Control unit for elevator installations

Abstract

The present invention relates to a control unit for an elevator device, the elevator device having a movable car and a drive unit for making the car travel between floors, the control unit including at least one interface and forming an interaction with a safety circuit, the safety circuit being formed by a plurality of safety switches connected in series and being able to switch between an open state for interrupting a travel state and a closed state for allowing the travel state, the safety circuit including at least one safety switch, an intermediate tap arranged in the safety circuit for tapping an intermediate voltage, a functional unit having a fuse element, the fuse element being controllable by the safety circuit, the control unit having a monitoring device and an intervention device, the intervention device being connected to the safety circuit, the intervention device being designed and arranged so that a first separating element is connected in series with the safety switch, and the safety switch and the first separating element can be bridged by at least one further separating element.

Description

Technical Field

[0001] The invention relates to a control unit for an elevator installation according to the preamble of claim 1 .

[0002] Furthermore, the invention relates to an elevator installation having a control unit according to the invention. Background Art

[0003] It is generally known in the prior art to use a safety circuit for monitoring elevator systems. This circuit is laid out along the elevator shaft and consists of multiple safety switches connected in series. Each safety switch in the safety circuit switches between open and closed states and monitors safety-relevant operating variables of the elevator system. Therefore, for example, when safety personnel are performing maintenance work, a safety switch arranged in the safety circuit is opened, thereby interrupting the safety circuit. Because the safety circuit is operatively connected to a fuse element, which in turn affects the operating state of the elevator system drive unit, it is possible to ensure that the elevator car cannot travel (move) in the event of an interruption in the safety circuit. To this end, the safety circuit is typically connected to the control input of a power contactor (main contactor). This triggers the power contactor in the event of an interruption in the safety circuit, isolating the power supply voltage from the drive unit.

[0004] Furthermore, it is known in the prior art to monitor the closed state of the car doors and / or floor doors of an elevator system by means of safety switches, thereby always preventing the car from travelling with the car doors or floor doors open or not completely closed, as this presents a high potential risk of injury to passengers.

[0005] However, it is generally known that safety switches arranged in the safety circuit for monitoring the closed state of the car doors and / or floor doors can be bridged by means of a switch block. This allows the doors to be opened only when the car has reached a stop position (at a floor), without having to disable the drive unit for safety reasons due to an interruption in the safety circuit. This results in a shorter travel time for the passengers, at least subjectively. Furthermore, bridging the safety switches arranged for monitoring the closed state of the car doors and / or floor doors also allows the car to be brought to a stop position while passengers are getting on or off, as the load changes acting on the car in the stop position can create a step between the car floor and the floor floor. However, these additional switch blocks are very complex to implement and thus incur high costs. Furthermore, in the event of a switch block failure, the defective component could create a dangerous situation for the passengers because the safety circuit is at least partially bridged by the switch block. Summary of the Invention

[0006] For this reason, the object of the present invention is to provide a control unit that is operatively connected to the safety circuit, thereby providing the required functionality on the one hand and overcoming the disadvantages known from the prior art on the other. Therefore, the object of the present invention is in particular to provide a control unit that is designed not only to detect the open or closed state of the car door and / or floor door, but also to influence the safety circuit so that the car can also travel with the safety switch opened. In this case, however, it should be possible to interrupt the safety circuit even in the event of a fault.

[0007] Furthermore, the object of the present invention is to provide an elevator installation comprising such a control unit according to the invention.

[0008] The purpose with respect to the control unit for an elevator is achieved by the features described in claim 1, namely, the intervention device is designed and arranged so that the first separating element, in particular by means of the second interface, is arranged in series with the safety switch for monitoring the closed state of the car door and / or floor door, wherein the safety switch for monitoring the closed state of the car door and / or floor door and the first separating element can be bridged by at least one further separating element, preferably two serially interconnected or anti-serially interconnected separating elements (in particular a second separating element and a third separating element), more preferably four serially interconnected or anti-serially interconnected, in particular paired separating elements, which one or more separating elements are in particular connected to the first interface on the input side and to the fourth interface on the output side.

[0009] With regard to the elevator system, this object is achieved by the features of claim 13 .

[0010] Advantageous developments of the invention are specified in the dependent claims.

[0011] The combination of at least two of the features disclosed in the description, the claims and / or the drawings also falls within the scope of the invention.

[0012] The idea of ​​the present invention is that the intervention device is designed in such a way and is operatively connected to the safety circuit via at least one interface, that is, the separating element (in particular the first separating element) is arranged in particular on the output side via the interface (in particular via the first interface) and is arranged in series with a safety switch of the safety circuit, which is provided for monitoring the closed state of the car door and / or the floor door. In addition, the intervention device also includes at least one further separating element, which is operatively connected to the safety circuit via a further interface (in particular via the first interface and the fourth interface), wherein the safety switch provided for monitoring the closed state of the door and the first separating element are bridged by a connectable path including the further separating element.

[0013] In this connection, it is further provided that, for redundancy reasons ((n-1) safety), two or four separating elements arranged in series or anti-serial fashion are provided for the additional separating element or first separating element, thereby forming a separating element. Furthermore, in a particularly preferred embodiment, two separating elements are each directly connected in series with one another, wherein the two additional separating elements are also arranged anti-serially relative to the two first separating elements. This ensures the functionality of the separating elements in terms of their blocking capability in a safety circuit with an AC voltage as the supply voltage, wherein the AC component of the supply voltage has a positive half-wave and a negative half-wave. Alternatively, a switch pair can also be formed by two anti-serially connected separating elements, wherein the two switch pairs are preferably electrically connected in series to form (n-1) safety.

