Elevator installation safety system and method of checking same

Abstract

A safety circuit for an elevator system includes a plurality of switch contacts, at least one first switch contact, and a control unit. The at least one first switch contact can be switched electronically and can be bridged using a conductive bridging element, in particular for maintenance or testing purposes. Additionally, the control unit is directly or indirectly connected to the safety circuit. The at least one first switch contact can be switched on the basis of instructions of the control unit in order to change the state of the safety circuit. In the process, the at least one control unit detects the absence of the state change of the safety circuit, in particular when the at least one first switch contact is being bridged by the bridging element.

Claims

1. A safety system for an elevator installation comprising: a safety circuit including a plurality of switch contacts, wherein a first one of the switch contacts is electronically switchable and can be bridged over with an associated conductive bridging-over element for maintenance purposes or test purposes, a control unit connected with the safety circuit wherein the first switch contact is switched in response to a control signal transmitted by the control unit to change a state of the safety circuit and the control unit detects an absence of the change in state of the safety circuit if the first switch contact is bridged over by the bridging-over element; and a second one of the switch contacts that is electronically switchable and is switched in response to another control signal transmitted by the control unit when the control signal to the first contact is transmitted and no change in state of the safety circuit is detected.

2. The safety system according to claim 1 wherein operation of the elevator installation is interrupted by the control unit when the control signal is transmitted by the control unit to switch the first switch contact and no change in state of the safety circuit is detected by the control unit.

3. The safety system according to claim 1 wherein the control unit stores a fault signal when the control signal is transmitted by the control unit to switch the first switch contact and no change in state of the safety circuit is detected.

4. The safety system according to claim 3 wherein the fault signal includes characteristic information with respect to the first switch contact, wherein the first switch contact is uniquely identifiable based on the characteristic information.

5. The safety system according to claim 1 wherein the first switch contact, after switching in response to the control signal transmitted by the control unit, switches back after a predetermined period of time.

6. The safety system according to claim 5 wherein the predetermined period of time is at least one millisecond.

7. The safety system according to claim 5 wherein the predetermined period of time lasts not longer than 30 seconds.

8. The safety system according to claim 5 wherein the predetermined period of time is between 500 milliseconds and 10 seconds.

9. The safety system according to claim 1 including another control unit, which is associated with a shaft information system of the elevator installation, connected to the safety circuit, wherein the further control unit switches the first switch contact in response to the control signal transmitted by the control unit.

10. The safety system according to claim 1 wherein the switch contacts are connected in series to a relay in a power supply of a main drive of the elevator installation.

11. A method of checking a safety system of an elevator installation, comprising the steps of: switching a first electronically switchable switch contact of a safety circuit in the safety system in response to a control signal transmitted by a control unit for changing a state of the safety circuit; detecting by the control unit an absence of the change in state of the safety circuit if the first switch contact is bridged over by a bridging-over element and switching a second electronically switchable switch contact of the safety circuit in response to another control signal transmitted by the control unit to interrupt operation of the elevator installation when the absence of the change in state of the safety circuit is detected.

12. The method according to claim 11 further comprising a step of interrupting operation of the elevator installation by the control unit when the absence of the change in state of the safety circuit is detected.

13. The method according to claim 11 further comprising a step of storing a fault signal in the control unit when the absence of the change in state in the safety circuit is detected.

14. The method according to claim 11 further comprising a step of switching back the first switched switch contact after a predetermined period of time.

15. The method according to claim 14 wherein the predetermined period of time is at least one millisecond.

16. The method according to claim 14 wherein the predetermined period of time lasts not longer than 30 seconds.

17. The method according to claim 14 wherein the predetermined period of time is between 500 milliseconds and 10 seconds.

18. The method according to claim 11 further comprising a step of switching the first switch contact in response to another control signal transmitted by a further control unit associated with a shaft information system of the elevator installation.

Description

DESCRIPTION OF THE DRAWINGS

(1) The invention is better described in the following by way of embodiments, in which:

(2) FIG. 1 schematically shows a circuit diagram of the safety system according to the invention, comprising a safety circuit of a first embodiment with a control unit; and

(3) FIG. 2 schematically shows a circuit diagram of the safety system according to the invention, comprising a safety circuit of a second embodiment with a further control unit.

DETAILED DESCRIPTION

(4) FIG. 1 shows a safety system comprising a safety circuit 1 with a plurality of switch contacts 10.1, 10.2, 11, 12.1, 12.2 connected in series. The switch contacts 10.1, 10.2, 12.1, 12.2 monitor a state of a safety-relevant component of the elevator such as, for example, a shaft door, a car door, a speed limiting system, an emergency stop switch or a shaft limit switch. In the illustrated example the safety circuit 1 comprises five switch contacts 10.1, 10.2, 11, 12.1, 12.2. The number of switch contacts in the safety circuit 1 is obviously variable and depends on the number of safety-relevant components to be monitored. The safety circuit 1 is in a safe state when all switch contacts 10.1, 10.2, 11, 12.1, 12.2 are closed.

(5) The safety circuit 1 is supplied with power from, for example, a 24V source. In a safe state of the safety circuit 1 a corresponding current flows across the switch contacts 10.1, 10.2, 11, 12.1, 12.2. A relay 13 is connected at one end of the safety circuit 1 with the same and with a 0V conductor. The relay 13 comprises a switching magnet 13.1 and a switch 13.2, the latter being integrated in a power supply 20 of a main drive 21. The switching magnet 13.1 switches the associated switch 13.2 in correspondence with a switch state of the safety circuit 1. In that case the energized switching magnet 13.1 keeps the switch 13.2 closed. As soon as a switch contact 10.1, 10.2, 11, 12.1, 12.2 of the safety circuit 1 is open and the current flow in the safety circuit 1 is interrupted, the power feed to the switching magnet 13.1 is also interrupted. As a consequence, the associated switch 13.2 is opened and the power supply 20 to the main drive 21 interrupted.

