EP3966146A2

EP3966146A2 - Drive of an elevator system

Info

Publication number: EP3966146A2
Application number: EP20724114.2A
Authority: EP
Inventors: Roman Hopp; Thomas Eilinger
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2019-05-07
Filing date: 2020-05-07
Publication date: 2022-03-16
Also published as: WO2020225383A3; WO2020225383A2; US20220219939A1; CN113748076A; CN113748076B

Abstract

The drive (1) of an elevator system (3) comprises an electric machine (5); a first converter (7) which can be electrically connected to an alternating current source (9) and to the electric machine (7); a drive controller (11) for controlling the drive (1); and a drive safety circuit unit (13) which can be electrically connected to a safety circuit (15) of the elevator system (3), to a controller (17) of the elevator system (3) and to the drive controller (11); and at least one first mechanical brake (19) which can be applied by a brake application command from the controller of the elevator system (17). The drive safety circuit unit (13) is designed so that it can be operated in a first operating state and in a second operating state; in the first operating state, the drive safety circuit unit transmits an emergency stop command coming from the safety circuit (15) of the elevator system (3) directly and without delay to the first converter (7), and in the second operating state, the drive safety circuit unit transmits an emergency stop command coming from the safety circuit (15) of the elevator system in a changed manner, in particular with a delay, to the first converter (7). In this way, reliable braking of the elevator system is guaranteed even in the event of failure of the two mechanical brakes.

Description

Drive of an elevator system

The invention relates to a drive for an elevator system, a method for operating a drive for an elevator system, and the use of a drive for an elevator system as a brake according to the preamble of the independent claims.

It is known in elevator systems that the functionality of the brake is decisive for the safety of the passengers in the elevator system. In order to increase the safety of the elevator system, a redundant brake system is therefore often used, which consists of a first and a second mechanical brake. Thanks to the redundant design of the brake system, the elevator system can be safely braked even if one of the two brakes fails.

The disadvantage here is that the redundantly designed brake system consists of two identical brakes. The two brakes are arranged next to each other so that they are exposed to the same Elm world influences. So it happens that one of the brakes is impaired in its function by Elmwelt influences. This often means that the functionality of the second brake is also impaired in an almost identical manner. This can lead to both brakes failing at the same time. The redundant brake system thus leads to a higher level of safety compared to only one brake, but this redundant brake system often does not achieve the reliability required to ensure that the

Elevator system can be operated safely at any time.

It is the object of the present invention to provide an elevator system which avoids the disadvantages of the prior art and in particular to provide a drive for an elevator system and a method for operating a drive for an elevator system, in which reliable braking of the elevator system even if the two mechanical brakes fail Elevator system is guaranteed. The task is through a drive of an elevator system, a method for

Operating a drive of an elevator system and achieved by using a drive of an elevator system as a brake according to the independent claims.

According to the invention, the drive of an elevator system comprises an electrical machine and a first converter which can be electrically connected to an alternating current source and the electrical machine. The drive further comprises a drive control for controlling the drive and a drive safety circuit unit which can be electrically connected to a safety circuit of the elevator system, to a control of the elevator system and to the drive control. The drive of the elevator system further comprises at least one first mechanical brake, which by a

Brake closing command of the elevator control system can be closed. The

Drive safety circuit unit is designed so that it is in a first

Operating state and can be operated in a second operating state. The

The drive interlock unit is equipped to be in a first

Operating state comes from the safety circuit of the elevator system

Emergency stop command transmitted to the first inverter immediately and unchanged. The drive safety circuit unit is further designed so that in a second operating state it receives a safety circuit from the elevator system

Modified emergency stop command transmitted to the first inverter. The

Drive safety circuit unit transmits one of the safety circuit of the

Elevator system coming emergency stop command in the second operating state of the

Drive safety circuit unit in particular delayed.

