EP4267503A1

EP4267503A1 - Elevator, method for controlling an elevator

Info

Publication number: EP4267503A1
Application number: EP21843972.7A
Authority: EP
Inventors: Valerio Villa
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2020-12-22
Filing date: 2021-12-22
Publication date: 2023-11-01
Also published as: WO2022136504A1; CN116670059A; AU2021405615A1; US20240034593A1

Abstract

The invention relates to an elevator (2), comprising a shaft (3), a car (4) which can move in the shaft (3), a drive (6) which is operatively connected to the car (4) and by means of which the car (4) can be moved, a brake (8), a plurality of shaft doors (10) and a safety control system (12). The safety control system (12) comprises a secure safety control unit of a first type (14) and at least one secure safety control unit of a second type (16). The safety control unit of the first type (14) and the at least one safety control unit of the second type (16) are interconnected. The at least one safety control unit of the second type (16) is designed such that a state of any of the shaft doors (10) can be collected by the at least one safety control unit of the second type (16). The safety control system (12) is designed such that the state of the shaft doors (10) can be collected directly only by the at least one safety control unit of the second type (16).

Description

Elevator, method for controlling an elevator

The present invention relates to an elevator, in particular an elevator with a safety control system, and a method for controlling an elevator.

Elevators are generally used to transport people or objects in a vertical direction. Safety control systems are used to avoid endangering persons or objects. These monitor, for example, with the help of sensors, that is, for example, using data or signals from sensors, current operating states of the elevator. Furthermore, when an unsafe state of the elevator is detected, the safety control system can address actuators which are intended to bring the elevator system into a safe state. The safety brake is such an actuator, for example. For example, the safety control system monitors a speed of the elevator. If an unsafe condition is detected, the safety control system activates certain actuators. For example, a safety gear for braking the elevator car is activated. The security control system also ensures that no further calls are served. The highest demands are placed on the safety control system in terms of reliability and safety.

Elevators are known in the prior art which include a central safety control system. These central safety control systems are connected to a variety of sensors and actuators located at various positions within the elevator. If an unsafe operating state of the elevator is determined by the central safety control system, in particular by the sensors which are connected to this central safety control system, the central safety control system controls one or more activatable actuators in a suitable manner to put the elevator into a safe state attributed. For example, when an open shaft door is detected, the car is prevented from moving in the elevator shaft. This can happen, for example, by triggering the safety brake actuator. In such a system, signals from the sensors distributed in the elevator shaft are transmitted unprocessed to the central safety control system, which alone, i.e. exclusively, processes and interprets the data in order to then address the actuators directly.

A disadvantage of such a central security control system is that the signal propagation times can become very long. This is particularly the case for elevators with a large number of floors. But even in the case of elevators with only a few floors, the central architecture can cause a delay in the transmission of data from the sensors and in the intervention of the actuators. This is further exacerbated by the load on the central safety control system with a large number of monitoring functions, since the computing capacity of the central safety control system is limited. This can lead to reaction delays in the elevator. This in turn affects the safety of the elevator.

EP 2 022 742 A1 discloses an elevator with a decentralized safety control system. The decentralized safety control system has a number of safety control units, the safety control units being connected to one another via a bus connection.

US 2011/302466 A1 discloses an elevator with a safety control system that includes a master unit and multiple slave units. The slave units are respectively connected to sensors and switches, transmitting signals from these sensors and switches to the master unit. The master unit processes the data and, if necessary, addresses actuators in order to bring the elevator into a safe state.

A disadvantage of the known security control systems is that by the Architecture of the system delays arise. In this way, the reaction of the lift to unsafe conditions is unnecessarily delayed.

It is therefore the object of the present invention to create an elevator which avoids the disadvantages of the prior art and in particular to create an elevator and a method for controlling an elevator in which delays in the safety control system are reduced as much as possible and the safety control system is simplified. so that the elevator can react to unsafe conditions as quickly as possible.

The object is achieved by an elevator and by a method for monitoring an elevator according to the independent claims.

