EP1427662B1 - Safety circuit for elevator doors - Google Patents

Abstract

An improved lift system door control or safety circuit utilizes locking devices for the lift shaft doors and lock sensors to monitor the status of the locking devices. The lock sensors are coupled to a lift drive unit control through a data bus, which need not be especially designed as a safety data bus. The lock sensors are repeatedly interrogated at short term intervals. The status of the doors is interrogated on a longer time interval, and such data is also passed to the drive unit control by the data bus. The interrogations are used to determine the operating condition of the locking sensors as well as whether communications or transmission errors are present.

Description

The invention relates to an elevator system according to the Preamble of claim 1.

Elevator systems today have so-called double doors, this means both shaft doors as well as at the elevator car arranged car doors. The opening and closing of the Shaft doors are usually through the cabin or the Cabin doors arranged. For the safety of the user Elevator systems and passers-by in the elevator systems It is of great importance that buildings containing the respective position of the shaft and cabin doors on the Location of the elevator car is tuned; that is, the Shaft doors and the cabin doors may only be open if the elevator car is on one of the provided inputs and Exit stations, ie at the height of one floor, stops. For this purpose, the layers of both shaft doors as well as the cabin doors monitored.

The shaft doors can usually be opened with the help of mechanical locking devices in their closed position lock. Conventional surveillance systems monitor the position of the shaft doors with the help of Security contacts; These safety contacts record whether the mechanical locking devices their locking position or take their unlocked position. The Safety contacts are closed when the locking devices in their locked position and the gates are closed. The safety contacts are integrated into a safety circuit, which in turn closed only with closed safety contacts is. The safety circuit is so with the drive of the Elevator system connected to the elevator car in normal Operation only open when the safety circuit is closed can be moved downwards. Is a shaft door open and their locking device in unlocked position, so are the appropriate safety contact and thus the Safety circuit open, which has the consequence that the elevator car can not move up or down, it unless with the help of a special control or by the Service personnel bridged the broken safety circuit.

• Ein Sicherheitskreis ist in jedem Falle mit inhärenten Problemen behaftet; hierzu gehören die Länge der Verbindungen, der Spannungsabfall im Sicherheitskreis und der verhältnismässig hohe Montageaufwand.
• Trotz eines Überwachungssystems mit einem Sicherheitskreis lassen sich unsichere bzw. gefährliche Situationen nicht vermeiden; einerseits lassen sich die Sicherheitskontakte einzeln oder gemeinsam verhältnismässig leicht überbrücken, was praktisch einem Nichtvorhandensein der Sicherheitsvorkehrungen gleichkommt; anderseits verhindert eine offene Schachttüre zwar eine Bewegung der Kabine, aber wenn sich die Kabine nicht bei der gerade offenen Schachttüre befindet, so besteht dennoch die Gefahr eines Absturzes durch die offene Schachttüre.
• Intelligente bzw. situationsgerechte Reaktionen, zum Beispiel bei offenem Sicherheitskreis, sind nicht möglich, da die Kabine in jedem Fall stillgesetzt wird; insbesondere kann nicht vermieden werden, dass Personen in der Liftkabine ungewollt eingeschlossen werden.
• Das Überwachungssystem erlaubt keine spezifische Diagnose; das heisst, dass bei offenem Sicherheitskreis nur festgestellt wird, dass mindestens ein Sicherheitskontakt und damit mindestens eine Verriegelungsvorrichtung bzw. mindestens eine Schachttüre offen ist. Es kann aber nicht festgestellt werden, welcher bzw. welche Sicherheitskontakte geöffnet sind.
• Eine vorsorgliche Wartung ist nicht möglich, da keine Anzeige über den Zustand der Sicherheitskontakte erfolgt; es ist also nicht möglich, das Aufzugssystem vorausschauend zu warten und abgenützte Sicherheitskontakte rechtzeitig, aber zu einem Zeitpunkt, in dem das Aufzugssystem problemlos stillgelegt werden kann, zu ersetzen, es sei denn im Rahmen einer periodischen Revision, wobei aber in vielen Fällen eine an sich nicht notwendige Ausserbetriebssetzung des Aufzugssystems erfolgt.
  Die Verfügbarkeit des Aufzuges wird eingeschränkt, da ein offener Sicherheitskontakt immer eine Ausserbetriebssetzung des Aufzugssystems zur Folge hat, auch wenn eine andere Lösung, zum Beispiel das Nichtbefahren des betroffenen Schachtabschnitts, möglich wäre.

