AU2016286288A1

AU2016286288A1 - Monitoring device for a lift system

Info

Publication number: AU2016286288A1
Application number: AU2016286288A
Authority: AU
Inventors: Michael Geisshüsler; Nicolas Gremaud; Simon ZINGG
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2015-06-30
Filing date: 2016-06-29
Publication date: 2018-01-18
Anticipated expiration: 2036-06-29
Also published as: EP3317218B1; CN107810159A; WO2017001531A1; AU2016286288B2; BR112017025853B1; BR112017025853A2; CN107810159B; EP3317218A1

Abstract

A monitoring device (30) for a lift system (1), having a lift car (2) and having an electromechanical braking device (20) which is arranged on the lift car (2) and is intended to brake the lift car (2), comprises at least two sensors (31, 32). The sensors record different motion variables of the lift car. The measurement variables from the sensors are filtered if necessary and are checked for plausibility. At least one actual travel parameter (P) of the lift car (2) is determined in a calculation algorithm (37) on the basis of the recorded measurement variables. This travel parameter, together with any measurement variables from the sensors, is compared with limit values and is assessed. The electromechanical braking device (20) is released on the basis of this comparison and assessment.

Description

The invention relates to a monitoring device for an elevator system, a method for monitoring a travel parameter of an elevator system, and an elevator system having such a monitoring device.

Elevator systems are installed in a building. The elevator system essentially comprises an elevator car that is connected via support means to a counterweight or to a second elevator car. The elevator car is caused to travel along essentially vertical guide rails, and the counterweight is caused to travel in the opposite direction, by means of a drive that may be selected to act on the support means or directly on the elevator car or counterweight. The elevator system is used to convey people and goods within the building to individual floors or a plurality of floors. The elevator system includes devices to secure the elevator car if the drive or support means fails. To this end, as a rule braking devices are used that can brake the elevator car on the guide rails, if needed.

Known from W02014/060587 is a safety device that monitors a motion of an elevator car and that can electrically actuate safety braking devices for the elevator car if needed. An acceleration and a travel velocity or travel path of the elevator car are measured. Further, an instantaneous travel velocity is derived from the acceleration, wherein data from travel velocity or travel path are used for starting an integration cycle.

Known from WO2013/110693 is another safety device that monitors a motion of an elevator car and that can activate a braking device if needed. Different movement parameters of the elevator car are detected and these parameters are checked redundantly for plausibility. Measures are introduced if deviations are found between the various movement parameters.

The purpose of the invention is to provide a qualitive improvement in the safety device, especially in the monitoring device for the safety device and in a corresponding method. This means that the monitoring device should work safely and reliably, it should be simple to connect to an electromechanical safety brake system, and it should furthermore be easy to manufacture and operate.

The solutions described in the following make it possible to satisfy these requirements in an optimal manner, at least individually.

In one solution, the electronic monitoring device preferably includes a first sensor and a second sensor. These sensors respectively detect a first measurement variable dependent on a motion of the elevator car and a second measurement variable, wherein the first measurement variable and the second measurement variable correspond to different motion variables of the elevator car. These different motion variables have a defined mathematical relationship. This means the measurement variables can be compared to one another and their function and quality can be evaluated. The different motion variables necessarily require different sensors, so that the risk of a system measurement error is reduced.

The electronic monitoring device preferably comprises at least one tester that checks the two measurement variables, that is, the first measurement variable and the second measurement variable, for plausibility. This facilitates rapid preliminary testing of the functioning of the sensors. Thus, for instance, plausibility may be tested using the fact that a path measurement cannot suddenly, that is, in a brief period of time, indicate a different location, that an acceleration cannot significantly exceed gravitational acceleration, or that a velocity measurement also cannot suddenly increase significantly. Thus rapid direct testing of the individual sensors can take place by means of the plausibility testing.

In addition, due to the mathematically definable relationship of the two measurement variables, the plausibility may also occur using testing of the mathematical agreement of converted measurement variables of the two measurement variables.

The electronic monitoring device preferably comprises a data storage unit. At least one limit or at least one set point for determining the at least one limit is stored in this data storage unit. Using set points, the actual limits or at least one limit may be calculated, for instance, using a training run. Advantageously, however, in a particularly safe embodiment, limits, such as a critical velocity limit, an acceleration limit, or even path limit marks at which a safety brake is to be activated or a tolerance value at which a safety circuit for the elevator system is to be activated or interrupted, are stored as fixed values in the data storage unit, for instance in an EPROM. In this way inadvertent or malicious reprogramming is prevented and the limits cannot be manipulated because they cannot be altered using conventional means. However, in this case data storage modules must be provided that are aligned for specific elevator systems or for elevator systems having different nominal data, in particular having different travel velocities.

The electronic monitoring device preferably comprises a calculation algorithm for calculating at least one actual travel parameter for the elevator car as a function of the first measurement variable and the second measurement variable. In this way different types of information may be extracted from the measurement variables as needed. The two measurement variables considered by themselves each merely provide an instantaneous status and are subject to sensor-specific imprecision. Thus conventional path sensors detect a traveled path at path intervals, or accelerometers normally have a drift, noise, offset, or other inaccuracies. The algorithm combines the at least two different motion variables to create a resulting motion variable that best reflects the actual travel parameters.

The electronic monitoring device preferably comprises a comparator that compares at least one of the first measurement variable, the second measurement variable, and the actual travel parameter to the at least one limit, and the electronic monitoring device furthermore comprises a signal output that indicates that the limit has been attained or exceeded or in any case that plausibility has been violated. As rule, the indication of this status causes actuation of an electronic or electromechanical switch or relay, which, depending on configuration, interrupts an electrical safety circuit, initializes actuation of a brake, or outputs a signal to another control group, such as an elevator control unit. The indication of the status occurs, for example, by means of a change in the voltage applied to the signal output. Thus safety of the elevator system may be assured, since, on the one hand, different types of sensors are used, which reduces the risk of component-caused system errors, and since a measure may be taken as soon as there is a departure from safe operating conditions.

Thus for monitoring travel parameters of the elevator system, motions of the elevator car are detected at least by means of a first sensor and a second sensor, wherein the first measurement variable detected by the first sensor and the second measurement variable detected by the second sensor correspond to different motion variables for the elevator car, which different motion variables have a mathematically defined relationship. The first measurement variable and the second measurement variable are checked for plausibility by means of a tester, and at least one actual travel parameter of the elevator car is calculated as a function of the first measurement variable and the second measurement variable by means of a calculation algorithm. Further, at least one of the first measurement variable, the second variable, or the actual travel parameter is compared to at least one limit by means of a comparator, wherein the limit is retrieved from a data storage unit. If the limit is attained or exceeded, or if plausibility is violated, a signal output indicates this status.

Considered overall, in this way such a custom-made monitoring device and a corresponding method may be provided for or in the elevator system, satisfying the most stringent safety requirements. This is in particular attained in that, not only can simple limits be considered, but also in that congruent or plausible behavior of the sensors among one another may be weighted. In this way suitable measures may be taken on a case-by-case basis. By calculating the actual travel parameters of the elevator car as a function of the first and second measurement variables, the actual travel parameter rapidly, precisely, and reliably depicts a motion process.

In one suggested solution, the monitoring device cooperates with at least one electromechanical braking device of a brake system for the elevator system. The electromechanical braking device has a stand-by position, in which the elevator car may travel, and has a braking position, in which the elevator car is braked. An actuator is designed to keep the electromechanical braking device in the stand-by position and, if needed, to move the electromechanical braking device from the stand-by position to the braking position. The monitoring device is thus essentially merely connected to the braking device via the signal output, preferably a keep-open signal. Naturally, for instance for the purposes of diagnosing, status evaluations, or resetting operations, additional signals may be transmitted between the monitoring device and the braking device on a case-bycase basis.

To this end, the electromechanical braking device preferably includes a signal input that is connected to the signal output of the electronic monitoring device and that, if the signal output is switched or provides a corresponding indication, initiates or releases the actuator, as a consequence of exceeding the limit, such that the actuator can move the electromechanical braking device from the stand-by position to the braking position.

The electromechanical braking device advantageously also includes a position indicator that indicates or outputs or reports via a signal input to the monitoring device an operating status, such as the stand-by position or the braking position of the electromechanical braking device.

