WO2017001531A1

WO2017001531A1 - Monitoring device for a lift system

Info

Publication number: WO2017001531A1
Application number: PCT/EP2016/065226
Authority: WO
Inventors: Michael Geisshüsler; Simon ZINGG; Nicolas Gremaud
Original assignee: Inventio Ag
Priority date: 2015-06-30
Filing date: 2016-06-29
Publication date: 2017-01-05
Also published as: CN107810159A; BR112017025853B1; BR112017025853A2; AU2016286288B2; EP3317218B1; CN107810159B; EP3317218A1; AU2016286288A1

Abstract

A monitoring device (30) for a lift system (1), having a lift car (2) and having an electromechanical braking device (20) which is arranged on the lift car (2) and is intended to brake the lift car (2), comprises at least two sensors (31, 32). The sensors record different motion variables of the lift car. The measurement variables from the sensors are filtered if necessary and are checked for plausibility. At least one actual travel parameter (P) of the lift car (2) is determined in a calculation algorithm (37) on the basis of the recorded measurement variables. This travel parameter, together with any measurement variables from the sensors, is compared with limit values and is assessed. The electromechanical braking device (20) is released on the basis of this comparison and assessment.

Description

Monitoring device for an elevator installation

description

The invention relates to a monitoring device for an elevator installation, to a method for monitoring a driving parameter of an elevator installation and to an elevator installation with such a monitoring installation.

Elevator systems are installed in a building. The elevator system consists essentially of an elevator car, which is connected by means of suspension with a counterweight or with a second elevator car. By means of a drive which acts selectively on the suspension means or directly on the elevator car or the counterweight, the elevator car and in a counter direction to the counterweight along substantially vertical guide rails is moved. The lift system is used to move people and goods within the building over single or multiple floors. The elevator system includes devices to secure the elevator car in the event of failure of the drive or the suspension means. These braking devices are usually used, which can slow down the elevator car on the guide rails in case of need.

From WO2014 / 060587 a safety device is known, which monitors a movement of the elevator car and which, if necessary, can electrically control safety gears of the elevator car. In this case, an acceleration and a travel speed or a travel path of the elevator car are detected. Further, an instantaneous vehicle speed is derived from the acceleration using data from vehicle speed or travel to start an integration cycle.

From WO2013 / 110693 a further safety device is known, which monitors a movement of the elevator car and which can activate a braking device if necessary. Here, various motion parameters of the elevator car are detected and these parameters are mutually checked for plausibility. If deviations between the various motion parameters are detected, measures are taken.

The invention now aims at a qualitative improvement of the safety device, in particular the monitoring device to the safety device and a corresponding method. This means that the monitoring device should work safely and reliably, it should simply be connectable to an electromechanical safety brake system and it should continue to be low in production and operation. The solutions described below make it possible to optimally fulfill at least some of these requirements. In one approach, the electronic monitoring device preferably includes a first sensor and a second sensor. In each case, these sensors detect a first measured variable and a second measured variable which depend on a movement of the elevator car, wherein the first measured variable and the second measured variable correspond to different motion variables of the elevator car. These different quantities of movement are in a mathematically defined context. This makes it possible to make the measured variables comparable and thus to assess their function and quality. The different quantities of movement inevitably require different sensors, which reduces the risk of a systematic measurement error. Preferably, the electronic monitoring device comprises at least one tester, which checks the two measured quantities or the first measured variable and the second measured variable for plausibility. This allows a quick pre-test of the function of the sensors. For example, plausibility may be checked against the fact that a displacement measurement may not suddenly, that is, in a short period of time, indicate a different location that acceleration may not significantly exceed gravitational acceleration, or that a velocity measurement may also not jump suddenly , Thus, by means of the plausibility check, a quick direct check of the individual sensors can take place.

In addition, because of the mathematically definable relationship between the two measured variables, the plausibility can also be carried out by checking the mathematical agreement of converted measured quantities of the two measured variables.

Preferably, the electronic monitoring device comprises a data memory. At least one limit value or at least one specification for determining the at least one limit value is stored in this data memory. Using specifications, the actual limit values or at least one limit value can be calculated, for example, based on a learning journey. Advantageously, however, are in a particularly safe design limits, such as a critical speed limit, an acceleration limit or limit mark when a safety brake is to be activated or a tolerance value in which a safety circuit of the elevator system is activated or interrupted as fixed values in the data memory, for example in an EPROM baked. This avoids accidental or wanton reprogramming and the limits can not be manipulated because they can not be changed by usual means. However, then for each elevator systems, or for elevator systems with different nominal data, in particular with different speeds, each tuned data storage modules must be provided.

Preferably, the electronic monitoring device comprises a calculation algorithm for calculating at least one actual driving parameter of the elevator car as a function of the first measured variable and the second measured variable. Thus, if required, various types of information can be extracted from the measured quantities. The two measured quantities considered in each case only give an instantaneous state and they are subject to sensor-specific inaccuracies. Thus, conventional displacement sensors detect a distance traveled at path intervals, or acceleration sensors usually have drift, noise, offset or other inaccuracies. The calculation algorithm combines the at least two different quantities of motion into a resulting amount of motion that best reflects the actual driving parameter.

Preferably, the electronic monitoring device comprises a comparator which compares at least one of the first measured variable, the second measured variable and the actual driving parameter to the at least one limit value and the electronic monitoring device further comprises a signal output indicating the achievement or exceeding of the limit value or possibly a violation of the plausibility , The indication of this condition typically causes actuation of an electronic or electromechanical switch or relay, which, depending on the configuration, interrupts an electrical safety circuit, initializes actuation of a brake, or outputs a signal to another control group such as an elevator control. The state is displayed, for example, by means of a change in the voltage applied to the signal output. Thus, a security of the elevator system can be ensured, since on the one hand sensors of different types are used, which reduces a risk of component-related systematic error, and because a measure can be taken immediately as soon as safe operating conditions are left.

Thus, for monitoring driving parameters of the elevator installation, movements of the elevator cabin are detected at least by means of a first sensor and a second sensor, wherein the first measured variable detected by the first sensor and the second measured variable detected by the second sensor correspond to different motion variables of the elevator cabin, which different motion quantities in a mathematically defined relationship. The first measured variable and the second measured variable are checked for plausibility by means of an inspector, and at least one actual driving parameter of the elevator car is calculated in dependence on the first measured variable and the second measured variable by means of a calculation algorithm. Furthermore, at least one of the first measured variable, the second measured variable or the actual driving parameter is compared by means of a comparator with at least one limit value, the limit value being called up by a data memory. If the limit value is reached or exceeded or plausibility is violated, a signal output indicates this condition. Seen as a whole, it can thus provide a tailor-made monitoring device or a corresponding method for or in the elevator installation which meets the highest safety requirements. This is achieved in particular by the fact that limit values can not simply be considered, but also that a congruent behavior or a plausible behavior of the sensors can be weighted among each other. As a result, appropriate measures can be taken on a case-by-case basis. By calculating the actual driving parameter of the elevator car as a function of the first and the second measured variable, the actual driving parameter reproduces a movement process quickly, precisely and reliably. In a proposed solution, the monitoring device cooperates with at least one electromechanical braking device of a brake system of the elevator installation. The electromechanical braking device in this case has a standby position in which the elevator car can be moved and it has a braking position in which the elevator car is braked. An actuator is in this case designed to hold the electromechanical brake device in the standby position and, if necessary, to move the electromechanical brake device from the ready position to the braking position. The monitoring device is thus connected to the braking device essentially only via the signal output, preferably a hold-open signal. Of course, on a case-by-case basis, for example for the purpose of diagnoses, of status assessments or for reset operations, further signals can be transmitted between the monitoring device and the braking device.

For this purpose, the electromechanical braking device preferably includes a signal input which is in connection with the signal output of the electronic monitoring device and which activates or releases the actuator during a switching or a corresponding indication of the signal output as a result of the exceeding of the limit value, so that the actuator electromechanical braking device can move from the standby position to the braking position.