Each elevator system with such conventional monitoring has several disadvantages, which will be described in more detail below.

• A safety circuit always has inherent problems; These include the length of the connections, the voltage drop in the safety circuit and the relatively high assembly costs.
• Despite a monitoring system with a safety circuit, unsafe or dangerous situations can not be avoided; On the one hand, the safety contacts can be bridged relatively easily individually or together, which is practically equivalent to the absence of safety precautions; On the other hand, an open shaft door prevents movement of the car, but if the car is not in the shaft door that is currently open, there is nevertheless the danger of falling through the open shaft door.
• Intelligent or situational reactions, for example with an open safety circuit, are not possible because the cabin is always shut down; in particular, it can not be avoided that persons in the elevator cabin are inadvertently trapped.
• The monitoring system does not allow a specific diagnosis; This means that when the safety circuit is open it is only ascertained that at least one safety contact and thus at least one locking device or at least one shaft door is open. However, it can not be determined which or which safety contacts are open.
• A precautionary maintenance is not possible because there is no indication of the condition of the safety contacts; Thus, it is not possible to anticipate the elevator system and replace worn security contacts in a timely manner, but at a time when the elevator system can be shut down without any problem, except in the context of a periodic revision, but in many cases one itself Not necessary shutdown of the elevator system takes place.
  The availability of the elevator is limited, since an open safety contact always has a shutdown of the elevator system result, even if another solution, for example, not driving the affected shaft section, would be possible.

Although a functionally improved solution can be achieved if for the capture or the transfer of the Safety related data related to the Position of the landing doors a data bus is used. There but the relevant data are security relevant, must a safety bus can be used. Such a safety bus, and in particular the required safety bus nodes, But they are relatively expensive and therefore come hardly applicable for standard elevator systems.

The object of the invention is thus seen in, a improved elevator system of the type mentioned above which concerns the safety precautions in the Connection with the position of the landing doors on the one hand avoids the disadvantages of the prior art and on the other hand is relatively inexpensive.

The solution of this task is carried out according to the invention by the Features of the characterizing part of claim 1.

Advantageous developments of the elevator system according to the invention are defined by the dependent claims 2 to 10 Are defined.

The elevator system according to the invention now has a monitoring system with a standard data bus. About this Data bus will be the data indicating the position of the landing doors affect, record or transfer. Instead of one Safety data bus is a common data bus with usual standard bus node used; this can be about act that data bus, anyway for the transfer of process data in the elevator shaft is present. Of the Use of a relatively expensive safety data bus including the required complex safety bus nodes, which actually because of the safety relevance of would be needed to transfer data is avoided by taking appropriate measures to ensure safety when transferring the security-relevant data via to ensure the not-secure data bus.

To determine the state or the position of the shaft door or their locking device is each shaft door or each locking device, a locking sensor assigned. The locking sensor is on the conventional Data bus connected to the information obtained transmits to the control or monitoring unit. The control or monitoring unit then evaluates the information received. This is done by the Control or monitoring unit periodically, for example at intervals of 20 ms interrogating the interlock sensors. A communication interruption in the area of the data bus or the bus node can thus be detected very quickly. in the Further, every locking sensor, including the associated interface, periodically or in larger temporal Intervals, for example, once every 8th or 24 hours, tested. This will be the appropriate Shaft door open and closed again or at least the contacts are pressed (unlocked / locked) and it will observes whether the correct data is sent to the tax or monitoring unit to be transmitted. This test can when opening and closing the shaft doors in normal operation respectively. Was a floor within the given Time period of 8 or 24 hours never approached, so is Test purposes of the control unit a test drive to this Floor initiated (forced test). The execution of all Tests are monitored in the control unit and preferably entered in a table.

For floors that are rarely approached, the Lock sensor and the corresponding interface preferably designed safety-oriented. This is recommended especially for floors, to which the elevator car can not be controlled automatically, for example because a residential unit, such as a penthouse, directly from Elevator shaft is accessible.

