Method for operating a personnel transport system by reliably configuring an electronic safety device by means of visual data transmission

Abstract

A method for operating a passenger transport system (1) and a passenger transport system suitable for carrying out the method are described. The passenger transport system comprises a control unit (11) for controlling functions of the passenger transport system (1) and at least one safety device (17) for monitoring safety-critical functions of the passenger transport system. The safety device can be switched into a configured state by storing configured parameters (43) in order to control safety-critical functions according to specific specifications. The method comprises: receiving configuration parameters (41) by a controller; transmitting the configuration parameters to a safety device (17); storing configured parameters (43) in the safety device based on the received configuration parameters; transmitting configured data (47) from the safety device to the controller, the configured data (47) encoding graphic information (49), the graphic information being displayed on a display (51) connected to the controller, and the graphic information reflecting the configured parameters one-to-one in a visual, machine-readable manner; reading the graphic information by means of an optical reading sensor (53) of a mobile, processor-controlled data processing device (21); and comparing the configured parameters reflected by the read graphic information with the nominal configuration parameters (59). The controller (11) controls the function of the personnel transport device depending on whether a sufficient degree of agreement between the configured parameters and the nominal configuration parameters has been determined during the comparison.

Description

Technical Field

[0001] The invention relates to a method for operating a passenger transport system. Background Art

[0002] People moving equipment such as elevators, escalators or moving walkways are used as equipment that is fixedly installed in buildings to move people and / or objects.

[0003] In the following, embodiments of the invention are described primarily with reference to a people moving device designed as an elevator device. However, the described embodiments can also be implemented for other types of people moving devices.

[0004] Passenger transport systems generally have to meet very high safety requirements. For this purpose, a plurality of safety devices are generally provided in passenger transport systems, by means of which safety-critical functions of the passenger transport system can be monitored, i.e. actively controlled or at least passively monitored. Such safety-critical functions can, for example, include measurement processes that can be used to determine current states or current conditions in the passenger transport system, so that information obtained in this process can be taken into account when operating the passenger transport system.

[0005] For example, a safety device in the form of a door sensor or door switch in an elevator installation can be used to determine whether the elevator door is properly closed so that the elevator controller can make a determination based on information transmitted by multiple such safety devices on different elevator doors of the elevator installation: whether the elevator car can move or whether travel is temporarily not allowed because at least one elevator door is not properly closed.

[0006] Other safety devices may be configured to provide information about where the elevator car is currently located in the elevator shaft and / or how fast the elevator car is currently moving through the elevator shaft. For this purpose, for example, a sensor may move through the elevator shaft together with the elevator car and read local information stored in the elevator shaft, from which the current position of the elevator car and the current speed of the elevator car may then be inferred. Based on this information, the elevator controller may move the elevator car precisely to the desired position.

[0007] Another type of safety device can be used to detect whether the elevator car is located within a tolerance range above and below the parking position on the floor. Based on this information, the elevator controller can determine, for example, that the elevator door has been allowed to open (so-called pre-opening) before the elevator car actually reaches the predetermined parking position, i.e., when the elevator car is still moving within the tolerance range. Furthermore, contrary to the rule that otherwise applies that the elevator car cannot be moved as long as the elevator door is not completely closed, in exceptional cases the elevator controller allows the elevator car to move slowly as long as the elevator car is located within the tolerance range near the parking position, so that a horizontal adjustment (so-called re-leveling) can be carried out, for example, when passengers enter or leave the elevator car, thereby changing the load and ultimately also the position of the elevator car.

[0008] In modern personnel transport equipment, safety devices can be adapted to specific situation-specific and / or device-specific operating conditions and / or characteristics of the personnel transport equipment. Therefore, such safety devices can be referred to as configurable safety devices. To this end, the safety device can be configured into a state in which the safety device controls the functions to be controlled by it according to specific specifications by inputting configuration parameters. Here, such a state is referred to as a configured state, and the parameters to be stored to achieve this configured state are referred to as configured parameters in this article. The safety device must not be operated in the personnel transport equipment before the safety device is placed in the configured state by inputting the situation-specific or device-specific configured parameters required by the safety device, so that the entire personnel transport equipment is usually not ready for operation.

[0009] In modern personnel transport systems, safety devices are increasingly being implemented using electronic and / or programmable circuits. On the one hand, this makes it possible for the safety device to be individually adapted to different operating conditions and / or environmental conditions, for example by storing system-specific and / or situation-specific configured parameters, in order to monitor the functions to be monitored by the safety device in a predetermined manner. The safety device can operate particularly reliably, be cost-effective and / or be easy to maintain. On the other hand, it can be a challenge to ensure that the configured parameters for programming the safety device are correct.

[0010] WO 2019 / 011828 A1 describes a method for configuring safety-critical configuration parameters in a personnel transportation device.

[0011] WO 2017 / 220678 A1 describes a method for configuring a passenger transport device having a processor-controlled mobile data processing device in the form of a mobile terminal. Summary of the invention

[0012] Essentially, an alternative solution is needed in order to be able to configure safety devices in personnel transport equipment in the simplest but most reliable way.

[0013] This need is met by the technical solution of the independent claim. Advantageous embodiments are defined in the dependent claims and in the following description.

