SAFETY SWITCHING FOR AN ELEVATOR SYSTEM

Abstract

A safety switching for elevator systems includes a safety function and a safety switch dedicated to the safety function. The safety switch opens or closes a safety circuit between one connection point and a second connection point as a function of a safety state of the safety function. A test function tests whether or not the safety switch opens and closes the safety circuit as a function of the safety state of the safety function. A detection device is provided for the test function. An auxiliary energy function is provided wherein an auxiliary voltage can be temporarily applied via at least the safety switch and an input part of the detection device for performing the test function. Locally between the connection points the auxiliary energy function introduces an auxiliary energy for generating the auxiliary voltage. The safety switching can be used for converting or retrofitting an existing elevator system.

Claims

1-15. (canceled)

16. A safety switching for an elevator system having a safety function, a safety switch assigned to the safety function, the safety switch opening and closing a safety circuit between a first connection point and a second connection point as a function of a safety state of the safety function, a test function for testing the safety function by testing whether the safety switch can open and close the safety circuit as a function of the safety state of the safety function, wherein the test function opens and closes the safety switch, comprising: a detection device for the test function; an auxiliary energy function for applying an auxiliary voltage, at least temporarily, via the safety switch and an input part of the detection device to enable performance of the test function; and wherein between the first connection point and the second connection point the auxiliary energy function introduces into the safety circuit auxiliary energy to generate the auxiliary voltage.

17. The safety switching according to claim 16 including a control unit that triggers the test function and evaluates a test signal received from the detection device, the test signal being associated with the test function.

18. The safety switching according to claim 16 wherein the auxiliary energy function introduces the auxiliary energy into the safety circuit locally by electromagnetic induction between the first connection point and the second connection point.

19. The safety switching according to claim 16 including an isolating transformer associated with the auxiliary energy function, wherein an output winding of the isolating transformer is connected in series with the safety switch between the first connection point and the second connection point.

20. The safety switching according to claim 19 including directional diodes forming a closed current circuit with the output winding of the isolating transformer and the safety switch inside a sub-circuit between the first connection point and the second connection point.

21. The safety switching according to claim 16 including an isolating transformer associated with the auxiliary energy function, wherein an output winding of the isolating transformer is arranged in a sub-circuit between the first connection point and the second connection point, and wherein the isolating transformer is excluded, by at least one capacitor of the sub-circuit, from a direct current path between the first connection point and the second connection point.

22. The safety switching according to claim 16 wherein the detection device has an output part and the input part of the detection device and the output part of the detection device are galvanically separated from one another.

23. The safety switching according to claim 22 wherein the detection device includes an optocoupler, wherein the input part of the detection device is a radiation transmitter of the optocoupler and the output part of the detection device is a radiation receiver of the optocoupler.

24. The safety switching according to claim 22 wherein the detection device includes a magnetic coupler, wherein the input part of the detection device is a coil form of the magnetic coupler and the output part of the detection device is a magnetic field detector of the magnetic coupler.

25. The safety switching according to claim 16 including an isolating transformer associated with the auxiliary energy function, wherein an output winding of the isolating transformer is connected in series with the safety switch between the first connection point and the second connection point, and wherein the detection device detects an induced current in an input winding of the isolating transformer or in the output winding.

26. The safety switching according to claim 16 wherein the safety function checks a correct retardation of an elevator car before a final stopping point is reached or checks for a correctly closed elevator car door for travel of the elevator car.

27. The safety switching according to claim 16 including a plurality of safety functions, a plurality of safety switches for the plurality of safety functions, wherein the test function tests the safety functions to determine whether the safety switches open and close the safety circuit as a function of the safety states of the safety functions, and wherein the auxiliary voltage is applied via the safety switches and the input part of the detection device.

28. A method for converting or retrofitting an existing elevator system by adding at least one of the safety switching according to claim 16.

29. An elevator system having an elevator car, a travel space provided for travel of the elevator car and a plurality of floor doors, wherein at least one safety circuit monitors at least one of the elevator car and the floor doors, and including at least one of the safety switching according to 16 connected to the at least one safety circuit.

30. A method for testing at least one safety function of a safety circuit in a system for conveying people and/or goods, the testing being performed with the safety switching according to claim 16, comprising the steps of: introducing the auxiliary energy into the safety circuit over a test timeslot; opening of the safety switch via the test function; detecting the opening of the safety switch via the detection device; closing of the safety switch via the test function; and detecting the closing of the safety switch via the detection device.