It has proven to be advantageous that the drive safety circuit unit of the

Emergency stop command of the safety circuit depending on the operating state of the drive safety circuit unit leads directly to an emergency stop of the converter or delays it, i.e. only after a certain time in which the state of the

Elevator system can be analyzed leads to an emergency stop of the converter. This makes it possible to switch off the converter and thus the drive only when it is certain that it is no longer required. It is possible to use the converter to support the emergency stop. The drive safety circuit unit thus enables continued operation of the converter after the elevator system has been put into an emergency stop state.

In one embodiment, the drive safety circuit unit is designed such that it is in the first operating state when the first mechanical brake is open. The drive safety circuit unit is further designed so that the

The drive safety circuit unit changes at least temporarily to the second operating state when the control of the elevator system receives a brake closing command.

This makes it possible to check a braking effect of the first mechanical brake, which should be closed by the brake closing command, ensuring that the converter and the electrical machine are kept operational during this checking phase. The electric machine is in this

The converter continues to hold the verification phase in the magnetized state.

An emergency stop command which leads to a brake closing command for the first mechanical brake does not immediately (immediately) result in the drive safety circuit unit switching off the converter and thus demagnetizing the electrical machine. The drive safety circuit unit thus enables the braking effect of the mechanical brake to be checked and, if necessary, the instantaneous use of the converter to support this braking effect.

Such a review of the braking effect can because of

Drive safety circuit unit can also be carried out in the event that the system, in particular the drive, is otherwise switched off immediately. The drive safety circuit unit makes it possible to use the converter as a further braking element in addition to the mechanical brake. This increases the

Availability of the braking power in the elevator system and thus the safety of the elevator system. In one embodiment of the drive, this is designed so that in the second operating state of the drive safety circuit unit, an emergency stop command from the control of the elevator system, which in the first operating state of the

Drive safety circuit unit leads to the immediate deactivation of the drive control and thus to an immediate demagnetization of the electrical machines, is delayed so that no immediate deactivation of the drive control and thus a maintenance of the magnetization of the electrical machine is possible despite the emergency stop command.

In one embodiment of the drive, this is designed so that the

Drive safety circuit unit is operated when receiving an emergency stop command in the second operating state, so that the drive safety circuit unit when

When the emergency stop command occurs, the electrical machine is immediately demagnetized, which is caused by the emergency stop command in the absence of the

Drive safety circuit occurs, at least delayed.

In one embodiment of the drive, it is designed such that the electrical machine can be magnetized in the first and / or in the second operating state of the drive safety circuit unit.

In one embodiment of the drive, this is designed so that in the first and / or second operating state of the drive safety circuit unit a

Magnetization of the electrical machine remains unchanged.

In one embodiment of the drive, this is designed so that in the first and / or second operating state, the drive has a safety circuit unit

Magnetization of the electrical machine is maintained.

In one embodiment, the drive safety circuit unit is designed in such a way that, after changing to the second operating state, it is dependent on The functionality of the first mechanical brake remains in the second operating state or changes to the first operating state. The drive safety circuit unit is designed such that it remains in the second operating state when the first mechanical brake is defective, the drive safety circuit unit changing to the first operating state when the first mechanical brake is functioning.

If the first mechanical brake is functional, that is, if the first mechanical brake is able to hold the elevator system safely at a given point with a given charge state, there is no need to use the converter and the electrical machine operated by the converter as an additional brake. The drive safety circuit unit can switch back to the first state. If the first mechanical brake is defective, the drive safety circuit unit remains in the second operating state and thus enables the drive to be used as a brake. The change from the second operating state to the first operating state therefore only takes place after the functional capability of the first mechanical brake has been checked. During this time, the converter remains active anyway and holds the

Magnetization of the electrical machine upright. The converter and the electrical machine can be used immediately at any time. If, on the other hand, the converter were to be switched off directly by this emergency stop command in the event of an emergency stop command from the safety circuit of the elevator system, the magnetization of the electrical machine would also decrease immediately, which means that the machine would first have to be magnetized again so that it can then be used to support the brake. This is prevented by the drive safety circuit unit.