[0014] According to the invention, a method for operating a passenger transport device is proposed. The passenger transport device has a controller for controlling functions of the passenger transport device and at least one safety device for monitoring safety-critical functions of the passenger transport device. By storing at least one configured parameter, the safety device can be switched to a configured state or configured to control safety-critical functions according to specific specifications. The method preferably has at least the following steps in the order given:

[0015] Receiving configuration parameters by the controller;

[0016] transmitting configuration parameters to the safety device;

[0017] storing configured parameters in the safety device based on the received configuration parameters to transition or configure the safety device to a configured state;

[0018] The configured data is transmitted from the safety device to the controller, wherein:

[0019] The configured data encodes graphic information,

[0020] Graphical information is displayed on a monitor connected to the controller, and

[0021] The graphical information reflects the configured parameters one-to-one in a visual, machine-readable manner;

[0022] Reading the graphic information by an optical reading sensor of a mobile, processor-controlled data processing device; and

[0023] By means of a data processing device, the configured parameters reflected by the read graphical information are compared with the nominal configuration parameters;

[0024] The result of the comparison is transmitted from the data processing device to the controller.

[0025] The controller controls the function of the personnel transport device based on whether a sufficient degree of consistency has been established between the configured parameters and the nominal configuration parameters during the comparison.

[0026] The feasible features and advantages of the embodiments of the present invention may be considered to be based on the concepts and cognitions introduced below, including but not limited to the present invention.

[0027] As already briefly explained at the outset, modern passenger transport devices are generally provided with a plurality of safety devices in order to be able to control safety-critical functions and thus to ensure safe operation of the passenger transport device. In this case, the safety devices can be individually configured in order to be able to take into account the properties of the respective passenger transport device and / or the operating conditions prevailing therein. At least one of the individual configurations of the safety devices is achieved when the safety device to be configured is already installed in its final position in the passenger transport device.

[0028] Before a personnel transport system is put into operation, its safety devices must be correctly configured. For this purpose, suitable configuration parameters are usually established individually for each safety device and transmitted to the corresponding safety device. The corresponding configuration parameters can be entered, for example, by a technician on a human-machine interface. The human-machine interface can, for example, correspond to an elevator controller or be integrated into the elevator controller. Alternatively, the configuration parameters can be called up, for example, from the elevator controller or a device connected thereto, for example from an electronic data source. The configuration parameters are then sent from the elevator controller to the corresponding safety device. The safety device saves the received configuration parameters and can then be operated with the corresponding configuration. In order to be able to monitor whether the safety device has received and stored the correct configuration parameters, it can be provided that the configuration parameters are transmitted back from the safety device to the elevator controller or the human-machine interface connected thereto. There, the returned configuration parameters can be monitored by a technician or compared with the rated values.

[0029] However, it is recognized that errors may occur during the above configuration process. For example, during the data transmission process from the human-machine interface to the elevator controller and / or from the elevator controller to the safety device, the data to be transmitted may be modified accidentally or due to a system error, so that the data to be transmitted is modified, so that the data actually reaching the safety device is erroneous.

[0030] In the worst case, system errors can occur during the data transmission to the safety device and the subsequent return of the data to the lift controller or HMI, so that modifications made to the data during the data transmission process can subsequently be compensated when the data are transmitted back to the lift controller or HMI and are therefore not recognizable, for example, by a monitoring technician.

[0031] In order to be able to eliminate the above-mentioned disadvantages of conventional configuration processes, a solution is briefly described for the method proposed here, in which a first data transmission, by means of which the configuration parameters received by the controller of the personnel transport device are transmitted to the safety device, and a second data transmission, by means of which the configured parameters subsequently stored in the safety device are transmitted back to the controller, differ from each other. During the first data transmission, for example, an electrical signal reflecting the value of the configuration parameter to be transmitted can be transmitted from the controller to the safety device, while during the second data transmission, at least as an intermediate step, graphic information is generated as a visual reflection of the configured parameters to be transmitted. This graphic information is displayed on a display and can then be read from the display by means of a reading sensor of a mobile data processing device. Ultimately, the configured parameters visually transmitted in this way by means of the graphic information can be compared with the nominal configuration parameters, and the function of the personnel transport device can only be allowed by the controller if the two parameters are consistent to a sufficient extent. The comparison can be performed by a technician, who is displayed the transmitted configured parameters and the nominal configuration parameters by the data processing device and who enters the comparison result on the data processing device. As an alternative to this, the comparison mentioned can be performed by the data processing device itself, which is programmed accordingly. In both examples, the comparison is performed by means of the data processing device. After the comparison is completed, the data processing device transmits the result of the comparison, i.e. whether the parameters mentioned are consistent to a sufficient degree within an acceptable tolerance, to the controller.

[0032] By transmitting the data on the way to the safety device in a different manner than the way back from the safety device, it is achieved in particular that the data are not subjected to the same or opposite data processing on the way and on the way back. Ultimately, it should be avoided that the data are modified or incorrectly transmitted by the system in two data transmission paths in two opposite directions. On the contrary, it should be achieved that if one of the two data transmissions leads to a modification or incorrect transmission of the data, this may not be discovered, at least because the other data transmission uses a different manner or technology to transmit the data, and the opposite data transmission is not compensated.

[0033] Details and possible designs of the data transmission and other method steps to be carried out within the framework of the method presented here are discussed below.

[0034] First, at least one configuration parameter is received by the controller. As discussed in more detail below with respect to various embodiments, the configuration parameters may originate from different data sources and / or be provided to the controller via different paths.

[0035] The received configuration parameters are then transmitted to the safety device. Usually, there is at least one dedicated data transmission channel between the controller and the safety device, through which the two components can exchange data. In this case, the data transmission channel is defined by the interaction between the physical data transmission medium (e.g., a data cable or a data radio link) on the one hand and the data protocol used in the data transmission process, which indicates how the information to be transmitted is encoded with the data. For example, the data interface of the controller can be directly connected to the data interface of the safety device via a data cable. The connection can be part of a bus system. Alternatively, the two components can exchange data wirelessly, for example, via a radio link. Here, measures such as data encryption and / or communication partner identity authentication can be established to ensure the security of data transmission. The configuration parameters can be transmitted, for example, as electrical signals via the data transmission channel. For example, the electrical signal can digitally or analogously encode the value or other properties of the configuration parameters.