The term "safety-related" is used below for Control means, actuators, etc, used for the Ensuring personal safety are relevant and therefore as components with increased reliability are executed. Such "safety-related" components characterized, for example, by redundant data acquisition, Data transmission and data processing and / or by software-based plausibility check of them collected, transmitted and processed data and / or by redundant existing actuators.

If necessary for security reasons, may additionally to the locking sensors further means for Detecting the state, in particular the position of Landing doors, to be provided; to transfer such funds Information about the position or the state of the shaft door to the controller, either over the already existing one Data bus, or by a safety-related execution including an additional safety bus Security node is provided.

The shaft doors are preferably self-compliant; that is, they close automatically as soon as they not actively kept open. Also the locks are complacent when the landing door is closed. An active lock is not necessary.

For safety reasons, the to lock the Shaft doors preferably use locking devices designed so that they only from one to the elevator car car door unlocked, opened or can be closed, or that they use a special tool unlocked and can be pushed by hand.

The state of the shaft door and its locking device is with advantage over the at this shaft door arranged interlock sensor monitors.

As locking sensors, for example, locking device contacts, Microswitches, inductive sensors, capacitive sensors or optical sensors used become.

The control of the elevator system is preferably so trained that they are interrogating the locking sensors evaluates to one or more predefined responses trigger, in particular the recognition and localization of a Error, triggering a service call, stopping one Elevator car or performing another situation adapted Reaction upon detection of the opening of a Shaft door.

The controller can also be designed so that they Interrogation of interlock sensors evaluates to detected Transmission error due to the evaluation of several data packets to correct.

With regard to the safety of the elevator system it is particularly advantageous if in addition to monitoring the Schachtnüren also the car door is supervised; thereby can by means of a coincidence test of the signals of the Shaft doors on the one hand and the cabin door on the other hand a Statement about the functionality of the shaft doors and / or the lock sensors of the landing doors become.

• Der Sicherheitskreis des herkömmlichen Überwachungssystems entfällt; dadurch werden die entsprechenden inhärenten Nachteile vermieden; wird ausserdem ein schon vorhandener Datenbus benutzt, so ist der Verdrahtungs- bzw. Montageaufwand gering.
• Die Sicherheit des Aufzugssystems ist, verglichen mit einem Aufzugssystem mit Sicherheitskreis im Sicherungssystem, erhöht. Zwar ist die Überbrückung von Kontakten möglich durch Software; sie ist aber erkennbar und kann nach einer vordefinierten Zeit aufgehoben werden. Die Sicherheit bleibt auch bestehen, wenn zum Beispiel ein Fehler auftritt oder ein Service durchgeführt wird.
• Das Uberwachungssystem erlaubt spezifische Diagnosen, weil ein Fehler sofort lokalisiert und fernübertragen werden kann.
• Eine vorsorgliche Wartung ist möglich, weil der Zustand der Sensoren, insbesondere der Verriegelungssensoren, analysierbar ist.
• Die Verfügbarkeit des Aufzuges ist erhöht.

The main advantages of the arrangement according to the invention are the following:

• The safety circuit of the conventional monitoring system is eliminated; thereby avoiding the inherent inherent disadvantages; If, in addition, an already existing data bus is used, the wiring or assembly effort is low.
• The safety of the elevator system is increased compared to an elevator system with safety circuit in the security system. Although the bridging of contacts is possible by software; but it is recognizable and can be canceled after a predefined time. The security remains even if, for example, an error occurs or a service is performed.
• The monitoring system allows specific diagnoses because a fault can be localized and transmitted remotely.
• A precautionary maintenance is possible because the state of the sensors, in particular the locking sensors, can be analyzed.
• The availability of the elevator is increased.

Die Überwachung der Kabinentüre kann sicherheitsgerichtet realisiert werden, wodurch die Aussagekraft der Koinzidenzprüfung erhöht wird. Dafür müssen der der Kabinentüre zugeordnete Sensor wie auch der angeschlossene Datenbus und die Busknoten sicherheitsgerichtet ausgebildet sein.

The safety of the elevator system can be further increased by the following measure:

The monitoring of the car door can be realized safety-oriented, whereby the meaningfulness of the coincidence test is increased. For this purpose, the sensor associated with the car door, as well as the connected data bus and the bus nodes, must be designed to be safety-oriented.

