SAFETY MONITORING DEVICE FOR MONITORING SAFETY-RELATED STATES IN A PASSENGER CONVEYOR SYSTEM AND METHOD FOR OPERATING SAME

Abstract

A safety monitoring device monitoring safety-related states in a passenger conveyor system has first and second double contact relays each controlled by a control voltage to switch first and second normally open contacts and a feedback contact synchronously between an open and closed relay states. First and second controllers each determine properties of the system correlated with safety-related states and in dependence generate the control voltages. The controllers and two double contact relays form first and second safety monitoring switch arrangements for monitoring first and second safety-related states and correspondingly switch first and second switching states within a safety monitoring chain of the system. The first arrangement includes the first contact of the first connected in series with the first contact of the second relay. The second arrangement includes the second contact of the first relay connected in parallel with the second contact of the second relay.

Claims

1-14. (canceled)

15. A safety monitoring device for monitoring safety-related states in a passenger conveyor system comprising: a first double contact relay and a second double contact relay, each of the first and second double contact relays being controlled by a control voltage to switch a first normally open contact, a second normally open contact and a feedback contact synchronously between an open relay state and a closed relay state; a first controller and a second controller, each of the controllers determining properties of the passenger conveyor system correlated with a safety-related state and generating the control voltages for controlling the first and the second double contact relays depending on the determined properties; wherein a first safety monitoring switch arrangement for monitoring a first safety-related state and for correspondingly switching a first switching state within a safety monitoring chain of the passenger conveyor system and a second safety monitoring switch arrangement for monitoring a second safety-related state and for correspondingly switching a second switching state within the safety monitoring chain of the passenger conveyor system are formed by the first and second double contact relays and the first and second controllers; wherein the first safety monitoring switch arrangement includes the first normally open contact of the first double contact relay connected in series with the first normally open contact of the second double contact relay; and wherein the second safety monitoring switch arrangement includes the second normally open contact of the first double contact relay connected in parallel with the second normally open contact of the second double contact relay.

16. The safety monitoring device according to claim 15 including monitoring the first safety-related state at a higher safety integrity level than monitoring the second safety-related state.

17. The safety monitoring device according to claim 16 including monitoring the second safety-related state at a safety integrity level SIL1 and monitoring the first safety-related state at least at a safety integrity level SIL2.

18. The safety monitoring device according to claim 15 wherein the first safety-related state indicates whether parts of the safety monitoring chain that monitor closed states of doors of the passenger conveyor system may be temporarily short-circuited whereby the parts of the safety monitoring chain that monitor closed states of doors of the passenger conveyor system are temporarily short-circuited by switching the first switching state to closed.

19. The safety monitoring device according to claim 15 wherein the second safety-related state indicates whether an elevator car has been moved beyond a permissible movement range whereby the safety monitoring chain is interrupted by switching the second switching state to open.

20. The safety monitoring device according to claim 15 including a plurality of series-connected third safety monitoring switch arrangements for monitoring third safety-related states.

21. The safety monitoring device according to claim 20 wherein the first safety monitoring switch arrangement is interconnected in parallel with the series-connected third safety monitoring switch arrangements and wherein the second safety monitoring switch arrangement is interconnected in series with the series-connected third safety monitoring switch arrangements.

22. The safety monitoring device according to claim 15 wherein the first and the second controllers are each a safety programmable logic controller.

23. A passenger conveyor system comprising the safety monitoring device according to claim 15 connected to a safety monitoring chain including a plurality of safety monitoring switch arrangements monitoring safety-related states within the passenger conveyor system.

24. A method for monitoring a working order of the safety monitoring device according to claim 15, the method comprising the steps of: varying the control voltages generated by the first and the second controllers such that one of the first and second double contact relays is alternately switched briefly to the open relay state and back to the closed relay state, and such that at least one of the first and second double contact relays is in the closed relay state at all times; and monitoring whether the feedback contacts of the first and second double contact relays indicate a relay state matching a currently activated relay state of the first and second double contact relays.

25. The method according to claim 24 wherein when the feedback contacts do not indicate the relay state matching the currently activated relay state, the first and second controllers generate the control voltages that switch the first and second double contact relays to the open relay state.