[0036] After the safety device has received the configuration parameters, the safety device may store the received configuration parameters or parameters corresponding to the received configuration parameters or parameters derived from the received configuration parameters as configured parameters. Thus, the safety device enters its configured state so that the safety device can properly control the safety-critical functions controlled by it.

[0037] In order to be able to subsequently check whether the safety device has been configured with the correct configured parameters, the safety device then transmits data representing the configured parameters back to the controller. Ultimately, the configured parameters should be forwarded by the controller to a mobile data processing device, from which or with the aid of which the configured parameters can be compared with the nominal configuration parameters, for example after they have been output in a manner perceptible to a technician.

[0038] However, the above-mentioned data transmission channel via which the configuration parameters are sent from the controller to the safety device should not be used for this purpose. Instead, another data transmission channel will be used for this purpose. This other data transmission channel may use the same physical data transmission medium as previously used for the reverse data transmission from the controller to the safety device, i.e., for example, the same data cable for the data transmission from the safety device to the controller. However, the data protocol used here, i.e., the encoding method of the configured parameters for the data transmission should be different from the data protocol used in the reverse data transmission.

[0039] In particular, the configured data should encode graphical information. In this context, graphical information is understood to be a data representation in which the configured parameters are represented in a visible, machine-readable manner. For example, a barcode, a 2D code (two-dimensional code) or the like can be used to represent the values ​​and / or other properties of the configured parameters. The two-dimensional code can be implemented in different ways, such as a QR code, a data array code or similar encodings.

[0040] Here, the graphic information should reflect the configured parameters in an unambiguous manner, that is, the graphic information can only be expressed as a unique configured parameter value or a unique configured parameter attribute to exclude misunderstandings or misconceptions.

[0041] The graphic information created in this way and transmitted to the controller can then be displayed on a display. The display can also be called a screen or a screen. The display is connected to the controller. For example, the display can be integrated into a housing that accommodates the controller. Alternatively, the display can be wired with the controller or exchange data wirelessly as a separate component. The display can also be used by the controller for other tasks. In particular, the display can be used as a human-machine interface, for example, information can be output from the controller to personnel, such as technicians who repair the elevator system. The display can be touch-sensitive, that is, designed as a touch screen, so that the display can also be used as a human-machine interface, with the help of which data can be transmitted from personnel to the controller.

[0042] The graphic information can then be read from the display. This should be done in particular with the help of a mobile, processor-controlled data processing device. The data processing device can be, for example, a smart phone (e.g. a smartphone), a portable computer (e.g. a laptop) or a similar portable device equipped with a processor for data processing. The data processing device can be carried by an authorized technician, for example. For example, the data processing device can be a smartphone belonging to the technician, on which a special application (App) has been installed.

[0043] At least in one variant of the data transmission channel, data can be transmitted between the data processing device and the controller in such a way that the graphic information displayed by the controller on the display is read using an optical reading sensor of the data processing device and then processed in the data processing device. The reading sensor can be configured to detect optical features, i.e. visually recognizable features. For example, the reading sensor can be a camera, a light sensor, a scanner, etc.

[0044] In addition to its processor, the data processing device may also have a data memory in which data can be stored and / or may have a data interface for exchanging data with other devices. In addition, the data processing device may have a human-machine interface, through which data can be input by a person and / or data can be output in a way that can be perceived by a person. The human-machine interface may include, for example, a touch screen, a loudspeaker, a microphone and / or a keyboard.

[0045] After the graphical information is read from the data processing device, the configured parameters reflected by the graphical information can be compared with the predetermined nominal configuration parameters. If such a comparison shows that the two parameters are sufficiently consistent within acceptable tolerances, this can be interpreted by the controller as an indicator that the safety-critical functions of the personnel transport device can be performed because the safety device has been correctly switched or configured to its configured state. The data processing device then transmits the result of the comparison to the controller.

[0046] However, if there is insufficient agreement between the visually read configured parameters and the nominal configuration parameters, the controller may not use data from the incorrectly configured safety device, so that safety-critical functions of the personnel transport system affected thereby may not be controlled by the controller.

[0047] Therefore, the controller is designed to control the functions of the passenger transport device depending on whether a sufficient degree of agreement between the visually read configured parameters and the rated configuration parameters is detected. This should be understood here as the controller controlling the passenger transport device differently from before the reception after the recognition of a sufficient degree of agreement. For example, the controller can control the passenger transport device in such a way that the moving parts of the passenger transport device, such as the elevator car of the elevator device, do not move at all or only move very slowly, that is, only slower than the normal operation of the passenger transport device before the recognition of a sufficient degree of agreement. Only after the recognition of a sufficient degree of agreement will the moving parts move at a normal speed. In addition, other control schemes of the passenger transport device can be considered depending on the recognition of a sufficient degree of agreement.

[0048] In particular, the controller is designed in such a way that it controls the functions of the passenger transport device designed as an elevator device in such a way that the elevator car of the passenger transport device is displaced in the elevator shaft only after the visually read configured parameters agree sufficiently with the nominal configuration parameters. This ensures that the elevator car is only moved after the safety device has been deployed. This enables particularly safe operation of the elevator device.

[0049] The controller can be particularly designed to operate the functions of the personnel transport device at most within a limited range before the aforementioned recognition of a sufficient degree of agreement between the visually read configured parameters and the nominal configuration parameters and to operate the functions of the personnel transport device within a full range after the aforementioned reception. For example, the limited range can be referred to as a commissioning mode or a maintenance mode, and the full range can be referred to as a normal mode.