[0014] This design advantageously enables the safety switches provided in the safety circuit for monitoring the closed state of the car doors and / or floor doors to be temporarily bridged, thereby, for example, initiating the opening of the doors before the car reaches a stop position, without interrupting the safety circuit due to the corresponding safety switches switching from the closed state to the open state. This advantageously shortens the waiting time for passengers in the car.

[0015] Furthermore, the control unit according to the invention makes it possible to compensate for any step that may form between the floor and the car floor when the car is in a stopped position, this step being caused by changes in load due to passengers entering or exiting the car, by controlling the drive unit. Advantageously, this eliminates the need for additional regulating devices, which would otherwise require bridging the safety circuit and / or controlling the drive unit in order to compensate for the step by moving the car.

[0016] One development within the scope of the invention provides that, in the activated state of the safety element (in particular the main contactor), a correct operating state of the elevator installation, in particular a maintenance bridge of the electrical contacts in the safety circuit and / or a fault-related short circuit and / or a closed state of the car door and / or floor door, can be detected by at least one test action.

[0017] In other words, it is further provided that the control unit is able to perform a check action while the safety element is in the activated state (i.e., in particular while the car is traveling). The safety element must not be switched to a fault state, nor must the safety circuit be influenced and / or interrupted by the check action, so that this is recognized and / or detected by the safety element, and thus no fault state is activated. However, it is also possible to check and / or detect the proper operating state of the elevator system by at least one check action by evaluating the detected intermediate voltage as a function of the operating position of the separating element, thereby detecting a maintenance bridge that must not be left in the safety circuit and / or detecting a short circuit (in particular due to a defective component), or detecting the open state of the car door and / or floor door.

[0018] To this end, within the scope of the present development, it is provided that the separating element is designed and controllable in such a way that an interruption of the safety circuit is possible for less than 5 milliseconds, preferably less than 2.5 milliseconds, more preferably less than 1.3 milliseconds, wherein the fuse element is not designed and / or arranged to detect such a shorter interruption.

[0019] The preferred design of the safety element as a main contactor means that the supply voltage is connected to the drive unit via the switchable power contacts of the main contactor, wherein the control input of the main contactor is effectively connected to the safety circuit. This results in the main contactor remaining in the closed state during the test. The invention advantageously utilizes the relatively short control times of the contactor (low switching dynamics) and the existing line inductances and / or capacitances in the safety circuit, thereby preventing dynamic control of the contactor. Furthermore, a specially provided delay element, in particular a capacitor, can be arranged at the control input.

[0020] Furthermore, by checking and / or analyzing the safety circuit in the closed state of the main contactor, disadvantageous switching noises of the main contactor can be avoided, which can have a particularly advantageous control effect in elevator installations in offices and / or living areas.

[0021] Alternatively, in this case, the fuse element can also be designed as an integrated component and / or functional unit of the drive unit, wherein the drive unit includes a converter with a control and monitoring input for receiving and / or electrically contacting the safety circuit. The control input advantageously enables monitoring of the safety circuit, wherein an error state can be triggered if the supply voltage drops to 0 V due to an open safety circuit under definable voltage conditions. It can also be advantageous to additionally arrange a delay element, in particular a capacitor, at the control and monitoring input in order to adjust the detection speed of the functional unit directly in the hardware. In this case, aging processes in the capacitor advantageously lead to a shortened delay time, thereby postponing the protection schedule without causing safety-related problems.

[0022] Within the scope of the invention, a “checking action” is understood to mean the creation and / or generation of a specific operating position by means of an intervention device by means of at least one separating element and the detection of at least one intermediate voltage at at least one intermediate voltage tap in the safety circuit by means of a monitoring device.

[0023] The expression "in the activated state" of the safety element is to be understood as an operating state of the elevator system in which the elevator system is ready for travel at any time, ie the car can travel between two floors upon passenger command.

[0024] A maintenance bridge can be a permanently installed circuit that maintenance personnel can activate during maintenance work, thereby activating a bypass to bridge the safety switches (individual safety switches and / or groups of safety switches) of the safety circuit, wherein the separated part of the safety circuit is preferably separated from the safety circuit on the input side by opening a contact element. Alternatively, the maintenance bridge can also be formed by a conductor, in particular a wire, which is operatively connected to the safety circuit to bridge the safety switches.

[0025] Monitoring the safety circuit when the fuse element is activated allows improvements to the control unit, as the safety circuit can now be analyzed not only in a standstill and / or standstill phase of the elevator system, but also at any time (i.e., in particular during normal travel of the elevator system). This significantly increases the number of tests (consisting of at least one check action), allowing for earlier detection of impermissible situations and / or short circuits.

[0026] In a preferred embodiment, the separating element is designed and controllable via a corresponding driver circuit to operate at a switching frequency between 0.5 kHz and 30 kHz, preferably between 0.5 kHz and 16 kHz, more preferably between 0.5 kHz and 9 kHz, and most preferably between 0.5 kHz and 2 kHz. This preferably allows the use of standardized separating elements and corresponding driver circuits, which contributes to low costs. Furthermore, a correspondingly designed separating element allows the safety circuit to be interrupted and / or disconnected for a short period of time, so that this short period is not detected by the fuse element and at least one check action can still be performed.

[0027] In this context, it is further provided that the separating element provided and / or arranged in the tapping device is designed as a switchable semiconductor component. In this case, advantageous designs of the semiconductor components are particularly preferably MOSFETs, IGBTs, and / or thyristors, since these switching technologies can operate at high switching frequencies with low losses. This allows for a low-cost separating element, which is associated with a proven and / or already proven circuit design using standardized components.

