EP3233698B1 - Method for operating an electronic security system with temporary participants - Google Patents

Description

The invention relates to a method for operating a security system with temporary subscribers and to a security system which is intended to carry out this method and to an elevator installation with this security system.

Elevator systems are equipped with safety systems for safe operation. These security systems typically consist of serially connected security elements. For example, these security elements can monitor the condition of manhole or car doors. Electromechanical safety circuits or bus-based safety circuits are known. The safe operation of such bus-based safety circuits is regularly checked. Construction and test methods of such bus-based safety circuits are, for example EP 1159218 A1 . WO 2010/097404 A1 or WO 2013/020806 A1 known. From this prior art, however, it is not clear whether or to what extent the security when connecting or disconnecting temporary subscribers, such as a hand control device for controlling the elevator installation during maintenance or an input device in the configuration settings of the security system can be adjusted, is ensured.

It is therefore an object of the invention to specify a method or a security system and an elevator installation with such a security system, with which or which the secure separation of a temporary subscriber from the security system is ensured.

This object is achieved by a method, a safety system and an elevator installation with this safety system having the features of the independent patent claims.

The safety system of the elevator installation comprises a control unit, a bus, a plurality of bus nodes which are connected to the control unit via the bus and a plurality of subscribers which are connected to the control unit via a bus node.

As a control unit is understood here a unit that has at least a microprocessor, a memory and a memory. Such a control unit is therefore designed to execute computer-aided programs. The control unit is configured here as a safety control unit which monitors safety-relevant states of the elevator installation and brings the elevator installation back into a safe state when an unsafe condition occurs. This includes, for example, the monitoring of the shaft door conditions, wherein the elevator system is shut down when a shaft door is open.

As participants, sensors, switch contacts, operating elements or actuators are understood here, which on the one hand monitor a state of the elevator installation and on the other hand can exert influence on the safe operation of the elevator installation. These include position, speed or acceleration sensors which monitor a state of motion of an elevator car as well as switch contacts which monitor a shaft or car door state or the passage of a predetermined end position through the elevator car. A security system may also include controls via which control commands for the control system of the security system or the elevator installation, the configuration of the security system or the selection of an operating mode can be entered, such as a switch button, an input screen or a manual control device. Actuators are understood to be all components that can be actuated by the control unit in order to restore an elevator installation to a safe state after the detection of an impermissible state, such as a drive motor, a holding brake or a safety brake. This listing of the aforementioned participants is only exemplary and not exhaustive.

The security system may have at least one participant who is designed as a temporary participant. A temporary subscriber is here understood to be a subscriber who is connected to the security system or the control unit only for a temporary time via a bus node. Such temporary subscribers can be designed, for example, as operating elements, governor elements or bridging elements which are or are connected to the safety system only in a certain operating mode, such as, for example, a normal operating mode, a maintenance mode or a configuration mode should.

Hand control device is here understood to mean a device for controlling the elevator installation, which is operated by a maintenance technician during maintenance work. This manual control unit preferably comprises four control elements, namely a button for performing a downward or upward travel, a button for triggering an emergency stop and a switch for activating or deactivating the maintenance mode.

Preferably, the temporary subscriber is logged out in the security system by A) announcing a disconnection of the temporary subscriber from the security system by means of a manipulation on the security system and B) the temporary subscriber is disconnected from the security system.

By means of the manipulation of the security system, an expectation is created in the control unit, which can be used for monitoring the logout process of a corresponding temporary subscriber. This manipulation can be done for example via a switching element of a manual control device or via a touch-sensitive screen of an input device.

The manipulation preferably takes place by means of input of a control command at a designated input location or by actuation of a switch. The entry point or the switch are each connected to the security system.

Preferably, the security system is set by the control unit in a fault mode when the temporary subscriber is disconnected after manipulation of the security system only after a predetermined time from the security system. This ensures that the logout process of the temporary subscriber is a deliberately performed action.

Under interference mode is understood here a mode in which the elevator system can not be operated or only limited. As a rule, the elevator system is shut down in the fault mode, so that a potentially dangerous situation can not even occur. At best, could still be a last ride the elevator car in the sturgeon mode be admitted to a next floor to avoid trapping passengers in the elevator car. The elevator installation can then be put back into service if the situation that led to the fault mode has been reversed again. If, for example, the temporary participant is not disconnected from the security system until after a predetermined time after the manipulation, the temporary participant must be reconnected to the security system.

Preferably, a target list of subscribers is implemented on the control unit, which at least includes data for an identification number of a subscriber, and the temporary subscriber is logged off by the control unit by an entry of the temporary subscriber from the control unit in the target list of an active to an inactive Status is set.