[0050] According to a specific embodiment, the data processing device can output the configured parameters reflected by the read graphic information to the personnel, and when the personnel confirms that the configured parameters are correct, a sealing signal can be sent to the controller. Here, the controller can be designed to operate the function of the personnel transport device within a limited range at most before receiving the sealing signal, and to operate the function of the personnel transport device within a full range after receiving the sealing signal.

[0051] In other words, the data processing device can be used to enable an authorized technician to check the correctness of the configured parameters transmitted from the safety device to the controller and further transmitted to the data processing device, for example by comparing the configured parameters with the rated configuration parameters. To this end, the technician can compare the information about the configured parameters output to him by the data processing device with other information provided to him, such as information about the rated specifications. It can be provided that the elevator device is only allowed to operate with its full functional range if such a check has been carried out by an authorized technician. In traditional elevator devices, it can be provided that the safety device is sealed after it has been checked by a technician, that is, for example, provided with a lead seal. Using the method described here, the sealing can be performed electronically, that is, the controller can be designed to allow the full functional range of the elevator device only after the configured parameters stored and subsequently transmitted by the safety device have been checked by a technician and the correctness has been confirmed.

[0052] For this purpose, the technician can make an input, for example, on a mobile data processing device to confirm the correctness and then transmit a sealing signal to the controller of the elevator system based on this. Only after receiving the sealing signal will the controller go from a restricted operating mode (in which safety-critical functions of the passenger transport device are permitted to a limited extent at most) to a normal operating mode in which all safety-critical functions of the passenger transport device are permitted and monitored by the controller.

[0053] According to a specific embodiment, the controller may send a sealing signal to the safety device, wherein the safety device switches to a sealed state after receiving the sealing signal. Subsequently, the safety device transmits a receipt signal to the controller. The controller is configured to operate the functions of the personnel transport device within a limited range at most before receiving the receipt signal, and to operate the functions of the personnel transport device within a full range after receiving the receipt signal.

[0054] Once the safety device is in the sealed state, changed configuration parameters can only be stored in the safety device under increased safety conditions, for example by entering a special authorization code. Unauthorized changes to the configuration parameters can thereby be particularly effectively prevented, which enables particularly safe operation of the personnel transport device. The safety device is designed in particular such that, before switching to the sealed state, the safety device only allows the personnel transport device to be operated with restricted functionality. The safety device is designed in particular such that, before switching to the sealed state, no movement of the elevator car in the elevator shaft is permitted, or only to a limited extent.

[0055] According to one embodiment, the configured data should not be modified by the controller before being shown on the display.

[0056] In other words, the controller preferably does not modify or process the configured data received from the security device in any way before forwarding it to the display. Instead, the graphical information encoded by the configured data should be able to be displayed directly on the display without prior modification by the controller.

[0057] In particular, it is to be avoided that, for example due to system errors which may occur during data processing in the controller, graphics information received from the controller is incorrectly forwarded to the display or incorrectly displayed on the display.

[0058] According to another specific embodiment, the graphics information encoded in the configured data may define, for each of a plurality of pixels of the display, a display state to be presented.

[0059] In other words, the display may have an array of a large number of pixels. Each pixel may be individually controllable. For example, a variable voltage may be applied to a single pixel. Depending on the type of control or the voltage applied, the pixel may assume a display state, i.e. the pixel may, for example, assume a brightness that depends on the control scheme and / or a color that depends on the control scheme. If necessary, the display may have its own control electronics, which appropriately converts an input signal, for example in the form of graphics information, into a control signal for each of the plurality of pixels.

[0060] In this case, the configured data transmitted from the safety device to the control unit can already encode the graphic information in such a way that it can be displayed directly on the display, i.e. without the controller processing the data in between. In particular, the configured data can encode the graphic information in such a way that the control electronics of the display can already determine in a one-to-one manner in which display state each pixel of the display is to be actuated.

[0061] As a result, possible sources of error in the data transmission between the safety device and the mobile data processing device in which the comparison of the transmitted configured parameters with the setpoint configuration parameters is ultimately carried out can be minimized.

[0062] According to one embodiment, the safety device can transmit a plurality of configured data to the controller one after another. Here, each of the plurality of configured data can encode different graphic information. Then, each of the plurality of graphic information is displayed on a display connected to the controller. Here, each graphic information reflects the configured parameters one to one in a visual, machine-readable manner.

[0063] In other words, the safety device can not only transmit information about which configuration parameters it is configured with to the controller and then to the mobile data processing device by means of a single set of configured data. Instead, the safety device can transmit a plurality of configured data. Although each of these configured data sets can reflect the same value or the same properties of the configuration parameters stored for configuring the safety device, for this purpose, this information can be encoded as graphical information in different ways. In other words, for example, different bar codes or QR codes can be used to reflect one and the same value of the configuration parameter. These different graphical information can then be displayed on the display.

[0064] In principle, different graphic information can be displayed simultaneously in different areas of the display. However, displays typically used for personnel transport devices are relatively small and have arrays with relatively few pixels. Therefore, it may be preferred to display multiple graphic information one after the other on the display.

[0065] By displaying the configured parameters while applying a plurality of different graphic information, it is primarily possible to avoid: Incorrect transmission of the configured parameters between the controller and the mobile data processing device, in particular due to pixel errors in the display used for display. Due to pixel errors, individual pixels of the display may not correctly present the display state defined in the graphic information. The incorrectly presented display state may cause the graphic information read by the reading sensor of the mobile data processing device to correspond incorrectly to the graphic information established by the safety device, so that erroneous data is transmitted between the two components. However, by transmitting the configured parameters together with a plurality of different graphic information, such erroneous data transmission caused by pixel errors can be detected. If necessary, for example, corresponding error information can be output on the mobile data processing device and / or error correction measures can be taken.