In one embodiment, the at least first mechanical brake comprises a brake sensor. The brake sensor is preferably designed as a brake contact. The brake sensor is used to monitor a braking operating state. The brake sensor makes it possible to distinguish between an open and a closed braking state. The drive safety circuit unit is connected to the brake sensor. The drive safety circuit unit can thus distinguish between an open and a closed first mechanical brake.

It has proven to be advantageous that a signal is available to the drive safety circuit unit from which the braking operating state can be derived. This enables the drive safety circuit unit to assess the braking effect of the brake only when the braking operating state of the brake corresponds to a closed brake. If the braking operating state corresponds to that of a closed brake, this does not mean that the brake actually brakes, i.e. that it stops. For example, it can happen that the brake in the

closed state is unable to apply a braking effect. If the brake closes after receiving a brake closing command, the brake sensor, for example a brake contact, is activated. The brake sensor signal is therefore exclusively on

Indicator whether the brake is in a state in which the braking effect should be present. As soon as the brake sensor sends the signal that the brake is on, the braking effect can be tested. The presence of the signal from the brake sensor in the drive safety circuit unit enables the latter to start the analysis of the braking effect when the braking effect should actually be present. If this signal were not available, the drive safety circuit unit would have to wait for a fixed time, for example. However, in different embodiments, brakes can have closing times of different lengths. The fixed time must therefore be selected according to the longest closing time. For types of brakes that are less sluggish, i.e. close faster, this leads to an unnecessary loss of time during which the elevator system is in the unbraked state. The presence of the brake sensor signal therefore increases the safety of the elevator system, since a lack of braking action can be determined as quickly as possible.

In one embodiment, the brake sensor is designed as a brake contact. In one embodiment, the electrical machine comprises a rotation sensor which measures the rotation of the electrical machine. The drive safety circuit unit is connected to the rotation sensor. The drive safety circuit unit can thus distinguish between a moving and a stationary electrical machine. The measurement of the rotation of the electrical machine is an indirect measurement of the braking effect of the electromagnetic brake. If the electromagnetic brake is in the braking operating state, in which the brake should be closed, the electrical machine must not move. Detects the

Drive safety circuit unit that the braking operating state is a closed state and if a signal from a rotation sensor of the electrical machine is also available to the drive safety circuit unit at the same time, then the

When changing to this braking operating state, the drive safety circuit unit determines by analyzing the rotation sensor signal whether the brake is actually able to produce the desired braking effect. It can be determined whether the electric machine is blocked by the brake in such a way that it no longer moves. The drive safety circuit unit can thus indirectly determine the wear of a brake lining. If the brake lining of a mechanical brake is worn, the brake sensor indicates that the brake is closed, but due to missing brake linings, the electrical machine may not be blocked or only inadequately blocked, which can then be determined by the rotation sensor.

In one embodiment, the first converter is a bidirectional converter. The drive safety circuit unit is designed such that it is in the second

Operating state via the drive controller controls the first converter in such a way that the electrical machine is operated in a generator mode.

So that the first converter can operate the electrical machine as a generator in the second operating state, the drive safety circuit unit must ensure that the drive control, in particular the converter control, also with a

Emergency stop command works. The drive safety circuit unit must therefore ensure that the controller that controls the converter is also active in the second operating state. In addition, the drive safety circuit unit must be able to give this converter control the command that the converter should operate the electrical machine in generator mode. To make this possible, the drive safety circuit unit must ensure that, in addition to the converter control, the sensors required for the converter control, i.e. for example current and voltage sensors at the output of the converter, continue to be supplied with energy and can thus continue to be used by the converter control unit. If the converter can operate the machine as a generator in the second operating state, the drive can brake the elevator system independently or as a support to a braking effect coming from the mechanical brake. This increases the availability of the elevator brake system without the need for an additional mechanical brake. The availability of the brake system is thus increased with a component that is largely already present in the elevator system. This is a particularly simple and inexpensive way of improving the safety of the elevator system. Without a drive safety circuit unit, which makes it possible to continue to operate the converter and the electrical machine even in the event of an emergency stop command, it would not be possible to support the mechanical brake by the drive when braking in the event of an emergency stop.

