SAFETY CIRCUIT OF AN ELEVATOR, AND METHOD FOR IDENTIFYING
A FUNCTIONAL NONCONFORMANCE OF A SAFETY CIRCUIT OF AN
ELEVATOR
Field of the invention
The invention relates to the identification of a functional nonconformance in the safety
circuit of an elevator.
Background of the invention
The design instructions and design regulations concerning the safety circuits of an
elevator are changing, especially as a result of developments in microprocessor
technology and software technology. As a consequence of new design instructions and
design regulations, the safety circuits of an elevator can be designed based on
microprocessor control and on data bus architecture. A number of sensors measuring
the operation of an elevator, for example, can be connected to the same data bus, and
the operation of the elevator can be monitored with a separate electronic supervision
unit connected to the data bus.
The purpose of the safety circuit of an elevator is to ensure the safe operation of the
elevator system in all operating situations. In this connection also a high, generally at
least SIL 2 - or SIL 3 - safety integrity level, is required of microprocessor-controlled
supervision units, data buses, sensors, et cetera. For achieving an adequate safety
level, devices and data buses must often be duplicated; duplication, on the other hand,
increases the amount of components, circuits and wiring needed.
As circuits and wiring increase, the risk of a connection error or of a wiring error, or of
connection of the wrong voltage to the signal conductors of a data bus, et cetera, also
increases. The operating voltage for devices to be connected to a data transfer bus is
also often carried in the same cable as the signal conductors. A breakage of the
insulation of a conductor might cause a short-circuit or the connection of operating
voltage to a signal conductor.
Therefore the safety circuit of an elevator must designed to be fail-safe such that the
elevator is always removed from use in a fault situation of the safety circuit.
Consequently it would be necessary to ensure that fault situations are identified and
located as soon as possible in an early stage, at best already in connection with the
installation of the elevator, in which case any fault situation will cause as little harm as
possible to operation of the elevator.
Aim of the invention
The aim of the invention is to improve the diagnostics of the safety circuit of an
elevator. To achieve this aim the invention discloses a method according to claim 1
and also a safety circuit of an elevator according to claim 9. The preferred
embodiments of the invention are described in the dependent claims. Some inventive
embodiments and inventive combinations of the various embodiments are also
presented in the descriptive section and in the drawings of the present application.
Summary of the invention
In the method according to the invention a message is formed in node A, and a testing
field is added to the message for testing the operation of the safety circuit of an
elevator. The message containing the aforementioned testing field is sent from node A
to the communications bus in the safety circuit of the elevator. In a preferred
embodiment of the invention the aforementioned message containing a testing field is
received in node B from the communications bus in the safety circuit of the elevator,
and a functional nonconformance of the safety circuit of the elevator is identified in
node B on the basis of the testing field received. In a preferred embodiment of the
invention a connection error and/or wiring error of node B is in this case identified on
the basis of the testing field received. In the most preferred embodiment of the
invention an incorrect polarity of the communications bus is in this case identified as a
connection error of node B.
In a preferred embodiment of the invention a signal is formed in node B for indicating
a functional nonconformance of the safety circuit of an elevator. The aforementioned
functional nonconformance of the safety circuit of the elevator is in this case
preferably a connection error and/or wiring error of node B. In one embodiment of the
invention with the signal formed the means in node B are controlled to indicate a
functional nonconformance of the elevator. In one embodiment of the invention the
signal formed is sent via a communications bus to a second node connected to the
communications bus for indicating a functional nonconformance.
In one embodiment of the invention one or more references of a testing field are
recorded in the memory of node B for identifying a functional nonconformance of the
safety circuit of the elevator, the testing field received is compared to the
aforementioned one or more references of a testing field that are recorded in the
memory of node B and a functional nonconformance of the safety circuit of the
elevator is identified on the basis of a comparison of the testing field received and the
one or more references of a testing field that are recorded in the memory.
In one embodiment information about the degree of severity of the functional
nonconformance indicated by the reference in question is connected in connection
with one or more references of the testing field in the memory of node B and also a
signal is formed in node B, which signal indicates the greatest in degree of its severity
of the detected simultaneous functional nonconformances of the safety circuit. In this
way, in addition to locating a fault, also the operating condition of the safety circuit of
an elevator can be better diagnosed.