The electromechanical brake device advantageously further includes a position indicator of the at least one operating state, such as the ready position or the braking position of the electromechanical brake device indicates or outputs or reports back to the monitoring device via a signal input.

Advantageously, the electromechanical braking device or the brake system includes an energy store, which is designed to bring the electromechanical braking device in case of need, regardless of an external power supply, from the ready position to the braking position.

In a proposed solution, a complete braking system includes a power failure device in the form of an emergency power supply or an automatic reset device.

The emergency power supply in this case comprises a memory for storing electrical energy or a connection to an independent of a normal power source emergency power source. The emergency power supply provides an interruption of a normal power source advantageously without interruption, an electrical energy supply to the electromechanical Bremsein- direction and the electronic monitoring device available.

Alternatively or in addition to the emergency power supply includes the power failure device of the brake system, the automatic return device. This comprises a decision algorithm for deciding on an actuation reason, if the electromechanical braking device is actuated, and it comprises a reset algorithm, which is automatically initialized and executed, provided that the decision algorithm determines as an actuation reason an uncritical event. An uncritical event is given, for example, when the electromechanical braking device or braking system is actuated as a result of a momentary or prolonged power interruption. Such an interruption can occur as a result of a fault in the power grid or it can occur as a result of deliberate shutdown of the power grid. This occurs, for example, when a hotel is operated only for a specific season and is unused for the rest of the year.

With the proposed embodiment and its variations, a safe braking system can be provided which improves ecological values, availability and safety. In a solution variant, the signal output of the electronic monitoring device now includes a first signal output and a second signal output. The first signal output is for example designed to open a safety circuit of the elevator installation, whereby an emergency stop of the elevator car is initiated and the second signal output is designed, for example, to release the electromechanical braking device of the elevator car for braking.

This can be many errors in a first level of security without catching a direct activation of safety brakes is required. This is advantageous because it allows longer interruptions in operation can be avoided. A triggering of safety or safety brakes usually requires a longer interruption of service.

Preferably, at least one of the two sensors or preferably all sensors are provided with a filter. This or these filters reduce the noise of the meter or meters. This is especially helpful if, for example, an acceleration is detected. Acceleration sensors detect natural oscillations and high-frequency vibrations or vibration peaks which are disturbing for evaluation of the signals. By means of an appropriate filter such noise can be eliminated or at least reduced.

In one variant of the solution, the filter of the electronic monitoring device filters at least one of the first or second measured variables by means of a low-pass filter, so that a high-frequency interference noise is attenuated. Preferably, the filter filters the second measured variable detected by the second sensor, in particular the detected vertical acceleration of the elevator car. High-frequency vibrations, which are excited, for example, by impacts, can thus be attenuated.

In one variant of the solution, the calculated or determined actual driving parameter corresponds to an actual amount of movement of the elevator car. This actual amount of movement is calculated by estimating, based on a momentary state of this actual amount of movement, a state of this amount to be expected in a next time step on the basis of the second amount of movement detected by the second sensor and the first amount of movement detected by the first sensor. The estimation or the estimation of the expected state of the motion quantity takes place here using a system model. The system model shows the mathematical relationships of the motion quantities used. In this system model, all relevant related quantities of motion, such as a route, a speed, an acceleration, a jerk, or an object, are therefore always available in the calculation algorithm at any time Air pressure shown. These quantities of movement are always updated in the system model to the expected state. Furthermore, the estimated expected state of the movement quantities or movement quantities is corrected by means of a correction factor or a set of correction factors, these correction factors being determined taking into account a required accuracy of the result and a behavior of the sensors used. In the aforementioned system model, this means that at least each of the motion variables guided in the system model is generally provided with an associated correction factor and thus the calculation at any time includes the integrated correction of the individual system motion variables.

Preferably, the definition of the system model and the correction factors is determined according to the rules of a Kalman filter.

The Kalman filter is a set of mathematical equations named after its discoverer Rudolf E. Kaiman. By means of this filter conclusions on the condition of many of the technology, science or the economy associated systems are possible in the presence of erroneous observations. In simple terms, the Kalman filter is used to remove the interference caused by the meters. In this case, both the mathematical structure of the underlying dynamic system and the measurement distortions must be known. Mathematical estimation theory is also called a Bayes minimum-variance estimator for linear stochastic systems in state space representation.

A special feature of the filter introduced by Kaiman in 1960 is its special mathematical structure, which enables its use in real-time systems of various technical fields. These include the evaluation of radar signals for position tracking of moving objects (tracking) but also the use in electronic control circuits of ubiquitous communication systems such as radio and computer. In studies and publications under the direction of Professor Roland Siegwart, applications of such systems for autonomously controlled systems and vehicles were developed. In these applications, it is about a movement course of a system, where only stochastic fixed values - such as a GPS position determination - present with sufficient accuracy to track. Investigations have now shown that this approach is ideally suited to safely track or map a driving course of an elevator car. In order to determine the correction factors, the system model is accordingly used with the mathematical relationships of the motion variables used, that is to say the mathematical structure of the underlying dynamic system, as used for estimating or estimating the expected state of the motion variable or motion variables is, together with measuring distortions of the sensors used, such as those resulting from inaccuracy of the sensors used, such as their cultivation or arrangement used. In the case of a calculation algorithm operating according to the rules of the Kalman filter, the actual movement quantity of the elevator car is calculated by starting from an instantaneous state of this movement variable a state of this movement variable to be expected in a next time step on the basis of the second movement variable detected by the second sensor and the first sensor sensed first movement size is estimated. In principle, a movement quantity expected according to the theoretical system model is corrected with a weighted proportion of the difference between and to the recorded first and second movement quantities. The weighting or the multiplication factor or the correction factor is predetermined in this case according to the rules of the Kalman filter by model simulation.

In a resolution of the system model results from the calculation algorithm on the one hand, an expected offset value of a motion variable, starting from a last known instantaneous state of the offset value, a correction factor of the offset calculation and calculated or calculated motion quantities is calculated and further where the expected state of the motion magnitude, starting from the instantaneous state the movement quantity, the determined or calculated movement quantities, the last known instantaneous state of the offset value and a correction factor of the movement calculation is calculated. The correction factors of the offset calculation and the motion calculation are hereby predetermined taking into account a required accuracy of the result and an inaccuracy of the sensors used according to the rules of the Kalman filter by model simulation and stored in the calculation algorithm. The expected state of the motion variable calculated in this way is output as the actual motion variable of the driving parameter. The calculation algorithm enables a quick and precise indication of the most probable instantaneous motion state, since it can optimally combine the diversity of the detected motion quantities and because it can use all variables defined in the system model for a safety and plausibility assessment. An elevator installation is essentially a simple system, since only one movement takes place in one dimension. The elevator system moves, or the elevator car and the counterweight move, in fixed guides only up or down. The prediction of the correction factors by means of the Kalman filter and the calculation of the expected state of the motion size of the elevator car are based on the same system model. Thus, the movement of the elevator car with the aid of measured variables which are only available stochastically in variable time steps-such as, for example, from a path increment sensor-can thus be depicted so accurately that safety-relevant information is generated. Thus, a prerequisite is given to replace a today only mechanically working security system at least in their control by electronic components.

Preferably, the calculated or determined actual amount of movement in the aforementioned context is a speed of the elevator car. This means that the calculated or determined actual driving parameter is an actual speed of the elevator car. Further, the second amount of movement is a vertical acceleration of the elevator car, and the first amount of movement is a path length unit detected in a time sequence.

An acceleration measurement is possible in high clock rate, a path length measurement is rather sluggish. At the same time sensors for detecting Weginkrementen or in other words for detecting the time sequence of Weglängeneinheiten and sensors for detecting accelerations are proven in practice and they are available at low cost. A combination of these two measurements thus provides a precise and cost-effective estimate of the most likely actual travel speed of the elevator car. The driving speed is a relevant safety variable for monitoring the elevator installation. Thus, this relevant safety variable can be monitored precisely and inexpensively. In a preferred variant of the solution, the first sensor of the electronic monitoring device is thus designed as a path increment sensor, and the first measured variable is accordingly a path traveled by the elevator car. The Weginkrementsensor detects the distance covered in constant path length units. A typical detection length unit is, for example, in the range of 2 to 100 millimeters.

