ES2985201T3 - Security system - Google Patents

Abstract

A security system (1) for unlocking at least one door lock (200), in particular an escape route safety device, is described and shown, the security system (1) comprising an actuating element (10), in particular an emergency button (10), the actuating element (10) comprising a manually operable actuating element (11), wherein by actuating the actuating element (11) an actuating signal for unlocking the door lock (200) can be generated. According to the invention, it is provided that the security system (1) comprises an electronic device (207) and that, by means of the actuating signal, the electronic device (207) electronically prevents a locking mechanism (205) of the door lock (200) from being locked without a cancellation condition occurring. (Automatic translation with Google Translate, without legal value)

Description

DESCRIPTION

Security system

The invention relates to a security system for unlocking at least one door lock, in particular for securing emergency exits, the security system comprising an actuating element, in particular an emergency button, the actuating element comprising an actuating element, an actuating signal for unlocking the door lock being capable of being generated by actuating the actuating element. The invention further relates to a method for unlocking at least one door lock, in particular for securing emergency exits, the actuating element, in particular an emergency button, comprising an actuating element, and an actuating signal for unlocking the door lock being generated by actuating the actuating element. Furthermore, the invention relates to a use of the security system according to the invention.

Safety systems for securing emergency exits are known. The safety systems comprise at least one emergency button configured to latch and a door lock. If the actuating element of the emergency button is actuated, the actuating element is held in an actuating position. In the actuating position, an electrical circuit is interrupted, such that a door lock is transferred to an unlocked state. If a locked state of the door lock is to be restored, a user, i.e. an authorized person, must manually transfer the emergency button on site by turning the actuating element from the actuating position to a starting position.

According to DIN EN 13637, the use of non-locking trigger elements is also permitted. This is problematic because the door can be locked again even if a danger persists, and the emergency exit can therefore be unavailable for persons fleeing the danger.

Document DE 102014113647 A1 discloses an emergency button designed with a scrollable display where a main alarm can be triggered by a pre-alarm and a continuous touch of a screen. An alarm opening mode simulates a mechanical interlocking of the emergency button.

EP 2725 172 A2 discloses a security system in which an alarm activation device is connected via a bus system to a locking device.

The object of the invention is therefore to present a security system and a method for unlocking at least one door lock which ensures the security of the security system also by using a non-locking actuating element.

This object is achieved by a security system according to independent claim 1. Advantageous improvements of the security system are indicated in the device-dependent claims, the description and the figures. Furthermore, the invention is also achieved by the features of the independent method claim according to claim 15. Features and details which are described in connection with the security system are fulfilled in this respect also in connection with the method according to the invention and vice versa. In this respect, the features mentioned in the description and in the claims may be essential for the invention in each case individually or in combination with one another. In particular, a method which can be carried out with a security system according to one of claims 1 to 14 and/or a security system with which a method according to claim 15 can be carried out is protected. Furthermore, a use of the security system according to the invention is protected.

The objective outlined above is achieved on the basis of the safety system described at the beginning in that the safety system comprises an electronic device and, as a result of the actuation signal, the electronic device electronically prevents a door locking mechanism from being controlled for locking without the presence of a cancellation condition. In other words, the actuation signal causes, with the aid of the electronic device, in particular in the electronic device, a door locking mechanism from being controlled for locking without the presence of a cancellation condition. Thus, control for locking the locking mechanism is prevented until the cancellation condition is reached. In this way, it is achieved that, after actuation of the actuating element for unlocking the door lock, a locking of the door lock is reliably prevented. Thus, by electronically preventing, in particular as a result of the actuation signal, the locking mechanism from being controlled for locking without the achievement of the cancellation condition, the safety of the safety system can be ensured. By preventing the system electronically, the safety of the safety system can be easily ensured. In particular, no additional mechanical components are required and/or the electronic preventing is carried out statically. "As a result of the actuation signal" means in this sense in particular that, after the generation of an actuation signal, a new blocking is prevented, regardless of whether the actuation signal is generated further or not.

After the abort condition has been met, the safety system again enables control for locking. It may be that after the abort condition has been met, the locking mechanism is controlled for locking. In this respect, in particular, after the abort condition has been met, the locking mechanism is controlled directly and automatically for locking. In particular, the abort condition causes the locking mechanism to be controlled for locking. The abort condition thus causes the door lock to be transferred to the locked state.

Locking is the transfer of the door lock to the locked state. Unlocking is the transfer of the door lock to the unlocked state.

The security system may comprise the locking mechanism.

The locking mechanism can be configured, for example, electromechanically or purely electromagnetically. The locking mechanism comprises, for example, at least one coil. A control of the locking mechanism for locking or unlocking can be carried out in particular when an electrical power supply is switched off or on. The electrical power supply can serve to supply the coil with electrical energy.

An electromagnetic locking mechanism is described as an example in DE10050111 C1. In the unlocked state, for example, no magnetic forces act on the door. In the locked state, for example, magnetic forces act on a door.

An electromechanical locking mechanism has a mechanical connection to the door in the locked state. In the unlocked state, the mechanical connection is cancelled or can be cancelled.

The electromechanical locking mechanism can thus comprise, for example, a locking element, i.e. a bolt or a door latch, which is in a retracted position in the unlocked state of the door lock. In the retracted position, the locking element is disengaged from the door. In the locked state, the locking element is engaged with the door. In another alternative to an electromechanical locking mechanism, the locking mechanism is constructed in the style of a door opener. That is, the locking mechanism comprises a latch element. In the locked state of the door lock, a door latch is engaged with the locking mechanism. In the unlocked state, the latch element releases the door latch such that the door latch can be disengaged from the locking mechanism, in particular by applying pressure to the door.

Preferably, deactivation of the power supply leads to an unlocked state of the door lock. Thus, control of the locking mechanism for unlocking the door lock is carried out by deactivating the power supply. Preferably, activation of the power supply leads to a locked state of the door lock. Thus, control of the locking mechanism for locking is carried out by deactivating the power supply.

Alternatively, the safety system can be configured without the locking mechanism. In this case, the safety system only controls the locking mechanism. For example, the safety system activates or deactivates the power supply for the locking mechanism or causes the power supply to be activated or deactivated.

A "check for locking or unlocking" also occurs if the security system receives information about the status of the locking mechanism. A "check for locking or unlocking" also occurs when, as detected by the information, the locking mechanism does not correspond to the nominal state and therefore an alarm is issued and/or a new attempt is made to reach the nominal state.

The security system according to the invention comprises a door lock control. If a door lock control is provided, the door lock control preferably controls the locking mechanism. To this end, the door lock control can activate or deactivate the supply of electrical energy to the locking mechanism.

The security system may comprise the door lock control, but not the locking mechanism. In this case, the door lock control is designed as a door lock adapter. The door lock adapter serves to use the security system according to the invention on already installed locking mechanisms.

The door lock comprises the locking mechanism and, if present, the door lock control. Particularly preferably, the security system comprises the door lock.

The door closer or locking mechanism may be integrated into a mechanical lock.

In the following, a distinction is made between user and operator. A user can be any person who uses the security system. A user can be, for example, a guest who wants to escape through the door secured by the security system. An operator is used to operate the security system. The operator has access to a monitoring device of the security system and/or can authenticate himself with respect to the security system, in particular in order to operate the security system. The monitoring device can be a PC or a display. The operator can, for example, achieve the abort condition. In the following, the actuation signal is understood to mean the signal that has been generated by the user through the actuation of the actuating element in order to unlock the door lock and release the emergency exit.

The safety system is used in particular to secure emergency exits. The safety system is therefore used to release the emergency exit. This means that actuation of the actuating element leads to unlocking without user authentication. Unlocking can take place directly or with a delay.

The actuating element is preferably designed as an emergency button. In this case, the actuating element corresponds to the actuating element of the emergency button. Alternatively, the actuating element can be designed as a panic bar assembly. In this case, the actuating element is designed as a panic bar. The actuating element can be designed as a fitting assembly. In this case, the actuating element is designed, for example, as a door handle.

According to the invention, the door lock control and the actuating element are connected to a first bus system. A connection to a bus system is understood in the following as a direct connection, so that a component connected to the bus system is to be regarded as a participant in the bus system with its own bus address. The door lock control and the actuating element are connected to each other via the first bus system.

The triggering element can directly control the locking mechanism for unlocking. Alternatively and particularly preferably, the triggering element triggers a control of the locking mechanism for unlocking. A triggering of a control is understood in particular to mean the sending of a message, for example via the first bus system, which contains information and/or a command that causes the direct or indirect recipient of the message to carry out the control. The sender of the message initiates the control. Triggering a control is thus understood to mean indirect control. Thus, for example, the triggering element can send a message via the first bus system to the door lock control, in response to which the door lock control controls the locking mechanism for unlocking. The triggering element can trigger, in particular in a delayed manner, the unlocking of the locking mechanism.

It may be provided that the actuation of the actuating element can be carried out in such a way that the actuating element can be moved from a starting position to an actuating position. In this way, the actuating element can be moved mechanically. Preferably, the actuating signal is generated in the actuating position. In this way, the actuating element can provide the user with information about the actuation.

It is also conceivable that the actuating element can be moved from the actuating position to the starting position after actuation, preferably without manual action, by means of a restoring agent. The actuating element can be moved by means of the restoring agent, for example, after a control of the restoring agent or directly after the manual actuation has ended to the starting position. The restoring agent can be a spring.

According to the invention, the actuating element is always actuated mechanically without locking. In this case, the actuating element can be held in the starting position during actuation or moved into the starting position directly after manual actuation. In this way, it is achieved that the actuating element can be actuated again even without manual retraction of the actuating element. Actuating the actuating element again can only cause unlocking of the door lock if the door lock is not already in the unlocked state. If the door lock is already in the unlocked state and the actuating element is actuated, the locking mechanism in particular is not controlled. The door lock remains in the unlocked state.

The actuating element preferably has a lighting zone. The lighting zone is preferably provided centrally on the actuating element. With the aid of the lighting zone, light of one colour, in particular red light, is always emitted. A light source arranged behind the actuating element can shine through the lighting zone.

It may be provided that a first program code is stored in the electronic device, the first program code preventing the locking mechanism from being controlled for blocking without the presence of the abort condition as a result of the generation of the actuation signal. In this way, the object according to the invention can be achieved in a simple manner. In particular, the first program code is stored in a first digital processing means of the electronic device. A second program code may be stored redundantly in a second processing means of the electronic device. By means of the first program code and the second program code, it is possible in each case to prevent the locking mechanism from being controlled for blocking without the presence of the abort condition as a result of the generation of the actuation signal. This provides fail-safety.

The first and/or second processing means may each comprise a processor. The first and/or second processing means may each be configured, for example, as microprocessors or microcontrollers. The first and/or second processing means may each comprise a non-volatile memory.

The electronic device can be located, for example, in the actuating element, in particular in the emergency button. Particularly preferably, however, the door lock comprises, in particular in the door lock control, the electronic device. In this way, the door lock control prevents, as a result of the actuation signal, the locking mechanism from being controlled for locking without the presence of a cancellation condition. Locking is thus prevented in the event of danger where the safety-relevant control of the locking mechanism is carried out.

The door lock control may comprise the first and second digital processing means. The first and second processing means serve to control the locking mechanism independently of each other. In this way, redundancy is achieved.

The actuating element, in particular the emergency button, may comprise an electronic unit. The electronic unit serves as a control for the actuating element. The electronic unit may comprise a first and a second digital actuating element processing unit, in particular a first and a second emergency button processing unit. The first and/or the second actuating element processing unit may each comprise a processor. The first and/or the second actuating element processing unit may be configured as microprocessors or microcontrollers. The first and the second actuating element processing unit may each comprise a non-volatile memory. In addition, the electronic unit may comprise a third digital actuating element processing unit.

The first and second actuating element processing units can each independently of one another register a drive signal. In this respect, the first actuating element processing unit registers a first drive signal and the second actuating element processing unit registers a second drive signal. In response thereto, the first and second actuating element processing units can each independently of one another trigger the control of the door locking mechanism by means of the first bus system for unlocking. In this respect, in particular at least one message is sent, in which the first and/or the second actuating element processing unit informs the door locking control about the presence of the first or the second drive signal via the first bus system. In this respect, in particular the first actuating element processing unit informs the first processing means and the second actuating element processing unit informs the second processing means. In this way, in particular both the first and the second processing means control the locking mechanism for unlocking, i.e. deactivate the supply of electrical power.

A life signal from the first and second actuating element processing units is preferably sent regularly to the door lock control. In this respect, the first and second actuating element processing units each output a life signal of their own. The life signals may be contained in a message. In this respect, the first processing means checks the life signal of the first actuating element processing unit and the second processing means checks the life signal of the second actuating element processing unit. If one of the life signals is missing on one or more occasions, the first and second processing means control the locking mechanism for unlocking. In this respect, one processing means can inform the other processing means about the absence of the life signal.

According to the invention, the actuating element electronically stores that an actuating signal, in particular the first and the second actuating signal, has been generated until the abort condition is present. According to the invention, the actuating element electronically stores in the first actuating element processing unit and, redundantly, in the second actuating element processing unit that an actuating signal has been generated. The storage can be carried out in the non-volatile memories of the first and the second actuating element processing units. In particular, the first actuating element processing unit stores that the first actuating signal has been generated and the second actuating element processing unit stores that the second actuating signal has been generated. In this way, it is achieved that the security system does not forget the actuation of the actuating element.

The door closing control may electronically store that an actuation signal has been generated until the presence of the abort condition. In particular, the door closing control electronically stores in the first processing means and redundantly in the second processing means that an actuation signal has been generated. The storage may be effected in the non-volatile memories of the first and second processing means.

Preferably, it is stored in both the actuating element and the door closing control that an actuation signal has been generated.

In order to achieve a particularly high level of safety, the actuating element according to the invention repeatedly sends a signal to the door lock control until the abort condition is present, that an actuating signal has been generated previously. Preferably, the signal is always sent together with a life signal until the abort condition is present. In this respect, the first actuating element processing unit can inform the first processing means repeatedly until the abort condition is present, about the generation of the actuating signal, and the second actuating element processing unit can inform the second processing means accordingly. The information can be contained in a message which is sent via the first bus system. It may be that the first actuating element processing unit always sends the safety-relevant message, for example the message about the presence of an actuating signal, the life signal or the signal that the actuating signal has been generated previously, to the door lock control. The message comprises the information of the first and the second actuating element processing units.

It may be provided that the electronic device comprises an electronic holding-open system, the holding-open electronic system being able to be transferred to an actuating state as a result of the actuation signal. When the cancellation condition is reached, the holding-open electronic system can be transferred to a starting state. In the actuating state, the holding-open electronic system prevents the locking mechanism from being controlled for locking. In the starting state, the holding-open electronic system allows the locking mechanism to be controlled for locking. When the cancellation condition is reached, the holding-open electronic system is transferred to the starting state. By means of the holding-open electronic system, the prevention of locking after the generation of the actuation signal is achieved in a particularly safe and simple manner.

The electronic hold-open system may comprise, in addition to the first program code, a variable. The first program code comprises the variable or has access to the variable. In an initial state of the electronic hold-open system, the variable is set to a start value. In the actuation state, the variable is set to an actuation value by means of which the door lock is prevented from being blocked. The variable may be binary. If the abort condition is reached, the value of the variable is set to the start value. The first program code records the value of the variable and enables a door lock to be blocked if the value of the variable corresponds to the start value and prevents a door lock to be blocked if the value of the variable corresponds to the actuation value. The variable is stored in the non-volatile memory of the first processing means. The second program code processes the variable accordingly, which is stored redundantly in the non-volatile memory of the second processing means.

The variable may be stored in the first and second trigger element processing units. The variable may be repeatedly transferred by the trigger element to the door closing control.

If the variables transmitted by the first and second actuating element processing units to the door closing control do not match, in particular a control of the locking mechanism for locking is not permitted. If the variables transmitted by the first and second processing means do not match, in particular a control of the locking mechanism for locking is not permitted. For this purpose, the first and second processing means communicate with each other.

It can preferably be provided that a number of door lock controls and a number of actuating elements are connected to one another via the first bus system and the number of door lock controls is associated with the number of actuating elements such that when one of the actuating elements is actuated, only the at least one door lock control that is associated with the actuated actuating element controls the respective door lock mechanism for unlocking. By means of the association, a selective unlocking of the door locks is provided. Thus, when one of the actuating elements that are connected to the first bus system is actuated, not all door lock controls that are connected to the first bus system are caused to control the respective door lock mechanism for unlocking, but only those door lock controls that have previously been associated with the actuating element. The other door lock controls that have not previously been associated with the actuating element refrain from controlling the respective door lock mechanism for unlocking. It is therefore possible to arrange door locks connected to the first bus system on different doors. If the actuating element is actuated, only the door on which the actuating element is arranged can be opened, for example. The other doors remain closed. If the actuating signal is generated in an actuating element of such a safety system, only the corresponding locking mechanism for locking can be controlled electronically in the at least one door lock control that is associated with the activated actuating element until the abort condition is present. Door lock controls of the first bus system that are not associated with the actuating element can, however, still be blocked.

An abort signal can be used to achieve the abort condition. The abort signal can be generated by an abort action directly on the actuating element. In this way, the operator is directed to the actuating element and can ensure that there is no danger at the location. The abort action can be carried out at least by means of a contact of the actuating element or by means of near-field communication.

The abort action that is carried out directly on the actuating element can be generated by actuating the actuating element. In this way, the actuating element already provided for the release of the emergency exit is used in a practical way. Thus, a further additional element on the actuating element can be dispensed with and, in particular, the operator can be brought to the actuating element. It may be that the abort condition is achieved without a rotational movement of the actuating element. The abort action on the actuating element can be carried out without rotation of the actuating element. In particular, it is conceivable that the actuating element can only be moved translationally. In particular, the actuating element can only be moved between the starting position and the actuating position.

It is conceivable that the cancellation signal corresponds to the drive signal. Thus, the same action can serve both for generating the drive signal for unlocking the door lock and as a cancellation action.

In order for the electronic device to detect that the actuation of the actuating element is carried out to achieve the cancellation condition and not to generate the actuation signal for releasing the emergency exit, the electronic device must have other additional information.

The security system may include an authentication device associated with the triggering element or be in communication connection with the authentication device associated with the triggering element. Communication may be via cable or wirelessly.

