Elevator system with improved monitoring

Abstract

The invention relates to an elevator system with improved monitoring, in particular, the elevator system comprises an elevator car, an elevator drive, an elevator controller, a position reference system, and a safety controller connected to the position reference system to receive car position information and configured to selectively apply a brake of the elevator drive to stop the elevator car. The safety controller is configured to monitor the received car position information at least when the elevator car moves in a given landing's designated unlocking area with the elevator car doors open and to apply the brake of the elevator drive when it is determined from the received car position information that the position of the elevator car is outside the given landing's designated moving area. The safety controller is further configured to monitor the received car position information after the brake has been applied to stop the elevator car with the elevator car doors open and to compare the position of the stopped elevator car with the given landing's designated unlocking area.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to an elevator system with improved monitoring when an elevator car moves in a given landing's designated unblocking area with the elevator car doors open, for example to reduce the occurrence of annoying blockages. BACKGROUND

[0002] It is known that elevator systems allow for releveling operations involving limited movement of the elevator car close to the landing with the doors open, for example in response to changes in the elevator car load that change the position of the elevator car floor relative to the adjacent landing floor or to handle rollbacks caused by improper load weighing. However, elevator safety codes or regulations typically require the application of the machine brake, i.e. the emergency stop, if the elevator car leaves the designated releveling area with the doors not fully closed. In addition, a blockage can be required to be triggered. Once the machine brake has been applied in the event of a blockage, the elevator car is stopped from use until an authorized person manually resets the controller to release the machine brake and allow the elevator car to resume normal operation.

[0003] It is desirable to improve the monitoring of releveling operations and other movements of the elevator car with the doors open to reduce unnecessary service downtime. SUMMARY

[0004] According to the present disclosure, there is provided an elevator system comprising:

[0005] an elevator car arranged to move within an elevator shaft;

[0006] an elevator drive comprising a brake;

[0007] an elevator controller configured to control the elevator drive to control movement of the elevator car in the elevator shaft between a plurality of landings;

[0008] a position reference system configured to measure a position of the elevator car within the elevator shaft;

[0009] a safety controller connected to the position reference system to receive car position information and configured to selectively apply the brake of the elevator drive to stop the elevator car,

[0010] wherein the safety controller is configured to monitor the received car position information at least when the elevator car moves in a given landing's designated unblocking area with the elevator car doors open, and to apply the brake of the elevator drive when it is determined from the received car position information that the position of the elevator car is outside the given landing's designated movement area, and

[0011] wherein the safety controller is further configured to monitor the received car position information after the brake has been applied to stop the elevator car with the elevator car doors open and compare the position of the stopped elevator car with the designated unlocking area of the given landing.

[0012] According to the present disclosure, the safety controller monitors the received car position information both before and after the brake is applied when the elevator car is moving with the elevator car doors open. This means that the safety controller is able to make one or more decisions (e.g. safety related decisions) even after the elevator car has left the designated movement area. These one or more decisions can be related to the safety status, e.g. whether the application of the brake is classified as a need for blocking. In some examples, the safety controller is further configured to make one or more decisions related to the safety status after the elevator car has left the designated movement area. These one or more decisions can be related to whether the brake is allowed to be released by the safety controller, e.g. if the position of the stopped elevator car is determined to be within the designated unlocking area of the given landing. This takes into account the case where the designated movement area is smaller than the designated unlocking area and thus it is considered safe to release the brake to allow the stopped elevator car to further operate.

[0013] In one or more examples, the brake is allowed to be released by the safety controller when the safety controller determines that the position of the stopped elevator car is within the designated unlocking area of the given landing. In other words, the safety controller determines from the position of the stopped elevator car that there is no need for blocking and that the elevator car can be allowed to move again without any intervention. This can enable further elevator movement with the elevator car doors open, e.g. levelling or re-levelling operations. In such examples, the safety controller is configured to release the brake. After the brake is released, the elevator controller can be configured to control the movement of the elevator car to return the elevator car to the designated movement area.

[0014] In one or more examples, the brake can only be released by an external intervention to reset the safety controller when the safety controller determines that the position of the stopped elevator car is outside the designated unlocking area of the given landing. In other words, the safety controller determines from the position of the stopped elevator car that there is a need for blocking and that the elevator car can only be allowed to move again after an external intervention, e.g. a reset operation by an authorised person. The external intervention can take the form of a manual reset or an override of the safety controller by an authorised external operator.