The identification number represents a number by means of which a subscriber connected to the security system can be recognized; in particular, this number can represent an identification number that is unique for each subscriber or an identification number that declares a type of the subscriber. The identification number can be stored on a storage medium of the subscriber. Such an identification number can also be stored in advance on the target list. The target list defines an expectation of the control unit, which participants should be connected to the security system. Accordingly, there is an entry in the target list for each participant that can be connected to the security system. If the temporary subscriber is disconnected from the security system, this subscriber is set inactive by the control unit in the target list or its entry.

Preferably, an actual list of subscribers is implemented on the control unit, which represents an image of the participants connected to the security system and operation of the elevator system is only enabled if the control unit in a comparison of activated in the target list participants with the in the actual List of registered subscribers a match is detected.

The actual list represents a list of all subscribers connected to the security system at any given time. Preferably, all recognized participants are listed by their identification numbers in the actual list. The Comparison between the subscribers listed in the actual list with the subscribers deposited in the target list, in particular those who have an active status for a certain operating mode, is preferably carried out on the basis of the identification numbers listed in the two lists. This comparison ensures that all subscribers intended for a particular operating mode are connected to the security system before a corresponding operating mode is released.

Preferably, in the event of a power failure, a system state of the security system is stored in a read-only memory of the control unit, in particular the system state is stored on the basis of a target list.

Preferably, when the safety system is restarted after the power failure, the stored system state is compared by the control unit with the current system state, in particular the stored target list is compared with an updated actual list and the safety system is set by the control unit in an interference mode, if based on the comparison the absence of a temporary participant in the actual list is determined.

Another aspect of the invention relates to a device for carrying out the method and an elevator installation with the said device.

• Fig. 1 schematisch eine exemplarische Anordnung einer erfindungsgemässen Aufzugsanlage;
• Fig. 2 eine exemplarische Ausführung einer Sollliste, die auf der Steuereinheit des Sicherheitssystems implementiert ist; und
• Fig. 3 ein Flussdiagramm mit einem exemplarischen Ablauf eines Abmeldeverfahrens eines temporären Teilnehmers am Sicherheitssystem.

The invention will be further described by means of embodiments. Show it:

• Fig. 1 schematically an exemplary arrangement of an elevator system according to the invention;
• Fig. 2 an exemplary implementation of a target list implemented on the control unit of the security system; and
• Fig. 3 a flowchart with an exemplary sequence of a logoff procedure of a temporary subscriber to the security system.

The in the Fig. 1 schematically illustrated elevator installation 1 comprises a control unit 2, which is connected via a bus 3 to a plurality of bus nodes 41 to 49. The control unit 2 can as in Fig. 1 be shown in a separate drive space 8. In a preferred embodiment, the control unit 2 may also be arranged in a shaft 6.

The reference numeral 6 schematically shows a shaft 6 of a building in which the elevator installation 1 is installed. By way of example, the building has three floors, each floor being equipped with a landing door 61, 62 or 63. The bus node 41, the shaft door 61, the bus node 42, the shaft door 62 and the bus node 43, the shaft door 63 assigned.

The respective bus nodes 41, 42 or 43 are each assigned a subscriber, here for example a switching contact 61a, 62a, 63a, which records information relating to the state of the associated landing door 61, 62 or 63 (open, closed, locked) and possibly a fault message for the control unit 2 can generate.

The elevator installation 1 furthermore has an elevator cage 7. The elevator cage 7 is equipped with an elevator door 74, which is likewise assigned to a bus node 44. The bus node 44 is a further participant, such as another switch contact 74a assigned, which information regarding the state of the associated elevator door 74 (open, closed, locked) determines and possibly generate a fault message for the control unit 2.

The elevator installation 1 can furthermore have a bus node 45 and a bus node 46, to which further subscribers are assigned, namely one catching mechanism 75 arranged on the elevator car 7 and one emergency switch 76. The catching brake 75 serves for safety braking of the elevator car 7, for example upon reaching one Overspeed of the same. By operating the emergency switch 76, the elevator installation 1 can be brought to an immediate standstill in an emergency situation.

In a drive space 8, a drive unit is further arranged, which is equipped with two other participants, namely with an emergency brake 87 and a speed sensor 88, which are each assigned to a bus node 47 and 48. In a preferred embodiment, the drive unit may be arranged in the shaft 6, wherein a separate drive space is eliminated.

Furthermore, a bus node 49 is provided, which is arranged in the region of the shaft 6, and is designed to accommodate a temporary subscriber, namely a manual control device 89. The bus node 49 may in particular be arranged on the roof of the car 7 or in the pit of the shaft 1 or at one of the doors 61-63, depending on where the elevator installation 1 maintenance work is to be performed, which require a method of the elevator car 7. The temporary subscriber 89 is thus connected to the bus 3 or the control unit 2 via the bus node 49.