The safety circuit of an elevator according to the invention comprises a
communications bus, nodes connected to the communications bus and also sensors
and/or actuators relating to the functionality of the safety circuit, said sensors being
connected to the nodes. One or more of the aforementioned nodes connected to the
communications bus comprises a microprocessor and also a memory, in which a
program to be executed is stored. The aforementioned microprocessor is configured to
perform any of the methods according to what is disclosed above for identifying a
functional nonconformance of the safety circuit of an elevator. In a preferred
embodiment of the invention the safety circuit comprises at least two nodes, the nodes
A and B. Node A is preferably an electronic supervision unit of the safety circuit of the
elevator, which supervision unit is configured to determine the operating status of the
elevator on the basis of measuring data received from the other nodes connected to the
communications bus, and which electronic supervision unit is configured, when it
detects a functional nonconformance of the elevator, to activate the machinery brake,
to disconnect the electricity supply to the elevator motor and also to prevent the
starting of the next run of the elevator.
The aforementioned communications bus is preferably a serial interface bus. In the
most preferred embodiment of the invention the signal to be transferred in the
communications bus is a differential signal, and the node B is configured to identify
the incorrect polarity of the differential signal connected to the node B on the basis of
the testing field received.
The aforementioned node B preferably comprises means for indicating a functional
nonconformance of the elevator. In one embodiment the means for indicating a
functional nonconformance of the elevator comprise a LED component in the node B,
which LED component is controlled with a microprocessor in the node B with a pulselike
control signal, the frequency, duration and frequency of occurrence of which pulse
is selected such that the flashing of the LED component gives visual information about
the type of, and/or degree of severity of, the functional nonconformance detected.
In one embodiment of the invention information about a detected functional
nonconformance of the safety circuit of an elevator is sent to a service center via a data
transfer link. In this way the diagnostics of the elevator can be improved, more
particularly relating to the remote monitoring/remote operation of the elevator. The
aforementioned data transfer link can be e.g. an Internet connection or corresponding
wireline connection; the data transfer link can also be implemented wirelessly, e.g.
with a GSM connection or with a corresponding data transfer connection based on
electromagnetic radiation.
By means of the invention, a functional nonconformance of the safety circuit of an
elevator, more particularly a wiring error/connection error of the communications bus,
can be reliably identified. In addition, by means of the invention the occurrence
location of a fault can be located quickly and accurately and the located occurrence
location can also be indicated to the serviceman repairing the fault or it can be sent to
a service center. All this improves the diagnostics of a safety circuit of an elevator and,
on the other hand, enables the repair of a fault as quickly as possible such that any
harm caused by the fault and relating to operation of the elevator is the minimum
possible.
The aforementioned summary, as well as the additional features and advantages of the
invention presented below, will be better understood by the aid of the following
description of some embodiments, said description not limiting the scope of
application of the invention.
Brief explanation of the figures
Fig. 1 illustrates one message structure according to the invention
Fig. 2 presents as a block diagram one safety circuit of an elevator according to
the invention
Fig. 3 illustrates some testing field references according to the invention
More detailed description of preferred embodiments of the invention
According to Fig. 2, the safety circuit of the elevator comprises nodes A,B,C, which
are connected to a communications bus 6. The nodes A,B,C communicate with each
other via the communications bus 6. The message 1 in the communications bus 6 is
transferred as a differential mode serial communication signal using two parallel
signal conductors 15A, 15B for the transfer of the signal. For this reason each of the
nodes A, B, C comprises a transmitter/receiver circuit 14A, 14B for the differential
signal, preferably for a RS485 signal and based on asynchronous so-called UART
protocol. The transmitter/receiver circuits 14A, 14B send a differential signal to the
communications bus 6 such that in the parallel signal conductors 15A, 15B the same
signal is sent simultaneously but inverted. When it receives the aforementioned signal
from the communications bus 6, the transmitter/receiver circuit 14A, 14B
correspondingly reads from the differential the difference between the parallel signal
conductors 15A, 15B.
According to Fig. 2, the safety circuit of the elevator is designed to meet the SIL 3
safety level, for which reason the communications bus 6 as well as the nodes A, B, C
to be connected to the communications bus are duplicated in their structure. The
duplicated structure is redundant such that in both differential data transfer channels
15A, 15B of the duplicated communications bus 6 data transfer occurs independently
of the other channel. The nodes A, B, C comprise two microprocessors 13A, 13B as
well as a transmitter/receiver circuit 14A, 14B connected to said microprocessors in
each node. The first transmitter/receiver circuit 14A is connected to the first
differential data transfer channel 15A, 15B and the second transmitter/receiver circuit
14B is connected to the second differential data transfer channel 15A, 15B according
to Fig. 2. The electronic supervision unit of the elevator functions as the node A,
which electronic supervision unit receives data via the communications bus 6 from the
sensors connected to the nodes B, C and controls, if necessary, the safety breaker 12 of
the elevator. The safety breaker 12 is a relay, the contact of which opens when the
electricity supply to the control coil of the relay ceases. The contact of the relay of the
safety breaker 12 is connected to the safety circuit of the elevator such that the
electricity supply to the electromagnet of the machinery brakes of the hoisting machine
(not presented in Fig. 2) of the elevator moving the elevator car ceases and the
machinery brakes activate when the contact of the relay of the safety breaker 12 opens.
