• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    method for restoration of elevator installation security system. The present invention relates to a method for restoring a security system (10) of an elevator installation (1) from a real state (51, 61), in which the normal operation of the installation is not released. of elevators (1), to a theoretical state (57, 72), in which a normal operation of the installation of elevators (1) is released by the security system (10). the method comprises the following steps: receiving a restoration query (52, 62), through the control system, to restore the real state (51, 61) to the theoretical state (57, 72) in the security system ( 10); performing a check of the restore lookup by the security system (10); evaluation of the verification by the security system (10), restoration of the security system (10) from the real state (51, 61) to the theoretical state (57, 72) when the verification by the security system (10) is considered valid.
    公开号:BR112015006484B1
    申请号:R112015006484-1
    申请日:2013-09-19
    公开日:2021-06-22
    发明作者:Ivo Lustenberger
    申请人:Inventio Ag；
    IPC主号:
    专利说明:

    [001] The present invention relates to a method for restoring a security system of an elevator installation from a real state to a target state, especially in a standard state, in which a normal operation of the elevator installation is released by the security system as well as an elevator installation according to the invention.
    [002] Elevator installations feature a security system to ensure sufficient service safety. The requirements are determined by different standards and ordinances. Usually, these security systems are configured largely independent, being superimposed on the other elevator systems. The safety system may have an influence on the installation of elevators and therefore may come into contact, for example, with the drive or the braking unit of the elevator installation. If sufficient security of services is not ensured, the displacement service will be interrupted.
    [003] A safety system of this type can be configured as a safety circuit in which several safety elements such as safety contacts and safety switches are integrated in a serial circuit. The contacts control, for example, whether a pit door or cabin door is open. The elevator cabin can only be moved when the safety circuit and with it all other safety contacts integrated with it are closed. Some of the security elements are activated by the doors. Other safety elements such as a switch such as a bridge switch are activated or released by the elevator car. The safety circuit stops traveling if the safety circuit is opened.
    [004] Safety systems with safety circuits of this type have several disadvantages such as, for example, inherent problems of a voltage drop in the safety circuit, as well as a relatively high incidence of failures. Furthermore, the safety circuit does not allow a specific diagnosis, because with the safety circuit open it will only be verified that at least one safety contact is open.
    [005] Therefore, it was proposed to equip the elevator installations, instead with the mentioned safety circuit, with a safety bus system. The safety bus system typically features a control unit, a safety BUS and one or several bus nodes. Different safety elements such as door contacts, bolt contacts or damper contacts will be consulted via the bus nodes If a message from the safety elements does not correspond to a target quantity, the safety system can influence the control of the elevator installation and, for example, induce an emergency shutdown. In this case, the security system may reach an exception state in which an operation of the elevator installation, for example, is blocked or is only possible to a limited extent. Typical exceptional states comprise, for example, a safety shutdown, for example, as a result of a speed change of the elevator car or an unclosed door or a maintenance state, in which only maintenance shifts are possible. A security system of this kind is described, for example, in WO 03/024856 A.
    [006] When the security system reaches a state of exception, it will be necessary to restore the security system to a normal state, in which the normal operation of the elevator installation is released. Often, after a successful test of the elevator installation by a service specialist, the safety system will be restored ("reset") to its normal state. The restoration can in this case be verified directly at an access point of the security system. This can, for example, be arranged in a closed maintenance compartment in order to ensure that only an authorized person can release the restoration. With this form, the security system is often difficult to access and restoration can take time and may not be comfortable, for example, for the technician. A restoration in certain cases could also be carried out automatically by an elevator control. However, in this case, the necessary degree of security for a restoration would not be guaranteed because elevator control, as a less secure system, is subordinated to the security system in a security hierarchy.
    [007] It is, therefore, the object of the invention to offer a method as well as an elevator installation with a security system that enable a more efficient operation and safety of the elevator installation. It is also an object of the invention to offer a method as well as an installation of elevators with a security system that enables a comfortable and simple restoration of the security system with sufficient security, for example, against misuse, vandalism, faulty control or faulty functions.
    [008] These tasks will be solved by the characteristics of the invention. The invention relates to the method for restoring a security system of an elevator installation from a real state, especially from a state in which normal operation of the elevator installation is not released, to a target state, especially in a standard state. , in which the normal operation of the installation of elevators is released by the security system, and the security system is linked at least through a communication interface for data exchange with a control system allocated to the elevator system, system this one, which is not especially part of the security system. The method comprises the following steps: - receiving a message transmitted from the control system for restoring the first state to the target state in the security system; - carrying out a verification of the restoration message through the security system; - evaluation of verification by the security system; - restoration of the security system from the real state to the target state when the verification is considered valid by the security system.
    [009] It is ensured through this method that the restoration of the security system is an act of a controlled procedure, verifying itself in a safe way. In particular, the restoration of the security system by unauthorized personnel or by a faulty function, for example by a randomly generated message, can be excluded. Correspondingly, the method ensures that at the start of normal operation of the elevator installation, the security system starts to operate reliably.
    [0010] The real state designation designates a momentary state of the security system, from which it shall be restored to the target state with the transmitted query. The real state is typically an exception state, in which normal operation of the elevator installation is not released. The actual state can, for example, be a state in which the safety system, for example, is in a faulty function or maintenance of the elevator installation.
    [0011] The target state designates a state to which the security system shall pass by virtue of a reset message. Especially the target state is a default state in which normal operation of the elevator installation is enabled. In this case, a check of the restore query is especially essential to ensure safety during normal operation. It is understood that, according to needs, the real state can also be a default state and the target state can be an exception state. Especially, the target state, for example, can also be a hold state, in which only hold shifts are possible.
