LIFT SYSTEM HAVING A PLURALITY OF CARS AND A DECENTRALISED SAFETY SYSTEM

Abstract

The disclosure relates to an elevator system consisting of a plurality of elevator carriages, a shaft system, a drive system for separately moving the elevator carriages within the shaft system, as well as a safety system having a plurality of safety nodes designed to bring the elevator system into a safe operating mode if an operating mode of the elevator system, which deviates from the normal operation mode, is detected. The elevator carriages, the shaft system and the drive system form a functional unit. One of the safety nodes is always assigned to one of the functional units, wherein the safety nodes are each connected to at least another safety node through an interface for transmitting data. Each safety node includes at least one sensor, which detects an operating parameter of the corresponding assigned functional unit. A control unit evaluates the operating parameter detected by one of the sensors of the respective safety node and, taking into account the data transmitted by at least another safety node.

Claims

1. An elevator system comprising: a plurality of elevator carriages; a shaft system enabling a loop operation of the elevator carriages; at least one drive unit; and a safety system with a plurality of safety nodes, wherein the safety system brings the elevator system into a safe operating mode whenever an operating mode of the elevator system deviates from a normal operating mode, wherein the elevator carriages, the shaft system and at least one drive unit each form at least one functional unit, and wherein at least one drive unit can be operated section-wise in the shaft, in such a way that the elevator carriages can be moved independently of each other in defined sections of the shaft system, wherein each of the defined sections is a functional unit (4) of the drive unit; wherein at least one of the safety nodes is assigned to each of the functional units, wherein the safety nodes are each connected to at least one of the other safety nodes through at least one interface for transferring data, the safety nodes in each case including at least one sensor to record an operating parameter of the correspondingly assigned functional unit, and the safety nodes each include at least one control unit, which is designed to analyze the operating parameter recorded by at least one sensor of the corresponding safety node and, taking into consideration the transmitted data from at least another safety node, to make an assessment of a possible deviation from the normal operating mode.

2. The elevator system according to claim 1, wherein the shaft system has at least two vertically extended transportation routes, along which the elevator carriages can be moved vertically, as well as at least two transfer units for displacing the elevator carriages, wherein each of the transfer units is a functional unit of the shaft system, which in each case is assigned to at least one of the safety nodes.

3. The elevator system according to claim 2, wherein the transportation routes are rails, along which the elevator carriages using at least one linear drive as the drive unit are movable, and each rail with at least one rotatable segment for a vertical transportation is designed as a transfer unit, wherein these rotatable segments can be arranged relative to one another, such that an elevator carriage of the elevator system can be moved along the segments between the rails.

4. The elevator system of claim 1 wherein the functional units each contain at least one safety device, which, by triggering, can bring the corresponding functional unit into a safe operating mode and can be directly controlled by the control unit of the safety node assigned to the corresponding functional unit.

5. The elevator system according to claim 1, wherein a plurality of monitoring rooms is defined for the shaft system, wherein each monitoring room is assigned a plurality of functional units, wherein the safety nodes of the functional units in a monitoring room are connected to at least one interface for transferring data.

6. The elevator system of claim 1 wherein the elevator system is designed to be partially deactivatable, in such a way, that individual units or groups of functional units can be deactivated, wherein the elevator system is further adapted to continue to be operational with non-deactivated functional units.

7. The elevator system of claim 1 wherein each section of the shaft system including at least one a shaft door is a functional unit, to which a safety node is assigned.

8. The elevator system according to claim 7, wherein the safety node, to which the section of the shaft system as a functional unit and including at least one shaft door, contains at least one sensor, which is designed to record a deviation from the normal operating mode of this functional unit, wherein the safety system of the elevator system is designed to deactivate this functional unit if such an operation condition that deviates from the normal operation conditions is recorded, and the elevator carriages of the elevator system are only moved outside of the section of the shaft system having at least one shaft door.