Authentication at the authentication device can be carried out, for example, by entering a code, by transmitting a code via cable or wirelessly, by recognizing a key by means of rotation, or by detecting personal characteristics such as a fingerprint or iris. The authentication device can be designed, for example, as a keypad, a key switch, a fingerprint sensor or a reader. The authentication device can be associated with one or more trigger elements. Preferably, the authentication device is associated with only one trigger element.

After successful authentication, the electronic device receives a positive identification signal about the authentication on the authentication device.

It is conceivable that the authentication device, in the absence of danger, could be used to enable an authorised person to unlock the door lock.

In this regard, a security system control device can receive a positive authentication signal from the authentication device and cause the door lock to be unlocked.

In order to achieve the cancellation condition, authentication may be carried out on the authentication device, in particular a reception of a positive identification signal by means of the triggering element. In order to achieve the cancellation condition, it is possible that the cancellation signal has been generated and that authentication has also been carried out on the authentication device, in particular the reception of the positive identification signal.

It may be that, for the achievement of the cancellation condition, a predetermined time sequence must be observed during the generation of the cancellation signal and the authentication, in particular the reception of the identification signal. Additionally or alternatively, it may be that, for the achievement of the cancellation condition, a predetermined order must be observed during the generation of the cancellation signal and the authentication, in particular the reception of the positive identification signal. The generation of the cancellation signal and the authentication carried out, in particular the generation of the cancellation signal and the authentication carried out in which the time sequence and/or order must be maintained, may be sufficient to achieve the cancellation condition and, therefore, at least allow the blocking of the door closure.

In particular, the cancellation signal and the authentication, in particular the reception of the positive identification signal, may occur at least partially simultaneously. The authentication, in particular the reception of the positive identification signal, should preferably last longer than the generation of the cancellation signal.

For example, to achieve the cancellation condition, it may be sufficient to first actuate the actuating element and, while the actuating element is held actuated, turn a key in the key switch. The key remains turned while the actuating element is released.

In another example, to achieve the cancellation condition, it may be sufficient to first turn the key in the key switch and then actuate the actuating element while the key remains turned. The key remains turned as long as the actuating element is released.

It may be that the abort signal generated by an action performed directly on the actuating element is always required for the attainment of the abort condition. Alternatively, it may be that the abort signal generated by the action performed directly on the actuating element is only required for the attainment of the abort condition if, after the generation of the actuating signal, the door has been opened. For this purpose, a signal from at least one door status monitoring device may be provided to the security system, in particular the electronic device. A door is also understood to mean a door leaf.

The door status monitoring device is used to detect whether the door is open or closed. The door status monitoring device can be, for example, a door contact, a sensor, a switch and/or a door lock with a detectable closed and/or latch position. The safety system can comprise the door status monitoring device or can be connected to the door status monitoring device. Particularly preferably, at least a first door status monitoring device and a second door status monitoring device are provided for a door, in particular for a door leaf, and/or a door lock. In this way, fail-safety can be achieved. Preferably, the first door status monitoring device differs in its design from the second door status monitoring device. In this way, fail-safety is increased.

In particular, if the door, in particular the door leaf, remains closed after the generation of the drive signal, there is at least one other possibility available to the safety system to achieve the cancellation condition. For example, in this case it may be sufficient for a predetermined time interval, for example 60 seconds, to elapse from the generation of the drive signal. In the expression "from the generation of the drive signal" a time for informing the electronic device about the drive signal may be ignored. The predetermined time interval may be stored in the electronic device. Thus, for achieving the cancellation condition, it may be sufficient if:

a. ) since the generation of the drive signal, no signal has been received from the door status monitoring device about the opening of the door leaf within the predetermined time interval in the security system, in particular by the electronic device, and

b. ) the predetermined time interval has elapsed.

The electronic device may comprise a timer for determining the time interval.

The predetermined time interval can be fixed and cannot be changed on the electronic device. Alternatively, an operator can adjust the predetermined time interval using a parameterization program. In this case, a minimum time can be predefined.

If the first and second door status monitoring devices are provided in a divergent manner, condition a.) may be that

a.) neither a signal from the first door status monitoring device nor from the second door status monitoring device, which are provided for a door leaf and/or a door lock, has been received in the security system concerning the opening of the door leaf since the generation of the drive signal within a predetermined time interval, in particular by the electronic device.

It may be provided that the security system comprises a central emergency exit control, with an abort signal being able to be generated at the central emergency exit control. The abort signal or a message about the abort signal can be sent via the at least one bus system, in particular via at least a second bus system, to the electronic device. The abort signal can serve to achieve the abort condition. In particular, authentication of an operator at the central emergency exit control is necessary for generating the abort signal. The emergency exit control may comprise an identification device for this purpose. Authentication at the central emergency exit control can be carried out, for example, by entering a code, by transmitting a code via cable or wirelessly, by recognizing a key by rotation, by detecting personal characteristics such as, for example, a fingerprint or iris. For example, the central emergency exit control may comprise a keypad, a key switch, a fingerprint sensor or a reader as an identification device.

The identification device preferably has at least one further function. The central emergency exit locking device may comprise a central emergency button. If the central emergency button is actuated, the locking mechanism is controlled for unlocking. The operation of controlling the locking mechanism for unlocking as a result of actuating the central emergency button is carried out in a fail-safe manner and is therefore suitable in the event of danger. If the central emergency button has been actuated, the electronic device preferably prevents the door locking mechanism from being controlled for locking until a corresponding signal is generated by the authentication identification device and the signal or a message about the signal is received by the electronic device.

In particular, if automatic locking after the predetermined time interval has elapsed if the door has been left closed is not considered sufficiently safe, it is conceivable that, in addition to conditions a) and b), for achieving the cancellation condition, it is provided as an additional condition that c.) the cancellation signal has been generated in the central emergency exit control.

Conditions a.) to c.) may be sufficient to achieve the cancellation condition.

It is preferably conceivable that a permissible abort signal contributing to the attainment of the abort condition is generated only after the predetermined time interval has elapsed. Authentication at the central emergency exit control within the predetermined time interval, on the other hand, does not lead to a permissible abort signal contributing to the attainment of the abort condition. It may be that the expiration of the predetermined time interval can be visually displayed at the central emergency exit control. For this purpose, the central emergency exit control can comprise lighting agents with which, in particular, a delay in unlocking as a result of actuation of the actuating element can be additionally displayed. The central emergency exit control can comprise an emergency module. The emergency module can comprise, in addition to the central emergency button and the identification device, the lighting agents.

If the door lock has been unlocked due to a fire alarm and the door has not been opened afterwards, which must be detected in particular by both the first and the second door status monitoring device, a locking of the door lock can also be triggered after the fire alarm has ended by authentication at the identification device. Only after the fire alarm has ended does authentication at the identification device lead to a locking again. For this purpose, the door lock control receives a signal about the authentication. It may be possible that the possibility of triggering a locking of the door lock after the fire alarm has ended by authentication at the identification device can be visually displayed on the central emergency exit control. In particular, the same lighting agents are used for this purpose.

It is conceivable that the actuating element comprises lighting agents. The lighting agents of the actuating element in situ can serve to visually represent whether the presence of a fire alarm or an actuation of the actuating element prevents electronic control of the door locking mechanism for locking without the presence of a cancellation condition. Preferably, the lighting agents represent in different ways whether relocking is prevented by the presence of a fire alarm or an actuation of the actuating element. Furthermore, it is conceivable that the lighting agents of the actuating element represent in situ whether relocking is prevented by actuation of the central emergency button. In particular, the lighting agents of the actuating element in situ can represent in different ways whether an actuation of the central emergency button or an actuation of the actuating element has been carried out in situ. In this way, the operator can recognize whether a re-establishment of a lock can be achieved by a cancellation action in situ or by operating the identification device.

In particular, a signal about the opening of the door after the predetermined time interval has elapsed or after the fire alarm has ended does not prevent the cancellation condition from being achieved.

It may be that conditions a.) and b.) or a.) to c.) are not sufficient to achieve the abort condition and thus allow the door to be locked. On the other hand, it may be that the abort condition is only achieved if it is also stored in the safety system, in particular electronically, that the presence of conditions a.) and b.) is permissible for achieving the abort condition and/or it is stored in the safety system that conditions a.) to c.) are permissible for achieving the abort condition. Pre-setting of the admissibility can be carried out by an operator. Pre-setting of the admissibility can be carried out with the aid of a parameterisation program. In the parameterisation program, the operator can manually set whether conditions a.) and b.) and/or conditions a.) to c.) are permissible for achieving the abort condition. It may be that pre-setting can only be carried out during commissioning of the security system.

If the safety system comprises several triggering elements, it may be stored for each triggering element or for groups of triggering elements individually whether the presence of conditions a.) and b) and/or the presence of conditions a.) to c.) is admissible for the attainment of the cancellation condition. The group of triggering elements may in particular comprise triggering elements which can be associated with a door or a door lock. The admissibility is preferably stored electronically in the respective triggering elements.

If the security system comprises several door locks, it may be possible to individually store for each door lock or for groups of door locks whether the presence of conditions a.) and b) and/or the presence of conditions a.) to c.) is admissible for the attainment of the cancellation condition. The group of door locks may in particular comprise door locks which can be assigned to a door or a door leaf. The admissibility is preferably stored electronically in the respective door locks.

Before the locking mechanism is checked for locking, the electronic device checks whether conditions a.) and b.) and/or conditions a.) to c.) have been stored as permissible. If conditions a.) and b) and/or conditions a.) to c.) have not been stored as permissible, no locking is accepted or the locking mechanism is checked for locking. Thus, for the cancellation condition to be achieved, it may be sufficient that conditions a.) and b.) are fulfilled and that the presence of conditions a.) and b.) is stored as permissible for the cancellation condition to be achieved.

Alternatively, for the attainment of the cancellation condition it may be sufficient that conditions a.) to c.) are fulfilled and that it has been established that the presence of conditions a.) to c.) is admissible for the attainment of the cancellation condition.

Thus, the security system may, for example, comprise a first trigger element in which the trigger condition is to be achieved, always in situ, i.e. by generating the abort signal and authentication, regardless of whether the door has been opened or not since the generation of the actuation signal. Any other achievement is not permissible. In a second trigger element of the security system, the abort condition can be achieved when the door has remained closed since the generation of the actuation signal, by means of the expiration of the predetermined time interval and because the eligibility for this has been saved. In the case of a third trigger element of the security system, if the door has remained closed since the generation of the actuation signal, the expiration of the predetermined time interval is not sufficient for the abort condition to be achieved. On the contrary, the cancellation signal must also have been generated after the predetermined time interval in the central emergency exit control to achieve the cancellation condition, and this possibility of reaching the cancellation condition must be saved as permissible.

If the conditions permissible for achieving the cancellation condition have been stored in the triggering element and/or in the triggering element in each case, it may be that the electronic device, before controlling the locking mechanism for locking, queries the triggering element in which the actuation signal was generated whether the fulfilled conditions presented to the electronic device are stored in the triggering element as permissible for achieving the cancellation condition.

The security system may comprise several central emergency exit controls. The central emergency exit controls may each comprise an identification device.

In this case, the identification device on which a cancellation signal can be generated that is admissible for fulfilling condition c.) can be stored in the safety system. This can be stored for several triggering elements and/or several door locks.

The actuating element may be capable of being brought into a deactivated state. In the deactivated state, the locking mechanism is not controlled to unlock the door lock as a result of actuation of the actuating element. The actuating element may be capable of being brought from the deactivated state into the activated state. In the activated state, the locking mechanism is controlled to unlock the door lock as a result of actuation of the actuating element. The deactivated state may be set, for example, at night in a department store or a closed psychiatric ward. The actuating element may be capable of being brought into the deactivated and/or activated state, in particular by the central emergency exit control.

It is preferably provided that in the activated state of the actuating element, a previously performed actuation of the actuating element in the deactivated state has no effect on the control of the locking mechanism. In this way, it is prevented that the door lock is unlocked directly during or after the transfer to the activated state, even if the actuating element was actuated hours or days earlier when the actuating element was in the deactivated state. This is particularly advantageous for the present actuating element, which is not interlocked.

The safety system is preferably designed to transmit an actuation of the actuating element in the deactivated state of the actuating element to a central unit. In this way, an operator can recognise a danger for the user and act accordingly. The operator can transfer the actuating element to the activated state or release the door lock. In particular, the central unit is the central emergency exit control or monitoring device.

The operation of the central emergency exit control and/or the connection of the central emergency exit control to the control unit is monitored in particular in the deactivated state of the actuating element. If a fault occurs, the actuating element is transferred to the activated state. This enables increased safety in the event that activation or unlocking can no longer be carried out via the central unit.

The emergency button may have a covering agent which is at least partially transparent. When the actuating element is actuated, the covering agent can be moved from a starting position to an actuating position. The covering agent can cover the actuating element such that the actuating element is actuated by means of the covering agent. The covering agent serves to create an imaginary barrier to the actuation of the actuating element and thus to prevent fraudulent actuation. The imaginary barrier arises because the user believes that he must break or remove the covering agent before the user can actuate the actuating element.

The cover agent may be provided so that it cannot be removed. If the cover agent is arranged so that it cannot be removed, the cover agent cannot be removed. In this way, the emergency button remains as it was originally designed and constructed.

In particular, the cover element is designed transparently such that the actuating element is perceptible to the user through the cover element. The actuating element is preferably actuated indirectly by means of the cover element. "In a non-removable manner" means in particular that the cover element cannot be removed or folded back for the generation of the cancellation signal. The non-removable arrangement on the actuating element is made possible in particular because the operator does not need to turn the actuating element in order to achieve the cancellation condition. Thus, the non-removable arrangement is made possible in particular by electronically preventing the locking mechanism for locking the door lock from being controlled without the presence of a cancellation condition.

The non-removable arrangement of the cover element can be designed in various ways. For example, the cover element can be mounted so that it cannot be removed. Thus, the cover element can be guided in particular in a movable manner in the emergency button. Additionally or alternatively, the cover element can be designed from an elastic material. For example, the cover element can comprise an elastic film which is extended over the actuating element. In this way, the cover element can contribute to the waterproof design of the emergency button. Additionally or alternatively, the cover element can be firmly connected to the actuating element. The connection can be designed in particular with a form-fitting or by material adhesion. In this way, misuse can be prevented, in particular the actuating element being able to move only together with the cover element.

The security system according to the invention is particularly suitable for use in a building in which people with a mentally impaired state live, in particular a psychiatric facility, a psychiatric hospital ward or the like. In particular, the possibility of deactivation, monitoring and, if necessary, activation can thus increase the security of the inmates.

The object of the invention is also achieved by a method for unlocking at least one door lock, in particular for securing emergency exits. In the method, an actuating element, in particular an emergency button, comprises a manual actuation element. By actuating the actuation element, an actuation signal for unlocking the door lock is generated. As a result of the actuation signal, an electronic device electronically prevents a locking mechanism from being controlled for locking without the presence of a cancellation condition.

The invention is described in more detail below with the aid of exemplary embodiments. Technical features with the same function are provided in the identical reference figures. They show:

Figure 1 a top view of a security system according to the invention with an emergency button as an activating element in a ready-to-operate state of a door according to the invention according to a first exemplary embodiment,

Figure 2 a functional diagram of the security system according to the invention from Figure 1, Figure 3 a functional diagram modified with respect to Figure 2 of a security system according to the invention according to a second exemplary embodiment, Figure 4 a top view of a security system according to the invention with several emergency buttons in a ready-to-operate state on a door according to a third exemplary embodiment,

Figure 5 a functional diagram of the security system according to the invention from Figure 4, Figure 6 a functional diagram modified with respect to Figure 5 of a security system according to the invention according to a fourth exemplary embodiment, Figure 7 a top view of a security system according to the invention in a ready-to-operate state according to a fifth exemplary embodiment, Figure 8 a functional diagram of a central emergency exit control of the security system from Figure 7,

Figure 9 is a functional diagram of the security system of Figure 7,

Figure 10 a functional diagram of a security system according to the invention according to a sixth embodiment,

Figure 11 shows an exemplary embodiment of an emergency button according to the invention in a side view,

Figure 12 shows the emergency button of Figure 11 in a longitudinal section,

Figure 13 shows the emergency button from Figure 11 in an exploded view,

Figure 14 shows an actuating element of the emergency button of Figure 11 in a perspective view,

Figure 15 another perspective view of the drive element of Figure 14,

Figure 16 a light conductor of the emergency button of Figure 11 in a perspective view, Figure 17 another perspective view of the light conductor of Figure 16 and

Figures 18a-d a schematic representation of the development of a functional release in a safety system according to the invention.

In the following, a distinction will be made between user and operator. A user can be any person who uses the security system 1. A user can be, for example, a guest who wants to escape through the door secured with the security system 1. An operator serves to operate the security system 1. The operator can, for example, authenticate himself with respect to the security system. The operator can, for example, be part of a surveillance team. Particularly preferably, the operator can adjust the security system 1.

In the following, the term "actuation of the emergency button" means "actuation of the actuating element of the emergency button".

A connection to a bus system is understood in the following as a direct connection, so that a component connected to the bus system is to be regarded as a participant of the bus system with its own bus address.

A triggering of a control is understood in particular to mean the sending of a message, for example via the first and/or second bus system, which contains information and/or a command that causes the direct or indirect recipient of the message to carry out the control. The sender of the message initiates the control. Thus, triggering a control is understood to mean an indirect control. The message may correspond in particular to a bus telegram.

As a consequence of an actuation means that the cause is an actuation, regardless of whether the actuation continues or not.

1 and 2 show a first exemplary embodiment of a security system according to the invention 1 for a door 2. The door 2 is not part of the security system 1 according to the invention. The security system 1 according to the invention comprises a door lock 200 and an emergency button 10. The emergency button 10 comprises a control device 100. A key switch 500 is associated with the emergency button 10. The security system 1 may comprise the key switch 500. Alternatively, the security system 1, in particular the emergency button 10, may have a key switch input by means of which a connection to the key switch 500 can be established.

As shown in Figure 2, the emergency button 10 and the door lock 200 are connected to each other via a first bus system 400. The key switch 500 is or can be electrically connected to the emergency button 10 via a connection 402. The connection 402 is shown as a broken arrow to show that signals about a position of a key inserted in the key switch 500 are supplied to an electronic unit 24 of the emergency button 10. As an alternative to the connection 402, the key switch 500 can also be connected to the first bus system 400 (not shown). This alternative applies to all exemplary embodiments.

The emergency button 10 is designed to send a message to the door lock 200 as a result of an actuation of the emergency button 10 via the first bus system 400 and thus cause an unlocking of the door lock. The message as a result of the actuation of the emergency button 10 can be carried out in a delayed manner.