    [0012] The control system can comprise both internal components, belonging to the installation of elevators, as it can comprise external components. Internal components can be, for example, elevator installation control units installed at fixed or mobile points. Especially the control system can, for example, comprise parts of an elevator installation control. Mobile control units such as portable maintenance or diagnostic devices or mobile phones can be coupled or can be coupled via an internal wired or cable-free network. According to need the control units can comprise, for example, means for reading or representing data such as, for example, a display and/or means for recording data such as, for example, a keyboard or a touch screen.
    [0013] External components of the control system can, for example, be connected via an external network, possibly public. For example, a mobile phone that is linked via a mobile phone network to the control system, or a computer that is linked via the internet can be part of the control system. For this purpose, the control system may have an interface unit for coupling to the corresponding external network.
    [0014] At least one communication interface can, for example, comprise a communication bus via a cable (eg BUS-CAN "Controller Area Network"). In the same way, the communication interface can also comprise an internal wireless network, belonging to the elevator installation (for example, WLAN network "Wireless Local Area Network") or a coupling to an external network without cable, public or cable supported. It is understood that the control system, that is, its components, through one or several communication interfaces can be coupled to the security system.
    [0015] Restore query designates a restore query from the first state to the target state. The transmission of the restoration query to the security system may be initiated by a user or by a system of the elevator installation (generally referred to hereafter with the expression "releaser"). When transmitting the restoration query, additional data may be sent to the security system, for example, the desired target state or possibly data from the releaser. The restoration query may be transmitted to the security system through an internal or external component of the control system.
    [0016] The term "verification" basically designates each type of a confirmation of the validity of the restore query. Advantageously, the verification can also comprise an authentication, in addition to which an authorization or an identity, for example, of the releaser will be verified. Naturally, the restoration of the security system to the target state according to the invention is verified normally also with a valid check only when the security system assesses a restoration to the target state as being safe, that is, that the target state is admitted by the security system. In certain embodiments it may be advantageous for the verification of the restoration query to be carried out by the security system only when the target state is assessed as being safe. Otherwise, the security system, by virtue of the restoration query, may, for example, release an alarm signal.
    [0017] Based on the verification according to the invention it can be ensured that the restoration cannot be released by the fault function of an elevator system, inadvertently by a user or intentionally by unauthorized persons. Therefore, the control system could also be part of an unsafe elevator installation system, that is, a system that is hierarchically subordinate to the security system and therefore does not need to be part of the security system. In the case of a mobile control unit that is carried by the user, the coupling to the security system according to the invention even takes place via an unsecured public network such as, for example, a mobile phone network.
    [0018] Performing the verification may comprise reading a verification code that is transmitted directly with the reset question to the security system. The verification code may, in this case, be generated by the releaser of the restoration query before, that is, during the transmission of the restoration query message. To verify the restoration query the security system may compare the verification code, for example, with a target verification code, memorized or generated by the security system. For example, the verification code at the time of release, that is, upon reception of the restoration query, can be removed, for example, from a list of stripes from a memorized list. These systems may require, for example, with a manual selection from a printed list or may be implemented electronically on Dongles chip cards or other mobile release devices that can be coupled to the control system, for example, in an interface of a control unit.
    [0019] It is also imaginable temporally synchronized systems that in the releaser as well as in the security system generate verification codes that are valid only within restricted synchronized temporal windows. Verification codes, however, may also comprise a simple personal identification number (PIN) or other static codes that are known only to an authorized releaser. user who is registered for the purpose of releasing the restore query, being transmitted with the restore query in an encoded form. For the specialist, other possibilities for verification are directly opened up in the transmission of the restoration consultation.
    [0020] Alternatively, the verification is verified as an example of a question/answer verification, in which a verification query is transmitted directly or indirectly to a system or to a user (hereinafter referred to as a whole with " recipient"), which needs to confirm, for example, the query with a verification response. Especially performing the verification comprises transmitting a verification query, especially a query code, from the security system to the control system in view of the received restoration query, as well as comprising receiving a verification response transmitted by the system control, especially a response code, in the security system.
    [0021] The verification query can be a simple signal from the security system, for example, turning on a button on a keyboard of a control system that needs to be pressed by a user, for example, to confirm the answer of verification. Preferably the verification question comprises, for the purpose of greater security, a question code and/or the verification answer comprises an answer code. The question code and/or the answer code, according to the requirements, can have different degrees of complexity and, for example, comprising a sequence of alphanumeric or binary signals. In the same way the question code and/or the answer code can also comprise an illustrated representation, such as for example symbols or a slash or a double matrix code. Question codes and answer codes can be identical in that, for example, the answer code transmitted by the security system up to the verification word will be transmitted by the recipient in an identical manner to the security system. The question code and the answer code are preferably such that the correct answer code can only be transmitted to the security system with knowledge of the question code.
    [0022] As response codes, for example, verification responses independent of the verification query can also be used, such as, for example, an authentication by a coded fingerprint or a scan of the iris of a user.
    [0023] It is understood that the recipient of the verification question and the releaser need to be mutually different, that is, the verification question need not be directed to the releaser of the restoration inquiry. The reset query can, for example, be transmitted by a fixed control unit of the control system to the security system (releaser) while the verification question will be transmitted (receiver) to a mobile control device of the control system which is transported by an operator. Other variants present themselves directly.
    [0024] Preferably the verification assessment comprises for a comparison of the verification response with a target verification response, as well as an evaluation of the verification as being valid when the verification response matches the target verification response. If the verification response comprises a response code, the target verification response preferably comprises a target response code.
    [0025] The security system check query for each new, specially randomly generated restore question will be preferred.
    [0026] In this way, they differ reciprocally from verification queries in relation to sequential restoration questions. It can be avoided in this way that, for example, in case of a fast sequence of restore queries, a check will be allocated the wrong restore query.