26. The method according to claim 24 wherein each of the first and second controllers monitors the feedback contacts of each of the first and second double contact relays.

27. The method according to claim 24 including performing the steps at least before, during and after each individual journey of the passenger transport system.

28. A passenger conveyor system including the safety monitoring device according to claim 15 comprising: an elevator shaft having a plurality of shaft doors; an elevator car having a car door and being movable in the elevator shaft to the shaft doors; a safety monitoring chain including a plurality of safety monitoring switch arrangements monitoring safety-related states of the car door and the shaft doors; and the safety monitoring device connected to the safety monitoring chain and monitoring the safety-related states of the car door and the shaft doors.

Description

DESCRIPTION OF THE DRAWINGS

[0065] FIG. 1 shows a passenger transport system according to the invention.

[0066] FIG. 2 shows a safety monitoring chain of a passenger transport system according to the invention.

[0067] FIG. 3 shows details of a safety monitoring device according to the invention.

[0068] FIG. 4a shows activated relay states and resulting switching states in the safety monitoring device according to the invention.

[0069] FIG. 4b illustrates a variation of activated relay states as part of a method according to the invention for monitoring the working order of a safety monitoring device.

[0070] The figures are merely schematic and not true to scale. Like reference signs designate like or equivalent features in the various figures.

DETAILED DESCRIPTION

[0071] FIG. 1 shows a passenger conveyor system 1 in the form of an elevator. The elevator comprises an elevator car 5 and a counterweight 7 which can be shifted vertically within an elevator shaft 3 by means of belts 9 which are driven by a prime mover 11. Furthermore, a brake 12 can be provided for braking the prime mover 11 or for directly braking the elevator car 5. An operation of the prime mover 11 and/or of the brake 12 is controlled by an elevator control unit 13. The elevator control unit 13 can, for example, supply the prime mover 11 with electrical power from an electric power source 15 in a controlled manner.

[0072] The elevator car 5 can be moved between different floors 17. A shaft door 19 is provided on each floor 17 and a car door 21 is provided on the elevator car 5.

[0073] In the passenger conveyor system 1, a plurality of safety monitoring switch arrangements 23 is provided, using which safety-related states within the passenger conveyor system 1 can be monitored.

[0074] For example, door switches 25 are provided on each of the shaft doors 19 and on the car door 21, using which it can be monitored whether the relevant shaft door or car door 19, 21 is currently correctly closed or at least partially open. Furthermore, in a pit region of the elevator shaft 3, a ladder presence switch 27 is provided, using which the presence and correct arrangement of a ladder 29 can be monitored. In the case of both the door switch 25 and the conductor presence switch 27, safety monitoring switch arrangements 23 can be provided, for example as a simple switch to be mechanically actuated.

[0075] In addition, the passenger conveyor system 1 can also have more complex safety monitoring switch arrangements 23. Using a magnetic tape 33 extending vertically along the elevator shaft 3 and a magnetic tape reader 31 mounted on the elevator car 5, an absolute position sensor 35 can be formed, for example, using which information about a current position of the elevator car 5 within the elevator shaft 3 can be obtained. Based on this information, safety-related states can then be monitored.

[0076] For example, it can be detected whether the elevator car 5 is currently opposite or at least close one of the shaft doors 19 and thus the car door 21 and/or the opposite shaft door 19 may be opened. Furthermore, based on this information, it can be detected whether the elevator car 5 is within a permissible movement range 37 within the elevator shaft 3 or whether it has been unintentionally moved out of this permissible movement range 37.

[0077] Data or signals can be transmitted from the various safety monitoring switch arrangements 23 to a safety monitoring device 39, for example by wire or wirelessly.

[0078] In particular, a plurality of the safety monitoring switch arrangements 23 can be interconnected, in particular interconnected in series, in order to form parts of a safety monitoring chain 41. For example, the door switches 25 and the ladder presence switch 27 can be connected in series such that the part of the safety monitoring chain 41 formed thereby is closed as a whole only when all the door switches 25 and the ladder presence switch 27 are closed.

