EP4538212A1 - Unité électronique d'ascenseur ainsi qu'installation d'ascenseur correspondante, procédé de vérification de sécurité autonome d'une unité électronique d'ascenseur - Google Patents

Unité électronique d'ascenseur ainsi qu'installation d'ascenseur correspondante, procédé de vérification de sécurité autonome d'une unité électronique d'ascenseur Download PDF

Info

Publication number
EP4538212A1
EP4538212A1 EP23203544.4A EP23203544A EP4538212A1 EP 4538212 A1 EP4538212 A1 EP 4538212A1 EP 23203544 A EP23203544 A EP 23203544A EP 4538212 A1 EP4538212 A1 EP 4538212A1
Authority
EP
European Patent Office
Prior art keywords
elevator
processor
central processor
central
electronics unit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP23203544.4A
Other languages
German (de)
English (en)
Other versions
EP4538212B1 (fr
Inventor
Roland Hoppenstedt
Martin DIFFENBACH
Mathias Spannagel
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ziehl Abegg SE
Original Assignee
Ziehl Abegg SE
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ziehl Abegg SE filed Critical Ziehl Abegg SE
Priority to EP23203544.4A priority Critical patent/EP4538212B1/fr
Priority to CA3256119A priority patent/CA3256119A1/en
Priority to US18/912,802 priority patent/US20250122048A1/en
Publication of EP4538212A1 publication Critical patent/EP4538212A1/fr
Application granted granted Critical
Publication of EP4538212B1 publication Critical patent/EP4538212B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/24—Control systems with regulation, i.e. with retroactive action, for influencing travelling speed, acceleration, or deceleration
    • B66B1/28—Control systems with regulation, i.e. with retroactive action, for influencing travelling speed, acceleration, or deceleration electrical
    • B66B1/30—Control systems with regulation, i.e. with retroactive action, for influencing travelling speed, acceleration, or deceleration electrical effective on driving gear, e.g. acting on power electronics, on inverter or rectifier controlled motor
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/24—Control systems with regulation, i.e. with retroactive action, for influencing travelling speed, acceleration, or deceleration
    • B66B1/28—Control systems with regulation, i.e. with retroactive action, for influencing travelling speed, acceleration, or deceleration electrical
    • B66B1/30—Control systems with regulation, i.e. with retroactive action, for influencing travelling speed, acceleration, or deceleration electrical effective on driving gear, e.g. acting on power electronics, on inverter or rectifier controlled motor
    • B66B1/308—Control systems with regulation, i.e. with retroactive action, for influencing travelling speed, acceleration, or deceleration electrical effective on driving gear, e.g. acting on power electronics, on inverter or rectifier controlled motor with AC powered elevator drive
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/34—Details, e.g. call counting devices, data transmission from car to control system, devices giving information to the control system
    • B66B1/3415—Control system configuration and the data transmission or communication within the control system
    • B66B1/3423—Control system configuration, i.e. lay-out
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/34—Details, e.g. call counting devices, data transmission from car to control system, devices giving information to the control system
    • B66B1/3415—Control system configuration and the data transmission or communication within the control system
    • B66B1/3446—Data transmission or communication within the control system
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0006—Monitoring devices or performance analysers
    • B66B5/0018—Devices monitoring the operating condition of the elevator system
    • B66B5/0031—Devices monitoring the operating condition of the elevator system for safety reasons

