HK1196118B - Test method for an elevator system and a monitoring device for carrying out the test method - Google Patents

Description

Test method for an elevator installation and monitoring device for carrying out the test method

Technical Field

The invention relates to a test method for an elevator installation and to a monitoring device for carrying out the test method according to the independent claims.

Background

Conventional elevator installations have a safety circuit which consists of safety elements connected in series. These safety elements monitor the state of, for example, a shaft door or a car door. Such a safety element may be a contact. Open contacts indicate, for example, that the door is in an open position and a potentially impermissible door state is created. Now, if an impermissible opening state of the door is detected with the open contacts, the safety circuit is opened. This results in the drive or brake device influencing the travel of the elevator car placing the elevator car in a standstill.

WO2009/010410a1 discloses a monitoring device for an elevator installation, which has a control unit and at least one bus node and a bus. The bus realizes the communication between the bus node and the control unit. The bus node monitors the state of, for example, a shaft door by means of a safety element. The bus node has a first microprocessor and a second microprocessor. The first microprocessor is here designed such that it reads a digital preset signal from the control unit, converts it into an analog signal and loads it onto the security element. The second microprocessor measures the analog signal behind the security element and converts it into a digital signal. The second microprocessor provides digital information to the control unit. These messages are transmitted from the bus node to the control unit as digital signals or are requested by the control unit by means of interrogation. When the safety switch remains open and the second microprocessor thus does not measure an analog signal, the second microprocessor autonomously sends negative status information to the control unit.

In order to be able to ensure safe operation of the elevator installation, the operating capability of both microprocessors (in particular the second microprocessor) must be tested repeatedly when a negative state occurs, i.e. when the safety element is switched off. A preset signal test is proposed in WO2009/010410a 1. In this test, the control unit sends different digital preset signals to the first microprocessor. The control unit may determine whether the two microprocessors correctly convert the changing preset signal based on the digital signal provided or transmitted by the second microprocessor. The preset signal having a value of zero or an error value represents a special case in which a spontaneous response of the second microprocessor is prompted. The control unit sends a digital default signal with an error value to the first microprocessor, which signal is converted into an analog default signal with an error value and is applied to the safety element. In this way, an open security element is simulated. The control unit expects the second microprocessor to respond spontaneously due to the detection of an analog preset signal having an erroneous value and to send a digital signal to the control unit. If this expectation of the control unit is met and the other preset signals are correctly inverted, the control unit may assume that both the first and the second microprocessor are functioning properly.

A disadvantage of such testable bus nodes is the relatively expensive manufacture. When such bus nodes are manufactured in large quantities, the saving in costs results in a large price effect.

Disclosure of Invention

The object of the invention is to provide a test method for an elevator installation and a monitoring device for carrying out the test method, which allow inexpensive production of the monitoring device, in particular of the bus nodes.

This object is achieved by the test method and the monitoring device of the independent claims.

According to one aspect of the invention, a monitoring device for an elevator installation has a control unit and at least one bus node. The bus node has a first microprocessor and a second microprocessor. The control unit and the bus node communicate via a bus. The monitoring device is characterized in that the first microprocessor and the second microprocessor are connected without interruption via a signal conductor.

An uninterrupted signal conductor is to be understood here to include a continuous, uninterrupted conductor which here connects, for example, two microprocessors directly to one another. In particular, a signal conductor composed of a plurality of combined partial elements in contact is not to be regarded as a continuous, uninterrupted signal conductor. Uninterrupted signal conductors do not include sub-elements such as switches, safety elements, etc., even if they are in contact with the signal conductor or member.

According to a second aspect of the invention, the monitoring device is an integral part of the testing method. The method comprises the following steps: the control unit transmits a preset signal to the first microprocessor, the first microprocessor transmits the signal to the second microprocessor through the signal conductor, and the second microprocessor provides the signal for the control unit. Finally, the control unit identifies whether the supplied signal corresponds to the signal expected by the control unit.

The monitoring device has the advantage that, in the test method, a predetermined signal which is sent by the control unit and is subsequently converted in the first microprocessor is transmitted by the first microprocessor via the signal conductor to the second microprocessor. Since the signal conductor connects the first microprocessor and the second microprocessor without interruption, the second signal conductor is directly connected with the first microprocessor and the second microprocessor. The structural design of the signal conductors within the bus nodes is particularly advantageous. Since the signal conductor does not comprise additional elements, such as safety elements or switches, and can be designed to be very short, its resistance is very small. The signal can be transmitted from the first microprocessor to the second microprocessor with very little power consumption. Accordingly, a less powerful signal amplifier may be employed relative to the aforementioned bus nodes. Such a bus node can be produced very cost-effectively.