Fig. 1

ein Aufzugssystem nach der Erfindung mit einem Überwachungssystem, in stark vereinfachter und schematisierter Darstellung.

In the following the invention will be described by means of an embodiment and with reference to the drawing. It shows:

Fig. 1

an elevator system according to the invention with a monitoring system, in a highly simplified and schematic representation.

The elevator system 10 shown in Fig. 1 is to destined to serve three floors A, B, C. In each of the Floors A, B, C is a shaft door 11 available. The Shaft door 11 serves a lift shaft in which an elevator car 12 with a car door 13 up and down to separate from the surrounding space. The Movement of the elevator car 12 takes place with the aid of a Drive unit 14 and is controlled by a controller 16. Basically, the shaft door should only be open be when the elevator car 12 on the corresponding Floor is located. The shaft door is used for this purpose controlled by the car door 13 of the elevator car 12, wherein they in their closed position by a locking device is locked, which further as a locking device 18 is designated. To establish the Condition, in particular the position of the locking device 18 and thus the shaft door, is as a locking sensor Figure 20 shows a contact device with a locking device contact intended. The contact device with the locking device contact is via a Data bus 22 connected to the controller 16. Also the Elevator car 12 is in control with the controller 16 connected.

The elevator installation 10 described above acts as follows:

Each locking device 18 or each shaft door associated latch sensor 20 and locking device contact 20 pertains to data the state of the locking device 18 and the Shaft door available. The data bus 22 transmits them Data or information to the controller 16, which received the Periodically evaluates data or information. The Control 16 asks at short intervals from to Example, 20 ms, the locking sensors 20 from, so that a Communication interruption in the area of the data bus 22 or the bus node can be detected very quickly.

In addition to the above-described continuously performed Test finds another test in larger temporal Intervals instead. Has the elevator car 12 on the approach one of the floors A, B or C ends, then the opens Car door. The shaft door 11 of the approached floor is normally unlocked from the car door 13 and open. This is done, about once in a period of 8 to 24 hours, the further test carried out. Is tested the lock contact 20. Is it found to be OK, so a corresponding entry is made in a table, the state 'contact in order' and the time of the Tests are saved. By the entry in the table the execution of the test is controllable.

Although the shaft door 11 opens, but shows when opening an unscheduled behavior, this indicates one minor errors, such as wear or contamination in the door area and / or the locking device 18. In this Trap, the elevator system 10 at least temporarily in Staying operational, but it is best to make an early, accurate Provide inspection and revision by service personnel.

If the locking contact 20 does not open, it must be assumed that the contact is defective, the Lock but released and the shaft door open has been. The elevator car 12 may no longer be in this case put into operation; the elevator system 10 must except Operation, and it is essential to the service staff summon. In this case, an accidental opening the affected shaft door can no longer be recognized.

Before leaving a floor are basically the Shaft door and the locking device 18 through the Cab door 13 closed and the lock falls. In this case, it is checked whether the locking contact 20 shaft side indicates that the shaft door 11 is closed is. At the same time, the closing state of the car door 13 safety-monitored, creating a coincidence test the two closing operations is possible and thus the Safety is increased. Is the result of these two Tests positive, so the elevator car 12 can move be offset.

However, at least one of the mentioned tests runs negative, so a recovery attempt can be made. For this purpose, a repeated closing and opening the Doors. Does the recovery attempt result in the shaft door 11 is closed and locked, so that can Elevator system 10 while operating, but a service should be envisaged, at least if repeated recovery attempts must be carried out.

Is on the other hand after carrying out the recovery attempt the Shaft door 11 still open, so must the elevator system go out of service and the service staff must be summoned become.

If a shaft door is open without the elevator car 12 has approached the corresponding floor, so must be concluded that the shaft door of was opened outside; this can be done either by a instructed person with a special tool or unauthorized used with force, as it is impossible is the shaft doors unintentionally or by faulty manipulation to open. The open standing of the shaft door 11 is detected only via the non-safety-related data bus. The non-safety-related detection of this condition However, the shaft door 11 can be regarded as sufficient for the following reasons: First this case is extremely rare. Second, the instructed persons organizationally on the potential Dangers indicated and stopped the elevator system to switch to service mode before leaving a shaft door to open. Third, the locking contacts are regularly, for example, every 8 hours, checked. Fourth the state of the locking contacts through the Control 16 queried with a certain frequency, so that Transmission errors filtered out and thus tolerable become. Fifth, the shaft doors 11 are self-compliant educated.