Description

DESCRIPTION OF THE DRAWINGS

[0030] Preferred examples of embodiment of the invention are explained in greater detail in the following description with the aid of the appended drawings, in which corresponding elements are provided with corresponding reference numbers. In the figures:

[0031] FIG. 1 shows an elevator system with a safety switching on a safety circuit in a partial diagrammatic representation corresponding to a possible embodiment of the invention;

[0032] FIG. 2 shows a safety switching for the elevator system represented in FIG. 1 corresponding to a first example of embodiment of the invention;

[0033] FIG. 3 shows a safety switching for the elevator system represented in FIG. 1 corresponding to a modified first example of embodiment of the invention;

[0034] FIG. 4 shows a safety switching for the elevator system represented in FIG. 1 corresponding to a second example of embodiment of the invention; and

[0035] FIG. 5 shows a signal flowchart to explain the mode of functioning of a possible embodiment of a safety switching of the invention.

DETAILED DESCRIPTION

[0036] FIG. 1 shows an elevator system 1 with a safety switching 2 on a safety circuit 3 in a partial diagrammatic representation corresponding to a possible embodiment of the invention. Elevator system 1 is a preferred embodiment of a system 1 for conveying people and/or goods. Elevator system 1 comprises an elevator car 4 and an elevator shaft 5. Elevator car 4 can be moved in a travel space 6 provided for the travel of elevator car 4. Travel space 6 is part of elevator shaft 5. Safety switching 2 is particularly well suited for such an elevator system 1.

[0037] Furthermore, elevator system 1 comprises a drive motor unit 7 with a drive pulley 8 and a counterweight 9. Elevator car 4 is suspended on a traction means 10, which at the same time serves as a support means 10. Traction means 10 is passed around a deflection pulley 11 and around drive pulley 8. Furthermore, traction means 10 is connected to counterweight 9.

[0038] For the sake of simplified representation, only a top floor 12 and a bottom floor 13 are represented in FIG. 1. Buffers 14, 15 are arranged in elevator shaft 5 in the region of bottom floor 13, against which buffers elevator car 4 or counterweight 9 collide in the event of a malfunction. A floor door 16 is provided at floor 12. A floor door 17 is provided at floor 13.

[0039] Safety circuit 3 is represented essentially with regard to its electrical connections. A safety monitoring unit 20 and a safety monitoring unit 21 are integrated via electrical lines 18 and via electrical lines 19 into safety circuit 3. A safety switch 22 is provided for safety monitoring unit 20, which monitors floor door 16. A safety switch 23 is provided for safety monitoring unit 21, which monitors floor door 17. Safety monitoring units 20, 21 can be designed conventionally. Safety switches 22, 23 can be mechanical safety switches 22, 23.

[0040] Safety switching 2, on the other hand, is constituted corresponding to a possible example of embodiment of the invention. A first example of a possible embodiment of safety switching 2 is described in greater detail with the aid of FIG. 2. A second example of a possible embodiment of safety switching 2 is described in greater detail with the aid FIG. 4.

[0041] Safety switching 2 represented in FIG. 1 is integrated into safety circuit 3 via an electrical line 30 and an electrical line 31. A first connection 32 and a second connection 33 are illustrated here, at which the electrical connection to the rest of safety circuit 3 takes place. Electrical lines 30, 31 are represented in FIG. 1 in a simplified form with regard to their electrical function. To provide the electrical connection, suitable cables can be provided, which are suspended in elevator shaft 5, so that elevator car 4 can be traversed through travel space 6 while the electrical connection to safety circuit 3 remains in place. Such electrical lines suspended in elevator shaft 5 can be a component part of electrical lines 30, 31 or can also be assembled as separate, additional electrical connection elements. Other possible options are however also conceivable for integrating safety switching 2 into safety circuit 3. Furthermore, in a modified embodiment, it is possible for more than one safety circuit 3 to be provided. In particular, stationary devices, such as floor doors 16, 17, can thus be monitored via stationary safety monitoring units 20, 21, which are incorporated into a separate safety circuit.

[0042] Safety switching 2 comprises a first safety switch 34 and a second safety switch 35. First safety switch 34 is used for a retardation control device 36. Second safety switch 35 is used to monitor elevator car door 37. These applications of safety switches 34, 35 represent possible applications for implementing safety functions on elevator car 4. One or more safety functions of safety switching 2 can be implemented in this or another way.