The security system 1 according to the invention, in particular the emergency button 10, may also be able to be connected to a fire alarm (not shown). If there is a fire alarm, the security system 1 also causes the door lock 200 to be unlocked.

The control device 100 does not perform any security-relevant functions: The control device 100 can trigger an unlocking of the door lock 200 for authorized persons. For this purpose, the control device 100 can be connected to an access control system (not shown). The access control system can in particular be connected or connectable to the first bus system 400. The control device 100 receives a positive authentication signal from the access control system, in particular via the bus system 400, on the basis of the authentication performed. The control device 100 then triggers an unlocking of the door lock 200. The access control system can, for example, comprise a reader, a key switch, a keypad for entering a code or a locking cylinder of a mechanical lock, in particular a self-locking panic lock, or be configured as such.

The control device 100 can also automatically trigger an unlocking of the door lock 200 at a predetermined time or after the expiration of a predetermined time, for example, if the door is to be unlocked at a certain time each day.

If there is no danger, i.e. if the emergency button 10 has not been actuated and a fire alarm is not active, the control device 100 can automatically trigger a new locking after a certain period of time has elapsed. In this connection, the control device 100 can receive, in addition to the positive authentication signal, also an access signal from the access control system and/or measure the length of the positive authentication signal. The control device 100 can adapt the length of the predetermined time interval by means of the access signal or on the basis of the length of the authentication signal. Thus, a person can, for example, hold an identification card in front of the reader for a long time or turn a key for a certain period of time. In this way, it is signaled that the predetermined time period should correspond to a long time period previously stored in the control device 100. If the person holds the identification card briefly in front of the reader or the user briefly turns the key, it is signaled that the predetermined time period should correspond to a short time period previously stored in the control device 100.

A first door status monitoring device 204 and a second door status monitoring device 206 detect whether the door 2 is open or closed. The control device 100 at least indirectly receives a signal from the door status monitoring devices 204, 206. If the door lock 200 has been unlocked due to a positive authentication signal, the control device 100 can directly and automatically trigger a new locking of the door lock 200 as soon as the control device 100 has the information, using the door status monitoring devices 204, 206, that the door was previously open and is now closed again.

The emergency button 10 comprises an audible alarm 23 and lighting agents 41 (see also FIG. 13). The lighting agents 41 serve to display the locked or unlocked state of the door lock 200 and thus serve as a display device. The lighting agents 41 serve to display a delayed unlocking of the door lock 200 as a result of actuation of the emergency button 10 and thus serve as a display device. The lighting agents 41 serve to display an alarm state after receipt of the fire alarm signal or as a result of actuation of the emergency button 10 and thus serve as indicators. The lighting agents 41 serve to display when a new lock described above fails.

The control device 100 controls the sound alarm 23 to emit an audible alarm when a danger event occurs, that is, when a fire alarm signal is received or the emergency button 10 has been actuated. The control device 100 controls the sound alarm 23 to emit an audible alarm when a new lock fails.

The control device 100 controls the lighting agents 41 to represent the locked or unlocked state of the door lock 200 to visually represent an unlocking and/or emit a visual alarm when a fire alarm signal is received or the emergency button 10 has been actuated or when a new lock fails.

The control device 100 can monitor the opening of the door in the unlocked state of the door lock 200 with the aid of the door status monitoring devices 204, 206. The control device 100 can, if desired, cause an audible alarm to be emitted if the door 2 is opened during the unlocked state of the door lock 200, at least if no positive authentication signal is present. In this way, it is possible to monitor whether someone opens the door even when the door is unlocked.

The emergency button 10 may comprise at least one additional output. The control device 100 may control via the output other components that can be connected to the security system 1 according to the invention, for example a room light.

The parameters for carrying out the stated functions of the control device 100 are stored in the control device 100. For example, the predetermined time(s), the predetermined time interval(s), parameters for the audible alarms, for example, at what volume and how often an audible alarm is to be emitted, and parameters for the various controls of the lighting agents 41 for the visual display of the various aforementioned states of the security system 1 are stored in the control device 100. The parameters for the lighting agents may include flashing frequencies, emission colors, color intensities and/or light patterns. For parameterization, the control device 100 can communicate with a mobile communication device via a radio module 64. Alternatively, the parameterization can be carried out with the aid of a monitoring device 301 via a second bus system 401 (see FIGS. 9 and 10). For parameterization, a parameterization program is provided which can be run on a communication device, for example a personal computer, mobile phone and/or tablet. The operator can set the parameters using the parameterization program.

The structure of the door lock 200 and the emergency button 10 is shown in more detail in Fig. 2. The emergency button 10 has a first emergency button processing unit 20, a second emergency button processing unit 21 and a third emergency button processing unit 22. The first, second and third emergency button processing units 20, 21, 22 are each designed as microprocessors or microcontrollers. The first and second emergency button processing units 20, 21 comprise a non-volatile memory. The third emergency button processing unit 22 comprises a non-volatile memory and/or has access to a non-volatile memory. The first, second and third emergency button processing units 20, 21, 22 are collectively referred to as the electronic unit 24 of the emergency button 10.

The electronic unit 24 simultaneously serves as a control device 100. In this respect, the first emergency button processing unit 20 serves as the first processing unit 103 of the control device 100. The second emergency button processing unit 21 serves as the second processing unit 104 of the control device 100. The third emergency button processing unit 22 serves as the third processing unit 105 of the control device 100.

The first and second emergency button processing units 20, 21 serve to implement safety-relevant functions of the emergency button. The third emergency button processing unit 22 or processing unit 105 serves to implement the non-safety-relevant functions. The safety-relevant functions include triggering unlocking in the event of danger. The non-safety-relevant functions include the other functions described above.

When the emergency button 10 is actuated, an actuating element 11 moves from a starting position 11.I to an actuating position 11.II, whereby a switch 63 is actuated (see also FIGS. 12, 13). In this way, a first and a second actuating signal are generated. In this way, a first and a second electrical circuit (not shown) are opened. A signal about the opening of the first electrical circuit is detected by the first emergency button processing unit 20. A signal about the opening of the second electrical circuit is detected by the second emergency button processing unit 21. An actuating signal is understood to be the signal that has been generated by the user through actuation of the actuating element to unlock the door lock and release the emergency exit. The expression "as a result of actuation of the emergency button 10" is used in particular in the sense of "after generation of the actuation signal", i.e. regardless of whether the actuating element 11 is still in the actuating position 11.II or has already returned to the starting position 11.I.

The first emergency button processing unit 20 and the second emergency button processing unit 21 each independently of one another trigger unlocking of the door lock 200 after detection of the actuation signal via the first bus system 400. The second emergency button processing unit 21 thus acts redundantly with respect to the first emergency button processing unit 20.

The door lock 200 comprises a door lock control 201. The door lock control 201 comprises a first processing means 202 and a second processing means 203. The first and second processing means 202, 203 are collectively referred to as electronic devices 207. The first and second processing means 202, 203 are each designed as microprocessors or microcontrollers. The first and second processing means 202, 203 can each control a locking mechanism 205 of the door lock 200 for unlocking. In the event of danger, i.e. as a result of actuation of the emergency button 10 or after receipt of a fire alarm, both the first processing means 202 and the second processing means 203 control the locking mechanism 205 for unlocking. The second processing means 203 is therefore redundant with respect to the first processing means 202. This structure provides fail-safe protection.

The locking mechanism 205 is electromechanically configured. The locking mechanism 205 comprises, for example, an electromechanically operable latch element (not shown) which locks a door latch 2 in the locked state of the door lock 200 and releases it in the unlocked state of the door lock 200. When the locking mechanism 205 is controlled for locking, the first and second processing means 202, 203 activate an electric current for the locking mechanism 205. When the locking mechanism 205 is controlled for unlocking, the first and second processing means 202, 203 deactivate an electric current for the locking mechanism 205. In each case, a separate switch is associated with one of the processing means 202, 203 for this purpose. Opening one of the switches leads to deactivation of the current for the locking mechanism 205.

The door lock control 201 obtains information about the state of the locking mechanism 205 by means of a locking mechanism status monitoring device. In particular, a position of an anchor of a coil of the locking mechanism 205 is monitored. If the state of the door lock 205 does not correspond to the nominal state, an alarm is issued. Additionally or alternatively, a new attempt to reach the nominal state can be made in this case.

Following an actuation of the emergency button 10, the first and second emergency button processing units 20, 21 communicate with the first and second processing means 202, 203 via the first bus system 400 using a message. The message may contain information about the actuation or a control command for unlocking. In this regard, the first emergency button processing unit 20 informs the first processing means 202 and the second emergency button processing unit 21 informs the second processing means 203. By means of the message, the first and second emergency button processing units 20, 21 cause both the first and second processing means 202, 203 to control the locking mechanism 205 for unlocking, i.e. to deactivate the electric current.

The presence of a fire alarm is detected by the first and second emergency button processing units 20, 21. The first and second emergency button processing units 20, 21 then cause the first and second processing means 202, 203 to be controlled for unlocking by the door lock control 201 by means of a message. In this regard, the first emergency button processing unit 20 informs the first processing means 202 and the second emergency button processing unit 21 informs the second processing means 203. By means of the message, the first and second emergency button processing units 20, 21 cause both the first and second processing means 202, 203 to control the locking mechanism 205 for unlocking, i.e. to deactivate the electric current.

The actuation of the emergency button 10 or the presence of a fire alarm can be transmitted in a message by one of the two emergency button processing units 20, 21, the first emergency button processing unit 20 writing a first part of the message and the second emergency button processing unit 21 writing a second part of the message. The first and second processing means 202, 203 are each responsible for at least one part of the message. The emergency button processing units 20, 21, 22 and the first and second processing means 202, 203 can each receive messages via the first bus system 400. In this respect, the electronic unit 24 and the door lock control 201 can each be assigned a bus address. The first and second emergency button processing units 20, 21 monitor each other. If a fault is detected, the electronic unit 24, in particular the intact emergency button processing unit 20, 21, causes the first and second processing means 202, 203 to control the door locking mechanism 205 for unlocking. The first and second processing means 202, 203 monitor each other. If a fault is detected, the locking mechanism 205 is controlled for unlocking by at least the intact processing means 202, 203. Likewise, in the event of a failure of the bus system 400, the locking mechanism 205 is controlled for unlocking by the door lock control 201. For this purpose, and for monitoring the first and second emergency button processing units 20, 21, a life signal from the first and second emergency button processing units 20, 21 is sent regularly to the door lock control 201. If the life signal does not arrive, the first and second processing means 202, 203 control the locking mechanism 205 for unlocking. The first and second processing means 202, 203 communicate with each other when the door lock control 201 has received a message about the actuation of the emergency button 10 and/or the presence of a fire alarm. If only the first processing means 202 or the second processing means 203 detects that the emergency button 10 has been actuated and there is a fire alarm signal, the processing means 202, 203 that has made the detection controls the door locking mechanism 205 for unlocking and initiates that the other processing means 202, 203 also controls the door locking mechanism 205 for unlocking. An error and an interference in this sense always also comprise a failure of the respective component. In the event of a power failure, the locking mechanism 205 automatically switches to the unlocked state. In the operations described in this section, the safety system 1 also emits an audible and/or visual alarm, in particular by means of the control device 100. If the actuation signal has been generated, the door lock 200 is electronically prevented from being transferred to the locked state without the presence of an abort condition. In this way, the door is prevented from being locked as long as the dangerous state persists. For this purpose, an electronic hold-open system is integrated into the electronic device 207. The electronic hold-open system is transferred to an actuation state as a result of the actuation of the actuating element 11, which serves to release the emergency exit. In the actuation state, control of the door lock 200 for locking is prevented.

The electronic hold-open system comprises a first program code. The first program code comprises a first variable or has access to a first variable. In a starting state of the electronic hold-open system, the first variable is set to a starting value. In the actuating state, the first variable is set to a driving value by which control of the door lock 200 for locking is prevented. The first variable can be binary. If the abort condition is reached, the electronic hold-open system is transferred back to a starting state. For this purpose, the value of the first variable is set to the starting value. In the starting state of the electronic hold-open system, control of the door lock 200 for locking is permitted. The first program code records the first value of the first variable and enables a locking of the door lock 200 if the value of the first variable corresponds to the starting value and prevents a locking of the door lock 200 if the value of the first variable corresponds to the driving value.

The electronic open-position holding system is stored both in the first processing means 202 and redundantly in the second processing means 203. For this purpose, the first program code is stored in the first processing means 202. The first variable is stored in the non-volatile memory of the first processing means 202. A second program code with the same functionality as the first program code is stored in the second processing means 203. The first variable is stored redundantly in the non-volatile memory of the second processing means 203. The first variable is additionally stored in the first emergency button processing unit 20 and in the second emergency button processing unit 21, in each case in the non-volatile memories. As a result of actuation of the emergency button 10, the first variable in the first and second emergency button processing units 20, 21 is transferred from the start value to the actuation value. The modified value of the first variable is transmitted by the electronic device 207 via the bus system 400. Until an abort condition occurs, the emergency button 10 repeatedly sends the actuation value of the first variable to the electronic device 207. The sending can take place at regular time intervals, in particular together with the life signal.

At least if at least one of the door status monitoring devices 204, 206 has detected that the door 2 has been opened after the emergency button 10 has been actuated, a cancellation action on the emergency button 10 is necessary to achieve the cancellation condition.

The actuating element 11 is designed so that it does not lock. During actuation, the actuating element 11 is transferred from the starting position 11.I to the actuating position 11.II (see Figure 11). Directly after actuation, the actuating element 11 is moved back to the starting position 11.I by the force of a restoring agent 12 configured as a spring (see Figures 12, 13). The actuation of the actuating element 11 is translational.

The cancellation action on the emergency button 10 is carried out by actuating the actuating element 11. In this way, a cancellation signal is generated which corresponds to the actuation signal. In order for the control device 100 to be able to detect whether actuation of the emergency button 10 serves to unlock the door lock 200 or whether a cancellation action occurs, another signal must be generated simultaneously to achieve the cancellation condition. For this purpose, an operator identifies himself. Authentication is carried out by inserting and turning a key in the key switch 500. Actuation of the actuating element 11 and authentication must overlap in time. That is, the operator must hold the key in the turned state while the actuating element 11 is in the actuating position 11.II. The actuating element 11 must return to the starting position 11.I while the key is in the turned state. The action sequence is sufficient to achieve the cancellation condition.

If the door status monitoring devices 204, 206 have detected that the door 2 has remained permanently closed following the actuation of the emergency button 10, the cancellation condition can be achieved at least in one other way, namely by the passage of a predetermined time interval. Thus, for example, after 60 seconds after the last generation of the actuation signal, the cancellation condition can be achieved if the door 2 has remained closed. Authentication at the key switch 500 and a cancellation action at the emergency button 10 are not necessary in this case. The first and second door status monitoring devices 204, 206 are provided to detect with fail-safety that the door 2 has remained permanently closed following the actuation of the emergency button 10. For this purpose, the door status monitoring devices 204, 206 are preferably configured differently. The first door status monitoring device 204 can be configured, for example, as a door contact. The second door status monitoring device 206 can be configured, for example, as a latch contact. Alternatively, for example, at least one of the door status monitoring devices can monitor the status of the door 2 magnetically, for example, as a reed switch. The door closing control 201 receives a signal from the first and second door status monitoring devices 204, 206 each as to whether the door 2 is open or closed. Only if, during the predetermined time interval, neither the first door status monitoring device 204 nor the second door status monitoring device 206 has sent a signal about the opening of the door, can the abort condition be reached by the expiration of the predetermined time interval.

The door closing control 201 contains a timer for measuring the predetermined time interval. The door closing control 201 starts the timer as a result of the actuation of the emergency button 10. If the door closing control 201 receives a signal from the first or second door status monitoring device 204, 206 during the predetermined time interval that the door has been opened, a cancellation action must be performed on the emergency button 10. In this case, it is not sufficient for the predetermined time interval to elapse. The length of the predetermined time interval is stored in the door closing control 201.

The door closing control 201 checks whether an achievement of the abort condition is permissible by the expiration of the predetermined time interval before the door closing control 201 controls the locking mechanism 205 for locking. Thus, during commissioning of the safety system 1, i.e. before the start of operation of the safety system 1, an operator can determine whether an elapse of the predetermined time interval without opening of the door 2 is permissible as an abort condition and thus leads to a new locking of the door 2. This determination can be made at the emergency button 10. A check for permissibility, an expiration of the predetermined time interval and a lack of signal from the first and second door status monitoring devices 204, 206 about an opening of the door 2 is sufficient for achieving the abort condition.

The door closing control 201 communicates the open or closed state of the door via bus 400 to the emergency button 10 and/or the control device 100.

The electronic unit 24 comprises a timer. A first delay duration can be stored in the electronic unit 24. If the door lock 200 is to be unlocked in a delayed manner, the electronic unit 24 waits for the first delay duration after the generation of the actuation signal before the first and second emergency button processing units 20, 21 communicate with the door lock control 201 via the first bus system 400 to trigger unlocking.

The third processing unit 105 causes the non-safety-relevant unlocking and locking of the door lock 200 described in FIGS. 1 and 2, for example unlocking after receipt of the authentication signal, at a predetermined time or after a predetermined time has elapsed, or locking after a predetermined period of time has elapsed or directly after the door 2 has been closed. For this purpose, the third processing unit 105 communicates with the door lock control 201 via the first bus system 400. The communication may, for example, contain information or a control command that causes the door lock control 201 to control the locking mechanism for unlocking or locking. If the control device 100 is connected to the second bus system (see FIG. 7), the third processing unit 105 serves to forward messages from and/or to a central emergency exit control 300.

The third emergency button processing unit 22 controls the sound alarm 23 and the lighting agents 41.

If at least one of the processing agents 202, 203 is informed that the locking mechanism 205 has assumed the unlocked state, the processing means 202, 203 sends a corresponding signal via the bus 400 to the electronic unit 24. The electronic device 207 is connected or connectable to the door status monitoring devices 204, 206 and receives signals about an open or closed state of the door from the door status monitoring devices 204, 206.

The functions of the control device 100, the door lock control 2021 and/or the emergency button 10 can be implemented using software modules. Program codes are stored in the electronic device 207 and/or the electronic unit 24, with the aid of which the functions can be implemented. Figure 3 shows a variant of the security system 1 shown in Figures 1 and 2. In this respect, the control device 100 is designed independently of the emergency button 10 and the door lock 200. The control device 100 can be arranged, for example, in a top-hat rail housing (not shown). The control device 100 is not integrated into an emergency button 10 or a door lock 200. For example, the control device 100 can be provided for arrangement in a technical room. The first bus system 400 connects the control device 100, the door lock 200 and the emergency button 10 to each other. As in the first exemplary embodiment, the key switch 500 is connected or can be electrically connected to the emergency button 10 by means of a connection 402.