Definitions

  • the invention relates to an elevator electronics unit intended and configured to control elevator operation, i.e., the travel operation of an elevator system.
  • the elevator electronics unit may comprise the following components, which are preferably housed in a common housing: a power output stage capable of supplying an elevator motor of the elevator system with an (in particular three-phase) AC output voltage; and (at least) one processor.
  • the invention also relates to an elevator system comprising such an elevator electronics unit.
  • the invention relates to a method for securely updating such an elevator electronics unit and/or an elevator system as well as a further method for downstream and autonomous safety checking of an elevator electronics unit and/or an elevator system, wherein downstream can be understood here to mean that the safety check is carried out autonomously after a software update has been carried out by the elevator electronics unit.
  • Frequency converters with power stages for operating elevator motors with or without gears have long been used in elevator systems and are often implemented as a single-processor solution, i.e., with a processor that can receive complex digital control commands and translate them into corresponding, particularly analog, control signals for controlling the power stage.
  • Some available frequency converters are specifically adapted for use in elevator systems, both in certain interfaces and in their respective designs.
  • elevator control functions are implemented or performed by several separate electronic systems.
  • Tasks of such control electronics or electronic elevator control devices which are often designed separately from the frequency converter, can include, for example, querying a safety circuit, detecting a door zone, evaluating car and landing calls, determining the car position, responding to control commands from the car roof or from the pit or from the return control system, as well as controlling special operating modes such as a fire service elevator.
  • these have also included communication with a remote control or remote monitoring system or a building control center, or, for example, operation with a cloud database.
  • the object of the invention is to provide an electronic elevator control device which can be designed as a compact elevator electronics unit, the components of which can be accommodated in a common housing, and which contributes to overcoming the aforementioned disadvantages.
  • an elevator electronics unit according to claim 1 is proposed.
  • the processor be designed as a central processor and consequently be configured to directly control the power output stage using motor control signals as part of a motor control system.
  • the central processor mediated via the power output stage, to control and regulate the elevator motor.
  • the central processor in particular, to specify elevator operation.
  • the central processor is designed and configured to perform basic functions of elevator operation, namely responding to external, in particular digital, calls from external transmitters by generating and outputting the corresponding motor control signals based on a respective travel curve for elevator operation.
  • a travel curve can be understood as a temporal profile of the speed of the elevator car, whereby the profile indicates the course/temporal change of the speed of the elevator car.
  • a profile can include acceleration and deceleration ramps, but also areas in which a constant travel speed is achieved, or, for example, areas of very low travel speed, such as when correcting the car position at the end of a braking process, i.e., shortly before reaching a final stop position.
  • the central processor can calculate the travel curve section by section (for example, only specifying respective interpolation points of the travel curve little by little) and derive corresponding updated motor control signals from the travel curve at regular intervals of 5 ms, for example.
  • the actual travel curve traveled by the elevator car can also be recorded by sensors and documented by the central processor, for example in the form of automatically generated log files.
  • the travel curve can also take into account certain conditions at the end points of the elevator journey, such as a shortened shaft head at the upper end or the attachment of a folding apron at the lower end. All such points can be taken into account by the central processor when specifying the driving curve in order to specify a suitable speed profile.
  • an external elevator control system specifies the travel curve and typically generates a digital control command at regular intervals, which is then transmitted to a frequency converter, e.g., via CANopen communication.
  • a frequency converter e.g., via CANopen communication.
  • the frequency converter often controls the motor itself.
  • the frequency converter has its own Processor/its own intelligence, which generates corresponding control signals from the digital input commands to control the power output stage of the frequency converter and thus also fills time gaps if necessary.
  • the invention in contrast to previously known approaches, in which a processor forwards complex control commands, such as specifying a frequency and level of the output AC voltage (which the power stage is to output to the elevator motor), to a second instance (such as a separate processor of a frequency converter), with the second instance then translating these commands into corresponding control signals with which the power stage can be directly controlled, the invention thus proposes that the central processor directly generate suitable control signals, such as an analog signal or a pulse width modulation (PWM) signal, and output them to the power stage, preferably without any intermediate instance.
  • PWM pulse width modulation
  • the power stage therefore preferably has no intelligence of its own; however, it can, for example, comprise a hardware circuit that converts an analog signal or a PWM signal sent by the central processor into an analog control signal for controlling the individual transistors/power switches of an inverter circuit of the power stage.
  • the motor control signals can thus be output by the central processor as analog signals and/or in the form of at least one PWM signal.
  • the central processor can thus control individual power switches of the power output stage (either directly or indirectly, for example, via the aforementioned hardware circuit). This allows the central processor to adjust the output AC voltage accordingly so that a desired speed and/or desired torque of the elevator motor results.
  • the central processor can thus implement a frequency converter together with the power output stage.
  • the central processor can preferably also be configured to (itself) specify the respective travel curve, taking into account a (respective) received external call and the evaluation of at least one piece of information regarding the current position of an elevator car of the elevator system.
  • the central processor automatically generates the necessary motor control signals based on the travel curve it determines.
  • the central processor can, for example, query information that allows conclusions to be drawn about the current car position, for example by directly or indirectly reading a sensor in the elevator system. This can therefore, in particular, be reliably determined information regarding the current position of the elevator car within the elevator shaft.
  • the central processor can also obtain the information, for example, from an instance of the elevator system that continuously creates and updates a virtual image of the elevator system.
  • a virtual image/shaft copying system can be implemented based on sensors, in particular magnetic sensors in the shaft, and/or relative encoder systems and/or an absolute encoder system of the elevator system.
  • the information regarding the current position of the elevator car will correspond more to an estimate of the current car position.
  • the central processor can evaluate at least one safety circuit of the elevator system.
  • a safety circuit can provide relevant "safety-related information" regarding the car position.
  • the safety circuit can be a link in a complex safety chain that ensures safe operation of the elevator system.
  • the elevator operation can be configured such that the elevator car can only move if the safety chain as a whole is in a condition permissible for travel operation.
  • the central processor can be configured to query the current state of the safety chain in order to take this state into account when specifying the travel curve.
  • the aforementioned safety chain of the elevator system can, for example, be implemented as a serial circuit of several safety elements ("Door closed?", "Ropes taut?", "Speed OK?”, etc.). Each element (which can be implemented with a respective safety circuit) must have a specific state so that the safety chain as a whole is in the permissible state in which safe movement of the elevator car is possible/approved.
  • Such a safety chain can, for example, monitor the correct closing and opening of the vehicle car doors and only authorize the doors to open when the vehicle car is in a safe state.
  • the safety chain can be designed so that an interruption of the safety chain stops the elevator system's operation.
  • the safety chain is therefore preferably superior to the central processor, i.e., the central processor can only execute elevator operation as long as the safety chain is not interrupted.
  • the central processor can therefore be configured to control a/the safety chain of the elevator system, which ensures safe operation of the elevator, depending on at least one received sensor signal (e.g., "elevator car within door zone").
  • the central processor Since the central processor receives and processes the typically digital external calls and can also communicate with other devices in the elevator system, for example, to determine the current car position, the central processor combines digital communication within the elevator system with the generation of the (often analog) motor control signals in a single processor unit. This fusion of the digital and analog worlds in the central processor significantly reduces complexity and thus simplifies maintenance and updating of the entire system.
  • the central processor can be implemented, for example, in the form of a microcomputer or a microprocessor and/or on a mainboard of the elevator electronics unit.
  • the central processor must have sufficient Performance, in particular sufficient processor speed, to be able to perform necessary time-critical engine control functions.
  • the central processor can have an analog signal output (for generating an analog motor control signal) and/or a PWM unit (for generating a PWM motor control signal) directly connected to the power output stage (in order to directly control the power output stage with the corresponding motor control signal).
  • an analog signal output for generating an analog motor control signal
  • a PWM unit for generating a PWM motor control signal
  • the central processor can thus be configured, in particular, to perform a digital-to-analog conversion in order to generate analog motor control signals from digital data/commands (e.g., resulting from the driving curve), with which the power output stage can be directly controlled.
  • the inventive design makes it possible to use the central processor to specify the operation of the elevator car and simultaneously control and regulate the elevator motor.
  • the central processor is equipped with such a high operational speed that it can perform time-critical motor control functions.
  • the communication between the central processor and the power output stage can also be bidirectional, for example, so that the power output stage can send a fault message to the central processor.
  • the central processor can also be configured to record sensor data from the elevator motor (such as the current angular position of the elevator motor rotor). When generating the motor control signals, the central processor can take such sensor data and/or fault messages into account.