9. The elevator system of claim 1 wherein the control unit of a safety node, assigned to an elevator carriage as a functional unit, is designed to continually calculate a first stop point for the first direction of travel of the elevator carriage and to continually calculate a second stop point for the other direction of travel, wherein the corresponding stop point indicates the position at which the elevator carriage can stop, if necessary, in each direction of travel.

10. The elevator system of claim 9 wherein the safety node, assigned to the elevator carriage as a functional unit, is thus designed, such that the calculated initial stop points are always at least transmitted via an interface to the safety node, which is assigned to the adjacent elevator carriage in the first direction of travel, and the calculated second stop points are always at least transmitted via an interface to the corresponding safety node, which is assigned to the adjacent elevator carriage in the second direction of travel.

11. The elevator system according to claim 10, wherein the control unit of a safety node, assigned to the elevator carriage as a functional unit, is designed such that the distance between the first stop point of this elevator carriage and the second stop point of the adjacent elevator carriage in the first direction of travel is determined and the distance between the second stop point of this elevator carriage and the first stop point of the adjacent elevator carriage traveling in the second direction is determined, wherein, if a negative distance is calculated, the safety system of the elevator system brings the system into a safe operating mode.

Description

BRIEF DESCRIPTION OF THE FIGURES

[0049] Further advantages, features and details of the embodiments of the invention will be explained in more depth in connection with the embodiments shown in the Figures. These show:

[0050] FIG. 1 An embodiment for an elevator system according to the invention in a simplified diagrammatic layout;

[0051] FIG. 2 an embodiment for an assignment of safety nodes to the functional units with an embodiment variant in an elevator system according to the invention in a simplified diagrammatic layout;

[0052] FIG. 3 a detail of an embodiment for an elevator system according to the invention in a simplified diagrammatic layout;

[0053] FIG. 4 an further embodiment for an elevator system according to the invention in a simplified diagrammatic layout;

[0054] FIG. 5 an embodiment for an elevator carriage for use in an elevator system shown in FIG. 4, with stop points shown by way of example, in a simplified diagrammatic layout.

DETAILED DESCRIPTION

[0055] FIG. 1 shows a simplified elevator system 1 with a plurality of elevator carriages 2 and a shaft system 3. The elevator carriages 2 can be moved separately in a first direction of travel 6 (shown symbolically by a single arrow 6) and in a second direction of travel 7 (shown symbolically by a double arrow 7), in other words largely independent of each other. The elevator carriages 2 hereby form a functional unit of the elevator system 1 in each case. The shaft system 3 of the elevator system 1 is designed such that a loop operation of the elevator carriages 2 is possible. This means that the elevator carriages 2 in particular can be moved all in the first direction of travel 6 or all in the second direction of travel 7.

[0056] The elevator system 1 shown in FIG. 1 comprises a linear drive with a plurality of linear motor segments 4 to move the elevator carriages 2, whereby each of the linear motor segments 4 is a functional unit of the drive system for the elevator system 1. Through these linear motor segments 4, which can be activated and deactivated individually, the drive system of the elevator system 1 is advantageously designed to be operated section-wise in the shaft, in particular in such a way that the elevator carriages 2 can be moved independently in defined sections of the shaft system, whereby each of the linear motor segments 4 forms such a defined section and each is hereby a functional unit of the drive system.

[0057] The shaft system 3 of the elevator system 1 comprises a plurality of shaft doors 5, whereby the sections of the shaft system 3 comprising a shaft door 5 each forms a functional unit of the elevator system 1.

[0058] The elevator system 1 shown in FIG. 1 also comprises a safety system (not shown explicitly in FIG. 1) with a plurality of safety nodes (not shown explicitly in FIG. 1). At least one of the safety nodes is assigned one of the functional units, in other words and in particular an elevator carriage 2, at least one linear motor segment 4 and at least one section of the shaft comprising one shaft door 5. The safety nodes are hereby advantageously each connected to at least one of the other safety nodes via an interface to transmit data, for example a communication bus or wireless via an air interface. The safety nodes each comprise at least one sensor (not shown explicitly in FIG. 1) to record an operating parameter of the correspondingly assigned functional unit. For example it is envisaged that the position, speed, acceleration and load capacity of an elevator carriage be recorded as operating parameters.

