However, this is not to be interpreted restrictively. It is also possible that several first configuration parameters and several second configuration parameters are also transmitted in an analogous manner to one or more safety devices and that several target configuration parameters are derived therefrom, which are stored in one or more of the safety devices.

1 shows a very rough diagram of a passenger transport system 1 in the form of an elevator system. An elevator car 5 is arranged in an elevator shaft 3 and is held by rope-like suspension means 9. A drive machine 7 can be rope-like Move the suspension means 9 and thus displace the elevator car 5 vertically. The drive machine 7 is controlled by a controller 11. An elevator door 13 is provided on one floor. A current closed state of the elevator door 13 is monitored with a safety device 17 in the form of a door switch 15. A plurality of further safety devices 17 can be provided in the passenger transport system 1 in order, for example, to control the closed states of further elevator doors 13 or other functionalities.

A technician 23 can visit the passenger transportation system 1 in order to use his smartphone 19 as a mobile data processing device 21 to configure the passenger transportation system 1 and in particular its safety device 17. This can take place, for example, directly after completion of the passenger transport system 1 or also during maintenance of the same.

With reference to FIG. 2, a possible embodiment of such a process for configuring the safety device 17 is described.

First, the controller 11 receives a first configuration parameter 41 and a second configuration parameter 43. The two configuration parameters 41, 43 were created in advance independently of one another, but both relate to a desired target configuration of the safety device 17 to be configured.

In the example shown, the first configuration parameter 41 is transmitted from a mobile, processor-controlled data processing device 21 to the controller 11. The data processing device 21 can be a smartphone 19 belonging to the technician 23, on which a suitable application (app) is running. The first configuration parameter 41 can for example be entered by the technician 23 via a man-machine interface 27 of the smartphone 19. The man-machine interface parts 27 can be, for example, a touch-sensitive screen 25 or a keyboard. Alternatively, the first configuration parameter 41 can also be called up with the aid of a data communication module 29 of the smartphone 19 from an external source such as, for example, an external database 37 held in a data cloud 35. In the database 37, for example, configuration data can be stored that during a conceptualization process or during a Commissioning of the passenger transport system 1 have been created. The first configuration parameter 41 can then, for example, also be transmitted to the controller 11 or its data communication module 31 with the aid of the data communication module 29. For example, the data transmission can take place wirelessly.

Furthermore, in the example shown, the second communication parameter 43 is provided by a data memory 39 which is coupled to the controller 11 for data exchange. This data memory 39 can, for example, be a flash memory on which configuration data for all safety devices 17 of the passenger transport system 1 are stored.

Both the first and the second configuration parameters 41, 43 are then transmitted from the controller 11 to the safety device 17 or to its data communication module 33. The data records representing the first and second configuration parameters 41, 43, that is to say their information technology representation, are in particular not modified by the controller 11. The two transmitted configuration parameters 41, 43 are then compared with one another in the safety device 17. If the two configuration parameters 41, 43 agree within a predetermined tolerance, a target configuration parameter 47 corresponding to the two configuration parameters 41, 43 is stored in the safety device 17. In addition, the target configuration parameter 47 is also transmitted back to the controller 11. As an alternative or in addition, a configured signal 49 can be transmitted to the controller 11.

On the basis of the receipt of the target configuration parameter 47 and / or the configured signal 49, the controller 11 can recognize that the safety device 17 has been correctly configured and can correctly perform its control function of the passenger transport system 1. The controller 11 can adjust the activation of the functionalities of the passenger transport system 1 accordingly. For example, the controller 11 can only then control the drive machine 7 in such a way that the elevator car 5 is displaced in the elevator shaft 3 or that it is displaced at a speed for normal operation of the passenger transport system 1. After the correct configuration of the safety device 17 has been recognized, the controller 11 can switch from a previous restricted mode, in which the functionalities of the passenger transport system 1 were possibly limited, to a normal mode, in which the functionalities of the passenger transport system 1 are fully available.