In a first embodiment of the test method, the control unit sends a preset signal having a first value to the bus node. In response, the bus node provides a signal having a second value. Subsequently, the control unit identifies whether the second value supplied corresponds to the first value sent. The second value corresponds to the first value if the second value supplied corresponds to the second value expected by the control unit as a response to the first value. If the second value provided can correspond, the test passes. If the second value provided does not correspond to the first value, the test fails.

In addition, the first microprocessor of the bus node reads a preset signal with a first value sent by the control unit and converts the preset signal into a signal inside the bus node, and the signal is transmitted to the second microprocessor by the first microprocessor through the signal conductor. The second microprocessor reads the signal, converts it into a response signal having a second value and provides the response signal to the control unit.

In a preferred first embodiment, the preset signal represents a digital first current value. The first microprocessor reads the current value and converts it into an analog current signal (having a current intensity) that corresponds to the digital first current value of the predetermined signal. The first microprocessor loads the signal conductor with the analog current signal. The second microprocessor measures the current level of the analog current signal and converts the measured current level into a digital signal having a second current value that corresponds to the measured current value. The digital signal is supplied by the second microprocessor to the control unit as a response signal. The control unit identifies whether the second current value can correspond or coincide with the transmitted first current value.

The substitute current value can also be a preset voltage value, a frequency value, an on-time value or an encoded value. Accordingly, the first microprocessor loads the signal conductor with an analog signal comprising the above-mentioned value.

Alternatively, the first microprocessor loads the signal conductor with a digital signal having a code value, which preferably corresponds to the code value of the predetermined signal. The encoded value is read by the second microprocessor and provided to the control unit accordingly. Here, the conversion of the digital signal into an analog signal and back into a digital signal is eliminated in the first or second microprocessor. In this alternative, the encoded value may represent any number or string of numbers.

Preferably, at least two queries are carried out in the test method using two different preset values. The test is considered to be passed if the value of the provided answer signal twice corresponds to two different values of the preset signal.

Preferably, the control unit carries out the method of testing the bus nodes at repeated time intervals. The time interval is determined according to the reliability of the first and second microprocessors employed and is between 1 and 100 seconds.

If the supplied digital signal is negative in its identification or if the test is not passed, measures are taken by the control unit to place the elevator installation in a safe operating state.

In a further embodiment of the test method, the control unit sends a preset signal comprising an error value to the bus node. In this test, the signal provided by the safety element to the second microprocessor (which represents an unsafe state of the elevator installation) is simulated. The control unit expects the bus node under test to transmit a response signal to the control unit autonomously or automatically. A current null, a voltage null, a frequency null, or an on-duration null corresponds to such an error value. By means of one of these zero values, for example a safety element simulating disconnection, it is designed as a safety switch. Likewise, the code value can represent an unsafe state or an error value of the elevator installation.

Here, the control unit transmits a preset signal having an error value to the first microprocessor. The first microprocessor reads the value and loads the signal conductors inside the bus nodes with a signal having an erroneous value. The second microprocessor reads the signal with the error value and autonomously transmits a response signal to the control unit. Here, the signal transmitted by the first microprocessor via the second signal conductor is also an analog or digital signal.

Drawings

The invention is illustrated and explained in detail below with the aid of a number of embodiments and two figures. Wherein the content of the first and second substances,

fig. 1 shows a schematic view of a first embodiment of a monitoring device; and

fig. 2 shows a schematic view of a second embodiment of the monitoring device.

Detailed Description

As already mentioned, the present monitoring device 10 and the present test method are particularly suitable for use in elevator installations.