[0059] Furthermore, it is envisaged that each of the safety nodes comprises at least one control unit (not shown explicitly in FIG. 1), which is designed to analyze the operating parameters recorded by the at least one sensor of the corresponding safety node. The control unit is advantageously further designed to take a decision with respect to an operating mode that deviates from a normal operating mode, taking into account this analysis and the data transmitted from the at least one further safety node.

[0060] The safety system of the elevator system 1 is thus advantageously designed to bring the elevator system into a safe operating mode if an operating mode of the elevator system 1, which deviates from a normal operating mode, is detected. A normal operating mode is hereby in particular error-free operation. A safe operating mode of the elevator system 1 is an operating mode into which the elevator system 1 is brought in the event of an error or danger. In particular, it is envisaged that in such a safe operating mode, at least one of the functional units of the elevator system 1 is deactivated. For example, at least one linear motor segment 4 can hereby be switched off and/or at least one elevator carriage 2 stopped by triggering an emergency braking and/or one section of the shaft system 3 comprising at least one shaft door 5 is not longer accessed by the elevator carriages 2.

[0061] The safety system for an elevator system designed according to the invention will be explained in more detail with reference to FIG. 2. To this end, FIG. 2 shows diagrammatically a plurality of elevator carriages 2 as functional units of the elevator system, a plurality of sections of the shaft 8, each of which forms a functional unit of the shaft system, and a plurality of transfer units 9, which are designed to transfer elevator carriages 2 between different transportation routes, in particular different shafts of the shaft system, as further functional units of the shaft system.

[0062] The functional units 2, 8, 9 each have a safety node 10, 10′, 10″, whereby these safety nodes 10, 10′, 10″ are part of the safety system of the elevator system. The safety nodes 10, 10′, 10″ are hereby connected to each other via an interface 11 to transmit data (shown symbolically in FIG. 2 by arrows 26), whereby a safety protocol is preferably envisaged for the transmission 26.

[0063] The safety nodes 10, 10′, 10″ each comprises sensors to record operating parameters of the corresponding functional unit. The operating parameters recorded by the sensors 12, 13, 14, 15, 19, 20, 21 of a safety node 10, 10′, 10″ as well as data sent by other safety nodes to a safety node are hereby transmitted to a control unit (not shown explicitly in FIG. 2) of the safety node. The control unit, for example a correspondingly programmed micro controller circuit, hereby analyzes the data. In addition, the control unit is designed to trigger a safety device assigned to the corresponding functional unit 2, 8, 9 and this bring the elevator system into a safe operating mode. The transmission of data in a functional unit 2, 8, 9 is shown symbolically in FIG. 2 by the arrows 27. A data transmission can also be bidirectional, in other words opposite to the direction of the arrows 27.

[0064] The safety components, in particular the safety devices as well as the control units that trigger the safety devices, are advantageously positioned locally at the functional units 2, 8, 9, preferably directly on the actuators and sensors. This advantageously avoids real time communication over long distances.

[0065] Safety nodes are advantageously distributed in vertical and horizontal shafts of the shaft system of an elevator system. These hereby advantageously record the conditions of the shaft components. With reference to the functional unit shaft section 8, which is always assigned a safety node 10′, the conditions of the shaft doors are recorded, for example, by sensors 15.

[0066] The safety nodes are advantageously designed to deactivate functional units of the elevator system via corresponding control units and safety devices, in particular to switch off drives. This can be done, for example, with reference to the functional unit shaft section 8, by triggering the safety devices 18, 18′. The safety devices 18 hereby provide a so-called “Safe Torque Off” (STO) functionality that switches the drives powerless. The safety devices 18′ advantageously provide a functionality that also switches the drive off by a protective motor switch.

[0067] Safety nodes assigned to functional units of the shaft system are hereby preferably wired directly to the shaft components.