[0028] In this context, it is particularly advantageous that modern semiconductor components can achieve high switching speeds, so that even if the safety circuit is (very briefly) interrupted during the execution of a test action, the fuse element (in particular the power contactor or the main contactor) does not switch to an incorrect state during the wiring and / or routing process due to component-related inertia and / or existing line inductances. This not only allows the execution of corresponding test actions in the activated state of the fuse element, but also allows an increase in the number of corresponding test and / or test measurements (a certain sequence of different test actions) during normal operation of the elevator installation, since the elevator no longer needs to be at a standstill (i.e., not transporting passengers) during the execution of the test and / or detection measurements.

[0029] Another embodiment provides that the intervention device for interrupting a safety circuit designed as a DC voltage circuit and bridging a safety switch or a safety switch group comprises at least two or preferably three switchable isolation elements or semiconductor components, which are preferably designed as bipolar transistors, MOSFETs, IGBTs and / or thyristors, wherein a quenching circuit known from the prior art is preferably used to switch off the thyristors.

[0030] Alternatively, a combination of the aforementioned semiconductor components is also conceivable. In this case, for reasons of redundancy, it can further be provided that, in order to ensure the functionality of the safety circuit (i.e., to guarantee interruption of the safety circuit), at least three or preferably five switchable semiconductor components, in particular MOSFETs, IGBTs and / or thyristors, are used, thereby doubling the safety switches permanently assigned to the safety circuit and designed for interrupting the safety circuit.

[0031] The monitoring and bridging of the safety switch for monitoring the closed state of the car door and / or floor door according to the invention requires at least two separating elements, so that the safety circuit is interrupted by opening the first separating element, wherein the safety switch for monitoring the closed state of the car door and / or floor door and the first separating element can be bridged by the second separating element. Furthermore, for reasons of redundancy, the second separating element can also be formed by two separating elements interconnected in series.

[0032] Advantageously, this enables (n-1) safety, so that, in particular, in the event of a fault in a separating element and even in the possibly permanently closed operating position of the corresponding separating element, the safety circuit can still be interrupted. However, it is also conceivable that the intervention device comprises a total of ten semiconductor components, so that the control unit according to the invention can be used for safety circuits based on DC voltage and AC voltage. The design of the intervention device according to the invention means that the first separating element is formed by two separating elements (in particular MOSFETs) interconnected in anti-serial fashion, and the second separating element is formed by a total of four separating elements, wherein two separating elements are interconnected in series and in anti-serial fashion.

[0033] Furthermore, preferred are embodiments of the present invention in which the control unit is designed to interact with a safety circuit having an AC power supply as the supply voltage. In this case, the intervention device advantageously comprises at least three, preferably five, switchable isolation elements or semiconductor components, wherein the isolation elements or semiconductor components designed to interrupt the safety circuit are doubled, in particular arranged in an anti-serial arrangement, thereby completely blocking both the positive and negative half-waves of the supply voltage or preventing the generation of undesirable current paths via the anti-parallel body diodes of the MOSFETs. In this context, it is advantageous to utilize the self-extinguishing properties of the thyristors in conjunction with a supply voltage designed as an AC voltage.

[0034] The design according to the invention of the intervention device for interruption and / or partial bridging of the safety circuit means that a total of three separating elements or semiconductor elements are required.

[0035] Furthermore, it is further provided that, for redundancy reasons, i.e., to increase safety or ensure (n-1) safety, additional separating elements or semiconductor components are provided, thereby, in particular, doubling the separating elements or semiconductor components designed to interrupt the safety circuit, i.e., arranging them in series with one another. In this case, corresponding to the implementation of the DC voltage circuit, if a semiconductor component fails and permanently shuts down, a safe interruption of the safety circuit can still be achieved. In other words, in this case, the control unit or intervention device includes a total of ten semiconductor components, wherein the control unit should include no more than a total of 20 separating elements or semiconductor components, preferably fewer than 16 separating elements or semiconductor components, and more preferably fewer than 11 separating elements or semiconductor components.

[0036] Furthermore, according to another preferred embodiment of the invention, five intermediate voltages are detected and evaluated by the monitoring device, wherein a total of four intermediate voltages, preferably three intermediate voltages, are evaluated for detecting the closed state of the car door and / or floor door.

[0037] For this purpose, the intermediate voltage is connected to the center tap of the safety circuit, so that a measured value of the supply voltage is detected depending on the position of the corresponding tap. The measured value can output a voltage or no voltage. Advantageously, this allows the position of an open safety switch in the safety circuit to be located and / or the operating state of the elevator system to be roughly checked or detected. This makes it possible to detect a maintenance bridge of an electrical contact in the safety circuit and / or to detect a fault-related short circuit in the safety circuit (particularly due to a faulty safety switch or a faulty isolating element) and / or to detect the open state of a car door and / or floor door.

[0038] Furthermore, by detecting the open state of the car door and / or floor door, the control unit can also detect a loss of the driving capacity of the elevator system, wherein an emergency system (e.g., a mechanical brake) can be activated to prevent further damage. Therefore, in a corresponding embodiment of the control unit according to the invention, a regulating device is also superfluous in this regard.

[0039] In addition, one embodiment of the present invention provides that the control unit is designed and configured to operatively connect the safety circuit to the monitoring device and / or intervention device via a total of six interfaces. In this case, the safety circuit is bypassed by the control unit or the intervention device via the interfaces, thereby bridging the safety circuit. Alternatively, the safety circuit can be designed in sections via the interface pairs, so that the safety circuit is completely interrupted by a separating element arranged in each section. Furthermore, it is conceivable that the interfaces are used solely to form taps for voltage measurement. The design of the intervention device according to the present invention means that a total of four interfaces are required to operatively connect the control unit to the safety circuit in order to implement the functionality according to the present invention.

[0040] Furthermore, within the scope of a further preferred embodiment of the unit, the control unit is designed and configured such that a first intermediate voltage SR1_out can be measured in order to detect the potential at a first intermediate tap, which is arranged in the safety circuit at a positive contact pin or a positive connection terminal of the safety circuit, in particular to detect the voltage at a control input of the main contactor.

