EP3230192B1 - Method and device for putting into operation of a lift system - Google Patents

Description

The invention relates to a method, a device for starting up an elevator installation and an elevator installation with this device according to the independent patent claims.
Elevator systems are provided with monitoring devices or safety circuits.
These safety circuits typically consist of serially connected safety elements. For example, these security elements can monitor the condition of manhole or car doors. Electromechanical safety circuits or bus-based safety circuits are known. The safe operation of such safety circuits is checked regularly. Safety circuits and test methods of such circuits are for example EP 1159218 A1 . WO 2010/097404 A1 or WO 2013/020806 A1 known. However, it is not clear from this prior art whether or to what extent the safety during the commissioning of elevator systems is ensured. A method and a device for starting up a lift installation according to the prior art is known from EP1795481 A1 known.

It is therefore an object of the invention to provide a method and a device, with which or which an elevator installation can be safely put into operation.

This object is achieved by a method, a device and an elevator installation with this device having the features of the independent patent claims.
An elevator system includes a control unit, a bus, a plurality of bus nodes connected to the control unit via the bus, and a plurality of security state detecting means connected to the control unit via a bus node.
As a control unit is understood here a unit that has at least a microprocessor, a memory and a memory. Such a control unit is therefore designed to execute computer-aided programs. The control unit is configured here as a safety control unit, which monitors safety-relevant states of the elevator installation and, when an unsafe condition occurs, brings the elevator installation back into a safe state. This includes, for example, the Monitoring the shaft door conditions, wherein the elevator system is shut down when a shaft door is open and when no elevator car is on the shaft door associated floor.

As a safety state detection means are understood here sensors or switching contacts that monitor a safety-related condition of the elevator system. This includes both position, speed or acceleration sensors that monitor a state of motion of an elevator car as well as switch contacts that monitor a manhole or cabin door state or the passing of a permissible end position by the elevator car. This listing is not exhaustive.

1. A) Verifikation der am Bus angeschlossenen Sicherheitszustandserfassungsmittel durch die Steuereinheit,
2. B) Prüfung der Funktionstüchtigkeit der am Bus angeschlossenen Sicherheitszustandserfassungsmittel durch die Steuereinheit,
3. C) Prüfung der Sicherheitsfunktionen der Aufzugsanlage aufgrund einer Zustandsänderung eines Sicherheitszustandserfassungsmittels durch die Steuereinheit, und
4. D) Freigabe der Aufzugsanlage für einen Normalbetrieb erst nach positivem Durchlauf der Schritte A) bis C) durch die Steuereinheit, wobei die Freigabe des Normalbetriebs einhergeht mit einer Zustandsänderung der Steuereinheit von einem ungesicherten Zustand in einen gesicherten Zustand.

According to the invention, the control unit goes through the following steps during a commissioning of the elevator installation:

1. A) verification by the control unit of the safety-state detection means connected to the bus,
2. B) checking by the control unit the functionality of the safety-state detection means connected to the bus,
3. C) Checking the safety functions of the elevator installation due to a state change of a safety condition detection means by the control unit, and
4. D) release of the elevator system for normal operation only after positive passage of steps A) to C) by the control unit, wherein the release of the normal operation is accompanied by a state change of the control unit from an unsecured state to a secure state.

During the verification in step A), the control unit, for example, records all safety-state detection means connected to the bus and compares them with a stored expectation. Alternatively, the security condition detection means may be entered manually by an installation engineer into the control unit. After step A), there is a verified inventory of all security state detection means connected to the bus by the comparison or the manual input.

When checking the functionality of the connected safety-state detection means, the control unit virtually or really brings about a change of state of the elevator installation and checks whether the signals output by the safety-state detection means correspond to the state change. For example, the control unit causes the elevator car to move to a specific floor. This can be provoked on reaching the specific floor opening the shaft door. With proper functioning of the safety state detection means, which monitors the state of the shaft door, this transmits a signal indicating the open state of the landing door to the control unit. Alternatively, the control unit can virtually simulate a process of the elevator car to a specific embroidery work. The control unit accordingly proceeds for all safety-state detection means to be checked. If the transmitted signals transmitted by the security state detection means coincide with the expectation of the control unit, then step B) is concluded as being positive.

When checking the safety functions of the elevator system, the control unit goes one step further and brings about an impermissible state. This invalid state can be generated both virtually and real. In the case of an impermissible state, not only the signals transmitted by the security state detection means must correspond to the expectation of the control unit, but a reaction corresponding to the inadmissible state for transferring the elevator installation to a safe state must also be detected. For example, emergency braking by the control unit would have to be triggered when the elevator car is open when the shaft doors are open. If a corresponding reaction has been registered for all conceivable inadmissible states, then step C) is concluded as positive.