According to the invention, the elevator comprises a shaft, a car which can be moved in the shaft, a drive which is operatively connected to the car and by means of which the car can be moved, a brake, a plurality of shaft doors and a safety control system. The safety control system comprises a first type safe safety control unit and at least one second type safe safety control unit. The safety control unit of the first type and the at least one safety control unit of the second type are connected to one another. The at least one safety control unit of the second type is designed in such a way that it can be used to determine the state of each of the shaft doors. According to the invention, the safety control system is designed in such a way that the state of the shaft doors can be determined directly and exclusively by the at least one safety control unit of the second type.

It has proven to be advantageous that the presence of two separate, secure safety control units, the clear assignment of the shaft doors to the at least one safety control unit of the second type and the exclusive direct recording of the status of the shaft doors by the at least one safety control unit of the second type specifically identify the safety control units for the survey assignment assigned to them can be executed. The determination of the state of the shaft doors is relevant to safety, since people in the vicinity of the shaft are endangered when the shaft door is open. Furthermore, when the shaft door is open, movement of the car should be prevented or at least restricted. With the safe safety control unit of the second type, a safety control unit is made available according to the invention, which is designed for this task. It is also important that all landing doors are monitored. The at least one safety control unit of the second type is designed to be safe, so that it is ensured that the determination of the state of the shaft doors is reliable. The safety control system can thus leave the monitoring of the state of the landing doors exclusively to the safety control unit of the second type and can be sure that this safety control unit will carry out the monitoring reliably. A final and safely recorded state of the shaft doors, i.e. a simple "door(s) closed / door(s) not closed" can then be transmitted in the safety control system via the connection to other units, in particular to the safe safety control unit of the first type. This makes it possible, among other things, to implement a speed requirement specific to the monitoring of the shaft doors in the safety control unit of the second type. The monitoring of each of the shaft doors by the at least one safety control unit of the second type makes it possible to design the safety control unit of the first type and possibly another safety control unit free of door monitoring-specific requirements. This allows a simple, efficient and safe safety control system to be provided.

A safety control unit which, for example, meets the standardized safety integrity level 1 (Safety Integrity Level, SIL 1), preferably SIL2 and particularly preferably SIL3 according to IEC61508 and/or EN8120 and/or EN8150, can be regarded as safe.

A state is to be understood above and below as a position of the landing doors existing at a certain point in time. In particular, the state of the landing door to be closed or not closed, i.e. open. While the safety control unit of the second type directly and exclusively records the status of the shaft door, this does not rule out the possibility that the safety control unit of the second type forwards information based on this recorded status within the safety control system, for example to the safe control unit of the first type. The exclusive and direct collection means that the evaluation of the sensor signal(s) and the derivation of the status from the signal(s) takes place exclusively through and in the safety control unit of the second type. This means that the safety control unit of the second type finally detects this state without the aid of another safety control unit of a different type.

In a preferred embodiment of the elevator, the safety control system comprises one safe safety control unit of the second type per landing door. The safety control units of the second type are preferably attached to the landing doors. Preferably, a safety control unit of the second type is attached to each of the landing doors.

It is thus made possible for each of the shaft doors to have a safety control unit of the second type which is specifically provided for this shaft door. The safety control unit of the second type can thus be configured in a comparatively simple manner since it only has to monitor one shaft door. In this embodiment, the safety control unit of the second type is preferably arranged at the shaft door, as a result of which the safety control unit of the second type is directly at the shaft door and delays caused by the transmission of signals can thus be further reduced. Since the safety control unit of the second type is a safe safety control unit, the connection to at least some of the sensors and/or actuators, in particular a door lock sensor and door lock actuator, must be made safe. By arranging it directly at the relevant shaft door, there is no need to make connections over long distances. Furthermore, arranging the shaft door proves advantageous, since the safety control unit and the Connections to the sensors and actuators present on the shaft door can already be established in a factory. On-site assembly by the fitter is no longer necessary. This results in a simple safety control unit of the second type, which further reduces delays and thus enables increased safety of the safety control system.

A connection which, for example, meets the standardized safety integrity level 1 (Safety Integrity Level, SIL1), preferably SIL2 and particularly preferably SIL3 according to IEC 61508 and/or EN81-20 and/or EN81-50 can be regarded as secure.