[0066] According to one embodiment, a plurality of partial information encoding a corresponding one of the partial information of the graphic information can be displayed successively on a display connected to the controller. Here, the sum of these information reflects the configured parameters one to one in a visual, machine-readable manner. The configured data packets can be transmitted from the safety device to the controller one after another. Alternatively, the controller can also divide the configured parameters received from the safety device into individual configured data packets.

[0067] As mentioned above, the displays available to the controller can only have a relatively small pixel array. Due to the small number of pixels available therein, it is difficult or even impossible to display the entire set of configured data to be transmitted simultaneously with the help of a single graphic information. In order to still be able to display the entire data set, it can be divided into several data packets. Each of these data packets can encode a part of the overall graphic information to be transmitted. Then, multiple partial information of the graphic information can be displayed on the display in sequence and read by the reading sensor of the mobile data processing device. Here, these partial information can be displayed on the display, for example, as multiple still images to be displayed one after another. Alternatively, these partial information can also be displayed continuously by the display. Once the data processing device reads all the partial information, the entire graphic information can be inferred from the sum of these partial information, and from this the configured parameters to be transmitted.

[0068] According to one embodiment, the controller may receive configuration parameters based on manual input by a person at a human-machine interface.

[0069] In other words, the configuration parameters to be received by the controller can be obtained by inputting the configuration parameters at the human-machine interface by a person such as an authorized technician. Such a human-machine interface can be an integral part of the controller. Alternatively, the human-machine interface can be provided as a separate device and, for example, temporarily or permanently connected to the interface.

[0070] The human-machine interface may have an input device, through which a person can input data reflecting the configuration parameters. For example, the human-machine interface may have a keyboard, a touch screen, etc. for this purpose. In addition, the human-machine interface may have an output device so that data can be output in a way that a person can perceive. For example, a screen, a speaker, etc. can be used for this purpose. For example, the above-mentioned display for displaying graphical information can be used as the human-machine interface.

[0071] Within the scope of the configuration process, the personnel can therefore transfer the configuration parameters to the controller via the HMI.

[0072] According to one embodiment, the controller can receive configuration parameters from a mobile, processor-controlled data processing device, which can be temporarily connected to the controller for data exchange.

[0073] In other words, the controller can be at least temporarily connected to a mobile, processor-controlled data processing device and receive the configuration parameters via the data processing device.

[0074] The data processing device, after it is connected to the controller, can be used as a human-machine interface of the controller. For example, data reflecting configuration parameters can be entered by a person on the data processing device, for example by means of its keyboard or touch screen. This data can then be forwarded to the controller.

[0075] Alternatively or additionally, the data processing means may be used to retrieve data reflecting the configuration parameters, for example from a remote database, and then forward it to the controller.

[0076] Alternatively or additionally, according to an embodiment, the controller may receive configuration parameters by calling data from a remotely located database.

[0077] In other words, one of the independently established parameters can be obtained by calling up from a database. The database can be stored remotely from the controller and in particular also remotely from the entire people moving device, for example on a server or in a data cloud (“Cloud”). The controller or a device communicating therewith can be connected to the database for data transmission, for example via wired or wireless data transmission.

[0078] According to one specific embodiment, data can be retrieved from a database, which data were created during the planning and / or ordering of the passenger transport device and which contain configuration parameters or from which configuration parameters can be derived.

[0079] In other words, the configuration parameters to be received by the controller can be established based on data previously established during the design of the people moving device or during the ordering of the people moving device. In such a design or ordering, the safety devices to be installed in the people moving device are also regularly selected and planned in terms of their configuration. Therefore, detailed information about the rated configuration of the individual safety devices of the people moving device can be found in the data established here. This data is usually stored in a database, for example by the manufacturer of the people moving device and / or the safety devices, so that it can be called up by the controller when necessary.

[0080] According to another embodiment, the controller can receive the configuration parameters from a data memory which is coupled to the controller for data exchange.

[0081] Compared to the above-mentioned data processing device, the data storage device itself does not need any data processing capabilities, that is, the data storage device does not need its own processor. Instead, the data storage device can only store data and provide it to the controller when needed for calling. Unlike the data processing device, the data storage device usually does not have its own power supply device. The data storage device can be a volatile or non-volatile memory. For example, the data storage device can be a flash memory, for example in the form of a SIM card or an SD card.

[0082] The data stored in the data storage may reflect the configuration parameters. In this case, the data may be established independently of the data reflecting the configuration parameters, which data may be provided to the controller via other channels. For example, the data stored in the data storage may be predetermined and stored by the manufacturer of the safety device or the manufacturer of the controller.

[0083] After the safety device receives the configuration parameters sent to it by the controller and stores the configured parameters accordingly, the safety device can transmit the configured parameters back to the controller as a confirmation that the configured parameters have been stored and to check the configured parameters, whereupon the controller forwards the configured parameters to the mobile data processing device. The transmitted configured parameters can then be analyzed in order to identify, for example, whether the configured parameters correspond to a predetermined target specification. This can be achieved, for example, in or with the help of a mobile data processing device that is temporarily connected to the controller.

[0084] For this purpose, the data processing device can, for example, output the transmitted configured parameters as a human-machine interface, for example in a manner perceptible to a technician, who can compare the configured parameters with the nominal configuration parameters known to him. Alternatively, the data processing device can use its data communication interface to transmit the received configured parameters to an external device, for example a monitoring device for monitoring the function of the elevator system. There, the configured parameters can then be compared with the nominal configuration parameters known there.

[0085] The configuration parameters are transmitted from the control unit to the safety device, in particular together with a checksum which characterizes the configuration parameters.