In one embodiment, the drive further comprises a second converter. The second converter is electrically connected to the electrical machine at an alternating current output on the machine side in parallel to an alternating current output on the machine side of the first converter. The electrical machine is in particular an induction machine. The drive safety circuit unit preferably has a

Converter control to control this second converter.

The AC connections of the electrical machine are connected both to the machine-side AC connections of the first converter and to the machine-side AC connections of the second converter. These Topology enables energy to flow between the machine and each of the two converters regardless of the status of the other converter.

In the event that the alternating current source is not available in the event of an emergency stop command from the safety circuit of the elevator system and the first converter has no braking resistor or one that is insufficiently dimensioned to destroy the energy generated when braking the elevator system in the second operating state, a second converter can ensure be that when braking

resulting energy in a second converter assigned to this

Braking resistor can be burned. A second converter with a

corresponding braking resistor enables the electrical machine in

To operate generator mode, regardless of how the first converter is designed and regardless of whether the first converter is available on one

AC power source is connected. The second converter thus enables the drive safety circuit unit to be used with all conceivable converter types and ensures that the drive safety circuit unit can use the electrical machine in every conceivable operating state, i.e. also in the event of a power failure as a brake. This makes it possible, in particular, to retrofit the drive safety circuit unit in existing systems without any problems, without having to intervene in the drive that is already installed, in particular in the converter.

An elevator system which comprises a drive as described above and below also leads to the solution of the object. The elevator system further comprises a control of the elevator system. The elevator system also includes a safety circuit for triggering an emergency stop of the elevator system.

It has proven to be advantageous that in such an elevator system the drive through the drive safety circuit unit when an emergency stop is triggered by the

Safety circuit can continue to be operated. This first makes it possible to determine whether the at least one mechanical brake of the elevator installation is functioning. Whereby the The drive safety circuit unit only switches off the drive, that is to say the converter, after the functionality of the first mechanical brake has been verified. Compared to an elevator system in which the converter is fed directly through the

Safety circuit is switched off, such an elevator system offers the advantage that the electrical machine remains magnetized due to the continued operation of the converter. The electrical machine can thus be used at any time without delay by the converter to brake the elevator system.

A method for operating a drive also leads to the solution of the object, this method in particular for operating a drive, as in FIG

Above and described below, is used. The method is used in particular to operate an elevator installation, as described above and below. The method comprises the step of sending a closing command to at least one mechanical brake for braking a load. This load is in particular an elevator car. The method further comprises the step of testing the braking effect of the at least one mechanical brake after the closing command has been sent to the mechanical brake. This checking is carried out in such a way that an actual braking effect is compared with a target braking effect. The method further comprises the step of using an electrical machine to brake the load if a discrepancy between the actual braking effect and the target braking effect can be determined when checking the braking effect.

It has proven to be advantageous that such a method increases the safety of the elevator system operated by this method, without the need for further mechanical brakes.

In one embodiment, the comparison of the actual braking effect with the target braking effect comprises the following steps: Checking whether a brake sensor reports a closed state of the mechanical brake. The process continues the step of reducing a holding torque exerted by the electrical machine if a closed state was determined in the preceding step. The method further comprises a step of checking whether a sensor is reporting a movement. The sensor is in particular a rotation sensor, which can detect a rotation of the electrical machine or a position sensor, which is a

Can determine movement of the elevator system. Such a method makes it possible to check whether the mechanical brake can brake in the given case, i.e. with a given load. The method also makes it possible to keep the converter in operation until it has been checked whether the mechanical brake can actually hold the car under the given circumstances. The method thus includes a test of the actual braking effect. The method also makes it possible to use the converter and the electrical machine to brake the elevator system if the at least first mechanical brake cannot apply the required braking effect, that is, the actual braking effect is less than the braking effect.