Attached to the landing door means above and below that the safety control unit is designed as part of the landing door. For example, the safety control unit can be arranged in a box above the shaft door leaf, in which the door leaf can also be moved. This box can be arranged outside the shaft and/or inside the shaft. Alternatively, the security control unit can also be mounted in a door post.

In a preferred embodiment of the elevator, the safe safety control units are designed in such a way that at least one actuator assigned to them can be controlled by them. The respective actuator can preferably be controlled directly and exclusively by this safety control unit.

By assigning an actuator to a safety control unit and by the direct exclusive control of this actuator by the safety control unit, the two components can be coordinated in their execution. For example, the safety control unit can be matched to the type of actuator with regard to the computing speed, ie the evaluation speed. So the safety control unit of the second type with a different evaluation speed, for example a lower evaluation speed and accordingly also with a different sensor readout rate, for example be performed at a lower read rate than, for example, the safety control unit of the first type. For example, the safety control unit of the second type can be designed for the processes at the shaft door without having to be designed for processes involving the safety-relevant braking of the car at the same time. In return, the safety control unit of the first type can be designed exclusively for the evaluation required for emergency braking (recovery). In this way, an inexpensive yet safe safety control system can be formed with different safety control units tailored to their purpose.

Above and below, an actuator is to be understood as a component through which the physical state of the elevator can be changed (or maintained against other influences). For example, the brake, in particular also the safety brake, as well as the drive, in particular also door drives, and door lock are actuators. An actuator that is controlled directly and exclusively by a safety control unit means above and below that the specific control with the required signals and energy for changing the state of the actuator takes place exclusively through the respectively assigned safety control unit. This does not prevent the safety control unit assigned to the actuator receiving the abstract, indirect command from another safety control unit to change the state. So that the safety control unit can directly and exclusively control the associated actuator, the sensors required for this purpose, which make it possible to ascertain the state of the actuator, are connected to the safety control unit. The safety control unit thus enables the implementation of a self-contained control loop of the actuator without having to resort to remote signals and/or evaluation capacity or information from other safety control units.

In a preferred embodiment of the elevator, each shaft door comprises a secure door lock and/or an active door drive as an actuator. The security control system is designed so that the door locks and / or the door drives can be directly controlled exclusively by the at least one safety control unit of the second type.

A door lock blocks opening of the shaft door in a first state and does not block this in a second state, that is to say it enables the door to be opened. Is the door lock designed in such a way that the state in which the door lock blocks the opening of the door can only be assumed if the door or the door leaves are/are also in a blockable state (in other words, the door lock is «fail- safe" and can therefore be described as safe), simply by monitoring the two states "blocked" or "not blocked" of the door lock, it can be concluded whether the landing door is closed and blocked or open (not closed) and unblocked is. A safe safety control unit of the second type assigned to the door lock can thus be provided, which can determine a safe state of the elevator in relation to the shaft door directly and exclusively, ie without additional sensors or actuators. For example, the door lock can be designed as a bolt that can be held in place by an electromagnet. The bolt can preferably only move to a closed state using gravity when the door leaves are closed and the electromagnet is de-energized. This means that the door leaves block the bolt from falling down due to gravity as long as the doors are not locked. By monitoring the position of the bolt, a fail-safe door lock can be implemented, from which the state of the shaft doors can be determined easily and safely. Furthermore, or as an alternative, the shaft door can also be provided with an active drive. The combination of safe safety control unit and active drive, which can be controlled directly and exclusively by the safe safety control unit, also enables the state of the landing door to be checked locally, i.e. exclusively by the two components (safety control unit/drive) and, if necessary, sensors connected to the safety control unit. for example sensors for detecting the position of the door leaf (or the position of the locking bolt). The combination safety control unit and active door drive can thus raise the critical status of open shaft doors. The control system can thus ensure, by querying the door status in the safety control unit of the second type, that the car is only moved in the shaft when a safe status is present. The advantage of a door lock and/or an active drive as described above and below is that there are no unexpected door opening movements. An elevator can be built in which the landing door is controlled exclusively (i.e. unexpected opening of a landing door by a service technician with a triangular key, as is provided in many elevator systems) by the safe safety control unit of the second type. Unexpected opening, for example by a fitter, does not have to be taken into account when designing the safety control system. In particular, this reduces the speed requirements for the safety control system with regard to readout and evaluation speed. In this way, sensors can only be queried after a status change requested by the system. This eliminates the need for a quick survey of the state of the shaft doors designed to detect unforeseeable events.