The electromechanical braking device or the brake system advantageously includes an energy storage unit that is designed to bring the electromechanical braking device, when needed, from the stand-by position to the braking position independent of an outside power supply.

In one suggested solution, a complete brake system includes a power failure device in the form of an emergency power supply unit or an automatic reset device.

The emergency power supply unit here comprises a storage unit for storing electrical energy or a connection to an emergency power source that is independent of a normal power source. When there is an interruption in a normal power source, the emergency power supply unit advantageously provides, free of interruption, electrical energy for supplying the electromechanical braking device and the electronic monitoring device.

Alternatively or in addition to the emergency power supply unit, the power failure device for the brake system includes the automatic reset device. The latter comprises a decision algorithm for deciding on a reason for actuation, provided the electromechanical braking device is actuated, and it comprises a reset algorithm that is automatically initialized and executed if the decision algorithm detects a non-critical event as a reason for actuation. A non-critical event has occurred, for instance, if the electromechanical braking device or the brake system has been actuated as a result of a brief or longer-lasting power interruption. Such an interruption may arise due to a fault in the energy network or it may occur as a result the power network being shut off intentionally. This happens, for instance, when a hotel is only operated for a certain season in the year and is not used for the rest of the year.

A safe brake system that improves ecological considerations, availability, and safety may be provided with the suggested embodiment and its variations.

In one solution, the signal output of the electronic monitoring device includes a first signal output and a second signal output. The first signal output is designed, for instance, to open a safety circuit of the elevator system, so that an emergency stop of the elevator car is initiated, and the second output signal is designed, for instance, to release the electromechanical braking device of the elevator car for braking.

Thus many errors may be detected in a first safety level without it being necessary to directly activate safety brakes. This is advantageous, because it makes it possible to avoid prolonged interruptions in operation. As a rule, triggering safety brakes causes a prolonged interruption in operation.

At least one of the two sensors, or preferably all sensors, are preferably provided with a filter. This or these filters reduce interfering noise in the measurement variables. This is particularly helpful if an acceleration is detected, for instance. Accelerometers detect natural vibrations and high-frequency vibrations or vibration peaks that interfere with the evaluation of the signals. Such interfering noise may be eliminated, or at least reduced, by means of an appropriate filter.

In one solution, the filter of the electronic monitoring device filters at least one of the first or second measurement variables by means of a low-pass filter so that high-frequency interfering noise is diminished. The filter preferably filters the second measurement variable detected by the second sensor, in particular the detected vertical acceleration of the elevator car. High-frequency vibrations that may be excited, for instance, by shocks may be diminished in this manner.

In one solution, the calculated or determined actual travel parameter equals an actual motion variable of the elevator car. This actual motion variable is calculated in that, proceeding from an instantaneous status of this actual motion variable, a status of this motion variable to be expected in a next time increment is estimated based on the second motion variable detected by the second sensor and the first motion variable detected by the first sensor. The estimate or assessment of the status of the motion variable to be expected is made using a system model. The mathematical relationships of the motion variables used are reproduced in the system model. Thus, in this system model, all relevant related motion parameters of interest, such as for instance a travel path, velocity, acceleration, a jolt, or even an air pressure, are reproduced in the calculation algorithm at all times. These motion variables are updated to the expected status at all times in the system model. Further, the estimated expected status of the motion variable or variables is corrected by means of a correction factor or a set of correction factors, wherein these correction factors are determined taking into account a required accuracy of the result and a behavior of the sensors used. In the aforesaid system model this means, as a rule, that at least each motion variable used in the system model is provided with an associated correction factor, and thus the calculation includes the integrated correction of the individual system motion variables at all times.

The definition of the system model and correction factors are preferably determined according to the rules of a Kalman filter.

The Kalman filter is a set of mathematical equations named after its discoverer, Rudolf E. Kalman. Using this filter, it is possible to draw conclusions about the status of many of the systems in technology, science, and economics when there are observations that include errors. Simply put, the Kalman filter removes the disturbances caused by the measuring devices. Both the mathematical structure of the underlying dynamic system and the measurement errors must be known.

In the context of mathematical theories of estimation, there is also a Bayes Minimum Variance Estimator for linear stochastic systems in state-space representation.

One special feature of the filter introduced by Kalman in 1960 is its special mathematical structure that permits its use in real-time systems from different technical fields. Among these are, inter alia, the evaluation of radar signals for tracking the position of moving objects (tracking), but also the use of ubiquitous communication systems, such as radios and computers, in electronic control circuits. Applications of such systems for autonomously controlled systems and motor vehicles were developed in student research studies and publications under the direction of Professor Roland Siegwart. In these applications, the issue is motion planning of a system, where only stochastic fixed values — such as position determination by means of GPS — are present with sufficient accuracy to track. Studies have demonstrated that this approach is particularly well suited for reliably tracking or reproducing a travel course of an elevator car. Consequently, for determining the correction factors, the system model is used that has the mathematical relationships of the motion variables used, that is, the mathematical structure of the underlying dynamic system, as it is used for estimating or assessing the status to be expected for the motion variable or variables, together with measurement errors of the sensors used, as such errors result inter alia from inaccuracy of the sensors used, their mounting, or their arrangement.

In a calculation algorithm working according to the rules of the Kalman filter, the actual motion variable of the elevator car is thus calculated in that, proceeding from an instantaneous status of this motion variable, a status of this motion variable to be expected in a next time increment is estimated based on the second motion variable detected by the second sensor and the first motion variable detected by the first sensor.

In principle this corrects a motion variable expected according to the theoretical system model with a weighted portion of the difference between and to the detected first and second motion variables. The weighting with respect to the multiplication factor or the correction factor is prespecified according to the rules of the Kalman filter using model simulation.

In one solution of the system model, this results in the calculation algorithm, wherein, on the one hand, an expected offset value of a motion variable is calculated, proceeding from a last known instantaneous status of the offset value, of a correction factor of the offset calculation, and determined or calculated motion variables, and wherein further the expected status of the motion variable is calculated, proceeding from the instantaneous status of the motion variable, the determined or calculated motion variables, the last known instantaneous status of the offset value, and a correction factor of the motion calculation. The correction factors of the offset calculation and motion calculation are predetermined by model simulation, taking into account a required accuracy of the result and an inaccuracy of the sensors used according to the rules of the Kalman filter, and are stored in the calculation algorithm. The expected status of the motion variable calculated in this manner is output as the actual motion variable of the travel parameter.

The calculation algorithm allows a rapid and precise indication of the most likely instantaneous motion status, since it can optimally combine the diverseness of the detected motion variables and since it can use all of the variables defined in the system model for a safety and plausibility assessment.

An elevator system is essentially a simple system, since only one motion occurs in one dimension. The elevator system only moves, that is, the elevator car and the counterweight move, upward or downward in secure guides. The predetermination of the correction factors by means of the Kalman filter and the calculation of the expected status of the motion variable for the elevator car are based on the same system model. Thus using measurement variables that are provided only stochastically in variable time increments — such as for instance by a path increment sensor — the motion of the elevator car can be reproduced with enough accuracy that safety-relevant data are created. Therefore there is a requirement to replace a safety system that today works exclusively mechanically with electronic components, at least with respect to their actuation.

The calculated or determined actual motion variable in the aforesaid context is preferably a velocity of the elevator car. This means that the calculated or determined actual travel parameter is an actual velocity of the elevator car. Further, the second motion variable is a vertical acceleration of the elevator car, and the first motion variable is a path length unit detected in a temporal sequence.

An acceleration measurement is possible at a high clock rate, while a path length measurement is slower. At the same time, sensors for detecting path increments, or, put another way, for detecting the temporal sequence of path length units, and sensors for detecting accelerations have been proven in practice and are available inexpensively. Combining these two measurements thus yields a precise and cost-effective estimate of the most likely actual travel velocity of the elevator car. The travel velocity is a relevant safety variable for monitoring the elevator system. Thus this relevant safety variable may be monitored precisely and cost-effectively.

In one preferred solution, therefore, the first sensor of the electronic monitoring device is embodied as a path increment sensor and the first measurement variable is consequently a path traveled by the elevator car. The path increment sensor detects the path traveled in constant path length units. A typical detection length unit is in the range of 2 to 100 millimeters, for example.