Unless otherwise stated, the structure and function correspond to those of the first exemplary embodiment, wherein the functions described with respect to FIGS. 1 and 2 are performed with the aid of the control device 100 or the processing units 103, 104, 105 by the control device 100 of FIG. 3, and the functions described with respect to FIGS. 1 and 2 are performed with the aid of the emergency button 10 or the emergency button processing units 20, 21, 22 by the emergency button 10: In particular, the first and second emergency button processing units 20, 21 detect the actuation signal resulting from an actuation of the emergency button 10, communicate with the first and second processing means 202, 203 via the first bus system 400 and thus cause a control of the locking mechanism 205 by means of the door lock control 201. The measures for achieving fail-safety or redundancy are implemented with the aid of the first and second emergency button processing units 20, 21. The first variable is stored in the first and second emergency button processing units 20, 21 and is transmitted from there to the door lock control 201. The emergency button 10 comprises the timer for determining the first delay duration. The control device 100 is connected or connectable to the second bus system 401. The third processing unit 105 causes the safety-insensitive unlocking and locking of the door lock 200 described in FIGS. 1 and 2, for example unlocking after receipt of the authentication signal, at a predetermined time or after the expiration of a predetermined time or a new automatic locking after the expiration of a predetermined time period or directly after the closing of the door 2.

The first, second and third processing units 103, 104, 105 are each designed as microprocessors or microcontrollers. The first, second and third processing units 103, 104, 105 together form an electronic processing system 101. The first and second processing units 103, 104 have a non-volatile memory. The third processing unit 105 comprises a non-volatile memory and/or has access to a non-volatile memory.

A fire alarm signal can be received by both the control device 100 and the emergency button 10. The presence of a fire alarm is detected in this case by the first and second emergency button processing units 20, 21 for the emergency button 10 or by the first and second processing units 103, 104 for the control device 100. Accordingly, both the control device 100 with the aid of the first and second processing units 103, 104 and the emergency button 10 with the aid of the first and second emergency button processing units 20, 21 can trigger an unlocking of the door lock 200. For this purpose, communication takes place via the first bus system 400 with the door lock control 201.

The control device 100 is informed via the first bus system 400 when the emergency button 10 has caused the door lock 200 to be unlocked, i.e. as a result of the emergency button 10 being actuated or after a fire alarm has been received. The control device 100 is also informed about a delayed unlocking of the door lock 200 as a result of the emergency button 10 being actuated. The control device 100 is informed about the locked and unlocked state of the door lock 200. The control device 100 is informed about the open or closed state of the door 2.

The control device 100 causes the alarm 23 and the lighting agents 41 to be controlled for the messages and visual displays described in conjunction with FIGS. 1 and 2. For this purpose, the control device 100 can communicate with the electronic unit 24, in particular with the third emergency button processing unit 22, via the first bus system 400. The third emergency button processing unit 22 then controls the alarm 23 or the lighting agents 41. For this purpose, the parameters for the alarm 23 and the lighting agents 41 are stored in the control device 100.

In the exemplary embodiments of Figures 1 to 3, the door lock 200 comprises the door status monitoring devices 204, 206. Alternatively to this, and not shown, the door status monitoring devices 204, 206 can be connected to the first bus system 400 or directly to the emergency button 10 and/or the control device 100.

In the exemplary embodiments of Figures 1 to 3, at least one additional emergency button (not shown) can be connected to the first bus system 400, which is designed without the control device 100. The additional emergency button is designed like the emergency button 10 of Figure 3 and can trigger the unlocking of the door lock 200 when actuated. The additional emergency button corresponds in design and function to the emergency button 10 of Figure 3.

In the exemplary embodiments of Figures 1 to 3, at least one further additional door lock, not shown, can be connected to the first bus system 400. The additional door lock is designed like the door lock 200 of Figure 2 or 3 and can also be unlocked by actuating the emergency button 10. The additional door lock corresponds in structure and functionality to the door locks 200 of Figures 1 to 3.

4 shows a third embodiment of a security system according to the invention 1 with several emergency buttons 10, 1010, 2010, 3010. The security system 1 comprises several door locks 200, 1200, 2200, 3200. Each emergency button 10, 1010, 2010, 3010 is associated with a key switch 500, 1500, 2500, 3500. The security system 1 serves to arrange the emergency button 10, 1010, 2010, 3010 and door locks 200, 1200, 2200, 3200 on different doors 2, 2002, 3002. The doors 2, 2002, 3002 are not part of the security system 1. 1 according to the invention. The plurality of emergency buttons 10, 1010, 2010, 3010 are connected to the first bus system 400 and thus correspond to a number of emergency buttons 10, 1010, 2010, 3010. The door locks 200, 1200, 2200, 3200 are connected to the first bus system 400 and thus correspond to a number of door locks 200, 1200, 2200, 3200.

In the example in Figure 4, the emergency buttons 10, 1010 are associated with the door locks 200, 1200.

The emergency button 2010 is associated with the door lock 2200. The emergency button 3010 is associated with the door lock 3200. Thus, as a result of actuating one of the emergency buttons 10, 1010, both door locks 200, 1200 are unlocked, but not the door locks 2200, 3200. If the emergency button 2010 is actuated, only the door lock 2200 is unlocked. Correspondingly, if the emergency button 3010 is actuated, only the door lock 3200 is unlocked. Thus, in this exemplary embodiment, the door locks 200, 1200, 2200, 3200 are selectively unlocked.

For example, the emergency buttons 10, 1010 are intended for arrangement in a double-leaf door 2.

In each case, a door lock 200, 1200 must be arranged in each case in a door leaf 3, 4 of the door 2. The emergency button 2010 and the door lock 2200 are intended for arrangement in another door 2002. The emergency button 3020 and the door lock 3200 must be arranged in a door 3002 as shown in Figure 4.

The security system 1 of Fig. 4 can also be set for selective unlockings different from those of Fig. 4. In an exemplary setting that differs from Fig. 4, when one of the emergency buttons 10, 1010, 2010, 3010 is actuated, only one associated door lock 200, 1200, 2200, 3200 is unlocked in each case. Thus, in each case only one door lock 200, 1200, 2200, 3200 is assigned to one emergency button 10, 1010, 2010, 3010. In particular, a security system 1 set in this way is suitable for four single-leaf doors in each case with one door lock 200, 1200, 2200, 3200.

In another exemplary embodiment of the security system 1, not shown, when one of the emergency buttons 10, 1010 is actuated, only the two door locks 200, 1200 are unlocked, and when one of the emergency buttons 2010, 3010 is actuated, the other two door locks 2200, 3200 are unlocked. The emergency buttons 10, 1010 are thus assigned to the door locks 200, 1200, and the emergency buttons 2010, 3010 are assigned to the door locks 2200, 3200. In particular, the security system 1 configured in this way is suitable for double-leaf doors with one door lock 200, 1200, 2200, 3200 per door leaf.

Furthermore, the security system 1 can be set so that if an emergency button 10, 1010, 2010, 3010 is actuated, all door locks 200, 1200, 2200, 3200 are unlocked.

In contrast to the security system 1 shown in Figure 4, a security system according to the invention 1 may comprise a number of emergency buttons 10, 1010, 2010, 3010 which does not coincide with the number of door locks 200, 1200, 2200, 3200. For example, in Figure 4, the door 2 may be configured as a single leaf and one of the emergency buttons 10, 1010 or one of the door locks 200, 1200 may be missing.

5 shows that the emergency buttons 10, 1010, 2010, 3010 and the door locks 200, 1200, 2200, 3200 are connected to one another via the first bus system 400. In each case, an emergency button 10, 1010, 2010, 3010 is connected or electrically connectable to a key switch 500, 1500, 2500, 3500 associated with the respective emergency button 10, 1010, 2010, 3010 via a connection 402, 1402, 2402 or 3402. Alternatively, the key switches 500, 1500, 2500, 3500 are connected to the first bus system 400 (not shown). In the exemplary embodiment of Figures 4 and 5, the control device 100 is integrated in one of the emergency buttons 10, 1010, 2010, 3010, for example the emergency button 10. The first bus system 400 is connected to only one control device 100. Unless otherwise stated below, the structure and functions of the door closers 200, 1200, 2200, 3200 correspond to the structure and functions of the door closer 200 of Figures 2 and 3, the structure and functions of the emergency button 10 to the structure and functions of the emergency button 10 of Figure 2, and the structure and functions of the emergency button 10 correspond to the structure and functions of the emergency button 10 of Figure 3. and the structure and functions of the emergency buttons 1010, 2010, 3010, with the structure and functions of the emergency button 10 of Figure 3. References to Figures 2 and 3 are used. In this regard, it is understood that in each case the door closers 200, 1200, 2200, 3200 comprise their own door locking mechanism, their own processing agents, etc., and the emergency buttons 10, 1010, 2010, 3010 each comprise their own emergency button processing units, alarms, lighting agents, switches and actuating elements.

In order to enable the association of the emergency buttons 10, 1010, 2010, 3010 with the door locks 200, 1200, 2200, 3200, during start-up of the safety system 1, i.e. before the start-up of the safety system 1, the emergency buttons 10, 1010, 2010, 3010 are associated with the door locks 200, 1200, 2200, 3200. To do this, one of the door locks 200, 1200, 2200, 3200 is put into an association mode in each case. Then, a conscious action is carried out on the emergency buttons 10, 1010, 2010, 3010. The conscious action can be carried out as an actuation of the actuating element 11 of the respective emergency button 10, 1010, 2010, 3010. After all emergency buttons 10, 1010, 2010, 3010 to be associated with the door locks 200, 1200, 2200, 3200 that are in the association mode have been actuated, the association mode of the door lock 200, 1200, 2200, 3200 is terminated. In the exemplary embodiment of Figure 4, for example, the door lock 200 is first transferred to the association mode and then the emergency buttons 10, 1010 are actuated, whereby the door lock 200 is switched to the association mode. The emergency buttons 10, 1010 are assigned to the door lock 200. The assignment mode of the door lock 200 is then closed. Next, for example, the door lock 1200 is put into assignment mode and then the emergency buttons 10, 1010 are actuated, whereby the assignment of the emergency buttons 10, 1010 to the door lock 1200 is carried out. The association mode of the door lock 1200 is then closed. The door lock 2200 is then put into assignment mode and then the emergency button 2010 is actuated, whereby the assignment of the emergency button 2010 to the door lock 2200 is carried out. The assignment mode of the door lock 2200 is closed. Correspondingly, the door lock 3200 and the emergency button 3010 can then be continued.

By means of the association, which emergency button 10, 1010, 2010, 3010 is to be assigned to the respective door lock 200, 1200, 2200, 3200 is to be stored in the respective door locks 200, 1200, 2200, 3200, in particular in the respective door lock controls 201. By means of the association, the association of the emergency buttons 10, 1010, 2010, 3010 to the door locks 200, 1200, 2200, 3200 of the first bus system 400 is stored in the control device 100 for all emergency buttons 10, 1010, 2010, 3010 and all door locks 200, 1200, 2200, 3200 of the first bus system 400. 3200. For the association, a bus address, in particular a non-modifiable bus address, of the respective emergency buttons 10, 1010, 2010, 3010 is stored in each case.

The establishment of the association in the respective door locks 200, 1200, 2200, 3200 is carried out in each case in the first digital processing means 202 and redundantly in the second digital processing means 203, in particular in the non-volatile memories of the processing agents 202, 203.

If, for example, the emergency button 10 is actuated, the emergency button 10 communicates with all door closers 200, 1200, 2200, 3200 of the first bus system 400. The door closers 200, 1200, 2200, 3200 each check on the basis of what is stored whether the respective door closer 200, 1200, 2200, 3200 has been assigned to the actuated emergency button 10. Only if an association exists, the associated door closers 200, 1200 then control the respective door locking mechanism 205.

In the event of a fire alarm signal, the door locks 200, 1200, 2200, 3200 which are associated with the emergency button 10, 1010, 2010, 3010 which receives the fire alarm signal are unlocked.

If a door lock 200, 1200, 2200, 3200 is to be unlocked in a delayed manner as a result of actuating an associated emergency button 10, 1010, 2010, 3010, a first delay duration is stored in the respective emergency button 10, 1010, 2010, 3010. The delay is set during commissioning of the safety system 1 by means of the parameterization program. A different first delay duration can be set for each emergency button 10, 1010, 2010, 3010 by the operator. For example, a first delay duration is stored in the emergency button 10 which differs from the first delay duration stored in the emergency button 2010. The emergency buttons 1010, 3010 are to trigger an unlocking of the associated door locks 2200 or 3200 without delay, such that no first delay duration or a first delay duration of 0 seconds is set for the emergency buttons 1010, 3010. Alternatively, the security system 1 can be configured such that the same first delay duration is always set for the emergency buttons 10, 1010, 2010, 3010 which are associated with the same door lock 200, 1200, 2200, 3200. For this purpose, the parameterization program allows the operator only a joint setting.

The control device 100 assumes the non-security-relevant functions for unlocking and locking all door locks 200, 1200, 2200, 3200, as described above with respect to Figures 1 and 2. For this purpose, the control device 100 can selectively communicate with the door locks 200, 1200, 2200, 3200. Thus, it is established in the control device 100 which access control system which door lock 200, 1200, 2200, 3200 is associated with, such that, with a positive authentication signal from an access control system, only the associated door lock(s) 200, 1200, 2200, 3200 are unlocked. Furthermore, it is stored in the control device 100 whether and, if so, when which door lock 200, 1200, 2200, 3200 is activated. which door lock 200, 1200, 2200, 3200 should be unlocked at a predetermined time. In addition, the control device 100 can store after a predetermined time interval or at which predetermined time intervals which door lock 200, 1200, 2200, 3200 should be locked again. Furthermore, the control device 100 stores whether and, if so, which door locks 200, 1200, 2200, 3200 are to be relocked immediately after the door 2, 2002, 3002 has been closed. The control device 100 can store whether and, if so, for which door lock 200, 1200, 2200, 3200 an audible alarm is to be generated when the unlocked door 2, 2002, 3002 is opened without a positive authentication signal. The control device 100 can store whether an audible alarm is to be generated if the door 2, 2002, 2003 is not relocked. These parameters can be set differently for each door closer 200, 1200, 2200, 3200 or for groups of door closers 200, 1200, 2200, 3200 to be arranged on a door 2, 2002, 3002. This setting is made using the parameterisation program by the operator during commissioning.

The control device 100 causes an audible and visual alarm to be emitted as a result of actuation of an emergency button 10, 1010, 2010, 3010 also in the at least one additional emergency button 10, 1010, 2010, 3010 which is associated with the same door lock 200, 1200, 2200, 3200 as the actuated emergency button 10, 1010, 2010, 3010. If, for example, the emergency button 10 is actuated in the exemplary embodiment of FIGS. 4 and 5, the control device 100 causes, by means of communication with the electronic unit 24 of the emergency button 1010, the audible alarm 23 and the lighting agents 41 of the emergency button 1010 to also emit an audible alarm or a visual alarm.

If, following actuation of an emergency button 10, 1010, 2010, 3010, unlocking is triggered in a delayed manner, the control device 100 causes the first delay duration with which the unlocking is triggered to also be displayed on the at least one additional emergency button 10, 1010, 2010, 3010, which is associated with the same door lock 200, 1200, 2200, 3200 as the actuated emergency button 10, 1010, 2010, 3010. To this end, the control device 100 communicates with the electronic unit 24 of the at least one additional emergency button 1010, 2010, 3010 or controls the lighting agents 41 of the emergency button 10, in which the control device 100 is integrated.

The control device 100 can carry out the non-security-relevant association for selective communication, for example the association of an access control system to a door lock 200, 1200, 2200, 3200 on the basis of a bus address. In this respect, the participants of the first bus system 400 each have a setting device for manually setting a bus address. The setting device can comprise DIP switches. At least the participants of the first bus system 400 that have the same setting on the setting device are automatically associated with each other. In order to be able to assign participants with the same setting different bus addresses, the participants of the first bus system 400 have different characteristics from which, with the aid of the setting made, different bus addresses are configured. The bus address determined by the setting for the emergency buttons 10, 1010, 2010, 3010 and the door closers 200, 1200, 2200, 3200 is merely an additional bus address that the emergency buttons 10, 1010, 2010, 3010 and the door closers 200, 1200, 2200, 3200 use in addition to the bus address used for safety-relevant communication.

If a door lock 200, 1200, 2200, 3200 has already been unlocked, the control device 100 can prevent unlocking of another door lock 200, 1200, 2200, 3200 until a condition is met, provided that no dangerous situation occurs. If the condition is met, the control device 100 causes the unlocking of the additional door lock 200, 1200, 2200, 3200. In this way, the control device 100 can communicate with several door locks 200, 1200, 2200, 3200 such that a lock is created. For example, the door 2002 can be arranged at the entrance to a room and the door 3002 at an exit from the same room. The control device 100 can, if a positive authentication signal is present, trigger an unlocking of the door lock 2200 for the door lock 2200. Even if a positive authentication signal is present for the door lock 3200 of the control device 100, the control device 100 can prevent the unlocking of the door lock 3200 until a condition is present. Once the condition is present, the control device 100 triggers an unlocking of the door lock 3200. The condition can be, for example, a lock time interval or the attainment of a measured variable, such as ambient temperature, humidity, air purity or the number of people in the room. The control device 100 can be connected or can be connected to a measuring device for this purpose. The condition may include the closure of the first open door 2002, which may be detected by the door status monitoring devices 204, 206. The condition and the door closures 2200, 3200 involved in the lock may be stored in the control device 100. The establishment of these parameters may be carried out by the operator using the parameterization program.

In Fig. 6, a variant of the safety system 1 shown in Figs. 4 and 5 is shown. In this respect, the control device 100 is configured independently of the emergency buttons 10, 1010, 2010, 3010 and the door locks 200, 1200, 2200, 3200. The first bus system 400 connects the control device 100 with the door locks 200, 1200, 2200, 3200 and the emergency buttons 10, 1010, 2010, 3010. The control device 100 in Fig. 6 corresponds structurally to the control device 100 in Fig. 3. The emergency button 10 in Fig. 6 corresponds structurally to the emergency button 10 in Fig. 3. Otherwise, the structure and the functions of the first bus system 400 are identical. Functionalities, which have been described above with respect to Figure 5, correspond to the structure and functionalities of the security system 1 of Figure 6.