Furthermore, the fail-safe design of the communication makes it possible for the connection between the safety control unit of the second type and the safety control unit of the first type to be designed as a simple, insecure wireless connection. This makes it possible to easily and inexpensively integrate the safety control unit of the second type, which is preferably present on each shaft door, into the safety control system.

An insecure connection is a connection that does not meet a standardized safety integrity level (Safety Integrity Level) or possibly a lower safety integrity level (Safety Integrity Level) than the relevant standard, e.g. EN61508 and/or EN8120 and/or EN8150 stipulates are met. A so-called "black channel" communication is implemented in which two secure units via an insecure connection to communicate securely with each other.

In a preferred embodiment of the elevator, the condition detected by the safety control unit of the second type is a condition of the door lock and/or the door drive. The status signals a closed or not closed shaft door.

If the communication is limited to the exchange of status information in the form of binary information (“door closed” corresponds to a safe state / “door not closed” corresponds to an unsafe state), the receiving safety control unit can indicate non-receipt of this status information as a “door not closed ’ or, to put it another way, rate it as an unsafe condition. This eliminates the need to carry out this communication safely, since the status to be transmitted enables transmission in a "fail-safe" manner. In this way, the need for secure communication is limited to the safety-relevant actuators and sensors, which are installed in the secure safety control unit of the second type itself.

In a preferred embodiment of the elevator, the safety control system is designed such that the brake can be directly controlled exclusively by the safety control unit of the first type, with the safety control unit of the first type and the brake preferably being arranged on the car.

Thus, only the safety control unit of the first type must be designed to meet the requirement for safe braking of the elevator car. Due to the preferred arrangement of the safety control unit of the first type in physical proximity to the brake, reaction delays due to transmission delays are minimized.

In a preferred embodiment of the elevator, the safety control unit of the second type is designed in such a way that the safety control unit of the second type sends a signal to check the communication at regular intervals sends to the safety control unit of the first type. This interval is, for example, greater than 1 s, preferably greater than 30 s, and particularly preferably greater than 1 minute.

The regular transmission of a signal to check the communication between the safety control unit of the second type and the safety control unit of the first type can ensure that the safety control unit of the first type, i.e. the receiver unit of the status information, is informed at regular intervals that the Communication between the two units still works. Does the safety control unit of the first type know that the communication is working and also that the safety control unit of the second type has recently sent status information on the safe state of the shaft door, the elevator has not initiated a state change of the shaft doors and that unexpected state changes of the shaft doors are not possible, the safety control unit of the first type can thus reliably conclude that the elevator is in a safe state in the area of the shaft doors. Details on the state of the door, ie sensor information from the sensors around the door, are not necessary in the safety control unit of the first type.

In a preferred embodiment of the elevator, the safety control system comprises at least one safety control unit of a third type. The third type of safety control unit enables safe torque-off of the drive. The first type safety control unit and the third type safety control unit are connected to each other.

The safety control unit of the third type enables the safety-related function of safely switching off the torque (safe torque off) to be carried out by the actuator drive. It is thus ensured that the safety control unit of this actuator is also designed separately from the other safety control units and can therefore be arranged directly next to or in the immediate vicinity of the drive, if possible Delays due to transmission delays can be further reduced.

In a preferred embodiment of the elevator, a connection between the safety control units is designed as a wireless and/or cable connection. In particular, the connection between the safety control unit of the third type and the safety control unit of the first type is implemented as a cable connection. The connection between the safety control unit of the first type and the at least one safety control unit of the second type is preferably implemented as a wireless connection, particularly preferably as an insecure wireless connection.

The signal from the safety control unit of the third type is a binary signal which, in a first state, allows the drive to operate in the normal operating state and which, in a second state, interrupts the connection of the converter to the machine, e.g. by means of electromagnetic contactors which disconnect or through Semiconductor switches that ensure that no more current flows into the machine. Due to the binary nature of this signal, the connection can be made very simply, for example by a two-wire cable connection. In addition, the communication is unidirectional, since the safety control unit of the third type, at least in its simplest embodiment of the safe torque-off, does not send back any confirmation or status information to the safety control unit of the first type.