[0041] Furthermore, it is provided, supplementally or alternatively, that a second intermediate voltage ACD1 can be detected in order to detect the voltage at a second intermediate tap, which second intermediate tap is arranged at a negative contact pin / connection terminal of at least one safety switch for monitoring the closed state of a car door, and / or that a third intermediate voltage SCD1 can be detected in order to detect the voltage at a third intermediate tap, wherein the third intermediate tap is arranged between at least one safety switch for monitoring the closed state of at least one floor door and at least one safety switch for monitoring the closed state of at least one car door.

[0042] Within the scope of the inventive design of the intervention device, the function of a separating element, which is provided in the safety circuit for bridging the safety switches for monitoring the closed state of the car doors and / or floor doors, can be checked by detecting and evaluating the intermediate voltage SR1_out. To this end, in an operating state in which the (safety circuit is partially) bridged (i.e., when the car is always traveling to a stopped position and the doors are already to be opened), the separating element is briefly opened and a check is performed to determine whether there is no output voltage at SR1_out. If this is not the case, a faulty separating element (causing a short circuit) can be detected, or it can be detected that the car doors and / or floor doors are not open, and therefore all the safety switches provided for monitoring the closed state of the car doors and / or floor doors are closed or faulty (short-circuited).

[0043] Therefore, if a voltage can be measured using SR1_out, the first separating element connected in series with the safety switch for monitoring the closed state of the car door and / or floor door is briefly opened to measure the intermediate voltage ACD1. If a voltage is detected here, the corresponding safety switch is closed or has failed. If no voltage is measured, a faulty separating element can be detected, which is arranged in the parallel (i.e., bridged) path.

[0044] In this context, it is also provided that a fourth intermediate voltage OC_out is detected at a fourth central tap, wherein the fourth central tap is arranged on the output side relative to the upper terminal pair in the safety circuit, in particular directly at the fifth terminal.

[0045] Finally, the monitoring device can be designed to detect a fifth intermediate voltage OC_in at a fifth intermediate tap of the safety circuit, wherein the fifth intermediate tap is arranged on the input side relative to the upper terminal pair, in particular at the sixth terminal.

[0046] Furthermore or additionally, a fourth central tap can also be arranged at the positive contact pin / positive connection terminal of the safety switch initially arranged in the safety circuit, wherein the fifth central tap together with a safety switch or safety switch group can be disconnected from the safety circuit via a coupled switch, in particular by contacting a preferably fixed maintenance bridge.

[0047] The term "positive contact pin / positive connecting terminal / positive contact pin" is understood to mean the connecting terminal of the safety switch or fuse element, which is arranged closer to the supply voltage. Thus, the negative contact pin / negative connecting terminal / negative contact pin of a safety switch is the connecting terminal of the fuse element, which is located away from the supply voltage in the safety circuit (i.e., at a negative potential) and is therefore arranged closer to the fuse element or main contactor.

[0048] Advantageously, the detection and evaluation of the intermediate voltage defined above enables detection of the state of the intermediate circuit and of the operating state of the elevator system with respect to the safety circuit, wherein, during the activated state of the fuse element, a maintenance bridge of the contacts in the safety circuit and / or a fault-related short circuit can advantageously be detected.

[0049] Furthermore, it is further provided that the intervention device is designed and configured such that the first center tap can be connected to the second center tap via a first separating element. Furthermore, it is further provided that the first center tap is connected to the fourth center tap via a second separating element (preferably via two separating elements interconnected in series or anti-serially, more preferably via four separating elements interconnected in series or anti-serially, in particular in pairs). Furthermore, it is also preferably provided that the fourth center tap and the fifth center tap are connected to each other via three separating elements (preferably via two separating elements interconnected in series or anti-serially, more preferably via four separating elements interconnected in series or anti-serially, in particular in pairs). By switching the separating elements on and off, and thus connecting parallel paths and / or interrupting the safety circuit at different locations, the safety circuit can be advantageously influenced, namely, by detecting and analyzing the state of the safety circuit. This allows the intermediate voltage to be used to enable the analysis of the state of the safety circuit, advantageously enabling the detection of safety switches bridged by a maintenance bridge and / or fault-related short circuits.

[0050] Furthermore, a preferred embodiment of the control unit according to the invention includes a monitoring device and an intervention device, which are designed and arranged to perform a test of a plurality of check actions or a fixed sequence of check actions every 60 seconds, preferably every 30 seconds, and more preferably every 10 seconds, in order to monitor the operating state of the elevator installation, in particular to detect a maintenance bridge of the electrical contacts and / or a fault-related short circuit in the safety circuit. Within the scope of the invention, the number of measurements required to check the functionality of the partition element is advantageously reduced, since, for example, due to aging and / or wear effects during use of the mechanical switch, the relay function can only be checked once every 24 hours. This has the beneficial effect of enabling earlier detection of faults.

[0051] Furthermore, the monitoring device and the intervention device are designed such that, for monitoring the operating state of the elevator installation, in particular for detecting a maintenance bridge of an electrical contact and / or a fault-related short circuit in the safety circuit, a corresponding sequence of predefined check actions lasts for a maximum of 1 second, preferably 500 milliseconds, more preferably 250 milliseconds, and most preferably 100 milliseconds. In this context, it is provided within the scope of the present invention that the corresponding sequence of predefined check actions is combined in such a way that the safety circuit is interrupted for no longer than the above-defined value. Advantageously, in connection with a safety circuit having an AC voltage, a zero quadrature and / or zero crossing of the supply voltage is used to generate a pause, wherein the first check action is initiated in particular in response to the detection of a zero quadrature and / or zero crossing.