Since in the exemplary embodiments of FIGS. 4 to 6 the door locks 200, 1200, 2200, 3200, the emergency buttons 10, 1010, 2010, 3010 and, if applicable, the control device 100 act as participants of a single first bus system 400, only the cables of the bus system 400 are required for the participants to be able to communicate with each other. The security system 1 thus has only a few cables.

The bus system 400 can comprise at least two cables for communication and at least two cables for the power supply. In particular, the bus system 400 has exactly two cables for communication and two cables for the power supply. In each of the exemplary embodiments of the security system 1 according to the invention, a power supply can be integrated as a connection to a power supply at any point in the bus system 400. Thus, the power supply can be provided as an independent component of the security system 1 outside the emergency button 10 or the emergency buttons 10, 1010, 2010, 3010 and the door lock 200 or the door locks 200, 1200, 2200, 3200. In this way, the security system 1 is flexible in terms of spatial structure.

If, as in the third and fourth embodiments, there are several emergency buttons 10, 1010, 2010, 3010 and one of the emergency buttons 10, 1010, 2010, 3010 has been actuated, only the door locks 200, 1200, 2200, 3200 associated with the actuated emergency button 10, 1010, 2010, 3010 are prevented from being blocked electronically by means of the electronic hold-open system. Achieving the cancellation condition enables blocking of the door lock(s) 200, 1200, 2200, 3200 associated with the actuated emergency button 10, 1010, 2010, 3010. To achieve the cancellation condition, it is necessary for the actuating element to be actuated in overlapping time. 11 of the emergency button 10, 1010, 2010, 3010 and previously actuated and the authentication at the key switch 500, 1500, 2500, 3500 associated with the actuated emergency button 10, 1010, 2010, 3010. At least this operating sequence is necessary for the door closing 200, 1200, 2200, 3200 associated with the actuated emergency button 10, 1010, 2010, 3010 in which at least one of the door status monitoring devices 204, 206 has detected that the door 2 or one of the door leaves 3, 4 has been opened after the actuation of the emergency button 10.

If the door status monitoring devices 204, 206 of the door closers 200, 1200, 2200, 3200 associated with the actuated emergency button 10, 1010, 2010, 3010 have detected that the door 2 has remained constantly closed after the actuation of the emergency button 10, 1010, 2010, 3010, the cancellation condition can be reached by the passage of the predetermined time interval. The cancellation condition can thus be achieved, for example, after 60 seconds after the last actuation of the emergency button 10. The permissibility of whether a locking is to be carried out after the expiry of the predetermined time interval when the door 2, 2002, 3002 has remained closed can be adjustable and can be set individually for each door lock 200, 1200, 2200, 3200 or for groups of door locks 200, 1200, 2200, 3200, in particular for door locks which are determined for arrangement on the same door. This setting can be made, for example, on the emergency buttons 10, 1010, 2010, 3010. Furthermore, for each door closer 200, 1200, 2200, 3200 or for groups of door closers 200, 1200, 2200, 3200, in particular for door closers that are intended for arrangement on the same door, the duration of the predetermined time interval can be individually set and defined. In this respect, a minimum duration of, for example, 60 seconds can be firmly predetermined for the predetermined time interval. The setting is made by means of the parameterization program.

A fifth exemplary embodiment of the security system 1 according to the invention is shown in Fig. 7. The fifth exemplary embodiment comprises the security system 1 according to the first exemplary embodiment of Figs. 1 and 2. That is, the emergency button 10, which includes the control device 100, is connected to the door lock 200 via the bus system 400. The key switch 500 is connected or connectable to the emergency button 10 via a connection 402. In the fifth exemplary embodiment, other components 300, 301, 510 are provided compared to the first exemplary embodiment.

The security system 1 comprises the central emergency exit control 300. The central emergency exit control 300 is intended to be arranged remotely from the door 2. Thus, the central emergency exit control 300, for example, together with a monitoring device 301, which can be configured as a display or personal computer, and/or a multi-door display device 350 (see FIG. 10), can be arranged in a monitoring cabin. The monitoring device 301 is optionally part of the security system 1 according to the invention. Alternatively, the monitoring device 301 is connectable to the security system 1 according to the invention.

The central emergency exit control 300 is modular in design. An emergency module 310 comprises a first mounting plate 311. The first mounting plate 311 accommodates a central emergency button 302 and an identification device 312, which is designed, for example, as a key switch. The central emergency button 302 and the identification device 312 are rigidly mechanically connected to one another by means of the first mounting plate 311. The central emergency button 302 serves to unlock the door lock 200 as a result of actuation of the central emergency button 302. Thus, the door lock 200 can be unlocked by means of the central emergency button 302 remote from the door 2. Unlocking as a result of actuation of the central emergency button 302 is fail-safe. Actuation of the central emergency button 302 is therefore suitable for a dangerous situation.

A deactivation module 320 comprises a first control element 322 configured as a key switch and a second control element 323 configured as a button. The first control element 322 serves to deactivate the emergency button 10. Thus, by actuating the first control element 322, the emergency button 10 is transferred to a deactivated state. If the emergency button 10 is in a deactivated state, the door lock 200 is not unlocked following actuation of the emergency button 10. The second control element 323 serves to activate the emergency button 10. If the emergency button 10 is in the deactivated state and the second control element 323 is actuated, the emergency button 10 is transferred to an activated state. In the actuated state of the emergency button 10, the emergency button 10 causes the door lock 200 to be unlocked if the emergency button 10 has been actuated. The deactivation module comprises a second mounting plate 321. The second mounting plate 321 serves to accommodate the first and second operating elements 322, 323. The second mounting plate 321 mechanically rigidly connects the first and second operating elements 322, 323 to one another.

The delay module 330 comprises a third mounting plate 331. The third mounting plate 331 accommodates a delay element 332. The delay element 332 is designed, for example, as a key switch. The delay element 332 serves to further delay the unlocking of the door lock 200 within the first delay duration. The delay module 330 comprises a termination element 333 which is designed as a button. The termination element 333 is fixed to the third mounting plate 331. The termination element 333 is rigidly mechanically connected to the delay element 332 via the third mounting plate 331. By actuating the termination element 333, the delay in unlocking the door lock 200 can be terminated.

The emergency exit central control 300 comprises an emergency exit control housing 340 open on one side, in which the emergency module 310, the deactivation module 320 and the delay module 330 are arranged. The deactivation module 320 and the delay module 330 are optional components of the emergency exit central securing 300. In addition, if present, the multi-door display device 350 may be arranged in the emergency exit control housing 340.

The emergency exit control housing 340 can mechanically fix the emergency module 310, the deactivation module 320 and the delay module 330. The emergency module 310, the deactivation module 320 and the delay module 330 are each fixed individually to the emergency exit control housing 340, in particular by screwing. For fixing to the emergency exit control housing 340, the first fixing plate 311 for the emergency module 310, the second fixing plate 321 for the deactivation module 320 and/or the third fixing plate 331 for the delay module 330 are used. The emergency exit control housing 340 and the modules 310, 320, 330 are designed such that different orders in which the modules 310, 320, 330 can be arranged adjacent to each other are possible. Thus, for example, in a central emergency exit securing 300, not shown, for example, the emergency module 310 can be arranged between the deactivation module 320 and the delay module 330. In another central emergency exit control 300, not shown, for example, a free space can be arranged on the left, the delay module 330 in the center, and The emergency module 310 on the right. The free space is created by the absence of the deactivation module 320 and is concealed by a plate. The emergency exit control housing 340 can have rails for sliding the rails 310, 320, 330. The emergency exit control housing 340 can have fixing options, for example perforated bars or elongated holes for variable fixing of the modules 310, 320, 330.

On the first mounting plate 311, on the second mounting plate 321 and on the third mounting plate 331, a display area 314, 324 or 334 is provided, which is only represented in a purely schematic manner. In the display area there are symbols which illustrate the function of the modules 310, 320, 330. In addition, visual lights for displaying the states of the safety system 1 can be provided in the display areas 314, 324, 334.

In the exemplary embodiment of Figure 7, the security system 1 further comprises an audio and video module 510. The audio and video module 510 is intended for arrangement near the door 2 which can be locked by the door lock 200. If the audio and video module 510 is activated, an operator in the surveillance cabin can speak to the user located in front of the door 2 and see the space around the door 2.

As shown in Figure 8, the central emergency button 302 is structured similarly to the emergency button 10. Thus, the central emergency button 302 comprises an electronic emergency button unit 308. The electronic emergency button unit 308 comprises a first emergency processing unit 303, a second emergency processing unit 304 and a third emergency processing unit 305. The first, second and third emergency processing units 303, 304, 305 are each configured as microprocessors or microcontrollers. The first and second emergency processing units 303, 304 have a non-volatile memory. The third emergency processing unit 305 has a non-volatile memory and/or has access to a non-volatile memory. The central emergency button 302 is actuated by actuating an emergency button actuating element 306. In this way, the emergency button switch 307 is actuated. In this way, a first and a second signal are generated. For this purpose, a first and a second electrical circuit (not shown) are opened. A signal about the opening of the first electrical circuit is detected by the first emergency processing unit 303. A signal about the opening of the second electrical circuit is detected by the second emergency processing unit 304.

The central emergency button 302 is connected to a second bus system 401. As shown in Figure 9, the control device 100 is also connected to the second bus system 401. The second bus system 401 is a different type of bus system from the first bus system 400. For example, the second bus system 401 may be configured as a LON or LAN bus and the first bus system 400 as a CAN or DCW bus.

In Figure 9, the emergency button 10 comprises the control device 100. The emergency button 10 and the door lock 200 shown in Figure 9 correspond to the emergency button 10 and the door lock 200 shown in Figure 2.

In an alternative (not shown), the control device 100, the emergency button 10 and the door closer 200 are configured according to Figure 3. In this alternative (not shown), the control device 100, the emergency button 10 and the door closer 200 are connected to each other by means of the first bus system 400, the control device 100 being connected to the second bus system 401.

The control device 100 receives messages from the central emergency exit securing 300 via the second bus system 401. The control device 100 forwards the messages via the first bus system to other participants of the first bus system 400. The message can in particular be information regarding an actuation of the central emergency button 302, the key switch 312, the first control element 322, the second control element 323, the delay element 332 and/or the termination element 333 or a control command as a result of an actuation of one of the aforementioned elements 302, 312, 322, 323, 332, 333. If the control device 100 is integrated in the emergency button 10, a branching to the emergency button 10 in which the control device 100 is integrated is not necessary. For example, according to Figure 9, the control device 100 branches the message to the door lock 200. If the control device 100 and the emergency button 10 are connected via the first bus system 400, the control device 100 branches the message to the emergency button 10 and/or the door lock 200. The control device 100 adapts the message to the format of the first bus system 400. Otherwise, safety-relevant messages are left intact.

If the central emergency button 302 has been actuated, the first emergency processing unit 303 and redundantly the second emergency processing unit 304 cause the door lock 200 to be unlocked. In this respect, the central emergency button 302 communicates via the control device 100 with the door lock control 201, in particular with the first and second processing means 202, 203. The first and second processing means 202, 203 then control the locking mechanism 205. The first and second processing units 103, 104 have previously derived the message. In this respect, the control device 100 has left the content of the message intact.

The central emergency button 302 has an input for receiving a fire alarm. If a fire alarm signal is received, the central emergency button 302 causes the door lock 200 to be unlocked.

For this purpose, the first and second emergency processing units 303, 304 communicate via the control device 100, in particular via the first and second processing units 103, 104, with the door lock control 201, as described above.

A signal about an actuation of the key switch 312 of the first module 310 is received by the emergency button electronic unit 308, in particular the third emergency processing unit 305. The emergency button electronic unit 308 sends a message regarding the actuation of the key switch 312 over the second bus system 401 to the control device 100. The control device 100 forwards the message to the first bus system 400.

The emergency button actuating element 306 is designed so that it does not engage. The emergency button actuating element 306 is designed identically to the actuating element 11 of the emergency button 10 (see FIGS. 13 to 15). Thus, the emergency actuating element 306 is transferred from a starting position to an actuating position during actuation (analogously to FIG. 11). Directly after actuation, the emergency actuating element 306 is moved back to the starting position by the force of a restoring agent configured as a spring (analogously to FIG. 11). The actuation of the emergency actuating element 306 is carried out translationally. If, as a result of actuation of the central emergency button 302, the door lock 200 is transferred to the unlocked state, the electronic device 207 prevents, by means of the electronic hold-open system, that the door lock 200 can be transferred back to the locked state without the presence of an abort condition. The abort condition after actuation of the central emergency button 302 can be achieved by actuation of the key switch 312. In particular, one actuation of the key switch 312 is sufficient to achieve the abort condition.

If the security system 1 comprises the central emergency exit control 300, the cancellation condition can be achieved in another way as a result of an actuation of the emergency button 10: If the door status monitoring devices 204, 206 have detected that the door 2 has remained permanently closed after the actuation of the emergency button 10, the cancellation condition can be achieved by the expiration of a predetermined time interval and an abort action in the central emergency exit control 300 after the predetermined time interval. The abort action can be an authentication in the central emergency exit control 300, in particular an actuation of the key switch 312. By means of the abort action, for example, the actuation of the key switch 312, an abort signal can be generated. The cancellation signal is derived via the control device 100 to the door lock control 201. An authentication at the key switch 500 and a cancellation action at the emergency button 10 are not necessary in this case.

The door closing control 201 checks whether the cancellation condition is permissible if the door 2 has remained closed before the door closing control 201 controls the locking mechanism 205 for locking by passing through the predetermined time interval and authentication at the central emergency exit control 300. Thus, an operator can determine during commissioning of the safety system 1 whether an expiration of the predetermined time interval without opening of the door 2 and the additional actuation of the key switch 312 is permissible as an abort condition and thus leads to a new locking of the door 2. A check of the permissibility, an expiration of the predetermined time interval, an actuation of the key switch 312 after the predetermined time interval and the fact that during the predetermined time interval neither the first door status monitoring device 204 nor the second door status monitoring device 206 has sent a signal about the opening of the door are sufficient for achieving the abort condition.

In this respect, it is a variant for achieving a cancellation condition that has been described with regard to figures 1 and 2. This variant can be selected, for example, by the operator when the operator does not consider the mere passage of the predetermined time interval when door 2 remains closed to be sufficiently safe. The operator can select and define this variant by means of the parameterisation program.

In particular if the operator has chosen this option, the passage of the predetermined time interval when the door 2 remains closed is visually displayed to the central emergency exit control 300. In particular, the lighting agents 313 serve to show that the predetermined time interval has passed without a signal having been received about the opening of the door 2 within the predetermined time interval. By means of the visual display, the operator recognizes that the door 2 can be locked by authentication at the central emergency exit control 300.

If the door status monitoring devices 204, 206 do not send any signal about a door opening during the presence of a fire alarm, a locking of the door closure 200 can be achieved after the fire signal has ended by the same actuation of the key switch 312. The possibility of achieving a locking of the door closure 200 by actuating the key switch 312 after the fire signal has ended is also visually indicated by the lighting agents 313.

The control device 100 derives messages from the emergency button 10 and/or the door lock 200 via the second bus system 401. In this respect, the control device 100 adapts the message to the format of the second bus system 401. The control device 100 sends information about the status of the emergency button 10 and/or the door lock 200 via the second bus system 401.

For example, the central emergency exit control 300 and the multi-door display device 350 can be connected to a third bus system 403 (see FIG. 10). Preferably, the central emergency button 302, in particular preferably the electronic emergency button unit 308, can be connected to the third bus system 403 (see FIG. 8). The multi-door display device 350 can visually display the locked or unlocked state of the door lock 200. In addition, one of the door locks 200, 200', 1200', 2200' of the security system 1 can be unlocked with the aid of the multi-door display device 350 (see FIG. 10). Unlocking with the aid of the multi-door display device 350 is not fail-safe. The third bus system 403 may be the same type of bus system as the first bus system 400, for example, a CAN or DCW bus.

The control device 100 derives via the second bus system 401 to the central emergency exit control 300, if the emergency button 10 waits for a first delay duration, before the emergency button 10 causes the door closing control 201 to control the locking mechanism 205 for unlocking.

The first delay duration is displayed on the central emergency exit control 300. For this purpose, the central emergency button 302 is constructed corresponding to the emergency button 10, as described with respect to FIGS. 13, 16, 17. For the visual display of the first delay duration, the lighting agents 313 of the central emergency button 302 are controlled by the emergency button electronics unit 308. As the first delay duration progresses, fewer lighting agents 313 are illuminated with the same color. For example, fewer lighting agents 313 can be illuminated with a first color and increasingly more lighting agents 313 with a second color. The lighting agents 41 of the emergency button 10 are controlled in an identical manner to visually display the first delay duration.

During the first delay duration, for example 8 seconds, the operator can actuate the delay element 332. To do this, the operator turns a key in the key switch serving as the delay element 332. An actuation of the delay element 332 is detected by the emergency button electronics unit 308, in particular the third emergency processing unit 305. A corresponding message is sent via the second bus system 401 and, if necessary, the first bus system 400. The emergency button 10 receives the message. Following actuation of the delay element 332, the emergency button 10 ends the first delay duration and begins a second delay duration. The second delay duration, for example 180 seconds, is longer than the first delay duration. At the end of the second delay period, the emergency button 10 causes the door lock 200 to be unlocked. The second delay period is determined at the emergency button 10 by means of the same timer that is used to determine the first delay period. During the second delay period, the key of the delay element 322 must remain unturned. On the other hand, a single turn of the key is sufficient to initiate the second delay period.

The second delay duration is visually represented on the central emergency exit control 300 and on the emergency button 10. The visual representation on the central emergency exit control 300 is similar to the visual representation on the emergency button 10. As the second delay duration progresses, fewer lighting agents 41, 313 are displayed with the same color. For example, fewer lighting agents 41, 313 may be displayed with a first color and increasingly more lighting agents 41, 313 with a second color. To represent how long the second delay duration lasts, a pattern that is associated with a temporal sequence, for example a circulating colored spot or a circulating colored window, may be repeatedly represented within the second delay duration (see description with respect to Figures 16, 17).