In a further embodiment, the third type security control unit is a stand-alone security control unit which is in bi-directional communication with the first type security control unit. The communication can be structured in the same way as the communication between the safety control unit of the first type and the safety control unit of the second type.

As described above and below, the execution of the elevator according to the invention, the communication within the safety control system, i.e. between the safety control units of the first type and the safety control unit of the second type, is restricted to a minimum and designed in such a way that the communication is fail-safe, i.e. a lack of communication is considered an unsafe condition Is evaluated. The requirement for the connection between these safety control units is therefore low. This is particularly advantageous since the safety control unit of the second type can be arranged at the respective shaft doors and the safety control unit of the first type can be arranged on the car. For example, a wireless module can be present in the shaft door, which transmits the status information of the safety control unit of the second type, with a corresponding wireless receiver being present in the safety control unit of the first type, which receives this information. In this way, a simple and inexpensive connection between the units can be implemented. In particular, there is no need for time-consuming cabling of the shaft doors and the connection of these to the cabin via a hanging cable.

In a preferred embodiment of the elevator, the safety control unit of the first type and/or the safety control unit of the second type includes an insecure interface for connection to sensors and/or actuators. In particular, the safety control unit of the second type includes an insecure interface for connection to a sensor for detecting the presence of a car door, preferably a magnet sensor, and optionally for connection to a shaft door drive unit for controlling the shaft door movements. In particular, the safety control unit of the first type includes an insecure interface for connection to position sensors and/or speed and acceleration sensors.

An insecure interface is an interface that does not meet a standardized safety integrity level (Safety Integrity Level) or possibly a lower safety integrity level (Safety Integrity Level) than the relevant standard, e.g. EN61508 and/or EN8120 and/or EN8150 requires fulfilled, to be looked at.

While certain sensors are essential for ascertaining a safe state of the monitored actuator/actuators, other actuators and/or sensors which ascertain/cause states irrelevant to safety may be present. For example, in the case of a landing door with an active door drive and a fail-safe door lock, the sensor for detecting the status of the door lock alone can already meet the required safety requirements with regard to the landing door. A sensor that monitors the door movement due to the active drive is not relevant to safety in this case and therefore does not have to be designed to be safe. In this case, the door movement sensor can be connected to the secure safety control unit of the second type via the insecure interface.

In a preferred embodiment of the elevator, the safety control unit of the first type and/or the safety control unit of the second type includes a safe interface for connection to sensors and/or actuators. In particular, the safety control unit of the second type includes a secure interface for connecting a door lock status sensor and an interface for controlling the electromagnet (actuator) of the door lock. In particular, the safety control unit of the first type includes a safe interface for connecting a sleep rope detector and a load measuring device, as well as a safe interface for controlling the brake and/or the safe torque-off function (in the form of a signal from the safety control unit of the first type for triggering the STO condition (disconnecting the machine from the drive) or a connection to a separate, self-contained third type safe safety controller that implements the STO function).

An interface which, for example, meets the standardized safety integrity level 1 (Safety Integrity Level, SIL1), preferably SIL2 and particularly preferably SIL3 according to IEC61508 and/or EN8120 and/or EN8150 can be regarded as safe. The safe interface enables the connection of the actuators and sensors relevant to the safety status of the elevator, thus enabling the provision of a safe safety control system through the provision of self-contained safe safety control units.

A method for controlling an elevator, preferably as described above and below, also leads to the solution of the task, the method comprising the steps:

- Assessing a safe state of at least one, preferably all, shaft doors of a plurality of shaft doors by ascertaining a safe state of an actuator of the shaft door by at least one safe safety control unit of a second type, the state ascertained in particular signaling either "closed" or "not closed". ,

- Transmission, in particular insecure transmission, in particular transmission via a wireless connection, of the raised status of the at least one, preferably all, shaft doors from the at least one safety control unit of the second type to a safety control unit of a first type.