In the same connection also the current supply to the electric motor of the hoisting
machine is disconnected. The electronic supervision unit A of the elevator controls the
contact of the relay of the safety breaker 12 open when it detects that the safety of the
elevator is endangered. A varying amount of nodes A, B, C can be connected to the
communications bus 6; one node B can be fitted in connection with the elevator car
(not presented in Fig. 2), preferably on the roof of the elevator car, in which case a
sensor 1 measuring the position of the elevator car in the elevator hoistway as well as
a sensor (not presented in Fig. 2) measuring the position of the door of the elevator car
can be connected to the node B. One node C can be fitted in the elevator hoistway (not
presented in Fig. 2), and sensors (not presented in Fig. 2) determining the limits of the
permitted movement of the elevator car in the proximity of the ends of the elevator
hoistway, sensors 10 determining the position/locking of a landing door, et cetera, can
be fitted to the node. One node can be fitted in the machine room, or in an elevator
system without machine room in the top part (not presented in Fig. 2) of the elevator
hoistway, and e.g. a sensor measuring the operation of the overspeed governor can be
connected to the node. In one embodiment of the invention in the communications bus
6 time shared protocol is used such that the electronic supervision unit A sends to the
nodes B, C via the communications bus 6 a message 1, and each of the nodes B, C
responds to the message 1 within an individual time window. One problem in the
safety circuit of the elevator according to Fig. 2 is the large amount of wiring,
connections and also components needed, owing to which a better solution than prior
art is needed for diagnosing various connection errors/wiring errors.
Fig. 1 illustrates a message structure, which can be used e.g. in the safety circuit of an
elevator according to Fig. 2 for identifying a functional nonconformance of the safety
circuit of the elevator. The message 1 contains a synchronization field 3, on the basis
of which the node receiving the message 1 is synchronized to the message to be
received. In addition, the message 1 contains a checking field 5, such as parity/a
checksum, on the basis of which the receiving node checks the correctness of the
received data in the data field 4. In addition to the aforementioned, or differing from
this, the message 1 can variably contain also other fields, e.g. an address field, with
which the node for which the message 1 to be received is intended is specified; one
possible field is an end field, with which the ending of the message is indicated, et
cetera. In a preferred embodiment of the invention a testing field 2 is added to
beginning of the message 1 for testing the operation of the safety circuit of the
elevator. The following will present how the testing field 2 can be used for identifying
a functional nonconformance of the safety circuit of an elevator.
In a preferred embodiment of the invention the nodes A, B, C send, one at a time, a
message 1 according to Fig. 1 to the communications bus 6, and the nodes in the bus
receive the message from the communications bus 6. The references 9A, 9B, 9C of a
testing field that are presented in Fig. 3 are recorded in the memory circuit of a node
A, B, C for identifying a functional nonconformance of the safety circuit of the
elevator. After it has received the testing field 2 belonging to the message 1, the
microprocessor in a node A, B, C compares the testing field received with the
references of the testing field in the memory and identifies a functional
nonconformance of the safety circuit of the elevator on the basis of a comparison of
the testing field 2 received and the references 9A, 9B, 9C of a testing field that are
recorded in the memory. At its simplest, the testing field is designed such that the
signal level, such as the voltage signal level or current signal level, of the testing field
to be received remains unchanged for the entire duration of the testing field. In a
preferred embodiment of the invention the graph 9A in Fig. 3 presents a reference of a
testing field, when the safety circuit of the elevator is in operating condition. In this
case the signal received by the microprocessor 13A, 13B in a node A, B, C remains in
a logical "1" state for the entire duration of the testing field 2. If the signal received
remains in a logical "0" state for the duration of the testing field 2, as is presented in
the graph 9B in Fig. 3, the signal conductors connected to the transmitter/receiver
circuit 14A, 14B of a node A, B, C are crossed. The graph 9C of Fig. 3 presents a
situation in which it has been forgotten to connect the signal conductors 15A, 15B to a
node A, B, C. In this case the rest of the message 1, as well as the testing field 2,
remains in a logical "1" state.
A message 1 can also comprise more than one testing field 2. In addition, a pulse
pattern of the testing field 2, and consequently also the references of the testing field,
can differ from what is described above. The pulse pattern/references of a testing field
2 can also be different in each node A, B, C and in both data transfer channels 15A,
15B, in which case by comparing a testing field 2 and the references of the testing
field a possible wiring error/connection error between the different nodes and data
transfer channels can be deduced.