If the opening of the shaft door 11 does not occur from the Elevator car 12 off, so the elevator system turns immediately out of the normal operating mode and also returns not in the same back, without having been assured is that the shaft door 11 is actually closed. Therefore, the elevator system can not be bridged by the Lock contacts are put into operation.

• Zur Überwachung benötigt man auf den einzelnen Stockwerken keinen sicherheitsgerichteten Busanschluss sondern nur einen üblichen, nicht-sicherheitsgerichteten Busanschluss. Konventionelle, nicht-sicherheitsgerichtete Busanschlüsse sind ohnehin auf jedem Stockwerk montiert, um die Rufe zu erfassen und die Anzeigen anzusteuern. Das Wegfallen zahlreicher sicherheitsgerichteter Busanschlüsse führt zu einer beträchtlichen Reduktion der Anlagekosten.
• Jeder Riegelkontakt wird einzeln ausgelesen und überprüft. Es wird nicht nur festgestellt, dass eine Störung oder ein Fehler aufgetreten ist, sondern die Störung bzw. der Fehler kann genau lokalisiert werden, wodurch im Störungsfalle eine Diagnose beschleunigt erstellbar ist.
• Nicht nur Störungen und Fehler, insbesondere der Ausfall von Verriegelungssensoren bzw. Verriegelungskontakten, können ausgemacht werden, sondern auch der jeweilige Zustand der Verriegelungssensoren bzw. Verriegelungskontakte, insbesondere bezüglich Prellverhalten und Spannungsabfall, können erfasst werden, bevor eine Störung auftritt.
  Aufgrund solcher Information kann eine vorsorgliche Wartung der Verriegelungskontakte vorgenommen werden. In vielen Fällen lässt sich dadurch vermeiden, dass Störungen und Fehler infolge ausfallender Verriegelungskontakte auftreten.
• Eine unbemerkte Überbrückung der Verriegelungskontakte ist nicht möglich, da die Steuerung einen zu einem nicht vorgesehenen Zeitpunkt erfolgenden Signalwechsel erkennen würde. Dadurch wird die Sicherheit der Schachttürüberwachung zusätzlich erhöht.
• Bei Auftreten einer Störung erlaubt es die Tatsache, dass offene Verriegelungskontakte lokalisiert werden können, die Aufzugskabine auf das nächstmögliche Stockwerk zu fahren, ohne hierbei die betroffene Schachttüre mit dem offenen Kontakt zu überfahren; die Passagiere können also in jedem Falle aussteigen und bleiben nicht längere Zeit eingeschlossen. Anschliessend daran können verschiedenen Reaktionen erfolgen: Die Aufzugskabine kann auf demjenigen Stockwerk verbleiben, auf welchem die Passagiere ausgestiegen sind, und das Servicepersonal wird herbeigerufen; oder die Aufzugskabine wird - falls sie sich unterhalb des Stockwerkes mit dem defekten Verriegelungskontakt befindet - in eine Position gefahren, in der ihr Kabinendach sich wenig unterhalb der geöffneten Schachttüre befindet, so dass die Gefahr des Absturzes einer Person durch die geöffnete Schachttüre in den Aufzugsschacht beseitigt ist; oder die Aufzugskabine wird mit geringer Geschwindigkeit und vorzugsweise begleitet von einem akustischen Signal auf das betroffene Stockwerk mit der offenen Schachttüre gefahren. Es kann ein Recovery-Versuch durchgeführt werden, und falls dieser gelingt, ist das Aufzugssystem wieder betriebsbereit.