In the method described above and below, the state of a shaft door is indirectly ascertained via the state of an actuator, that is to say it is assessed. If the actuator is safe, that is, for example, designed to be fail-safe, a safe state determination can take place indirectly by determining the state of this safe actuator. For example, a fail-safe door lock or an active, safe door drive can be used as an actuator for indirectly ascertaining the safe state.

An actuator is suitable for indirect monitoring of the state of the object that can be actuated directly or indirectly by the actuator, i.e. that can be controlled by the actuator (in the present case the shaft door), if the actuator includes a safe control and the state to be monitored (e.g. closed /Not closed) of the object to be monitored (e.g. shaft door) can only be changed after/by actuating the actuator. This means that unexpected changes in status, e.g. manual opening of the shaft door by the fitter, can be ruled out. In contrast to an elevator with a classic door switch, which has to detect an unexpected door opening within a very short time at any time, the requirements for the safety control system of the second type, which records the status immediately, are reduced, in particular the monitored status has to be recorded less often.

The state distinction "closed" and "not closed" can be raised by a sensor, which only determines whether the landing door is in a closed state, whereby in all other cases, including the case in which the sensor fails, a state "not closed” is charged.

In a preferred embodiment, each of the shaft doors has a secure door lock, with the method for controlling the elevator

In a preferred embodiment of the method for controlling the elevator, the method further comprises the steps:

- Receiving the transmitted status by the safety control unit of the first type,

- Release of an opening of a brake, in particular release of a brake, by the safety control unit of the first type if all of the received states correspond to the "closed" state,

- Blocking an opening of the brake by the safety control unit of the first type if one of the received states is "not closed" or not all states have been received.

In a preferred embodiment of the method for controlling the elevator, the method further comprises the steps: - repeated sending of a signal to check the communication by the safety control unit of the second type to the safety control unit of the first type at a defined time interval,

- determining the communication capability between the safety control unit of the first type and the safety control unit of the second type upon receipt of the communication verification signal, and

- Determination of an error state in the communication between the safety control unit of the first type and the safety control unit of the second type if the signal is not received after a period of time which is longer than the defined time interval, the defined time interval preferably being longer than 1 second, preferably longer than 30 Seconds, particularly preferably longer than 2 minutes.

In a further embodiment of the method, this further comprises the step:

- Sending the STO command or enabling an STO operation from the safety control unit of the first type to the safety control unit of the third type.

Further advantages, features and details of the invention result from the following description of exemplary embodiments and from the drawings, in which identical or functionally identical elements are provided with identical reference symbols.

show here

Fig. 1: a highly simplified and schematic representation of an elevator with an elevator shaft and a cabin,

Fig. 2: a schematic block diagram of the safety control system.

Fig. 1 shows an elevator 2. The elevator 2 is shown in a side view. A Part of the elevator 2 is shown in a front view, this being indicated by the dot-dash line.

The elevator 2 includes a cabin 4 which can be moved along the shaft 3 . The elevator car 4 is held by a suspension means, the suspension means being a cable or a belt, for example. At the other end, the suspension element is connected to a counterweight. The suspension element is driven by a drive 6 .

The cabin 4 includes a cabin door 15 for opening and closing access to the cabin 4. In this exemplary embodiment, the cabin door is opened via an active door drive. The car door drive can be controlled via a safety control unit of a first type 14 which is arranged on the car.

At least one shaft door 10 is provided on each of the plurality of stories 21', 21", 21"'. The shaft door 10 can be opened or closed in order to permit or block access to the shaft 3, respectively. The elevator 2 also includes an active drive on each shaft door 10 . This active drive enables the landing door to be opened or closed by laterally shifting the landing door leaves. Each of the shaft doors 10 can be controlled by a second type 16 of its own safety control unit.

The elevator further comprises a car brake 8 on the car 4, the car brake 8 being controlled by the safety control unit of the first type 14.

A safety control unit of the second type 16 per floor 21', 21", 21'" and shaft door is arranged in a yoke of the door frame 25 above the door leaves 27. Also in this box 25 is a door lock 20 and an active door operator 22 and a wireless communication module for wireless connection 26 to the safety control unit of the first type 14, and a Sensor 36 for monitoring the status of the door lock. The security control unit of the second type 16 comprises a secure interface 32 and an insecure interface 34.