(6) In the depicted illustration, two bridging-over elements 14.1, 14.2 which bridge over the two switch contacts 10.1, 10.2 are inserted. This is carried out, for example, for testing purposes or maintenance purposes of the elevator installation so as to permit certain travel states which otherwise are not permitted in a normal operating mode. After the conclusion of such tests or maintenance operations the bridging-over elements are removed again so as to guarantee safe operation of the elevator installation in a normal mode. Before the elevator installation is again operable in the normal mode it is checked whether the bridging-over elements 14.1, 14.2 have actually been removed.

(7) For that purpose the safety circuit 1 is connected with a control unit 30, preferably the main control unit of the elevator installation. The control unit 30 can on the one hand recognize the state of the safety circuit 1 by way of the line 31 and on the other hand transmit control signals for switching the switch contacts 10.1, 10.2, 11. This action of the control unit 30 on the switch contacts 10.1, 10.2, 11 is illustrated in FIGS. 1 and 2 by dashed lines.

(8) In a test the two switch contacts 10.1, 10.2 are switched by the control unit 30 into an open state. If the two bridging-over elements 14.1, 14.2 have been removed, this opening causes interruption of the safety circuit 1. This interruption can be recognized by the control unit 30. Accordingly, the expectation of the control unit 30 has been fulfilled and the elevator installation can be safely operated in the normal mode. The switch contacts 10.1, 10.2 are preferably opened in a predetermined sequence so as to individually test each switch contact 10.1, 10.2.

(9) Conversely, the expectation of the control unit is not fulfilled if opening of the switch contacts 10.1, 10.2 does not lead to interruption of the safety circuit 1. In such a case it has to be assumed that removal of one or both of the bridging-over elements 14.1, 14.2 has not taken place. Accordingly, opening of the switch contacts 10.1, 10.2 has no effect on the state of the safety circuit 1. For reasons of safety this is not acceptable in the normal mode. Accordingly, the control unit 30 opens the safety contact 11 so as to prevent further operation of the elevator installation.

(10) In the case of a negative test result a fault signal can be stored in a data memory unit of the control unit 30. Advantageously, the fault signal contains characteristic information, particularly a unique address about which switch contact or contacts 10.1, 10.2 is or are bridged over. This makes it possible for a maintenance engineer to quickly localize and remove an overlooked bridging-over element 14.1, 14.2.

(11) After a predetermined period of time the two switch contacts 10.1, 10.2 are switched back or closed. In that case the time period is at least 1 millisecond and preferably at most 30 seconds. A particularly preferred duration of this time period is 500 milliseconds to 10 seconds. The switch contacts 10.1, 10.2 comprise a resetting unit for the resetting.

(12) Such a resetting unit is preferably designed as a time relay or monoflop. In that case, the resetting unit is settable to a specific time period. After expiry of this time period the resetting unit triggers resetting of the associated switch contact 10.1, 10.2.

(13) The safety circuit 1 can obviously also have additional switch contacts 12.1, 12.2 which are not switchable by means of a control unit 30. Such non-switchable switch contacts 12.1, 12.2 preferably do not have to be bridged over for maintenance operations. These switch contacts 12.1, 12.2 monitor, for example, the state of shaft doors or car doors as well as an emergency switch. The safety circuit 1 is accordingly designed in such a way that within the scope of maintenance preferably only electronically switchable switch contacts 10.1, 10.2 have to be bridged over by means of a bridging-over element 14.1, 14.2.

(14) FIG. 2 shows an alternative embodiment of the safety system with an additional control unit 40. By contrast to the first embodiment according to FIG. 1 the two switch contacts 10.1, 10.2 are activated by the control unit 40. The control unit 40 is connected with the control unit 30 by way of a line 32. The control unit 40 obtains control signals from the control unit 30 by way of this line 32.

(15) In this alternative embodiment the test of the switch contacts 10.1, 10.2 is similarly triggered by the control unit 30 in that the control unit 30 transmits to the control unit 40 by way of the line 32 a control signal for opening the switch contacts 10.1, 10.2. The control unit 40 correspondingly opens the switch contacts 10.1, 10.2 so as to check whether the two bridging-over elements 14.1, 14.2 have been removed.

(16) If a further control unit 40 is present, resetting of the associated switch 10.1, 10.2 can be triggered by the control unit 40. It is therefore possible to dispense with the resetting units of the first embodiment in the design of the safety system. Resetting of the switch contacts 10.1, 10.2 can be triggered not just on the basis of elapsing of a period of time, but alternatively or optionally also on the basis of checking a condition. The test otherwise takes place analogously to the first embodiment.

(17) The control unit 40 is, for example, associated with a shaft information system. The shaft information system has data with respect to the speed and position of an elevator car available. Accordingly, the switch contact 10.1 is switchable on the basis of excess speed of the elevator car and the switch contact 10.2 is designed as a limit switch. The switch contact 10.1 is to be bridged over in the case of a safety braking test and the switch contact 10.2 in the case of test travel onto a buffer. Accordingly, a condition for resetting the switch contact 10.1 is linked to maintenance of a permissible car speed and resetting of the switch contact 10.2 is linked to maintenance of a permissible car position between two end positions in the shaft.

(18) In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.