If the termination element 333 is actuated during the first or second delay duration, the emergency electronics unit 308, in particular the third emergency processing unit 305, detects the actuation of the termination element 333 and sends a message regarding the actuation of the termination element 333 via the second bus system 401. In this way, the emergency electronics unit 308 causes the emergency button 10 not to delay the unlocking any further, but to directly cause an unlocking of the door lock 200. The termination element 333 is designed such that it does not latch. One actuation of the termination element 333 is sufficient to terminate the delay in generating the unlocking.

The emergency button 10 can be transferred to the deactivated state by actuating the first control element 322. To do this, the operator turns a key in the key switch serving as the first control element 322. An actuation of the first control element 322 is detected by the emergency button electronic unit 308. When the first control element 322 is actuated, a first and a second electrical deactivation circuit are opened or closed. The opening or closing of the first deactivation electrical circuit is detected by the first emergency processing unit 303. The opening or closing of the second electrical circuit is detected by the second emergency processing unit 304. The first and second emergency processing units 303, 304 communicate via the second bus system 401 with the emergency button 10. If the first bus system 400 is located between the emergency button 10 and the central emergency button 302, the control device 100 bypasses the message to the first and second emergency processing units 303, 304. In the bypass, the format is modified, but the content remains unchanged.

In the deactivated state of the emergency button 10, actuation of the emergency button 10 has no effect on the door closing 200.

The activated state and the deactivated state are stored electronically in the emergency button 10. Since the activated state and the deactivated state are stored in the emergency button 10, the key does not need to remain turned in the first control element 322 during the deactivated state. On the contrary, a single turn of the key is sufficient to deactivate the emergency button 10.

The deactivation remains until the second control element 323 is actuated. The actuation of the second control element 323 can be detected by the emergency button electronics unit 308, in particular the emergency processing unit 305. The emergency electronics unit 308 sends a message regarding the actuation of the second control element 323 via the second bus system 401 and, if necessary, via the first bus system 400 to the emergency button 10, whereupon the emergency button 10 is transferred to the activated state. The second control element 323 is not latched. Since the activated and deactivated states are stored in the emergency button 10, a single actuation of the second control element 323 is sufficient to transfer the emergency button 10 to the activated state.

The central emergency exit control 300 comprises a bus 341 via which signals from the second control element 323, the delay element 332 and the termination element 333 can be detected by means of the emergency electronics unit 308, in particular the third emergency processing unit 305. The emergency electronics unit 308 serves as the intelligence of the entire central emergency exit control 300. Only the emergency electronics unit 308 comprises microprocessors. The deactivation module 320 and/or the delay module 322 can be designed without a processor. The bus 341 can be designed as an I2C bus. A second variable can be stored in the first emergency button processing unit 20 and redundantly in the second emergency button processing unit 21 to establish the activated and deactivated state, in particular in non-volatile memories. The second variable can be binary. If the emergency button 10 is in the deactivated state, the second variable is set to a deactivation value. If the emergency button 10 is in the activated state, the second variable is set to an activation value. Following an actuation of the first control element 322, the second variable is set to the deactivation value. Following an actuation of the second control element 323, the second variable is set to the activation value. Before the emergency button 10 causes the door lock 200 to be unlocked, the emergency button 10 checks the value of the second variable. If the emergency button determines that the emergency button 10 is deactivated, there is no communication between the emergency button 10 and the door lock control 201 to cause unlocking 200.

The first emergency processing unit 303 and the second emergency processing unit 304 monitor each other for faults. If a fault is detected, a message is sent via the second bus system 401. The emergency button 10 receives the message and then transfers itself to the activated state if the emergency button 10 is in the deactivated state. To do this, the emergency button 10 changes the value of the second variable to the activation value.

The first emergency processing unit 303 and the second emergency processing unit 304 repeatedly send, in particular at regular intervals, a life signal via the second bus system 401. The emergency button 10 receives the life signals. If a life signal is missing on one or more occasions, the emergency button 10 is transferred to the activated state, if the emergency button 10 is in the deactivated state.

If the security system 1 receives a fire alarm signal, the emergency button 10 is transferred to the activated state, if the emergency button 10 is in the deactivated state.

The actuation of the emergency button 10 in the deactivated state is displayed on the central emergency exit control 300, on the monitoring device 301 and/or on the multi-door display device 350. If a dangerous situation actually exists, the emergency button 10 is transferred to the activated state by the operator actuating the second control element 323, or the door can be closed and unlocked directly by the operator. For this purpose, the operator can actuate the central emergency button 302. If a dangerous situation occurs, the operator can perceive, for example, the audio and video module 510. In this way, a high level of safety is achieved.

Deactivation can be carried out, for example, at night in a department store. Furthermore, it is conceivable to use the deactivatable emergency button 10 in a building in which mentally handicapped persons live. Thus, emergency buttons 10 can also be used on doors to which mentally handicapped persons have access, for example in a station or psychiatric ward.

If the emergency button 10 is actuated in the deactivated state and the emergency button 10 is then transferred to the activated state, then actuating the emergency button 10 in the deactivated state does not lead to unlocking of the door lock 200 after transfer to the activated state. Actuating the emergency button 10 in the deactivated state has no effect. This is due, on the one hand, to the fact that the actuating element 11 and the switch 63 are not designed to interlock. On the other hand, actuating the emergency button 10 is not stored in the deactivated state on the emergency button 10. The door lock control 201 does not receive any message regarding actuation of the emergency button 10 in the deactivated state. The electronic hold-open system has thus been transferred to the actuating state. In this way, it is achieved that, directly by activating the emergency button 10, the door lock 100 is unlocked, for example, because the emergency button 10 was actuated long before. In this way, a high level of security is achieved in the building in question.

In order to achieve a particularly high level of safety, it can be provided that the audio and video module 510 is activated during the first and/or second delay period. In this case, the emergency button 10 activates the audio and video module 510 at the beginning of the first and/or second delay period. The audio and video module 510 is also activated by the emergency button 10 when the emergency button 10 is actuated in the deactivated state. For this purpose, the emergency button 10 communicates with the audio and video module 510 via the second bus system 401 and, if necessary, via the first bus system 400.

It may be that the emergency button 10 can only be deactivated if the audio and video module 510 can be activated. If the audio and video module 510 is part of the security system 1 according to the invention, deactivation can be dispensed with if the audio and video module 510, for example, is not in operation and/or the connection to the audio and video module 510 fails. This is not the case if the security system 1 does not comprise an audio and video module 510, but a building surveillance system separate from the security system 1 is provided.

It may be that the emergency button 10 delaying the triggering of the unlocking is only delayed for the first and/or second delay duration, if the audio and video module 510 can be activated. If the audio and video module 510 is part of the security system 1 according to the invention, a delay can be dispensed with if the audio and video module 510, for example, is not in operation and/or the connection to the audio and video module fails. This is not the case if the security system 1 does not comprise an audio and video module 510, but a building surveillance system independent of the security system 1 is provided.

10 shows a further exemplary embodiment of a safety system 1 according to the invention. As in the exemplary embodiment of FIGS. 7 to 9, the safety system 1 comprises a central emergency exit control 300, which is structured corresponding to that of FIGS. 7 and 8. The corresponding key switches 500, 500', 1500, 1500', 2500 of the respective emergency buttons 10, 10', 1010, 1010', 2010 are not shown for the sake of clarity. The central emergency exit control 300 is connected to the second bus system 401. A first bus subsystem 5 and a second bus subsystem 6 are connected to the second bus system 401. The two subsystems 5, 6 each comprise a first bus system 400, 400'. Emergency buttons 10, 1010 or 10', 1010', 2010' and door locks 200 or 200', 1200', 2200' are connected to the respective first bus system 400, 400'. The first bus systems 400, 400' are of the same type of bus system, for example a CAN bus or a DCW bus. The second bus system 401 is of a different type of bus system, for example a LON or LAN bus.

The security system 1 comprises the multi-door display device 350. The multi-door display device 350 can, for example, visually display which door lock 200 or 200', 1200', 2200' is in the unlocked state and which door lock is in the unlocked state. With the aid of the multi-door display device 350, an operator can perform safety-independent locking and unlocking of individual door locks 200 or 200', 1200', 2200' of the security system 1.

Each subsystem 5, 6 comprises only one control device 100, 100'. In each case, the control device 100, 100' of the respective subsystem 5, 6 is connected to the second bus system 401. The control device 100 of the first subsystem 5 is connected to the emergency buttons 10, 1010 and the door lock 200 of the first subsystem 5 via the first bus system 400. The control device 100' of the second subsystem 6, on the other hand, is integrated in an emergency button 10' of the second subsystem 6 and is connected to the further emergency buttons 1010', 2010' and the door locks 200', 1200', 2200' of the other first bus system 400'.

In the subsystem 5, a first emergency button 10 and a second emergency button 1010 are provided. If the emergency button 10, 1010 is actuated, the actuated emergency button 10, 1010 in each case causes the door lock 200 to be unlocked.

A first emergency button 10, a second emergency button 1010' and a third emergency button 2010' are provided in the subsystem 6. The emergency buttons 10', 1010', 2010' selectively trigger unlocking of the door locks 200', 1200', 2200' of the second subsystem 6. For example, actuating the first emergency button 10' triggers only unlocking of the first door lock 200'. Correspondingly, actuating the second emergency button 1010' triggers only unlocking of the second door lock 1200', and actuating the third emergency button 2010' triggers only unlocking of the third door lock 2200'.

A wide variety of variations are conceivable. Thus, a security system according to the invention 1 can, for example, be designed without the first or second subsystem 5, 6. For example, one of the security systems 1 according to the invention described in FIGS. 1 to 6 can be provided as the sole or additional subsystem. The configuration and functions of the emergency buttons 10, 10', 1010, 1010', 2010' and the door locks 200, 200', 1200', 2200' are configured corresponding to the above exemplary embodiments, unless they are described further or differently below.

In each of the door locks 200, 200', 1200', 2200' of the security system 1, it is saved whether the respective door lock 200, 200'1200', 2200' is unlocked when the central emergency button 302 is actuated. For example, the door locks 200, 200', 2200' can allow unlocking as a result of actuating the central emergency button 302, but not the door lock 1200'. If the central emergency button 302 is actuated, the door lock controls 201 of the door locks 200, 200', 2200' control the respective locking mechanism 205 for unlocking. On the contrary, such a control does not take place in the 1200' door closure.

If the central emergency button 302 is actuated, the control devices 100, 100' receive a corresponding message from the central emergency button 302 via the second bus system 401 and forward the message in each case to all door locks 200 or 200', 1200', 2200' of the respective first bus system 400, 400'. The door locks 200, 200, 1200, 2200 decide on the basis of what is stored, including the admissibility of unlocking as a result of actuation of the central emergency button 302, whether the respective door lock control 201 of the door locks 200, 200', 1200', 2200' controls the respective locking mechanism 205 for unlocking or not.

The setting of whether the door lock 200, 200'1200', 2200' is unlocked as a result of actuation of the central emergency button 302 is made by the operator during commissioning of the safety system 1. The setting is made by means of the parameterization program.

For each of the emergency buttons 10, 1010, 10', 1010', 2010', it is specified whether a transfer to the deactivated state is permitted for the respective emergency button 10, 1010, 10', 1010', 2010' when the first operating element 322 is actuated or not. In this way, a selective deactivation is achieved by actuating the only first operating element 322 of the safety system 1. For example, the emergency buttons 10, 10', 2010' can be transferred to the deactivated state when the first operating element 322 is actuated, but not the emergency buttons 1010, 1010'.

If the first control element 322 is actuated, the control devices 100, 100' receive a corresponding message via the second bus system 401 and forward the message in each case to all emergency buttons 10, 1010, 1010', 2010' of the respective first bus system 400, 400' which do not comprise the control device 100. The emergency buttons 10, 1010, 10', 1010', 2010' of the safety system 1 decide, on the basis of the setting for the admission for deactivation, whether the respective emergency button 10, 1010, 10', 1010', 2010' itself is transferred to the deactivated state as a result of actuation of the first control element 322.

The setting of whether deactivation of the emergency buttons 10, 1010, 10', 1010', 2010' is to be permitted may be a third variable. The third variable may be implemented in binary form. The third variable is stored in the non-volatile memories of the respective first and second emergency button processing units 20, 21 of each emergency button 10, 1010, 10', 1010', 2010'. If deactivation is permitted for the respective emergency button 10, 1010, 10', 1010', 2010', the third variable takes on a first value. If deactivation is prohibited for the respective emergency button 10, 1010, 10', 1010', 2010', the third variable takes on a second value. The 10, 1010, 10', 1010', 2010' emergency button checks the value of the third variable before the 10, 1010, 10', 1010', 2010' emergency button is deactivated and is only deactivated if the third variable has the first value.

The setting of whether the emergency button 10, 1010, 10', 1010', 2010' is to be deactivated is made by the operator during commissioning of the safety system 1. This is done using a parameterisation program.

In each of the emergency buttons 10, 1010, 10', 1010', 2010', it is defined whether, when the delay element 332 is actuated, the respective emergency button 10, 1010, 10', 1010', 2010' delays or not the unlocking of the door locks 200, 200', 1200', 2200' associated with the emergency button 10, 1010, 10', 1010', 2010' for a second delay duration. The second delay duration can be set differently for the respective emergency buttons 10, 1010, 10', 1010', 2010' and is stored in the safety system 1, in particular for the emergency buttons 10, 1010, 10', 1010', 2010'. Alternatively, the acceptance of the delay during a second delay duration and, if necessary, the time of the second delay duration can be individually set only for emergency button groups 10, 1010, 10', 1010', 2010' which are assigned to a door lock 200, 200', 1200', 2200' or a door 2, 2002, 3002. The setting and saving are carried out by the operator using the parameterization program.

For example, the emergency buttons 10, 2010' can delay the unlocking of the door locks 200 or 2200' by actuating the delay element 332, but not the emergency buttons 1010, 10', 1010'. The duration of the second delay time for the emergency button 10 is selected differently from the duration of the second delay time for the emergency button 2010'. If the emergency button 10 is actuated and, within the first delay duration that is stored for the emergency button 10, the delay element 332 is actuated, the emergency button 10, from the actuation of the delay element 332, delays the unlocking by the second delay duration that is stored in the emergency button 10. If the emergency button 2010 is actuated and, within the first delay duration that is stored for the emergency button 2010, the delay element 332 is actuated, the emergency button 2010, from the actuation of the delay element 332, delays the unlocking by the second delay time that is stored in the emergency button 2010' and which is different from the second delay time for the emergency button 10. If the emergency button 1010 is actuated, the emergency button 1010 delays the unlocking by the second delay time that is stored in the emergency button 2010' and which is different from the second delay time for the emergency button 10. Unlocking with the first delay duration stored for the emergency button 1010. If the delay element 332 is actuated during the first or second delay duration of the emergency button 1010, the unlocking is not delayed by a second delay duration, since this delay is not permitted for the emergency button 1010, but the emergency button 1010 directly triggers unlocking of the door lock 200 after the first delay duration. The emergency buttons 10', 1010' do not delay the unlocking of the associated door locks 200' or 1200'. For the emergency buttons 10', 1010', neither a first delay duration nor a second delay duration is permitted. Instead of not allowing a delay at the first and/or second delay duration, a delay of 0 seconds can also be stored. An actuation of the termination element 333 terminates any unlocking delay.

If the delay element 332 is actuated, the control devices 100, 100' receive a corresponding message via the second bus system 401 and forward the message in each case to the emergency buttons 10, 1010, 1010', 2010' of the respective first bus system 400, 400' which do not comprise the control device 100. The emergency buttons 10, 1010, 10', 1010', 2010' of the safety system 1 decide on the basis of the setting how to proceed.

The setting of whether the emergency button 10, 1010, 10', 1010', 2010' supports the delay of the second delay duration and, if so, the setting of the duration of the second delay time is carried out during commissioning of the safety system 1. The settings are made by the operator using the parameterisation program. The first and/or second delay duration can only be selected up to a firmly predetermined maximum duration.

Furthermore, the operator can selectively define which abort condition is permitted for each emergency button 10, 1010, 1010', 2010' using the parameterization program. The abort condition for the abort action in situ is always permitted. For each emergency button 10, 1010, 1010', 2010', however, the achievement of the abort condition by passing the predetermined time interval or the achievement of the abort condition by passing the predetermined time interval and subsequent actuation of the identification device 312 in the event that the door 2 has remained closed can be selectively permitted or not permitted.

The setting of whether the emergency button 10 can be deactivated by actuating the first control element 322, whether the emergency button 10 can delay the unlocking by a second delay duration by actuating the delay element 332, the duration of the first and second delay times, the establishment of the cancellation condition and/or the establishment of whether the door lock 200 is to be unlocked by actuating the central emergency button 302 can also be an exemplary embodiment for the security system 1 according to the exemplary embodiment of FIGS. 7 to 9.

In a divergent manner and not shown in FIGS. 7 to 10, several central emergency exit controls 300, 300' can also be connected to the second bus system 401. For example, in a psychiatric facility, one central emergency exit control 300 can be provided for arrangement in a monitoring cabin and another central emergency exit control 300' for arrangement in a nursing station.

In the respective door locks 200, 200', 1200', 2200', it is possible to determine in each case using the parameterization program which of the central emergency buttons 302, 302' is to be unlocked as a result of an actuation. For this purpose, a list must be established in the door locks. In the respective emergency buttons 10, 10', 1010, 1010', 2010', it is possible to determine in each case using the parameterization program which of the first operating elements 322, 322' are permitted to be deactivated as a result of an actuation. In contrast to the third variable, a list is established in each case for this purpose in the emergency buttons 10, 10', 1010, 1010', 2010'.

From the first to the fourth embodiment of the security system 1 according to the invention, a second bus system 401, a central emergency exit control 300, a monitoring device 301 and an audio and video module 510 are not present. However, embodiments according to the invention of the security system 1 are conceivable in which, from the first to the fourth embodiment, the missing components 401, 301, 300 and 510 are at least partially included. If the security system 1 is designed for several doors, an audio and video module 510 can be assigned to each door. The emergency buttons 1010, 2010, 3010 do not comprise the control device 100, and the door locks 200, 1200, 2200, 3200 are not connected to the second bus system 401.

In Figures 1 to 10, the door locks 200, 200', 1200, 1200', 2200, 2200', 3200 are part of the security system 1 according to the invention. However, it is also conceivable that in each case only the door lock controls 201 are part of the security system 1 according to the invention. In this case, the door lock controls 201 can in each case be connected to the locking mechanism 205 and, if necessary, to the door status monitoring devices 204, 206. Unlocking of the door lock 200 does not take place in this case in the security system 1, however, it is part of the security system 1 that the door lock control 201 controls the locking mechanism 205, i.e. that the door lock control 201 activates or deactivates the electrical current for the locking mechanism 205. In this case, instead of the terms "unlocking or locking of the door lock", "control of the locking mechanism for unlocking or locking" can be used in each case.