In one embodiment, the step of using an electrical machine to brake the elevator installation comprises the step of building a

Torque. Whereby the built-up torque is preferably a torque at which the load can be held, that is to say the torque one

Holding torque.

The drive thus builds up a torque with the converter in the electrical machine that is higher than the reduced torque that was present after the torque was reduced. The reduction of the torque after the closing command for the mechanical brake has been given is necessary so that the braking effect of the mechanical brake can be checked. If it is now found that the mechanical brake has an actual braking effect that is smaller than the target braking effect, a holding torque can again be achieved through the structure, that is to say by increasing the torque caused by the electrical machine. At this holding torque, the load, that is to say in particular the elevator car and the counterweight, held solely by the drive. A failure of the mechanical brake is thus compensated. In this way, even if the brake is defective, it can be ensured that the elevator system is securely held.

In a preferred embodiment, the electrical machine is as one

Induction machine trained. The generation of a torque comprises the following steps: measuring a current and / or a voltage of the electrical machine, that is to say measuring the amplitude of the current and / or the voltage and measuring a phase position of the current and / or the voltage. Generating a

Voltage, which corresponds to the measured voltage to generate the

desired torque.

In a preferred embodiment, the method enables a

Torque is generated which corresponds to the torque that the machine had previously. In one embodiment, this torque can be generated by the first converter. In this case, the first converter is not switched off, but kept switched on to generate the torque. In another embodiment, the torque is generated by a second converter. This second converter generates a torque which corresponds to the torque generated by the first converter. For this, the second converter is in synchronization with the first converter. So that the second converter can seamlessly take over the function of the first converter. For this purpose, the control of the second converter accesses the measured current and voltage values of the electrical machine.

The use of a drive also leads to the solution of the problem

Elevator system as a third brake. The third brake is next to a first

mechanical brake and a second mechanical brake used to brake an elevator car. The third brake, that is to say the drive, is used exclusively when the first and second mechanical brakes cannot hold the elevator car in a closed state. The use of the drive as a third brake enables the safety of the elevator system to be improved by increasing the availability of the brake system. By using the drive as a third brake, additional

Braking effect are made available, which is based on a different system than the mechanical brake. Such a hybrid system with mechanical and electrical braking effects increases the reliability of the elevator system.

In a preferred use of the drive as a third brake, it is ensured that the drive does not demagnetize when changing from normal operation, in which the drive takes on its function as a drive for the elevator system, to operation in which the drive is used as a third brake, i.e. in particular is not turned off.

This ensures that the drive can be used to brake the elevator system without delay. This increases the safety of the elevator system.

In the following, the invention is further explained in figures using exemplary embodiments. Here show:

1: a schematic representation of an elevator installation in a first

Embodiment.

2: a first embodiment of a drive according to the invention.

3: a second embodiment of a drive according to the invention.

4: a schematic representation of a method according to the invention for

Operating a drive in an elevator system. 1 shows an elevator system 3, the elevator system having a drive 1. In this embodiment, the drive 1 consists of an electrical machine 5, which in this case is designed as an induction machine. The drive 1 is used in the elevator system 3 to move an elevator car 4. The movement of the elevator car 4 in the shaft of the elevator installation is monitored by a position sensor 29.

Fig. 2 shows a drive according to the invention in a first embodiment.