The main advantages of the new elevator system are the following:

• For monitoring, you do not need a safety-related bus connection on the individual floors, but only a standard, non-safety-related bus connection. Conventional, non-safety-related bus connections are already mounted on each floor to detect the calls and to control the displays. The elimination of numerous safety-related bus connections leads to a considerable reduction of system costs.
• Each latch contact is read out individually and checked. It is not only determined that a fault or an error has occurred, but the fault or the error can be located precisely, whereby a diagnosis can be generated accelerated in the event of a fault.
• Not only faults and faults, in particular the failure of locking sensors or locking contacts can be identified, but also the respective state of the locking sensors or locking contacts, in particular with regard to bounce behavior and voltage drop, can be detected before a fault occurs.
  Due to such information, a precautionary maintenance of the locking contacts can be made. In many cases, this avoids the occurrence of faults and errors due to failing locking contacts.
• An unnoticed bridging of the locking contacts is not possible because the controller would detect a signal change taking place at an unintended time. As a result, the security of the shaft door monitoring is additionally increased.
• If a fault occurs, the fact that open lock contacts can be located will allow the elevator car to move to the next possible floor without overriding the affected hoistway door with the open contact; Passengers can therefore get off in any case and do not remain locked for a long time. Following this, various reactions can take place: the elevator car can remain on the floor on which the passengers have disembarked, and the service personnel is called in; or the elevator car is - if it is below the floor with the defective locking contact - moved to a position in which their canopy is located slightly below the open shaft door so that eliminates the risk of a person falling through the open shaft door into the elevator shaft is; or the elevator car is driven at low speed and preferably accompanied by an audible signal on the affected floor with the open shaft door. A recovery attempt can be made and, if successful, the elevator system is ready for operation again.

Claims (10)

1. Lift system (10) with a lift cage (12) movable in a lift shaft by a drive unit (14), a control (16) for controlling the drive unit (14), a data bus (22) connected with the control (16), shaft doors (11) for closing the lift shaft, locking devices (18) for locking the shaft doors (11) at the shaft side and lock sensors (20) for monitoring the setting of the locking devices (18), wherein the lock sensors (20) are connected with the control (16) by way of the data bus (22), characterised in that a lock sensor (20) is repeatedly automatically interrogated by the control (16) at short intervals in time by way of the data bus (22) in order to be able to establish communications interruptions or transmission errors in the transmission by way of the data bus (22), and the function of a locking sensor (22) is detected in that the state of the locking sensor (20) is repeatedly automatically interrogated at long intervals in time with open and closed shaft door and made available to the control (16) by way of the data bus (22).
2. Lift system (10) according to claim 1, characterised in that the locking device is self-shutting when the corresponding shaft door (11) is closed.
3. Lift system (10) according to claim 1 or 2, characterised in that the locking devices (18) used for locking the shaft doors (11) are preferably so constructed that they can be unlocked, opened or closed only by a cage door (13) provided at the lift cage (12) or that they can be unlocked by a special tool and slid open by hand.
4. Lift system (10) according to one of claims 1 to 3, characterised in that there is monitored, by way of the locking sensor (20) at one of the shaft doors (11), the state (for example the position) of the locking device (18) of these shaft doors (11) and the state (for example the setting) of the shaft doors (11).
5. Lift system (10) according to one of claims 1 to 4, characterised in that the locking sensor (20) is a locking device contact, a microswitch, an inductive sensor, a capacitive sensor or an optical sensor.
6. Lift system (10) according to one of claims 1 to 5, characterised in that the control (16) evaluates the interrogation of the locking sensors (20) in order to be able to trigger one or more of the following predefined reactions: recognition and localisation of a fault; triggering of a service call; or, if an open shaft door was recognised, stopping lift cage or carrying out a situation-adapted reaction.
7. Lift system (10) according to one of claims 1 to 6, characterised in that the control (16) evaluates the interrogation of the locking sensors (20) in order to correct ascertained transmission errors by evaluation of several data packets.
8. Lift system (10) according to one of claims 3 to 7, characterised in that in addition to monitoring of the shaft doors (11) the cage door is also monitored in order to make possible, by means of a coincidence check of the signals of shaft door (11) and cage door (13), a statement about the functional capability of the shaft door (11) and/or the locking sensor (20) of the shaft door (11).
9. Lift system (10) according to claim 8, characterised in that the monitoring of the cage door (13) is carried out by a safety bus in order to increase safety.
10. Lift system (10) according to claim 1, characterised in that in addition to the locking sensors (20) further means for detecting the state of the shaft doors (11) are present, which transmit information about the state of the shaft door by way of the data bus (22) or by way of a safety bus to the control (16).

Images