If all steps A) to C) went through positive, the elevator system can be released for normal operation. In this case, the control unit changes from an unsecured state to a secure state. As long as the control unit is in an unsecured state, ie during steps A) to C), the control unit can be configured. If the control unit assumes the secured state, a configuration of the control unit is excluded. In this secured state the control unit can only be brought into different operating modes. These operating modes include at least a normal operating mode and a maintenance mode. Optionally, the controller may also include an inspection mode, an evacuation mode or other special operating modes.

An advantage of the method according to the invention is that the transition from commissioning to normal operating mode is defined by means of the control unit. Steps A) to C) require clear conditions that must be met before the elevator installation can be set to normal operation mode. Thus, the elevator system can be safely put into operation.

By taking a secure state of the control unit, the reliability is further increased. Because an unwanted change of the program of the control unit or an unwanted addition or omission of bus nodes is excluded in this state. If an installation technician wants to connect additional bus nodes to the bus, then the control unit is to be brought back into the unsecured state by means of a special command. A renewed release of the elevator installation for a normal operating mode is in turn only possible after passing through steps A) to C).

Furthermore, the elevator system has an emergency brake for braking an elevator car. The emergency brake is designed for example as a drive brake, which counteracts a rotational movement of the drive axle of the drive. Here, the braking effect of the drive brake is transmitted from the drive axle via a traction sheave and a suspension means to the elevator car. The emergency brake can be triggered by the control unit.

Preferably, the examination of the safety functions in step C) includes a release of the emergency brake due to an impermissible state of motion of the elevator car and / or an impermissible state of the car or shaft doors. In particular, the emergency brake due to an impermissible speed, an unintentional movement of the elevator car in the open state of the shaft doors, overrunning a limit switch, an impermissible acceleration, a Inadmissible open state of the shaft door or an inadmissible open state of the cabin doors triggered.

Furthermore, the elevator system has a catch brake for braking the elevator car. The safety brake is arranged on the elevator car and acts on a guide rail of the elevator car to bring the elevator car to a standstill. The safety brake can also be triggered by the control unit.

Optionally or in addition, the examination of the safety functions in step C) comprises a triggering of the safety brake due to an impermissible state of motion of the elevator car and / or an impermissible state of the car or shaft doors. In particular, the safety brake is triggered due to impermissible speed, unintentional movement of the elevator car when the shaft doors are open, overrunning a limit switch, improper acceleration, improper open status of the hoistway door, or inadmissible open state of the car doors.

Needless to say, other safety functions can also be checked, such as, for example, a safety-related braking of the elevator car by means of controlling an inverter. The above test examples of the safety functions are to be understood as purely exemplary and do not represent a concluding treatise of step C).

Preferably, the impermissible state of motion of the elevator car and / or the impermissible state of the car or the shaft door are generated virtually by the control unit, by the control unit transmitting at least one error signal to a bus node.

Alternatively, the unacceptable state of motion of the elevator car and / or the inadmissible state of the car or shaft door are generated by the control unit by bringing the elevator car and / or the car or the shaft door by the control unit in an inadmissible state of motion or an inadmissible state ,

Furthermore, the elevator system has an interface for inputting control commands to the control unit. The interface can be designed as a key board or as a touch-sensitive screen, via which a control command or a code in the form of a combination of numbers and / or a sequence of letters can be entered.

Preferably, on the one hand, the input of configuration commands to the interface is accepted only in the unsecured state of the control unit, on the other hand, the input of configuration commands to the interface in the secure state is rejected by the control unit.

Configuration commands here are commands to the control unit with which the number of bus nodes and / or the type of state detection means can be detected.

In the secured mode, preferably only predetermined operating modes are enabled by the control unit, which include a normal mode, a maintenance mode or an inspection mode.

Another aspect of the invention relates to a device for carrying out the method and an elevator installation with the said device.

Fig. 1

schematisch eine exemplarische Anordnung einer erfindungsgemässen Aufzugsanlage; und

Fig. 2

ein Flussdiagramm der Verfahrensschritte des erfindungsgemässen Verfahrens.

The invention will be described below with reference to exemplary embodiments. Show it:

Fig. 1

schematically an exemplary arrangement of an elevator system according to the invention; and

Fig. 2

a flowchart of the method steps of the inventive method.

The in the Fig. 1 schematically illustrated elevator installation 1 comprises a control unit 2, which is connected via a bus 3 to a plurality of bus nodes 41 to 48 and 49a, 49b. The control unit 2 can as in Fig. 1 be shown in a separate drive space 8. In a preferred embodiment, the control unit 2 is arranged in the shaft 6.