  • the elevator system in which the elevator electronics unit (which can be understood as an electronic elevator control device) is used can, for example, comprise (in a manner known per se) an elevator car, support means, possibly a counterweight, and a drive unit (e.g. with traction sheave and) with an elevator motor (either with or without gear).
  • the elevator electronics unit can be designed as a compact structural unit; it can also take over the control and regulation of the drive unit, for example by incorporating a motor power output stage. (especially as part of the mentioned power output stage) of the drive unit, as already explained in detail above.
  • Particularly safety-relevant functions of the elevator system in particular individual links of the mentioned safety chain, can be implemented by means of a (respective) hardware circuit.
  • the central processor can be equipped with a serial interface as well as digital input and output ports, as well as relay outputs to output control currents to drive relays.
  • the elevator electronics unit can also have safety circuits, particularly in the form of non-modifiable hardware circuits, to which the central processor can access (send and/or receive).
  • the respective safety circuit can, in turn, be connected to external field devices, such as a position sensor or other sensor or actuator.
  • a housing in which the elevator electronics unit is housed can be characterized, among other things, by the fact that a central current and/or voltage supply is provided on the housing, via which at least one internal power supply of the elevator electronics unit can be supplied with electrical voltage.
  • the at least one internal power supply can provide a respective suitable electrical operating voltage for operating components of the elevator electronics unit, for example to provide a specific DC voltage for the central processor and/or for one of the additional processors.
  • the elevator electronics unit can be further developed as follows: It can be provided that the central processor is configured to implement a motor control of the elevator motor, which includes time-critical operations that must be executed in less than 1 ms. Furthermore, the central processor can be configured to implement a travel operation control of the elevator system. This travel operation control can include less time-critical operations that can be executed in more than 1 ms and/or non-time-critical operations that must be executed within 10 ms. The central processor is Preferably, the central processor is configured to execute the engine control function and the driving operation control function simultaneously.
  • Real-time relevant signals can be understood here as signals that must be processed within a defined maximum response time; however, this maximum response time can be in the range of several hundred ms. Real-time relevant signals can thus include both time-critical ( ⁇ 1 ms) and non-time-critical (> 10 ms) signals.
  • the central processor can have a system of intelligent interrupts so that time-critical and non-time-critical operations can be processed sequentially and/or using a time-division multiplexing (TDM) method, preferably one after the other and in order of priority.
  • TDM time-division multiplexing
  • the quasi-parallel execution (using one processor core) or actual parallel execution (on at least two processor cores) of both functions (engine control and regulation & monitoring of driving operation) by a single central processor is thus possible because the processor can prioritize between these two functions, thus prioritizing the time-critical operations over the non-time-critical operations.
  • This can be achieved, for example, by means of appropriate interrupt prioritization and/or by using two processor cores.
  • a characteristic of using only one processor core can be that the central processor executes both functions serially, one after the other, but at such short intervals that quasi-parallel execution of both functions is possible by one and the same central processor.
  • a program for monitoring the operation of the elevator system (more precisely, the operation of the elevator car) and a program for motor control can be stored in the memory of the central processor.
  • Both of these programs can be configured via digital software updates, as will be explained in more detail below; i.e., these programs can be stored in a (particularly respective) overwritable (internal or external) memory.
  • the advantage of this approach is, among other things, that the processor's software is easier to maintain than when maintaining two separate processors. Furthermore, the solution is more cost-effective because one processor can be eliminated, and there are no longer any error-prone contacts or wires because communication between the two processors is eliminated. Furthermore, the update process is simplified when using only one central processor, as is the error analysis of the entire system, due to the elimination of the previously required communication between the two processors.
  • the elevator electronics unit can be used particularly advantageously if it comprises at least one additional processor configured to perform at least one additional function.
  • This additional function can thus modularly supplement the functional scope of the central processor.
  • the at least one additional processor is plugged into a mainboard on which the central processor is implemented. This allows an additional function to be very easily modularly supplemented, i.e., retrofitted, by plugging in the additional processor.
  • the at least one additional processor can communicate with the central processor, for example, via a serial interface, in particular in the form of a BUS system for data transmission.
  • a so-called dual-ported RAM can also be used to enable communication/data exchange between the additional processor and the central processor.
  • such a dual-ported RAM can be written to and read from by both processors, so that, for example, the additional processor can read information from the dual-ported RAM that the central processor has stored there. has filed and vice versa.
  • the respective additional processor can thus be viewed as a modular peripheral device of the central processor, via which the central processor gains access to additional functions and/or implements such additional functions.
  • a so-called STO (Safe Torque Off) function (which ensures that unintentional energization of the drive can be reliably prevented) or, for example, a brake control function can be implemented as an additional function, with which a mechanical brake of the elevator system can be safely controlled and operated.
  • STO Safe Torque Off
  • a brake control function can be implemented as an additional function, with which a mechanical brake of the elevator system can be safely controlled and operated.
  • Such an approach is suitable, for example, if an electromechanical brake is to be controlled using a PWM signal, which PWM signal can then be generated by the assigned additional processor.
  • the actual (particularly digital) braking command can be transferred from the central processor to the additional processor, whereby the central processor can derive from the respective travel curve at which times braking should be applied or at which times the brake should be released.
  • electromechanical brakes typically release when energized and intervene when the energization/PWM signal is removed. If the central processor wants to brake, it will instruct the auxiliary processor to adjust the brake energization accordingly.
  • the central processor can implement an electronic braking circuit (in particular using an electrical braking resistor) with which braking energy can be electrically dissipated in a controlled manner.
  • the central processor must have a controlling effect on the motor/drive unit of the elevator system, which is precisely the task of the central processor.
  • the central processor can control an IGBT or other suitable power switch in a hardware circuit to connect an electrical braking resistor.
  • Such an electronic braking circuit implemented with the help of the central processor, can be used in particular to prevent overvoltages, for example, in an intermediate circuit of the power output stage.
  • the central processor can of course also use an additional processor, i.e. instruct the respective additional processor by signals and/or digital commands, for example to establish a remote connection or to execute the respective additional function actually carry out.
  • an additional processor i.e. instruct the respective additional processor by signals and/or digital commands, for example to establish a remote connection or to execute the respective additional function actually carry out.
  • a group control system as mentioned above can, for example, determine which car is moved by the elevator electronics unit in order to respond to an incoming external call.
  • two separate elevator electronics units according to the invention can also be configured in the entire elevator installation, which are then electronically networked with one another and configured to coordinate with one another with regard to the processing of incoming external calls.
  • the central processor of an elevator electronics unit can be configured to communicate with at least one further central processor of a further elevator electronics unit, in particular in order to process incoming external calls in a coordinated manner, namely by generating and outputting corresponding motor control signals to move one of at least two elevator cars of the elevator installation.
  • the respective additional function will generally not be included in the functional scope covered by the central processor.
  • an additional processor can execute commands within the scope of the respective additional function decentralized to the central processor and/or simultaneously with the central processor.
  • a respective additional processor can also be configured to execute/assume several such additional functions.
  • Another central function, preferably performed by the central processor, can be, as mentioned, enabling electrodynamic braking of the elevator car or the recuperation of kinetic braking energy.
  • the central processor can, for example, control a feed-in and regenerative unit (particularly as a pre-stage of the power output stage). This allows kinetic braking energy to be recuperated as electrical power during generator operation of the elevator motor and fed back into an external power grid.
  • the control can In particular, it should be implemented via an additional processor. However, if this function is not to be implemented, the additional processor that is intended to control the regenerative unit can be omitted. The additional processor thus supplements functionality that is controlled by the central processor.
  • Another important additional function that can be added with the help of an additional processor is to enable communication between the central processor and the Internet, since the central processor should not have direct access to the Internet for security reasons.
  • At least one additional processor can thus serve as a gatekeeper, providing the central processor with secure Internet access, similar to a router.
  • the functionality of the elevator electronics unit can be easily adapted to customer requirements, significantly expanding the range of possible applications of the elevator electronics unit.
  • a particular advantage here is that all functions relevant to personal safety in the elevator system can be performed by the central processor, allowing the safety test to initially be limited to the elevator electronics unit without additional processors. In a second step, the safety of the entire system, including the central and additional processors, can then be tested.
  • the at least one additional processor can be operated or operable with a standardized, hardware-independent, programmable software, in particular with a standardized hardware-independent operating system such as Linux, or can comprise such software.
  • the at least one additional processor may communicate with the central processor on the basis of interrupts, in particular bidirectionally.
  • the additional processor does not need its own operating system.
  • the at least one additional processor is configured to trigger at least one central interrupt of the central processor in order to trigger (if necessary) a central interrupt service routine of the central processor assigned to this central interrupt.