The second sensor of the electronic monitoring device is preferably embodied as an accelerometer and the second measurement variable is consequently a vertical acceleration acting on the elevator car. The accelerometer continuously detects the vertical acceleration of the elevator car at a preferably high detection clock rate. A typical detection clock rate is in a range of 20 Hz to 1000 Hz, for instance.

Alternatively or in addition, in one solution the first sensor of the electronic monitoring device may also be embodied as an absolute path measurement system. Absolute path measurement systems are known in elevator construction. With these path measurement systems, as well, a path traveled by the elevator car is provided as the corresponding first measurement variable.

In one solution, the tester of the electronic monitoring device checks the first measurement variable and the second measurement variable for plausibility. In one embodiment, it checks the first and the second measurement variables for plausibility essentially independently of one another, in that the measurement variables are tested in terms of their physical meaning. For instance, a very high acceleration value indicates a plausibility problem. In another or in an additional embodiment, the tester compares the first measurement variable to the second measurement variable and outputs an “OK” status signal if the two measurement variables are in agreement. If there is no agreement, it outputs a “NOT_OK” status signal. Whenever a path increment is input or registered, the tester advantageously checks how well the path traveled, taking into account the associated time interval, corresponds to the acceleration detected over this time period. Alternatively or in addition, the tester continuously checks how well the accelerations detected over a time period agree with a corresponding detection of path increments. Thus functioning may in principle be tested continuously. On the one hand, if a path increment is found, it is possible to determine how well the acceleration signal correlates, and on the other hand, it is possible to check whether the acceleration signal is functioning properly, for instance even when the elevator system is shut down. For instance, if a high acceleration signal is applied, a path signal would have to be found in a corresponding time interval. If this is not the case, there is an error. Similarly, when using an accelerometer, for example a tachometer, plausibility may be checked using a temporal observation of a change or using maximum application limits.

In one solution, the electronic monitoring device further includes at least a third sensor for independently detecting a third measurement variable that is a function of the motion of the elevator car. This third sensor is preferably an accelerometer, analogous to the second sensor, and the third measurement variable is consequently the vertical acceleration acting on the elevator car. This accelerometer also continuously detects the vertical acceleration of the elevator car in parallel with the second sensor and with an equally high detection clock rate. This means that the detection clock rates of the second and third sensors preferably run synchronously. Thus there can be precisely synchronous monitoring of the two sensors.

Therefore quality of the monitoring may be optimized and the monitoring device or the tester can provide qualitative information about the individual sensors, in addition to the “OK” or “NOTOK” status.

For instance, if the second and third measurement variables — the two vertical accelerations — match, but the first measurement variable, the path traveled by the elevator car, is not plausible in relation to the second and third measurement variables, then there is an error in the first sensor or the associated assessment and travel by the elevator car is correspondingly immediately interrupted.

But if, for instance, the second and third measurement variables — the two vertical accelerations — do not match, but instead one of the second or third measurement variables is plausible in relation to the first measurement variable, the path traveled by the elevator car, then there is an error in the corresponding deviating second or third sensor. In this case, for instance, initiated travel could be completed and new travel by the elevator car could be prevented. Corresponding fail patterns and the resulting behavior instructions are normally assessed and defined using risk/availability analysis.

Consequently, in one solution the at least one signal output of the electronic monitoring device is switched with a time delay or the signal output is indicated with a time delay when the tester outputs the “NOT_OK” status signal. The time delay advantageously delays the circuitry or the indication of the signal output until the elevator car has reached its next stop. Alternatively or in addition, the at least one signal output transmits the “NOT OK” status signal to an elevator control unit, for instance via a status signal output of the electronic monitoring device. The elevator control unit may the move the elevator car, for instance to a main stop and can halt the elevator system there. This takes into account the scenarios depicted in the foregoing. This time delay is preferably only activated, however, if the further safety of the elevator system is assured. This may be the case, for instance, if the tester detects that the checked measurement variables yield different values, but both values on their own are within a permissible range.

In one solution, stored in the data storage unit of the electronic monitoring device is an acceleration limit that determines an acceleration limit for the vertical acceleration detected by the second sensor. Further stored in the data storage unit are a first velocity limit that defines a first velocity limit for the calculated actual velocity and a second velocity limit that defines a second velocity limit for the calculated actual velocity. In addition, a first time period that defines a first reaction time is stored in the data storage unit.

In one solution, these values stored in the data storage unit are fixed or unalterable. The data storage unit is then manufactured, in a manufacturing plant, for a specific elevator configuration and the data storage unit or a corresponding data storage component or, if the data storage unit is assembled integrally with a corresponding processor, the corresponding processor is then designated in this way. In a simple case, the designation may be a nominal velocity to which the values are matched or it may be a system identification number or the like.

In another solution, at least one of the values stored in the data storage unit, such as the acceleration limit, the first velocity limit, the second velocity limit, or the first reaction time, is calculated when needed or during initialization of the electronic monitoring device.

Advantageously, all velocity limits are calculated. During initialization of the electronic monitoring device, a nominal velocity could be queried by an elevator control unit as a result of a training run or by means of manual input. The limits could be calculated from this by means of relative factors that would then have to be present in a data storage unit or processor.

A typical value for the acceleration limit could be an acceleration of 3.5 m/s² to 6.0 m/s². The first acceleration limit could be 1.1 to 1.25 times the nominal velocity and the second velocity limit could be 1.25 to 1.5 times the nominal velocity. Thus, at a nominal velocity of 2.5 m/s, the first velocity limit is less than 3.125 m/s and the second velocity limit is at least 3.125 m/s. The first reaction time is typically about 12 ms (milliseconds).

In a further solution, the first signal output now registers that the safety circuit should be opened when the actual velocity of the elevator car exceeds or has exceeded the first velocity limit. This causes the safety circuit to be opened or interrupted. The second signal output for releasing the electromechanical braking device of the elevator car registers when the actual velocity of the elevator car exceeds or has exceeded the second velocity limit. Because of this, the electromechanical braking device is released for braking. In addition, the second signal output also registers when the actual velocity of the elevator car exceeds the first velocity limit and at the same time the detected vertical acceleration of the elevator car exceeds the acceleration limit during a time period that is longer than the first reaction time, so that in this case, as well, the electromechanical braking device is released for braking.

With the establishment of such an incremental limit model, on the one hand limits for preswitching an elevator and for triggering a safety braking device as it is defined for a velocity limiter in European Lift Standard EN81-1, Section 9.9 are maintained, and, on the other hand, if support means fail, there is no wait until an excessive velocity is attained, but instead there is a reaction just based on the first velocity limit being exceeded and acceleration being too great. Naturally the suggested ranges for values are merely suggestions. As a rule, the values are established based on local regulations and taking into account the elevator system manufacturer’s designs.

Proceeding from the signals of the first and second sensors, the electronic monitoring device preferably calculates a first actual travel parameter, preferably using the Kalman filter, and, proceeding from the signals of the first and third sensors, calculates a second actual travel parameter, preferably using the Kalman filter. The corresponding calculation routines preferably occur after the signals of the sensors have been successfully checked in the tester and have been provided with the “OK” status signal. In one embodiment, the associated two calculation routines occur in two parallel processors, preferably in synchronous processors, so that each of the specific results can be compared to one another and a failure of a calculation routine may thus be detected rapidly. In another embodiment, the two calculation routines occur in the same processor.

In one solution, a second time period that defines a second reaction time is also stored in the data storage unit. This second reaction time is about 100 ms up to 500 ms, for example. Using the second signal output, the electronic monitoring device now causes release of the electromechanical braking device of the elevator car, in addition to the previous switching criteria, when the actual velocity of the elevator car exceeds the first velocity limit during a time period that is longer than the second reaction time, that is, for example, 120 ms.

Thus the electromechanical braking device is also activated if, despite interrupting the safety circuit — which would have to lead to the elevator drive being turned off and actuation of a drive brake — the actual velocity within the second reaction time has not been reduced until it is lower than the first velocity limit. The safety of the elevator system is further improved using this embodiment. A prolonged period of the elevator car sliding is prevented. Naturally the second reaction time is determined taking into account the entire velocity level.

