NL2027507A - DEVICE FOR CONTROLLING A LIFTING LOAD - Google Patents

Abstract

The present invention relates to an improved device for controlling a hoisting load, in particular for controlling a lifting bridge. The invention is specifically aimed at providing a safe emergency support that allows a quick but controlled emergency stop.

Description

DEVICE FOR CONTROLLING A LIFTING LOAD

TECHNICAL FIELD The invention relates to an improved device for controlling a hoist, in particular for controlling a lift bridge. The invention is specifically directed to the provision of a safe emergency support that allows a quick but controlled emergency stop.

DESCRIPTION OF THE INVENTION In what follows, various sub-aspects are discussed separately. However, it is to be understood that a combination of one or more of these aspects, if not explicitly stated, also forms part of the description of the invention. In particular, such combinations are particularly preferred, wherein combinations of a greater number desl aspects are still preferable.

detailed, complete systems are shown in the figures belonging to this text, whereby the invention must not necessarily be provided with all subsystems in order to be functional. The figures should therefore be regarded as the most optimized embodiments specific to certain contexts, in this case a lifting bridge (Ringbrug in Tisselt). The figures should therefore be interpreted as in no way limited to embodiments in which all visible subsystems are included, especially where subsystems are redundant, are additional. In addition, the numbers of certain subsystems or components in the drawings, but also in the text, are not limiting, since they have been chosen mainly in the light of the current context. The skilled person will therefore be able to easily adapt the information in this document according to the situation in which the invention would be applied.

1. General: in a first embodiment, the invention relates to a device for controlling a lifting load, in particular for a lifting bridge, wherein the lifting weld relates to the bridge deck. The device then falls over the following parts: a. one or more hoisting loads, preferably a bridge deck of a lifting bridge;

b. one or more, preferably two or four, suspension points for the lifter, said suspension points situated at its highest point, fixed suspension points suitable for guiding cables;

c. at least one cable group comprising one or more cables, per suspension point,

wherein the rope group is connected at one end to the lifting load and the lifting load is suspended by the rope groups of the suspension points, the rope group extending over the suspension point, and the rope group is connected to a counterweight, the suspension point along the rope group loops the counterweight and the lifting load is positioned;

d. at least one motorized braking system, preferably a disc brake system, per cable group, the motorized braking system being capable of holding the lifting load when the lifting load is at rest with the motorized braking system closed, the motorized braking system configured not to close upon detection of a movement of the rope group above a predetermined speed, which represents a movement of the lifting load, preferably wherein this predetermined speed is substantially 0 m/s;

e. at least one motorized/mechanical emergency braking system, preferably a drum braking system, capable of cushioned deceleration of a downward movement of the lifting load, said motorized/mechanical emergency braking system being adapted for cushioned deceleration of the downward movement upon failure of the motors thereto;

f at least two motors and at least two drives, the motors and drives coupled one to one, for loading and unrolling the groups of cables, the motors being powered by an external power source;

g. a system for controlling the motorized braking system, the motorized/mechanical emergency braking system, the motors and the drives, the control system preventing the undesired closing of the motorized braking system;

wherein, in operation of the device, one of the molors and one of the drives act as a driving molor and driving drive, and another molor and drive act as a hot spare motor and hollow spare drive; wherein the control system is configured to actuate the hot spare motor and the hollow spare drive upon detection of failure of the driving motor and/or the driving drive through the slurry system to take over the drive of the rope groups and movement of the lifting load within a time frame of 500 ms to 2000 ms;

wherein the system is further configured to actuate the emergency braking system to apply mechanical braking to the hoist upon detection of failure of the hot spare motor and/or the hot spare drive by the control system.

With regard to point a. it should be noted that the lifting load may consist of one piece, or of several connected parts. In particular, the invention is directed to lift bridges, where the lifting load is the bridge deck itself, and typically comprises further components.

for point b. it should be noted that a suspension point itself can consist of several separate sub-suspension points, each of which can guide one or more cables, which are grouped together in one suspension point. The suspension points in the case of lift bridges are provided in lifting towers at the two longitudinal ends of the bridge (or at least the ends of the bridge deck}, and typically provided on either side of the width of the bridge, as can also be seen in Figures 2 and 3 .

The cables of the cable groups are connected, via the suspension points, to counterweights, which provide a stabilization in relation to the weight of the lifting load, in this case the bridge deck. In this way a substantial equilibrium is already achieved, and motors or other systems do not have to bear the full mass of the lifting load, but only have to be responsible for the manipulation in the relative position of the lifting load, which in equilibrium in principle can be achieved with minimal force. can be reached. These counterweights are provided at each of the suspension points.

The motorized braking system of point d. functions as a fixative system. It holds the hoist in position once it has been brought to a cool stop by the motors that drive the rope group (or at least that drive the rope drum on which the rope groups are wound and unwound). When the motorized braking system is closed, the load on the motors disappears. It is crucial that the motorized braking system is not used (even if extreme emergency situations where all other failures fail, and/or via manual override) to manipulate a moving lifting load. The braking system has two positions, closed and open. In open conditions, it does not interact with the cables/cable group/cable drum or other components that drive movement of the vehicle lift. In closed loessland, it clamps on one or more of the above components (lypically on the cable drums) to keep it in a stationary position. To ensure the above conditions, the motorized braking system is hydraulically designed and programmed not to lock during movements of the cable group (or as said, associated components) above a certain speed, preferably at which speed is 0 m/s, or in the event of failure of one of the components of this braking system. The failsafe state (in the event of a power failure or certain other problems) of the braking system is therefore open.

Preferably, the motorized braking system is provided in the form of two or more brake callipers per cable drum, the cable groups being wound and unwound onto the cable drum. The cable drums are provided at the other (relative to the counterweight end) ends of the cables.

In addition to this braking system, an emergency braking system is also provided, typically comprising drum brakes. This emergency braking system has been adapted to be able to manipulate a moving lifting load, and is used in the event of failure of all drives or motors, or the control system. The emergency braking system is preferably opened and applied per longitudinal end of the lifting load (Der oever for a bridge deck), from a common hydraulic group.

Preferably, the drum brakes are provided on the motor side, engaging a drive shaft directly driven by the motor. Again the drum brakes are adjustable in two positions, namely open or closed, with no intermediate positions.

As indicated, torques of motors and drives are provided, preferably in such a way that they can dynamically take over from each other. one of them redistribute the work of this, In case of two motors, the remaining motor will therefore take over the work, The motors are therefore provided in such a way that they are able to drive the cable groups independently. In other circumstances, one molor (or a subset of the total number of motors) is used as the primary motor, with the other motors {s} used as hot spare or hot standby, ready to take over if problems are detected on the primary. . These takeovers in both silualies are possible within a maximum of 500 ms of delecline from outages or other problems.