The drive includes an electrical machine 5, which in this

Embodiment is designed as an induction machine. The drive further comprises a first converter 7, which in this exemplary embodiment is designed as a bidirectional converter. The converter converts electrical energy which comes from the alternating current source 9 into a form of energy suitable for driving the electrical machine 5. The converter has 9 current sensors on the AC source side, with one current sensor per phase. The converter also has a current sensor per phase on the side of the electrical machine 5. The measured values of these current sensors are used in the drive control 11 in order to control the switching elements of the converter 7, which in this embodiment are designed as IGBTs. The converter 7 thus enables the generation of a

Voltage with a variable amplitude and a variable frequency. The electrical machine 5 can thus be operated at different operating points. The electrical machine 5 is equipped with a first mechanical brake 19. This first mechanical brake 19 makes it possible to bring the electrical machine 5 to a standstill. In this exemplary embodiment, the electrical machine 5 comprises a second mechanical brake. The second mechanical brake is a brake that is redundant to the first mechanical brake. The first mechanical brake and the second mechanical brake each include a brake contact 21. In this embodiment, the brake contact 21 is designed as a switch which is actuated when the first and the second mechanical brake are closed. The electric machine comprises a rotation sensor 23. A brake signal 22 is sent from brake contact 21 to drive safety circuit unit 13. A signal line with the signal from the rotation sensor 24 also leads from the rotation sensor 23 to the drive safety circuit unit 13. The drive safety circuit unit 13 has an input for the signal 28 of the

Position sensor 29. The drive safety circuit unit 13 also has an input, via which the safety circuit 15 of the control of the elevator installation 17 is fed to the drive safety circuit unit 13. As well as an output for the signal of the rotation sensor 24, which via this output and a line from the

Drive safety circuit unit 13 is performed on the operational control 11. There is also a connection which receives the signal from the elevator control 30 from the

Elevator control 17 leads to drive control 11. There is also one

Connection of the safety circle 15 of the elevator control with the

Drive safety circuit unit 13. This connection makes it possible that the safety circuit 15 of the control of the elevator system 17 via the

Drive safety circuit unit 13 is performed, from there to the

Drive control 11 is forwarded. This enables the

Drive safety circuit unit 13 the signal of the safety circuit of the

Elevator control 17 passes on delayed. The drive safety circuit unit 13 decides on the delay of the safety circuit based on the signal from the position sensor 29 and / or the rotation sensor 23 and based on the signal from the brake contact 21. The drive safety circuit unit 13 checks the braking effect of the first mechanical brake 19 and the second mechanical brake as soon as a corresponding one occurs Signal from brake contact 21 and the other brake contact arrives. The checking of the braking effect of the first mechanical brake 19 and the second mechanical brake is carried out via the signal from the position sensor 29 and the rotation sensor 23. If, after the brake contact 21 of the first mechanical brake 19 and the second mechanical brake is closed, a rotation by the rotation sensor 23 or If a movement is detected by the position sensor, it can be concluded from this that the braking effect of the first mechanical brake 19 and the second mechanical brake is inadequate. In this case it will The safety circuit signal which comes from the elevator control 17 is delayed so that the drive control 11 continues to function, that is to say operates the converter 7 in such a way that the electrical machine 5 remains magnetized. This enables the use of the electrical machine 5 as an additional braking element. This would not be possible if the safety circuit were to put the converter 7, in particular the drive control 11, directly out of operation. In this case, the converter 7 and the electrical machine 5 would have to be restarted or magnetized. This would become valuable

Loss of time, so that the braking effect of the drive, that is to say of the electrical machine 5, would only start with a great delay. The drive safety circuit unit 13 thus enables the drive 1 to be used directly as an additional braking element in the event that the first electrical brake 19 and the second electrical brake do not produce the desired braking power. The signal from the rotary sensor 24 is required by the drive safety circuit unit 13 and then passed on to the drive control 11, where it is also used to control the electrical machine.