  • the central processor is configured to trigger a peripheral interrupt of the at least one additional processor in order to trigger (if necessary) an interrupt service routine of the at least one additional processor assigned to this peripheral interrupt.
  • the transmission of a peripheral interrupt from the central processor to the additional processor can, for example, indicate a specific (particularly time-controlled) event to the additional processor, such as a flush approach to a stop position with the vehicle cabin or a specific operating situation of the elevator system.
  • the additional processor can trigger an appropriate action, which can, for example, enable suitable convenience functions (visualizations and/or the playback of an audio file, etc., upon reaching a specific stop position) or make a temporary special operation of the elevator system known to people.
  • the additional interrupts of the central processor triggered by the additional processor can trigger certain actions of the central processor.
  • the central processor is configured in such a way that such central interrupts acting on the central processor from outside/from an additional processor cannot interrupt time-critical operations, particularly motor control, that the central processor is currently executing.
  • these externally incoming central interrupts can/should be deprioritized compared to internal interrupts generated by the central processor itself.
  • a table can be provided, for example, that lists which peripheral interrupts correspond to which events. Based on such a table, the customer can then adapt the respective peripheral interrupt routine to their requirements in order to implement a specific customer-specific function with the add-on processor.
  • adapting the central processor is not necessary for this, which demonstrates the advantage of this concept.
  • an "open platform for third parties" can be created, which can easily implement its own control functions and/or operating options and/or visualizations (e.g., on a display unit in the elevator car), voice announcements, or other additional functions, particularly convenience functions, with the help of an additional processor.
  • the visualization of an elevator system's user interface is to be adapted to customer requirements, it is sufficient to make the corresponding changes in the additional processor.
  • the elevator electronics unit can also have an adaptation interface, via which the respective additional processor (in particular by a customer on-site).
  • the central processor can transmit unchanged commands to the additional processor to display specific information; however, the additional processor will then visualize this information on the display unit according to the customer's requirements and/or convert it into a corresponding function/output.
  • an operator interface of the elevator system does not necessarily have to communicate bidirectionally with the central processor; bidirectional communication between the central and additional processors, particularly via interrupts, is usually sufficient.
  • the additional processor (like the central processor, for example) can also be operated using hardware-dependent, particularly proprietary, software. While this may have disadvantages for third parties, it does lead to greater security for the overall system.
  • the at least one additional processor can also transmit information to the central processor; however, it is preferred if the respective additional processor cannot have controlling access to the central processor. This is because this can prevent the additional processor from interfering with safety-relevant operations that the central processor must reliably execute. Conversely, however, it can be provided that the central processor can have controlling access to the at least one additional processor. For example, the central processor can thus adapt a sequence of command execution of the respective additional processor and/or place the respective additional processor into a sleep or hibernation state or wake it up from such a state.
  • the elevator electronics unit may include additional components: For example, an electronic call interface, via which the central processor can receive and evaluate the external calls. Furthermore, at least one electronic safety interface, via which the central processor can receive and evaluate signals from the at least one safety circuit. Depending on the design, the central processor can also use such an interface to control the safety circuit, for example to enable the safety circuit to be bypassed (as already explained above with reference to the safety chain). And finally, at least one electronic internal communication interface, via which the central processor can communicate with the at least one additional processor, in particular mediated via a further additional processor and/or bidirectionally. In this case, it is preferred if the safety interface and/or the internal communication interface are each implemented by means of a BUS system.
  • the central processor can thus receive external travel commands via the call interface and translate them into corresponding control commands, actuator control commands (e.g. to open the elevator car door), and/or motor control signals (to control the power output stage).
  • actuator control commands e.g. to open the elevator car door
  • motor control signals to control the power output stage
  • the central processor can query safety-relevant information from external field devices, in particular sensors and actuators of the elevator system, and/or transmit actuator control commands to such a field device and/or read out a safety circuit and/or influence the aforementioned safety chain, in particular bypassing a link in the safety chain.
  • the central processor can communicate with the at least one additional processor via the internal communication interface and receive central software updates and/or release peripheral software updates, as explained in more detail below.
  • a bus is defined here as a system for data transmission between multiple participants over a shared transmission path. If a data transmission is currently taking place between two participants, the other participants must remain silent at the same time, as they would otherwise interfere.
  • Speaking time is distributed according to a schedule (time or signal) known to all participants. Listening, however, is not restricted.
  • the central processor may, in particular, be equipped with a real-time clock.
  • the central processor may also use one of the aforementioned additional processors, for example, if the latter implements a brake monitoring function, which the central processor can then access to collect/document braking parameters.
  • the central processor can also be configured to conduct safe test drives without passengers (e.g., at night) to collect such operating parameters autonomously (i.e., without a human operator). For example, the central processor can safely measure step responses of the drive unit by specifying step changes in the engine speed during such a safe test drive and recording the step response of the drive unit.
  • Such test drives can also be referred to as verification drives. be designed to check/record certain wear parameters or operating parameters that are not accessible without safety risk during normal journeys with passengers.
  • the central processor can be configured, for example, to estimate and/or sensor-detect the operating temperatures of components of the elevator system, which are important, for example, for evaluating power consumption.
  • the central processor can use a real-time clock to estimate the cooling of the drive unit over time. Such sensor-detected or estimated operating temperatures can then be taken into account when executing test runs and recording power consumption.
  • the central processor can also be enabled to determine at least one wear parameter and/or an estimate of the remaining service life of at least one component of the elevator system based on the collected operating parameters.
  • the central processor can thus continuously monitor the service life of the elevator system and/or its wear and tear and, furthermore, based on such determinations/estimates, initiate maintenance of the elevator system and/or the replacement of a component of the elevator system, for example by sending a corresponding digital message (e.g., push message via the Internet), for which the central processor can use an additional processor.
  • the operating parameters stored by the central processor and/or determined wear parameters or remaining service lives can of course also be retrieved externally, in particular via the Internet, in which case one of the additional processors can then forward a retrieval request received via the Internet to the central processor.
  • the central processor can implement the autonomous, i.e., independent, optimization of the elevator system's operation.
  • the central processor can adapt the control of this component based on measured current consumption of a component of the elevator system (in particular, the drive unit and/or a door drive), in particular to enable less wear-related operation or improved component performance.
  • safe test runs which can be considered "reference runs" without passengers in the elevator car (i.e., in an unloaded state) can be carried out within certain times, preferably at night, automatically controlled by the central processor.
  • the central processor can be configured to automatically optimize at least one control parameter using such test runs, in particular taking into account the current temperature of the power output stage and/or the elevator motor.
  • Such control parameters can, in particular, be parameters for a current control and/or a speed control of the drive unit/elevator motor.
  • the central processor can therefore adapt a current controller and/or a speed controller during the optimization.
  • the central processor can autonomously monitor the elevator system's operation to capture specific behaviors of the elevator system's users and, based on such monitoring, optimize the elevator system's operation. Such optimization could, for example, result in the central processor autonomously moving the elevator car to specific floors at specific times of day.
  • the central processor can intelligently provide the drive unit with longer cooling phases during periods of high load (namely when the elevator car is still stationary because the doors close more slowly/later), without these longer cooling phases being directly visible to the user.
  • the central processor can, in response to this, for example in response to a drop in the temperature of the power output stage and/or the motor, extend the door closing time and/or the door opening time again in order to accelerate the travel operation (more precisely: the start-up after entering the car and/or the door opening when a stop position is reached and/or the travel speed of the elevator car).
  • the central processor can also be configured to perform a security check of a peripheral software update obtained from an external source (for example, a USB storage device or mediated via a network connection) in order to be able to load it onto the at least one additional processor.
  • an external source for example, a USB storage device or mediated via a network connection
  • an additional function executed by the additional processor can be updated and/or adapted, in particular according to customer requirements.
  • the peripheral software update can only be loaded after prior approval by the central processor.
  • the central processor When checking and releasing the peripheral software update, it is preferred for the central processor to check at least one release condition.
  • the central processor can contact an external instance, in particular via an additional processor, and/or request confirmation from an operator (e.g., by pressing a button on the elevator electronics unit).
  • the check can also include separate authentication of the peripheral software update, preferably using (very secure) two-factor authentication.
  • Two-factor authentication can be understood here, for example, as the central processor checking the legitimacy of updates and additionally obtaining confirmation from an operator (who then influences the elevator electronics unit on-site).