The controller 11 can also send the target configuration parameter 47 to the mobile data processing device 21. The data record reflecting the target configuration parameter 47, that is to say its IT representation, is in particular not modified by the controller 11. At the data processing device 21, for example, the technician 23 can analyze this returned nominal configuration parameter 47, for example by comparing it with the data previously entered by the technician 23 or by comparing it with data previously read from the database 37. In the event that the technician 23 determines that the target configuration parameter 47 is correct, ie, for example, agrees sufficiently with the target specifications, he can confirm the correctness of the target configuration parameter 47, for example by an input on the man-machine interface 27 . The data processing device 21 can then transmit a sealed signal 51 back to the controller 11. Due to the receipt of this sealed signal 51, the controller 11 can then switch from a previous restricted mode, in which the functionalities of the passenger transport system 1 were only available to a limited extent, to a normal mode, in which the functionalities of the passenger transport system 1 are fully available.

Instead of going into normal mode immediately after receiving the sealed signal 51 from the data processing device 21, the controller 11 can transmit the sealed signal 51 to the security device 17. The safety device 17 then changes to a sealed state after receiving the sealed signal 51 and transmits an acknowledged signal 52 to the controller 11. The controller 11 only changes to normal mode after receiving the acknowledged signal 52 from the safety device 17 .

In order to ensure the integrity of the data, which reproduce the various configuration parameters 41, 43, 47, together with these data during the transmission between the various devices, ie between the data processing device 21 and the controller 11 on the one hand or between the controller 11 and the safety device 17 on the other hand, additional checksums 45 are transmitted, which characterize the respective configuration parameters 41, 43, 47 or their data. Such checksums 45 can have been determined in advance as CRC values.

In the example shown above, the first configuration parameter 41 was determined by the mobile data processing device 21 and transmitted to the controller 11, whereas the second configuration parameter 43 was read from the data memory 39 provided directly on the controller 11. However, it should also be possible to have both the first configuration parameter 41 and the second configuration parameter 43 determined by the data processing device 21. For example, the data processing device 21 can determine on the one hand an input from the technician 23 on his screen 25 as a first configuration parameter 41 and on the other hand data retrieved from the database 37 as a second configuration parameter 43 and then transmit both configuration parameters 41, 43 to the controller 11.

Similarly, it is also conceivable to have both configuration parameters 41, 43 determined directly by the controller 11 by, for example, on the one hand calling up data from a database 37 via the data communication module 31 integrated in the controller 11 and receiving it as first configuration parameters 41 and on the other hand data from the data memory 39 receives as second configuration parameter 43.

In particular, with the aid of the method proposed herein, it is possible to configure the safety device 17 without the technician 23 necessarily having to enter configuration data manually into a human-machine interface. For example, the safety device 17 can compare first configuration parameters 41, which were automatically read out from the database 37, with second configuration parameters 43, which were automatically read out from the data memory 39. If the two configuration parameters 41, 43 match sufficiently, a corresponding target configuration parameter 47 can be automatically stored in the safety device 17. The safety device 17 can then go over to at least a partial operation in which their functionalities are available at least to a limited extent or in which functionalities of the entire passenger transport system 1 are provided to a limited extent. In partial operation, for example, a speed at which the elevator car 5 may be shifted can be limited, or journeys of the elevator car 5 only after an additional previous one

Confirmation to be carried out. At a later point in time, for example, the stored target configuration parameter 47 can be checked by a technician 23 and, if it is correct, a sealed signal 51 can be transmitted to the controller 11, whereupon it can then go into full operation.

Overall, with the approach described here, a higher level of reliability can be achieved when configuring the passenger transportation system 1 and thus increased safety for the passenger transportation system 1. In addition, the configuration process itself can be simplified.

Finally, it should be pointed out that terms such as “having”, “comprising”, etc. do not exclude any other elements or steps and that terms such as “a” or “a” do not exclude a multitude. It should also be pointed out that features or steps that have been described with reference to one of the above exemplary embodiments can also be used in combination with other features or steps of other exemplary embodiments described above. Reference signs in the claims are not to be regarded as a restriction.