In normal operation of the elevator 2, the car 4 is moved from one floor 21'' to another floor 21'. The elevator car is moved by the action of the drive on the suspension element. The drive 6 is controlled in such a way that the car 4 stops when it reaches the corresponding floor. The passengers can now get on and off.

Fig. 2 shows the safety control system 12 of the elevator 2. The safety control system 12 is divided schematically into three areas. A first area 10 (identified by the box with the reference numeral 10) represents that part of the safety control system 12 which is located at the shaft doors 10 or in the immediate vicinity of the shaft doors. A second area (identified by the border with the reference number 4 ) represents that part of the safety control system 12 which is arranged on the cab 4 . There is also a third part (outline marked with the reference number 6 ) which is the part of the safety control system 12 which is arranged at the drive 6 .

In the area of the shaft doors 10, two identical safety control units of the second type 16 and corresponding sensors 36 and actuators 20, 22, 38 are shown. The secure control unit of the second type 16 is connected via a secure interface 32 and a secure connection 28 both to a first actuator 20 in the form of a door lock and to a sensor 36 , this sensor monitoring the state of the door lock 20 . Furthermore, the secure safety control unit of the second type 16 is connected via an insecure interface 34 and an insecure connection 30 to other sensors 36, specifically a magnetic sensor for detecting a cabin near the shaft door, and an actuator 22 in the form of a door drive. In the area of the cabin 4, the safety control system 12 includes a safe safety control unit of the first type 14. This safety control unit 14 is connected to a plurality of sensors 36, with four sensors 36 being shown in this exemplary embodiment. A camera on the cabin roof and a camera on the cabin floor are connected as sensors 36 . The cameras serve at least to monitor the room in which a service technician is working during maintenance. These sensors 36 are connected to the safety control unit 14 via an insecure connection 30 via the insecure interface 34 . In addition, an acceleration sensor and an absolute position sensor are also connected via an insecure interface 34 and link 30 . Furthermore, three sensors 36 are connected to the safety control unit 14 via a secure connection 28 . There are two slack rope sensors and a sensor 36 for determining the weight in the cabin 4. The safety control unit 14 is also connected via a secure connection 28 to two actuators 8, which are brakes. The safety control unit also includes a secure connection 28 in the area of the drive 6, via which the STO function in the converter can be triggered.

Finally, it should be noted that terms such as "comprising," "comprising," etc. do not exclude other elements or steps, and terms such as "a" or "an" do not exclude a plurality. Furthermore, it should be pointed out that features or steps that have been described with reference to one of the above exemplary embodiments can also be used in combination with other features or steps of other exemplary embodiments described above. Any reference signs in the claims should not be construed as limiting.

Claims

patent claims

1. Elevator (2), comprising a shaft (3), a car (4) that can be moved in the shaft (3), a drive (6) that is operatively connected to the car (4) and by which the car (4) can be moved a brake (8), a plurality of landing doors (10) and a safety control system (12) comprising a safe safety control unit of a first type (14) and at least one safe safety control unit of a second type (16), the safety control unit of the first type (14) and the at least one safety control unit of the second type (16) are connected to one another, the at least one safety control unit of the second type (16) being designed in such a way that the at least one safety control unit of the second type (16) indicates a state of each of the shaft doors (10) can be raised, characterized in that the safety control system (12) is designed so that the state of the shaft doors (10) directly exclusively by the least one Safety control unit of the second type (16) can be raised.

The elevator (2) of claim 1, wherein the safety control system (12) comprises one second type safe safety control unit (16) per shaft door (10), the second type safety control units (16) preferably being attached to the shaft doors (10). .

3. Elevator (2) according to one of the preceding claims, wherein the safe control units (14, 16) are designed in such a way that at least one actuator (8, 20, 22) assigned to them can be controlled by them, wherein the respective actuator (8 , 20, 22, 36) can preferably be controlled exclusively by this safety control unit (14, 16).

4. Elevator (2) according to one of the preceding claims, wherein each of the landing doors (10) comprises a secure door lock (20) and/or an active door drive (22) as an actuator, wherein the safety control system (12) is designed such that the Door locks (20) and/or the door drives (22) can be controlled directly and exclusively by the at least one safety control unit of the second type (16).