[0079] The safety monitoring device 39 can communicate with or be part of the elevator control unit 13 and can affect functions of the elevator control unit 13. In particular, the safety monitoring device 39 can actuate one or more main relay arrangements 43 in order, for example, to be able to interrupt a power supply between the elevator control unit 13 and the prime mover 11 and/or to activate or release the brake 12 for braking the elevator car 5.

[0080] FIG. 2 illustrates details of a safety monitoring chain 41. A plurality of safety monitoring switch arrangements 23 (hereinafter also referred to as third safety monitoring switch arrangements) in the form of door switches 25 and other safety monitoring switch arrangements 23, for example in the form of a ladder presence switch 27 or the like, are connected in series.

[0081] One of these further safety monitoring switch arrangements 23 acts as car emergency limit switch 28 (KNE switch). This car emergency limit switch 28 is opened when the elevator car 5 is moved beyond its permissible movement range 37.

[0082] The part of the safety monitoring chain 41 formed by the series-connected safety monitoring switch arrangements 23 is connected in series with the main relay arrangement 43. The main relay arrangement 43 comprises a first main double contact relay 45 having a coil 49, a first normally open contact 53, a second normally open contact 57, a feedback contact 61 and a second main double contact relay 47 comprising a coil 51, a first normally open contact 55, a second normally open contact 59 and a feedback contact 63. The main relay arrangement 43 is normally, i.e. when the coils 49, 51 are not energized, open. Accordingly, the main relay arrangement 43 closes an electrical connection, which extends in series through the first normally open contacts 53, 55 of the first and the second main double contact relay 45, 47, between the power-supplying elevator control unit 13 and the prime mover 11 only when their two coils 49, 51 are energized owing to a fully closed safety monitoring chain 41. Similarly, the brake 12 is energized and thus released only when a connection between a power source and the brake 12 is closed using the main relay arrangement 43 as a result of a fully closed safety monitoring chain 41.

[0083] In order to allow the car door 21 and/or one of the shaft doors 19 to be opened under predetermined conditions, although the prime mover 11 shifts the elevator car 5, what is referred to as a UET switch 65 is provided in parallel with the series connection of door switches 25. This UET switch 65 also forms a safety monitoring switch arrangement 23 and may be closed only when the predetermined conditions are met, i.e., for example, when the elevator car 5 has already approached a target floor position to within a few centimeters and already should have started to open the doors 19, 21 before the elevator car 5 has finally stopped at the target floor position. By closing the UET switch 65, the part of the safety monitoring chain 41 formed by the door switches 25 is thus temporarily bypassed.

[0084] In order to meet the high safety requirements applicable to passenger conveyor systems 1, both the KNE switch 28 and the UET switch 65 have so far been implemented redundantly, each having two simple relays. For example, in the case of the UET switch 65, the two simple relays were connected in series such that a switching state of the UET switch 65 was closed only when both relays were closed at the same time, i.e., both relays were in their closed relay state.

[0085] However, accordingly, four simple relays had to be used overall for the two functions which were to be implemented by the KNE switch 28 and the UET switch 65.

[0086] FIG. 3 illustrates a safety monitoring device 67 according to the invention, which can be implemented so as to form part of a safety monitoring chain 41 of a passenger conveyor system 1 in order to monitor safety-related states in the passenger conveyor system 1. The safety monitoring device 67 can in particular implement the functions of a KNE switch 28 and a UET switch 65.

[0087] The safety monitoring device 67 comprises a first double contact relay 69 and a second double contact relay 71. Both double contact relays 69, 71 are designed as normally opened relays and each have coils 73, 75 which, when supplied with a control voltage, close first normally open contacts 77, 79 and second normally open contacts 81, 83, respectively. Each of the double contact relays 69, 71 also has a feedback contact 85, 87. In each of the double contact relays 69, 71, the relevant coil 73, 75 shifts, i.e. opens and closes, the first and the second normally open contacts 77, 79, 81, 83 of said relays and their feedback contact 85, 87 synchronously with one other and thus can be switched by the control voltage into an open or closed relay state.

[0088] The safety monitoring device 67 further comprises a first and a second controller 89, 91. The two controllers 89, 91 are designed to determine properties of the passenger conveyor system 1 which correlate with a safety-related state, and then to generate suitable control voltages for the first or the second double contact relay 69, 71 depending on the determined properties. The two controllers 89, 91 can communicate with one another or control one another. In particular, the controllers 89, 91 can be in the form of safety programmable logic controllers (SPLC).