[0052] In one embodiment of the control unit according to the invention, the control unit further comprises a counter unit, the output value of which, the counter value and / or the sensor output signal can be activated in response to the result of a checking action (e.g., a fault voltage at an intermediate tap). In another embodiment, the control unit further comprises a communication device designed and / or arranged to transmit the sensor output signal, wherein the sensor output signal can be directly or indirectly influenced by the counter unit or can be derived from the counter unit. The effect achieved by this embodiment is based on the implementation of a temporary travel operation (i.e., permitted only for a specific time period), in particular at a limited travel speed of the car, in order to travel to a specific intermediate position.

[0053] The scope of the present invention also claims protection for the use of the control unit according to the invention for operating an elevator system and for monitoring the operating state of the elevator system, in particular for detecting impermissible contact of a maintenance bridge in the safety circuit of the elevator system and / or fault-related short circuits and / or the closed state of car doors and / or floor doors.

[0054] Furthermore, the invention also protects a system comprising an elevator installation and a control unit according to the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Further advantages, features and details of the invention can be derived from the description of preferred exemplary embodiments and with the aid of the accompanying drawings.

[0056] Figure 1 is a schematic diagram of a preferred embodiment of a control unit according to the present invention for an elevator system,

[0057] Figure 2 is a schematic diagram of an operating state which is carried out by the control unit 1 according to the invention during a test process comprising several checking actions,

[0058] Figure 3 is a schematic diagram of a working state which is carried out during another test including several checking actions, and

[0059] Figure 4 FIG1 is another schematic diagram of another test which is carried out during operation of the elevator installation with the car door and the floor doors closed. DETAILED DESCRIPTION

[0060] Figure 1 The schematic structure of a preferred embodiment of a control unit 1 according to the present invention is shown. The control unit 1 shown is designed to interact with a safety circuit 3 formed by a plurality of safety switches 4 connected in series. The safety switches 4 switch between an open state, which inhibits travel, and a closed state, which allows travel, depending on safety-related operating conditions of the elevator system.

[0061] The safety circuit 3 is supplied on the input side with a supply voltage 10 which can be designed as an AC voltage or a DC voltage, wherein Figure 1 In the embodiment shown in FIG, the supply voltage is a DC voltage.

[0062] On the output side, the safety circuit 3 is operatively connected to a fuse element 7, which in the present embodiment is designed as a main contactor 8, whose control input is connected to the safety circuit 3. As soon as the safety circuit 3 is interrupted and there is no voltage at the control input of the main contactor 8, the main contactor 8 opens and disconnects the drive unit 2, which is connected via the power contacts of the main contactor 8, from its power supply. This ensures that the car cannot move when the safety circuit 3 is open, because the drive unit 2 cannot be driven without energy or supply voltage.

[0063] Furthermore, a maintenance bridge 5 can be integrated into the safety circuit 3 , in particular for carrying out maintenance and / or repair work, in order to bridge individual safety switches 4 or groups of safety switches 4 by switching parallel paths.

[0064] exist Figure 1In the embodiment, the corresponding maintenance bridge 5 is realized by a fixedly installed circuit, which is connected to a bypass to the safety circuit 3 by operating the switch 17, and the bypass bridges all safety switches of the first group of safety switches 18 (not shown).

[0065] The safety switches (not shown) of the first group of safety switches 18 monitor the safety arrester (not shown) to mechanically secure the car in the elevator shaft in the event of a malfunction. The interruption of the safety circuit 3 ensures that the drive unit 2 is disconnected from the power supply. To reset the safety arrester, the open safety switches must first be bridged by switching on the maintenance bridge 5, which is implemented by a permanently installed circuit. Because all safety switches of the first group of safety switches 18 are bridged in this operating state, a critical operating state relevant to safety results in the elevator system. To prevent travel from being interrupted, all separating elements in the safety circuit 3 are open, which advantageously allows the fuse element 7 to remain in the fault state in order to shut down the drive unit 2.

[0066] In addition to the first group of safety switches 18, the safety circuit 3 also includes further safety switches 41, 42, which monitor the closed state of at least one car door and the closed state of at least one floor door. Figure 1 Only one safety switch for all floor doors and all car doors of the elevator system is shown. However, as can be seen from the figure, the safety circuit 3 is interrupted by the opening of the door (car door or floor door) to prevent the car from traveling when the door is open.

[0067] The control unit 1 shown further comprises a monitoring device 9 for measuring and evaluating the intermediate voltage tapped at the various intermediate taps 6 of the safety circuit 3 and an intervention device 11, wherein the monitoring device 9 is operatively connected to the safety circuit 3 so that the safety circuit 3 can be interrupted by means of at least one separating element 12 and / or individual safety switches 4 or groups of safety switches 4 can be bridged by closing the separating element 12. For this purpose, the separating element 12 is designed to be switchable between a closed switching position and an open switching position.

[0068] The control of the separation element 12 and the evaluation of the intermediate voltage are determined by Figure 1 This is accomplished by two microcontrollers not shown. Figure 1 The corresponding flow of measurement and control signals is schematically illustrated in FIG by means of the small arrows on the separating element 12 and the center tap 6 .

[0069] Advantageously, the monitoring device 9 and the intervention device 11 are arranged and designed to perform a check operation. Within the scope of the present invention, a check operation is understood to mean detecting at least one intermediate voltage as a function of the operating position of at least one separating element 12, wherein a series of multiple check operations can also be performed to determine the operating state of the elevator installation.

[0070] The detection and evaluation of the intermediate voltage (test operation) according to the different operating positions of the separating element 12 advantageously enables the detection of an electrical contact bridge 5 and / or a fault-related short circuit in the safety circuit 3. This allows the proper operating condition of the elevator system to be checked.