The drives are connected from the slurry system, as well as the braking systems. Typically the slurry system comprises one or more PLCs (programmable logic control), and preferably one or more so-called safety PLCs. The device is adapted to receive feedback or meal data from most subsystems. provided to the control system, lypically from detectors or sensors in or on the subsystems. For example, these decoders/sensors can display the position of the lifting load at multiple locations, the speed at which the cable reels extend or retract, the rotational speed of shafts driven by the motors, the applied forces or torques by brakes or motors, etc. On the basis of this data, the siuring system can dynamically adjust ds subsystems and check the proper functioning of the installation.

A crucial aspect of the current invention is the redundancy of almost every system, and in many cases even multiple redundancy (backup on backup). For example, on the one hand, the device provides several drives {moloren} which are responsible for pulling in and rolling out the cable groups on the cable drum.

These motors can be switched in a variety of ways {together or in primary and hot spare}, ensuring a drive guarantee in most conditions.

In the past, the takeover by a backup engine typically did not follow immediately, but first a hard stop was performed, after which the news engine took over.

Hard stops are of course undesirable, as these equipment damage, require inspection and often repairs.

In devices for lifting very large loads, such as the present invention, it is nevertheless crucial that they can stop the movement of the load in a short time, and bring it to a complete stop, a so-called emergency stop.

Given the enormous mass that is often used, this is initially carried out with the help of the engines.

However, in certain circumstances it is necessary to resort to braking systems that help to slow down the movement, for example if the engines were to fail.

In the past, such emergency stops were performed as hard stops, by allowing brakes to act on moving parts during the movement of the lifting load itself.

As indicated, this puts enormous stress on components and brakes, and poses the risk of breakage during braking, often leading to catastrophic consequences.

To avoid this, the old structure and management were adapted.

In the first instance, braking is performed just like the other movements of the hoist, namely via the main drive in the form of the reels (and drives) that unwind and retract the cable drums. one or more other molars, these by themselves can still manipulate the movement of the lifting load, When the inability to perform an emergency stop is detected {for example in the event of failure of both drives or part of the control system, step! the emergency braking system in action at the control of the system.

This emergency braking system, preferably in the form of drum brakes, acts on the shafts driven by the motors in order to slow down the movement of the lifting load and bring it to a standstill.

It is remarkable that the normal braking system is not used to bring a moving hoisting lasi to a standstill. This 'regular' braking system typically consists of disc brakes, and is only used to stabilize (hold in position) the lifting load once it has been brought to a standstill. The brake system engages the cable drums and closing the brake system while the cable drums are in motion can lead to breakage, so in normal operation the brake system only serves to hold the lifting load to relieve the motors. In the event of an emergency stop, the disc brakes only reactivate (i.e. close them} once it is detected that the lifting load has come to a standstill).

In a preferred embodiment, the motors and drives feed back measurement data to the system. This measure includes the speed at which the motors and drives roll out or retrieve the cable groups, whereby in the event of a discrepancy between these speeds a failure is detected/determined by the system, and the necessary follow-up steps are taken to bring the lifting load to a standstill. as discussed above, The advantage of this is that it represents an objective determination of the operation of the motors, and thus the movement of the lifting load. Of course, in most situations, further mounting measures are implemented to detect errors, such as direct (height) position measurements at different positions on the lifting load, measurements directly on the rope drum, on the shafts driven by the motor, on the drives, slic.

In a preferred embodiment, the control system is provided in the form of, or including, a safety-held programmable logic controller, or safety PLC, or safety PLC. A safety PLC is similar to a regular PLC, but with integrated safety functions for monitoring safety systems. Safety PLOs are specifically designed to be foolproof, and adapted to do so in a predictable manner in the event of failure. way so that further lailsafes can be provided in these cases. This goal is achieved, among other things, by providing redundant (micro)pfocessors and integrated diagnostic components to monitor inpul and ouipul, so that! upon detection of errors or failure, a safe shutdown of the PLC is performed.

It should also be noted that to be considered a safety PLC, a PLC must comply with internally established standards, such as IEC 61508 (Functional Safely of Electrical/Elecironic/Programmable Electronic Safety-Related

Systems), and is then further divided into different safety integrity levels {Safety Integrity Level or SIL}, depending on the successful 'resistance' to possible scenarios.

in a preferred embodiment, the drives dynamically drive the motors to effect a desired speed or acceleration of the loading or unrolling of the cable groups. in a preferred embodiment, the lifting load concerns a bridge deck of a lifting bridge with two longitudinal ends and two lateral sides, wherein at least one, preferably, two of the suspension points are provided on both lateral sides, and wherein one of the suspension points is provided on both lateral sides. is at each of the longitudinal ends. The rope groups from the suspension points at the first longitudinal end are drawn in and uncoiled by at least a first of the motors, and the rope groups from the suspension points at the second longitudinal end are drawn in and uncoiled by at least a second of the motors.

In practice, the drive will almost always take place per bank, with a group of motors (and drives) that act on the bridge deck at a first longitudinal end and a group of motors (and drives) that act on the bridge deck at a second longitudinal end, with the control is centrally controlled (which typically controls local subsystems).

In a further preferred embodiment, the cable groups, the braking systems and the emergency braking system at the two longitudinal ends are driven and controlled by a separate subset of the motors and the drives.

In a preferred embodiment, both motors control a controlled emergency braking during operation of the device, with the other motor taking over control of the emergency braking completely! within a time span of 500 ms to 2000 ms in the event of a failure of one of the motors.

In a preferred embodiment, the drives are configured to already supply (braking) energy generated by the motors by means of a braking resistor in the event of a power failure from the external power source to the drives, and whereby part of the dissipated braking energy is also used to drives to perform the controlled emergency braking.

When braking the movement of the lifting load via the motors, the energy generated by the braking can be fed and reused to supply the drives with electrical voltage during emergency braking. In this way it is ensured that, in the event of failure of the external power sources that drive the drives and motors, the braking function of the drives and motors will self-drive at the expense of the movement to be stopped.

In a preferred embodiment, the braking system is adapted to close the brakes in the event of a power failure of the existing power source via a ballery power supply only after the control system commands after deleting a lifting load has stopped. If this ballery supply fails, the brake remains open.

In a preferred embodiment, the emergency braking system is adapted to allow the brakes to close in the event of a power failure of the external power source via a battery supply only after the control system commands this upon detection of a stationary hoisting load. If this battery supply fails, a mechanical damped braking is performed. In a preferred embodiment, the emergency braking system is adapted to perform a mechanical damped braking on the lifting load upon detection of an emergency braking on one or more of the cable groups that lasts longer than a predetermined period of time, or when it is already detected during this period of time that the emergency braking does not follow the predetermined braking curve. In a preferred embodiment, the rope groups are retrieved and unrolled via rope drums, which rope drums are driven by the mole ears by means of a gearbox between the motors and the rope pulley shaft. In a further preferred embodiment, the motors drive a fast shaft, which fast shaft drives an idle shaft via the gearbox, which slow shaft drives the cable drums, wherein the ratio of rotational speed of the fast shaft to the fast shaft is at least 2, preferably at least 10. In a still further preferred embodiment, the braking system comprises a brake disc (or more) positioned on the mounting shaft on each cable drum, which brake disc comprises at least one pair of calipers configured to engage and retain the cable drum in a closed condition. , Upon detection of a failure of the slurry system or a failure of a hydraulic system that actuates the disc brakes, the brakes go into failsafe slaloop, which is the open state. The disc brakes are prevented from closing until the system detects that the bridge deck is under control. in a further preferred embodiment, the emergency braking system comprises one or more drum brakes for each motor, positioned on the fast shaft of the motor and configured to engage and decelerate the fast shaft when closed. By placing the brakes in different positions throughout the drive of the cable groups, it can be controlled in a more complete way, and several faiisafe systems are in position.