Elevator according to claim 4, wherein the condition collected by the safety control unit of the second type (16) is a condition of the door lock (20) and/or the door drive (22), the condition being a closed or an unclosed hoistway door (10 ) signaled.

6. Elevator (2) according to claim 3, wherein the safety control system is designed such that the brake (8) can be directly controlled exclusively by the safety control unit of the first type (14), which is preferably attached to the car (4) and the Brake (8) is preferably designed as a cabin brake.

7. Elevator according to one of the preceding claims, wherein the at least one safety control unit of the second type (16) is designed such that, in the event of an unsafe state of an actuator that it can control (20, 22), it sends status information to the safety control unit of the first type ( 14) sends.

8. Elevator (2) according to one of the preceding claims, wherein the safety control unit of the second type (16) is designed in such a way that the safety control unit of the second type (16) sends a signal for checking the communication to the safety control unit of the first type ( 14) sends, this happening at an interval of, for example, more than 1 second, preferably more than 30 seconds, particularly preferably more than 1 minute.

9. Elevator (2) according to any one of the preceding claims, wherein the safety control system (12) comprises at least one safety control unit of a third type (18) comprises, wherein the safety control unit of the third type (18) is connected to the safety control unit of the first type (14) and enables a safe torque-off of the drive (6).

10. Elevator (2) according to one of the preceding claims, wherein a connection (24) between the safety control units (14, 16, 18) is designed as a wireless and/or cable connection (24, 26), wherein in particular the connections of the safety control unit of the third type (18) to the safety control unit of the first type (14) as a cable connection, the connection between the safety control unit of the first type (14) and the safety control unit of the second type (16) preferably being a wireless connection (30), particularly preferably implemented as an insecure wireless connection.

11. Elevator (2) according to one of the preceding claims, wherein the safety control unit of the first type (14) and/or the safety control unit of the second type (16) has an insecure interface (28) for connection to sensors (36) and actuators (38). comprises, in particular, the security control unit of the second type (16) comprises an insecure interface (34) for connection to a shaft door drive unit, wherein the security control unit of the first type (14) comprises an insecure interface (34), in particular for connection to position sensors (36) and/ or speed and acceleration sensors (36).

12. Elevator (2) according to one of the preceding claims, wherein the safety control unit of the first type (14) and/or safety control unit of the second type (16) has a safe interface (30) for connection to sensors (36) and/or actuators (8 , 20, 22, 38), in particular the safety control unit of the first type (14) includes a safe interface (32) for connecting a slack rope sensor (36) and a load measuring sensor (36), and a safe interface (36) for controlling the brake (8) and to connect the safety control unit of the third type (18).

13. Method for controlling an elevator (2), preferably according to one of the preceding claims, comprising the steps

- Assessing a safe state of at least one, preferably all, landing doors of a plurality of landing doors (10) by ascertaining a safe state of an actuator of the landing door by at least one safe safety control unit of a second type (16), with the ascertained state being either "closed" or "Not closed" signals,

- Transmission, in particular insecure transmission, in particular transmission via a wireless connection (26), of the raised status of the at least one, preferably all, shaft doors (10) from the at least one safety control unit of the second type (16) to a safety control unit of a first type ( 14).

14. The method of claim 13, the method further comprising the steps of

- Receiving the transmitted status by the safety control unit of the first type (14),

- release of an opening of a brake (8), in particular release of a brake (8), by the safety control unit of the first type (14) if all of the received states correspond to the "closed" state,

- blocking opening of the brake (8) by the safety control unit of the first type (14) if one of the received statuses is "not closed" or not all statuses have been received.

15. The method according to any one of claims 13 or 14, the method further comprising the steps

- Repeated sending of a signal to check the communication by the safety control unit of the second type (16) to the safety control unit of the first type (14) at a defined time interval,

- determining the communication capability between the security control unit of the first type (14) and the security control unit of the second type (16) upon receipt of the communication verification signal, and - Determination of an error state in the communication between the safety control unit of the first type (14) and the safety control unit of the second type (16) if the signal is not received after a period of time which is longer than the defined time interval, the defined time interval preferably being longer than 1 second, preferably longer than 30 seconds, particularly preferably longer than 2 minutes.