[0068] A transfer unit 9 in particular is provided for the horizontal transfer of an elevator carriage from one shaft to another shaft. This kind of transfer unit 9 is advantageously monitored by one of the safety nodes 10″ assigned to the corresponding transfer unit 9. Position limit switch 19, devices to record the condition of a locking mechanism 20 and an absolute position sensor 21 hereby continually record operating parameters of the transfer unit 9 as sensors of the safety node in the embodiment. If an operating mode that deviates from a normal operating mode is determined by the safety node 10″ of a control unit of the safety node 10″, a safety device assigned to the transfer unit 9 is advantageously triggered, preferably a service brake 17 with a coupled drive shut-off 17′, which can in particular be realized as a “Safe Torque Off” (STO) functionality.

[0069] The safety nodes 10 assigned to the elevator carriages 2 comprise in particular sensors 12, 13, 14 to record operating parameters with respect to the corresponding elevator carriage 2, in particular a sensor 12 to record the position of the elevator carriage, a sensor 13 to record the condition of the elevator carriage doors, in particular the conditions “closed”/“open””, a sensor 14 to record the load capacity of the elevator carriage 2. Further operating parameters are advantageously transmitted to the corresponding safety node 10 of an elevator carriage by further safety nodes. By analyzing the operating parameters, the safety node 10 hereby takes a decision with respect to an operating mode that deviates from a normal operating mode. If an operating mode that deviates from a normal operating mode is determined, the safety node 10 or the control unit for this safety node 10 advantageously triggers safety devices 16, 16′ for the elevator carriage 2. This brings the elevator system into a safe operating mode. Safety devices for the elevator carriage are in particular a service brake 16 and redundant safety gear 16′.

[0070] In order to further reduce the processing load for each safety node, it is in particular envisaged to avoid or at least reduce a plurality of identical calculations and a plurality of identical decisions within the safety system of the elevator system. This is why the safety nodes 10, 10′, 10″ are advantageously designed to take decisions locally, in particular decisions with respect to the triggering of a safety device, and to transmit the corresponding results, conditions and/or decisions to the other safety nodes.

[0071] The safety nodes 10, 10′, 10″ of functional units 2, 8, 9 are hereby advantageously provided with at least the information and/or operating parameters listed below.

[0072] The safety node 10 of the elevator carriage 2 hereby advantageously has access to the following operating parameters [0073] X, Y, Z position, speed and acceleration of the elevator carriage; [0074] Load capacity of the elevator carriage; [0075] condition of the elevator carriage door; [0076] condition of the actuator system and/or the safety device, in particular the service brake and safety gear; [0077] whereby the information and operating parameters above are advantageously provided by the sensors of the safety nodes; [0078] condition of the shaft doors; [0079] whereby this information is preferably provided by the safety node 10′ of functional unit 8 of the shaft system; [0080] information on a possible collision with other elevator carriages 2; [0081] whereby safety node 10 is advantageously provided with operating parameters from elevator carriages 2 adjacent to safety node 10 to generate this information, preferably stop points (as explained above and in the following with reference to FIG. 4 and FIG. 5); and [0082] condition of the transfer unit 9; [0083] whereby this information is preferably provided by the safety node 10 assigned to the transfer unit 9.

[0084] The interaction of safety nodes, in particular of safety nodes within a defined monitoring room (as explained above), will be explained in more detail below on the basis of two examples. For a better understanding, reference will be made to the elements shown in FIG. 1 and FIG. 2.

[0085] First example—emergency stop of the elevator carriage if the risk of a collision is detected:

[0086] Each safety node 10 that is assigned an elevator carriage 2 as a functional unit, generates information with respect to a possible collision on the basis of its own sensors 12, 13, 14 and distributes this information via the interface 11 to all other safety nodes that have been assigned an elevator carriage as a functional unit.

[0087] Each safety node 10 that is assigned an elevator carriage 2 as a functional unit checks the risk of a collision on the basis of the information received from other safety nodes that have been assigned an elevator carriage 2 as a functional unit. If a possible collision is detected, a safe mode of the elevator carriage 2 is initiated—advantageously triggered by the control unit of the corresponding safety node 10.