In a further preferred embodiment, a first encoder is provided on the fast axis, preferably an incremental encoder, further preferably having a Safety Integrity Level (SIL) of at least SIL2, wherein the first encoder measures the rotational speed of the fast axis, and therefore of the engine, measure.

in a still further preferred embodiment, a second encoder is provided on the slow axis, preferably an absolute encoder, more preferably with a Safety Integrity Level (SIL) of at least SiL2, the second encoder measuring the rotational speed of the slow axis, and therefore of the cable drum, as well as the position of the manure hoist.

EXAMPLE In what follows, a specific case is elaborated of a device according to the invention, adapted for controlling a bridge, in particular the Ringbrug in Tisselt. It is to be understood that this case is not to be construed as limiting, and is merely illustrative of the principles of the invention. Figure 1 shows a photo of the lift bridge according to the example. Figure 2 shows a schematic representation of the arrangement along the axis of the bridge deck. Figure 3 shows a schematic representation of the arrangement along the horizontal axis perpendicular to the axis of the bridge deck. Figures 4A-4E show views of the bridge deck from a lateral perspective, with additional information, cases discussed in a number of cases, Figure 5 shows a function sequence of the movement law when the bridge is opened according to the example.

Figure 8 shows the gene function course of the motion law when bridge is closed according to the example.

Figure 7 shows a possible functional course of a functional course of the control in a device according to an embodiment of the invention without calamity, i.e. without emergency braking.

Figure 8 shows a possible functional course of an emergency braking performed in a device according to an embodiment of the invention.

The Ringbrug in question is a lifting bridge in Tisselt, a borough of Willebroek.

The bridge spans the Brussels-Scheldt Sea Canal and carries the N76 from the A12 to the E19. The bridge was built in 1986 and has a metal movable desite with a length of 54.5 m and a width of 20.2 m. The bridge has a portico on both banks with 2 lifting towers and a central beam between them, It should be understood that the invention is not limited to this embodiment, which serves as an example, and is generally applicable to all lift bridges, and even other types of bridges.

This bridge consists of 2 architectural structures separated by the canal; the bridge itself with a portico on both banks consisting of an engine room and 2 lifting towers on the one hand and a technical building on the left bank (LO) on the other. Each lifting tower has an access door at the level of the bridge fall. These doors open directly onto a narrow feeler path next to the N16. Each engine room has a further landing door and a larger garage door below the slip roads, at the level of the towpaths, which give access to the engine rooms where the propulsion and movement work are located. The vertical towers contain next to! the counterweights also (at the top) the turning discs.

Per bank 2 main engines (MOT1 and MOT2 on LO, and MOTT and MOT2 on RO} are placed for normal operation, and 1 auxiliary engine (NMOT1 on LO, and NMOT2 on BO).

The main drive per bank consists of the 2 main motors |, each of which can be selected separately. A bridge operation is done with 2 molars per bank, with a 50/50 distribution of the torque. They are redundant Lov. lined up together. If necessary, one motor can take care of the full torque, and the second motor turns freely.

The speeds of the main drive motors are each controlled by a Powerflex Active Frontend variable speed drive from Rockwell Automation.

With the hydraulic auxiliary molor, the bridge can be moved at a very slow speed. This requires local changeover actions by a mechanic, more specifically the manual adjustment of the coupling with the gearbox. The auxiliary motor is connected to the gearbox by means of separate smaller gearbox. The gearbox is connected via the output shafts to the 2 counterspinned winding cable drums, which are placed in the sliding engine room. The drive cables are connected via a pulley to the underside of the bed weights which are located in the lifting fenders. The bridge has 4 counterweights that move in the lifting towers. These are each connected to the bridge deck by means of 4 sverwichis cables that run over the return wheels in the lifting towers. Since the bridge is powered by 2 independent mechanisms, synchronization of both banks is necessary to keep the fall horizontal during the movement. A schematic representation of the drive system can be found in Figure

2.

2. Bridge The drive system for raising and lowering the bridge deck is constructed identically for each bank and can be seen in Figure 2. The individual components of the drive system are discussed in the paragraphs below. 221 Reducior (TWK) The central gearbox in Figure 2 has the code TWK (gearbox). The gearbox is equipped with an oil pump. It will start as soon as a movement of the bridge deck is ordered. If this pump is faulty, this will only be reported. The operation of this pump is not a condition for starting a bridge movement.

2.2 Brakes (RGP1, RGP2, TNK1, SREM, TREM) The braking system in Figure 2 contains components with the following codes: e RGP1, RGP2: two motor/pump combinations that open or close the brakes via valve control. A braking movement occurs with 2 pumps together; in the event of a failure of one, the residual pump is only able to realize the braking movement, without requiring intervention from an operator or technician. Both the drum brakes and the disc brakes are opened or released per bank from these common hydraulic groups, s TNK1: an oil tank with oil level detection. Opening the brakes is not allowed if there is little oil in the system, e TREM: on the fast axle there are 2 drum brakes per side. These are hydraulically and mechanically designed in such a way that they close delayed. In the event of a failure of the control system {PLC}, both drives, or a failure of the hydraulic system, these brakes will go into failsafe status, meaning that they will perform that delayed siuiting. Each drum brake has 2 detections: brake gscpend and brake sicien. « SREM: a brake disc is placed on the slow shaft per cable irommei. Two brake calipers are installed per brake disc. In the event of a failure of the control system {PLC}, or a failure of the hydraulic system, these brakes will go into failsafe status, meaning they will continue to open. Each caliper has 2 detections: brake open and brake siolan.

The moment of control is also included in the sequence described further. The Master PLC will control the brakes from the safety program, by means of the “safe brake control” function. This function will monitor that brakes only open when the drive reports back that this bridge is “stuck”, and also checks the brake feedback relays for proper operation. It is very important that the brakes are kept open when a safe braking is taken after a power failure. For this, the valves that open the drum brakes are powered by the UPS.

All brakes are used for both the main and emergency drive of the bridge deck, and the associated sensors and actuators are run on both control systems. The manual brake controls can be used for maintenance purposes, but caution is required. This manual operation includes a hand pump, and ball valves for selection to open/set the disc and/or drum brakes.

Parallel contacts are used to control the valves and pumps, of which the control of the associated contactor takes place either from the main PLC or not from the emergency PLC, and also depends on their respective emergency situation.

The critical sensors (brake open and closed limit switches) are placed twice; one set is connected to the HooldPLC, the other set to the EmergencyPLC.