In one solution, stored in the data storage unit of the electronic monitoring device is a version identification of the electronic monitoring device. This version identification permits the product to be tracked by the manufacture of the device and the corresponding specifications, and consequently permits testing for correctness at any time. In addition, any experiences that were gained with specific embodiment versions may be assigned to other systems of the same version in a simple manner. Thus overall an improvement in the reliability of the product overall may be a attained.

The electronic monitoring device advantageously comprises a first assembly that includes at least the second sensor, embodied as an accelerometer, the filter allocated to the second sensor, the tester, the data storage unit, the calculation algorithm, and the comparator, and the electronic monitoring device furthermore comprises a second assembly that includes at least the first sensor embodied as path increment sensor.

The first assembly thus comprises components that do not require any external interface other than that they are connected to a supply voltage, having a connection to the safety circuit of the elevator system and in any case having a communications interface to the elevator system. If the communications interface also includes connection to the safety circuit, naturally it is possible to do without a separate connection to the safety circuit. The second assembly includes components that interact mechanically, or at least physically, with the elevator system. This may be a path increment sensor that is driven by the motion of the elevator car or it may be a positioning system, for instance an absolute path measurement system, that is constructed on a magnetic, optical, radar, or other basis. This second assembly may thus be arranged in an optimal orientation or arrangement and is then preferably connected to the first assembly by means of a wire connection. Naturally a wireless connection is also possible.

The first assembly and the second assembly may of course be combined to create a single assembly. This depends on the selection of the sensors used, and also on arrangement options for the components in the elevator system.

The routines and algorithms used for testing, comparing, and calculating are preferably in processors. A plurality of processors may be used for the different functions. Thus, for instance, selected functions may be processed in parallel, so that the processors can monitor one another. However, it is also possible for a plurality of, or all, functions or routines to be integrated in a single processor, which results in a particularly cost-effective and energy-saving solution.

According to one advantageous solution, the complete brake system includes the electromechanical braking device. It advantageously includes a braking element and this braking element has a self-energizing structure. The actuator of the electromechanical braking device is designed such that when needed it can move the braking element from the stand-by position to a brake starting position. During a travel motion of the braking device relative to a brake counter piece with which the braking element is in contact in the brake starting position, the braking device automatically clamps the electromechanical braking device independently from the brake starting position into a brake end position. This brake end position then defines the braking position of the braking device. With this, the actuator can work with minimal force, since the braking element merely has to be moved into the brake starting position, and the motion into the brake end position, which then corresponds to the actual braking position, occurs on its own using kinetic motion energy of the elevator systems. Thus the electromechanical braking device is built small and is operated with little energy.

In one solution, the actuator includes an electromagnet or an electrically actuatable driver. When powered, the latter may hold the electromechanical braking device or its actuator in its stand-by position. When not powered, this electromagnet or the electrically actuatable driver releases the electromechanical braking device or its actuator, so that the electromechanical braking device may be moved into the braking position or at least into the brake starting position.

This solution makes it possible to provide a fail-safe brake system, since the braking device is always moved to a braking position during an interruption in power or if there is a defect. Failsafe criteria may be satisfied easily.

Alternatively, the actuator or the electromagnet or driver contained in the actuator is configured such that, if unpowered, the actuator can hold the electromechanical brake system in its stand-by position and, if powered, the actuator can move the electromechanical braking device into the braking position or at least into the brake starting position.

This solution makes it possible to provide a brake system with little energy consumption, since energy is required only for the actual actuation. However, complex measures are required in order to be able to ensure safety even when there is a power failure or outage.

In one solution, the actuator includes at least a lever system, a detent system, and/or a spindle system, and the energy storage unit of the electromechanical braking device includes at least a spring, a compression spring, a pneumatic or hydraulic pressure accumulator, or a pyrotechnic gas generator. The energy content of the energy storage unit is dimensioned such that sufficient energy is always provided to move the electromechanical braking device, at least into the brake starting position, independently from an external energy supply.

Consequently, the brake systems operates such that, if an undesired travel status is detected that makes it necessary to engage the braking device of the elevator cabin, the electronic monitoring device detects this status, and it is correspondingly indicated via the second signal output. Via corresponding switching units, this means, for instance, that an electromagnet of the braking device is deactivated or switched unpowered. Thus the actuator is released and the corresponding energy storage unit of the braking device causes the braking element to engage or move into the brake starting position, with the counterpiece, as a rule the guide rails of the elevator car. Due to the motion of the elevator car and the associated motions of the braking device relative to the guide rails, the braking element is moved further into the brake end position, wherein it further prestresses the braking device, so that corresponding braking force can be built up and generated.

In one solution, in which the power failure device for the brake system includes an emergency power supply unit, this emergency power supply unit has a rechargeable battery such as a capacitor or battery. The latter is designed to provide an energy supply for the electronic monitoring system and for the electromechanical braking device for a predefined time. The predefined time is advantageously a period of time that an authorized person requires to move the elevator car to a floor manually after the elevator car experiences a power interruption.

In one solution, the rechargeable battery of the emergency power supply unit is designed to supply energy to consumers, such as a car light, car ventilation element, an information display, and/or an emergency call system, in addition to the electronic monitoring device and the electromechanical braking device.

In one solution, the rechargeable battery of the emergency power supply unit is arranged in the region of the elevator car, preferably as a component of the electronic monitoring device. Alternatively, the rechargeable battery of the emergency power supply unit is arranged in a control module of an elevator control unit.

The electronic monitoring device is advantageously embodied such that it detects when the power in the emergency power supply unit or the power supply unit drops below a critical voltage limit. In addition, if there is a drop below the critical voltage limit, the electronic monitoring device actuates the actuator of the electromechanical braking device such that the electromechanical braking device is moved into the braking position or at least to the brake starting position. At the same time, a message that the braking device has been actuated due to the drop below the critical voltage limit in the data storage unit of the electronic monitoring device.

Now the automatic reset device for the brake system preferably has an analysis routine that performs a status analysis when the power supply unit of the electronic monitoring device is turned on and that starts an automatic reset routine when information is detected in the data storage unit that the braking device was actuated due to the drop below the critical voltage limit.

In an additional solution, the reset routine initializes a notification or announcement that notifies all of the passengers in the elevator car.

In one embodiment, the brake system includes two electromechanical braking devices that are arranged on the elevator car and each of which includes an electromagnet or a driver. These may keep the electromechanical braking devices in their stand-by position and actuation of these electromagnets or drivers switches the two electromagnets or drivers serially one after the other. These two electromechanical braking devices are each advantageously connected to the electronic monitoring device via a connecting cable. This connecting cable has, in addition to lines that connect the electromagnets or drivers, connecting lines that transmit information from the position indicator of the electromechanical braking devices to the electronic monitoring device.

In one alternative solution to the aforesaid embodiment, the brake system includes two electromechanical braking devices that are arranged on the elevator car and each of which includes an electromagnet or a driver that can release the electromechanical braking devices, if needed, so that the electromechanical braking devices can be moved into their braking position. The actuation of these electromagnets or drivers actuates the two electromagnets or drivers in parallel, wherein these two electromechanical braking devices are each connected to the electronic monitoring device via a connecting cable. This connecting cable also has, in addition to lines that connect the electromagnets or drivers, connecting lines that transmit information from the position indicator of the electromechanical braking devices to the electronic monitoring device. When it has been established that one of the two electromechanical braking devices has been actuated, the electronic monitoring device also releases the other of the two electromechanical braking devices.

In one solution, the electronic monitoring device is arranged in the region of the elevator car. The second assembly with the first sensor embodied as a path increment sensor is arranged in the region of a deflection roller of the elevator car, which deflection roller deflects a support means of the elevator car. The second assembly of the electronic monitoring device is connected by means of another connecting cable to the first assembly of the electronic monitoring device, which is preferably disposed at an easily accessible location of the elevator car.

In one solution, the electronic monitoring device is connected to an electric power supply of the elevator car, and the electronic monitoring device is connected to the safety circuit of the elevator system by means of a first connecting location and to the elevator control unit of the elevator system by means of a second connecting location.