An emergency button 10 is shown in Figures 11 to 13. The emergency button 10 shown in Figure 11 can be used or is used as an emergency button 10, 10', 1010, 1010', 2010, 3010 in one of the security systems 1 according to the invention of Figures 1 to 10.

The emergency button 10 comprises the actuating element 11. The actuating element 11 can be moved from the starting position 11.I, which is shown in Figure 11, to the actuating position 11.II, which is shown in Figure 11. In Figure 12, the actuating element 11 is also located in the starting position 11.I.

In the operating position 11.II, switch 63 is activated. In this sense, switch 63 also changes from a position 63.I to a second position 63.II, as shown in Figure 12.

After actuation, the actuating element 11 returns directly and without manual action to the starting position 11.I. For this purpose, a spring-shaped restoring agent 12 is provided in the emergency button 10. After actuation, the switch 63 also returns directly and without manual action to the first position 63.I.

The emergency button 10 comprises at least a first plate 60. It is therefore possible to design the emergency button 10 in a compact manner and with assured operation.

The emergency button 10 has a mounting height AH of less than 48 mm from a crest 32 of a front surface 19 of the actuating element 11 in the mounting direction, preferably less than 45 mm, particularly preferably less than 43 mm.

The switch 63 is fixed to the first plate 60. The first and second electrical circuits are interrupted on the first plate 60 by actuation of the switch 63.

The emergency button 10 further comprises a second bale 61. The first, second and third emergency button processing units 20, 21, 22 are arranged on the first plate 61. The arrangement of the first, second and third emergency button processing units 20, 21, 22 is independent of whether the first, second and third emergency button processing units 20, 21, 22 serve as processing units 103, 104, 105 of the control device 100.

The opening of the first and second electrical circuits can be detected wirelessly by the first or second emergency button processing unit 20, 21. For this purpose, the first and second boards 60, 61 are connected to each other via pins 68.

The first and second plates 60, 61 are arranged at a fixed distance from each other. For this purpose, bolts 69 are provided which fix the first and second plates 60, 61 to each other by means of screws 70 at a fixed distance from each other (see Figure 13). The first and second plates 60, 61 are arranged parallel to each other.

The emergency button 10 comprises a mounting plate 62. The mounting plate 62 is also arranged at a fixed distance from the first and second plates 60, 61. For this purpose, bolts 71 are provided which connect the mounting plate 62 to the first plate 61 by means of screws 72.

The mounting plate 62 is used for fixing a flush-mounted box. The flush-mounted box can have a diameter of 60 mm and a depth of 41 mm. The part of the emergency button 10 extending from the mounting plate 62 in the mounting direction is designated as component 73. The component 73 has a diameter of less than 60 mm and a depth of less than 33 mm, preferably less than 31 mm, particularly preferably less than 29 mm. In this way, there is sufficient space for cables in the flush-mounted box. The distance MP from the underside of the mounting plate 62 to an upper side of the second plate 62 is less than 22 mm, preferably less than 20 mm, particularly preferably less than 17 mm. The mounting plate 62 can also be used for fixing to a cover element of a surface-mounted housing (not shown). The distances mentioned are fulfilled in particular for an emergency button in which the Bluetooth module 64 is fixed to a lower side of the second circuit board 61, in contrast to the illustration in the figures.

As described above, the canceling action, which is carried out directly on the emergency button 10, is carried out without a rotary movement of the actuating element 11 and the switch 63. It is therefore possible to use a switch 63 with a lower height. Thus, the switch 63 is designed such that the switch 63 does not rotate. The switch 63 has a height SH of less than 20 mm, preferably less than 17 mm, particularly preferably less than 15 mm.

The manner of the cancellation action and the reduced height of the switch 63 contribute to a reduced construction height AH of the emergency button 10.

The low overall height AH of the emergency button 10 is also aided by the fact that the switch 63 is arranged centrally below the actuating element 11 and that the actuating element 11 is guided eccentrically in the emergency button 10.

As shown in Figures 14 and 15, the drive element 11 has rod-shaped guide means 35. The guide means 35 are guided in guide sleeves 65. The guide sleeves 65 are connected to the mounting plate 62. In order to achieve good guidance, one of the guide sleeves 65 extends through the first plate 60.

The guide means 35 are arranged parallel to the switch 63. The guide means 35 prevent a rotary movement of the actuating element 11 about an imaginary axis 701 running in the actuating direction 700.

By means of the guide means 35 guided in the guide sleeves 65, the drive element 11 can only be moved translationally.

The actuating element 11 has an actuating agent 36. As shown in FIGS. 12 and 15, the actuating agent 36 is designed in the form of a circular cylinder. This ensures that the actuating agent 36 always actuates the switch 63. In particular, a first and a second switching element 74, 75 of the switch are thus always actuated simultaneously (see FIG. 13). The first electrical circuit is opened by the first switching element 74 and the second electrical circuit by the second switching element 75.

The actuating element 36 is designed with a hollow interior space 38. A light source (not shown) is arranged in the switch 63. The light emitted by the light source is directed through the hollow interior space 38 to the ridge 32 of the end face 19 of the actuating element 11, where the light passes through the actuating element 11. The ridge 32 serves as the illumination region 32 of the actuating element 11. The actuating element 11 may comprise a light-permeable base body 33. In contrast to the representation in the figures, the base body 33 may be provided with an opening. A light-permeable, in particular translucent, insert, not shown, may be arranged in the opening. The insert may be fixed in the opening, in particular pressed in. In this way, the actuating element 11 can be manufactured in a particularly simple manner.

The front surface 19 is partially conical. The illumination zone 32 forms the tip of the truncated cone. The illumination zone 32 projects against the actuation direction 700 of the cover 14 of the emergency button 10. In this way, the light emerging from the illumination zone 32 laterally to the emergency button 10 can be clearly seen.

The recovery agent 12 has a cavity 37. The actuating agent 36 of the actuating element 11 and the switch 36 with the first and second switching elements 74, 75 are inserted into the cavity 37. This results in a compact arrangement.

The Bluetooth module 64 is arranged between the first and second plates 60, 61. The Bluetooth module 64 serves for parameterization. Alternatively, although not shown, the Bluetooth module 64 is compactly attached to a side of the second plate 61 facing away from the drive element 11. In this way, the distance between the first and second plates 60, 61 can be further reduced.

An anti-tampering switch 66 is arranged on the first plate 60. Due to the low construction height, an actuating extension 67 of the anti-tampering switch 66 is guided through the mounting plate 62. The actuating extension 67 rests directly on the cover 14 of the emergency button 10.

If the control device 100 is integrated into the emergency button 10, the emergency button 10 can include the functions described above despite the low overall height AH and thus be intelligently designed. The functions described above are implemented with the aid of a program code which is stored in at least one of the processing units 103, 104, 105.

The emergency button 10 has a covering agent 13. The covering agent 13 is transparent and covers the front surface 19 of the actuating element 11. In this way, the covering agent 13 prevents direct contact of the actuating element 11 with the user. The covering agent 13 serves as a mental barrier for the user.

The cover agent 13 is not destroyed by actuation of the emergency button 10. The cover agent 13 moves by actuation of the emergency button 10 from a starting position 13.I to an actuation position 13.II. By means of the cover agent 13, the user actuates the actuating element 11 only indirectly by means of the cover agent 13.

The covering agent 13 is arranged in a non-removable manner on the emergency button 10. In this way, it is ensured that a user cannot remove the covering agent 13 due to misuse.

The covering agent 13 is firmly connected to the actuating element 11. For this purpose, the covering agent 13 has extensions 27, which are shown in Figure 13. As shown in Figures 13, 14 and 15, the actuating element 11 has holes 28 through which the extensions 27 are guided and are connected to the actuating element 11 by material adhesion.

The actuating element 11 has a flange-like section 31 to which the covering agent 13 is fixed. The flange-like section 31 has the holes 28.

The flange-like section 31 serves as a stop for the drive element 11 in the drive direction 700. The drive element 11 reaches the drive position 11.II when the flange-like section 31 abuts against the mounting plate 62 or the guide bushings 65.

The flange-like section 31 serves as a stop for the actuating element 11 against the actuating direction 700. The actuating element 11 reaches the starting position 11.I when the flange-like section 31 abuts against a light conductor 40. The light conductor 40 holds the actuating element 11 against the force of the restoring agent 12. For this purpose, the light conductor 40 has a contact surface 51. The light conductor 40 is fastened to the mounting plate 62. In this way, the actuating element 11 remains held against the force of the restoring agent 12 even when the cover 14 is removed. The light conductor 40 has a flange 52 with which the light conductor 40 is fastened to the mounting plate 62 (see FIG. 17). The light conductor 40 is fixed by means of the same screws 72 to the mounting plate 62 by means of which the mounting plate 62 is fixed to the first plate 60.

Alternatively, and although not shown, the covering agent 13 may be configured as an elastic film encompassing the actuating element 11.

Due to the firm connection, the actuating position 11.II and the starting position 11.I and the distance between the actuating position 13.II and the starting position 13.I coincide. Immediately after the actuation has been completed and without manual action, the covering agent 13 returns to the starting position 13.I. The restoring agent 12 serves this purpose. The restoring agent 12 transfers the covering agent 13 indirectly via the actuating element 11 to the starting position 13.I.

The cover 13 and the actuating element 11 each have a circular cross section. The cover 14 has a circular recess 15. The cover 13 projects counter to the actuating direction 700 through the recess 15. The actuating element 11 also projects through the recess 15.

The recess 15, the actuating element 11 and the covering agent 13 have an imaginary common axis 701. The recess 15, the actuating element 11 and the covering agent 13 are arranged concentrically.

The cover member 13 has an actuating surface 17 which is spaced apart from the front surface 19 of the actuating element 11. The cover member 13 also has a side surface 16 which is configured at a distance from the side surface 18 of the actuating element 11.

By spacing the front surface 19 and the actuating surface 17 apart, the transparent covering agent 13 can protrude far beyond the cover 14, whereas the partially light-impermeable actuating element 11 only protrudes to a small extent beyond the cover 14. In this way, the light conductor 40, which closes substantially flat with the cover 14, can also be seen adequately by a user standing obliquely to the emergency button 10. The light conductor deviates by a maximum of ±3 mm, preferably a maximum of ±2 mm, particularly preferably ±1 mm from a flat closure with the cover 14.

Since the cover element 13 projects far beyond the cover 14, the user can operate the emergency button 10 with a flat hand. To do this, the cover element 13 is positioned flat against the cover 14 in the actuation position 13.II or the cover element 13 projects against the actuation direction 700 from the cover 14 in the actuation position 13.II. In other words, the distance ABS of the starting position 13.I and the actuation position 13.II corresponds at most to the distance DF of an elevation 30 of the actuation surface 17 relative to the cover 14. Likewise, the distance measurement AB of the actuation position 11.II and the starting position 11.I corresponds at most to the distance DF. In FIG. 11, the distance ABS and the distance measurement AB correspond to the distance DF.

The emergency button 10 comprises lighting agents 41. The lighting agents 41 are used to indicate the unlocked and locked state of the door lock 200. If there are several emergency buttons 10, 1010, 2010, 3010, the lighting agents 41 indicate the unlocked and locked state of the associated door lock or locks 200, 1200, 2200, 3200. The lighting agents 41 are arranged concentrically around the actuating element 11. For example, the unlocked state is indicated by a green light and the locked state by a red light. In particular, all lighting agents 41 emit the same light to indicate the locked and unlocked state, at least if there is no dangerous situation.

The lighting agents 41 can be controlled in at least two groups. By means of the different control, for example, patterns are possible by means of which other states of the security system 1 can be displayed to the user. By means of the additional display possibilities, a plurality of states can be displayed to the user and/or the operator in a compact and simple manner and without additional display agents. In this way, the security of the security system 1 is increased.

In Figure 13, one of the eight illustrative illuminating agents 41 is shown, of which three illuminating agents are provided with the references 41a, 41b, 41c. The individual illuminating agents are designated in the following as 41a, 41b, 41c, etc.

Each of the individually controllable groups of lighting agents 41 can comprise an individual lighting agent 41a, 41b, 41c, etc. In the exemplary embodiment of FIGS. 11 to 17, each lighting agent 41a, 41b, 41c, etc. can be controlled individually. Each lighting agent 41a, 41b, 41c, etc. is in each case configured as an RGB LED. The lighting agents 41a, 41b, 41c, etc. can be controlled such that each lighting agent 41a, 41b, 41c, etc. can emit light in at least four different colors, preferably at least five. In this respect, it can be, for example, red, blue, yellow, green and pink light.

The lighting agents 41 are controlled by the third emergency button processing unit 22. For this purpose, the emergency button processing unit 22 and the lighting agents 41 are connected to a ring bus (not shown).

The lighting agents 41 are arranged on the first board 60. Also, the sound alarm 23 is arranged on the first board 60. The sound alarm 23 is controlled by the third emergency button processing unit 22.

If several door locks 200, 1200 are assigned to the emergency button 10 as shown, for example, in FIG. 4, at least two options are conceivable. On the one hand, the emergency button 10 can only display the unlocked state when all door locks 200, 1200 assigned to the emergency button 10 are in the unlocked state. In this case, the unlocked state is only displayed when the entire width of the emergency door of the two door leaves 3, 4 is available for evacuation. Alternatively, the emergency button 10 already displays the unlocked state when one of the door locks 200, 1200 or all door locks of a door leaf 3, 4 are in the unlocked state. In this way, the possibility of escape is displayed as early as possible when one of the door leaves 3, 4 is already open. The options can be selected by the operator. For this purpose, a switch (not shown) may be provided, for example, in the safety system 1.

Another status of the safety system 1 that is displayed by the group-controllable lighting agents 41 is the event of danger. In this respect, the lighting agents 41 can display whether a fire alarm signal is present or whether an activation signal has been generated.

The lighting agents 41 can be controlled in such a way that the progress of the unlocking delay is displayed after generation of the actuation signal by means of the lighting agents 41. In this regard, for example, fewer and fewer lighting agents 41 emit light of one color, in particular red light.

Another state of the security system 1 that can be represented by the lighting agents 41 is a fault displayed by the lighting agents 41. The fault displayed in this way can be a fault of the security system 1. For example, it can be shown that the control device 100, the door lock control 200 or the first or second emergency button processing unit 20, 21 of the security system 1 is not operational, is defective, fails or has been intentionally deactivated or removed. The fault can be a fault of the alarm system connected to the security system 1, which is not operational, is defective, fails or has been deactivated or removed.

The light conductor 40 comprises a plurality of light-conducting regions 44 (see FIGS. 16 and 17). Each of the lighting agents 41a, 41b, 41c is associated with one light-conducting region 44. The light conductor 40 can be divided into the light-conducting regions 44 in an imaginary manner. Recesses 46 are provided between the light-conducting regions 44. The light essentially remains in the light-conducting regions 44 through the recesses 46.

Each light-guiding zone 44 has a bypass section 48. The bypass section 48 is arranged in the transmission direction 702 on the illuminating agents 41. The transmission direction 702 is counter to the actuation direction 700. The bypass section 48 serves to guide light to an opening section 45 of the light-guiding zone 44. The opening section 45 opens in the transmission direction 702.

The opening section 45 is adjacent to the bypass section 48 in the transmission direction 702. The opening section 45 serves to broaden the light beam of the emitted light. The bypass section 48 is broadened less than the opening section 45.

The light conductor 40 is made of a single piece. The light conductor 40 is made of a uniform, in particular monolithic, material. The light conductor 40 is made of a translucent material.

The light-guiding areas 44 have a connecting section 49. The connecting section 49 adjoins the opening section 45 in the transmission direction 702. The connecting sections 49 of the light-guiding area 44 are connected to one another in a single piece such that the light guide 40 is made of a single piece and a uniform material.

The connection sections can have a depth of 2 mm to 6 mm, preferably 3 mm to 5 mm, particularly preferably 3.5 mm to 4.5 mm. In this way, the light from one of the illumination agents 41a, 41b, 41c etc. is practically restricted to an illumination zone 50a, 50b, 50c, 50d, 50e, 50f, 50g, 50h on the surface 47 of the light guide 40 facing the user. In this respect, each light guide zone 44 comprises an illumination zone 50a, 50b, 50c, 50d, 50e, 50f, 50g, 50h.

The surface 47 of the light guide 40 corresponds to a circular ring. The illumination zones 50a, 50b, 50c, 50d, 50e, 50f, 50g, 50h are designed as sectors of the circular ring. By emission of light from an illumination agent 41a, 41b, 41c, etc., the corresponding illumination zone 50a, 50b, 50c, 50d, 50e, 50f, 50g, 50h is illuminated. The circular ring surrounds the actuating element 11.

The lighting agents 41 can be controlled such that at least one lighting agent 41a, 41b, 41c, etc., emits light of one color and at least one other lighting agent 41a, 41b, 41c, etc., simultaneously emits light in another color. For example, in this way the lighting zones 50a, 50b, 50e, 50f can display light of one color and the lighting zones 50c, 50d, 50g and 50h, light of another color. While the lighting zones 50a, 50b, 50e, 50f, for example, are illuminated continuously, the lighting zones 50c, 50d, 50g and 50h of lighting agents 41 can emit intermittent light.

For example, if the illumination zones 50a, 50b, 50e, 50f are first illuminated with light of a first colour and the illumination zones 50c, 50d, 50g and 50h with light of a different colour, then the illumination zones 50a, 50h, 50d, 50e are illuminated with light of the first colour and the illumination zones 50b, 50c, 50f and 50g with light of the other colour, then the illumination zones 50h, 50g, 50d, 50c are illuminated with light of the first colour and the illumination zones 50a, 50b, 50e and 50f with light of the other colour, the impression of a circulating colour window is created. The oppositely positioned illumination zones 50, i.e. the illumination zones 50 which are located on a straight line extending through an imaginary axis 701, in Fig. 14 specifically 50a and 50e or 50b and 50f or 50c and 50g or 50d and 50h, are preferably illuminated in the same manner, i.e. with the same colour and the same flashing frequency. Thus, the user positioned obliquely before the emergency button 10 can detect the pattern even if the actuating element 11 covers at least one of the oppositely positioned illumination zones 50.

In order to ensure that the light conductor 40 is as little obscured as possible, the illumination zone 32 projects beyond the light conductor 40 by a maximum of 10 mm, preferably by a maximum of 7 mm, particularly preferably by a maximum of 5 mm.