The proper functioning of the whole is monitored. This means that when a movement is actuated, the brake must reach the requested position within a certain time. Also, a brake may not leave its position without being commanded to do so.

If the main drive is not able to perform a Safestop 2, for example in the event of a failure of the Main PLC or 2 drives on 1 bank, the drum brakes are made of steel to perform a fully damped braking without intervention of the control. It is very important that the disc brakes are never closed while the speed of the bridge deck is <> 0. Their failsafe status during bridge movement, eg failure of the Master PLO or failure of a group or valve that opens the brakes, is therefore “ brakes open”. The brakes can be closed again if the PLC is able to give that command, and it will only do so when no more bridge movement is measured. The brakes can also be reactivated by manually operating a ball valve. The hydraulic steering concept was developed accordingly. In the safety area of the Main PLC, the diagnostic coverage of this operating principle is carried out for each movement, by means of checking the return of a correct initial position of the control valves, brake shoes and brake calipers, before a new bridge movement is allowed.

2.3 Lubrication (SGP, STNK) The drive system is equipped with an electrically controlled grease pump. This Sat! start as soon as a movement of the bridge deck is ordered. A feedback from associated motor protector and relay is provided. Furthermore, a pulse signal is given to the PLC when a full lubrication cycle has been completed. A cycle is complete when sheet is injected into the four lubrication channels. The four lubrication channels are: drag bar 1, drag bar 2, deflection disk 1 and deflection disk 2. When a certain time has elapsed and no sufficient lubrication pulses have arrived at the PLC, a message is created for this. The operation of this pump is not a condition to start a bridge weighing.

2.4 Main drive (DR, MOT, ENG) The main drive system is shown in Figure 2 and ordered sub-components with the following codes: e DR: a 4quadranian frequency drive, containing 0.a. can fulfill safety functions. e MOT: an AC drive motor e ENC: a SiL2 incremental encoder, mounted on the output shaft of the drive motor. Further discussion of the sub-components follows in the following paragraphs:

2.4.1 Drive

2.4.1.1 Bridge speed Initially, the bridge speed is continuously regulated with the drives. Depending on the sland designation of the bridge deck word! the motion law commanded. When changing the speed limit, the drives accelerate or decelerate via an acceleration or deceleration time commanded by the PLC until the new set point is reached. The PLC uses a standard SORV (S-curve) for this, and will forward this curve to both banks for synchronous acceleration and deceleration. Via a closed loop control, in function of an encoder mounted on the corresponding motor, each drive will maintain this speed target. Ds drive is equipped with the necessary self-diagnosis to monitor correct enforcement of this selpoint. In addition, the EPLC (encoder PLC) performs an overspeed monitoring and deceleration control, whereby a controlled emergency stop will be performed if the measured actual speed of the bridge deck exceeds a fixed limit. The maximum allowable speed (500tom} is fixed in the drive, and the drive will never exceed it even if the PLC commands a higher value, This maximum allowable speed is fixed, as this is the maximum speed according to current law of motion, and given the limitation on the speed that the bevel gearbox can handle, the maximum allowable offset LO<>RO applied in synchronization is fixed in the PLC and cannot be exceeded.

2.4.1.2 Synchronization LO <> RO It is very important that any difference between the lifting heights of both banks remains within a certain limit value. From the measuring system, the Main PLC receives a difference value from both EPLCs that can vary between + 20cm and -20cm. Both EPLC's know the readings from both banks, deduct the reading from the other bank from their own meal value, and send the result to the Main PLC via an analog output. Some cases are discussed below to illustrate the functional operation: (1. Synchronization at | Functional: | normal operation During the lifting of the bridge, the EPLCs register a difference | lifting — see Figure | of 12cm. The main PLO will start adjusting as soon as the 4A difference » 10cm and stops adjusting as soon as the difference < 3cm In this case the Main PLC will reduce the cut point of the drives LO by 30rpm, whereupon they will reduce their output speed by 30ipm (fixed). may also happen | during the generations of the S curve, so the drives are in | steel apply this offset while accelerating or

| decelerate, and not only when they are running at a fixed speed. | Consciously no complicated control algorithm is used! with | virtual axis or Pl control, By fixing the {oe offset to be fitted | and to keep it limited, the risk of software fouling increases | and excessive skew due to a control error or | defective encoder reduced in size. | Controls: | If the adjust command is active for a time longer | then 10s, a lime out alarm will be generated and | stops the bridge movement (soft slop). If the difference is still | is always larger than 10cm, a rechizelling will be at stilsiand | be executed (case 5} as soon as a new command | is given | if the difference becomes greater than 15cm, a pre-alarm | will be triggered and the bridge movement will stop (soft stop). | After giving a new command the slurry perform a reset at standstill (case 5) 2. Synchronization at Functional: normal operation During the descent of the bridge the EPLCs register a difference descent — see Figure 48 | of 12 cm. The hootdPLC will start adjusting as soon as the | difference » 10cm and stops the adjustment as soon as the | difference < 3 cm. in this case the Main PLC will send a signal to the | drives RO, whereupon they reduce their output frequency by | 30 rpm according to the principle stated in case 1. | Controls: | See case 1

3. Behavior at too Functional: TTT | big difference -- see | During sen movement, the EPLCs notice that the difference is | Figure 4C accrued iol ssn value greater than 20cm. Via an error pull | they transmit an emergency command to the main PLC. The | drives then execute sen 882 command. During hell | finishing that $82 command doesn't make any edits | undertaken more. The bridge deck can then ferug | be rammed by using the emergency steering, | see {4}, after the cause of the misalignment has been investigated. | Controls:

| The emergency stop circuit can only be rearmed if the difference | between the two cevers is less than ZOom. a. Toggle Functional: | synchronization — see | When during the lowering of the bridge 1 of both ocsvers the | Figure 4D limit switch range, the synchronization is turned off. | The bank that has reached the sincechakslaar shall be stopped | turn into; the other bank continues turning until these are also | limit switch bareiki. | Controls: | in case of a defective limit switch, this is either too early | switches, or not at all, the EPLC will indicate this and a stop | initiate. See 8.1. In addition, the pre-alarm difference | > 15cm, and emergency stop alarm difference >» 20cm active in this phase.