[0088] As long as no safe mode should or has to be achieved, the safety node 10 that has been assigned an elevator carriage 2 as a functional unit grants all safety nodes that have been assigned a functional unit 4 of the drive system permission to activate the corresponding functional units 4 of the drive system. The functional units 4 of the drive system can, for example, be activated by energizing the corresponding linear motor segments if a linear drive is used as a drive system.

[0089] If the elevator carriage 2 is to be brought into a safe operating mode, the safety node 10 assigned to this elevator carriage 2 advantageously informs all safety nodes that are assigned functional units 4 of the drive system that the functional units 4 of the drive system responsible for this elevator carriage 2 are to be deactivated, for example by switching off the corresponding linear motor segments if a linear drive is used as a drive system.

[0090] All safety nodes that are assigned functional units 4 of the drive system check the responsibility for the elevator carriage 2 on the basis of the information transmitted via the interface 11 from the safety node 10 assigned to this elevator carriage 2. Depending on the result of this check, they deactivate or activate the corresponding functional units 4 of the drive system.

[0091] Second example—an elevator carriage enters a transfer unit:

[0092] Each safety node 10 that is assigned an transfer unit 9 as a functional unit of the shaft system, generates information with respect to a current condition of the transfer unit 9 on the basis of its own sensors 19, 20, 21 and sends this to all other safety nodes 10 that have been assigned an elevator carriage as a functional unit.

[0093] Each safety node 10 that is assigned an elevator carriage 2 as a functional unit checks the risk of a collision with a transfer unit 9 on the basis of the information received from the safety node 10 that has been assigned the corresponding transfer unit 9. If a possible collision is detected, the elevator carriage 2 is brought into a safe operating mode.

[0094] As long as this does not have to be brought into a safe operating mode, the safety node 10 assigned to the elevator carriage 2 grants all safety nodes assigned to a functional unit 4 of the drive system permission to activate the corresponding functional units 4 of the drive system, for example, permission to energize the corresponding linear motor segments if a linear drive is used as a drive system

[0095] If the elevator carriage 2 is to be brought into a safe mode, the safety node 10 assigned to the elevator carriage 2 informs all safety nodes that are assigned a functional unit 4 of the drive system that the functional units 4 of the drive system responsible for this elevator carriage 2 are to be deactivated. If a linear drive is used as a drive system, for example, the information is sent to switch off the linear motor segments.

[0096] All safety nodes that are assigned a functional unit 4 of the drive system check their responsibility for this elevator carriage 2 on the basis of this information and deactivate the corresponding functional unit 4 of the drive system, for example the linear motor segment, or allow this to activate the corresponding functional unit 4 of the drive system, for example the linear motor segment. If a change to the operating mode of a transfer unit 9 poses a risk for the elevator carriage 2 or the persons being transported with this elevator carriage, the safety node 10″ assigned to this transfer unit 9 does not allow a change in the condition of the transfer unit 9. A safety device 17, 17′ is preferably activated that prevents a change in the condition of the transfer unit 9. One such safety device 17′ is in particular a locking mechanism.

[0097] In the elevator system 1 shown partially in FIG. 3, one part of the shaft system 3 in which elevator carriages 2 can be moved separately, in other words essentially independent of each other, is shown together with two elevator carriages 2. The shaft system 3 hereby has a section 8 of the shaft system 3 that displays a shaft door 5 as a functional unit. This section of the shaft 8 is hereby assigned a safety node (not shown explicitly in FIG. 3). This safety node comprises a sensor (not shown explicitly in FIG. 3) that is designed to record an operating mode that deviates from a normal operating mode for this functional unit 8, whereby the elevator system 1 is designed to deactivate this functional unit 8 if such an operating mode that deviates from a normal operating mode is recorded, and to advantageously only move the elevator carriages 2 of the elevator system 1 outside this section 8 of the shaft system 3 that has at least one shaft door 5.