[0086] In other words, the configuration parameters are preferably not transmitted as the only data between the controller and the safety device, but rather the data reflecting the configuration parameters are supplemented by data reflecting a checksum characterizing the configuration parameters.

[0087] Such a checksum can be used within the scope of a cyclic redundancy check, which is therefore also partially referred to as a CRC (cyclic redundant check). A cyclic redundancy check is a method for determining a test value for the data in order to be able to detect errors in data transmission or storage. Ideally, the method can even be used to independently correct the received data to avoid retransmission. Here, additional redundancy in the form of a so-called CRC value is added to the data chunks, for example, of user data, before data transmission or data storage. The CRC value serves as a checksum and is a test value calculated according to a specific method, with the help of which any errors that may have occurred during storage or transmission can be identified. Thus, by adding a checksum that characterizes the configuration parameters, the risk of undetected errors occurring during the transmission of the configuration parameters from the controller to the safety device can be minimized.

[0088] In this case, the controller can be designed to exchange signals or data with various actuators and / or sensors within the personnel transport device. In particular, the controller can control the operation of the drive machine of the personnel transport device. If necessary, the controller can also accept inputs from various human-machine interfaces to control the operation of the personnel transport device based on this, or output information related to the current state of the personnel transport device through the human-machine interface. For example, such a human-machine interface can include buttons, buttons, sensors, screens, speakers and / or the like on the operating panel of the elevator device. For example, the controller can have separate modules that communicate with each other, wherein, for example, one module performs tasks that are critical to safety, while another module serves the human-machine interface and operates the drive machine.

[0089] The safety device can be designed to control safety-critical functions in the personnel transport device. To this end, the safety device can have one or more sensors to detect physical quantities related to the safety-critical functions. The safety device can also have one or more actuators that can influence these physical quantities.

[0090] For example, the safety device may be designed to detect the current open state of an elevator door, measure the current travel speed of the elevator car, determine the current position of the elevator car within the elevator shaft, identify loads or accelerations currently acting on the elevator car, etc.

[0091] By storing configuration parameters, the safety device can be adapted to the characteristics of the passenger transport device and / or the conditions existing in the passenger transport device. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] The embodiments of the present invention are described below with reference to the accompanying drawings. Neither the drawings nor the description should be interpreted as limiting the present invention.

[0093] Figure 1 A lift installation according to one embodiment of the invention is shown.

[0094] Figure 2 The present invention shows a diagram for explaining data transmission and data processing within the scope of a method according to one specific embodiment of the invention.

[0095] The figures are merely schematic and not true to scale. The same reference numerals in different figures denote the same or equivalent features. DETAILED DESCRIPTION

[0096] Figure 1 A very rough schematic diagram of a passenger transport device 1 in the form of an elevator device is shown. The elevator car 5 is arranged in the elevator shaft 3 and is held by a rope-like sling 9. The drive machine 7 can move the rope-like sling 9 and thus vertically move the elevator car 5. The drive machine 7 is controlled by a controller 11. For example, the controller 11 can have separate modules that communicate with each other, wherein, for example, one module performs safety-critical tasks and another module serves the human-machine interface and controls the drive machine 7. The elevator door 13 is arranged on a floor. The current closed state of the elevator door 13 is monitored by a safety device 17 in the form of a door switch 15. A plurality of further safety devices 17 can also be provided in the passenger transport device 1, in order to, for example, monitor the closed state of other elevator doors 13 or also monitor other functions.

[0097] Technician 23 can access passenger transport device 1 in order to configure passenger transport device 1 , in particular its safety device 17 , using his smartphone 19 as mobile data processing device 21 . This can be done, for example, when passenger transport device 1 is already completed or also within the scope of maintenance work.

[0098] refer to Figure 2 A possible design of such a process for configuring the safety device 17 is presented.

[0099] First, the control unit 11 receives configuration parameters 41. The configuration parameters 41 specify a desired setpoint configuration of the safety device 17 to be configured.

[0100] In the example shown, configuration parameters 41 are transmitted from a mobile, processor-controlled data processing device 21 to the control unit 11. The data processing device 21 can be a smartphone 19 of a technician 23, on which a suitable application (App) is running. The configuration parameters 41 can be input, for example, by the technician 23 via the human-machine interface 27 of the smartphone 19. The human-machine interface 27 can be, for example, a touch-sensitive screen 25 or a keyboard. Alternatively, the configuration parameters 41 can also be called up from an external source, for example an external database 37 stored in a data cloud 35, using the data communication module 29 of the smartphone 19. For example, configuration data can be stored in the database 37, which data are established during the design process or during the ordering process of the personnel transport device 1. The configuration parameters 41 can then also be transmitted to the control unit 11 or its data communication module 31, for example, by means of the data communication module 29. For example, the data can be transmitted wirelessly.

[0101] Alternatively, communication parameters 41 may be provided by a data memory 39 which is connected to controller 11 for data exchange. Data memory 39 may be, for example, a flash memory in which configuration data for all safety devices 17 of passenger transport system 1 are stored.

[0102] The configuration parameters 41 are then transmitted from the controller 11 to the safety device 17 or its data communication module 33. The configured parameters 43 are then stored in the safety device 17 based on the received configuration parameters 41, in order in this way to switch the safety device 17 to its configured state.

[0103] Subsequently, configured data 47 is generated in the security device 17 based on the configured parameters 43. The configured data 47 encodes graphic information 49, which reflects the configured parameters 43 one-to-one in a visually displayable and machine-readable manner. Here, the graphic information 49 represents, for each pixel 61 of the display on which the graphic information 49 is to be displayed, the display state to be presented by the pixel 61.