    [0027] If the verification query, especially the question code, at any given time, is generated, it can serve as a basis to generate a conventional random generator. These random generators can be implemented in hardware or software within the security system. In variants, the query code may also be based on other factors such as the effective date and time. In the same way, the verification query as well as a verification response target for generation can be extracted from a list of traits of a memorized list of a security system. In this case, a list of corresponding dashes with answer codes may be stored in the recipient of the verification question. These dash lists can, for example, be renewed at maintenance with a firmware update.
    [0028] To additionally increase the degree of security, advantageously the verification query for each restoration query is differentiated. This ensures that the verification query for the restoration query is unambiguously defined.
    [0029] Preferably, for each verification query precisely a target verification response is allocated. In this case, for each restoration query, a clearly defined combination of verification query and verification response, ie target verification response, may be used. It can be ensured in this way that no previously used check questions or check answers, and possibly corresponding question codes or answer codes are present in a system that could result in erroneous or intentionally invalid checks.
    [0030] In the variants one can naturally imagine that, for example, the same verification query has always been used, and an individual target verification response will be determined depending on other factors such as, for example, the effective date and/ or by time.
    [0031] Advantageously, the target verification response will be generated by the security system according to the rule, especially a verification question encoding. In this case the receiver that transmits the response code to the security system will have to use the same rule in order to generate the correct verification response, i.e., the verification response that matches the target verification response. The rule can comprise a simple set of rules that, for example, can be used directly by a user. The rule can, however, also comprise a complex coding that is implemented, for example, electronically.
    [0032] According to usage it may be advantageous to produce the target verification response in the security system only after receiving the verification response from the verification query. This has the advantage that in the time interval between the transmission of the reset question and the verification response, a target verification response is not present in the security system that could be read and/or misdirected. Alternatively, the target verification response could be generated together with the verification query, being memorized in a security system memory at least until transmission of the verification response.
    [0033] Preferably, the control system comprises at least one of the following control units: - a fixed control unit, especially a command or control unit of an elevator command, - a mobile control unit that through the system The control system is coupled, that is, it can be coupled to the security system, preferably the control system comprises a coupling to an internal or external wireless network through which the mobile control unit is coupled or can be coupled.
    [0034] In this case, advantageously - the verification query will be transmitted by the security system to at least one control unit and - the verification response from at least one control unit or another control unit of the control system will be transmitted to the security system.
    [0035] The fixed control unit can be an internal system of the elevator installation, comprising a part of an elevator control such as, for example, a control unit. The control unit can, however, also comprise parts of an external system, that is, it may be provided by an external system. One can imagine, for example, a maintenance system for a facility operator maintenance center, for example, for various elevator installations. If external systems are integrated, at least one communication interface and/or the control system can present an interface for coupling to an external network such as the internet or a mobile phone network. "Fixed" means here either a stationary arrangement, i.e. immovable, or a fixed arrangement on moving components of the elevator installation such as, for example, on a control panel in an elevator car.
    [0036] The fixed control unit may have means to automatically generate the verification response as a result of transmitting a verification query, performing this transmission to the security system. This can be advantageous, for example, in the case of elevator control control units to be able to independently check the restoration query. Fixed control units may also have means for exchanging data with the user and/or attaching a release device (see below). The fixed control unit may, for example, comprise a control unit integrated within an elevator car. The control unit can be installed, for example, with a maintenance unit behind a wall panel or a maintenance window. Furthermore, the control unit may also comprise a freely accessible control panel inside the elevator car. In this case, for example, an already existing display of any mode may be used to present the verification query, while keys of any form already present may be used for manual entry of the verification response. In this way, however already existing components of the elevator installation can be used synergistically.
    [0037] The control unit can, for example, be carried by a user and is configured to be coupled to the security system through the control system or at least through a communication interface. For this purpose, the control system and/or the communication interface can have, for example, a coupling in an internal wireless network such as, for example, a WLAN network or an external network such as, for example, a mobile phone network . The mobile control unit can, however, also be coupled or be coupled to the control system via a plug-in connection to a correspondingly configured interface (eg via another fixed control unit). The mobile control unit may have means for exchanging data with a user or for coupling a release device (see later). The mobile control unit can, for example, be an elevator installation diagnosis or maintenance device, a mobile phone or a tablet (so-called "Tabs" or Pads").
    [0038] Preferably the verification query will be transmitted from the security system to at least one control unit. The verification query can be read there by a user or by a release device coupled to at least one control unit. The transmission of the verification response to the security system need not necessarily be verified from the same control unit, since the system control does not comprise more than one control unit. Especially in this case, global combinations of the aforementioned control units are basically imaginable in order to transmit the security system verification query to the receivers through one of the control units and through another control unit transmitting to the system of security.
    [0039] Advantageously, at least one control unit comprises at least means for reading the verification query and the control unit from which the verification response is transmitted to the security system has at least means for recording the verification response. The verification query will in the case be read through the reading medium and the verification response will be fed through the recording medium. It is understood that in this case only one control unit has both the means for reading and also the means for recording.
    [0040] The means for reading the verification query may in this case comprise a display for the visual presentation of the verification query and on this display, for example, the query code may be shown. The input means can comprise a keyboard through which, for example, the response code can be manually entered. In this case, the verification query can be read by a user who generates the verification response, being registered by the user. It is understood that the verification response can be generated by the user, for example, by an independent external device by entering the verification query. In this case, the verification response can be manually transmitted by the external device to the control unit, from which the verification response will be transmitted to the security system.