[0098] In the embodiment shown in FIG. 3, a sensor monitors in particular the correct opening and closing of the shaft doors with respect to the section of the shaft 8. If, as is shown by way of example in FIG. 3, the sensor records an unsuccessful closing of the shaft door 5 at the safety nodes or at the control unit of the safety node of the section of the shaft 8 as an operating parameter, the control unit advantageously deactivates this section of the shaft 8. The consequence of this is that the elevator carriages 2 can no longer enter this section of the shaft 8. This information is hereby transmitted to the signal nodes (not shown explicitly in FIG. 3) of the elevator carriages 2 at the latest when the elevator carriages 2 enter the defined monitoring room 28. The elevator system 1 and/or the safety system of the elevator system 1 is namely advantageously designed in such a way that all safety nodes in a defined monitoring room exchange information with each other. Advantageously, corresponding monitoring rooms are defined for the entire shaft system 3.

[0099] By deactivating the section of the shaft 8, the elevator carriage 2 moving in the upwards direction of travel 6 can at most move up to the lower limit of section 8 that is shown by the line 29. The elevator carriage 2 moving in the downwards direction of travel 7 can at most move up to the upper limit of section 8 that is shown by the line 29′. Otherwise, the elevator system 1 is advantageously still ready for operation.

[0100] The elevator system 41 shown in FIG. 4, which is not shown to scale for reasons of a better overview, comprises a shaft system 42 with two vertical shafts 412 and two connecting shaft 413. Furthermore, the elevator system 41 comprises a plurality of elevator carriages 43 (for example eight elevator carriages in FIG. 4) which can be moved separately in the shaft system 42 in successive operation, in other words, a plurality of elevator carriages 43 can be moved in a shaft 412 or in a shaft 413.

[0101] The elevator carriages 43 can hereby be moved upwards in a first direction of travel 44 in the shafts 412 (shown symbolically in FIG. 4 by the arrow 44) and downwards in a second direction of travel 45 (shown symbolically FIG. 4 by the arrow 45). In the connecting shafts 413, via which the elevator carriages 43 can change between the shafts 412, the elevator carriages can also be moved laterally in a third direction of travel 410 (shown symbolically in FIG. 4 by the arrow 410) and in a fourth direction of travel 411 (shown symbolically in FIG. 4 by the arrow 411).

[0102] It is in particular envisaged, that the elevator system comprises at least a linear motor as a drive system (not shown explicitly in FIG. 4), by means of which the elevator carriages 43 can be moved within the shaft system 42.

[0103] The elevator system 41 shown in FIG. 4 is hereby operated in such a way that a first stop point 46 is continually calculated for every elevator carriage 43 for the first possible direction of travel and a second stop point 47 for the second possible direction of travel. Thus, a stop point is calculated for every elevator carriage 43 for at least one direction of travel. Thus, an upper shaft door is calculated as a first stop point 46 for the elevator carriages 43 in the vertical shafts 412, and a lower stop point is calculated as a second stop point 47. In the connecting shafts 413, a stop point in the direction of travel of the corresponding elevator carriage 43 is calculated as stop point 46′ and a second stop point opposite to the direction of travel of the corresponding elevator carriages 42 is calculated as stop point 47′.

[0104] The stop points can be defined in particular by coordinates (x, y), whereby lateral stop points are defined by the x-coordinates and vertical stop points by the y-coordinates. For example, point A in FIG. 4 can be assigned the coordinates (0, 0).

[0105] The two stop points 46, 47 and 46′, 47′ each specify, starting from the current position of the corresponding elevator carriage 43, the latest point at which the elevator carriage 43 can stop, assuming a worst case scenario, for each of the possible directions of travel 44, 45 and 410, 411. In particular, an upper stop point 46 is calculated, i.e. predetermined, for an elevator carriage 43′ traveling upwards, taking into account current operating parameters such as the direction of travel, speed and load capacity of the elevator carriage 43′, where the elevator carriage 43′ would stop if the elevator carriage 43′ were to be accelerated to its maximum in the direction of travel and then braked. The lower stop point 47 of the elevator carriage 43′ is calculated for the worst case assumption, namely that the drive fails, the elevator carriage 43′ consequently falls and the elevator carriage 43′ is only then braked.