Fig. 1 shows a first embodiment of a monitoring device 10. The monitoring device 10 has a control unit 11 and at least one bus node 13. The communication between the control unit 11 and the bus node 13 is effected via a bus 12. Data can be transmitted over the bus in both directions between the bus node 13 and the control unit 11. The bus node 13 itself comprises a first microprocessor 14 and a second microprocessor 15. The first microprocessor 14 or the second microprocessor 15 is respectively designed such that the first microprocessor receives a first predetermined signal from the control unit 11 and the second microprocessor provides status information as a response signal to the control unit 11. The bus node 13 is also connected to the safety element 16 via signal conductors 17.1, 17.2 outside the bus node, a first part 17.1 of the signal conductors outside the bus node connecting the first microprocessor 14 to the safety element 16 and a second part 17.2 of the signal conductors outside the bus node connecting the safety element 16 to the second microprocessor 15. Finally, the first microprocessor 14 and the second microprocessor 15 are connected to one another without interruption via a signal conductor 18 within the bus node.

The control unit 11, the bus 12 and the at least one bus node 13 form a bus system. Within the bus system, each bus node 13 has its own, unambiguous address. By means of which the message set-up between the control unit 11 and the bus node 13 is achieved.

The control unit 11 outputs a digital preset signal to the first microprocessor 14 through the bus 12. The control unit here addresses certain bus nodes 13 and signals a predetermined signal to the first microprocessor 14. The first microprocessor 14 receives the predetermined signal and accordingly generates the predetermined signal as an analog signal, which is applied to the signal conductors 17.1, 17.2 outside the bus node. The analog signal may be a certain voltage, amperage, frequency, or on-time duration value.

The security element 16 displays the status of the element that is important in security. For example, the safety element 16 is used as a door contact, a latch contact, a buffer contact, a gate contact (klappinkakt), a travel switch or an emergency brake switch. The safety element 16 is designed as a safety switch, for example, in such a way that a closed safety element 16 represents a safe state and an open safety element 16 represents a potentially dangerous state of the elevator installation.

When the safety element 16 is closed, the second microprocessor 15 measures the analog signal arriving via the signal conductor 17.2 outside the bus node behind the safety element 16. After the measurement, the second microprocessor 15 converts the measured analog signal into a digital signal. Finally, the second microprocessor 15 provides the digital signal to the control unit 11.

The safety element 16 monitors the state of, for example, a car door or a shaft door. In the open state of one of the doors, the safety element 16 likewise remains open and thus indicates a potentially dangerous state of the elevator installation. Here, the signal conductors 17.1, 17.2 outside the bus node are interrupted. As described above, the second microprocessor 15 measures the analog signal arriving behind the security element 16. When the safety element 16 is switched off, this analog signal can no longer be detected by the second microprocessor 15. The second microprocessor 15 measures in this case an analog signal with an error value of zero. Depending on the type of analog signal, there is an error current with a current value of 0mA, an error voltage with a voltage value of 0mV, an error frequency with a frequency value of 0Hz, or an error on-duration value with an on-duration value of 0%. Now, if an error value is detected by the second microprocessor 15, the second microprocessor 15 autonomously sends a digital signal to the control unit 11 via the bus 12 based on the detected error value.

By means of the unambiguous address of the bus node 13, the control unit 11 is able to locate the error precisely. If necessary, the control unit 11 takes measures to remove the fault or to place the elevator installation in a safe operating mode. These operating modes mainly include maintaining the remaining availability of the elevator in a safe driving area of the elevator car, evacuating trapped passengers, emergency braking or finally alerting maintenance and service personnel to rescue trapped passengers and/or to eliminate errors that cannot be relieved by the control unit.

The safe operation of the bus node 13 is mainly dependent on the operational capabilities of the first microprocessor 14 and the second microprocessor 15. In particular, it must be ensured that the following steps are carried out by the first and second microprocessors 14, 15 without error: the predetermined signal is converted into an analog signal in the first microprocessor 14, the analog signal is measured in the second microprocessor 15, a response signal is provided by the second microprocessor 15 and the second microprocessor 15 reacts spontaneously when an analog signal with an error value is measured.

In a first test, the functional behavior of the bus node 13 in terms of the conversion of the default signal during normal operation is checked. Here, the control unit 11 sends a preset signal in digital form with a current value, a voltage value, a frequency value or an on-duration value to the selected bus node 13 by means of data of the address of the bus node 13. The preset signal is refreshed at certain time intervals, i.e. the control unit 11 sends a preset signal with a new value of current, voltage, frequency or on-time duration to the bus node 13. Preferably the new value is different from the previous value. During such time intervals, the first microprocessor 14 generates a corresponding analog signal according to a predetermined signal. The first microprocessor 14 loads the analog signal onto a signal conductor 18 external to the bus node. The second microprocessor 15 measures the analog signal and provides the measured value as a digital response signal. During the period of this time interval, the control unit 11 addresses the second microprocessor 15 of the bus node 13 and obtains data by means of a read function as the value of the current, voltage, frequency or on-time duration provided as a digital response signal.