  • One of the factors can, for example, include biometric or hardware-based identification. In this way, the legitimacy of the update can be securely checked and the additional processor can then be updated accordingly.
  • the central processor can therefore initiate the actual update process for the additional processor.
  • Both factors of such two-factor authentication can also generally be obtained over the Internet (preferably via an encrypted communication connection), which can implement sufficient security, for example, to authorize the installation of a peripheral software update.
  • the central processor takes over all essential safety functions for the operation of the elevator system, it can also be ensured that safety functions are not affected by an update of the software of the at least one additional processor. are adaptable. Therefore, third parties can also safely specify or initiate such peripheral software updates. However, checking the peripheral software update can, for example, increase cybersecurity because it can limit the circle of third parties who can carry out or initiate peripheral software updates. According to the invention, the peripheral software updates are therefore only intended to enable the adaptation of certain (convenience) applications. If the additional processor is reprogrammed by third parties, a conflict with safety-relevant functions of the elevator cannot occur due to the inventive architecture of the elevator electronics unit.
  • the at least one additional processor can comprise at least one additional processor that is configured to perform a security check of a central software update, which is obtained, for example, from an external source (for example, a USB storage device or mediated via a network connection).
  • the central software update can/should be loaded onto the central processor in order to update it.
  • a function of the central processor that is safety-relevant for the operation of the elevator system, for example the aforementioned motor control and/or the aforementioned operation control, can be updated and/or adapted.
  • the central software update can only be loaded onto the central processor after it has been released by the additional processor.
  • peripheral software updates it is also preferred for such a central software update if the said additional processor is in contact with an external instance, in particular via another additional processor, makes contact and requests confirmation from an operator (e.g., by pressing a button on the elevator electronics unit).
  • This verification/approval can therefore include authentication of the central software update, preferably using (very secure) 2-factor authentication.
  • the additional processor that checks the admissibility of the update of the central processor can be implemented either i) by means of hardware-independent programmable software or ii) by means of hardware-dependent, in particular proprietary, software, the design of which depends on the hardware used.
  • the at least one additional processor or the central processor can also be configured to perform a downstream security check, i.e., after a central software update has been installed on the central processor and/or after a peripheral software update has been installed on one of the additional processors.
  • a downstream security check can further increase the safety of the elevator system's operation with regard to cybersecurity.
  • the additional processor regularly checks the admissibility of software used by the central processor for its operation.
  • the elevator electronics unit can initiate safe test runs (of the elevator car) without passengers.
  • Such test runs can be used to record operating parameters from the elevator electronics unit, which can then be taken into account in the downstream safety check.
  • the downstream safety check can include a review of operating parameters collected during such safe test runs initiated by the elevator electronics unit.
  • Such autonomous test runs are only possible because the central processor of the elevator electronics unit, by evaluating information regarding the elevator car position (and preferably also reading at least one safety circuit) and also specifying the travel curve, can carry out such test runs safely and, above all, autonomously.
  • the central processor is configured to check, by reading at least one sensor, whether there are people in the elevator car before executing an autonomous test run. condition.
  • the elevator electronics unit blocks operation of the elevator system with people as soon as the said downstream safety check reveals/notices faulty operation of the elevator system or an error in the central software update.
  • the elevator electronics unit in particular the at least one additional processor or the central processor, performs safe test runs without passengers in the car, for example at night. It is already common practice in the prior art, for example, to conduct learning runs or test runs to test the correct functionality of the elevator brakes. The presence of passengers in the car can be reliably detected by measuring the weight of the car. During such test runs, for example, electrical currents or other sensor signals can also be recorded as operating parameters, which then allows conclusions to be drawn about the correct functioning of the elevator.
  • the power output stage of the elevator electronics unit (together with the central processor) can be designed as an active front-end (AFE) converter.
  • the power output stage can, in particular, comprise a regulated mains rectifier, which can be implemented, for example, by means of a feed-in and feed-back unit.
  • the central processor can be configured to control the AFE converter such that, when the elevator motor is operating in generator mode, kinetic braking power can be electrically fed back into an external network using the AFE converter.
  • the central processor can thus be considered part of the AFE converter.
  • the elevator system can be designed to feed electrical power generated during generator and/or short-circuit operation in the elevator motor back into the grid when the elevator car is decelerating.
  • a braking resistor may be dispensed with.
  • the elevator electronics unit or more precisely the central processor, can also control and regulate such electrical feedback of kinetic braking energy from the elevator system.
  • the central processor can use an additional processor for this purpose. so that it can control it accordingly.
  • the AFE frequency converter implemented in this way possibly with a regulated mains rectifier, can have active power switches on the input side, for example in the form of IGCTs (integrated gate-commutated thyristor) or IGBTs (insulated gate bipolar transistor).
  • the elevator electronics unit can also include an electrical regenerative unit that takes on the function of electrically feeding back braking energy.
  • Configuring the power output stage, including the central processor, as an AFE also enables rapid switching between motor and generator operation of the elevator motor/drive unit.
  • a magnetically excited synchronous motor is used as an elevator motor, it can generate a speed-dependent braking torque that occurs as soon as the motor windings are electrically short-circuited.
  • a short-circuit function can be controlled by the central processor, i.e. the elevator system, in particular the elevator electronics unit, can comprise an electronic short-circuit circuit for this purpose, which can be controlled via the central processor. With such a short-circuit circuit, the motor windings of the elevator motor can thus be short-circuited as required and/or the entire frequency converter can be de-energized to the outside.
  • the central processor can use the short-circuiting not only for the purpose of recuperating braking energy, but also, for example, in the context of emergency operation in order to temporarily protect the elevator car (particularly when using a gearless drive unit).
  • the electromagnetic braking torque generated by the short circuit allows for safe passive movement in the elevator shaft. In this case, the elevator car moves only due to its own weight (and any additional load) and is decelerated by the electromagnetic braking torque; however, controlled regenerative operation may not occur.
  • the central processor can also be configured to process time-critical and/or real-time relevant signals when executing the motor control and/or to generate time-critical and/or real-time relevant motor control commands.
  • the elevator electronics unit can be configured as described above and/or according to one of the claims directed to an elevator electronics unit, or as previously described.
  • the method provides for the update to be performed by uploading a central software update to a processor, wherein this processor can, in particular, be the previously described central processor of the elevator electronics unit.
  • this processor can, in particular, be the previously described central processor of the elevator electronics unit.
  • the security of the central software update is first checked by an additional processor, which can, in particular, be an additional processor of the said elevator electronics unit, before uploading, and is released by this additional processor depending on the test result.
  • the additional processor (for the purpose of release) checks at least one release condition, wherein the additional processor can, in particular, access an external instance, such as an external secure server, for this purpose.
  • the central software update can be obtained from an external source, for example from a USB storage device or via a network connection.
  • At least one release condition checked by the additional processor concerns a parameter that was recorded and saved during operation of the elevator system before the central software update was installed. As already mentioned, this can be done by the central processor or the additional processor.
  • a further method which enables a safety check of an elevator electronics unit and/or an elevator system downstream of a software update.
  • This method can be used, in particular, in addition to or as an alternative to the previously described methods in order to increase safety.
  • the safety check is triggered by the uploading of a central software update to a processor of the elevator system (in particular to the central processor and/or one of the additional processors of the elevator electronics unit) and that, furthermore, the admissibility of software used by the central processor for its operation is checked at regular intervals.
  • This safety check can preferably be carried out automatically (i.e., in particular without external triggering) by the processor itself, in particular by a/the central processor or by an additional processor of the elevator electronics unit.
  • This procedure may also provide for safe test drives without Passengers are transported using the elevator system (preferably automated), and operating parameters are recorded that are taken into account in the subsequent safety check.
  • operating parameters allow conclusions to be drawn about the correct functioning of the elevator system/elevator electronics unit and thus about the admissibility and safety of the central software update performed.
  • FIG. 1 shows an elevator electronics unit 1 according to the invention, which is intended and can be used for controlling an elevator motor 3 of a complex elevator system 28.
  • the elevator electronics unit 1 comprises a processor 11, which implements a control CPU that communicates with external transmitters 27, for example, an elevator user who makes an input via a user interface.
  • the control CPU 11, which is designed as a central processor 4, thus receives external calls and, in response thereto, generates a suitable control of the elevator motor 3 in order to travel to a specific elevator stop with an elevator car 20 of the elevator system 28 that corresponds to the incoming call.
  • the central processor 4 thus implements a motor frequency converter CPU, which generates motor control signals 42 and transmits them to a power output stage 2 as part of the elevator electronics unit 1 (black block arrow).
  • the central processor 4 and the power output stage 2 thus form a frequency converter 39.