The emergency button 10 may comprise a brightness sensor (not shown). The brightness sensor measures the brightness of the surroundings of the emergency button 10. If the brightness of the surroundings decreases, the light output of the light emitted by the lighting agents 41 is reduced.

Using the Bluetooth module 64, parameters can be set via a mobile communication device, for example how the lighting agents are to be controlled in which state of the security system 1. Among the parameters of the flashing frequencies of the lighting agents 41 are whether a continuous or flashing light is to be emitted, which state is to be displayed by which color. The settings are stored after parameterization in an electronic memory of the security system 1, in particular of the control device 100. Furthermore, the display of different states may not be selectable by the operator for safety reasons and may always be stored in the electronic memory. The operator can himself select states of the security system 1 that he wants to display by means of the lighting agents 41. For this purpose, colors and/or patterns can be emitted by means of the lighting agents 41 that are not predetermined to a state. For example, the operator can select which state he wants to display with blue light. In addition to parameterization via the Bluetooth 64 module, parameterization via the monitoring device 301 is also possible.

The change in state of the door lock 200 is displayed after the door lock control 201 has communicated the change in state to the control device 100. The control device 100 then controls the lighting agents 41 or causes a control of the lighting agents 41.

During commissioning of the safety system 1, several initialization views are generated consecutively at fixed time intervals by means of the lighting agents 41. In one of the initialization views, the possible enabled functions of the control device 100 are shown. In a second initialization view, the emergency buttons 10, 1010, 2010, 3010 and door locks 200, 1200, 2200, 3200 that can be connected to the safety system 1 are shown, with the status no fault/defective/not present being shown. In a third initialization view, the status of the inputs and outputs is shown.

The central emergency button 302 is structured substantially like the emergency button 10. In particular, the actuating element 11 corresponds in function and structure to the emergency button actuating element 306. The switch 63 corresponds to the emergency button switch 307. In addition, the central emergency button 302 comprises a recovery agent corresponding to the recovery agent 12. The central emergency button 302 comprises a first and a second plate and/or a mounting plate which are structured and connected to one another correspondingly to the first plate 60, the second plate 61 or the mounting plate 62. On the first plate of the central emergency button 302, the alarm 309 and the lighting agents 313 corresponding to the alarm 23 and the lighting agents 41 are arranged. On the second plate of the central emergency button 302, the second to the third emergency processing units 303, 304, 305 are arranged. 305. The emergency button switch 307 ends on the first plate of the central emergency button 302. When the emergency button switch 307 is actuated, a first and a second electrical circuit are opened on the first plate, which can be detected wirelessly by means of the first and second emergency processing units 303, 304. For this purpose, the first and second plates are connected by means of pins. The light conductor of the central emergency button 302 corresponds in structure and function to the light conductor 40. The lighting agents 313 can be controlled correspondingly to the lighting agents 41.

It is conceivable that a cover agent 13 corresponding to the cover agent 13 is designed differently on the central emergency button 302 or is missing. The lighting agents 313 do not serve in particular for the visual representation of a locked state of an emergency button 10. The lighting agents 313 serve for the visual representation of the first and second delay durations and/or for the visual representation that a cancellation action is possible.

The security system 1 according to the invention does not necessarily have to be able to perform all of the functions mentioned in the description relating to at least one of FIGS. 1 to 10. On the contrary, the functions mentioned in the description relating to at least one of FIGS. 1 to 10 are stored in the security system 1. However, in order to be able to perform the functions, the functions must be released. This is done by the control device 100 communicating with a communication module 801. The communication module 801 is designed as a smart card. The communication module 801 comprises a memory in which at least one code for the release of at least one function is stored. The communication module 801 comprises a microprocessor which serves only to encrypt the code. The communication module 801 is inserted into a housing 77 of the control device 100 (see FIG. 18a). By means of the arrangement in the housing 77, the communication module 801 is held in the housing 77 by means of a form-fitting and/or force-fitting action. At the same time, the communication module 801 is electrically contacted by means of the arrangement in the housing 77, such that the control device 100 can read the at least one code of the communication module 801. The control device 100 and the communication module 801 are thus connected by a cable (not shown).

In order to read the code, the control device 100 must first gain access to the communication module 801 using a password. The control device 100 must decrypt the at least one code before the function can be released. By releasing the function, the program code with the help of which the function can be executed is released.

To release the function, the program code with the help of which the function can be executed is released. If the program code has been stored in the emergency button 10 and the control device 100 and the emergency button 10 are connected to each other via the first bus system 400, the control device 100, after reading the code from the communication module 801, triggers a release in the emergency button 10 via the first bus system 400. If the program code is stored in the door lock control 201, the control device 100, after reading the code from the communication module 801, triggers a release in the door lock control 201 via the first bus system 801.

A code can release one or more functions, in particular function blocks.

In the parameterization program, only parameters relating to functions that have been previously released can be set. Only these parameters are displayed on the screen.

The function remains enabled if the code is read out again from the communication module 801 repeatedly, in particular at regular time intervals. Non-adjustable time intervals can be stored in the control device 100 for this purpose. After the predetermined time interval has elapsed, the control device 100 blocks the function if the corresponding code could not be read out from the communication module 801. If the function is implemented via the emergency button 10, which is connected to the control device 100 via the first bus system 400, the control device 100 triggers a blocking of the function via the first bus system 400. If the function is implemented via the door lock control 201, which is connected to the control device 100 via the first bus system 400, the control device 100 triggers a blocking of the function via the first bus system 400.

Several codes code1, code2 for different functions can be stored in the communication module 801 (see figure 18a).

If an additional function is to be released, it is conceivable to remove the communication module 801 from the housing 77 and slide another communication module 802 into the housing 77 (see FIG. 18b). The communication module 801 is referred to hereinafter as the parent module 801. The additional communication module 802 is referred to hereinafter as the auxiliary module. The auxiliary module 802 is designed as a smart card. The auxiliary module 802 comprises a memory in which at least one code for releasing the additional function is stored. The auxiliary module 802 comprises a microprocessor which serves only to encrypt the code. The code code3 which is stored in the auxiliary module 802 is read out by the control device 100 (see FIG. 18b). In order to read the code code3, the control device 100 must first gain access to the auxiliary module 802 with the aid of a password. The control device 100 must decrypt the at least one code before the function can be released. The code code3 of the auxiliary module 802 is stored in a memory 107 of the control device 100 (see figure 18c). Then, the code of the auxiliary module 802 is deleted in the auxiliary module 802 (see figure 18c). The auxiliary module 802 is removed from the housing 77. Then, the matrix module 801 is slid into the housing 77 (see figure 18d). The code of the auxiliary module 802 is stored in the matrix module 801 (see figure 18d). The code is deleted from the memory of the control device 100 (see figure 18d). The additional function is released.

In a matrix module 801, the code is, however, not stored in the control device 100 (see FIG. 18a, d). In a matrix module 801, the code is not deleted. On the contrary, the matrix module 801 serves for permanent arrangement in the housing 77. The codes stored in the matrix module 801 codes code1, code2, code3 are read out repeatedly. The control device 100 decides on the basis of a key K801, K802 of the communication module 801, 802 whether it is a matrix module 801 or an auxiliary module 802. The key K801, K802 is stored electronically in particular in the matrix module 801 and the auxiliary module 802. The key K801 of the matrix module 801 differs from the key K802 of the auxiliary module 802.

The insertion and removal of the housing 77 is carried out manually in each case. The remaining operations are carried out automatically.

Insertion and removal of the housing 77 may be reserved for an operator. For this purpose, the housing 77 is arranged in a manner that is not accessible to an unauthorized user. In particular, the anti-tampering switch 66 is actuated in the event of an unauthorized attempt to access the housing. The housing may be arranged between the first plate 60 and the second plate 61, for example on the underside of the first plate 60.

In order for the safety system 1 to be functional, a matrix module 801 must be arranged in a housing 77 of the safety system 1. In order for the safety system 1 to be functional for longer than the predefined interval, the matrix module 801 must remain in the housing 77.

Each emergency button 10, 10', 1010, 1010', 2010, 2010', 3010 comprises a receptacle 77. Exactly one matrix module 801 is required and provided for each first bus system 400, 400' of the safety system 1. Only when the matrix module 801 is inserted into the receptacle of an emergency button 10, 10', 1010, 1010', 2010, 2010', 3010 does the emergency button 10, 10', 1010, 1010', 2010, 2010', 3010 simultaneously serve as a control device 100 for the corresponding first bus system 400, 400'. The same program codes as in the control device 100 are stored in the remaining emergency buttons 10, 10', 1010, 1010', 2010, 2010', 3010 of the security system 1, in the housing of which a matrix module 801 is not located,. However, without a matrix module 801, the program codes are not released, so that the other emergency buttons 10, 10', 1010, 1010', 2010, 2010', 3010 cannot serve as control device 100. Since the matrix module 801 is located in the housing 77, the emergency button 10, 10', 1010, 1010', 2010, 2010', 3010 serves as control device 100.

If the control device 100 is to be configured independently of the emergency buttons 10, 10', 1010, 1010', 2010, 2010', 3010 and the door locks 200, 200', 1200, 1200', 2200, 2200', 3200, a matrix module 801 is inserted into a housing 77 of the processing electronics 101. With the matrix module 801 in the housing 77, the processing electronics 101 is capable of performing the functions of the control device 100.

If the safety system 1 comprises several subsystems 5, 6 and thus several first bus systems 400, 400', the safety system 1 comprises exactly the same number of matrix modules 801, 801' as subsystems 5, 6 (see FIG. 10). The emergency button 10', which communicates with the matrix module 801', and the electronic processing system 101 of the control device 100 of FIG. 10, which communicates with the matrix module 801, are simultaneously provided for connection to the second bus system 401.

The matrix module 801, 801' may contain for each subsystem 5, 6 different codes and thus release different functions. Thus, for example, the matrix module 801' of the second subsystem 6 may comprise a code for the selective association of the door locks 200', 1200', 2200' to the emergency buttons 10', 1010', 2010'. In contrast, the code for a selective association of door locks with emergency buttons in the matrix module 801 is not necessary for the subsystem 5.

The communication module 801, 801', 802 may have a gap 803 through which a particular self-adhesive tape is guided. The self-adhesive tape serves for manual removal of the communication module 801, 801', 802 from the receptacle 77. The self-adhesive tape comprises information about functions that can be activated by codes stored in the respective communication module 801, 801', 802. The information may be a color code, a QR code and/or a barcode.

Alternatively, the communication module 801, 801', 802 can be configured as a smart card with a flexible section. A part of the smart card protruding from the housing 77 can be provided with the information, i.e. the color code, the QR code and/or the barcode.

A matrix module 801 inserted once into a security system 1 can be inserted again with full functionality into a housing 77 of another security system 1 according to the invention.

Claims (15)

1. Safety system (1) for unlocking at least one door lock (200), in particular for securing emergency exits, the safety system (1) comprising an activating element (10), in particular an emergency button (10), the activating element (10) comprising an actuating element (11), which can be actuated manually, actuating signal for unlocking the door lock (200) being able to be generated by actuating the actuating element (11), the actuating element (11) being configured for non-locking mechanical actuation, the safety system (1) comprising an electronic device (207) which is configured to electronically prevent, as a result of the actuation signal, by means of the electronic device (207), a locking mechanism (205) of the door lock (200) from being controlled for locking without the presence of a cancellation condition, characterized in that the security system comprises a door closing control, the door closing control (201) being connected to the activating element (10) through a first bus system (400), the activating element (10) being designed to electronically hold until the cancellation condition occurs, that a drive signal has been generated, the trigger element (10) being designed to repeatedly send a signal to the door closing control (201) that a drive signal has been generated until the cancellation condition occurs, the actuator element (10) being designed to electronically store in a first actuator element processing unit (20) and redundantly in a second actuator element processing unit (21) that a drive signal has been generated. 2. Safety system (1) according to claim 1, characterized in that the actuation of the actuating element (11) can be carried out in such a way that the actuating element (11) can be moved from a starting position (11. I) to an actuating position (11. II), in particular the actuating element (11) can be moved after actuation without manual action from the actuating position (11. II) to the starting position (11. I), preferably by means of a restoring agent (12). 3. Security system (1) according to claim 1 or 2, characterised in that a first program code is stored in the electronic device (207), the first program code preventing, as a result of the generation of the actuation signal, the locking mechanism (205) from being controlled for blocking without the presence of the cancellation condition, the first program code being stored in a first processing means (202) of the electronic device (207) and a second program code being stored redundantly in a second processing means (203) of the electronic device (207), the first program code and the second program code each preventing, without the presence of the cancellation condition, the locking mechanism (205) from being controlled for blocking, the first and second processing means (202, 203) each being designed in particular as microprocessors or microcontrollers. 4. Security system (1) according to one of the preceding claims, characterized in that the security system (1) comprises a door closing control (201) for controlling the locking mechanism (205), the door closing control (201) comprising the electronic device (207). 5. Security system (1) according to one of the preceding claims, characterized in that, in a delayed manner, the activating element (10), after the generation of the actuation signal, causes the door closing control (201) to control the locking mechanism (205) for unlocking. 6. Safety system (1) according to one of the preceding claims, characterized in that the electronic device (207) comprises an electronic open-position holding system, the electronic open-position holding system being able to be transferred to an actuation state as a result of the actuation signal and, upon reaching the cancellation condition, the electronic open-position holding system being able to be transferred to a starting state. 7. Safety system (1) according to one of the preceding claims, characterized in that, for achieving the cancellation condition, a cancellation signal can be generated by means of a cancellation action carried out directly on the activating element (10), in particular on the actuating element (11). 8. Safety system (1) according to one of the preceding claims, characterized in that the cancellation signal can be generated by actuating the actuating element (11), the cancellation signal corresponding to the actuation signal. 9. Security system (1) according to one of the preceding claims, characterized in that the security system (1) comprises an authentication device (500) associated with the triggering element (10) or being communicatively connected to the authentication device (500) associated with the triggering element (10), the authentication being carried out in the authentication device (500), in particular the reception of a positive identification signal by the triggering element (10), in order to achieve the cancellation condition, both the generation of the cancellation signal and the authentication in the authentication device (500), in particular the reception of the identification signal, being necessary for the achievement of the cancellation condition, a predetermined temporal sequence and/or order having to be complied with during the generation of the cancellation signal and the authentication, in particular during the reception of the identification signal, in order to achieve the cancellation condition. 10. Security system (1) according to one of the preceding claims, characterized in that there are several possibilities for achieving the cancellation condition, at least a first door status monitoring device (204) and a second door status monitoring device (206) being provided for a door leaf (2, 3, 4) and/or for a door lock (200), a possible condition for achieving a cancellation condition comprising that neither a signal from the first door status monitoring device (204) nor from the second door status monitoring device (206), which are provided for a door leaf (2, 3, 4) and/or a door lock (200), has been received in the security system (1) about the opening of the door leaf (2, 3, 4) since the generation of the drive signal within a predetermined time interval. 11. Safety system (1) according to one of the preceding claims, characterized in that the safety system (1) comprises a central emergency exit control (300), an admissible abort signal for achieving an abort condition can be generated in the central emergency exit control (300) after the predetermined time interval has elapsed and the abort signal or a message about the abort signal can be sent via at least one bus system (400, 401) to the electronic device (207), in particular authentication of a user in an identification device (312) of the central emergency exit control (300) being necessary for generating the abort signal. 12. Safety system (1) according to one of the preceding claims, characterized in that the cancellation signal, which is generated by an action directly carried out on the activator element, is only necessary for achieving the cancellation condition if, after the generation of the actuation signal, the door has been opened. 13. Safety system (1) according to one of the preceding claims, characterized in that the cancellation condition can be achieved by a. ) since the generation of the drive signal, no signal from the door status monitoring device (204, 206) about the opening of a door leaf (2, 3, 4) has been received in the security system (1) within the predetermined time interval, in particular from the electronic device (207), or no signal from the first door status monitoring device (204) and the second door status monitoring device (206) about the opening of the door leaf (2, 3, 4) has been received in the security system (1) within a predetermined time interval, in particular by the electronic device (207), and b. ) the predetermined time interval has elapsed and it is stored in the safety system (1) that the presence of conditions a.) and b.) is permissible for the attainment of the cancellation condition, it being possible to store in particular for several triggering elements (10, 10', 1010, 1010', 2010, 2010', 3010) and/or several door locks (200, 200', 1200, 1200', 2200, 2200', 3200) of the safety system (1) individually whether the presence of conditions a.) and b) is permissible for the attainment of the cancellation condition. 14. Safety system (1) according to one of the preceding claims, characterized in that the cancellation condition can be achieved by a. ) since the generation of the drive signal, no signal from the door status monitoring device (204, 206) about the opening of a door leaf (2, 3, 4) has been received in the security system (1) within the predetermined time interval, in particular by the electronic device (207), or no signal from the first door status monitoring device (204) and the second door status monitoring device (206) about the opening of the door leaf (2, 3, 4) has been received in the security system (1) within a predetermined time interval, in particular by the electronic device (207), and b. ) the predetermined time interval has elapsed and c. ) the cancellation signal has been generated in the central emergency exit control and in the safety system (1) it is stored that the presence of conditions a.) to c.) is permissible for achieving the cancellation condition, it being possible to store in particular for several triggering elements (10, 10', 1010, 1010', 2010, 2010', 3010) and/or several door locks (200, 200', 1200, 1200', 2200, 2200', 3200) of the safety system (1) individually whether the presence of conditions a.) to c.) is permissible for achieving the cancellation condition. 15. A method for unlocking at least one door lock (200), in particular for the emergency exit lock, the actuating element (10), in particular an emergency button (10), comprising an actuating element (11) that can be actuated manually, and an actuation of the actuating element (11) generating an actuation signal for unlocking the door lock (200), an actuation of the actuating element (11) being carried out mechanically and without interlocking, electronically preventing as a result of the actuation signal by means of an electronic device (207) that, without the presence of a cancellation condition, a locking mechanism (205) can be controlled for blocking, characterized in that the security system comprises a door closing control, the door closing control (201) being connected to the activating element (10) through a first bus system (400), electronically storing the trigger element (10) until the presence of the cancellation condition the fact that a drive signal has been generated, the activating element (10) sending repeatedly until the presence of the cancellation condition a signal to the door closing control (201) that a drive signal has been generated, electronically storing the trigger element (10) in a first trigger element processing unit (20) and, redundantly, in a second trigger element processing unit (21) that a drive signal has been generated.