[0104] The configured data 47 are then transmitted back from the safety device 17 to the controller 11 and then forwarded from the controller to the data processing device 21. Here, a different data transmission channel than the previous data transmission from the data processing device 21 via the controller 11 to the safety device 17 is used.

[0105] For this purpose, the controller 11 has a small display 51, for example in the form of an LCD display, in particular in the form of an array display. If necessary, the display 51 can also be arranged externally, and the controller 11 can be connected to the external display 51. During normal operation of the elevator system 1, the controller 11 can, for example, use the display 51 to display the current functional status of the elevator system 1 or components of the elevator system 1.

[0106] Within the scope of the configuration method described here, the controller 11 can use a display 51 to display the graphic information 49 received from the security device 17 on the display 51. In this case, the graphic information 49 defines the display state to be presented for each pixel 61 of the display 51. The graphic information 49 (in the form of a barcode or a QR code) is then displayed, for example Figure 2 The optical reading sensor 53 of the mobile data processing device 21 can be recognized and read by the optical reading sensor 53. The reading sensor 53 can be, for example, a camera 55 of a smartphone 19 serving as the data processing device 21.

[0107] If the display 51 has only a small number of pixels 61, the entire graphic information 49 can also be divided into a plurality of partial information 63 (also as in Figure 2 ). Here, the different partial information 63 to be visually displayed is reflected by a plurality of configured data packets 65, which reflect the configured parameters 43 as a whole. Each partial information 63 represents the display state of each of the few pixels 61. The configured data packets 65 can be transmitted from the safety device 17 to the controller 11 (not shown) in sequence. Alternatively, the controller 11 can split the configured parameters received from the safety device 17 into individual configured data packets. Then, the reading sensor 53 of the data processing device 21 can read the partial information 63 in sequence, and determine the configured parameters 43 from the sum of the partial information.

[0108] In another optional improvement, the configured parameters 43 can be reflected by a plurality of different configured data 47. Each of these configured data 47 encodes the configured parameters 43 with different graphic information 49. Then, the different graphic information 49 can be preferably displayed on the display 51 one after another, and can be read by the reading sensor 53. If there are erroneous pixels 61 on the display 51, such pixels may interfere with the transmission of individual graphic information in the graphic information 49. However, the possibility that such pixel errors distort all the graphic information 49 transmitted one after another is small. Therefore, even if there are pixel errors, reliable visual transmission of the configured data 47 can be achieved by analyzing the various graphic information 49.

[0109] The configured data 47 optically transmitted in this way from the controller 11 to the data processing device 21 or the configured parameters 43 reflected by the configured data can then be compared with the setpoint configuration parameters 59 .

[0110] For this purpose, the configured parameters 43 can be displayed to the technician 23 on the screen 25 of the smartphone 19 with the aid of the configured data 47. The technician 23 can know the nominal configuration parameters 59 and check whether the configured parameters 43 are consistent with the nominal configuration parameters 59 within an acceptable tolerance. Alternatively, for example, the nominal configuration parameters 59 can also be stored in the smartphone 19 or called up by the smartphone 19 from, for example, a database 37 and also displayed on the screen 25. The technician 23 can then more easily compare the configured parameters 43 with the nominal configuration parameters 59.

[0111] If the two parameters 43, 59 are consistent to a sufficient degree, the technician 43 can then authorize the release of the transmission to the controller 11, for example by operating the operating field on the touch screen 25 designed as the human-machine interface 27. The release can be regarded as the result of comparing the two parameters 43, 59. In response to the release, the data processing device 21 can send a sealing signal 57 to the controller 11. Only when the controller 11 obtains such a sealing signal 57 can the controller safely assume that the safety device 17 has been correctly configured and can then operate the full range of functions of the personnel transport device 1 in normal mode. In contrast, before receiving the sealing signal 57, the controller 11 can only operate in a restricted mode, in which the functions of the personnel transport device 1 are provided to a restricted extent at most.

[0112] Instead of switching to the normal mode immediately after receiving the seal signal 57 from the data processing device 21, the controller 11 may send the seal signal 57 to the safety device 17. Then, the safety device 17 switches to the sealed state upon receiving the seal signal 57, and sends the sign-off signal 58 to the controller 11. The controller 11 transitions to the normal mode only after receiving the sign-off signal 58 from the safety device 17.

[0113] In order to ensure the integrity of the data reflecting the configuration parameters 41 and / or the configured data 47, a checksum 45 can be additionally transmitted together with the above data between the various devices, i.e. between the data processing device 21 and the controller 11 on the one hand, or between the controller 11 and the safety device 17 on the other hand, which checksum characterizes the configuration parameters 41 or the associated configured data 47. Such a checksum 45 can be predetermined as a CRC value.

[0114] In the example given above, the configuration parameters 41 are determined by the mobile data processing device 21 and transmitted to the controller 11. For example, the data processing device 21 can detect inputs made by the technician 23 on its screen 25 as configuration parameters 41 or determine data retrieved from the database 37 as configuration parameters 41. Alternatively, the configuration parameters 41 can be read from a data memory 39 provided directly on the controller 11. As a further alternative, it is also conceivable that the configuration parameters 41 are determined directly by the controller 11, in that the controller retrieves data from the database 37, for example, via a data communication module 31 integrated in the controller 11, and receives them as configuration parameters 41.

[0115] In particular, the method proposed here can be used to configure the safety device 17 without the technician 23 having to manually enter the configuration data into the human-machine interface. For example, in the data processing device 21, the configuration parameters 41 automatically read from the database 37 can be automatically compared with the configured parameters 43 transmitted back from the safety device 17. If the two parameters 41, 43 are consistent to a sufficient extent, a sealing signal 57 can be transmitted to the controller 11. If possible, before the sealing signal 57 is transmitted, a release by an authorized technician 23 can be requested, for example by operating a control field on the screen 25 of the smartphone 19.