  • the power output stage 2 generates, in accordance with the motor control signals 42, As is known, a suitable AC output voltage 38 is provided to operate the elevator motor 3 and to move the elevator car 20, suspended by means of support means 15, accordingly in the elevator shaft.
  • the central processor 4 reads a shaft position sensor or other field devices 24 as needed, which are relevant to the safe operation of the elevator 22. In this way, the central processor 4 can reliably specify the operation of the elevator system 28.
  • the central processor 4 of the elevator electronics unit 1 of the Figure 1 can not only communicate directly with the power output stage 2 to implement a motor control 37, but can also read a safety circuit 23 via an electronic safety interface 7, which in turn queries information from safety-relevant field devices 24 or other sensors 25.
  • the central processor 4 therefore assumes basic functions of elevator operation, such as approaching a desired elevator stop, since the central processor 4 reacts to incoming (i.e. external) digital calls from external transmitters 27 by generating corresponding motor control signals 42 and transmitting them directly to the power output stage 2.
  • the central processor 4 thus directly controls the power output stage 2 by means of the motor control signals 42 and thus, mediated by the power output stage 2, controls the elevator motor 3, namely in accordance with the incoming call.
  • the central processor 4 generates a respective travel curve based on the incoming external call and taking into account at least one piece of information regarding a current position of the elevator car 20, and derives the corresponding motor control signals 42 from this travel curve.
  • the central processor 4 generates the travel curve in sections, so that updated motor control signals are generated at regular intervals. 42 are output from the central processor 4 to the power output stage 2.
  • the central processor 4 can have at least one analog signal output 43 and/or at least one PWM unit 44, which is/are each directly connected to the power output stage 2 in order to transmit analog signals and/or PWM signals 40 as motor control signals 42 directly to the power output stage 2.
  • the power output stage 2 can comprise a hardware circuit 45, for example to convert a PWM signal 40 into corresponding analog control signals for controlling power switches of an inverter circuit 46 of the power output stage 2.
  • the elevator electronics unit 1 has several electronic call interfaces 6, via which the central processor 4 can communicate digitally with external transmitters 27.
  • the central processor 4 can, for example, receive external calls from the elevator shaft or from a display or from an operating interface of the elevator 22.
  • the central processor 4 can, for example, also access an external network node 29 in this way, which in turn can include its own CPU.
  • the central processor 4 also controls the door drive of the elevator car 20.
  • the central processor 4 detects, through communication with zone magnets arranged in the elevator shaft, when the vehicle car 20 enters a door zone. In this case, the central processor 4 bypasses a link in a safety chain of the elevator system. By thus controlling the safety chain, the central processor 4 enables early opening of the doors (by controlling the door drive) before the Vehicle cabin has reached a safe final stopping position within the door zone.
  • the architecture of the elevator electronics unit 1 is thus that the central processor 4, within the framework of the motor control 37, controls the power output stage 2 in order to control and regulate the elevator motor 3 via this stage and thus specify the elevator operation. Furthermore, the central processor 4 assumes basic functions of elevator operation, namely responding to external calls, specifying a travel curve for the elevator operation, and evaluating the aforementioned safety circuit 23. Within the framework of the motor control 37, the central processor 4 implements time-critical operations that must be executed in less than 1 ms. At the same time, however, the central processor 4 also assumes control of the travel operation of the elevator system 28, which also includes numerous non-time-critical operations that can be processed at a lower speed. This is possible because the central processor 4 has a system of intelligent interrupts, so that time-critical and non-time-critical operations are processed sequentially one after the other and in order of priority by the central processor 4.
  • FIG 2 shows a further possible embodiment of an elevator electronics unit 1 according to the invention, which, however, now, in comparison to the Figure 1 , comprises an additional processor 5a.
  • This additional processor 5a assumes an additional function and thus supplements the functional scope of the central processor 4 in a modular manner, because the additional function can be easily added or omitted by adding/omitting the additional processor.
  • the Figure 2 communicates the The central processor 4 communicates via the additional processor 5a with a feed-in and feed-back unit 13, via which the power output stage 2 can draw power from the power grid 12 or feed it back into it.
  • feed-back can occur, for example, when the elevator motor 3 is operated in generator mode and is used to decelerate the elevator car 20.
  • the resulting kinetic braking energy is converted into electrical power, which flows back into the power grid 12 via the unit 13.
  • the central processor 4, with the aid of the additional processor 5a implements an electrodynamic braking function or an energy recuperation function.
  • FIG. 3 comprises the elevator electronics unit 1, which is otherwise analogous to that of the Figure 2 or Figure 1 is designed, a further additional processor 5b, wherein the central processor 4 communicates with the two additional processors 5a and 5b via respective internal communication interfaces 8, which are implemented by means of a BUS system 10.
  • an additional electronic call interface 6c is created by means of the additional processor 5b, via which the central processor 4, mediated by the additional processor 5b, can communicate with further peripheral devices 26.
  • the additional processor 5b is operated by means of hardware-independent software, namely a Linux operating system.
  • the second additional processor 5b also takes over the function of a router 18 and thus mediates between the central processor 4 and an external instance 19 such as the Internet or a cloud.
  • a third An additional processor 5c is provided, which here assumes the function of such a router 18, whereby with this approach, for example, calls from a remote control 31 or other (e.g., distant) external transmitters 27 can also be received.
  • the central processor 4 can again access these external information sources 19, 27, 31 via the additional processor 5c or receive calls from them and convert them into corresponding operations.
  • an evacuation trip of the elevator 22 can be initiated via a remote control 31 without the central processor 4 having to have a direct connection to the Internet.
  • authentication queries and the like can be implemented, for example.
  • the central processor 4 can communicate, in particular digitally, with numerous components of the elevator system 28, it can also collect and document operating parameters during operation of the elevator system 28. This includes, in particular, the documentation of error messages and the travel curves actually completed by the elevator car 20.
  • the central processor 4 also autonomously carries out safe test runs at night without passengers in the elevator car 20, measuring the power consumption of the drive unit as well as other operating parameters. From such collected operating parameters, the central processor 4 then determines estimated values for the remaining service life of individual components. If such a remaining service life turns out to be too short, the central processor 4 (with the help of the additional processor 5c) can send a push message via the Internet and thus initiate maintenance of the elevator system 28.
  • the push message can include information about which component needs to be replaced/maintained.
  • the latter can also autonomously adapt the motor control 37 and thus autonomously optimize the operation of the elevator system 38.
  • the Figure 6 illustrates a method according to the invention with which the central processor 4 can release a peripheral software update to be loaded onto one of the additional processors 5 shown in the elevator electronics unit 1.
  • a software update can, for example, be retrieved from an external instance 19, such as a secure server, via the additional processor 5c.
  • the central processor 4 checks a release condition.
  • 2-factor authentication can be provided as a release condition, in which the central processor 4, on the one hand, accesses the external server 19 via the additional processor 5c and, furthermore, requests confirmation via an operator query 33, which a service technician must enter manually using the input device 35 shown.
  • the central processor 4 can thus first check the admissibility of the update with the help of the external server 19 via a security query 34 and further ensure via the operator query 33 that the software update is actually desired and can be carried out safely at this time because it has been approved by the service technician.
  • the Figure 7 shows the case when a central software update is to be installed on the central processor 4.
  • This software update can also be obtained, for example, via the router 18 from an external instance 19 or For example, in a manner known per se, from an electronic storage device such as a USB stick, which is plugged into a corresponding interface of the elevator electronics unit 1.
  • the central software update is only loaded onto the central processor 4 after it has been released, but this release is performed by one of the additional processors 5 of the elevator electronics unit 1.
  • the responsible additional processor 5 checks at least one release condition for this purpose. It can be particularly advantageous if this release condition relates to parameters, for example, a number of error-free journeys of the elevator system 28 that were already recorded and saved during operation of the elevator system 28 before the software update was loaded.
  • the additional processor 5 In order to avoid any impairment of safety-relevant functions of the elevator system 28 due to the loading of the central software update, the additional processor 5 only releases the central software update if 2-factor authentication has been successfully performed. One of the two factors of this authentication cannot be entered remotely, but must be entered on-site by a service technician by manually operating a control element of the elevator electronics unit 1.
  • the central processor 4 can then perform the safety check based on these collected operating parameters/data and thus decide whether the operating parameters document correct functioning of the elevator system 28 and thus whether safe operation of the elevator 22 can be guaranteed even after the central software update has been installed. If, however, the safety check is negative, the central processor 4 blocks further operation of the elevator 22, at least as soon as there are people in the elevator car 20.
  • an intelligent elevator electronics unit 1 is proposed with a central processor 4 that implements a motor control 37 comprising time-critical motor control commands and also performs basic functions of elevator operation, such as responding to external calls, specifying a travel curve, or evaluating a safety circuit 23 of the elevator system 28 in which the elevator electronics unit 1 is used to control an elevator motor 3.
  • the elevator electronics unit 1 also includes the power output stage 2 required for operating the elevator motor 3 and can further comprise one or more additional processors 5 with which the functionality of the elevator electronics unit 1 can be modularly expanded.
  • This architecture makes it possible, in particular, to securely perform software updates of the central processor 4 and/or an additional processor 5, to perform a downstream safety check of such a software update, or to autonomously optimize the operation of the elevator system 28 with the aid of the central processor 4.