[0106] Corresponding predictions are carried out continually for the further elevator carriages 43 of the elevator system. The elevator carriages 43 advantageously hereby display a control unit, for example a micro controller circuit designed as a control unit (not shown explicitly in FIG. 4).

[0107] The distance from the first stop point 6 of an elevator carriage to the second stop point 47 of a second elevator carriage is determined for every elevator carriage 43 that has an adjacent elevator carriage in an initial direction of travel. Moreover, the distance from the second stop point 47 of an elevator carriage to the first stop point 46 of the second elevator carriage is determined for every elevator carriage 43 that has a second, adjacent elevator carriage in the second direction of travel.

[0108] For example, the distance 48 from the upper stop point 46 of the elevator carriage 43′ to the lower stop point 47 of the elevator carriage 43′ is determined for the elevator carriage 43′ that has a second, adjacent elevator carriage 43″ in the second direction of travel 44. To this end, the lower stop point 47 of the elevator carriage 43″ is advantageously transmitted to a control unit (not shown explicitly in FIG. 4) of the elevator carriage 43′. The distance 48 determined in this example is positive. There is thus no risk of a collision with respect to the elevator carriages 43′ and 43″.

[0109] In addition, the elevator carriage 43′ has an adjacent elevator carriage 43′″ in the further direction of travel 45. Thus, the distance 49 from the lower stop point 47 of the elevator carriage 43′ to the upper stop point 46 of the elevator carriage 43′ is determined for the elevator carriage 43′. To this end, the upper stop point 46 of the elevator carriage 43″ is advantageously transmitted to a control unit (not shown explicitly in FIG. 4) of the elevator carriage 43′. The distance 49 determined in this example is negative, in other words the upper stop point 46 of the elevator carriage 43′″ lies below the lower stop point 47 of the elevator carriage 43′. There is thus the risk of a collision with respect to the elevator carriages 43′ and 43″. On account of the negative distance 49 between the lower stop point 46 of the elevator carriage 43′ and the upper stop point 47 of the elevator carriage 43′″, the elevator system is brought into a safe mode, in particular by activating brakes on these elevator carriages, preferably triggered by the control units assigned to the corresponding elevator carriages 43′ and 43′″.

[0110] Since only one stop point is transmitted to an elevator carriage 43 from the two adjacent elevator carriages, the communication load for the procedure employed is advantageously low.

[0111] Reference is made to FIG. 5 for a further explanation of the stop points that are calculated for an elevator carriage 43 in accordance with a procedure according to the invention. FIG. 5 hereby shows an elevator carriage 43 with an overall elevator carriage height of 417 and an entrance threshold 420.

[0112] An example of a calculated stop point 46, 47 is shown for each direction of travel 44, 45 for the elevator carriages 43 that can be moved in the direction of travel 44 and in the direction of travel 45 (the direction of travel in FIG. 5 is shown symbolically in each case by arrows 44, 45). The upper stop point 46 is hereby shown for the direction of travel 44 and the lower stop point 47 for the direction of travel 45.

[0113] The upper stop point 46 hereby indicates the latest point where the elevator carriage 43 can stop with the upper end of the elevator carriage 421 starting from the current operating parameters and assuming a worst-case scenario in the direction of travel 44. The distance between the stop point 46 and the upper end of the elevator carriage 421 in the embodiment shown here results from the sum total of an optionally defined minimum distance 415 to the elevator carriage 43 that may not be fallen below, and a braking distance 418 calculated from the current traveling parameters assuming a worst-case scenario. The stop points are calculated, for example, by means of a correspondingly configured predictor model.

[0114] The lower stop point 47 hereby indicates the latest point where the elevator carriage 43 can stop with the lower end of the elevator carriage 422 starting from the current operating parameters and assuming a worst-case scenario in the direction of travel 45. The distance between the stop point 47 and the lower end of the elevator carriage 422 in the embodiment shown here results from the sum total of an optionally definable minimum distance 416 to the lower end of the elevator carriage 422 that may not be fallen below, and a braking distance 419 calculated from the current traveling parameters assuming a worst-case scenario.