[0043] Retardation control device 36 is arranged on elevator car 4. Retardation control device 36 can also be retrofitted on an existing elevator car 4. Retardation control device 36 cooperates with a measuring tape 38, on which codes are provided. Retardation control device 36 detects the current position of elevator car 4 in travel space 6 from the codes provided on measuring tape 38. In particular, a distance from a ceiling 39 or from a floor 40 of elevator shaft 5 can thus be determined. In a modified embodiment, such a retardation control device 36 can also be based on another principle. For example, retardation control device 36 can employ the principle of a radar using electromagnetic radiation, for example to detect the distance from ceiling 39 and/or from floor 40.

[0044] Retardation control device 36 can monitor, particularly in the region of top floor 12 and bottom floor 13, the reliable braking of elevator car 4. A safety function is thus implemented, which prevents a collision with ceiling 39 or a violent crash of elevator car 4 at buffer 14 and/or of counterweight 9 at buffer 15. For this purpose, retardation control device 36 actuates first safety switch 34 if the retardation is too small. When the first safety switch is actuated and thus opened, an emergency stop is triggered during normal operation by safety circuit 3.

[0045] Second safety switch 35 is correspondingly actuated when elevator car door 37 is opened. If elevator car 4 stops at one of floors 12, 13, second safety switch 35 can then be bridged. If, however, elevator car 4 is moving through travel space 6, an emergency stop is triggered by safety circuit 3 when second safety switch 35 is opened.

[0046] Operation of elevator system 1 is understood here to mean that a main energy supply is present to an extent such that a device 45 of safety circuit 3 monitors the opening of one of safety switches 22, 23, 34, 35 or can check the proper functioning of a safety switch 22, 23, 34, 35. During the operation of elevator system 1, a direct voltage 46 is applied to safety circuit 3 and a check is made to establish whether a current connection arises. The application of direct voltage 46 can take place repeatedly within a certain time interval and thus only for a short test period.

[0047] When elevator system 1 is put out of operation, it means here that device 45 is de-energized at least to an extent such that a possible opening of a safety switch 22, 23, 34, 35 cannot be detected.

[0048] When elevator system 1 is thus put out of operation, possibly occurring safety functions cannot be tested by device 45 of safety circuit 3. However, such a test is possible locally via safety switching 2 corresponding to the examples of embodiment of the invention. This enablement of the testing is represented here by way of example with the aid of safety switching 2. Safety monitoring units 20, 21 are regarded here as conventional safety monitoring units 20, 21, which can be tested only by device 45. It goes without saying, however, that the operating principle of safety switching 2, which enables a local check, can also be implemented in a corresponding way on other safety monitoring units of elevator system 1, in particular on safety monitoring units 20, 21. Depending on the application, differently constituted safety switchings 2 can be employed at the given point of use.

[0049] In this example of embodiment, safety switching 2 is partially accommodated in a housing 47. Other components, in particular an elevator control, can also be accommodated in housing 47. Safety switching 2 can also be partially integrated into the elevator control.

[0050] FIG. 2 shows a safety switching 2 for elevator system 1 represented in FIG. 1 corresponding to a first example of embodiment of the invention. Safety switching 2 comprises a control unit 48, which can be implemented by an integrated circuit 48. An auxiliary energy function H can be activated via a control unit 48. When auxiliary energy function H is activated, an auxiliary signal 49 is generated with or without a direct voltage component and an alternating current component of a suitable waveform. Auxiliary signal 49 can for example be constituted as a rectangular signal or a sinusoidal signal. Safety switching 2 also comprises an isolating transformer 50 with an input winding 51 and an output winding 52. Auxiliary signal 49 is conveyed via input winding 51. An auxiliary voltage is as induced in output winding 52.

[0051] Safety functions A, B are implemented in this example of embodiment. In a modified embodiment, just one safety function A can be implemented. Furthermore, more than two safety functions A, B can be implemented. Each of safety functions A, B is assigned to a safety switch 34, 35. In this example of embodiment, first safety switch 34 is provided for retardation control device 36. And second safety switch 35 is provided for elevator car door 37. The number of safety switches 34, 35 usually agrees with the number of safety functions A, B.