The second sensor of the electronic monitoring device is preferably designed as an acceleration sensor and the second measured variable is accordingly a vertical acceleration acting on the elevator car. The acceleration sensor detects the vertical acceleration of the elevator car continuously with a preferably high detection clock rate. A typical detection clock rate is, for example, in a range of 20Hz to 1000Hz. Alternatively or additionally, in a variant of the solution, the first sensor of the electronic monitoring device can also be designed as an absolute displacement measuring system. Absolute displacement measuring systems are known in elevator construction. Even with these displacement measuring systems, the first measured variable results in a path traveled by the elevator car.

In a solution variant, the auditor of the electronic monitoring device checks the first measured variable and the second measured variable for plausibility. In one embodiment, it checks the first and the second measured variable essentially independently of one another for plausibility by checking the measured variables for their physical meaning. For example, a very high acceleration value indicates a plausibility problem. In another or supplementary version, the tester compares the first measured variable with the second measured variable and outputs a status signal "OK" if the two measured quantities agree. If there is no match, it outputs a status signal "NOT_OK". When checking in or registering a path increment, the examiner advantageously checks to what extent the distance covered, taking account of the associated time interval, corresponds to the acceleration recorded over this period. Alternatively or additionally, the examiner continuously checks to what extent the accelerations detected over a period of time coincide with a corresponding detection of path increments. This means that a function can always be checked continuously. On the one hand, upon arrival of a Weginkrements be determined to what extent the correlation to the acceleration signal is given and on the other hand can be checked, for example, even at a standstill of the elevator system, to what extent the acceleration signal is in order. If, for example, a larger acceleration signal is present, a path signal would have to arrive in a corresponding time interval. If this is not the case, there is an error. By analogy, when using a speed measuring sensor, for example a speedometer, the plausibility can be checked on the basis of a temporal consideration of a change or on the basis of maximum application limits.

In one solution variant, the electronic monitoring device further includes at least one third sensor for the independent detection of a third measured variable dependent on the movement of the elevator car. Preferably, this third sensor is analogous to the second sensor, an acceleration sensor and the third measured variable is accordingly acting on the elevator car vertical acceleration. Also, this acceleration sensor detects the vertical acceleration of the elevator car continuously and parallel to the second sensor with a preferably equally high detection clock rate. This means that the acquisition clock rates of the second and third sensor preferably in synchronism or in other words the same clocked run. This can be an exact synchronous monitoring of the two sensors.

Thus, a quality of the monitoring can be optimized and the monitoring device or the inspector can in addition to the status "OK" or "NOT_OK" also make a qualitative statement about the individual sensors.

If, for example, the second and third measured quantities agree - the two vertical accelerations - but the first measured variable - the distance traveled by the elevator car - is not plausible with respect to the second and third measured variables, then there is an error in the first sensor or the associated sensor Evaluation before and a ride of the elevator car is interrupted accordingly immediately.

However, if, for example, the second and third measured variables - the two vertical accelerations - do not agree, but one of the two second and third measured variables is plausible with respect to the first measured variable - the path traveled by the elevator car - then an error lies in the correspondingly different one second or third sensor. Then, for example, an initiated trip could be completed and a new trip of the elevator car could be prevented. Corresponding failure patterns and the resulting behavioral statements are usually evaluated by risk and availability analysis and defined accordingly.

In a solution variant, the at least one signal output of the electronic monitoring device is accordingly switched with a time delay or the signal output indicates with a time delay when the tester outputs the status signal "NOT_OK". The time delay preferably delays the circuit or the display of the signal output until the elevator car has reached a next stop. Alternatively or additionally, the at least one signal output transmits, for example via a status signal output of the electronic monitoring device, the status signal "NOT_OK" to an elevator control. The elevator controller can then control the elevator car, for example, in a main hold and they can shut down the elevator system there. Here, the previously described scenarios are considered accordingly. However, this time delay is preferably only activated if a security of the elevator system is still guaranteed. This may be the case, for example, if the examiner recognizes that the measured quantities tested give different values, but both values are within a permissible range. In one solution variant, an acceleration limit value is stored in the data memory of the electronic monitoring device, which determines an acceleration limit value for the vertical acceleration detected by the second sensor. Furthermore, a first speed limit value is stored in the data memory which determines a first speed limit value for the calculated actual speed and a second speed limit value is established which determines a second speed limit value for the calculated actual speed. In addition, a first period of time, which determines a first reaction time, is stored in the data memory. In one approach, these values are stored in the data memory fixed or unchangeable. The data memory is then fabricated for a particular elevator configuration in a manufacturing plant and the data memory or a corresponding data storage device or if the data memory is integrally assembled with a corresponding processor, the corresponding processor is then designated accordingly. The designation may in a simple case be a nominal speed to which the values are tuned or it may be an asset identification number or the like.

In another approach, at least one of the values stored in the data memory, such as the acceleration limit, the first speed limit, the second speed limit, or the first response time, is calculated as needed or upon initialization of the electronic monitor.

Advantageously, all speed limits are calculated. Upon initialization of the electronic monitoring device, a nominal speed could be queried by an elevator controller as a result of a learn run or by manual input. From this, the limit values could be calculated by means of relative factors which then have to be present in a data memory or processor.

A typical value for the acceleration limit could be at an acceleration of 3.5m / s ² to 6.0ms ² . The first speed limit could be at a 1.1 to 1.25 times the nominal speed and the second speed limit could be at a 1.25 to 1.5 times the nominal speed. At a nominal speed of 2.5m / s, the first speed limit is below 3.125m / s and the second speed limit is at least 3.125m / s. The initial response time is typically set at about 12 ms (milliseconds). In a further solution variant, the first signal output for opening the safety circuit now indicates when the actual speed of the elevator car has exceeded or exceeded the first speed limit. As a result, an opening or interruption of the safety circuit is effected. The second signal output for enabling the electromechanical braking device of the elevator car indicates when the actual speed of the elevator car exceeds the second speed limit. This ensures that the electromechanical brake device is released for braking. In addition, the second signal output also indicates when the actual elevator car speed exceeds the first speed limit, and at the same time the detected elevator cabin vertical acceleration exceeds the acceleration threshold for a period of time longer than the first response time, thereby also causing the electromechanical braking device to Brakes is released.

The definition of such a stepped limit value model on the one hand limits for pre-switching an elevator and triggering a safety gear, as defined in the European elevator standard EN81-1, Chapter 9.9 are defined for a speed limiter and on the other hand is not waited in case of failure of support means to one Exceeded second speed is reached, but it is already responding because of exceeding the first speed limit and too high acceleration. Of course, the suggested value ranges are only hints. The values are usually determined on the basis of local regulations and in consideration of the manufacturer of the lift installation.

The electronic monitoring device preferably calculates a first actual driving parameter from the signals of the first and second sensors, preferably using the Kalman filter, and calculates a second actual driving parameter, preferably using the caiman, from the signals of the first and third sensors. filter. The corresponding calculation routines are preferably carried out after the signals of the sensors have been successfully checked in the tester and provided with the status signal "OK". In one embodiment, the associated two computation routines are performed in two parallel processors, preferably in equally clocked processors, so that the respective results are compared with each other and thus a failure of a computation routine can be quickly detected. In another embodiment, the two calculation routines occur in the same processor. In a solution variant, a second period of time, which determines a second reaction time, is stored in the data memory. For example, this second response time is about 100ms up to 500ms. The electronic monitoring device now causes via the second signal output a release of the electromechanical braking device of the elevator car in addition to the previous switching criteria, if the actual speed of the elevator car exceeds the Erst-speed limit during a period which is longer than the second reaction time, for example, 120ms.