In the example shown, the temporary subscriber 89 can be connected to the bus 3 at a slot of the corresponding bus node 49. Alternatively, the temporary subscriber 89 can also be connected wirelessly to bus 3, for example via a WLAN, Bluetooth or another type of radio connection.

The hand control unit 89 is designed to control the elevator installation 1 or the elevator car 7 during a maintenance mode and comprises four control elements by way of example, namely one button for performing an upward or downward travel, one button for triggering an emergency stop and one switch for activating or deactivating a maintenance mode.

The control unit 2 has a target list 5 a, which defines an expectation of the control unit 2. The target list 5a includes e.g. a list of which participants 61a-63a, 74a, 75, 76, 87, 88, 89 should be connected to the bus 3 at some point in time. In addition, the control unit 2 has an actual list 5b, which represents a listing of all subscribers 61a-63a, 74a, 75, 76, 87, 88, 89 currently connected to the bus 3.

Based on Fig. 2 the target list 5a is explained in more detail. The target list 5a comprises an entry for each participant contained therein. This entry corresponds to one row of the table. In a first column, a bus address ADD of a bus node 41 to 49 is stored, to which the respective subscriber 61a-63a, 74a, 75, 76, 87, 88, 89 is connected. Via the bus address ADD, the control unit 2 with a Bus node 41 to 49 or a connected thereto participants 61a-63a, 74a, 75, 76, 87, 88, 89 communicate. Accordingly, the control unit 2, for example, control signals to a corresponding subscriber, for example to the safety brake 75 via the bus address ADD, 45 address or specifically query states of the switch contact 61a at the bus ADD, 41.

In a second column, a first identification number ID1 of a subscriber 61a-63a, 74a, 75, 76, 87, 88, 89 is stored. This first identification number ID1 depends on the type of subscriber. Thus, subscribers 61a to 63b all logically have the same first identification number ID1 with the value SS, since all three subscribers are designed as type-identical switching contacts 61a to 63a which monitor the state of an associated hoistway door 61 to 63. A catch brake 75, however, has a deviating first identification number ID1 with the value UU.

The subscribers can also be identifiable via a second identification number ID2. This second identification number ID2 represents for each participant 61a-63a, 74a, 75, 76, 87, 88, 89 e.g. a number AAA to JJJ, which allows a unique identification of each participant 61a-63a, 74a, 75, 76, 87, 88, 89.

Finally, an activation value A or I is stored for each participant in the target list 5a, the activation value A representing an active status and the activation value I representing an inactive status of a subscriber. The target list 5a shown has respective activation values A, I for two different operating modes of the elevator installation 1, namely for a normal operating mode N and for a maintenance mode W. Thus, for example, in the entry for the temporary subscriber 89 or the manual control unit is an activation value A for a maintenance mode W and an activation value I for a normal operating mode N indicated. The manual control unit 89 is therefore assigned an active status in maintenance mode W and an inactive status in normal operation mode N.

After completion of maintenance, the manual control unit 89 is deregistered from the control unit 2, in a first step A according to Fig. 3 a disconnection of the hand control unit 89 from the bus 3 based on a reset of the activation switch on the manual control unit of the control unit 2 is announced. To After resetting the activation switch, the manual control unit 89 can be disconnected from the bus 3 in a second step B. By means of the resetting of the activation switch, an expectation is created in the control unit 2 which can be used for monitoring the logoff operation of the manual control device 89.

Here, the elevator system 1 is set by the control unit 2 in a jamming mode when the temporary subscriber 89 is disconnected after resetting the activation switch only after a predetermined time from the bus 3.

Alternatively, the disconnection of the temporary subscriber 89 may be announced by means of a manipulation at the control unit 2. The announcement can be made by inputting a control command at a designated entry point, which is connected via a bus node to the bus 3 or which is arranged directly on the control unit 2. Another way to announce the disconnection is the operation of a switch. This switch can also be connected via a bus node to the bus 3 or be arranged directly on the control unit 2.

When logging off the manual control unit 89 whose entry is set by the control unit 2 in the target list 5a of an active A to an inactive status I. In accordance with the operating mode W, N for the inactive status I stored for the manual control unit 89 in the entry of the target list 5a, the control unit 2 can automatically bring the elevator installation 1 into a normal operating mode N.