[0089] In the shown example, the two controllers 89, 91 receive information about the current position of the elevator car 5 within the elevator shaft 3 from the absolute position sensor 35. From this information, the controllers 89, 91 can derive whether the elevator car 5 is currently within the permissible movement range 37 or whether it has left said range. Depending on which of these two cases applies, the controllers 89, 91 can produce different control voltages for the two double contact relays 69, 71 in order to emulate the function of a KNE switch 28 by means of the safety monitoring device 67. In addition, from the information the controllers 89, 91 can infer whether the elevator car 5 is currently sufficiently close to a target floor position such that it appears permissible to temporarily bypass the part of the safety monitoring chain 41 formed by the door switches 25 in order to emulate the function of a UET switch 65 by means of the safety monitoring device 67.

[0090] The safety monitoring device 67 forms, together with its double contact relays 69, 71 and its controllers 89, 91, safety monitoring switch arrangements 23 in the form of a first and a second safety monitoring switch arrangement 93, 95.

[0091] The first safety monitoring switch arrangement 93 comprises the first normally open contact 77 of the first double contact relay 69 and the first normally open contact 79 of the second double contact relay 71, which contacts are interconnected in series. By means of this first safety monitoring switch arrangement 93, the safety monitoring devices 67 emulate the function of the UET switch at a first output 97.

[0092] The second safety monitoring switch arrangement 95 comprises the second normally open contact 81 of the first double contact relay 69 and the second normally open contact 83 of the second double contact relay 71, which contacts are interconnected in parallel with one another. By means of this second safety monitoring switch arrangement 95, the safety monitoring devices 67 emulate the function of the KNE switch at a second output 99.

[0093] An actually assumed relay state of each of the double contact relays 69, 71 can be determined by the controllers 89, 91 via the relevant feedback contact 85, 87 of the associated double contact relay 69, 71. As a result, it can be monitored whether a relay state, activated by a controller 89, 91, in the associated double contact relay 69, 71 has led to the desired relay state being assumed or whether a fault has prevented this. Each of the two feedback contacts 85, 87 can transmit a feedback signal to each of the two controllers 89, 91.

[0094] FIG. 4a illustrates, in table form, possible control voltages K1, K2 produced by the two controllers 89, 91 for controlling the first and the second double contact relay 69, 71 into an open relay state (K1=0 or K2=0, i.e. no control voltage applied to the coil) or a closed relay state (K1=1 or K2=1, i.e. control voltage applied to the coil) and resulting switching states UET, KNE at the two outputs 97, 99 of the safety monitoring device 67. In this case, the first output 97 is designed to implement the function of the UET switch 65 and the second output 99 is designed to implement the function of the KNE switch 28.

[0095] It can be seen that the UET switching state emulated by the first safety monitoring switch arrangement 93 is closed only when both double contact relays 69, 71 have been activated by the two controllers 89, 91 into their closed relay state (1). In addition, the KNE switching state emulated by the second safety monitoring switch arrangement 95 is then open only when both double contact relays 69, 71 have been activated by the two controllers 89, 91 into their open relay state (0).

[0096] Using the safety monitoring device 67 described, the function of the UET switch 65 can be implemented via the first safety monitoring switch arrangement 93 at a very high safety integrity level of SIL2 or even SIL3 required for this purpose. The function of the KNE switch 28 can be implemented via the second safety monitoring switch arrangement 95 at least at the safety integrity level of SIL1 that is sufficient for this purpose.

[0097] Finally, an embodiment of a method is explained with reference to FIG. 4b, using which method the working order of the safety monitoring device 67 can be monitored.

[0098] At predetermined time intervals, i.e., for example, periodically, or triggered by particular events such as the beginning or the end of a journey, the normal operation of the safety monitoring devices 67, in which the safety-related states are monitored in the passenger conveyor system 1, is briefly interrupted. Instead, the control voltages generated by the first and the second controller 89, 91 are varied such that one of the two double contact relays 69, 71 is alternately switched briefly into its open relay state (Kx=0) and back into its closed relay state (Kx=1), and such that always at least one of the two double contact relays 69, 71 is in its closed relay state.

