ELEVATOR, METHOD FOR CONTROLLING AN ELEVATOR

Abstract

An elevator includes a shaft, a car movable in the shaft, a drive operatively connected to the car and by which the car can be moved, a brake, a plurality of shaft doors and a safety control system. The safety control system has a secure safety control unit of a first type and at least one secure safety control unit of a second type. The safety control unit of the first type and the at least one safety control unit of the second type are interconnected. The at least one safety control unit of the second type collects a state of any of the shaft doors. The safety control system is adapted such that the state of each of the shaft doors can be collected directly only by one of the safety control unit of the second type.

Claims

1-15. (canceled)

16. An elevator comprising: a shaft; a car movable in the shaft; a drive operatively connected to the car and adapted to move the car in the shaft; a brake at the car; a plurality of shaft doors providing access to the shaft; a safety control system including a secure safety control unit of a first type and a secure safety control unit of a second type, wherein the safety control unit of the first type and the safety control unit of the second type are interconnected; wherein the safety control unit of the second type collects a state of an associated one of the shaft doors; and wherein the state of the associated shaft door is collected directly exclusively by the safety control unit of the second type.

17. The elevator according to claim 16 wherein the safety control system includes a plurality of the safety control units of the second type, and wherein each of the safety control units of the second type is mounted on an associated one of the shaft doors.

18. The elevator according to claim 16 wherein each of the safety control unit of the first type and the safety control unit of the second type has at least one actuator associated therewith and controlled directly exclusively thereby.

19. The elevator according to claim 16 wherein the associated shaft door includes a secure door lock and/or an active door drive that operates as an actuator, and wherein the door lock and/or the door drive is controlled directly exclusively by the safety control unit of the second type.

20. The elevator according to claim 19 wherein the state collected by the safety control unit of the second type is a state of the door lock and/or the door drive and the state signals that the associated shaft door is closed or non-closed.

21. The elevator according to claim 16 wherein the brake is controlled directly exclusively by the safety control unit of the first type, the safety control unit of the first type is attached to the car, and the brake is a car brake.

22. The elevator according to claim 16 wherein the safety control unit of the second type controls an actuator, and when the actuator is in an unsafe state, the safety control unit of the second type transmits status information representing the unsafe state to the safety control unit of the first type.

23. The elevator according to claim 16 wherein the safety control unit of the second type transmits a signal to the safety control unit of the first type at predetermined regular intervals to check communication between the two safety control units, the regular interval being at least one second.

24. The elevator according to claim 23 wherein the regular intervals are at least one minute.

25. The elevator according to claim 16 wherein the safety control system includes a safety control unit of a third type connected to the safety control unit of the first type, the safety control unit of the third type adapted to implement a Safe Torque Off state of the drive.

26. The elevator according to claim 25 wherein the safety control unit of the third type and the safety control unit of the first type are connected by a cable connection.

27. The elevator according to claim 16 wherein the safety control unit of the first type and the safety control unit of the second type are connected by a non-secure wireless connection.

28. The elevator according to claim 16 wherein the safety control unit of the first type includes a non-secure interface and/or the safety control unit of the second type includes a non-secure interface, the non-secure interface of the safety control unit of the second type being connected to a shaft door drive unit of the associated shaft door, and the non-secure interface of the safety control unit of the first type being connected to at least one of a position sensor, a speed sensor and an acceleration sensor at the car.

29. The elevator according to claim 16 wherein the safety control unit of the first type includes a secure interface being connected to at least one of a slack cable sensor, a load measurement sensor, an actuator for actuating the brake and a safety control unit of a third type adapted to implement a Safe Torque Off state of the drive.

30. A method for controlling the elevator according to claim 16, the method comprising the steps of: operating the safety control unit of the second type to collect the state of the associated shaft door by collecting a state of an actuator of the associated shaft door wherein the collected state of the actuator signals either closed or not closed as the collected state of the associated shaft door; and transmitting the collected state of the associated shaft door from the safety control unit of the second type to the safety control unit of the first type via a non-secure connection.

31. The method according to claim 30 wherein the non-secure connection is a wireless connection.

32. The method according to claim 30 further comprising the steps of: receiving the transmitted collected state by the safety control unit of the first type; enabling an opening of the brake when the received collected state signals closed by the safety control unit of the first type releasing the brake; and blocking an opening of the brake by the safety control unit of the first type when the received collected state signals not closed.

33. The method according to claim 30 further comprising the steps of: repeatedly transmitting a check communication signal by the safety control unit of the second type to the safety control unit of the first type at a defined time interval; determining that a communication capability between the safety control unit of the first type and the safety control unit of the second type functions upon receipt of the check communication signal by the safety control unit of the first type; and determining a fault condition of the communication capability between the safety control unit of the first type and the safety control unit of the second type when the check communication signal is not received by the safety control unit of the first type after a period of time that is longer than the defined time interval.