[0071] According to the invention, the monitoring device 9 and the intervention device 11 are designed such that, in the activated state of the safety element 7 (i.e., when the main contactor 8 is in the closed operating position), at least one checking action can be performed in order to monitor the proper operating state of the elevator installation and, in particular, to detect a short circuit in the electrical contacts 5 and / or a fault-related short circuit in the safety circuit 3.

[0072] Furthermore, the control unit 1 shown is operatively connected to the safety circuit 3 of the elevator system via six interfaces 51, 52, 53, 54, 55, 56. The upper interface pair 19 formed by the fifth interface 55 and the sixth interface 56 partially forms the safety circuit 3, wherein a separating element 12 designed to interrupt the safety circuit 3 is arranged in the part of the safety circuit 3 formed by the control unit 1.

[0073] Figure 1 The control unit 1 shown includes a total of five isolation elements 12, which are designed as switchable semiconductor components 13 in the preferred embodiment of field-effect transistors (MOSFETs) 14. Since the control unit 1 shown is designed to interact with a safety circuit 3 supplied with a DC voltage, it does not include any MOSFETs 14 interconnected in series. However, for redundancy reasons, two MOSFETs 14 are arranged in series so that the safety circuit 3 can still be interrupted in the event of a reverse failure of one MOSFET 14.

[0074] In addition, the control unit also includes a lower interface pair 20, which is formed by a first interface 51 and a fourth interface 54 and is effectively connected to the safety circuit 3 so that the safety switches 41 and 42 can be bridged via a separating element in the closed working position, wherein the safety switches 41 and 42 are configured to monitor the closed state of the car door and the floor door.

[0075] Furthermore, in order to carry out at least one checking action, the monitoring device 9 is designed to enable detection of a total of five intermediate voltages.

[0076] This first enables detection of a first intermediate voltage SR1_out at the first intermediate tap 21, which is the voltage at the positive contact pin of the fuse element 7. In the present case, the control voltage of the main contactor 8 is detected on the input side, thereby always being able to determine the operating state of the elevator system.

[0077] Furthermore, a second intermediate voltage ACD1 is detected at a second center tap 22 , wherein the second center tap 22 is arranged on the negative contact pin of at least one safety switch 42 which monitors the closed state of the car door.

[0078] The third intermediate voltage SCD1 is detected at a third intermediate tap 23 , which is arranged between at least one safety switch 41 for monitoring the closed state of a floor door and at least one safety switch 42 for monitoring the closed state of a car door.

[0079] Furthermore, a fourth central tap 24 for contacting a fourth intermediate voltage OC_out is provided, wherein the fourth central tap 24 is arranged on the output side relative to the upper terminal pair 19 , ie directly at the fifth terminal 55 .

[0080] A fifth intermediate voltage OC_in is measured at a fifth central tap 25 of the safety circuit 3 , wherein the fifth central tap 25 is arranged on the input side relative to the upper pair of terminals 19 , ie, at the sixth terminal 56 .

[0081] Furthermore, it can be seen from the illustrated circuit of the control unit 1 that the first central tap 21 can be connected to the second central tap 22 via a first separating element 31 , wherein the separating element is designed as a MOSFET 14 .

[0082] Furthermore, it can be seen that the first interface 51 is connected to the fourth interface 54 via the second separating element 32 and the third separating element 33 , wherein the second separating element 32 and the third separating element 33 are connected in series with each other.

[0083] Furthermore, the fourth central tap 24 at the potential of the fifth connection 55 can be connected to the fifth central tap 25 (sixth connection 56 ) via the fourth and fifth separating elements 34 and 35 , wherein the fourth and fifth separating elements 34 and 35 are connected in series with each other.

[0084] The control unit 1 shown further comprises a purely schematically shown counter unit 15 which can be controlled in response to the result of the checking action. Furthermore, the control unit 1 has a communication device 16 for transmitting control variables to a communication partner (not shown) as a function of the sensor output signal of the counter unit 15 and / or the detected intermediate voltage, thereby enabling, for example, a limited time travel of the elevator system at a reduced travel speed and / or a changed stop position (end position) of the car in the elevator system.

[0085] During operation of the elevator system, the control unit 1 according to the present invention performs a series of checking actions every 10 seconds to monitor the operating state of the elevator system. Advantageously, for the timing of the checking actions, quadrature zero is detected and used to start the checking actions.

[0086] The isolation element 12 , which is realized as a MOSFET 14 , advantageously enables the safety circuit 3 to be interrupted for a shorter period of time due to the higher switching speed, without causing the main contactor 8 to be triggered.

[0087] To illustrate the checking action performed by the control unit 1 according to the invention, Figure 2 A diagram of the monitoring device 9 and the intervention device 11 is shown, wherein four checking actions are represented by the operating positions of the fourth separating element 34 and the fifth separating element 35 .

[0088] In a first check operation shown in area A, the fourth separating element 34 and the fifth separating element 35 are initially closed by the intervention device 9 and then the intermediate voltage OC_in at the fourth center tap 24 and the intermediate voltage OC_out at the fifth center tap 25 are detected. The measurement results are then compared with empirical values, wherein for a proper operating state of the safety circuit 3 and / or a proper operating state of the elevator system, the intermediate voltage OC_in and the intermediate voltage OC_out must have positive measured values ​​in relation to the supply voltage 10.

[0089] In the second check step, shown in region B, the fifth separating element 35 is opened and the two intermediate voltages are detected and evaluated again. The measurement result is now checked to determine whether no voltage is measured at the intermediate voltage OC_out, while OC_in must still have a voltage value. If this is not the case, an error is generated.

[0090] In the third checking action shown in the region C, the fourth separation element 34 and the fifth separation element 35 are opened, wherein only the intermediate voltage OC_in has a voltage value during the subsequent voltage measurement.