[0099] By such a variation of the control voltages, each of the two double contact relays 69, 71 can be activated at least once to open and subsequently close. Although the first safety monitoring switch arrangement 93 bringing about the UET function is briefly opened and closed again, it is also ensured that the second safety monitoring switch arrangement 95 bringing about the KNE function always remains closed. Thus, the entire safety monitoring chain 41 is always closed during this variation of the control voltages.

[0100] While the described method is carried out, it is not only possible to vary the control voltages using, for example, the controllers 89, 91, but also to monitor which actual relay state the feedback contacts 85, 87 of both double contact relays 69, 71 indicate. As long as the double contact relays 69, 71 are functioning properly, the relay state fed back by the feedback contacts 85, 87 should match the relay state activated by the controllers 89, 91. If this is no longer true at a time t.sub.0, a fault in one of the double contact relays 69, 71 can be assumed. This can be brought about for example by arms of one of the normally open contacts 77, 79, 81, 83 having been glued or welded together.

[0101] In this case, both controllers 89, 91 can generate control voltages such that both the first and the second double contact relays 69, 71 are switched into their open relay state. This can ensure that at least the extremely safety-critical UET function of the first safety monitoring switch arrangement 93 is reliably switched into its open state such that a dangerous movement of the elevator car 5 when the doors 19, 21 are open is avoided at all costs.

[0102] The safety monitoring device 67 described herein and the method for monitoring the working order thereof make it possible to reduce the cost of the correspondingly equipped passenger conveyor system 1, since only two double contact relays instead of the conventional four simple relays are needed for their implementation. Furthermore, a higher overall reliability can be achieved because only two instead of the previous four safe relays are needed. Complexity of an electronic circuit for the safety monitoring device 67 can also be simpler than for conventional devices, since fewer components need to be controlled.

[0103] Finally, it should be noted that terms such as having, comprising, etc. do not preclude other elements or steps and terms such as a or an do not preclude a plurality. Furthermore, it should be noted that features or steps that have been described with reference to one of the above embodiments can also be used in combination with other features or steps of other embodiments described above.

[0104] In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.

LIST OF REFERENCE SIGNS

[0105] 1 passenger conveyor system [0106] 3 elevator shaft [0107] 5 elevator car [0108] 7 counterweight [0109] 9 belt [0110] 11 prime mover [0111] 12 brake [0112] 13 elevator control unit [0113] 15 power source [0114] 17 floor [0115] 19 shaft door [0116] 21 car door [0117] 23 safety monitoring switch arrangements [0118] 25 door switch [0119] 27 ladder presence switch [0120] 28 car emergency limit switch (KNE switch) [0121] 29 ladder [0122] 31 magnetic tape reader [0123] 33 magnetic tape [0124] 35 absolute position sensor [0125] 37 permissible movement range [0126] 39 safety monitoring device [0127] 41 safety monitoring chain [0128] 43 main relay arrangement [0129] 45 first main double contact relay [0130] 47 second main double contact relay [0131] 49 coil of the first main double contact relay [0132] 51 coil of the second main double contact relay [0133] 53 first normally open contact of the first main double contact relay [0134] 55 first normally open contact of the second main double contact relay [0135] 57 second normally open contact of the first main double contact relay [0136] 59 second normally open contact of the second main double contact relay [0137] 61 feedback contact of the first main double contact relay [0138] 63 feedback contact of the second main double contact relay [0139] 65 door bypass switch (UET switch) [0140] 67 safety monitoring device [0141] 69 first double contact relay [0142] 71 second double contact relay [0143] 73 coil of the first double contact relay [0144] 75 coil of the second double contact relay [0145] 77 first normally open contact of the first double contact relay [0146] 79 first normally open contact of the second double contact relay [0147] 81 second normally open contact of the first double contact relay [0148] 83 second normally open contact of the second double contact relay [0149] 85 feedback contact of the first double contact relay [0150] 87 feedback contact of the second double contact relay [0151] 89 first controller [0152] 91 second controller [0153] 93 first safety monitoring switch arrangement [0154] 95 second safety monitoring switch arrangement [0155] 97 first output for UET function [0156] 99 second output for KNE function