34. The method according to claim 33 wherein the defined time interval is at least 2 minutes.

Description

DESCRIPTION OF THE DRAWINGS

[0060] In the drawings:

[0061] FIG. 1: shows a highly simplified and schematic illustration of an elevator comprising an elevator shaft and a car, and

[0062] FIG. 2: shows a schematic block diagram of the safety control system.

DETAILED DESCRIPTION

[0063] FIG. 1 shows an elevator 2. The elevator 2 is shown in a side view. A part of the elevator 2 is shown in a front view, this being indicated by the dot-dash line.

[0064] The elevator 2 comprises a car 4 which can be moved along the shaft 3. The elevator car 4 is held by a support means, the support means being, for example, a cable or a belt. At the other end, the support means is connected to a counterweight. The support means is driven by means of a drive 6.

[0065] The car 4 comprises a car door 15 for opening and closing an access to the car 4. In this embodiment, the car door is opened via an active door drive. The car door drive can be controlled via a safety control unit of a first type 14, which is arranged on the car.

[0066] At least one shaft door 10 is provided on each of the plurality of floors 21, 21, 21. The shaft door 10 can be opened or closed in order to thus allow or block access to the shaft 3. The elevator 2 further comprises an active drive on each shaft door 10. This active drive enables the opening or closing of the shaft door by a lateral displacement of the shaft door leaf. Each of the shaft doors 10 can be controlled by a separate safety control unit of a second type 16.

[0067] The elevator further comprises a car brake 8 on the car 4, the car brake 8 being controlled by the safety control unit of the first type 14.

[0068] One safety control unit of the second type 16 per floor 21, 21, 21 and shaft door 10 is arranged in a yoke of the door frame 25 above the door leaves 27. Also located in this box 25 is a door lock 20 and an active door drive 22, as well as a wireless communication module for wireless connection 26 to the safety control unit of the first type 14, as well as a sensor 36 (see FIG. 2) for monitoring the state of the door lock. The safety control unit of the second type 16 comprises a secure interface 32 and a non-secure interface 34 (see FIG. 2).

[0069] In normal operation of the elevator 2, the car 4 is moved from one floor 21 to another floor 21. In this case, the movement of the elevator car 4 is achieved by the action of the drive 6 on the support means. In this case, the drive 6 is controlled in such a way that the car 4 stops when the corresponding floor is reached. The passengers can now get in or out.

[0070] FIG. 2 shows the safety control system 12 of the elevator 2. The safety control system 12 is subdivided schematically into three regions. A first region 10 (denoted by the border having the reference sign 10) represents the part of the safety control system 12 which is arranged on the shaft doors 10 or in the immediate vicinity of the shaft doors. A second region (denoted by the border having the reference sign 4) represents the part of the safety control system 12 which is arranged on the car 4. Furthermore, a third region exists (border having the reference sign 6), which is the part of the safety control system 12 that is arranged at the drive 6.

[0071] Two identical safety control units of the second type 16, and corresponding sensors 36 and actuators 20, 22, are shown in the region of the shaft doors 10. The secure control unit of the second type 16 is connected via a secure interface 32 and a secure connection 28 both to a first actuator 20 in the form of a door lock and to a sensor 36, this sensor monitoring the state of the door lock 20. Furthermore, the secure safety control unit of the second type 16 is connected, via a non-secure interface 34 and a non-secure connection 30, to further sensors 36, namely a magnetic sensor for detecting a car in the vicinity of the shaft door, and an actuator 22 in the form of a door drive.

[0072] In the region of the car 4, the safety control system 12 comprises a secure safety control unit of the first type 14. This safety control unit 14 is connected to a plurality of sensors 36, four sensors 36 being shown in this embodiment in the lower left corner of the region 4. One camera is connected to the car roof, and one camera is connected to the car floor, as sensors 36 as shown in FIG. 1. In this case, the camera serves at least to monitor the space in which a service technician is working during maintenance. These sensors 36 are connected via a non-secure connection 30 to the safety control unit 14 via the non-secure interface 34 (not shown). Furthermore, an acceleration sensor 36 and an absolute position sensor 36 in the left central area of the region 4 are also connected via a non-secure interface 34 and connection 30. Furthermore, three sensors 36 are connected to the safety control unit 14 via a secure connection 28. Two slack cable sensors 36 are present, and a sensor 36 for determining the weight in the car 4 are these three sensors. The safety control unit 14 is further connected, via a secure connection 28 in each case, to two actuators 8, which are brakes. The safety control unit 14 also comprises a secure connection 28 to a safety control unit of a third type 17 in the region of the drive 6, via which the STO function in the converter can be triggered. The STO function can be triggered in the alternative by the safety control unit 14 through a secure connection 24 to actuators 18.

[0073] Finally, it should be noted that terms such as comprising, including, etc. do not preclude other elements or steps, and terms such as a or an do not preclude a plurality. Furthermore, it should be noted that features or steps which have been described with reference to one of the above embodiments may also be used in combination with other features or steps of other embodiments described above.

[0074] In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.