Thus, the electromechanical braking device is also activated if, despite the interruption of the safety circuit - which would lead to a shutdown of the elevator drive and actuation of a drive brake - within the second reaction time, the actual speed has not been reduced below the Erst-speed limit again. Through this design, the safety of the elevator system is additionally improved. Prolonged slipping of the elevator car is prevented. Of course, the second reaction time is determined taking into consideration the entire speed level.

In one solution variant, a version identification of the electronic monitoring device is stored in the data memory of the electronic monitoring device. This version identification allows traceability of the product via the manufacturer of the device and the corresponding specifications and, accordingly, a constant check of a correct assignment. Also any experiences that were made with certain execution versions can easily be assigned to other attachments of the same version. Thus, overall, an improvement in the reliability of the product can be achieved.

Advantageously, the electronic monitoring device comprises a first module which contains at least the second sensor designed as an acceleration sensor, the filter associated with the second sensor, the tester, the data memory, the calculation algorithm and the comparator, and the electronic monitoring device further comprises a second module, which at least includes the trained as Weginkrementsensor first sensor.

The first module thus comprises components which do not require any further external interface, except that they are connected to a supply voltage, to a connection to the safety circuit of the elevator installation and possibly to a communication interface to the elevator installation. If the communication interface also the connection of the safety circuit includes, of course, can be dispensed with a separate connection of the safety circuit. The second assembly includes components that are in mechanical or at least physical interaction with the elevator installation. This may be a path increment sensor driven by the elevator car's motion, or it may be a positioning system, for example, an absolute path measuring system based on magnetic, optical, radar, or different basis is constructed. This second assembly can thus be arranged in optimum alignment or arrangement and it is then preferably connected by means of a wire connection to the first module. Of course, a wireless connection is conceivable.

Of course, the first and second assemblies can also be assembled into a single assembly. This depends on a selection of the sensors used, as well as on the possibility of arranging the components in the elevator installation. The routines and algorithms used for checking, comparing, and calculating are preferably mapped into processors. Several processors can be used for the different functions. Thus, for example, selected functions can be processed in parallel, whereby the processors can monitor each other. However, several or all functions or routines can be integrated in a single processor, resulting in a particularly cost-effective and energy-saving solution.

The complete brake system includes according to an advantageous solution, the electromechanical braking device. This advantageously includes a brake element and this brake element has a self-reinforcing structure. The actuator of the electromechanical brake device is designed such that it can move the brake element in case of need from the ready position to a brake starting position. The brake element biases, during a travel movement of the brake device with respect to a brake counterpart with which the brake element in the brake starting position is in contact, the electromechanical brake device automatically from the brake starting position to a Bremsendstellung. This brake end position then determines the braking position of the brake device. Thus, the actuator can work with minimal force, since the brake element only has to be moved to the brake starting position and moving into the Bremsendstellung, which then corresponds to the actual braking position, by a kinetic kinetic energy of the elevator system itself. Thus, the electromechanical braking device can be built small and operated with low energy. In one variant of the solution, the actuator includes an electromagnet or an electrically controllable driver. This can hold in energized state, the electromechanical braking device or its actuator in its standby position. In the de-energized state, this electromagnet or the electrically controllable driver releases the electromechanical brake device or its actuator, so that the electromechanical brake device can be moved into the braking position or at least into the brake starting position.

This solution makes it possible to provide a fail-safe braking system, since in a power outage or defect in any case, the braking device is placed in a braking position. Fail-safe criteria are easy to fulfill.

Alternatively, the actuator or the electromagnet or driver contained in the actuator is designed such that the actuator can hold the electromechanical braking device in its standby position in the de-energized state and the actuator can move the electromechanical braking device in the energized state in the braking position or at least in the brake start position ,

This solution makes it possible to provide a braking system with low energy consumption, since energy is only required for the actual operation. However, complex measures are required to be able to ensure safety even in the event of a power failure or line break.

In one variant of the solution, the actuator includes at least one lever system, a latch system and / or a spindle system and the energy storage of the electromechanical brake device includes at least one spring, a compression spring, a pneumatic or hydraulic pressure accumulator or a pyrotechnic gas generator. The energy content of the energy store is dimensioned such that in any case, sufficient energy is available to move the electromechanical braking device, at least independently of an external electrical energy supply, into the brake starting position. As a result, the brake system operates such that upon detection of an unwanted driving condition that requires intervention of the brake device of the elevator car, the electronic monitoring device detects this state, which is indicated accordingly via the second signal output. This causes via corresponding switching units that an electromagnet of the braking device, for example, disabled so switched off. Thus, the actuator is released and the corresponding energy storage of the braking device brings the brake element for engagement, or in the brake starting position, with the Counterpart, usually the guide rail of the elevator car. By the movement of the elevator car and the associated relative movement of the brake device to the guide rail, the brake element is moved further into the Bremsendstellung, whereby it further biases the brake device, so that the corresponding braking force can be built and provided.

In a variant of the solution in which the power failure device of the brake system includes an emergency power supply, this emergency power supply has a rechargeable battery, such as a capacitor or accumulator. This is designed to ensure the power supply of the electronic monitoring device and the electromechanical braking device for a predetermined time. The predetermined time advantageously corresponds to at least one time period, which requires an authorized person to manually move the elevator car to a floor after a power failure of the elevator system.

In a variant of the solution, the rechargeable battery of the emergency power supply is designed to provide additional consumers, such as a cabin light, a cabin ventilation, an information display and / or an emergency call system, in addition to the electronic monitoring device and the electromechanical braking device.

In one variant of the solution, the rechargeable battery of the emergency power supply is arranged in the area of the elevator car, preferably as part of the electronic monitoring device. Alternatively, the rechargeable battery of the emergency power supply is arranged in a control module of an elevator control.

Advantageously, the electronic monitoring device is designed such that it detects when the emergency power supply or the power supply falls below a critical voltage limit. Further, when the critical voltage limit is undershot, the electronic monitoring device controls the actuator of the electromechanical brake device in such a way that the electromechanical brake device is moved into the braking position or at least into the brake starting position. At the same time, an information according to which the braking device has been actuated for falling below the critical voltage limit in the data memory of the electronic monitoring device. The automatic restoring device of the brake system now preferably has an analysis routine which, when the power supply of the electronic converter is switched on, is switched on. monitoring device performs a state analysis and which, upon detection of the information in the data memory, after which the braking device has been actuated for falling below the critical voltage limit, starts an automatic reset routine. In a supplementary solution variant, the reset routine initializes an information display or information announcement that informs any passengers of the elevator car.

In one embodiment, the brake system includes two electro-mechanical brake devices disposed on the elevator car, each including an electromagnet or driver. These can hold the electromechanical brake devices in their standby position and a control of these electromagnets or drivers switches the two electromagnets or drivers serially in succession. These two electromechanical brake devices are advantageously each connected via a connecting cable to the electronic monitoring device. This connection cable has, in addition to wires which connect the electromagnets or drivers, connecting wires which transmit information to the position indicators of the electromechanical brake devices to the electronic monitoring device.

In an alternative solution variant to the preceding embodiment, the brake system includes two electromechanical brake devices arranged on the elevator car, which each include an electromagnet or driver which can release the electromechanical brake devices if required, so that the electromechanical brake devices can be brought into their braking position. The activation of these electromagnets or drivers controls the two electromagnets or drivers in parallel, wherein these two electromechanical brake devices are each connected via a connecting cable to the electronic monitoring device. This connection cable also has, in addition to the wires which connect the electromagnets or drivers, connecting wires which transmit information to the position indicators of the electromechanical brake devices to the electronic monitoring device. When the activation of one of the two electromechanical brake devices is detected, the electronic monitoring device also releases the other of the two electromechanical brake devices.

In one solution variant, the electronic monitoring device is arranged in the area of the elevator car. In this case, the second module with the first sensor designed as Weginkrementsensor is arranged in the region of a deflection roller of the elevator car, which deflection roller deflects a suspension means of the elevator car. The second assembly of electronic Monitoring device is connected by means of a further connecting cable to the first module of the electronic monitoring device, which is preferably located at an easily accessible location of the elevator car. In one solution variant, the electronic monitoring device is connected to an electrical power supply of the elevator installation and the electronic monitoring device is connected by means of a first connection point to the safety circuit of the elevator installation and by means of a second connection point to the elevator control of the elevator installation.