Landscapes

  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Indicating And Signalling Devices For Elevators (AREA)
  • Maintenance And Inspection Apparatuses For Elevators (AREA)
EP23203544.4A 2023-10-13 2023-10-13 Unité électronique d'ascenseur ainsi qu'installation d'ascenseur correspondante, procédé de vérification de sécurité autonome d'une unité électronique d'ascenseur Active EP4538212B1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP23203544.4A EP4538212B1 (fr) 2023-10-13 2023-10-13 Unité électronique d'ascenseur ainsi qu'installation d'ascenseur correspondante, procédé de vérification de sécurité autonome d'une unité électronique d'ascenseur
CA3256119A CA3256119A1 (en) 2023-10-13 2024-10-10 Elevator electronic unit and associated elevator system, method for secure software update and method for a downstream security check
US18/912,802 US20250122048A1 (en) 2023-10-13 2024-10-11 Elevator electronic unit and associated elevator system, method for secure software update and method for a downstream security check

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP23203544.4A EP4538212B1 (fr) 2023-10-13 2023-10-13 Unité électronique d'ascenseur ainsi qu'installation d'ascenseur correspondante, procédé de vérification de sécurité autonome d'une unité électronique d'ascenseur

Publications (2)

Publication Number Publication Date
EP4538212A1 true EP4538212A1 (fr) 2025-04-16
EP4538212B1 EP4538212B1 (fr) 2026-04-08

Family

ID=88413928

Family Applications (1)

Application Number Title Priority Date Filing Date
EP23203544.4A Active EP4538212B1 (fr) 2023-10-13 2023-10-13 Unité électronique d'ascenseur ainsi qu'installation d'ascenseur correspondante, procédé de vérification de sécurité autonome d'une unité électronique d'ascenseur

Country Status (3)

Country Link
US (1) US20250122048A1 (fr)
EP (1) EP4538212B1 (fr)
CA (1) CA3256119A1 (fr)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120793651B (zh) * 2025-05-23 2026-03-24 九龙仓(长沙)置业有限公司 一种基于ai的电梯更新控制方法及系统