[0116] Once the configured parameters 43 have been stored, the safety device 17 can be switched to its configured state and thus to at least partial operation, in which the functionality of the safety device is provided at least to a limited extent, or the functionality of the entire passenger transport system 1 is provided to a limited extent. In partial operation, for example, the speed at which the elevator car 5 can move can be limited, or the elevator car 5 can only be driven after a previous additional confirmation. At a later point in time, for example, the stored configured parameters 43 can be checked by the technician 23 after being transferred to his smartphone 19, and if correct, a sealing signal 57 can be transmitted to the controller 11, which can then switch to full operation.

[0117] Overall, the method presented here makes it possible to achieve a higher degree of reliability when configuring passenger transport devices 1 and thus to increase the safety of passenger transport devices 1. Furthermore, the configuration process itself can be simplified.

[0118] Finally, it should be noted that the terms "having", "comprising" and the like do not exclude other elements or steps, and the terms "a" or "an" and the like do not exclude a plurality. Furthermore, it should be pointed out that features or steps that have been described with reference to one of the above exemplary embodiments can also be used in combination with other features or steps of other above-described exemplary embodiments. Any reference signs in the claims should not be interpreted as limiting.

Claims

1. A method for operating a personnel transport system (1), wherein: The passenger transport device (1) comprises a control unit (11) for controlling functions of the passenger transport device (1) and at least one safety device (17) for monitoring safety-critical functions of the passenger transport device (1); The safety device (17) can be switched into a configured state by storing configured parameters (43) in order to control safety-critical functions according to specific specifications; Wherein, the method comprises: Receiving configuration parameters (41) by the controller (11); transmitting configuration parameters (41) to a safety device (17); storing configured parameters (43) in the safety device (17) based on the received configuration parameters (41) so as to switch the safety device (17) to the configured state; It is characterized in that The method comprises: The configured data (47) are transmitted from the safety device (17) to the controller (11), wherein: The configured data (47) encodes the graphic information (49), The graphical information (49) is displayed on a display (51) connected to the controller (11), and The graphical information (49) reflects the configured parameters (43) one-to-one in a visual and machine-readable manner; reading the graphic information (49) by means of an optical reading sensor (53) of a mobile, processor-controlled data processing device (21); and By means of a data processing device (21), the configured parameters (43) reflected by the read graphic information (49) are compared with the setpoint configuration parameters (59); transmitting the comparison result from the data processing device (21) to the controller (11); The controller (11) controls the function of the passenger transport device (1) depending on whether a sufficient degree of agreement was determined between the configured parameters (43) and the setpoint configuration parameters (59) during the comparison.

2. The method according to claim 1, wherein: The controller (11) controls the functions of a passenger transport system (1) designed as an elevator system in such a way that an elevator car (5) of the passenger transport system (1) is not displaced in the elevator shaft (3) until a sufficient degree of agreement has been determined between configured parameters (43) and setpoint configuration parameters (59) during the comparison.

3. The method according to claim 1 or 2, wherein: The data processing device (21) outputs the configured parameters (43) reflected by the read graphic information (49) to the personnel, and when the personnel confirms the correctness of the configured parameters (43), transmits the sealing signal (57) to the controller (11). The controller (11) operates the functions of the personnel transport device (1) to a limited extent at most before receiving the sealing signal (57), and operates the functions of the personnel transport device (1) to a full extent after receiving the sealing signal (57).

4. The method according to claim 3, wherein: The controller (11) transmits the sealing signal (57) to the safety device (17), After receiving the sealing signal (57), the safety device (17) switches to a sealing state and transmits a receipt signal (58) to the controller (11); and The controller (11) controls the functions of the personnel transport device (1) to a limited extent at most before receiving the sign-off signal (58), and controls the functions of the personnel transport device (1) to a full extent after receiving the sign-off signal (58).

5. The method according to claim 1 or 2, wherein: The configured data (47) is not modified by the controller (11) before being displayed on the display (51).

6. The method according to claim 1 or 2, wherein: Graphics information (49) encoded in the configured data (47) defines, for each of a plurality of pixels (61) of a display (51), a display state to be presented.

7. The method according to claim 1 or 2, wherein: The safety device (17) transmits a plurality of configured data (47) to the controller (11) in succession. Each of the plurality of configured data (47) encodes different graphics information (49), Each of the plurality of graphic information (49) is displayed on a display (11) connected to the controller (11), and Each of the graphic information (49) reflects the configured parameters (43) one-to-one in a visual, machine-readable manner.

8. The method according to claim 1 or 2, wherein: A plurality of partial information (63) encoding a corresponding one of the partial information (63) in the graphic information (49) are displayed sequentially on a display (51) connected to the controller (11), and The sum of the partial information (63) reflects the configured parameters (43) one-to-one in a visual, machine-readable manner.

9. The method according to claim 1 or 2, in, The controller (11) receives configuration parameters (41) based on manual input by a person at the human-machine interface (27).

10. The method according to claim 1 or 2, wherein: The controller (11) receives configuration parameters (41) from a mobile processor-controlled data processing device (21), which can be temporarily connected to the controller (11) for data exchange.

11. The method according to claim 1 or 2, wherein: The controller (11) receives configuration parameters (41) by calling data from a remotely located database (37).

12. The method according to claim 11, wherein: Data can be retrieved in the database (37) which are generated during the design process and / or ordering of the passenger transport device (1) and which contain configuration parameters (41) or from which configuration parameters (41) can be derived.

13. The method according to claim 1 or 2, wherein: The controller (11) receives configuration parameters (41) from a data memory (39) which is connected to the controller (11) for data exchange.

Images