The invention shall be described using exemplary embodiments in conjunction with the figures. Shown are:

Figure 1 is a schematic side view of an elevator system;

Figure 2 is a schematic sectional view of an elevator system;

Figure 3 is a schematic view of an electromechanical braking device;

Figure 4 is a schematic overview of an entire brake system;

Figure 5 is a schematic overview of an electronic monitoring device;

Figure 6 is a schematic overview of an expanded electronic monitoring device, with redundant use of two sensors;

Figure 7 is a schematic decision tree for a comparator.

In the figures, the same reference numbers are used for equivalent parts in all of the figures.

Figure 1 provides a general overview of an elevator system 1. The elevator system 1 is installed in a building and is used for transporting people or goods within the building. The elevator system 1 is installed in a shaft 6 of the building and includes an elevator car 2 and a counterweight 3, both of which may be moved upward and downward along guide rails 10. The elevator car 2 stops at a plurality of stops 11 in the building. A drive 5 drives and stops the elevator car 2. The drive 5 is arranged, for instance, in the upper region of the shaft 6 and the elevator car 2 is connected to the drive 5 via support means 4, for instance support cables or support belts. In the example, the drive 5 is connected in a speed-reducing manner to the elevator car 2 and to the counterweight 3. To this end, support rollers 9 are attached to the elevator car 2 and to the counterweight 3 and the support means 4 are guided via these support rollers 9. The counterweight equals a mass produced part of the elevator car 2, so that the drive 5 primarily merely has to compensate a weight difference between elevator car 2 and counterweight 3. The drive 5 could of course also be arranged at a different location in the building, in the region of the elevator car 2, or with the counterweight 3. The drive 5 is controlled by an elevator control unit 7.

The elevator car 2 is equipped with a brake system 15 that is suitable for securing and/or decelerating the elevator car 2 when there is an unexpected motion or excess velocity. The brake system 15 comprises a plurality of components. An electromechanical braking device 20 is arranged, for instance, beneath the elevator car 2. The electromechanical braking device 20 is connected electrically to an electronic monitoring device 30 and is controlled thereby. A power failure device 50, that is assembled together with the electronic monitoring device 30, for example, controls the brake system 15 when there is an interruption in a power supply for the elevator system 1. The elevator car 2 is connected to the elevator control unit 7 via a traveling cable 8. The traveling cable 8 includes signal and energy supply lines. The electronic monitoring device 30 is connected to the elevator control unit 7 via these signal lines, inter alia. Naturally the signal lines may be embodied by means of a bus system. However, the person skilled in the art may also use wireless signal transmission.

Figure 2 provides a schematic top view of the elevator system 1 from Figure 1. The brake system 15 in the example includes two elevator braking devices 20, 20.1. The two elevator braking devices 20, 20.1 are preferably embodied identical or mirror-symmetrical and act as needed on the guide rails 10 arranged on both sides of the elevator car 2. To this end, the guide rails 10 include suitable braking surfaces that, in cooperation with the elevator braking devices 20, 20.1, can cause the elevator car 2 to brake. The electronic monitoring device 30 is arranged on the roof of the elevator car 2, so that it is easily accessible for maintenance purposes. The electronic monitoring device 30 in the example works with a first sensor 31 connected to the support roller 9 of the elevator car 2 and with a second sensor 32 that is integrated into the monitoring device 30, the aforesaid sensors detecting motion variables for the elevator car 2.

Figure 3 depicts one possible known embodiment of an electromagnetic braking device 20 as it is known from WO 2005044709. The electromechanical braking device 20 includes a brake housing 29 and a braking element 25 in the form of a safety wedge. The brake housing 29 is attached to the elevator car 2. The braking element 25 is embodied self-energizing in cooperation with the brake housing 29. The braking element 25 is held in a stand-by position by an actuator 21. An electromagnet 26 of the actuator 21 also keeps an energy storage unit 22 in the form of a compression spring loaded and the braking element 25 is disposed on the energy storage unit 22. This is the position illustrated in Figure 3.

The depicted electromechanical braking device 20 is symmetrical by itself. This means that two braking elements 25 are arranged on either side of the guide rails 10 and can clamp the latter if necessary. A position of the braking element 25 may be determined by means of a position indicator 24 and may be transmitted to the electronic monitoring device 30 by means of a corresponding connecting cable 27. A signal input 23 of the electromagnet 26 is also connected to the electronic monitoring device 30 via connecting cable 27. As soon as the electronic monitoring device 30 releases the electromagnet 26 and thus the actuator 21, the energy storage unit 22 relaxes and the braking elements 25 are forced into the gap, which is narrowing in a predetermined manner due to the braking housing 29. The energy storage unit 22 transports the braking elements 25 at least until the braking elements 25 clamp the guide rails 10. This is then a brake starting position. At this point, due to its wedge-shaped configuration, during a travel motion by the brake housing 29 or elevator car 2, the braking element 25 is drawn into the narrowing gap of the brake housing 29, so that a corresponding braking force builds. The motion of the braking element 25 in the brake housing 29 is then limited by a stop so that a predetermined braking force builds. This is then a brake end position. The actuator 21 also includes a reset unit 28. This reset unit 28 includes a spindle unit that can move the electromagnet 26 such that the energy storage unit may be restressed therewith. The electromechanical braking device 20 is finally completely reset again in a subsequent return motion of the elevator car 2. The reset unit 28 may consequently be controlled by a reset algorithm 52.

Other electromechanical devices 20 work with eccentric brake shoes that are also released, when necessary, by means of electromagnet and that are reset by means of spindle motors or that are reset using a return motion of the brake shoes, such as is set forth in EPI 733992.

In the exemplary embodiment in Figure 4, the brake system 15 includes the electronic monitoring device 30, the power failure device 50, and two electromechanical braking devices 20, 20.1. The electromechanical braking devices 20, 20.1 are essentially constructed as explained in the foregoing.

The electronic monitoring device 30 essentially includes two assemblies. A first assembly 42 is built on a printed circuit board 42.1. In the example it includes second and third sensors 32, 33. Both sensors 32, 33 are one-dimensional accelerometers, each of which detects a measurement variable 32m, 33m in the form of an acceleration. An arrow 45 indicates the installation position of the electronic monitoring device 30 on the printed circuit board 42.1 or a surrounding housing in the elevator system 1. What this attains is that the two sensors 32, 33 specifically detect vertical acceleration. The two sensors 32, 33 are each connected to an evaluation unit 46, explained in greater detail in Figures 5 and 6, via an associated optional filter 34. In the example, the optional filter(s) 34 are realized by means of a circuit of resistors and capacitors that filter high-frequency vibrations of the accelerometers.

A second assembly 43 essentially comprises a first sensor 31 that detects a measurement variable 3 lm in the form of path increments s. The first sensor 31 is connected, for instance, to the support roller 9 of the elevator car 2 (see Figure 2) or driven thereby. The measurement variable 31m of the first sensor 31 is also transmitted to the evaluation unit 46.

The electronic monitoring device 30 furthermore has needed interfaces, connection points and connections 39, 24, 24.1, 41 for transmitting signals, information, and energy to the elevator control unit 7, to the safety circuit SK, to the electromechanical braking devices 20, and, depending on the embodiment, to a power supply unit UN or a corresponding power failure device 50.

In the example according to Figure 4, the power failure device 50 is combined with the electronic monitoring device 30. The power failure device 50 includes an emergency power supply 51. The latter is supplied electrical energy by a conventional energy source UN of the elevator system 1 and stores the energy in rechargeable batteries or capacitors. They are dimensioned such that the brake system 15 may be kept in its stand-by position during brief power outages. A brief power outage is, for instance, switching off the power supply in a building for one night, that is, for about 12 hours, for example. Thus a section of a building that is not needed for half a day may be switched without power. The emergency power supply unit 51 keeps the brake system 15 active during this period and the elevator system 1 is immediately ready for operation again when the power is turned on. During a prolonged period of the power being turned off, for instance, if an elevator system 1 is to be shut down because it is off-season, the energy reserve of the emergency power supply unit 51 drops below a predetermined level. The electronic monitoring device 30 detects the drop below this predetermined level by means of voltage monitoring and releases the electromechanical braking devices 20 for braking. At the same time, it writes into a data storage unit 36 of the electronic monitoring device 30 an associated message IU that there has been a drop below the corresponding critical voltage level and that the electromechanical braking device 20, 20.1 has been actuated.