In the following, the invention will be explained by way of example with reference to exemplary embodiments in conjunction with the figures.

Show it:

FIG. 1 shows a schematic view of an elevator installation in side view;

FIG. 2 shows a schematic view of the elevator installation in cross section,

FIG. 3 shows a schematic view of an electromechanical brake device,

FIG. 4 shows a schematic overview of an entire brake system,

FIG. 5 shows a schematic overview of an electronic monitoring device,

FIG. 6 shows a schematic overview of an expanded electronic monitoring device with redundant use of two sensors,

FIG. 7 shows a schematic decision scheme of a comparator.

In the figures, the same reference numerals are used across the figures for equivalent parts.

FIG. 1 shows an elevator installation 1 in an overall view. The elevator installation 1 is installed in a building and serves to transport persons or goods within the building. The elevator installation 1 is installed in a shaft 6 of the building and includes an elevator car 2 and a counterweight 3, which are movable up and down along guide rails 10. The elevator car 2 opens up several stops 11 of the building. A drive 5 is used to drive and hold the elevator car 2. The drive 5 is arranged for example in the upper region of the shaft 6 and the elevator car 2 is connected to the drive 5 via suspension means 4, for example via suspension ropes or carrying straps. In the example, the drive 5 is connected to a translation at low speed to the elevator car 2 and the counterweight 3. For this purpose, 3 support rollers 9 are attached to the elevator car 2 and the counterweight and the support means 4 are guided over these support rollers 9. The counterweight is like one Mass fraction of the elevator car 2, so that the drive 5 must compensate for the main thing only a mass difference between the elevator car 2 and counterweight 3. Of course, the drive 5 could also be arranged at another location in the building, in the area of the elevator car 2 or at the counterweight 3. The drive 5 is controlled by an elevator control 7.

The elevator car 2 is equipped with a braking system 15, which is suitable for securing and / or decelerating the elevator car 2 during an unexpected movement or at overspeed. The brake system 15 consists of several components. An electromechanical braking device 20 is arranged below the elevator car 2 in the example. The electromechanical brake device 20 is electrically connected to and controlled by an electronic monitoring device 30. A power failure device 50, which in the example is assembled with the electronic monitoring device 30, controls the braking system 15 in the event of an interruption of a power supply to the elevator installation 1. The elevator car 2 is connected to the elevator control 7 via a hanging cable 8. The hanging cable 8 includes signal and power supply lines. Among other things, the electronic monitoring device 30 is connected to the elevator control 7 via these signal lines. Of course, the signal lines can be implemented by means of a bus system. However, it is open to the skilled person to realize a wireless signal transmission.

FIG. 2 shows the elevator installation 1 of FIG. 1 in a schematic plan view. The brake system 15 includes in the example two elevator brake devices 20, 20.1. The two elevator brake devices 20, 20. 1 are preferably designed identically or mirror-symmetrically and, if required, they act on the guide rails 10 arranged on both sides of the elevator car 2. The guide rails 10 for this purpose include suitable braking surfaces, which in combination with the elevator brake devices 20, 20.1 can cause a slowing down of the elevator car 2. The electronic monitoring device 30 is arranged on the roof of the elevator car 2, so that it is easily accessible for service purposes. In the example, the electronic monitoring device 30 operates with a first sensor 31 connected to the carrying roller 9 of the elevator car 2 and a second sensor 32 integrated in the monitoring device 30, which detect movement variables of the elevator car 2.

FIG. 3 shows a possible known embodiment of an electromechanical brake device 20 as known from the publication WO2005044709. The electromechanical brake device 20 includes a brake housing 29 and a brake member 25 in the form of a brake wedge. The brake housing 29 is attached to the elevator car 2. The brake element 25 is performed self-energizing in cooperation with the brake housing 29. The brake member 25 is held by an actuator 21 in a standby position. An electromagnet 26 of the actuator 21 holds to an energy storage 22 in the form of a compression spring tensioned and the brake element 25 is located on the energy storage 22. This corresponds to the position shown in FIG.

The electromechanical braking device 20 shown is symmetrical in itself. This means that two brake elements 25 are arranged on both sides of the guide rail 10 and can clamp them if necessary. A position of the brake element 25 can be detected by means of a position indicator 24 and can be transmitted by means of a corresponding connection cable 27 to the electronic monitoring device 30. A signal input 23 of the electromagnet 26 is also connected via connecting cable 27 to the electronic monitoring device 30. As soon as the electronic monitoring device 30 releases the electromagnet 26 and thus the actuator 21, the energy store 22 relaxes and the brake elements 25 are forced into the narrowing gap predetermined by the brake housing 29. The energy storage 22 transports the brake elements 25 at least so far that the brake elements 25 clamp the guide rail 10. This then corresponds to a brake start position. From this point on, the brake element 25 is, because of the wedge-shaped design, pulled in a traveling movement of the brake housing 29 and the elevator car 2, in the narrowing gap of the brake housing 29, whereby a corresponding braking force builds up. The movement of the brake element 25 in the brake housing 29 is then limited by a stop, so that builds up a predetermined braking force. This then corresponds to a Bremsendstellung. The actuator 21 further includes a reset unit 28. This reset unit 28 includes a spindle unit which can move the electromagnet 26 in such a way that the energy store 22 can be re-tensioned with it. In a subsequent return movement of the elevator car 2, the electromechanical brake device 20 is finally completely reset. The reset unit 28 can accordingly be controlled by a reset algorithm 52.

Other electromechanical brake devices 20 operate with eccentric brake shoes, which are also released if necessary by means of an electromagnet and which are reset by means of spindle motors or which are reset by an engagement movement of the brake shoes, as described for example in EP1733992.

The braking system 15 includes in the embodiment of Figure 4, the electronic monitoring device 30, the power failure device 50 and two electromechanical Braking devices 20, 20.1. The electromechanical brake devices 20, 20.1 is essentially constructed as explained above.

The electronic monitoring device 30 essentially comprises two modules. A first assembly 42 is constructed on a circuit board 42.1. In the example, this includes a second and a third sensor 32, 33. Both sensors 32, 33 are one-dimensional acceleration sensors each detecting a measured variable 32m, 33m in the form of an acceleration a. An installation position of the electronic monitoring device 30 in the elevator system 1 is marked on the board 42. 1 or a surrounding housing by means of an installation arrow 45. This ensures that the two sensors 32, 33 detect the vertical acceleration in the specific case. The two sensors 32, 33 are connected via an associated optional filter 34 with an evaluation unit 46, which is explained in more detail in Figures 5 and 6. The optional filter or filters 34 are realized in the example by means of a circuit of resistors and capacitors, which filter high-frequency oscillations of the acceleration sensors.

A second module 43 essentially comprises a first sensor 31 which detects a measured variable 31m in the form of path increments s. The first sensor 31 is connected, for example, to the carrying roller 9 of the elevator car 2 (see FIG. 2) or driven by it. The measured variable 31m of the first sensor 31 is likewise transmitted to the evaluation unit 46.

The electronic monitoring device 30 further has required interfaces, connection points and connections 39, 24, 24.1, 41 to signals, information and energy to the elevator control 7, the safety circuit SK to the electromechanical braking devices 20 and depending on the design to a power supply UN or a corresponding Stromaus - Transfer case 50.