Claims

1. A method for operating a passenger transportation system (1), wherein the passenger transportation system (1) has a controller (11) for controlling functionalities of the passenger transportation system (1) and a safety device (17) for controlling a safety-relevant function of the passenger transportation system (1); wherein the safety device (17) can be configured in a configured state by storing a target configuration parameter (47) in order to control the safety-relevant function according to certain specifications; the method comprising:

Receipt of a first configuration parameter (41) and a second configuration parameter (43) created independently of the first configuration parameter (41) by the controller (11), the first configuration parameter (41) and the second configuration parameter (43) using the same target configuration parameter ( 47) concern;

Transmitting the first configuration parameter (41) and the second configuration parameter (43) to the safety device (17);

Compare the first configuration parameter (41) and the second configuration parameter (43) in the safety device (17) and, in the event that the first configuration parameter (41) and the second configuration parameter (43) match within a predetermined tolerance, Einspeichem the dem first configuration parameters (41) and second configuration parameters (43) corresponding target configuration parameters (47) in the safety device (17) and transmission of the target configuration parameter (47) and / or a configured signal (49) from the safety device (17) the controller (11); wherein the controller (11) controls the functionalities of the passenger transport system (1) depending on whether it has received the target configuration parameter (47) and / or the configured signal (49).

2. The method according to claim 1, wherein the controller (11) controls the functionalities of the passenger transport system (1) designed as an elevator system in such a way that an elevator car (5) of the passenger transport system (1) is only moved in an elevator shaft (3) after from her the target configuration parameters (47) and / or the configured signal (49) has been received.

3. The method according to claim 1 or 2, wherein the controller (11) receives the first configuration parameter (41) or the second configuration parameter (43) on the basis of a manual input to be carried out by a person on a man-machine interface (27).

4. The method of claim 1, 2 or 3, wherein the controller (11) receives the first configuration parameter (41) or the second configuration parameter (43) by retrieving data from a remote database (37).

5. The method according to claim 4, wherein data can be called up in the database (37) which were created during a conception process and / or when the passenger transport system (1) was commissioned and which the first configuration parameter (41) and / or the second configuration parameter ( 43) or from which the first configuration parameter (41) and / or the one configuration parameter (43) can be derived.

6. The method according to any one of the preceding claims, wherein the controller (11) receives the first configuration parameter (41) and / or the second configuration parameter (43) from a mobile, processor-controlled data processing device (21) which is temporarily used for data exchange with the controller (11 ) can be coupled.

7. The method according to any one of the preceding claims, wherein the controller (11) receives the first configuration parameter (41) or the second configuration parameter (43) from a data memory (39) which is coupled for data exchange with the controller (11).

8. The method according to any one of the preceding claims, wherein the controller (11) transmits the target configuration parameter (47) to a mobile, processor-controlled data processing device (21).

9. The method according to claim 8, wherein the data processing device (21) outputs the target configuration parameters (47) to a person and upon confirmation of correctness of the target configuration parameter (47) by the person transmits a sealed signal (51) to the controller (11), the controller (11) before receiving the sealed signal (51) possibly including the functionalities of the passenger transport system (1) controls a limited scope and, after receiving the sealed signal (51), controls the functionalities of the passenger transport system (1) to a full extent.

10. The method according to claim 9, wherein the controller (11) transmits the sealed signal (51) to the safety device (17), the safety device (17) changes to a sealed state after receiving the sealed signal (51) and an acknowledged signal (52) is transmitted to the controller (11) and the controller (11) controls the functionalities of the passenger transport system (1) before receiving the acknowledged signal (52) at most to a limited extent and after receiving the acknowledged Signals (52) controls the functionalities of the passenger transport system (1) to a full extent.

11. The method according to any one of the preceding claims, wherein the first configuration parameter (41) and / or the second configuration parameter (43) are transmitted from the controller (11) to the safety device (17) together with a checksum (45) characterizing the respective configuration parameter will.

12. The method according to any one of the preceding claims, wherein a data record (41, 43) reflecting the first configuration parameter (41) and / or the second configuration parameter (43) is not modified by the controller (11) before it is transmitted to the safety device (17) will.

13. Passenger transportation system (1) comprising: a controller (11) for controlling functionalities of the passenger transportation system (1), and a safety device (17) for controlling a safety-relevant function of the passenger transportation system (1); wherein the safety device (17) can be configured in a configured state by storing a target configuration parameter (47) in order to control the safety-relevant function according to certain specifications; wherein the controller (11) and the safety device (17) are configured to carry out or control the method according to one of claims 1 to 12.

14. Computer program product which, when executed in a processor-controlled controller (11) for controlling functionalities of a passenger transportation system (1) and a processor-controlled safety device (17) for controlling a safety-relevant function of the passenger transportation system (1), instructs them to use the method according to one of the Execute or control claims 1 to 12.

15. Computer-readable medium on which the computer program product according to claim 14 is stored.