[0052] When safety switches 34, 35 are closed, a current flow in a sub-circuit 53 of safety switching 2 is produced via the induced auxiliary voltage. Sub-circuit 53 is located completely inside the region between connections 32, 33. A local current flow thus arises. At least one directional diode 54 and at least one directional diode 55 are arranged in sub-circuit 53. Moreover, at least one directional diode 56 is also arranged in electrical line 30, which however is located outside sub-circuit 53. The at least one directional diode 56 is namely provided for the check by means of device 45, wherein however it is now assumed that elevator system 1, as defined above, is out of operation.

[0053] As a result of the switching, a voltage drop at the at least one directional diode 55 occurs with closed safety switches 34, 35. In this example of embodiment, the voltage drop results from the threshold voltage or the sum of the threshold voltages of the at least one directional diode 55, when the at least one directional diode 55 is actuated into the forward direction.

[0054] Furthermore, a detection device 57 is provided with an input part 58 and an output part 59. Input 58 comprises a photodiode 58, which is operated with the voltage drop at the at least one directional diode 55. A phototransistor 60 is assigned to photodiode 58. Phototransistor 60 is actuated at its base via photodiode 58 and supplied via resistor 61 from a voltage source 62. When phototransistor 60 is switched into the forward direction as a result of the actuation via photodiode 58, an input signal E is switched to earth. When, on the other hand, phototransistor 60 is blocking, input signal E lies on the positive voltage of voltage source 62.

[0055] In this example of embodiment, an optocoupler 58, 60 is implemented via photodiode 58 and phototransistor 60. A photodiode 58 is an example of embodiment of a radiation transmitter 58 of optocoupler 58, 60. Phototransistor 60 is a possible embodiment of a radiation receiver 60 of optocoupler 58, 60. A galvanic isolation between input part 58 and output part 59 is brought about by optocoupler 58, 60.

[0056] A galvanic isolation between input winding 51 and output winding 52 correspondingly results via isolating transformer 50. The earth on the side of control unit 48 is independent of a possible earth of safety circuit 3 on the side of connections 32, 33.

[0057] The auxiliary energy, which is introduced by auxiliary energy function H into safety circuit 3 locally between connection point 32 and the at least one further connection point 33 to generate the auxiliary voltage in sub-circuit 53, is thus introduced locally by means of electromagnetic induction. The feedback also takes place locally and by way of a galvanic isolation.

[0058] For the testing of safety functions A, B, control unit 48 comprises a test function T. Detection device 57 is provided locally for test function T. The evaluation takes place by control unit 48. A possible embodiment of a method for testing safety functions A, B is described in greater detail with the aid of FIG. 5.

[0059] FIG. 3 shows a safety switching for the elevator system represented in FIG. 1 corresponding to a modified example of embodiment of the invention. The design of safety switching 2 differs from the embodiment described in FIG. 2 in that detection device 57 is arranged in the primary circuit of auxiliary energy function H or its isolating transformer 50. In a variant of embodiment, a first effect is used. A pulse is introduced in the primary circuit of isolating transformer 50 and a corresponding reflection is awaited. This only occurs if current can flow on the secondary side, i.e. if safety switch 34, 35 is closed. Consequently, if no reflection can be detected or measured, safety switch 34, 35 is in fact opened. Opening of safety switch 34, 35 accordingly brings about an absence of the reflection. The control and evaluation of the pulse sequence and the reflection takes place once again by control unit 48. In an alternative variant of embodiment, another effect is used. A pulse, a pulse sequence or an AC signal is introduced on the primary side of isolating transformer 50 and a current or an inductance of the primary coil is measured. A higher current, or a smaller inductance, shows that current can flow in the secondary side and the safety switch is closed. On the other hand, a smaller current, or a greater inductance, shows that no current is flowing in the secondary side and consequently the safety switch is opened. Control unit 48 controls the pulse sequence and compares the state with an opened and closed safety switch 34, 35 with one another and thus tests the extent to which safety switch 34, 35 has actually opened.

[0060] FIG. 4 shows a safety switching 2 for elevator system 1 represented in FIG. 1 corresponding to a further example of embodiment of the invention.

[0061] In this example of embodiment, the auxiliary voltage is induced in a sub-circuit 63 between connection point 32 and the at least one further connection point 33. In the first example of embodiment described with the aid of FIG. 2, output winding 52 of isolating transformer 50 is located between connections 32, 33 in a series connection with safety switches 34, 35 and the at least one directional diode 55. In the second example of embodiment described with the aid of FIG. 4, however, an isolation is provided via at least one capacitor 64, 65. This means that the test taking place via safety circuit 3 pursues the current path not via output winding 52 during operation of elevator system 1. In this example of embodiment, isolating transformer 50 is thus excluded by capacitors 64, 65 from a direct current path between connection point 32 and the at least one further connection point 33.