The reference numeral 6 schematically shows a shaft 6 of a building in which the elevator installation 1 is installed. By way of example, the building has three floors, each floor being equipped with a landing door 61, 62 or 63. The bus node 41, the shaft door 61, the bus node 42, the shaft door 62 and the bus node 43, the shaft door 63 assigned.

The respective bus nodes 41, 42 or 43 are each assigned a security status means, here for example a switching contact 61a, 62a, 63a, which records information relating to the state of the associated shaft door 61, 62 or 63 (open, closed, locked) and possibly a fault message for the control unit 2 can generate.

The elevator installation 1 furthermore has an elevator cage 7. The elevator cage 7 is equipped with an elevator door 74, which is likewise assigned to a bus node 44. The bus node 44 is a further security state means, such as another switch contact 74a assigned, which information regarding the state of the associated elevator door 74 (open, closed, locked) determines and possibly generate a fault message for the control unit 2.

The elevator installation 1 can furthermore have a bus node 45 and a bus node 46 which are each assigned to a catch brake 75 arranged in the elevator car 7 and an emergency switch 76. The safety brake 75 is used for safety braking of the elevator car 7, for example, when reaching an overspeed of the same.

By operating the emergency switch 76, the elevator installation 1 can be brought to an immediate standstill in an emergency situation.

In a drive space 8, a drive unit is further arranged, which is equipped with an emergency brake 87 and a further safety state detection means, such as a speed sensor 88, each associated with a bus node 47 and 48. In a preferred embodiment, the drive unit is arranged in the shaft 6, wherein a separate drive space is eliminated.

In the shaft 6 further security state detection means, here two limit switches 89a, 89b are provided, which limit a travel of the elevator car 7 at the ends of the shaft 6. In the Fig. 1 the limit switches 89a, 89b are shown together for reasons of clarity. One of the limit switches 89a, 89b may be arranged in the pit area of the shaft 6, while the further limit switch 89a, 89b may be arranged in the shaft head area of the shaft 6. The limit switches 89a, 89b are connected to the bus 3 via a respective bus node 49a, 49b. If the elevator car 7 passes over one of the limit switches 89a, 89b, the respective limit switch 89a, 89b changes its state and a fault message is issued to the control unit 2. The control unit 2 brings the elevator car 7 due to this fault message by means of the emergency brake 75 to a standstill.

When commissioning an elevator installation 1, the control unit 2 verifies according to method step A. Fig. 2 the bus nodes 41 to 48 and 49a, 49b installed in the elevator installation and / or the connected security state detection means 61a, 62a, 63a, 74a, 88, 89a, 89b and the node-specific data of each bus node 41 to 48 and 49a, 49b. As node-specific data, data about the bus node addresses or data of the state detection means connected to the bus node will become here. The determined data are stored by the control unit.

The detected node-specific data are then automatically compared by means of the control unit 2 with a subscriber list 5, which is empty in this embodiment. For this reason, a request is made to a technician who is responsible for commissioning the elevator installation 1 for each determined bus node 41 to 48 and 49a, 49b, if the respective determined bus node 41 to 48 and 49a, 49b in the participant list should be saved or not.

Upon confirmation of the determined bus node 41, the technician receives a new message for storing a further determined bus node, for example, the bus node 42. If canceled, the technician can restart the commissioning, or edit the list of participants.

The collection of node-specific data and their comparison with a list is referred to here as verification.

The bus node 41 thus stored in the subscriber list 5 or the security state detection means 61 a connected thereto can then be tested for functionality in accordance with the method step B from the Fig. 2 be subjected. The control unit 2 controls the landing door 61 and leaves it open. The security state detection means 61a assigned to the bus node 41 detects the opening of the shaft door 61 and reports this change of state to the control unit 2. The reported state change thus tests the functionality of the bus node 41 and of the assigned security state detection means 61a.

The control unit 2 can, for example, also instruct the drive unit to move the elevator car 7 to the second floor. When starting the second floor, the control unit 2 receives node-specific data about the rotational speed of the engine from the speed sensor 88 from the bus node 48, which characterize a movement of the elevator car 7.

When the elevator car 7 has reached the desired floor, the elevator door 74 opens simultaneously with the shaft door 62. The respective bus nodes 44, 42 and the respective safety state detection means 74a, 62a notify the control unit 2 of the change of state which the functionality of both bus nodes 42 and 44 and the associated security state detection means 62a, 74a. The procedure is the same for the other floors.