The power failure device 50 preferably includes an automatic reset device 52. A decision algorithm 54 of the automatic reset device 52 starts automatically when the power supply UN of the electronic monitoring device 30 is turned on and performs a status analysis. If it is determined that the message IU has been entered into the data storage unit 36 of the electronic monitoring device 30 that there has been a drop below the corresponding critical voltage level and that the electromechanical braking device 20, 20.1 has therefore been actuated, the automatic reset device 52 initializes the automatic reset algorithm 55. The latter now controls the electromechanical braking device 20, 20.1 or its actuator 21, 21.1 to move back to its stand-by position by means of the reset unit 28, 28.1. The message IU in the data storage unit 36 is reset.

Depending on the type of embodiment of the electromechanical braking device 20, this controlling occurs directly from the reset algorithm 55 or the control occurs via the elevator control unit 7 of the elevator system 1. In the example, the power failure device 50 is combined with the electronic monitoring device 30. However, at least part of it may also be a component of the elevator control unit 7.

The evaluation unit 46 of the electronic monitoring device 30 also includes a tester 35, as may be seen in Figure 5. The tester 35 compares the first measurement variable 31m transmitted by the first sensor 31 to the second measurement variable 32m transmitted by the second sensor 32. In the example, the first measurement variable 31m is a path increment signal s and the second measurement variable 32m is an acceleration signal a. On the one hand, the tester 35 checks that the acceleration signal a is within plausible limits. Thus, for example, accelerations greater than a value of gravitational acceleration g are not plausible. Consequently, as soon as the tester 35 registers an acceleration signal a that is significantly greater than gravitational acceleration g, the acceleration signal a is not plausible, which leads to output of a “NOTOK” status signal 40. Furthermore, if a path increment signal s is received, the tester 35 checks how well the time span between two path increment segments s correlates with the accelerations registered in this time span and it checks in brief time spans how well the registered accelerations a match receipt of the path increment signals s. That is, if the second sensor 32 does not indicate any relevant acceleration a over a certain period of time, but the first sensor 31 indicates a relevant or large path increment s, there is an error and the status signal 40 is output by the tester 35 as “NOTOK”.

The evaluation unit 46 of the electronic monitoring device 30 also includes a calculation algorithm 37. The calculation algorithm 37 calculates an actual travel parameter P, the actual velocity VC in the exemplary embodiment. Proceeding from an instantaneous status of this actual velocity ν_Μ , the calculation algorithm 37 estimates a status of this actual velocity V_t to be expected in the next time increment based on the second motion variable 32m detected by the second sensor 32, a , and the first motion variable 31m detected by the first sensor 31, s. The estimate of the status of the actual velocity VC to be expected is made using a system model 44 that describes the mathematically defined relationship of the motion variables to one another, taking into account correction factors K_n The mathematical and temporal relationships of all motion variables a, s, v are reproduced in the system model 44. Thus, in this system model 44, all relevant related motion variables, such as for instance the travel path s, the velocity v, and the acceleration a, are reproduced in the calculation algorithm 37. Characteristic deviations, such as an offset ao of the second motion variable 32m, a detected by the second sensor 32 are also added in the system model 44. These motion variables are updated to the next expected status at all times in the system model 44. Further, the estimated expected statuses of the motion variables are corrected by means of the correction factors K_n, taking into account a required accuracy of the result and inaccuracy of the sensors used. In the aforesaid system model 44 this means that the motion variables a, s, v used in the system model 44 are provided with an associated correction factor K_n, and thus the calculation includes the integrated correction of the individual system motion variables in the system model 44 at all times. The system model 44 corrected in this way thus includes the estimated expected motion variables. These corrected estimated expected motion variables provide the best reproduction of the system and are consequently output as the actual motion variables. Finally, the calculated status to be expected for this actual velocity V_t is output as actual travel velocity VC or as actual travel parameter P.

As a result, in the example provided the calculation algorithm 37 also includes two relevant estimates.

1) Calculations of an offset ao of the second motion variable detected by the second sensor 32:

ao_t = ao_t-i + Kn₂ x ( ds - (V_t_i x d_t + (a_m - ao_t_i) x dt²/2)) dt Time interval (as a rule equals a clock frequency of the calculation routine) ds Path interval detected in the time interval dt a_m Mean acceleration detected in the time interval dt ao_t Expected offset ao ao_t-i Instantaneous status of the offset ao according to most recent calculation Kn₂ Correction factor for offset calculation

V_t_i Instantaneous status of the actual velocity according to most recent calculation

2) Calculation of actual velocity VC

V_t = V_t.i + (a_m - ao_t-i) x dt + Kni x (ds - (V_t_i x d_t + (a_m - ao_t_i) x dt²/2))

V_t Expected status of actual velocity (anticipated),

Kn! Correction factor for velocity calculation

	IPk		Pk )	1 \		Pfc \
_Λ	Pk-i		Pfe-i		0.99916			Pfe-i
^xk =		—	^vk	+	0.41916	•	^_1 ° °)·	^vk
	K				-0.010177
	1 1		) ^€k J			,	^ek

The correction factors K_n are predetermined, taking into account a required accuracy of the result and inaccuracy of the sensors used, as well as the calculation process. The correction factors K_nmay also include portions for implementing physical units. The correction factors K_n, K_nl, K^ used for calculating the actual travel parameters P are determined according to the rules of a Kalman filter.

In the present example, the calculation is depicted using the calculation of velocity v. Naturally the calculation may be embodied for all mathematically related motion variables, wherein the mathematical relationships must then be adapted accordingly. The system model 44 is integrated into the calculation algorithm 37.

In addition, the evaluation unit 46 of the electronic monitoring device 30 includes the comparator

38. In one stage, the comparator 38 takes into account the status signal 40 that is output by the tester 35. In the embodiment according to Figure 5, as soon as the “NOTOK” status signal 40 is output, the comparator 38 uses a first signal output 39.1 to open the safety circuit SK. This halts the elevator system 1. Alternatively, it is also possible to release the electromechanical braking device 20 directly using a second signal output 39.2 and thus to effect a rapid stop by means of the electromechanical braking device 20. As a rule, however, this is not required, since it is unlikely that excess velocity and failure of one of the sensors 31, 32 will occur simultaneously. In any event, the opening of the safety circuit SK in this case may even be temporally delayed in order to make it possible to stop the elevator car 2 at a next stop level 11.

As long as the tester 35 outputs the “OK” status signal 40, however, the comparator 38 checks that relevant limits are being maintained in the motion sequence of the elevator car 2. The relevant limits W are stored in the data storage device 36. If the comparator 38 determines that a limit has been exceeded, there is an output or display of the first signal output 39.1 to the safety circuit or there is a corresponding output or display of the second signal output 39.2 to the electromechanical braking device 20 to release the latter for braking.

The testing functions of the tester 35, the calculation algorithm 37, and the comparison functions of the comparator 38 may occur in separate processors. The functions are preferably combined in a single processor, however.

Figure 7 depicts one possible comparison scenario. The comparator 38 is available on one side of the data storage unit 36 having the relative limit values W. The acceleration limit AG determines a limit for the vertical acceleration a detected by the second sensor 32. The first velocity limit VCG1 determines a first limit for the calculated actual velocity VC and the second velocity limit VCG2 determines a second limit for the calculated actual velocity VC. The calculated actual velocity VC, in this and in the following embodiments, corresponds to the value output primarily as actual travel velocity or as actual travel parameter P. A first reaction time T1 defines a time period during which, for instance, excessive acceleration, as occur during vibrations, may happen.

A second reaction time T2 defines a time period within which an emergency braking device, such as for instance a drive brake, is to cause deceleration of the elevator car 2.

The comparator 38 now checks whether the actual velocity VC of the elevator car 2 exceeds the first velocity limit VCG1. If this is not the case, the comparison output is set to 0, which means that the first signal output 39.1 to the safety circuit SK is also at 0. Thus the safety circuit remains closed. If the actual velocity VC of the elevator car 2 exceeds the first velocity limit VCG1, VC > VCG1, the comparison output is set to 1, which means that the first signal output 39.1 to the safety circuit SK is set to 1. This causes the safety circuit SK to be opened and the elevator system 1 is immediately halted via the drive system.