    [0041] The means for reading can, however, also comprise an interface, through which the verification code can be read by a releasing device that can be coupled to the interface, that is, that is already coupled. In this case, the interface can also provide a means for inputting the verification response which, for example, is generated automatically by the coupled release device being transmitted to the security system. For that, the releasing device comprises means for generating the verification answer of the verification question which may be implemented, for example, in terms of hardware or software in a circuit or in a programmable computer. These release devices can comprise, for example, chip cards, Dongles, Pen drives or other mobile devices that can be coupled to the interface.
    [0042] According to the type of control unit, at least one control unit may itself have means to generate a verification response from the verification query. These means may comprise, for example, a circuit in which, for example, a standard for generating the verification response or a list of verification responses in terms of hardware or software is implemented. It will be preferred in this case that the verification response is produced by at least one control unit, automatically on receipt of the verification inquiry, being transmitted to the security system. This will be especially advantageous if the control unit is a control unit that can verify the restoration query without interaction by a user. The means for generating the verification response can, however, also advantageously be present in other fixed control units or mobile control units.
    [0043] For security purposes it may additionally be provided that the transmission of the verification response can be initiated by the user and the transmission can be released, for example, only by a coded key or by an additional coded question. It is also imaginable that the verification response will only be generated by virtue of a matching input from the verification query.
    [0044] Preferably, the verification performance will have to take place within a predetermined time interval for it to be judged as correct by the security system. The time interval can be released with the restoration inquiry or only with the transmission of the verification inquiry by the security system. If the predetermined time interval elapses without ending a check, another restore query will normally be required. This will prevent the security system from being in an indefinite waiting state for a longer period of time.
    [0045] The invention also relates to an elevator installation, especially for carrying out a method according to the invention, comprising a security system that from a real state - especially from a state in which normal operation of elevator installation is not released - can be restored to a target state, especially in a normal state, in which normal operation of the elevator installation is released by the security system. In this case, the security system is coupled at least through a communication interface for data exchange in a control system allocated to the installation of elevators, especially a control system that does not belong to the security system. The installation of elevators stands out due to the fact that the security system comprises means for receiving a restoration query, transmitted from the control system, for the restoration of the real state to the target state, as well as means for carrying out a verification of the restoration query through the control system, as well as comprising means to assess the validity of a verification. In this case, the security system is configured in such a way that, due to a verification considered valid, it produces the restoration of the real state to the target state.
    [0046] It immediately follows that the configuration according to the invention of the installation of elevators, for example, by a corresponding programming of programmable control unit of the security system, as well as of the control system, that is, of its - components, may be provided. In this case, any existing components of the elevator installation can be used, for example, a control panel in an elevator cabin, which through conventional communication BUS such as, for example, a Bus-CAN is linked with the security system.
    [0047] Preferably, the means for performing the verification has means for transmitting a verification query to the control system, as well as having means for receiving a verification response from the control system.
    [0048] Advantageously, the security system comprises means to randomly produce a verification response, especially a question code, as well as having means to generate a target verification response, allocated to the verification query, especially a code of target response allocated to the query code according to normal or a target response code allocated to a list. In the case, the means for evaluating a validity of the preference check is configured in such a way that it compares a verification response received by the control system with the target verification response.
    [0049] Preferably, the control system allocated to the installation of elevators comprises at least one, preferably several of the following control units: - a fixed control unit, especially a command unit or a control unit of a command of elevators, - a mobile control unit which through the control system can be coupled or can be coupled to the security system, preferably the control system is an internal wireless network or an interface for coupling to an external endless network through which it is coupled or can be coupled to the mobile control unit.
    [0050] Internal control units are part of the installation of elevators, while external components of the control system although allocated to the installation of elevators, are not covered by them.
    [0051] Preferably, at least one control unit comprises: - means for reading the verification query, especially an interface for coupling another control unit or a mobile release device for reading the verification response or a display for the visual presentation of the verification query and/or - means for inputting the verification response, especially an interface for coupling another control unit, or a mobile release device, for recording the verification response or a keyboard for manual entry of the verification response and/or - means for producing the verification response, especially a circuit or a programmable computer.
    [0052] Any other necessary components or synergistic uses of already existing components of an elevator installation according to the invention result directly from the above description of the method according to the invention.
    [0053] From the subsequent detailed description and the whole of the invention, furthermore, other advantageous embodiments and combinations of features of the invention result.
    [0054] The necessary drawings for the explanation of the execution examples schematically show: Figure 1 a security system and a control system of an elevator installation according to the invention; Figure 2 is a flow diagram of a method according to the invention in which the security system receives a verification code with a reset query; 3 is a flow diagram of a method according to the invention, in which, by virtue of a verification inquiry, a verification response is received by the security system.
    [0055] Basically in the Figures, identical components have identical reference signs.
    [0056] Figure 1 shows (indicated in broken lines) a well 2 of an elevator installation 1. Elevator installation 1 features a security system 10 with a central control unit 11 and a security bus 12. The unit control 11 can be configured as a programmable computer, that is, it can comprise a computer of this kind, with which the realization of the method according to the invention can be provided (see Figure 2 - 3) with the necessary functionality achieved, by example, through a corresponding schedule. Safety Bus 12 can, for example, be implemented as a Controller Area Network (BusCAN). With the safety bus 12, through bus nodes (not shown) different safety systems of the safety system 10 are connected to control the installation of elevators 1. elevator shaft, as well as a bridge spanner 16 is being shown. It is understood that these security elements are chosen merely by way of examples and in practice a variety of other security elements may be coupled in the security system 10.
    [0057] Alternatively, in relation to the Safety Bus 12, the safety elements can be connected in series as door sensors 14, bridge switch 16 or other safety elements, being integrated in a serial way in a safety circuit. Here, the safety circuit is linked with control unit 11. In a solution of this nature, the safety elements are usually not individually controlled. The safety circuit presents the status of all safety elements in a global way. When one of the safety elements follows an unsafe state, for example, in the case of an open pit door 3, the safety circuit will be interrupted and will present an unsafe state of the elevator installation 1.