The power failure device 50 is assembled in the example of Figure 4 with the electronic monitoring device 30. The power failure device 50 includes an emergency power supply 51. This is powered by a conventional power source UN of the elevator system 1 with electrical energy and stores the energy in rechargeable batteries or capacitors. These are sized so that the braking system 15 can be kept in its standby position during shorter power cuts. For example, a shorter power-off is a shutdown of a building during one night, ie for about 12 hours. Thus, a part of the building, which is not needed for half a day, can be switched off. The emergency power supply 51 keeps the braking system 15 active during this time and the elevator installation 1 is immediately restarted after the current has been switched on. ready for operation. For a longer power cut, for example, if an elevator system 1 is seasonally shut down, the energy reserve of the emergency power supply 51 drops below a predetermined level. The electronic monitoring device 30 detects by means of voltage monitoring this falls below the predetermined level and it releases the electromechanical brake devices 20 for braking. At the same time it writes an associated information IU of the falling below the corresponding critical voltage limit and the successful operation of the electromechanical braking device 20, 20.1 in a data memory 36 of the electronic monitoring device 30th

The power failure device 50 preferably includes an automatic reset device 52. A decision algorithm 54 of the automatic reset device 52 automatically starts when the power supply UN of the electronic monitoring device 30 is turned on and performs a state analysis. If it is determined that the information IU falls below the critical voltage limit and the subsequent successful operation of the electromechanical brake device 20, 20.1 is entered in the data memory 36 of the electronic monitoring device 30, the automatic reset device 52 initializes the automatic reset algorithm 55. This now controls the electromechanical Braking device 20, 20.1 or their actuator 21, 21.1 by means of the return unit 28, 28.1 in their ready position back. In this case, the information IU in the data memory 36 is reset.

Depending on an embodiment of the electromechanical brake device 20, this control takes place directly from the reset algorithm 55 or the control is effected via the elevator control 7 of the elevator installation 1. The power failure device 50 is assembled in the example with the electronic monitoring device 30. However, it can also be at least partially a part of the elevator control 7.

The evaluation unit 46 of the electronic monitoring device 30 comprises, as shown in FIG. 5, a checker 35. The checker 35 compares the first measured variable 31m transmitted by the first sensor 31 with the second measured variable 32m transmitted by the second sensor 32. In the example, the first measured variable 31m is a path increment signal s and the second measured variable 32m is an acceleration signal a. On the one hand, the tester 35 checks the acceleration signal a for compliance with plausible limit values. For example, in normal operation accelerations above a value of the gravitational acceleration g are not plausible. As a result, as soon as the tester 35 registers an acceleration signal a which is significantly above the acceleration due to gravity g, the acceleration signal a is not plausible, which results in an output of a status signal 40 "NOT_OK". Further checks the examiner 35 upon arrival of a Weginkrementssignals s, to what extent the Time interval between two Weginkrementssignalen s correlated with the registered in this period accelerations and he checks in tight time steps to what extent the registered accelerations a coincides with the arrival of the Weginkrementssignalen s. Thus, if the second sensor 32 does not display any relevant acceleration a over a certain period of time, but the first sensor 31 indicates a relevant or large path increment s, then an error exists and the status signal 40 is output by the tester 35 as "NOT_OK".

The evaluation unit 46 of the electronic monitoring device 30 further comprises a calculation algorithm 37. The calculation algorithm 37 calculates an actual driving parameter P, in the exemplary embodiment the actual velocity VC. The calculation algorithm 37 estimates, starting from an instantaneous state of this actual speed Vt-i, a state of this actual speed V _t to be expected in a next time step on the basis of the second movement variable 32m, a detected by the second sensor 32 and the first detected by the first sensor 31 Movement size 31m, s. The estimation of the expected state of the actual velocity VC takes place here by using a system model 44 which describes the mathematically defined relationship of the motion variables taking account of correction factors K _n to each other. The system model 44 shows the mathematical and temporal relationships of all the motion quantities a, s, v used. In this system model 44, all relevant related quantities of motion, such as the travel path s, the speed v or the acceleration a, are thus imaged at any time in the calculation algorithm 37. Characteristic deviation variables, such as an offset ao of the second movement variable 32m, a detected by the second sensor 32, are also tracked in the system model 44. These quantities of movement are tracked in the system model 44 at any time to the next expected state. Furthermore, the estimated expected states of the amount of movement are corrected by means of the correction factors K _n , these correction factors K _{n being determined} taking into account a required accuracy of the result and an inaccuracy of the sensors used. In the abovementioned system model 44, this means that the motion variables a, s, v used in the system model 44 are provided with an associated correction factor K _n and thus the tracking in the system model 44 always includes the integrated correction of the individual system motion quantities. Correspondingly corrected system model 44 thus includes the estimated, expected quantities of motion. These corrected estimated expected motion quantities best represent the system, and accordingly, they are output as actual motion quantities. Finally, the calculated expected state of this actual speed Vt is output as the actual vehicle speed VC or as the actual driving parameter P, respectively. As a result, the calculation algorithm 37 in the example carried out includes two relevant estimates.

1) Calculation of an offset ao of the second movement variable detected by the second sensor 32:

ao _t = aot-i + x Ch2 (ds - (Vt-i xd _t + (a _m - ao _t -i) x dt ^2/2))

dt time interval (usually corresponds to a clock frequency of the calculation routine) ds in the time interval dt detected path interval

a _m Average acceleration detected in the time interval dt.

ao _t expected offset ao,

ao _t -i momentary state of the offset ao according to the last calculation,

Kü ₂ correction factor of the offset calculation,

V _t -i instantaneous state of the actual speed according to the last calculation, 2) calculation of the actual speed VC

V _t = V t-i + (a _m - AOT i) x dt x + Kni (ds - (V _t -ixd _t + (a _m - ao _t i) x dt ^2/2))

V _t expected state of actual speed (anticipatory),

Kni correction factor of the velocity calculation,

The correction factors K _n are predetermined in consideration of a required accuracy of the result and an inaccuracy of the sensors used as well as the calculation process. The correction factors K _{n also} include shares for the implementation of physical units. The correction factors K _n , K _n i, K _n2 used to calculate the actual driving parameter P are determined according to the rules of a Kalman filter.

In the present example, the calculation is based on the calculation of the speed v. Of course, the calculation can be performed for all mathematically related quantities of motion, in which case the mathematical dependencies must be adapted accordingly. The system model 44 is integrated here into the calculation algorithm 37.

Furthermore, the evaluation unit 46 of the electronic monitoring device 30 comprises the comparator 38. The comparator 38 takes into account in one stage the status signal 40 which is output by the tester 35. As soon as the status signal 40 is output as "NOT_OK", in the embodiment according to FIG. 5 the comparator 38 effects an opening of the safety circuit SK via a first signal output 39.1. As a result, the elevator installation 1 is shut down. alternative it is also possible to effect a release of the electromechanical brake device 20 directly via a second signal output 39.2 and thus to obtain a rapid stop by means of the electromechanical brake device 20. However, this is usually not required, as a simultaneous onset of overspeed and failure of one of the sensors 31, 32 is unlikely. In any case, an opening of the safety circuit SK can even be delayed in time in this case in order to allow a normal stopping of the elevator car 2 on a next holding floor 11.

However, as long as the tester 35 outputs the status signal 40 as "OK", the comparator 38 checks compliance with relevant limit values in the movement sequence of the elevator car 2. The relevant limit values W are stored in the data memory 36. If the comparator 38 detects that a limit value has been exceeded, output or display of the first signal output 39.1 to the safety circuit SK takes place or a corresponding output or display of the second signal output 39.2 to the electromechanical brake device 20 is released in order to release it for braking.

The test functions of the tester 35, the calculation algorithm 37 and the comparison functions of the comparator 38 can be performed in separate processors. Preferably, however, the functions are merged into one processor.

FIG. 7 shows a possible comparison scenario. On the one hand, the data memory 36 with the relevant limit values W is available to the comparator 38. The acceleration limit value AG determines a limit value for the vertical acceleration a detected by the second sensor 32. The first-speed limit value VCG1 determines a first limit value for the calculated actual speed VC, and the second-speed limit value VCG2 determines a second limit value for the calculated actual speed VC. The calculated actual speed VC corresponds in this and in the following explanations to the value previously output as the actual driving speed or as the actual driving parameter P. A first reaction time Tl defines a time span during which, for example, excessive accelerations, such as occur during oscillation processes, can occur. A second response time T2 defines a time period within which an emergency brake device, such as a drive brake, should cause a deceleration of the elevator car 2. The comparator 38 now checks to what extent the actual speed VC of the elevator car 2 exceeds the first speed limit VCG1. As long as this is not the case The comparison output is set to 0, which means that the first signal output 39.1 to the safety circuit SK is also at 0. This keeps the safety circuit SK closed. If the actual speed VC of the elevator car 2 exceeds the first speed limit VCGl VC> VCGl, the comparison output is set to 1, which means that the first signal output 39.1 to the safety circuit SK is set to 1. This causes the safety circuit SK to open and the elevator installation 1 to be shut down immediately via the drive system.