[0091] Finally, in a fourth checking action shown in region D, only the fourth separation element 34 is opened and the two intermediate voltages OC_in and OC_out are detected again and it is evaluated whether a voltage value is detected only at the aforementioned intermediate voltage OC_in.

[0092] If the detected intermediate voltage does not correspond to the empirical value, a short circuit of the fourth separation element 34 or the fifth separation element 35 can be detected. Alternatively, it is also possible to identify Figure 2 If the maintenance bridge 5 shown in FIG is connected, or if no voltage value is measured at all, a missing supply voltage or a defect in the measuring device can be detected. Figure 1Other maintenance devices ("check control") not shown in detail may also be the reason why the voltage cannot be measured.

[0093] The exemplary sequence of the four check actions above illustrates the design of the control unit 1 according to the invention. Since the safety circuit 3 is interrupted by the opening of the fourth separating element 34 or the fifth separating element 35, it is important to achieve the corresponding operating position in a very short time. This ensures that, despite the interruption of the safety circuit 3, the fuse element 7 (in Figure 2 (not shown) is still active. For this purpose, it is useful to insert artificial pauses between the individual checking actions, in particular to prevent dynamic influences and / or the formation of fluctuations in the safety circuit. It is crucial that during the pauses, an operating position of the separating element 12 is achieved in which the safety circuit 3 is not interrupted.

[0094] Figure 3 Another test comprising several checking actions is shown, which is carried out within the scope of the control unit 1 according to the invention. Figure 2 As already shown in the illustrations, in areas A to D of each test action a corresponding circuit diagram is shown, which displays the open or closed state of the safety switches 41, 42 in the safety circuit 3 and the achieved working positions of the corresponding embedded separation elements 31, 32, 33 during the test.

[0095] The illustrated check operation is always performed when the safety switches 41 and 42 are bridged, wherein the safety switches 41 and 42 monitor the closed state of at least one car door and at least one floor door. Consequently, the corresponding operating position is always present when the car approaches a floor and before it reaches the stop position, thereby preventing the car door and / or floor door from opening before reaching the stop position. Furthermore, pauses are inserted between the individual check operations to prevent an interruption in the safety circuit 3 from triggering a fault state of the fuse element 7 or the main contactor 8. During these pauses, the current check operation is understood to be the operating position of the separating elements 32 and 33 shown in area A, as this does not result in an interruption in the safety circuit 3.

[0096] In the operating state shown in region A (which corresponds to the operating position in which the safety switches 41, 42 are bridged), the safety switches 41, 42 of the safety circuit 3 are bridged by the second and third separating elements 32, 33. The intermediate voltage SR1_out is then detected and the presence of a voltage is evaluated.

[0097] During the second checking action shown in region B, the third separating element 33 and the first separating element 31 are opened for a very short time in order then to evaluate the intermediate voltage SR1_out again to determine whether there is currently no voltage at the corresponding first intermediate tap 21 .

[0098] In a third check action shown in region C, all separating elements 31 , 32 , 33 are now switched to the open operating state in order to check again whether no voltage is actually detected at the first center tap 21 (intermediate voltage SR1_out).

[0099] Finally, a final check action is performed, in which the third separation element 33 is closed again and the intermediate voltage SR1_out is checked again for the presence of a voltage.

[0100] Furthermore, within the scope of this or another checking action, the second intermediate voltage ACD1 at the second center tap 22 and / or the third intermediate voltage SCD1 at the third center tap 23 are additionally or alternatively detected and evaluated. This advantageously allows the detection of an open or closed state of a floor door and / or car door depending on the operating position of the first separating element 31.

[0101] Figure 4 A further test, which is characterized by two checking actions, is shown in . A corresponding checking action is always performed when the two safety switches 41 , 42 are not bridged by the separating elements 32 , 33 arranged in parallel.

[0102] During this test, the first separating element 31 is initially closed and the presence of a voltage (intermediate voltage SR1_out) at the first center tap connection 21 in the safety circuit 3 is checked (comparison region A).

[0103] Then, the first isolating element 31 opens briefly and the intermediate circuit voltage SR1_out is detected and further evaluated again to determine whether there is now no voltage. If this is not the case, a fault in the circuit can be detected and the safety circuit 3 can be interrupted by opening all isolating elements 12.

[0104] The invention thus makes it possible in a surprisingly simple manner to optimize and expand the control units known from the prior art so that the closed state of the car doors and / or floor doors can be monitored in a particularly cost-effective manner and the safety circuit can thus be influenced, so that the elevator system can be operated even when the car doors and / or floor doors are open.