5. Correction for Functional: TTT | movement == see | As soon as the bridge is lifted or daa! command, a | Figure 4E Resetting at standstill can be performed when the | Main PLO signal gets that the difference is greater than tCcm. To | ar to make sure that this also works with a bridge that is down, | adjustments are always carried out by means of the | control of the bank that is too low, with the offset value | from 30 rpm. As soon as the difference of Sum is smaller, | . becomes this rechizeiling aborted, and the normal movement | start. | Coniroles: | The checks from case 1 also apply here

2.41.3 Safe braking A drive system is built that guarantees a gradual safe braking 'at all times' (Defects of both drives on the same bank {double simultaneous fault}, reducer, cable work or the brake {men} are not considered here ). At all times we mean: e Emergency stop: initiated by an emergency stop button or from the central control system due to a defect or irregularity (eg tilt of the bridge). This safe slop works according to the principle of Safe Stop 2 (882) according to

EN 60204-1. When the system is certain that the brakes have been applied, the SS2 function may be followed by a Safe Torque Off {STO}; e Power failure of the power supply: The propulsion system provides a means, in the event of a failure of the mains power supply, to slow down the bridge in such a way that the brakes can be closed safely, without power sources other than a control voltage. The drive is able to dissipate the necessary braking energy to an installation outside the grid, by means of a correctly dimensioned braking resistor - it then acts as a generator ì.0.v. braking resistance, as well as giving a signal if the available mechanical inertia / energy of the bridge is insufficient to guarantee normal (electrical braking} of the bridge. This signal will be used to close the brakes. or drive In the event of a failure of a 4-quadrant motor or drive, the other motor or drive is "hot standby" and takes over the requested braking functionality within 500 ms to 2000 ms « emergency braking must take place within a time of 6 s +/ - 0.5s with a linear decrease in speed; « As soon as an emergency braking lasts longer than 6s, or if the expected deceleration is measured during the braking, the safety PLC will decide to perform a mechanical braking using the drum brakes. installing a safety drive, in collaboration with the motor in the paragraph below, Lsm the safety encoder on the motor, in collaboration with the safety PLC, this is realized.

2.4.1.4 Self-diagnosis For each setpoint supplied to the drive, it is checked by the safety function “safe speed moniloring”. That selpoint is determined from the non-failsafe part of the PLC (handling motion law, adjusting difference LO<> RO, reaching end position, controlled slop}, but can be overruled by the safe program {veriraging control, SafeSlop 2, STO). in any case, the molor speed is reported by a SiL2 encoder, and the “sale speed monitoring” function will declare the drive as “disturbed” as soon as the set point offered le deviates a lot from the reported speed, detecting errors such as: e The drive has a malfunction and is electrically not in steel to hold the motor e The motor has no malfunction e The encoder has a malfunction, or is no longer coupled to the motor If the drive is “faulty”, the backup drive will functionality instantaneously on command from the safety PLC. If the second drive is also “disturbed”, an emergency braking follows with the mechanically delayed drum brakes, also on command of the safety PLC.

2.4,1.5 Redundancy The redundancy character of the set-up has already been mentioned above. When 1 drive has a malfunction, the other immediately takes over the requested functionality, even if this happens during, for example, the handling of an 882. If the malfunction has a rather permanent character, the operator can set that only 1 drive per bank will worked further. In that case, takeover during a controlled emergency stop is no longer guaranteed, so it is mandatory to continue working at a reduced speed. When both drives per bank are working correctly and in service, they will use the principle of load sharing, so they each account for a torque of 50%. The setpoints are therefore always sent to both drives per bank. In the event of a failure on one drive, the safety PLC detects this and then commands the remaining drive to supply full torque.

2.4.2 Motor The motors, each driven by a drive mentioned in the above section, are equipped with a SIL2 encoder, which measures the rotational speed and transmits this to the drive. Furthermore, each motor is equipped with 2 external cooling fans. These are controlled with every movement. If the cooling coils are defective, the bridge may not start. When the motors have the bridge and open brakes, they provide torque and the motors get warm. If these engines become too hot as a result, the bridge could fall. Finally, a PTC relay switches when the molor has reached 155°C. This signal is a PLC input where we: = Alarm motor lemperaluur high. = Bring the bridge to a stop when it's in motion, then lock the brakes, and finally slam the motors when the brakes are off. = The bridge must not slack while this alarm is active.

2.5 Emergency drive The emergency drive system is shown in Figure 2.

The emergency drive can be selected in mode 2d to drive the bridge using the control system described further below. All signals and functionalities with regard to 1. the bridge deck is then driven via the Emergency PLCs; for road and shipping signalling, this will continue to be done via the HooidPLC. Only the feedback on the clutch of the emergency drive is indicated directly on a failsafe input of the hooldPLC. The main drive is controlled by means of intervention in the emergency stop circuit is made impossible if the emergency drive is not correctly disconnected from the gear unit.

2.6 Cable + guide 13 2.8.1 Weak cabsi detectis In case the drive would continue to rotate when the bridge is resting on its blocks, the hoisting rope will hang siap, report the danger of it rolling off the rope drum. A mechanical construction detects this, and will indicate this phenomenon to the main PLC by means of a sen safety sensor. An emergency stop is then performed on this. Local correction using the emergency drive will then be necessary.

2.6.2 Tow bar In case the cable winds up on its own on the cable drum, this will be detected by a mechanical construction equipped with a safety sensor. An emergency stop is then performed on this. Local correction using the emergency drive will then be necessary.

2.6.3 Deflection wheels There are no detections or sensors that are read into the hooldPLC. The lubrication is provided by the central lubrication system.

2.7 Counterweight The trapdoor has a detection: "trapdoor vertical" to detect whether the trapdoor is still open. This deletion is an input from the main PLC. This input is to indicate that the hatch is open. The security for the access of the hatch becomes! further described,

2.8 Bridge deck The position of the bridge deck! measured with the encoder, can be found on Error! Reference source not found. This position is read in and processed in the EPLC. The switching points at which the Main PLC has to adjust the speed is done by means of contact exchange between the two PLC systems. The motion laws were measured on the current control, and are reproduced with the new control.

A third law of motion is added: Opening lot Sm. This means that during the lifting of the bridge a controlled stop is automatically performed as soon as the measured position > Sm.

During each phase of each movement, it is possible to give a controlled stop, and to give a new command in any direction.

The position “bridge down” will be signaled with 2 inductive sensors, which register that the bridge is on its blocks. In the event that the bridge deck is not completely laid down, due to an encoder's mestiout, or an obstacle lying on the blocks, whereby the cable unwinds without the bridge sinking, a comparison of the measured switching point of these sensors versus the instantaneous encoder value, generate an error message. A sensor that switches too early, due to defect or contamination, will also be identified according to this principle.

3. Lock closed position

3.1 Main The interlock installation is maintained, and the control will be programmed according to the principles described in this document.

3.1.1 Tank The tank is fitted with oil level monitoring contacts. If the skin is too low! control of the pump is prevented.

3.1.2 Motor-pump group The actuation of a lock takes place as follows: Start pump -> check feedback -> switch freewheel valve -> switch movement valve. If the limit switch reports that the position has been reached, or the stop button is pressed, the movement is stopped.

The running time of each latching movement is monitored by the PLC, both for the release and the timely entry of all limit switches. The loss of a detection without command is also alarmed.

The position of the selector local or aulomalic operation is also controlled by the PLC.

It is always checked whether the bolts are correctly unlocked before the bridge deck can be moved quickly.

3.2 Main As emergency control, a local pear can be connected to the control box. The control then takes place independently of the PLC control. Nothing is changed. The operating principle is explained further in this document.

4. Lock open position

4.1. hood

The interlock is not controlled from the Main PLC. The open position of the lock must be checked before the bridge can be moved.