[0015] In one or more examples, the specified movement zone of a given landing is smaller than the specified unlocking zone of the given landing. In some examples, the specified movement zone is defined by a distance from the given landing of no more than ±100 mm, such as no more than ±50 mm, preferably no more than ±40 mm. In some typical examples, the specified unlocking zone is defined by a distance from the given landing of up to ±350 mm, such as up to ±300 mm, such as up to ±250 mm, preferably up to ±200 mm. The specified unlocking zone can be set by safety standards or coding. In some elevator systems, the specified unlocking zone can be set by the sensitivity of interlock mechanisms between the car and the landing door. In some examples, the specified unlocking zone is defined by a distance from the given landing that is smaller than a distance that is typically, for example, ±100 mm.

[0016] In one or more examples, the position reference system is configured to measure the relative position of the elevator car from the given landing. Various systems are known for measuring the relative position, such as landing alignment sensors (e.g., one or more “level sensors”) that are triggered when the elevator car floor is within a certain distance from the given landing. Another method of measuring the relative position of the elevator car from the given landing is to use an encoder connected to a pulley that rotates as the elevator car moves. The encoder can be connected to the pulley of the elevator drive or to the pulley of a dedicated governor. Some examples are visible in WO 2015 / 119608, the content of which is incorporated herein by reference.

[0017] In examples where the position reference system is configured to measure the relative position of the elevator car from the given landing, the safety controller can be configured to apply the brake of the elevator drive upon determining that the relative car position exceeds a first threshold (e.g., indicating that the position of the elevator car is outside the specified releveling zone of the given landing) and to compare the relative car position of the stopped elevator car to a second threshold (e.g., indicating whether the elevator car remains within the specified unlocking zone of the given landing). The safety controller can only need to evaluate the relative car position relative to these two discrete thresholds.

[0018] In one or more examples, the position reference system is configured to measure an absolute position of the elevator car within the elevator shaft. Various systems are known for measuring (e.g. continuously) an absolute position, typically comprising a position reference tape (e.g. an encoder tape) extending at least part of the way along the elevator shaft (e.g. at least close to the landings) and one or more sensors mounted on the elevator car and arranged to read the position reference tape to determine the absolute position of the elevator car within the elevator shaft. It is desirable that the position reference system is configured to measure the absolute position of the elevator car within the elevator shaft continuously, as this facilitates the safety controller to continuously monitor the received car position information after application of the brake during a car releveling operation. A continuous absolute position reference system can more reliably determine the position of a stopped elevator car compared to a specified unlocking zone, e.g. when deciding whether the elevator car has safely stopped within the specified unlocking zone but not reached the limits of the specified unlocking zone.

[0019] In some examples, the position reference system comprises one or more optical sensors mounted on the elevator car and arranged to read a position reference tape, e.g. a camera-based system. Such a system can comprise a series of optically readable markings, e.g. an encoded pattern, along the length of the elevator shaft, and a camera arranged on the elevator car and configured to read the markings so as to be able to determine the absolute position of the elevator car within the elevator shaft. The optical sensors can use visible light or infrared radiation.

[0020] In some examples, the position reference system comprises one or more magnetic sensors mounted on the elevator car and arranged to read a position reference tape, e.g. a magnetic-based system. Such a magnetic system can comprise a magnetic encoder tape extending along the length of the elevator shaft. The magnetic tape can be read (e.g. decoded) using at least one (e.g. multiple) Hall sensors arranged on the elevator car so as to determine the absolute position of the elevator car within the elevator shaft.

[0021] The position reference system can be in addition to other systems providing for determining the position and / or speed of the elevator car within the elevator shaft during normal operation, e.g. encoders arranged to monitor the sheave of the elevator drive. Such other systems can provide information directly to the elevator controller, while the position reference system is in communication (e.g. directly) with the safety controller. Through its connection with the position reference system, the safety controller is able to reliably monitor the position of the elevator car when the elevator car is moving with the elevator car doors open (e.g. during a releveling operation).