Analogously, the control unit 2 can instruct the drive unit to move the elevator car 7 via one of the limit switches 89a, 89b in order to check the functionality of the bus node 49a, 49b or the safety detection means 89a, 89b

To test the safety function according to method step C Fig. 2 For example, the control unit 2 simulates an actuation of the emergency switch 76 and determines whether the emergency brake 87 immediately brings the elevator car 7 to a standstill by means of a corresponding notification of node-specific data of the bus nodes 47 and 48.

Furthermore, the control unit 2 can simulate the detection of an overspeed of the elevator car 7 by the speed sensor 88 and provoke triggering of the catch brake 75. Accordingly, a status message of the safety brake 75 is transmitted from the assigned bus node 45 to the control unit 2. In this case, the triggering of the safety brake 75 is confirmed.

After successful completion of the three process steps A, B, C, namely the "Verification of the safety condition detection means", the "Functionality Check" and the "Check the safety functions" issued a message to release the elevator system 1 for normal operation according to step D. Fig. 2 , This release is associated with a change of state of the control unit 2 from an unsecured state to a secure state.

The previously described three method steps A, B, C which precede the release D of the elevator installation 1 take place in an unsecured state of the control unit 2. In the secured state of the control unit 2, however, the control unit 2 can no longer be manipulated. The control unit 2 accepts in this state only control commands for changing the operating mode. For example, the control unit 2 can be brought from a normal mode into a maintenance mode and vice versa.

In a modernization of the elevator installation 1, changes to the configuration of the control unit 2 are to be made possible again. The control unit 2 is to bring this again by means of input of a special command in the unsafe state. As part of a modernization, the number of bus nodes and / or the type of state detection means can be adjusted within a given framework. For example, an absolute positioning sensor, which is arranged on the elevator car 7, could be provided in addition to the rotational speed sensor 88 or as a replacement thereof. After installing the absolute positioning sensor and establishing the connection with the bus 3, the control unit 2 verifies its node-specific data, checks its functionality and checks the safety functions associated with the absolute positioning sensor. Only after passing through the three process steps A, B, C is again issued a message to release the elevator installation 1 for a Normal operation according to process step D. The control unit 2 is brought back into its secure state.

Of course, depending on the design of the elevator installation 1, several control units or additional condition detection means can be provided. If the spatial arrangement of the state detection means allows it, a plurality of state detection means may also be connected to the bus 3 at a common bus node. The teaching of the invention is not limited to the embodiments.

Claims (15)

1. Method for commissioning an elevator system (1) with a control unit (2), a bus (3), a plurality of bus-nodes (41-48, 49a, 49b), which are connected via the bus (3) with the control unit (2), and a plurality of safety-state detection means (61a-63a, 74a, 88, 89a, 89b), which are connected with the control unit (2) via a bus-node (41-48, 49a, 49b), wherein the method comprises the following steps:

   A) verification by the control unit (2) of the safety-state detection means (61a-63a, 74a, 88, 89a, 89b) which are connected to the bus (3);

   B) checking by the control unit (2) of the functional capability of the safety-state detection means (61a-63a, 74a, 88, 89a, 89b) which are connected to the bus (3);

   C) checking by the control unit (2) of the safety functions of the elevator system (1) based on a change of state of a safety-state detection means (61a-63a, 74a, 88, 89a, 89b) by the control unit (2); and