4.2. Emergency Local operation of these bolts is possible. Nothing is changed.

5. Control system A central CPU will be provided in the technical building, which will be connected to two Remote IO islands (one on each bank} and this via Ethernet. A Remote IO is installed on each bank {inner bank {LO} and right bank (RO}}). island that collects the inputs and oulputs from the appropriate bank and forwards them to the CPU for processing.

To realize the data communication between the CPU and the remote IO siland on RO ie, use is made of the optical fibers in the underwaler junction.

5.1. Eunclional course of control without calamity (happy flow) After a command to move has been given, the sequence is started on both banks. First it is checked whether the selected drive and the brakes are fault-free, If so, then the drives are activated and torqued put. The monitoring of the drives will now start; if you are not operating in “reduced speed” mode, the backup drives are also checked! Moving at maximum speed is only possible when both drives are “online”: this is monitored by the PLC.

As soon as it is detected that the motor is on torque steel, the brakes on the fast axis are continued to be opened, followed by the brakes on the irage axis. The brakes must report back within a specified time that they have been opened correctly and must remain in this position for the remainder of the sequence. This is actively monitored by the central PLC.

The open position of the brakes, as well as the torque of the selected drive, act as a synchronization signal between the banks. From now on, a speed interchange will be set simultaneously on both banks in function of the law of motion, which will also be monitored from now on (overspeed, underspeed, positions of limit switches that do not correspond to the encoder value, skew position...). Both banks have a safe encoder for this. The difference in height between the two banks must not exceed a previously set value. The central PLC makes the necessary adjustments to the set speed during the movement.

On reaching the end position, the drives indicate that the speed is 0, and the brakes are applied, All synchronization and monitoring are interrupted and the drives are switched off. If the brakes do not close and the bridge steel opens then the drives are activated so that the motors remain on the bridge, if the brakes do not lock and the bridge steel is closed the drives are still switched off.

if an error is defined or an emergency stop is pressed during the monitoring of the drives, brakes or movement, the control described in paragraph 5.2 is switched over.

if a brake does not close, and the bridge is open, the torque is maintained on the motors. If a brake fails and the bridge is closed, the torque is taken from the motors.

5.2. Functional effect emergency braking (unhappy flow) If an emergency stop is initiated on one {1) bank, this must also be done on the other bank. In other words, the PLC will always send an emergency stop command to both banks, even if the emergency stop is the result of a fault on siechis 1 bank.

The emergency stop procedure for each bank follows a specific degradation model. An attempt is made to brake with the active drive, in case of failure the backup drive takes over the braking. In the event of failure or unavailability of the backup drive, progressive mechanical braking is performed. This progressive mechanical braking should be started simultaneously on both banks, even if the drive can brake correctly for the other bank. The control of this exercise is in the hands of the PLC, not the drives.

The 'fast stop' procedure must be completed within 6s. Also, the PLC must not detect a speed increase during the emergency stop. If these conditions are not met, {progressive} mechanical brakes will be applied irrevocably on both banks.

If, after performing a soft or “fast” stop, there is no correct feedback that all brakes are closed, the drive will hold the motor at torque for an indefinite period of time.

A safety PLC with remote 10's is used for the PLC control. The safety functions that are “depending on a control system”, resulting from the risk analysis and listed in the safety reguiremenis, as well as the safety interlocks listed in all-inclusive specifications, are programmed in this PLC. The assembly of the PLC installation, and also the interaction with the Scada system is elaborated on the network plan. The structure of the PLC software and the practices involved are based on the rules of the game described in the standard description, and will be described in detail in the software design document. The PLC control will be addressed from a scada system, row distance ie local, whereby the communication takes place over an OPC server.

5.3. Cooperation between circuits in the FPLC When the cooperation between the bridge, drives and brakes is examined in detail, this leads to the following analysis: All brakes (SREM, TREM, RGP) and drives (DR) receive a command from the Drive biok {MK LO and ML RO}. The Drive Biok (MK LO and ML RO) receives commands (open/close/speed) from the Bridge Block (B}. The Drive Blocks will first enable the drives, and when all drives are enabled, and ready to receive a Separation Point, it will ask the drivetrain to open the brakes, This by giving the commands TREM Open and SREM Open. Feedback to the drivetrain is given as soon as all brakes are correctly open, otherwise the movement cannot be started.If a brake fails , the initidle command will drop, because the SREM/TREM/RGP blocks will then produce time outs that will lose the executability of the step.Also via a collect bit “drive system fail”, an SS2 is given to the E-PLC. during the movement a brake open feedback would be lost, an S82 is given from the normal program to the FPLC (drive system not OK). t convert it to an S-curve and pass it on to the drive blocks, finish handling the law of motion, wait for the drives to zerospeed, then command the brakes to close. This is done by removing the command open TREM and open SREM. Close the brakes. The drives must remain enabled until the brakes report correctly when they are closed, even if an emergency stop is knocked in the meantime! This does not apply if the bridge (detected via F sensor) is at the bottom. So closing time out Bem does NOT give SS2. IREM: Suppose a TREM block is commanded to open the brake from the bridge block. First, the TREM asks block to star the RGPs. 1 of the RGP's must report that it has started correctly before the TREM block can continue. Both groups must, however, be given enough time to slack or fall into a disturbance. Conditions to continue can be (BGPI_GESTART * ROP2_START) or (RGPI_STO * RGP2_GSTART) or (RGP1_GSTART * RGP2_STO). When the release from the BGP is present, this blgk will pass the command to open the valve to the F-PLC {for F output). Both groups in failure cause a soft slump of the bridge (see explanation RGP), but the «open still siseds follow the command from the bridge/drive block! The release from the RGPs is therefore only a stari condition. Furthermore, this block monitors all feedback from the brakes. The feedback from the valve vs the control is also monitored.

When the command to open the brake is lost, the tilt command to the FPLC is lost, and the command to the RGPs is lost. Open brake time out and valve open time out give a 582 request to the safety PLC, close brake time out does not do that! Each alarm makes the operativeness of the slack disappear (except TO close). Part in safety PLC: From the normal program, the FPLC receives the command “pull TREM open valve”. This is passed on 1 to 1 on the safety output, unless the safety PLC sees that the software emergency siop relay is lost: in that case the valve is kept open for a maximum of 6s, unless zero speed is reached (measured via EPLC) or some interlock of the safety matrix is in effect. The “valve not pulled” feedbacks are necessary for the diagnostic coverage. Arming the emergency stop circuit is therefore not possible if this valve does not report back that it is switched off. The same story applies to all feedback “TRem closed” If the manual valve is not in the correct position, the NS relay will also drop out! SHEM: The SREM block is commanded to open the brake. First, the SREM block asks to start the RGPs. One of the RGFs must report back that it has started correctly before the SBEM block can continue. Both groups must be given sufficient time to start, or to fail. Conditions to continue can be (RGP1_ STARTED * RGP2_ STARTED) or (RGP STO * RGP2_ STARTED) or (RGPI_ STARTED * RGP2_ STO). When the release from the RGP is present, this block will pass the command to open the valve to the F-PLC (because F output). Both groups in malfunction care! for a soft stop of the bridge (see explanation RGF), but the valves still follow the command from the bridge/drive block! The release from the BOPs is therefore only a stari condition. Furthermore, this block monitors all feedbacks from the brakes. The feedback of the tilt vs the control is also monitored via. When the brake open command is lost, the valve command to the FPLC is lost, the command to the BOPs is lost, and the “SREM Close” valve is pulled until the brakes report back when they are closed.