The comparator 38 furthermore checks whether the actual velocity VC of the elevator car 2 exceeds the second velocity limit VCG2. As soon as VC > VCG2 is true, the corresponding comparison output is set to 1. This means that the second signal output 39.2 to the electromechanical braking device 20 is set to 1. Thus the elevator system 1 is immediately halted using the corresponding release of the electromechanical braking device 20. If the actual velocity VC of the elevator car 2 did not exceed the second velocity limit VCG2, there is a check of whether the detected vertical acceleration a of the elevator car 2 exceeded the acceleration limit AG, a > AG. If this continues during the time period T, which is longer than the first reaction time TI established in the data storage unit, T > TI, the second signal output 39.2 to the electromechanical braking device 20 is also set to 1. Thus the elevator system 1 is correspondingly likewise halted using the electromechanical braking device 20. Therefore, the electromechanical braking device 20 is actuated when the first velocity limit VCG1 is exceeded and when a critical acceleration value AG simultaneously continuously exceeds a critical acceleration value AG.

Furthermore, in an expanded optional embodiment, an additional check takes place in that the comparator 38 checks whether, after the first velocity limit VCG1 has been exceeded, the actual velocity VC of the elevator car 2 again drops below the first velocity limit VCG1 within a second reaction time T2 established in the data storage unit. This second reaction time T2 is typically 100 to 200 ms (milliseconds). That is, if the actual velocity VC continues above the first velocity limit VCG1 longer than the second reaction time T2, the second signal output 39.2 to the electromechanical braking device 20 is also set to 1. Thus the elevator system 1 is correspondingly likewise immediately halted using the electromechanical braking device 20.

As explained in connection with Figure 4, the data storage unit 36 for the electronic monitoring device 30 includes, in addition to the limits W, explained in the foregoing, a storage address for storing the message 1U. Furthermore, as a rule a version identification of the electronic monitoring device 30 is also stored in the data storage unit 36. In some cases additional limits are stored. These may be limits that reflect a reduced travel velocity, service velocities, test velocities, and the like.

Figure 6 depicts a refinement of the electronic monitoring device 30 from Figure 5. The monitoring device 30 includes a third sensor 33. The electronic monitoring device 30 is embodied essentially redundantly by means of this third sensor, which is embodied analogous to the second sensor 32. Using a common first sensor 31, the check for plausibility and correlation of the measurement variables 31m, 32m, 33m is conducted in two testers 35, the actual velocity VC of the elevator car 2 is calculated in two calculation algorithms 37, and the comparison to limit values is conducted redundantly in two comparators 38. Overall safety is elevated since, as explained in the following, both comparators 38 can redundantly cause the release of the electromechanical braking device 20 for braking according to predetermined criteria. At the same time, especially the comparison of the two identical sensors 32, 33 permits direct diagnosis of a faulty sensor. Thus in some cases there may be limited continued travel by the elevator car 2, even if one of the two sensors 32, 33 fails, for example. In addition, the source of the error, that is, the defective sensor or the defective evaluation group, may be indicated. Moreover, the comparison of the actual velocity VC of the elevator car 2 determined by the redundantly designed calculation algorithms 37 in a tester 35.1 makes it possible to verify the functioning of the entire evaluation chain.

The person skilled in the art may vary the illustrated arrangements. The electromechanical braking devices 20 may be arranged above or below the elevator car 2. It is also possible to use a plurality of brake pairs on one elevator car 2. If needed, the brake system 15 may also be installed on the counterweight 3.

The monitoring device 30 may be integrated in the elevator control unit 7 or in an elevator car computer. The elevator car computer is a unit that is arranged in the region of the elevator car and that includes, for instance, a control unit of an elevator car door or a position determination of the elevator car 2 or the like. However, embodying the monitoring device 30 separately from other equipment has proved advantageous, since it can be tested, and in any case, type-tested by itself. An appropriate housing for the monitoring device 30 preferably has a geometric configuration that permits clearly defined arrangement on the elevator car 2 so that it is practically impossible to mount it incorrectly. The first and second assemblies 42, 43 may also be combined on a printed circuit board, as specified in the foregoing in the description. The resulting combined assembly may then be arranged, for example, directly on a support roller 9 of the elevator car 2 or on a guide roller of the elevator car 2 so that the path increment sensor 31 may be driven directly. The guide roller is for instance a guide roller that is used for guiding the elevator car 2 along the guide rails 10.

These explanations are essentially made using sensors 31, 32, 33, which detect accelerations a, paths s, and path intervals ds, and the velocity v is used as evaluation variable. Additional or other

0 motion variables that are mathematically related may be used in the context of the invention. For instance, air pressure that is mathematically related to motion parameters may be used, or limits may be defined as functions of paths traveled.

Claims

Patent claims

1. A monitoring device (30) for an elevator system (1) having an elevator car (2) and having an electromechanical braking device (20) arranged on the elevator car (2) for braking the elevator car (2), comprising:

- at least a first sensor (31) and a second sensor (32) for detecting a first measurement variable (31m) dependent on a motion of the elevator car (2) and for detecting a second measurement variable (32m), wherein the first measurement variable (31m) and the second measurement variable (32m) correspond to different motion variables (a, v, s) of the elevator car (2) that are in a mathematically defined relationship;

- at least one tester (35) that checks the first measurement variable (31m) and the second measurement variable (32m) for plausibility;

- at least one data storage unit (36), wherein the data storage unit stores at least one limit (W) or at least one set point for determining the at least one limit;

- at least one calculation algorithm (37) for calculating at least one actual travel parameter (P) for the elevator car (2) as a function of the first measurement variable (31m) and the second measurement variable (32m);

- at least one comparator (38) that compares at least one of the first measurement variable (31m), the second measurable variable (32m), or the actual travel parameter (P) to the at least one limit (W);

- at least one signal output (39) that indicates that the limit (W) has been achieved or exceeded or indicates that plausibility has been violated.
2. The monitoring device (30) according to claim 1, wherein the signal output (39) of the electronic monitoring device (30) includes a first signal output (39.1) and a second signal output (39.2) and the first signal output (39.1) opens a safety circuit (SK) of the elevator system (1) so that an emergency stop for the elevator car (2) may be introduced and the second signal output (39.2) releases the electromechanical braking device (20) of the elevator car (2) for braking.
3. The monitoring device (30) according to either of claims 1 or 2, wherein the actual travel parameter (P) is an actual motion variable (V, VC) of the elevator car (2) and the calculation algorithm (37) calculates this actual motion variable (V, VC) in that, proceeding from an instantaneous status of this actual motion variable (V_t.i), a status of this motion variable (V_t) to be expected in a next time increment is estimated based on the second motion variable (a) detected by the second sensor (32) and the first motion variable (ds) detected by the first sensor (31) is estimated (37.1), wherein the expected status of the motion variable (V_t) is estimated using a system model (44) that describes the mathematically defined relationship of a plurality of motion variables (a, ds) to one another, wherein, in the system model, proceeding from the instantaneous status of the plurality of motion variables, each expected status of the plurality of motion variables is estimated and in that the estimated expected motion variables (V_t) are corrected by means of correction factors (K_n), wherein the correction factors (K_n) are determined taking into account a required accuracy of the result and an inaccuracy of the sensors used, and wherein at least one of the estimated expected motion variables corrected in this manner by means of correction factors (K_n) is output as the actual motion variable (V, VC) of the travel parameter (P).
4. The monitoring device (30) according to either of claims 1 or 2, wherein the actual travel parameter (P) is an actual motion variable (V, VC) of the elevator car (2) and the calculation algorithm (37) calculates this motion variable (V, VC) in that, proceeding from an instantaneous status of this actual motion variable (V_t.i), a status of this motion variable (V_t) to be expected in a next time increment is estimated (37.1) based on the second motion variable (a) detected by the second sensor (32) and the first motion variable (ds) detected by the first sensor (31);

wherein the calculation algorithm (37) on the one hand calculates an expected offset value (ao_t) of at least one motion variable (a, ds) proceeding from a last known instantaneous status of the offset value (ao_t_i), a correction factor of the offset calculation (K_n2) and determined or calculated motion variables (a, ds, ν_Μ);