3 shows a second exemplary embodiment of a drive 1 according to the invention. The identical elements already described above are not described again here. Reference is made to the preceding description. In this second exemplary embodiment, the drive 1 comprises a second converter 25 in addition to the first converter 7. The second converter 25 is electrically connected to the electrical machine 5 in parallel with the first converter 7. This enables the second converter 25 to take over the function of the first converter 7. For this purpose, the drive 1 includes a further converter control 27, which in the

Drive safety circuit unit 13 is formed. This converter control 27 controls the second converter 25. This enables the failure of the

AC power source 9, braking of the electrical machine 5 by the second converter 25 and the corresponding converter control 27 is taken over. The braking described in the foregoing and in the following can thus also be exercised by the electrical machine, the electrical network, that is to say the AC power source 9, has failed. For this purpose, the second converter 25 has a braking resistor and an electrical valve with which the braking resistor can be optionally connected to the intermediate circuit of the converter. This makes it possible to destroy the energy that flows from the machine 5 into the converter 25 when the electrical machine 5 is braked. This creates one of the

AC power source 9 independent system is intended.

4 shows a schematic representation of a method for operating a drive 1 according to the invention. The method comprises the following steps:

The elevator car moves to a corresponding floor 31, the

The converter holds the car on floor 33, the brake closes 35, the brake contact reports that the brake is closed 37, the converter lowers the torque 39. In step 41 it is decided whether the braking effect of the first mechanical brake and, if applicable, the second mechanical brake is sufficient. If it is determined by the rotation sensor 23 that the elevator car 4 is not moving, the converter reports in step 43 that everything is okay. In step 45 the converter is switched off. The elevator control opens the safety circuit 15 in step 47. If, however, it is determined that the elevator car 4 is moving, that is, the rotation sensor 23 and / or the position sensor 29 detects a movement, then in step 49 a movement is detected. The converter then builds up a torque again in step 51 or increases the torque. Thus, in step 53, the car is held by the converter or, if necessary, held / braked by the converter and the mechanical brake. The converter then requests safe parking of the elevator car 4 in step 53. In step 55, the drive control 11 accordingly initiates the method for safe parking of the elevator car 4. In step 57 the elevator car is placed on the buffer, where it is safely parked. In step 59 it is then reported that the elevator car is safely placed. In step 61 the safety circuit is fully opened.

Claims

Expectations

1. Drive (1) of an elevator system (3), comprising

an electric machine (5); a first converter (7) which can be electrically connected to an alternating current source (9) and the electrical machine (7); a drive control (11) for controlling the drive (1); a drive safety circuit unit (13) which can be electrically connected to a safety circuit (15) of the elevator system (3), to a controller (17) of the elevator system (3) and to the drive controller (11); and at least one first mechanical brake (19), which by a

Brake closing command of the control of the elevator system (17) can be closed; wherein the drive safety circuit unit (13) is designed such that it can be operated in a first operating state and in a second operating state, and wherein the drive safety circuit unit (13) is designed such that in the first operating state it is one of the safety circuit (15) of the elevator installation (3 )

incoming emergency stop command is transmitted immediately and without delay to the first converter (7), and in the second operating state, an from

Safety circuit (15) of the elevator system changes the emergency stop command coming, in particular with a delay, transmitted to the first converter (7).

2. Drive (1) according to claim 1, wherein the drive safety circuit unit (13) is designed such that it is in the first operating state when the first mechanical brake (19) is open, the

Drive safety circuit unit (13) changes at least temporarily into the second operating state when a brake closing command is issued.

3. Drive (1) according to claim 2, wherein the drive safety circuit unit (13) is designed such that after changing to the second Operating status depending on the functionality of the first

mechanical brake (19) remains in the second operating state or changes to the first operating state, the drive safety circuit unit (13) remaining in the second operating state if the first mechanical brake (19) is defective, the drive safety circuit unit (13) in the functioning first mechanical brake (19) in the first operating state changes.

4. Drive (1) according to one of the preceding claims, wherein the drive (1) is designed so that in the second operating state of

Drive safety circuit unit (13) an emergency stop command from the controller (17) of the

Elevator system (3), which emergency stop command in the first operating state of the drive safety circuit unit (13) for the immediate deactivation of the

Drive control (11) and thus leads to an immediate demagnetization of the electrical machines (7), is delayed so that no immediate deactivation of the drive control (11) and thus maintenance of the

Magnetization of the electrical machine (7) is made possible despite the emergency stop command.