[0062] Detection device 57, as explained in connection with FIG. 2, is provided with an input part 58 and an output part 59. In contrast with the embodiment of FIG. 2, input part 58m comprises a coil form 58m which is directly integrated into sub-circuit 63. A Hall sensor or a magnetic field detector 60m is arranged in the coil form. Magnetic field detector 60m is used to test the interruption of the current circuit and therefore a correct opening of safety switches 34, 35 of safety functions A, B. This represents an alternative to the optocoupler according to FIG. 2. These two principles are essentially interchangeable. To simplify the representation, control unit 48 is likewise not shown.

[0063] FIG. 5 shows a signal diagram to explain the mode of functioning of a possible embodiment of safety switching 2 of the invention. In a method for testing safety functions A, B, such tests can be repeated at a certain time intervals. To simplify the representation, auxiliary energy functions H, safety functions A, B and input signal E, which are plotted on the ordinate, are illustrated coded in a binary manner. Time t is plotted on the abscissa.

[0064] It is assumed here that voltage source 62 is permanently switched on. In a modified embodiment, voltage source 62 can however also be switched off temporarily between the test procedures. Auxiliary energy function H is not required until point in time t.sub.1. Since no auxiliary energy is introduced into safety circuit 3, photodiode 58 remains de-energized, so that phototransistor 60 is blocking. Input signal E is therefore set to 1 corresponding to voltage source 62. At point in time t.sub.1, auxiliary energy function H is required and is therefore set to 1 in this signal diagram. Test function T, however, activates neither of safety functions A, B between points in time t.sub.1 and t.sub.2. Safety switches 34, 35 therefore remain closed. As a result of the introduction of the auxiliary energy, an auxiliary voltage arises which activates optocoupler 58, 60 via the voltage drop at the at least one directional diode 55. Phototransistor 60 thus switches to earth, so that input signal E is set to 0.

[0065] For the test, safety function A is activated between point in time t.sub.2 and point in time t.sub.3. Opening of first safety switch 34 thereby takes place. This signifies an interruption of the current flow at input part 58. Input signal E is accordingly set to 1.

[0066] Safety function A is again deactivated between points in time t.sub.3 and t.sub.4, so that the same situation as between points in time t.sub.1 and t.sub.2 results.

[0067] Safety function B is activated between points in time t.sub.4 and t.sub.5, so that in this case second safety switch 35 interrupts the current flow through photodiode 58. Input signal E is thus again set to 1.

[0068] Safety functions A, B are not activated between points in time t.sub.5 and t.sub.6, so that optocoupler 58, 60 is active and input signal E is switched to earth. Input signal E is therefore 0.

[0069] A simultaneous activation of safety functions A, B can then optionally take place. This is represented here between points in time t.sub.6 and t.sub.7. Here, the current flow through input part 58 is again interrupted, so that input signal E is set to 1. Auxiliary energy function H is deactivated at point in time t.sub.7.

[0070] From the described signal diagram, control unit 48 determines that safety functions A, B are operating reliably. Control unit 48 can deduce from a deviation from the described signal diagram that a fault is present. A small energy requirement arises here, since the energy supply for performing the method has to be consumed for the testing in each case only for short time intervals (test timeslots) between points in time t.sub.1 and t.sub.7. An associated test cycle (test timeslot) can amount for example to 5 milliseconds and can be repeated every 5 seconds. Since the test can take place with a small alternating voltage of for example 1.4 V, a negligible power results, which can be less than 30 milliwatts. A reliable test with low energy consumption can thus take place by the temporary application of the auxiliary voltage via safety switches 34, 35 and input part 58 of detection device 57.

[0071] Local monitoring of safety switching 2 can thus be carried out during a stoppage of elevator system 1 in which safety circuit 3 is out of operation. If for example a building is not opened overnight or between work days and a fault occurs in this period, this can be detected in good time in a test. A test is in particular carried out to establish whether safety switches 34, 35 open and close the safety circuit as a function of the safety state of safety functions A, B. If one of safety switches 34, 35 fails, this failure is then detected for example by way of the described test cycle. A service engineer can then remove the fault in good time.

[0072] The invention is not limited to the described examples of embodiment and modifications.

[0073] In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.