    [0058] The control unit 11 is connected, for example, with a drive 4 or a brake unit of the elevator installation 1 to stop the displacement. This can be the case, for example, when the safety system 10 - for example, as a result of an erroneous failure message of the safety elements or an interruption of the safety circuit - goes into an exception state. In the present case, the control unit 11 is linked with the drive 4 via a separate line 18. The line can, however, be provided via the safety bus 12.
    [0059] Through a communication interface 19, the control unit 11 is connected with a control system 20 allocated to the installation of elevators 1. The communication interface 19 can be implemented analogously to the safety bus 12 as a BusCAN . The control system 20 comprises parts of the elevator installation 1, but it may also comprise other external components, which should not be added to the elevator installation 1. The control system 20 comprises different control units 21, 22, 23 and 28 which are directly or indirectly, through the intercom face 19, connected with the control unit 11 and therefore with the security system 10.
    [0060] One of the control units shown is configured as a control unit 21 (shown in dashed form) fixedly disposed within an elevator car 9. The control unit 21 features a display 21.1 as well as a keypad 21.2 or, by for example, a touch screen for reading, that is, for data entry by a user. The control unit 21 may also have an interface 21.3 to which a portable device such as a dongle or a portable computer can be coupled. Interface 21.3 can in this case be configured for data entry and/or for reading data from a coupled device. Especially the 21.3 interface can also be configured as a chip card reader.
    [0061] Another of the control units presented is configured as command unit 22 of an elevator control. This unit can be mounted in different places in the elevator installation 1, for example, in the elevator shaft 2, in a maintenance compartment or also, for example, behind a wall panel in the elevator car itself 9. The control unit 22 is a monitoring unit that is basically intended for automatic verification, that is, verification carried out directly by the control unit 22. For this purpose, the control unit may have a corresponding circuit that is provided for the verification, or that is, it is correspondingly programmed. This does not exclude, however, that the control unit 22 may also comprise means for reading and/or means for inputting as well as an interface (shown dashed).
    [0062] Another of the control units shown is configured as mobile control unit 23. This can be, for example, a laptop computer, a special maintenance device or a mobile phone. The mobile control unit 23 can be carried by a user. The control system 20 can present an internal wireless network 24 which is united with the communication interface 19 and, through this, with the security system 10. The mobile control unit 23, with a corresponding configuration with wireless communication means. wire, through the wireless network 24 is coupled to the security system 10, that is, it can be coupled to it. In the mobile control unit 23, instead or in addition, it can also have a coupling 23.1 with which, for example, via interface 21.3 or via a corresponding interface in control system 20, it is coupled, i.e. can be coupled to the communication interface 19.
    [0063] In addition, the control system 20 can present an interface 25 to an external network. Through the interface 25 the control system can be linked, for example, with an external network 26 with cable such as the internet. Interface 25 may also provide a link to an external wireless network, such as a mobile phone network 27. It is understood that external networks can also be special networks that are offered by the installation operator, for example, for remote maintenance of the elevator installation 1. For example, an external maintenance center 28, through the external network 26 supported by cable, can be coupled to the interface 25 in this case the maintenance center 28 (as well as the external network) forms a component of the control system 20 that does not belong to the elevator installation 1, ie an external component.
    [0064] The external wireless network 27 can be used for coupling the mobile control unit 23. For example, if the mobile control unit 23 is, for example, a mobile phone, through this unit the mobile phone network 27 it may be connected with the interface 25. In this case, the mobile phone network 27, as well as the mobile phone 23, constitute external components of the control system 20.
    [0065] Figure 2 presents a flow diagram 50 for the execution of a first variant of the method according to the invention in the security system 10, as well as in the control system 20. In the starting point 51 is found the 10 security system in a real state. In a first step 52, the security system 10 receives a restoration inquiry that is transmitted through a, i.e., from an internal or external control unit 21, 22, 23, 28 of the control system 20 in a inquiry step 53 to the security system 10. The restoration inquiry consists of a first partial data set with which the restoration inquiry can be identified by the security system 10. In another partial data set it may be contained a verification code, which, for example, for each restoration query is generated again by a system or by a user in a generation step 58. It is understood that the verification code, in accordance with the security requirement , needs to be in a position to enable a reliable verification of the restoration query. The verification code can, for this purpose, for example, be extracted from a predetermined list (list of dashes) or it can be generated by an independent device, in a synchronous time window, with a verification code target in the security system 10. The verification code may also comprise a system or user authentication.
    [0066] In a first verification step 54, the security system verification code 10 will be extracted from the restoration query. In a second verification step 56 the extracted verification code will be compared to a target comparison code. The target verification code may be generated by the security system 10 in a generation step 55a during the performance of the first verification step 54. Alternatively, the target verification step can already be produced during step 52 on receipt of the restoration query. (step 55b). The generation of the target verification code can be done analogously to the generation of the verification code.
    [0067] If in a second verification step 56 it is verified that the extracted verification code coincides with the target verification code, the verification will be considered valid. Thereafter, the security system 10 will return to the target state as long as the target state is assessed to be safe (step 57). if the verification code and the target verification code do not match, the restore query will be considered invalid. In sequence, the security system 10 remains in real state 51. Eventually, in the case of an invalid verification an alarm may be triggered pointing to the unverified restoration query and therefore a potential failure function or fault handling of the restoration query .
    [0068] Figure 3 shows another flow diagram 60 for carrying out a second variant of the method according to the invention in the security system 10, as well as in the control system 20. At the starting point 61 is the 10 security system in a real state. In a first step 62, the security system 10 receives a reset inquiry that is being transmitted over, i.e., from an internal or external control unit 21, 22, 23, 28 of the control system 20 in one step. number 63 to the security system 10. In this case, the reset query may comprise only a single set of data that uniquely identifies the reset query and in specific form. Of course, additional data, such as an identification of the control unit, for which the restoration query was transmitted, can also be transmitted.