The microprocessor in a node A, B, C controls the LEDs 8 with control pulses, the
duration and frequency of occurrence of which can determine which type of fault is in
question. A node A, B, C comprises its own LEDs 8 / microprocessor 13A, 13B for
the diagnostics of both data transfer channels 15A, 15B, so that the faulty data transfer
channel 1 A, 15B can be located on the basis of a flashing LED.
In a preferred embodiment of the invention information about the degree of severity of
the functional nonconformance indicated by the reference 9A, 9B, 9C in question is
recorded in connection with the references 9A, 9B, 9C of a testing field. For example,
in Fig. 3 the degree of severity of the fault indicated by the reference 9C can be
determined to be larger than the degree of severity of the fault indicated by the
reference 9B. In this case, if the testing field/testing fields in a node A, B, C
simultaneously indicate(s) a number of different faults, the control of the LED is
selected in the node in question always to indicate the greatest fault in terms of its
degree of severity.
In the invention the means for indicating a functional nonconformance can comprise,
in addition to or instead of LEDs, e.g. a loudspeaker, in which case a functional
nonconformance can be indicated as an acoustic signal; the aforementioned means can
also comprise a display, in which case a functional nonconformance can be indicated
e.g. in symbols, in numbers or in text format.
In the preceding embodiments the invention is described in connection with the safety
circuit of an elevator; however, the invention is also suited for use e.g. in the
diagnostics of the safety circuits of an escalator and of a travelator.
The invention is described above by the aid of a few examples of its embodiment. It is
obvious to the person skilled in the art that the invention is not only limited to the
embodiments described above, but that many other applications are possible within the
scope of the inventive concept defined by the claims.
Claims
1. Method, in which:
a message (1) is formed in node A
c h a r a c t e r i z e d in that :
- a testing field (2) is added to the message (1) for testing the operation
of the safety circuit of an elevator
the message (1) containing the aforementioned testing field (2) is sent
from node A to the communications bus (6) in the safety circuit of the
elevator
2. Method according to claim 1, characterized in that:
the message (1) containing the aforementioned testing field (2) is
received in node B from the communications bus (6)
a functional nonconformance of the safety circuit of the elevator is
identified on the basis of the testing field (2) received
3. Method according to claim 2, characterized in that:
a connection error and/or wiring error of node B is identified on the
basis of the testing field (2) received
4. Method according to any of claims 1 - 3, characterized in that:
a signal (7) is formed for indicating a functional nonconformance of the
safety circuit of the elevator
5. Method according to any of claims 2 - 4, characterized in that:
- one or more references (9A, 9B, 9C) of a testing field are recorded in
the memory of node B for identifying a functional nonconformance of
the safety circuit of the elevator
6. Method according to claim 5, characterized in that:
- the testing field (2) received is compared to the aforementioned one or
more references (9A, 9B, 9C) of a testing field that are recorded in the
memory of node B
- a functional nonconformance of the safety circuit of the elevator is
identified on the basis of a comparison of the testing field (2) received
and the one or more references (9A, 9B, 9C) of a testing field that are
recorded in the memory
7. Method according to claim 5 or 6, characterized in that:
- information about the degree of severity of the functional
nonconformance indicated by the reference (9A, 9B, 9C) in question is
connected in connection with one or more references (9A, 9B, 9C) of
the testing field in the memory of node B
8. Method according to claim 7, characterized in that:
- a signal is formed in node B, which indicates the greatest in degree of
severity of the detected functional nonconformances of the safety
circuit
9. Safety circuit of an elevator, comprising:
a communications bus (6);
nodes (A,B,C) connected to the communications bus (6);
sensors and/or actuators (10, 11, 12), relating to the functionality of the
safety circuit, further connected to the nodes (A, B, C);
c h a r a c t e r i z e d in that one or more of the aforementioned nodes (A, B, C)
connected to the communications bus comprises a microprocessor (13A, 13B) and
also a memory, in which a program to be executed is stored;
and in that the aforementioned microprocessor (13A,13B) is configured to
perform any of the methods according to claims 1 - 8 for identifying a functional
nonconformance of the safety circuit of the elevator.
10. Safety circuit according to claim 9, characterized in that the safety circuit
comprises at least two nodes, A and B.
11. Safety circuit according to claim 9 or 10, characterized in that the
communications bus (6) is a serial interface bus.
12. Safety circuit according to any of claims 9 - 11, characterized in that a node
(A,B,C) comprises means (8) for indicating a functional nonconformance of the
elevator.