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0663366A1 (fr) * 1994-01-12 1995-07-19 Inventio Ag Commande intelligente décentralisée pour ascenseurs
EP2251293A1 (fr) * 2009-05-15 2010-11-17 ThyssenKrupp Aufzugswerke GmbH Dispositif de commande d'ascenseur
EP2916219A1 (fr) * 2014-03-03 2015-09-09 Kone Corporation Système et procédé de mise à jour de logiciel d'ascenseur dans des cartes processeurs d'ascenseur
EP3173366A1 (fr) * 2015-11-25 2017-05-31 Otis Elevator Company Manipulation de système automatisé de transport de passagers par validation et activation à distance automatisées d'un logiciel de commande
EP3295263A1 (fr) * 2015-05-12 2018-03-21 Otis Elevator Company Procédé de mise à jour d'un logiciel lié à la sécurité
CN109230921A (zh) * 2018-10-10 2019-01-18 中际联合（北京）科技股份有限公司 升降设备控制系统及其控制方法
DE102017213405A1 (de) * 2017-08-02 2019-02-07 Franz Xaver Meiller Fahrzeug- Und Maschinenfabrik - Gmbh & Co Kg Aufzugsystem
CN109951096A (zh) * 2017-12-19 2019-06-28 株式会社日立大厦系统 电力转换装置
EP3617111A1 (fr) * 2018-08-30 2020-03-04 Inventio AG Téléchargement de mises à jour de logiciel de contrôle sur des systèmes de transport de passagers
EP3915912A1 (fr) * 2020-05-29 2021-12-01 KONE Corporation Système de transport de personnes et procédé de mise à jour de logiciel d'un composant de transport de personnes dans un système de transport de personnes

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0663366A1 (fr) * 1994-01-12 1995-07-19 Inventio Ag Commande intelligente décentralisée pour ascenseurs
EP2251293A1 (fr) * 2009-05-15 2010-11-17 ThyssenKrupp Aufzugswerke GmbH Dispositif de commande d'ascenseur
EP2916219A1 (fr) * 2014-03-03 2015-09-09 Kone Corporation Système et procédé de mise à jour de logiciel d'ascenseur dans des cartes processeurs d'ascenseur
EP3295263A1 (fr) * 2015-05-12 2018-03-21 Otis Elevator Company Procédé de mise à jour d'un logiciel lié à la sécurité
EP3173366A1 (fr) * 2015-11-25 2017-05-31 Otis Elevator Company Manipulation de système automatisé de transport de passagers par validation et activation à distance automatisées d'un logiciel de commande
DE102017213405A1 (de) * 2017-08-02 2019-02-07 Franz Xaver Meiller Fahrzeug- Und Maschinenfabrik - Gmbh & Co Kg Aufzugsystem
CN109951096A (zh) * 2017-12-19 2019-06-28 株式会社日立大厦系统 电力转换装置
EP3617111A1 (fr) * 2018-08-30 2020-03-04 Inventio AG Téléchargement de mises à jour de logiciel de contrôle sur des systèmes de transport de passagers
CN109230921A (zh) * 2018-10-10 2019-01-18 中际联合（北京）科技股份有限公司 升降设备控制系统及其控制方法
EP3915912A1 (fr) * 2020-05-29 2021-12-01 KONE Corporation Système de transport de personnes et procédé de mise à jour de logiciel d'un composant de transport de personnes dans un système de transport de personnes

Also Published As

Publication number Publication date
EP4538212B1 (fr) 2026-04-08
US20250122048A1 (en) 2025-04-17
CA3256119A1 (en) 2025-10-31

Similar Documents

Publication Publication Date Title
EP1239354B1 (fr) Procédé de surveillance d'un dispositif de freinage, en particulier un appareil de manipulation, ainsi qu'un appareil de commande et de surveillance
EP2022742B1 (fr) Système d'ascenseur
DE4231359C2 (de) Steuergerät für einen Induktionsmotor
EP3197815B1 (fr) Installation de transport de personnes comprenant au moins un onduleur
DE102015001094A1 (de) Servomotorsteuerung und Produktionssystem damit
EP2359466B1 (fr) Procédé de fonctionnement d'un entraînement, ainsi qu'entraînement
EP4538212B1 (fr) Unité électronique d'ascenseur ainsi qu'installation d'ascenseur correspondante, procédé de vérification de sécurité autonome d'une unité électronique d'ascenseur
EP3353108B1 (fr) Dispositif de surveillance d'ascenseur
WO2016001038A1 (fr) Système de commande d'entraînement de porte modulaire et système d'entraînement de porte modulaire
EP2160349B1 (fr) Agencement, module et procédé pour le fonctionnement sûr d'une installation
EP3390257A1 (fr) Installation de transport de personnes, procédé de maintenance et commande de maintenance
DE19641592C2 (de) Automatischer Türantrieb bzw Verfahren zur Steuerung eines automatischen Türantriebs
EP3704048A1 (fr) Dispositif de surveillance de sécurité destiné à surveiller des états relatifs à la sécurité dans une installation de transport de personnes ainsi que procédé destiné à faire fonctionner ce dernier
EP3128170B1 (fr) Éolienne avec entrainement azimutal
EP3730440A1 (fr) Dispositif de commande permettant de commander un fonctionnement d'une installation de transport de personnes
EP3012961A2 (fr) Entrainement dote d'un frein de securite, systeme de commande de moteur et procede de fonctionnement d'un systeme de commande de moteur
DE202016101183U1 (de) Aufzug mit einem Sicherheitscontroller zum unmittelbaren Beeinflussen der Bremskraft
EP1410114B1 (fr) Unite d'entrainement d'un telepherique avec dispositif de deconnexion et d'arret regules et/ou modules
AT521134B1 (de) Industrieanlage
DE19643408C2 (de) Notbetriebssteuerung für ein Hebezeug
EP1323662B1 (fr) Procédé pour stopper un dispositif de transport pour personnes
WO2020249475A1 (fr) Procédé servant à faire fonctionner une installation de transport de personnes comprenant un dispositif de sécurité pouvant être scellé par voie électronique
EP1323661B1 (fr) Procédé pour stopper un dispositif de transport pour personnes
DE102018109316A1 (de) Antriebssystem, vorzugsweise Roboter
WO2026082316A1 (fr) Procédé pour faire fonctionner un système d'ascenseur avec des dispositifs de freinage d'urgence

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20241219

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Free format text: PREVIOUS MAIN CLASS: B66B0001280000

Ipc: B66B0001300000

Ref document number: 502023003663

Country of ref document: DE

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: B66B 1/30 20060101AFI20251022BHEP

Ipc: B66B 1/34 20060101ALI20251022BHEP

INTG Intention to grant announced

Effective date: 20251107

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

P01 Opt-out of the competence of the unified patent court (upc) registered

Free format text: CASE NUMBER: UPC_APP_0006408_4538212/2026

Effective date: 20260223

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: CH

Ref legal event code: F10

Free format text: ST27 STATUS EVENT CODE: U-0-0-F10-F00 (AS PROVIDED BY THE NATIONAL OFFICE)

Effective date: 20260408

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

RIN1 Information on inventor provided before grant (corrected)

Inventor name: HOPPENSTEDT, ROLAND

Inventor name: DIFFENBACH, MARTIN

Inventor name: SPANNAGEL, MATHIAS

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 502023003663

Country of ref document: DE