    [0069] As a result of the reception 62 of the reset inquiry by the control system 20, the security system 10, in a generation step 64 for the verification inquiry, generates, for example, an inquiry code. Simultaneously with the generation step, another generation step 65a can be carried out with which a target response code will be generated as target verification response, belonging to the inquiry code, being memorized in the security system. The inquiry code and the target response code can be unambiguously allocated to each other. After the generation 64 of the inquiry code, it will be transmitted, in a transmission step 66 from the security system 10 to the control system 20, and in this system it will be received (step 67). In this case, the inquiry code may be transmitted in a controlled manner to a specific control unit 21, 22, 23, 28 of the control system 20. This unit need not be identical to a control unit 21, 22, 23, 28 of which the query to restore the security system 10 was transmitted.
    [0070] As a result of receiving the inquiry code, in the control system 20 a response code will be generated as a verification response (step 68). This can be done automatically through a correspondingly programmed circuit or computer of the corresponding control unit 21, 22, 23, 28. Alternatively, for this purpose, an independent release device (not shown) can be coupled by a user in the corresponding control unit, eg via interface 21.3. In another variant, the inquiry code, for example, will be visually displayed in the control unit 21, 22, 23, 28 as long as this unit is correspondingly configured. In this case, the query code can be read by a user in order to generate the response code (step 68). To do so, the user can use a rule to generate the response code that he knows or, for example, can use an independent device, which is configured in the query code input to generate the response code.
    [0071] In a transmission step 69, the response code will be transmitted by the control system 20 to the security system. The control unit 21, 22, 23, 28 used for this purpose need not be identical with the control unit 21, 22, 23, 28 from which the restoration query was transmitted and also need not be identical with the control unit 21, 22, 23, 28 to which the inquiry code has been transmitted.
    [0072] In a reception step 70, the response code will be received in the security system 10. Alternatively to the generation step 65a, the target response code may only be generated in a generation step 65b upon reception 70 of the response code.
    [0073] The received response code, in a comparison step 17 will be compared with the target response code. If in the comparison step 71 it is verified that the response code matches the target response code, the verification will be considered valid. Then, since the target state is judged to be safe, the security system 10 restores to the target state (step 72). Otherwise, the restore query is checked as being invalid. Therefore, the security system 10 remains in the real state 61.
    [0074] For the expert, other advantageous variants are directly presented for carrying out the verification of the method according to the invention.
    权利要求:
    Claims (14)
    [0001]
    1. Method for restoring a security system (10) of an elevator installation (1) from a real state (51, 61), in which a normal operation of the elevator installation (1) is not released, for a target state (57, 72), in which a normal operation of the elevator installation (1) is released by the security system (10), the security system (10) being connected via at least one communication interface ( 19), for data exchange, with a control system (20), allocated to the installation of elevators (1), especially not belonging to the security system (10), comprising steps a) receiving a restoration query (52 , 62), transmitted from the control system (20), to restore the real state (51,61) to the target state (57,72) in the security system (10), b) performing a verification of the restoration consultation (52, 62) by the security system (10), c) verification evaluation by the security system (10), d) restoration that of the security system (10) from the real state (51, 61) to the target state (57, 72) when the verification is considered valid by the security system (10), characterized by the fact that the verification comprises the following steps e) transmission of a verification inquiry (66), especially an inquiry code, by the security system (10) to the control system (20) as a result of the reset inquiry (52, 62) received, f) receiving a verification response (70), transmitted by the control system (20), especially a response code, in the security system (10), and the verification query (66) being generated again by the system. control (20) to each restore query (52, 62).
    [0002]
    2. Method according to claim 1, characterized in that the verification evaluation comprises steps a) comparing the verification response (70) with a target verification response (56, 71), especially in the case of the response The verification (70) comprises a response code with a target response code, b) evaluating the verification as being valid when the verification response (70) matches the target verification response (56, 71).
    [0003]
    3. Method according to claim 1 or 2, characterized in that the verification query (66) is randomly generated by the security system (20) for each restoration query (52, 62).
    [0004]
    4. Method according to any one of claims 1 to 3, characterized in that the verification query (68) in relation to each restoration query (52, 62) is unique.
    [0005]
    5. Method according to any one of claims 1 to 4, characterized in that the verification query (66) is precisely allocated a target verification response (56, 71).
    [0006]
    6. Method according to any one of claims 1 to 5, characterized in that the target verification response (56, 71) is generated by the security system (10) according to a rule, especially a coding, from the query (66), the target verification response (56, 71) preferably being generated from the verification query (66) only upon receipt of the verification response (70).
    [0007]
    7. Method according to any one of claims 1 to 6, characterized in that the control system (20) comprises at least one of the following control units - a fixed control unit (21, 22, 28), especially a control unit arranged in an elevator car (9), or a control unit of an elevator control, - a mobile control unit (23) which, through the control system (20), is coupled or can be coupled to the security system (10), preferably the control system (20) comprises a link (25) in an external wireless network (27) or an internal wireless network (24), through which it is coupled or can be coupled to the mobile control unit (23), whereby a) the verification inquiry (66) is transmitted by the security system (10) to the at least one control unit and b) the verification response (70) is transmitted by at least one control unit or by another s control unit. control system (20) for the security system (10).
    [0008]
    8. Method according to claim 7, characterized in that the at least one control unit comprises at least means for reading (21.1, 21.3) the verification query (66) and the control unit, of which it is transmitted the verification response (70) to the security system (10), comprises at least means for inputting (21.2, 21.3) the verification response (70), the verification query (66) being read through the means. for reading (21.1, 21.3) and the verification response (70) is entered through the medium to the input (21.2, 21.3).