wherein the calculation algorithm (37) further calculates the expected status of the motion variable (V_t) proceeding from the instantaneous status of the motion variable (ν_Μ), the determined or calculated motion variables (a, ds), the last known instantaneous status of the offset value (ao_t_i), and a correction factor of the motion calculation (K_nl); wherein the correction factors (K_n[> K_n2) are determined, taking into account a required accuracy of the result and inaccuracy of the sensors used; and, wherein the expected status of the motion variable (V_t) calculated in this manner is output as the actual motion variable (V, VC) of the travel parameter (P).
5. The monitoring device (30) according to claim 3 or 4, wherein the correction factors (K_n, K_nb K_n2) used by the calculation algorithm (37) for calculating the actual travel parameters (P) are determined using the rules of a Kalman filter.
6. The monitoring device (30) according to any of claims 1 through 5, wherein the first sensor (31) of the electronic monitoring device (30) is a path increment sensor (31s), and the first measurement variable (31) that is detected by the first sensor (31) and that is the first motion variable (s, ds) is a path traveled by the elevator car (2), wherein the path increment sensor (31 s) detects the path traveled in constant path intervals, or, the second sensor (32) of the electronic monitoring device (30) is an accelerometer (32a), and the second measurement variable (32m) that is detected by the second sensor (31) and that is the second motion variable is a vertical acceleration acting on the elevator car (2), wherein the accelerometer (32a) detects the vertical acceleration of the elevator car (2) at a high detection clock rate.
7. The monitoring device (30) according to any of claims 1 through 6, wherein the tester (35) for the electronic monitoring device (30), which checks the first measurement variable (31m) and the second measurement variable (32m) for plausibility, compares the first measurement variable (31m) to the second measurement variable (32m), taking into account the associated mathematically defined relationships, and outputs an “OK” status signal (40) if the two measurement variables match and outputs the “NOT OK” status signal (40) if they do not match;

wherein the check of the two measurement variables takes place in a time increment that is determined or used by the calculation algorithm (37) for calculating the actual travel parameter (P) of the elevator car (2); and/or, wherein the check of the two measurement variables includes that there is a comparison of to what extent a weighted difference in the two measurement variables is within a characteristic behavior defined by the first sensor and/or by the second sensor.
8. The monitoring device (30) according to any of claims 1 through 6, wherein the tester (35) for the electronic monitoring device (30), which checks the first measurement variable (31m) and the second measurement variable (32m) for plausibility, compares the first measurement variable (31m) to the second measurement variable (32m) and outputs an “OK” st atus signal (40) if the two measurement variables match and outputs the “NOT_OK” status signal (40) if they do not match, wherein the check of the two measurement variables includes:

- that when fully traveled path interval is registered there is a comparison, taking into account an associated time, of how well the path traveled corresponds to the acceleration detected across this time, and/or,

- that there is a comparison of how well the accelerations detected over a time period agree with a corresponding detection of path increments.
9. The monitoring device (30) according to claim 7 or 8, wherein if the tester (35) outputs the “NOT_OK” status signal (40), the at least one signal output (39) of the electronic monitoring device (30) indicates in a time delayed manner that plausibility has been violated, wherein the time delay preferably delays the indication of the signal output (39) until the elevator car (2) has reached a next stop (11); or, the at least one signal output (39) of the electronic monitoring device (30) includes a status signal output (41) by means of which the “NOT_OK” status signal (40) may be transmitted for instance to an elevator control unit (7).
10. The monitoring device (30) according to any of claims 1 through 9, wherein stored in the data storage unit (36) of the electronic monitoring device (30) is an acceleration limit that determines an acceleration limit (AG) for the vertical acceleration (a) detected by the second sensor (32);

stored in the data storage unit (36) of the electronic monitoring device (30) is a first velocity limit that determines a first velocity limit (VCG1) for the calculated actual velocity (VC); stored in the data storage unit (36) of the electronic monitoring device (30) is a second velocity limit that determines a second velocity limit (VCG2) for the calculated actual velocity (VC);

a first time period that defines a first reaction time (TI) is stored in the data storage unit (36).
11. The monitoring device (30) according to claim 10, wherein the signal output has a first signal output (39.1) and a second signal output (39.2) and:

- the first signal output (39.1) causes the safety circuit (SK) to be opened when the actual velocity (VC) of the elevator car exceeds or has exceeded the first velocity limit (VCG1); and,

- the second signal output (39.2) causes release of the electromechanical braking device (20) of the elevator car (2);

- when the actual velocity (VC) of the elevator car exceeds the second velocity limit (VCG2); or,

- when the actual velocity (VC) of the elevator car exceeds the first velocity limit VCG1 and the detected vertical acceleration (a) of the elevator car (2) exceeds the acceleration limit AG during a time period (t) that is longer than the first reaction time (TI).
12. The monitoring device (30) according to claim 11, wherein further a second time period that defines a second reaction time (T2) is stored in the data storage unit (36) and the second signal output (39.2) additionally causes the release of the electromechanical braking device (20) of the elevator car (2) when the actual velocity (VC) of the elevator car (2) exceeds the first velocity limit (VCG1) during a time period (t) that is longer than the second reaction time (T2).
13. The monitoring device (30) according to any of claims 10 through 12, wherein at least one of the acceleration limit (AG), first velocity limit (VCG1), second velocity limit (VCG2), first reaction time (TI), or second reaction time (T2) stored in the data storage unit (36) is calculated as needed or during initialization of the electronic monitoring device (30).
14. The monitoring device (30) according to any of claims 1 through 13, wherein the electronic monitoring device (30) further comprises at least a third sensor (33) for independently detecting a third measurement variable (33m) that is dependent on the motion of the elevator car (2), wherein this third sensor (33) is an accelerometer (33g) and the third measurement variable (33m) is the vertical acceleration acting on the elevator car (2), wherein the accelerometer (33) detects the vertical acceleration of the elevator car (2) continuously and in parallel to the second sensor (32), wherein a detection clock rate of the third sensor preferably runs synchronously with the second sensor.
15. The monitoring device (30) according to claim 14, wherein the tester (35) compares the measurement variables of the second and third sensors (32, 33) to one another directly and compares the two measurement variables (32m, 33m) to the first measurement variable (31m) of the first sensor 31, taking into account physical meanings, and, as a result of the comparisons, outputs the “OK” status signal (40) or the “NOT OK” status signal (40), wherein an error source is also indicated if the “NOT OK” status signal (40) is output.
16. A method for monitoring a travel parameter (P) of an elevator system (1), wherein

- a motion of the elevator car is detected at least by means of a first sensor (31) and a second sensor (32), wherein a first measurement variable (31) detected by the first sensor (31) and a second measurement variable (32m) detected by the second sensor (32) correspond to different motion variables (a, v, s) of the elevator car (2), which different motion variables (a, v, s) are in a mathematically defined relationship;

- the first measurement variable (31m) and the second measurement variable (32m) are checked for plausibility by means of a tester (35);

- at least one actual travel parameter (P) for the elevator car (2) is calculated by means of a calculation algorithm (37) as a function of the first measurement variable (31m) and the

5 second measurement variable (32m);

- at least one of the first measurement variable (31m), second measurement variable (32m), or the actual travel parameter (P) is compared, by means of a comparator (38), to the at least one limit (W), which limit (W) is retrieved in a data storage unit (36);

- at least one signal output (39) indicates that the limit (W) has been achieved or exceeded

10 or indicates that plausibility has been violated.
17. An elevator system having an elevator car (2) and having an electromechanical braking device (20, 20.1) arranged on the elevator car (2) and having a monitoring device (30) according to any of claims 1 through 15:

WO 2017/001531

PCT/EP2016/065226

1 /5

Fig. 2

WO 2017/001531

PCT/EP2016/065226

2/5

24, 27 30

Fig. 3

ZZZZZZZJ ,

WO 2017/001531

PCT/EP2016/065226

3/5

32m, a

Fig. 5

WO 2017/001531

PCT/EP2016/065226

4/5

33m, a

Fig. 6

WO 2017/001531

PCT/EP2016/065226

5/5

VCG1, VCG2, AG, T1, (T2)

31.32 A 37 >vc

Fig. 7