Open time oul brake and open lime oul valve give 882 request to the safety PLC, Time out brake/shuttle valve and does not! Any alarms target the executability of the step drop (except TO close)

Part in safety PLO: From the normal program the FPLC receives the command “pull open valve SREM”. This is passed on 1 to 1 on the safely output, unless the safety PLC sees that the software emergency stop relay is failing: in that case the valve is held open for a maximum of 6s, unless zero speed has been reached (measured via EPLC) or some interiock of 'the safety matrix is in effect. As soon as zerospeed is reached, the tilt Brake Close is pulled, on command from the regular PLC, but only allowed through here if the EPLC says that the bridge is stopped by means of F input. The “valves not pulled” feedbacks are necessary for the diagnostic coverage. Arming the emergency stop circuit is therefore not possible if this valve does not report back that it is switched off. The same story applies to all feedback “SRem closed” If the hand valves are not in the correct position, the NS rsiais will also drop out! An RGP block receives a command from the TREM or SREM block. Without thinking about it, this will start the group, by pulling the control contactor --» E-OUTPUT, so there is a signal! passed to the F PLC. The block monitors all feedbacks from the contactor (both contactor ON and contactor OFF) by means of a. a control TM subroutine. In the event of an alarm, the BGP is put into failure mode. The rise of the pressure is also monitored with control TM. In the event of an alarm, the RGP also goes into failure mode. As soon as the contactor is pulled and the pressure is present, the status “pump started” is returned to the SREM and TREM blocks. When both RGFs of a bank fail, the viability condition of the open bridge / close bridge command is dropped. {soft stop so). As long as the valve control is left undisturbed, the brakes will remain open even if the groups are off. Part in safety PLC: From the normal program, the FPLC receives the command “attach contactor”. This is passed 1 to 1 on the safely output, unless the safety PLC sees that the software emergency stop relay is off {with an off delay of 8s}, or some inlerlock of the safety malrix is in effect: The {feedback messages “contactor OFF" are necessary for the diagnostic coverage, so arming the emergency stop circuit is not possible if these contacts do not report back that they are switched off.

6.1. Encoder slow axis

6.1.1. General When referring to the encoders for the encoder of the bridge position and of the speed, the term "rotary encoder" is interpreted as follows: The invention further provides a system of network PLCs (EPLC).

The encoders comply with the safety threshold SIL2. The EPLC to which the encoder is coupled is therefore also connected.

Functionally, the system can be described as follows: An EPLC, provided with only 10 cards, and a fieldbus interface is set up in the engine room of the bridge, one per caver.

A local fieldbus is built and an absolute multiturn SiL2 encoder is connected to this network.

The encoder is installed on the drive shaft of the bridge.

This EPLC will enter the encoder value, and scale it to a value corresponding to eg.

O..max height; then this value is converted to a few switching points.

The switch pins are written on output outputs, and presented as inputs on the main PLC.

As a result, the hay dPLO has the necessary switching points to handle the motion law, and the logic adopted herein does not differ in the switching pattern of a conventional, wire-break-proof isolated limit switch equipped bridge.

In addition, this EPLC is also linked to the Ethernet, in such a way that the position on a local display, but also a display on the other bank, can be paid, regardless of whether the main PLC is in operation or not.

The desired switching points of the deceleration moments can be set on these displays or on the scada.

With the exception of the switching point of the delay control.

This point must always be at the last position at which the bridge still has the possibility to brake within 8s from full speed, without speeding past the end position, and this is fixed in the safety section of this PLC.

Both EPLCs are in communication with each other over the network, and can thus each calculate the difference between the two banks for the purpose of skew monitoring.

Both EPLC know the readings from both banks, subtract the reading from the other bank from their own flour value, and send the result to the HooldPLC via an analog output . The main PLC receives these measured values via an analog input, whereupon it can ensure that the height difference loops on the banks will not become too large, see 0. The EPLCs will intervene themselves by initiating an emergency stop via an F output, if The difference between both banks is apparently not controlled by the Main PLC, and the difference exceeds a fixed limit.

Because this system is equipped with SIL2 encoders and safety PLC, an emergency stop can be generated on the main PLC via safety outputs if:

e The difference in position between both banks is too great

= The measured regime speed is too great e The measured limit speed is too great (when operating on 1 drive per bank) « The measured approach speed is too great when the deceleration control switch point is reached

6.1.2. Self-diagnosis Various options for diagnosis are provided.

+ The system receives a signal from the central PLC when a movement in a certain direction is controlled. If this direction does not match the direction of rotation of the encoder, or if no movement is detected at all, an alarm will be generated.

e If the encoder is turned without sen control being active, a fault message is also given.

+ Communication with the encoder is continuously monitored e The "bridge down" limit switch is connected to this system. When commissioned, the switching point of this sensor is measured and stored in the memory of the PLC. If the switching point of this limit switch no longer corresponds to the stored value, an error message is generated.

6.1.3. Position Accuracy The encoder outputs 8192 pulses per revolution. For a total opening of 27m, the slow shaft has made 5.5 revolutions.

270.000mm FiesTEE = omm Mel the selected encoder word! for the measurement of the height of the bridge deck, an accuracy of 6 mm is achieved, registered by the EPLC. The skew land monitoring in the EPLC can be performed with sufficient accuracy. By setting the switching points with the help of the law of motion, can be done with sufficient precision. The Main PLC must know the msel values of both banks for the synchronization. If this value is sent to the Main PLC, by means of an analog output and input, the accuracy of this can also be calculated: PLO resolution : 270.000mmi{stroke)} / 27500 = 9.8mm {4mA = Ù and 20mA = 27500 in the PLC) If the linear sensitivity of the analog output card of the EPLC is included, being 0.03%, this already results in an inaccuracy of 80mm. This is not accurate enough.

With this insight, it is decided to send the fertilizer values via the network if it appears that the scada OPC server can retrieve the measured values directly from the EPLOs (study also ongoing), or the value of the difference, calculated in the EPLCs, to be forwarded by means of analog input and output. Because this is a limited number {max 15cm), word! this does however achieve sufficient accuracy to allow the synchronization between both banks to take place.

6.1.4. Speed Accuracy If the 100% speed to be calculated in the calibration check is considered, being 0.289m/s = 289mm/s, it can be determined that the EPLC will calculate a speed of 48 encoder pulses per second. This is sufficiently accurate to perform a correctly functioning overflow monitor. If the 10% speed to be controlled by the deceleration check is taken into account, being 0.04m/s = 40mm/s, it can be determined that the EPLC will calculate a speed of 6.8 encoder pulses per second. This is accurate enough to perform a correctly working delay control,

6.1.5. Conclusion The functionalities to be realized: e Set switching points delay with an accuracy of +/-6mm s Display the position locally with an accuracy of +/-8mm + Monitor the difference in position between both banks is too great (> 20cm +/ - 2x6mm} e Forwarding that difference to the Main PLC (< 20cm +/-2x8mm +/-0.03%)} « The measured regime shaft cleanliness is too great e The measured limited speed is too great (when operating on 1 drive per bank ) « The measured approach speed is too great when reaching the switching point of the delay control Finally, this system provides an additional control signal to the main PLC, for an additional check on the correct execution of the Safe Stop 2 for the drives. If the bridge decelerates according to a certain delay, the EPLG displays dil by high-selling an F exit.