    [0009]
    9. Method according to claim 7, characterized in that the at least one control unit has means for generating a verification response (70) of the verification query (66), wherein the verification response (70) ) is automatically generated on receipt of the verification inquiry (66) by the at least one control unit and is transmitted to the security system (10).
    [0010]
    10. Method according to any one of claims 1 to 9, characterized in that the verification must take place within a predetermined period of time to be considered valid.
    [0011]
    Installation of elevators (1), especially for carrying out a method as defined in any one of claims 1 to 10, comprising a security system (10) which, from a real state (51, 61 ), especially from a state, in which normal operation of the elevator installation is not released (1), can be restored to a target state (57, 72), especially to a default state, in which normal operation of the elevator installation. elevators (1) is released by the security system (10), and the security system (10) through at least one communication interface (19) is connected for data exchange to a control system (20) , allocated to the installation of elevators (1), especially not belonging to the security system (10), the security system (10) comprising a) means for receiving a catering inquiry (52, 62) transmitted from the control system (20) for real state restoration (51,61) for the target ado (57, 72) and b) means for performing a verification of the restoration query (52, 62) through the control system (20), as well as c) means for evaluating a validity of the verification, and d) is executed in such a way that the security system (10), as a result of a verification deemed valid, restores from the real state (51, 61) to the target state (57, 72), characterized by the fact that the means for carrying out of the verification comprise transmission means for transmitting a verification inquiry (66) to the control system (20), as well as receiving means for receiving a verification response (70) from the control system (20) and the means for performing the verification is provided to regenerate the verification query (66) by the security system (10) for each restoration query (52, 62).
    [0012]
    12. Installation of elevators (1) according to claim 11, characterized in that the security system (10) presents a) means for generating, especially for random generation, of a verification query (52, 62 ), especially an inquiry code, as well as b) means for generating a target verification response (56, 71) allocated to the verification inquiry (52, 62), especially a target response code allocated to the inquiry code, and being that c) the means for evaluating a validity of the verification is performed to compare a verification response (70) received by the control system (20) with the target verification response (56, 71).
    [0013]
    13. Installation of elevators (1) according to claim 11, characterized in that the control system (20), allocated to the installation of elevators (1), comprises at least one, preferably several, of the following control units a) a fixed control unit (21, 22, 28), especially a control unit (21) arranged in an elevator car (9), or a control unit (22) of an elevator control, b) a mobile control unit (23) which, through the control system (20), is coupled or can be coupled to the security system (10), preferably the control system (20) comprises an internal wireless network (24 ) or an interface (25) for connecting to an external wireless network (27), through which the mobile control unit (23) is coupled or can be coupled.
    [0014]
    14. Elevator installation according to claim 13, characterized in that the at least one control unit comprises a) means for reading (21.1, 21.3) the verification query (52, 62), especially an interface ( 21.3) for coupling another control unit or a mobile release device for reading the verification response (70), or a display (21.1) for visually presenting the verification query (52, 62), and /or b) means for inputting (21.2, 21.3) the verification response (70), especially an interface (21.3) for coupling another control unit or a mobile release device for inputting the verification response (70) , or a keyboard (21.2) for manual entry of the verification response (70), and/or c) means for generating the verification response (70), especially a circuit or a programmable computer.
    类似技术:
    公开号 | 公开日 | 专利标题
    BR112015006484B1|2021-06-22|METHOD FOR RESTORATION OF SAFETY SYSTEM FOR ELEVATOR INSTALLATION AND ELEVATOR INSTALLATION
    US10872483B2|2020-12-22|Systems and methods for controlling access to physical space
    US9892579B2|2018-02-13|Control method for smart lock, a smart lock, and a lock system
    US20140002236A1|2014-01-02|Door Lock, System and Method for Remotely Controlled Access
    US8907763B2|2014-12-09|System, station and method for mustering
    ES2683968T3|2018-10-01|Procedure for operating an evacuation path device as well as evacuation path arrangement
    US20140019768A1|2014-01-16|System and Method for Shunting Alarms Using Identifying Tokens
    US20130214902A1|2013-08-22|Systems and methods for networks using token based location
    US9810000B2|2017-11-07|Electronic locking apparatus for a rollup door
    CN207216734U|2018-04-10|A kind of gate inhibition's safety access management system for smart home
    JP5996598B2|2016-09-21|Security system with PIN lock
    US20090241615A1|2009-10-01|Defeatable room access control system and method
    CN204759558U|2015-11-11|Intelligent entrance guard , equipment and system
    CN110288727A|2019-09-27|The intelligent system on duty in unmanned laboratory
    US11263892B2|2022-03-01|Alarm system with first responder code for building access
    JP2006227756A|2006-08-31|Cooperation controller
    TW201732687A|2017-09-16|Access system with replacement/back-up function