The time interval between such preset interrogation cycles can in principle be freely adjusted and depends primarily on the reliability of the bus node components. Preferably, the time interval lasts a few seconds. In the case of higher reliability, the time interval can also be adjusted to 100 seconds or more.

The control unit 11 carries out the test method with all bus nodes 13 row by row and detects its resonance (Resonanz). In other words, the digital preset signal and the digital response signal provided by each second microprocessor 15 are identified by the control unit 11 and correspond to the control unit 11. If the preset signal can correspond to the digital answer signal provided, the control unit 11 recognizes that the first microprocessor 14 and the second microprocessor 15 are operating correctly when converting the preset signal in normal operation.

In a second test, an open security element 16 is simulated. The control unit 11 simulates an open safety element 16 in that a predetermined signal with an error value of 0mA, 0mV, 0Hz or 0% is predetermined for a specific bus node 13. The digital preset signal with the error value is converted by the first microprocessor 14 into an analog signal with the error value. In a next step, the analog signal is applied by the first microprocessor 14 to the signal conductor 18 inside the bus node. The second microprocessor 15 measures the analog signal and autonomously informs the control unit 11 in the barrier-free operating mode. This test ensures that, with a positive result output, each opening of the safety element 16 results in the digital response signal of the bus node 13 being transmitted to the control unit 11 autonomously.

This second test is carried out repeatedly in time for each bus node 13. The test time is dependent as much as possible on the speed of the data transmission via the bus 12 and is typically 50-100 milliseconds. The frequency of the zero preset test is mainly determined by the reliability of the second microprocessor 15 employed. The more reliable the second microprocessor 15, the lower the frequency of the test, whereby the safe operation of the elevator can be ensured.

The preset value test with the wrong value is usually performed at least once a day. But the test can also be performed in the order of minutes or hours.

Fig. 2 shows a second embodiment of the monitoring device 10. The monitoring device 10 likewise comprises a control unit 11, at least one bus node 13 and a bus 12, which connects the control unit 11 to the bus node 13. The bus node 13, like in the first embodiment of fig. 1, has a first microprocessor 14 and a second microprocessor 15, which are connected to one another without interruption via a signal conductor 18 within the bus node.

In contrast to the first exemplary embodiment, the contactless security elements 16.1, 16.2 are connected to the second microprocessor 15 via a signal conductor 17 outside the bus node. The contactless security elements 16.1, 16.2 here comprise, for example, an RFID tag 16.2 and an RFID reader unit 16.1. The RFID tag 16.2 and the RFID reader unit 16.1 each have an induction coil. The induction coil on the side of the RFID reading unit is supplied with electrical energy and excites the induction coil on the side of the RFID tag when less than a certain distance apart. Here, the RFID tag 16.2 transmits the digital code value to the RFID reader unit 16.1 via two induction coils. The RFID reading unit 16.1 reads the digital code value and converts it into an analog signal with the same code value. Correspondingly, the RFID read unit 16.1 loads the analog signal for the signal conductor 17 outside the bus node. The second microprocessor 15 measures the analog signal and converts it into a digital response signal with the code value and supplies it to the control unit 11.

The contactless safety elements 16.1, 16.2 monitor the state of, for example, car doors or shaft doors. As long as such a door is closed, the distance between the RFID tag 16.2 and the RFID reading unit 16.1 is kept sufficiently small to enable the transmission of a digital code value. Accordingly, the second microprocessor 15 supplies the control unit 11 with a digital signal having the read-out encoded value of the RFID tag 16.2. Conversely, when the door is open (which represents a potentially unsafe state of the elevator installation), the transmission of the code value to the RFID reading unit 16.1 is interrupted. The RFID reading unit 16.1 reads no encoded value or no error value. Accordingly, the second microprocessor 15 also measures a signal with an erroneous value. In this case, the second microprocessor 15 autonomously transmits the digital signal to the control unit 11.

In this second embodiment of the monitoring device 10, the reliable operability of the bus node 13 is also checked by means of a second test.