5. Drive (1) according to one of the preceding claims, wherein the

at least first mechanical brake (19) a brake sensor (21), in particular a brake contact (21), for monitoring a

Brake operating state includes, which sensor (21) allows between an open and a closed braking operating state

distinguish, the drive safety circuit unit (13) with the

Brake sensor (21) is connected and drive safety circuit unit (13) can thus distinguish between an open and a closed first mechanical brake (19).

6. Drive (1) according to one of the preceding claims, wherein the electrical machine (5) comprises a rotation sensor (23) which measures the rotation of the electrical machine (5), the drive safety circuit unit (13) being connected to the rotation sensor (23) is and the drive safety circuit unit (13) between a moving and a stationary electrical

Machine (5) can distinguish.

7. Drive (1) according to one of the preceding claims, wherein the first converter (7) is a bidirectional converter (7), wherein the

Drive safety circuit unit (13) is designed such that it is in the second

Operating state controls the first converter (7) such that the electrical machine (5) is operated in a generator mode.

8. Drive (1) according to one of the preceding claims, wherein

the drive (1) further comprises a second converter (25), the second

The converter (25) is connected to the electrical machine at an AC output on the machine side, electrically parallel to an AC output on the machine side of the first converter (7), the electrical machine (5) being in particular an induction machine, the drive safety circuit unit (13) preferably being a converter control (27 ) to

Has control of this second converter (25).

9. Elevator system (3) comprising

a drive (1) according to any one of the preceding claims;

a control of the elevator system (17), and

a safety circuit (15) for triggering an emergency stop of the elevator system (3).

10. A method for operating a drive (1), in particular a drive (1) according to one of claims 1 to 8, an elevator system (3), in particular an elevator system (3) according to claim 9, wherein the method

is used in particular to brake the elevator system in normal operation, the method comprising the following steps:

Sending a closing command to at least one mechanical brake (19) for braking a load, in particular an elevator car (4);

Checking the braking effect of the at least one mechanical brake (19) after the closing command has been sent to the mechanical brake (19) in which an actual braking effect is compared with a target braking effect; Use of an electrical machine (5) to brake the load if, when checking the braking effect, a deviation of the actual braking effect from the target braking effect can be determined.

11. The method according to claim 10, wherein the comparison of the actual braking effect with the target braking effect comprises the following steps

Check whether a brake sensor (21) has a closed state of the

mechanical brake (19) reports;

Reduce one exerted by the electrical machine (5)

Holding torque if a closed state was determined in the previous step;

Check whether a sensor reports a movement, in particular a rotation sensor (23) a rotation of the electrical machine (5) or a position sensor (29) which measures a movement of the elevator system (3).

12. The method according to any one of claims 10 to 11, wherein the step of

Using an electric machine (5) for braking comprises the following steps

Build-up of a torque, in particular a holding torque

13. The method according to claim 12, wherein the electrical machine (5) is an induction machine and wherein a current and / or a voltage of the electrical machine and a phase position of the current and / or the voltage are measured before the holding torque is reduced; whereby a voltage / current is generated when the torque is built up, which corresponds to the measured voltage / current in the measured phase position.

14. Use of a drive (1) of an elevator system (3) as a third brake

in addition to a first mechanical brake (19) and a second

mechanical brake for braking an elevator car (4), in particular for braking the elevator car in normal operation, the third brake being used exclusively when the first and the second

mechanical brake (19) cannot hold the elevator car (4) in a closed state.

15. Use of the drive as a third brake according to claim 14, wherein

it is ensured that the drive is not demagnetized, in particular not switched off, when changing from normal operation, in which the drive performs its function as a drive for the elevator system, to operation in which the drive is used as a third brake.