    US20140160288A1|2014-06-12|Security monitor
    US20040246095A1|2004-12-09|Security device
    CN110322608A|2019-10-11|Based on the intelligence community guest system remotely controlled
    JP2008052633A|2008-03-06|Method for registering apartment house remote monitoring system
    KR20140021819A|2014-02-21|Home security system
    CN206411673U|2017-08-15|A kind of medicine management system got it filled of meeting an urgent need
    US7409711B1|2008-08-05|Method and apparatus for troubleshooting a security gate system remotely
    US20190272693A1|2019-09-05|Function module for an electronic access control
    同族专利:
    公开号 | 公开日
    BR112015006484A2|2017-07-04|
    MX2015003716A|2015-10-22|
    CN104661945A|2015-05-27|
    WO2014048826A1|2014-04-03|
    US9944492B2|2018-04-17|
    US20150251875A1|2015-09-10|
    PL2900581T3|2017-05-31|
    ES2607145T3|2017-03-29|
    EP2900581A1|2015-08-05|
    AU2013322887B2|2017-02-23|
    AU2013322887A1|2015-04-16|
    CN104661945B|2017-05-10|
    MX355619B|2018-04-25|
    EP2900581B1|2016-09-14|
    PT2900581T|2016-12-16|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US4246983A|1978-03-31|1981-01-27|Montgomery Elevator Company|Elevator control|
    US5274203A|1989-06-30|1993-12-28|Otis Elevator Company|"Smart" position transducer system for elevators|
    FI111934B|1992-12-22|2003-10-15|Kone Corp|Remote control system in elevator devices|
    JP2002160872A|2000-11-27|2002-06-04|Mitsubishi Electric Building Techno Service Co Ltd|Wrong operation preventing device for car control panel for elevator|
    DE50205296D1|2001-09-18|2006-01-19|Inventio Ag|SECURITY CIRCUIT FOR LIFTING DOORS|
    JP4223252B2|2002-09-12|2009-02-12|三菱電機ビルテクノサービス株式会社|Elevator hibernation certification system|
    ZA200307740B|2002-10-29|2004-07-02|Inventio Ag|Device and method for remote maintenance of a lift.|
    JP4980923B2|2004-11-30|2012-07-18|オーチスエレベータカンパニー|Multi-function destination entry passenger interface|
    WO2007011359A1|2005-07-18|2007-01-25|Otis Elevator Company|Remotely performed and/or assisted restoration of elevator service|
    CN101883730B|2007-12-03|2014-06-04|奥蒂斯电梯公司|Passive detection of persons in elevator hoistway|
    ES2601585T3|2009-12-18|2017-02-15|Thyssenkrupp Elevator Ag|Procedure for the telediagnosis of an elevator installation and elevator installation for the procedure|
    JP2011256006A|2010-06-08|2011-12-22|Toshiba Elevator Co Ltd|Cage operation system by remote control and cage operation method thereof|
    ES2595002T3|2011-05-10|2016-12-27|Otis Elevator Company|Remote control management of an elevator system|
    DE102011109888B4|2011-08-10|2020-01-23|Phoenix Contact Gmbh & Co. Kg|Method and device for automatically creating an executable safety function for a device|
    EP2766290A4|2011-10-14|2015-06-24|Otis Elevator Co|Elevator system with messaging for automated maintenance|WO2012126620A1|2011-03-21|2012-09-27|H. Henseler Ag|Elevator comprising a car that is movable in the maintenance mode|
    ES2595002T3|2011-05-10|2016-12-27|Otis Elevator Company|Remote control management of an elevator system|
    CA2924178A1|2013-09-18|2015-03-26|Inventio Ag|Method for operating an elevator control device|
    CA2942858A1|2014-04-14|2015-10-22|Inventio Ag|Method for operating a lift system and a lift control device operating in accordance with the method|
    BR112017010993A2|2014-12-18|2017-12-26|Inventio Ag|process for operating an electronic security system with temporary subscribers|
    WO2016096826A1|2014-12-18|2016-06-23|Inventio Ag|Method for operating an electronic safety system with temporary subscribers|
    WO2016096829A1|2014-12-18|2016-06-23|Inventio Ag|Method for operating an electronic safety system with temporary subscribers|
    US10787341B2|2015-07-01|2020-09-29|Otis Elevator Company|Elevator control system and elevator system having inspection control station|
    AU2017369390B2|2016-11-30|2020-04-02|Inventio Ag|Configuring accessing right to elevator control system|
    WO2018134205A1|2017-01-17|2018-07-26|Inventio Ag|Real-time data communication for elevator system|
    US10745244B2|2017-04-03|2020-08-18|Otis Elevator Company|Method of automated testing for an elevator safety brake system and elevator brake testing system|
    EP3415453B1|2017-06-14|2021-12-22|KONE Corporation|Remote fault clearing for elevators, escalators and automatic doors|
    US10244374B2|2017-07-17|2019-03-26|Otis Elevator Company|Service tool proximity detection|
    US10669122B2|2017-07-17|2020-06-02|Otis Elevator Company|Service tool location-based function availability|
    US10414629B2|2018-01-22|2019-09-17|Otis Elevator Company|Mechanical system service tool|
    US11040854B2|2018-03-03|2021-06-22|Otis Elevator Company|Resetting governor sub-systems|
    EP3608272A1|2018-08-07|2020-02-12|Siemens Aktiengesellschaft|Operation of a door controller|
    EP3653556A1|2018-11-15|2020-05-20|KONE Corporation|Resetting an elevator shaft access monitoring system|
    EP3822209A1|2019-11-18|2021-05-19|Carrier Corporation|Elevator system with mesh network having proxy-transceiver|
    法律状态:
    2018-11-21| B06F| Objections, documents and/or translations needed after an examination request according [chapter 6.6 patent gazette]|
    2020-01-07| B06U| Preliminary requirement: requests with searches performed by other patent offices: procedure suspended [chapter 6.21 patent gazette]|
    2021-04-13| B09A| Decision: intention to grant [chapter 9.1 patent gazette]|
    2021-06-22| B16A| Patent or certificate of addition of invention granted|Free format text: PRAZO DE VALIDADE: 20 (VINTE) ANOS CONTADOS A PARTIR DE 19/09/2013, OBSERVADAS AS CONDICOES LEGAIS. |
    优先权:
    申请号 | 申请日 | 专利标题
    EP12185777|2012-09-25|
    EP12185777.5|2012-09-25|
    PCT/EP2013/069450|WO2014048826A1|2012-09-25|2013-09-19|Method for restoring a safety system for an elevator installation|
    [返回顶部]