[0115] The positions of the stop points vary depending on the respective current traveling parameters. If the elevator carriage is at a standstill, the stop points will move closer to the elevator carriage. If the elevator carriage is moving at high speed upwards, in other words in the direction of travel 44, the upper stop point will lie further up. The case may in particular arise that even at a high speed, the lower stop point 47 is determined at position 414, because a movement in the direction of travel 45 can hereby be ruled out, even in the worst-case scenario.

[0116] This kind of upper stop point and a lower stop point is calculated for every such elevator carriage 43 shown in FIG. 5. In each case, the distance between the upper stop point 46 of an elevator carriage and the lower stop point 47′ or 47″ of an adjacent elevator carriage above this elevator carriage and the distance between the lower stop point 47 of this elevator carriage and the upper stop point 46′ or 46″ of an adjacent elevator carriage below this elevator carriage is hereby determined. With a non-critical operation, the distances 48 are positive because 47″ is greater than 46 and 47 greater than 46″. With a negative distance, on the other hand, there is the risk of a collision. This kind of negative distance arises if 46 is greater than 47′ or 46′ is greater than 47. If this kind of negative distance is determined, the elevator system is brought into a safe operating mode, in particular into as safe mode.

[0117] The embodiments shown in the figures and explained in connection with these serve to describe the invention and are not restrictive for these. The embodiments that are explained are not reproduced true to scale in the Figures for reasons of a better overview.

REFERENCE NUMBERS

[0118] 1 Elevator system [0119] 2 Elevator carriage [0120] 3 Shaft system [0121] 4 Drive system [0122] 5 Shaft door [0123] 6 Initial direction of travel (symbolized by single arrow) [0124] 7 Second direction of travel (symbolized by double arrow) [0125] 8 Section of a shaft comprising at least one shaft door as a functional unit of the shaft system [0126] 9 Transfer unit as a functional unit of the shaft system [0127] 10 Safety node [0128] 10′ Safety node [0129] 10″ Safety node [0130] 11 Interface [0131] 12 Sensor [0132] 13 Sensor [0133] 14 Sensor [0134] 15 Sensor to record the condition of the shaft door [0135] 16 Safety device [0136] 16′ Safety device [0137] 17 Safety device [0138] 17′ Safety device [0139] 18 Safety device [0140] 18′ Safety device [0141] 19 Sensor [0142] 20 Sensor [0143] 21 Sensor [0144] 26 Data transmission between the safety nodes [0145] 27 Internal data transmission in a safety node [0146] 28 Monitoring room [0147] 29 Lower limit of a section of the shaft (8) (shown symbolically by a line) [0148] 29 Upper limit of a section of the shaft (8) (shown symbolically by a line) [0149] 41 Elevator system [0150] 42 Shaft system [0151] 43 Elevator carriage [0152] 43′ Elevator carriage [0153] 43″ Elevator carriage [0154] 43′″ Elevator carriage [0155] 44 Initial direction of travel [0156] 45 Second direction of travel [0157] 46 First stop point [0158] 46′ First stop point [0159] 46″ First stop point [0160] 47 Second stop point [0161] 47′ First stop point [0162] 47″ First stop point [0163] 48 Positive distance between calculated stop points [0164] 49 Negative distance between calculated stop points [0165] 410 Third direction of travel [0166] 411 Fourth direction of travel [0167] 412 Vertical shaft [0168] 413 Connecting shaft [0169] 414 Extreme position for a possible stop point [0170] 415 Minimum distance to be observed by the carriage [0171] 416 Minimum distance to be observed by the carriage [0172] 417 Elevator carriage height [0173] 418 Calculated braking distance [0174] 419 Calculated braking distance [0175] 420 Entrance threshold [0176] 421 Upper end of elevator carriage [0177] 422 Lower end of elevator carriage