In the first test, the control unit 11 sends a digital preset signal with a first code value to the first microprocessor 14. The first microprocessor 14 converts the predetermined signal into an analog signal having the encoded value and loads it onto a signal conductor 18 inside the bus node. The second microprocessor 15 measures the analog signal and converts it into a digital answer signal with the measured code value. Finally, the second microprocessor 15 provides the digital answer signal to the control unit 11. The control unit 11 discriminates whether the code value of the answer signal matches the code value of the preset signal. The test is considered to pass if the coded value of the answer signal can correspond to the coded value of the preset signal. Preferably the encoded value of the preset signal is different from the encoded value of the RFID tag 16.2.

The second test involves a simulation of the error value and a corresponding spontaneous reaction of the second microprocessor 15. Here, the control unit 11 sends a digital preset signal with an error value to the first microprocessor 14. The first microprocessor 14 converts the predetermined signal into an analog signal having an error value and loads the signal conductor 18 inside the bus node with the analog signal. The second microprocessor 15 measures the analog signal with the error value and autonomously transmits a digital response signal to the control unit 11. The second test is ended with a positive result when the control unit 11 identifies the expected spontaneous response of the second microprocessor 15.

The time interval during which the control unit 11 sends the preset signal to the bus node 13 for the test can be adjusted in accordance with the first embodiment of the monitoring device 10.

The two test methods of the second embodiment of the monitoring device 10 are likewise carried out by the control unit 11 for each bus node 13.

In a particularly preferred alternative, the signal conductors 18 within the bus nodes are each supplied with a digital signal in both embodiments of the monitoring device 10, which digital signal corresponds to different values of the preset signal.

Claims (12)

1. A test method for an elevator installation having a control unit (11) and at least one bus node (13) with a first microprocessor (14) and a second microprocessor (15), wherein the control unit (11) and the bus node (13) communicate via a bus (12) and the first microprocessor (14) and the second microprocessor (15) are connected without interruption via a signal conductor (18); the test method comprises the following steps: -transmitting a preset signal by said control unit (11) to said first microprocessor (14); -said first microprocessor (14) passes said signal to said second microprocessor (15) through said signal conductor (18); -said second microprocessor (15) providing a signal to said control unit (11); and the control unit (11) identifies whether the supplied signal corresponds to a signal expected by the control unit (11).

2. A test method according to claim 1, wherein the control unit (11) interrogates the signal provided by the second microprocessor (15) at time intervals.

3. The test method of claim 2, wherein the time interval is adjusted between 1-100 seconds.

4. A test method according to any one of claims 1-3, in which, on the basis of the signal provided, a discrimination is made by the control unit (11) that is negative in result, in order to place the elevator installation in a safe operating state.

5. A test method according to any one of claims 1-3, wherein the preset signal represents a voltage value, a current value, a frequency value, an on-time value or an encoding value.

6. A test method according to any one of claims 1-3, wherein the signal transferred by the first microprocessor (14) to the second microprocessor (15) is transferred via a direct signal conductor (18).

7. A test method according to any one of claims 1-3, wherein the signals transferred by the first microprocessor (14) to the second microprocessor (15) are transferred via signal conductors (18) inside bus nodes.

8. A test method according to any one of claims 1-3, wherein at least two preset signals with different values are sent by the control unit (11) to the first microprocessor (14) and the control unit (11) discriminates whether the signal respectively provided by the second microprocessor (15) corresponds to the signal expected by the control unit (11).

9. A test method according to any one of claims 1-3, wherein a preset signal with an error value is sent by the control unit (11) to the first microprocessor (14) and the control unit (11) discriminates whether the second microprocessor (15) autonomously delivers a signal to the control unit (11).

10. A monitoring device (10) designed for carrying out a test method according to one of claims 1 to 9, having a control unit (11) and at least one bus node (13) having a first microprocessor (14) and a second microprocessor (15), wherein the control unit (11) and the bus node (13) communicate via a bus (12) and the first microprocessor (14) and the second microprocessor (15) are connected without interruption via a signal conductor (18).

11. The monitoring device (10) of claim 10, wherein the signal conductor (18) directly connects the first microprocessor (14) and the second microprocessor (15).

12. The monitoring device (10) according to claim 10 or 11, wherein the signal conductor (18) is arranged inside a bus node.