8.4. Encoder fast shaft Each motor of the main drive is equipped with a SIL2 absolute encoder, The speed that the motor will have made at a full movement O> 27m is calculated as follows: tees ò ING & (i red = ratio of gearbox, and d_kabellr = diameler cable drum)

The engine will therefore have made 779 rpm.

According to the specs of the selected encoder, it can make a maximum of 4036 revolutions, so this is no problem.

The selected encoder gives 2048 pulses per revolution.

Converted there are 17,000 pulses per second at full speed to participate in the SIL2 safe speed check, so that the achieved accuracy is therefore no problem.

Claims (15)

CONCLUSIONS Device for controlling a hoisting load, in particular for a lift bridge, wherein the device comprises: a. one or more hoisting loads, preferably a bridge deck of a lift bridge; b. &6 One or more, preferably two or four, suspension points for the lifting operator, said suspension points situated at a high point, said suspension points suitable for guiding cables; c. at least s6n cable group comprising one or more cables, per suspension point, the cable group being connected to the lifting load at a first end and the lifting load being suspended by the cable groups of the suspension points, the cable group running over the suspension point, and the cable group being connected on a counterweight, the suspension point being positioned along the rope group between the counterweight and the lifting load; d. at least one motorized braking system, preferably a disc brake system, per cable group, the motorized braking system being capable of holding the lifting load when the lifting load is at rest with the motorized braking system closed, the motorized braking system configured not to close upon detection of a movement of the rope group above a predetermined speed, which represents a movement of the lifting load, preferably wherein this predetermined speed is substantially 0 m/s. e. at least one motorized/mechanical emergency braking system, preferably a drum brake system, suitable for damped deceleration of a downward movement of the lifting load, said motorized/mechanical emergency braking system being adapted for damped deceleration of the downward movement in the event of failure of the motors; f at least two molars and at least two drives, the motors and drives being coupled one to one, for loading and uncoiling the cable groups, the molors being supplied with current by an external power source; g. a slurry system for controlling the molorized braking system, the emergency braking system, the molars and the drives, wherein the control system prevents undesired closing of the molorized braking system; wherein, in operation of the device, one of the motors and one of the drives functions as a driving motor and driving drive, and another motor and drive functions as a hot spare motor and hot spare drive; wherein the system is configured to instruct the hot spare motor and hot spare drive to take over the drive of the rope groups for movement of the hoist upon detection of failure of the driving motor and/or the driving drive by the siuring system within a time span of 500 ms to 2000 ms; wherein the system is further configured to actuate the emergency braking system to perform mechanical braking on the lifting load upon detection of a failure of the hot spare motor and/or the hot spare drive by the system. 2. Apparatus for controlling a lifting loader according to the preceding claim 1, wherein the motors and drives provide feedback to the control system regarding the speed at which the motors and drives pull in or unroll the groups of ropes, and where a discrepancy between the speed of the coupled motors and drives, a failure is detected by the control system, Apparatus for controlling a lifting load according to one of the preceding claims 1 or 2, wherein the system is provided as or comprising a safety programmable logic controller (safety PLC). Apparatus for controlling a lifting load according to any one of the preceding claims 1 to 3, wherein the drives dynamically control the motors to effect a desired speed and/or desired acceleration of retrieving or unrolling the rope groups, Device for controlling a lifting load according to one of the preceding claims 1, 10 and 4, wherein the lifting weld is a bridge deck of a lifting bridge with two longitudinal ends and two lateral sides, wherein at least one, preferably two of the suspension points are provided on both lateral sides, and wherein one of the suspension points is provided at each of the longitudinal owl ends on both lateral sides, and wherein the cable groups of the suspension spikes at the first longitudinal end are brought in and uncoiled by at least one first of the molars , and wherein the cable groups from the suspension pins at the second longitudinal end are brought in and unrolled by at least one second of the motors. 6. Apparatus for controlling a lifting loader according to the preceding claim 5, wherein the rope groups at the two longitudinal ends are driven and actuated by a separate subset of the motors and the drives. Device for controlling a hoisting load according to one of the preceding claims 1 to 6, wherein when the device is in operation, both motors actuate a controlled emergency braking, and wherein, if one of the motors fails, the other is moior. takes over control of the emergency braking completely within a time span of 500 ms to 2000 ms. A lifting load control device according to any one of the preceding claims 1 to 7, wherein the drives are configured to discharge braking energy generated by the motors to the drives in the event of a power failure from the external power source to the motors by means of a braking resistance, and where the dissipated braking energy is partly used to allow the drives to perform the controlled emergency braking. Apparatus for controlling a lifting load according to any one of the preceding claims 1 to 8, wherein the emergency braking system is adapted to perform a mechanical damped braking on the lifting load upon detection of an emergency braking on one or more of the rope groups that lasts longer than a predetermined period of time, or if it is already detected during this period that the emergency braking does not follow the predetermined braking curve. Apparatus for connecting a lifting load according to any one of the preceding claims 1 to 9, wherein the rope groups are brought in and unrolled via rope drums, which rope drums are driven by the motors by means of a land wheel box between the reels and the rope drums. 11. Device for connecting a hoisting load according to the preceding claim 10, wherein the reels drive a fast shaft, which fast shaft drives a fast shaft via the land wheel shaft, which slow shaft drives the rope pulley, the ratio of rotational speed of the fast shaft relative to the rage axis at least 2, preferably at least 10. 12. Apparatus for controlling a lifting load according to the preceding claim 11, wherein the braking system comprises a brake disc positioned on the mounting axis on each cable drum, the brake disc comprising at least one pair of brake calipers configured to engage and retain the cable drum in position. status. Apparatus for controlling a lifting load according to the preceding claim 11 or 12, wherein the emergency braking system comprises &&on or more brakes for each motor, positioned on the fast axis of the motor, and configured to engage and decelerate the fast shaft in closed toast mode. ash. Device for controlling a lifting load according to one of the preceding claims 11 to 13, wherein a first encoder is provided on the fast axis, preferably an incremental encoder, further preferably with a Safety Integrity Level (SIL) of at least SIL2, where the first encoder measures the rotational speed of the fast shaft, and therefore of the motor. Apparatus for controlling a hoisting load according to the preceding claim 14, wherein a second encoder is provided on the slow axis, preferably an absolute encoder, further preferably having a Safety Integrity Level (SIL) of at least SlL2, the second encoder measures the rotational speed of the slow shaft, and therefore of the rope drum, as well as the position of the lifting load.