In addition, an actual list 5b of the subscribers 61a-63a, 74a, 75, 76, 87, 88, 89 is implemented on the control unit 2, which is an image of the subscribers 61a-63a, 74a connected to the security system 5b at some point in time. 75, 76, 87, 88, 89 represents. The actual list 5b is constructed very much like the target list 5a and substantially comprises the first four columns of the target list 5a. The control unit 2 thus reads out for each existing bus node 41 to 49 or its address ADD and the identification numbers ID1, ID2 of the subscribers 61a-63a, 74a, 75, 76, 87, 88, 89 connected to the respective bus node 41 to 49. The operation of the elevator installation 1 is only released by the control unit 2 if the control unit 2 compares the identification numbers ID1, ID2, in particular the Identification numbers ID1, ID2 of the entries of the target list 5a, for which an active status is stored in a respective operating mode N, W, with those of the actual list 5b determines a match.

In the event of a power failure, the system state of the elevator installation 1 is stored in a permanent memory of the control unit 2. In particular, the target list 5a is stored on the read-only memory, since the target list 5a represents such a system state. Namely, all participants 61a-63a, 74a, 75, 76, 87, 88, 89 are listed in the target list 5a, who should have an active status at some point in time.

When restarting the elevator installation 1 after the power failure, the stored target list 5a serves as a checklist. In order to determine whether all existing before the power failure temporary participants 89 are still connected to the bus 3, the stored target list 5a is compared with the current actual list 5b. If, on the basis of the comparison, the control unit 2 detects the absence of a temporary subscriber 89 in the actual list, the latter sets the elevator installation 1 into a fault mode.

Claims (9)

1. A method for operating a safety system of an elevator system (1) having

   - a control unit (2),

   - a bus (3),

   - a plurality of bus nodes (41-49), which are connected to the control unit (2) via the bus (3), characterised by

   - a plurality of participants (61a-63a, 74a, 75, 76, 87, 88, 89), of which at least one participant is designed as a temporary participant (89), and which are connected to the control unit (2) via a bus node (41-49), wherein

   - the temporary participant (89) is logged out of the safety system by

   - A) giving notice of a disconnection of the temporary participant (89) from the safety system by means of a manipulation of the safety system, and

   - B) disconnecting the temporary participant (89) from the safety system.
2. The method according to Claim 1, wherein the safety system is set to a fault mode by the control unit (2) if the temporary participant (89) is not disconnected from the safety system until after a predefined time after the manipulation of the safety system.
3. The method according to Claim 1 or 2, wherein a target list (5a) of the participants (61a-63a, 74a, 75, 76, 87, 88, 89) is implemented on the control unit (2), which list includes at least data on an identification number (ID1, ID2) of each participant (61a-63a, 74a, 75, 76, 87, 88, 89), and the temporary participant (89) is logged out of the control unit (2) by the control unit (2) changing an entry of the temporary participant (89) in the target list (5a) from an active status (A) to an inactive status (I).
4. The method according to Claim 3, wherein an actual list (5b) of the participants (61a-63a, 74a, 75, 76, 87, 88, 89) is implemented on the control unit, said list forming an image of the participants (61a-63a, 74a, 75, 76, 87, 88, 89) connected to the safety system, and operation of the elevator system (1) is only enabled if the control unit (2) establishes a correspondence in a comparison between the participants (61a-63a, 74a, 75, 76, 87, 88, 89) activated in the target list (5a) and the participants (61a-63a, 74a, 75, 76, 87, 88, 89) entered in the actual list (5b).
5. The method according to Claim 1, wherein the manipulation of the safety system takes place by inputting a control command at an input point provided therefor or by operating a switch, wherein the input point or the switch are each connected to the safety system.
6. The method according to any one of the preceding claims, wherein
   in the event of a power failure, a system condition of the safety system is preferably stored in a non-volatile memory of the control unit (2); in particular the system condition is stored using a target list (5a).
7. The method according to Claim 6, wherein when the safety system is put back into operation after the power failure, the stored system condition is compared with the current system condition by the control unit (2); in particular the stored target list (5a) is compared with an actual list (5b) and the safety system is set by the control unit (2) to a fault mode if a temporary participant (89) is found to be missing from the actual list (5b) on the basis of the comparison.
8. A safety system for an elevator system (1), having

   - a control unit (2),

   - a bus (3),

   - a plurality of bus nodes (41-49), which are connected to the control unit (2) via the bus (3), characterised by

   - a plurality of participants (61a-63a, 74a, 75, 76, 87, 88, 89), of which at least one participant is designed as a temporary participant (89), and which are connected to the control unit (2) via a bus node (41-49), wherein the safety system is designed to carry out the method according to any one of Claims 1 to 7.
9. An elevator system (1) having a safety system according to Claim 8.

Images