Furthermore, the comparator 38 checks to what extent the actual speed VC of the elevator car 2 exceeds the second speed limit value VCG2. As soon as this VC> VCG2 occurs, the corresponding comparison output is set to 1. This means that the second signal output 39.2 to the electromechanical brake device 20 is set to 1. Thus, the elevator installation 1 is stopped immediately via the corresponding release of the electromechanical braking device 20. If the actual speed VC of the elevator car 2 has not exceeded the second speed limit value VCG2, it is checked whether the detected vertical acceleration a of the elevator car 2 exceeds the acceleration limit value AG a> AG. If this state continues for a time duration T which is longer than the first reaction time T 1 defined in the data memory, T> T 1, the second signal output 39. 2 to the electromechanical brake device 20 is also set to 1. Accordingly, the elevator installation 1 is likewise shut down via the electromechanical braking device 20. Thus, when exceeding the first speed limit VCGl and simultaneously exceeding a critical acceleration value AG, the electromechanical brake device 20 is actuated. Furthermore, in an extended optional embodiment, an additional check takes place in that the comparator 38 checks to what extent, after exceeding the first speed limit value VCG1, within a second reaction time T2 defined in the data memory, the actual speed VC of the elevator car 2 again reflects the first speed limit value VCG1 below. A typical magnitude of this second response time T2 is 100 to 200 ms (milliseconds). Thus, if the actual speed VC remains longer than the second-response time T2 above the first-speed limit value VCG1, the second signal output 39.2 to the electromechanical braking device 20 is also set to 1. Accordingly, the elevator installation 1 is likewise shut down immediately via the electromechanical braking device 20. The data memory 36 of the electronic monitoring device 30 includes, in addition to the already explained limits W further, as explained in connection with Figure 4, a memory address for storing the information IU. Furthermore, a version identification of the electronic monitoring device 30 is also usually stored in the data memory 36. In some cases, further limit values are stored. These may be limits adapted to reduced travel speed, service speeds, test speeds or the like.

FIG. 6 shows a further development of the electronic monitoring device 30 of FIG. The monitoring device 30 includes a third sensor 33. By means of this third sensor, which is designed analogously to the second sensor 32, the electronic monitoring device 30 is guided in a substantially redundant manner. Using a common first sensor 31, the check of the plausibility and correlation of the measured quantities 31m, 32m, 33m in two controllers 35, the calculation of the actual speed VC of the elevator car 2 in two calculation algorithms 37 and the comparison with limit values in two comparators 38 are carried out redundantly , Since both comparators 38, as explained above, can effect the opening of the safety circuit SK or the release of the electromechanical brake device 20 for braking according to predetermined criteria in a redundant manner, an overall safety is increased. At the same time, in particular, the comparison of the two similar sensors 32, 33 allows a direct diagnosis of a faulty sensor. This can be done case by case a limited onward travel of the elevator car 2, even if, for example, one of the two sensors 32, 33 fails. In addition, a source of error, ie the defective sensor or the defective evaluation group, can be displayed. Furthermore, the comparison of the actual speed VC of the elevator car 2 determined by the redundantly designed calculation algorithms 37 in a tester 35.1 makes it possible to verify the function of the complete evaluation chain.

The illustrated arrangements can be varied by the person skilled in the art. The electromechanical brake devices 20 can be mounted above or below the elevator car 2. It is also possible to use a plurality of brake pairs on an elevator car 2. The brake system 15 may be attached to the counterweight 3 in case of need.

The monitoring device 30 may be integrated in the elevator control 7 or in a cabin computer. The cabin computer is a unit arranged in the region of the cabin which, for example, includes a control of a car door or a position determination of the elevator car 2 or the like. However, one has separated from other devices Execution of the monitoring device 30 proved to be advantageous because it can be tested for itself and possibly type-tested. A corresponding housing of the monitoring device 30 preferably has a geometric design that allows a clear arrangement on the elevator car 2, so that incorrect assembly can be virtually eliminated. The first and second assemblies 42, 43 may also be assembled on a board as shown in the input description. The resulting common subassembly can then be arranged, for example, directly with a carrying roller 9 of the elevator car 2 or with a guide roller of the elevator car 2, so that the path increment sensor 31 can be driven directly. The guide roller is for example a guide roller which is used to guide the elevator car 2 along the guide rails 10.

The present explanations are essentially based on sensors 31, 32, 33, which detect accelerations a and paths s and path intervals ds, respectively, and the speed v is used as the evaluation variable. For the purposes of the invention, other or other quantities of motion may be used that are mathematically related. For example, an air pressure that is in mathematical relation to motion parameters could be used, or limits may be defined in dependencies on traveled paths.

Claims

Monitoring device (30) for an elevator installation (1) with an elevator car (2) and with an electromechanical braking device (20) arranged on the elevator car (2) for braking the elevator car (2)

at least a first sensor (31) and a second sensor (32) for detecting a first measured quantity (31m) and a second measured variable (32m) which are dependent on a movement of the elevator car (2),

wherein the first measured variable (31m) and the second measured variable (32m) correspond to different quantities of motion (a, v, s) of the elevator car (2), which different motion variables (a, v, s) are in a mathematically defined relationship,

at least one checker (35) which checks the first measured variable (31m) and the second measured variable (32m) for plausibility,

at least one data memory (36), the data memory storing at least one limit value (W) or at least one specification for determining the at least one limit value,

at least one calculation algorithm (37) for calculating at least one actual driving parameter (P) of the elevator car (2) as a function of the first measured variable (31m) and the second measured variable (32m),

at least one comparator (38) comparing at least one of the first measured variable (31m), the second measured variable (32m) or the actual driving parameter (P) to the at least one limit value (W),

- At least one signal output (39) indicating a reaching or exceeding of the limit value (W) or a violation of the plausibility.

Monitoring device (30) according to claim 1, wherein

the signal output (39) of the electronic monitoring device (30) includes a first signal output (39.1) and a second signal output (39.2), and the first one

Signal output (39.1) opens a safety circuit (SK) of the elevator system (1), whereby an emergency stop of the elevator car (2) can be initiated and the second signal output (39.2) releases the electromechanical braking device (20) of the elevator car (2) for braking.

Monitoring device (30) according to one of claims 1 or 2, wherein the actual driving parameter (P) is an actual amount of movement (V, VC) of the elevator car (2) and the calculation algorithm (37) calculates this actual amount of movement (V, VC) by starting from a momentary state of this quantity of motion (V _t -i) one in one the next time step expected state of this amount of motion (V _t ) on the basis of the second sensor (32) detected second motion variable (a) and the first sensor (31) detected first motion variable (ds) estimated (37.1), wherein the estimate the expected state of the quantity of motion (V _t ) is carried out using a system model (44), which determines the mathematically defined relationship of several

Moving quantities (a, ds) to each other describes, in the system model based on the instantaneous state of the plurality of motion quantities respectively the expected state of the plurality of motion variables is estimated, and by the estimated expected motion variables (V _t ) are corrected by means of correction factors (K _n ), wherein the

Correction factors (K _n ) are determined taking into account a required accuracy of the result and an inaccuracy of the sensors used, and wherein at least one of the estimated expected motion quantities corrected by correction factors (K ") is output as the actual motion variable (V, VC) of the driving parameter (P) becomes.