[0105] Reference Signs List

[0106] 1 Control unit

[0107] 2 drive units

[0108] 3 Safety circuit

[0109] 4 Safety switches

[0110] 5 Maintenance Bridge

[0111] 6 Middle tap

[0112] 7. Fuse element

[0113] 8 Main contactor

[0114] 9 Monitoring device

[0115] 10 Power supply voltage

[0116] 11 Intervention Device

[0117] 12 Separator elements

[0118] 13 Switchable semiconductor components

[0119] 14 MOSFET

[0120] 15 counter units

[0121] 16 communication devices

[0122] 17 switches / buttons

[0123] 18 First safety switch

[0124] 19 upper interface pair

[0125] 20 Lower interface pair

[0126] 21 First intermediate tap

[0127] 22 Second intermediate tap

[0128] 23 Third intermediate tap

[0129] 24 Fourth intermediate tap

[0130] 25 Fifth intermediate tap

[0131] 31 First separation element

[0132] 32 Second separation element

[0133] 33 Third separation element

[0134] 34 Fourth separation element

[0135] 35 Fifth separation element

[0136] 41 Safety switch for floor doors

[0137] 42 Safety switch for car door

[0138] 51 First Interface

[0139] 52 Second interface

[0140] 53 Third interface

[0141] 54 Fourth interface

[0142] 55 Fifth interface

[0143] 56 Sixth Interface

Claims

1. A control unit for an elevator system having a car movable between floors along an elevator shaft and a drive unit for causing the car to travel between the floors, in, The control unit includes at least one interface, and the control unit interacts with a safety circuit via the at least one interface. The safety circuit is laid through the elevator shaft, and the safety circuit is formed by a plurality of safety switches connected in series. Depending on safety-related operating conditions of the elevator system, the safety switches can be switched between an open state for interrupting a travel state and a closed state for allowing the travel state. The safety circuit includes at least one safety switch for monitoring the closed state of a car door and / or a floor door, and an intermediate tap arranged in the safety circuit is used to tap an intermediate voltage. The safety circuit has a fuse element that can be controlled by the safety circuit such that the fault state of the fuse element is activated by the interrupted safety circuit, thereby shutting down the drive unit, and the activation state of the fuse element is activated by the closed safety circuit, so that the drive unit is driven to achieve the driving operation. The control unit comprises a monitoring device and an intervention device for measuring and evaluating the intermediate voltage, wherein the intervention device is operatively connected to the safety circuit such that the safety circuit can be interrupted and / or at least one safety switch can be bridged by means of at least one separating element that can be switched between a closed operating position and an open operating position, wherein the monitoring device and the intervention device are arranged and designed to perform a check action in order to detect at least one intermediate voltage as a function of the operating position of the at least one separating element, characterized in that The intervention device is designed and arranged so that a first partition element is arranged in series with the safety switch for monitoring the closed state of the car door and / or floor door, wherein the safety switch for monitoring the closed state of the car door and / or floor door and the first partition element can be bridged by at least one further partition element, and the at least one further partition element is connected to the first interface on the input side and to the fourth interface on the output side.

2. The control unit according to claim 1, characterized in that The fuse element is configured as a functional unit of a main contactor or a drive unit.

3. The control unit according to claim 1, characterized in that The fuse element can be controlled by the safety circuit such that the fault state of the fuse element is activated by the interruption of the safety circuit, so that the supply voltage is disconnected from the drive unit.

4. The control unit according to claim 3, characterized in that The closed safety circuit activates the activated state of the fuse element, so that the drive unit is connected to the supply voltage.

5. The control unit according to claim 1, characterized in that The first separating element is arranged in series with the safety switch for monitoring the closed state of the car door and / or the floor door by means of a second interface.

6. The control unit according to claim 1, characterized in that The at least one separating element is designed to interrupt the safety circuit for less than 5 milliseconds, so that in the activated state of the safety element or the activated state of the functional unit of the drive unit, the correct operating state of the elevator system is detected by at least one checking action.

7. The control unit according to claim 1, characterized in that The separation element is designed to be operable at a switching frequency between 0.5 kHz and 30 kHz.

8. The control unit according to claim 1, characterized in that The separation element is designed as a switchable semiconductor component.

9. The control unit according to claim 1, characterized in that In order to interrupt the safety circuit designed as a DC circuit and to bridge the safety switch, the intervention device comprises at least two separating elements.

10. The control unit according to claim 1, characterized in that In order to interrupt the safety circuit designed as an AC circuit and to bridge the safety switch, the intervention device comprises at least three separating elements.

11. The control unit according to claim 1, characterized in that The monitoring device is designed to detect and / or evaluate at least five intermediate voltages.

12. The control unit according to claim 1, wherein For interaction with the safety circuit, the control unit has at least six interfaces, wherein at least one separating element can be connected and / or integrated into the safety circuit via the upper interface pair of the fifth and sixth interfaces so that the safety circuit is interrupted in the open operating position.

13. The control unit according to claim 12, wherein: The monitoring device is designed and arranged to measure a first intermediate voltage SR1_out for contacting a first intermediate tap, which is arranged at a positive contact pin of the fuse element; and / or A second intermediate voltage ACD1 for contacting a second intermediate tap arranged at a negative contact pin of at least one safety switch for monitoring a car door can be measured; and / or capable of measuring a third intermediate voltage SCD1 for contacting a third intermediate tap, said third intermediate tap being arranged between at least one safety switch for monitoring at least one floor door and at least one safety switch for monitoring at least one car door; and / or A fourth intermediate voltage OC_out for contacting a fourth intermediate tap can be measured, the fourth intermediate tap being arranged on the output side relative to the upper terminal pair; and / or A fifth intermediate voltage OC_in can be measured for contacting a fifth intermediate tap, which is arranged on the input side relative to the upper terminal pair.

14. The control unit according to claim 13, wherein: The intervention device is designed and configured to: The first intermediate tap is connectable to the second intermediate tap via a first partition element; and / or The first intermediate tap is connectable to the fourth intermediate tap via a second partition element; and / or The fourth intermediate tap can be connected to the fifth intermediate tap via a fourth partition element.

15. The control unit according to claim 1, characterized in that The monitoring device and the intervention device are designed to perform a test including a fixed sequence of checking actions every 60 seconds for monitoring the operating state of the elevator installation; and / or The monitoring device and the intervention device are designed so that a test comprising a fixed sequence of checking actions lasts a maximum of 1 second for monitoring the operating state of the elevator installation.

16. The control unit according to claim 1, characterized in that A counter unit, which can be controlled in response to the result of a checking action, and a communication device designed to transmit a sensor output signal are designed to enable a travel operation of the elevator installation at a reduced travel speed of the car for a limited period of time, wherein the sensor output signal can be influenced by the counter unit.

17. An elevator installation comprising a control unit according to any one of claims 1 to 16.

Images