   D) release of the elevator system (1) for a normal operation only after positive execution by the control unit (2) of the steps A) to C), wherein the release of the normal operation is accompanied by a change of state of the control unit (2) from an unsecured state to a secured state.
2. Method according to Claim 1,
   wherein the elevator system (1) can further have an emergency brake (87) to brake an elevator car (7), which emergency brake (87) can be triggered by the control unit (2), and
   wherein the checking of the safety functions in Step C) comprises a triggering of the emergency brake (87) on account of an inadmissible movement-state of the elevator car (7) and/or of an inadmissible state of the car doors (74) or hoistway doors (61-63), in particular on account of an inadmissible velocity, of an unintentional movement of the elevator car (7) with open state of the hoistway doors (61-63), an overrunning of a final-limit switch (89a, 89b), an inadmissible acceleration, an inadmissible open state of the hoistway door (74), or an inadmissible open state of the car door (61-63).
3. Method according to Claim 1 or 2,
   wherein the elevator system (1) can further have a safety gear (75) to brake an elevator car (7), which safety gear (75) can be triggered by the control unit (2), and wherein
   the checking of the safety functions in Step C) comprises a triggering of the safety gear (75) on account of an inadmissible movement state of the elevator car (7) and/or of an inadmissible state of the car doors (61-63) or hoistway doors (74), in particular on account of an inadmissible velocity, an unintentional movement of the elevator car (7) in open state of the hoistway doors (61-63), an overrunning of the final-limit switch (89a, 89b), an inadmissible acceleration, an inadmissible open state of the hoistway door (74), or an inadmissible open state of the car doors (61-63).
4. Method according to one of claims 2 or 3,
   wherein the inadmissible movement-state of the elevator car (7), and/or the inadmissible state of the car door (74) or of the hoistway door, is virtually generated by the control unit (2), in that at least one fault signal is transmitted from the control unit (2) to a bus-node (43-48, 49a, 49b).
5. Method according to one of claims 2 or 3,
   wherein the inadmissible movement-state of the elevator car (7), and/or the inadmissible state of the car door (74) or of the hoistway door (61-63) is generated by the control unit (2), in that the elevator car (7) and/or the car door (74) or the hoistway door (61-63) is brought by the control unit (2) into an inadmissible movement state or an inadmissible state.
6. Method according to Claim 1,
   wherein the elevator system (1) further contains an interface for entering control commands to the control unit (2) and wherein the entry of configuration commands at the interface is only accepted in the unsecured state of the control unit (2).
7. Method according to Claim 1,
   wherein the elevator system (1) further contains an interface for entering control commands to the control unit (2) and wherein, in the secured state, configuration commands at the interface are rejected by the control unit (2).
8. Method according to one of the foregoing claims,
   wherein, in secured mode, only predefinable operating modes are released by the control unit (2) which comprise a normal operation, a maintenance operation, or an inspection mode.
9. Apparatus for commissioning an elevator system (1), in particular for executing the method according to one of claims 1 to 8, with a control unit (2), a bus (3), a plurality of bus-nodes (41-48, 49a, 49b), which are connected via the bus (3) with the control unit (2), and a plurality of safety-state detection means (61a-63a, 74a, 88, 89a, 89b), which are connected with the control unit (2) via a bus-node (41-48, 49a, 49b),
   characterized in that
   the control unit (2) is so designed that the elevator system (1) is only released for normal operation when the control unit (2) has verified the safety-state detection means (61a-63a, 74a, 88, 89a, 89b) that are connected to the bus (3), checked the functional capability of the safety-state detection means (61a-63a, 74a, 88, 89a, 89b) that are connected to the bus (3), and, based on a change in state of a safety-state detection means (61a-63a, 74a, 88, 89a, 89b), checked the safety functions of the elevator system (1), wherein the release of normal operation is accompanied by a change in state of the control unit (2) from an unsecured state into a secured state.
10. Apparatus according to Claim 9,
    with an emergency brake (87) for braking an elevator car (7), wherein the emergency brake (87) can be triggered by the control unit (2),
    characterized in that, in the checking of the safety functions (2), on account of an inadmissible movement-state of the elevator car (7) and/or of an inadmissible state of the car doors (74) and/or of the hoistway doors (61-63), in particular on account of an inadmissible velocity, an unintentional movement of the elevator car (7) in an open state of the hoistway doors (61-63), an overrunning of a final-limit switch (89a, 89b), an inadmissible acceleration, an inadmissible open state of the hoistway door (61-63), or an inadmissible open state of the car doors (74), the control unit triggers the emergency brake (87).
11. Apparatus according to Claim 9,
    with a safety gear (75) for braking an elevator car (7), wherein the safety gear (75) can be triggered by the control unit (2), characterized in that, in the checking of the safety functions, on account of an inadmissible movement-state of the elevator car (7) and/or of an inadmissible state of the car doors (74) or of the hoistway doors (61-63), in particular on account of an inadmissible velocity, an unintentional movement of the elevator car (7) in an open state of the hoistway doors (61-63), an overrunning of a final-limit switch (89a, 89b), an inadmissible acceleration, an inadmissible open state of the hoistway door (61-63), or an inadmissible open state of the car doors (74), the control unit (2) triggers the safety gear (75).
12. Apparatus according to Claim 9,
    with an interface for the entry of control commands to the control unit (2),
    characterized in that the control unit (2) only accepts the entry of configuration commands at the interface in the unsecured state.
13. Apparatus according to Claim 9,
    with an interface for the entry of control commands to the control unit (2),
    characterized in that, in the secured state, the control unit (2) rejects the entry of configuration commands at the interface.
14. Apparatus according to one of claims 9 to 13,
    characterized in that,
    in secured mode, the control unit (2) only releases predefinable operating modes that comprise a normal operation, a maintenance operation, or an inspection mode.
15. Elevator system (1) with an apparatus according to one of claims 9 to 14.

Images