Monitoring device (30) according to one of claims 1 or 2,

wherein the actual driving parameter (P) is an actual amount of movement (V, VC) of the elevator car (2) and the calculation algorithm (37) calculates this actual amount of movement (V, VC) by starting from an instantaneous state

Motion variable (V _t -i) a state of this motion variable (V _t ) to be expected in a next time step on the basis of the second detected by the second sensor (32)

Movement quantity (a) and the first movement quantity (ds) detected by the first sensor (31) is estimated (37.1),

wherein the calculation algorithm (37) on the one hand an expected offset value (ao _t ) at least one motion variable (a, ds), starting from a last known

Instantaneous state of the offset value (ao _t- i), a correction factor of the offset calculation (K _n2 ), and calculated or calculated motion quantities (a, ds, V _t- i), the calculation algorithm (37) further calculating the expected state of the motion variable ( V _t ) is calculated on the basis of the momentary state of the motion variable (V _t -i), the determined or calculated motion variables (a, ds), the last known instantaneous state of the offset value (ao _t -i) and a correction factor of the motion calculation (K "i) wherein the correction factors (Κ "ι, ^) are determined taking into account a required accuracy of the result and an inaccuracy of the sensors used, and wherein the thus calculated expected state of the amount of movement (V _t ) as the actual amount of motion (V, VC) of the driving parameter (P) is output. Monitoring device (30) according to claim 3 or 4, wherein

the correction factors (K ", K" i, K "2) used by the calculation algorithm (37) to calculate the actual driving parameter (P) are determined using the rules of a Kalman filter.

Monitoring device (30) according to one of claims 1 to 5, wherein

the first sensor (31) of the electronic monitoring device (30) is a Weginkrement- sensor (31s), and the first movement variable (s, ds) corresponding first measured variable (31m), which is detected by the first sensor (31), one of the elevator car (2) covered path, wherein the Weginkrementsensor (31s) detects the distance covered at constant path intervals, or

the second sensor (32) of the electronic monitoring device (30) is an acceleration sensor (32a), and the second measured variable (32m) corresponding to the second movement variable (a) and detected by the second sensor (31) is a sensor (2 ) is vertical acceleration, wherein the acceleration sensor (32a) detects the vertical acceleration of the elevator car (2) at a high detection clock rate.

Monitoring device (30) according to one of claims 1 to 6, wherein

the tester (35) of the electronic monitoring device (30), which checks the first measured variable (31m) and the second measured variable (32m) for plausibility, the first measured variable (31m) with the second measured variable (32m) taking into account the associated mathematically defined relationship compares and outputs a status signal (40) "OK" if the two measured quantities coincide and, if there is no match, outputs the status signal (40) "NOT_OK",

wherein the verification of the two measured quantities takes place in a time step which is determined or used by the calculation algorithm (37) for calculating the actual driving parameter (P) of the elevator car (2), and / or

wherein the verification of the two measured quantities includes comparing how far a weighted difference of the two measured quantities lies within a characteristic behavior determined by the first sensor and / or the second sensor.

Monitoring device (30) according to one of claims 1 to 6, wherein

the tester (35) of the electronic monitoring device (30), which checks the first measured quantity (31m) and the second measured variable (32m) for plausibility, compares the first measured variable (31m) with the second measuring size (32m) and if the two match Measured variables a status signal (40) "OK" outputs and if there is no match the Status signal (40) outputs "NOT_OK", whereby the check of the two measured quantities includes

in that, when registering a completed path interval, it is compared to what extent the distance covered, taking into account an associated time, corresponds to the acceleration detected over this time, and / or

- that compares the extent to which the accelerations recorded over a period coincide with a corresponding detection of Weginkrementen.

9. Monitoring device (30) according to claim 7 or 8, wherein

the at least one signal output (39) of the electronic monitoring device (30), when the tester (35) outputs the status signal (40) "NOT_OK", displays the violation of the plausibility with a time delay, the time delay preferably indicating the display of the

Delayed signal output (39) until the elevator car (2) has reached a next stop (11); or

the at least one signal output (39) of the electronic monitoring device (30) contains a status signal output (41) by means of which the status signal (40) "NOT_OK" can be transmitted, for example, to an elevator control (7).

10. Monitoring device (30) according to one of claims 1 to 9, wherein

an acceleration limit value is stored in the data memory (36) of the electronic monitoring device (30) which determines an acceleration limit value (AG) for the vertical acceleration (a) detected by the second sensor (32);

stored in the data memory (36) of the electronic monitoring device (30) is a first speed limit value which determines a first speed limit value (VCG1) for the calculated actual speed (VC);

in the data memory (36) of the electronic monitoring device (30) a second speed limit value is stored, which determines a second speed limit value (VCG2) for the calculated actual speed (VC);

in the data memory (36) a first time period is stored, which determines a Erst-reaction time (Tl).

11. Monitoring device (30) according to claim 10, wherein

the signal output has a first signal output (39.1) and a second signal output (39.2), and the first signal output (39.1) effects an opening of the safety circuit (SK) when the actual speed (VC) of the elevator car exceeds or exceeds the first speed limit (VCG1); and

- The second signal output (39.2) causes a release of the electromechanical braking device (20) of the elevator car (2),

- if the actual speed (VC) of the elevator car exceeds the second speed limit (VCG2); or

if the actual speed (VC) of the elevator car exceeds the first speed limit (VCG1) and the detected vertical acceleration (a) of the elevator car (2) exceeds the acceleration limit (AG) for a time (t) longer than the first one Reaction time (Tl) is.

Monitoring device (30) according to claim 11, wherein

in the data memory (36) further a second period of time is deposited, which determines a second reaction time (T2); and

the second signal output (39.2) additionally causes the release of the electromechanical braking device (20) of the elevator car (2) when the actual speed (VC) of the elevator car (2) exceeds the first speed limit (VCG1) during a time period (t) is longer than the second period (T2).

Monitoring device (30) according to one of claims 10 to 12, wherein

at least one of the acceleration limit value (AG) stored in the data memory (36), the first speed limit value (VCG1), the second speed limit value (VCG2), the first reaction time (Tl) or the second reaction time (T2), if necessary or at one Initialization of the electronic monitoring device (30) is calculated.

14. Monitoring device (30) according to one of claims 1 to 13, wherein the electronic monitoring device (30) further comprises at least one third sensor (33) for independent detection of the movement of the elevator car (2) dependent third measured variable (33m), wherein this third sensor (33) is an acceleration sensor (33g) and the third measured variable (33m) is the vertical acceleration acting on the elevator car (2), wherein the acceleration sensor (33) continuously and parallelizes the vertical acceleration of the elevator car (2) to the second sensor (32) detected, wherein a detection clock rate of the third sensor preferably synchronously or the same clocked to the second sensor runs.

15. Monitoring device (30) according to claim 14, wherein the tester (35) directly compares the measured quantities of the second and third sensors (32, 33) and the two measured quantities (32m, 33m) taking into account physical laws with the first measured variable (31m) of the first sensor (31) compares and outputs from the comparisons the status signal (40) "OK" or the status signal (40) "NOT_OK", wherein in an output of the status signal (40) "NOT_OK" additionally a Error source is specified.

16. A method for monitoring a driving parameter (P) of an elevator installation (1), wherein

a movement of the elevator car is detected at least by means of a first sensor (31) and a second sensor (32), wherein a first measured variable (31m) detected by the first sensor (31) and a second measured variable detected by the second sensor (32) (32m) correspond to different quantities of motion (a, v, s) of the elevator car (2), which different motion quantities (a, v, s) are in a mathematically defined relationship,

the first measured variable (31m) and the second measured variable (32m) are checked for plausibility by means of a tester (35),

at least one actual driving parameter (P) of the elevator car (2) is calculated as a function of the first measured variable (31m) and the second measured variable (32m) by means of a calculation algorithm (37),

at least one of the first measured variable (31m), the second measured variable (32m) or the actual driving parameter (P) is compared to at least one limit value (W) by means of a comparator (38), which limit value (W) is stored in a data memory (36). is retrieved, and

- At least one signal output (39) reaching or exceeding the limit

(W) or indicates a plausibility violation.

17. Elevator installation with an elevator car (2) and with an elevator car (2) arranged electromechanical braking device (20, 20.1) and with a

Monitoring device (30) according to one of claims 1 to 15.