[0022] In the present disclosure, an elevator car can move in a designated unblocking area of a given landing with the elevator car doors open for a variety of reasons. For example, the elevator car can be approaching the landing (e.g., with the elevator car doors opened in advance) or undergoing a releveling operation to align the floor of the elevator car with the floor of the landing after the elevator car has stopped at the landing. In a releveling operation, the position of the stopped elevator car is corrected during loading or unloading, if needed, by continuous movement (automatic or inching).

[0023] When the elevator car first stops at the landing, the elevator car doors can be opened (at least partially) in advance or only when the elevator car stops. However, the stopped elevator car can not be positioned with the elevator car floor precisely aligned with the floor of the landing, for example due to roll-back caused by an improper load weighing. During a car releveling operation, the elevator car can be moved one or more times with the elevator car doors open to align the elevator car floor with the floor of the landing. In other examples, the elevator car can stop with the elevator car floor not precisely aligned with the floor of the landing due to an error in the motion profile as the elevator car approaches the landing, which can be corrected by further controlled movement of the elevator car with the elevator car doors open to fully align the elevator car floor with the floor of the landing.

[0024] In the present disclosure, movement of the elevator car with the elevator car doors open refers to any movement of the elevator car with the elevator car doors (and associated landing doors) not closed and locked. In other words, the elevator car doors have been unlocked (e.g., by a door coupling device at the given landing) and are therefore openable. For example, the elevator car doors can be unlocked and still closed. For example, the elevator car doors can be unlocked and partially or fully open.

[0025] In the present disclosure, the designated movement area of a given landing is defined by a set distance above / below the floor of the landing. The designated movement area is where controlled movement of the elevator car with the elevator car doors open is expected to take place.

[0026] In some examples, the designated movement area of a given landing is a designated releveling area where a releveling operation can take place. In some examples, the safety controller is configured to monitor the received car position information during a releveling operation of the elevator car.

[0027] The inventors have recognized that a given landing’s designated movement zone can be smaller than the landing’s unlocking zone. The given landing’s designated unlocking zone is defined by a distance above / below the landing’s floor within which the elevator car’s floor must be in order for one or more corresponding landing doors to be able to unlock. Within the designated unlocking zone, movement of the elevator car is allowed with one or more elevator car doors open (which means that one or more landing doors are also open). The inventors have recognized that it can be possible to allow the elevator car to stop within the designated unlocking zone with the elevator car doors open without the safety controller triggering a blockage.

[0028] According to typical elevator safety regulations (e.g., EN 81), movement of the elevator car is allowed with the landing and elevator car doors open (e.g., for leveling and relleveling operations) provided that the movement is limited to the designated unlocking zone, and all movement of the elevator car outside the designated unlocking zone is blocked by safety devices (i.e., causes the safety controller to trigger a blockage).

[0029] In some examples, the safety controller is integrated with the elevator controller (i.e., the two functions are performed by a common computer). For example, a single controller can be connected to the position reference system to receive car position information and configured to selectively apply brakes of the elevator drive in order to stop the elevator car.

[0030] In some examples, the safety controller is independent of the elevator controller. For example, the safety controller can be connected to the position reference system to receive car position information independent of the elevator controller. For example, the safety controller can be configured to selectively apply brakes of the elevator drive in order to stop the elevator car independent of the elevator controller.

[0031] In some examples, the safety controller is independent of the elevator controller by being monitored through a safety chain that is separate from the elevator controller. In some examples, the safety controller is connected to at least one safety device in the elevator system, such as a safety device configured to detect the open / closed state of a door of the elevator car. As noted above, an elevator car door is considered to be open when it is not fully closed and locked.

[0032] In some examples, the safety controller is connected to multiple safety devices in the safety chain. The safety controller can communicate with the multiple safety devices through a safety bus. Each safety device can monitor an independent portion of the elevator system. For example, each landing door can be provided with its own safety device configured to monitor the state of the landing door, such as whether they are open or closed.

[0033] In some examples, the safety controller can comprise a PESSRAL node, such as a node defined for programmable electronic systems in safety-related applications for elevators according to one or more relevant standards.

[0034] In some examples, the safety controller is configured to interrupt power to the elevator drive in order to apply a brake (e.g., by de-energizing a relay to release a brake). In various examples, the elevator drive can also include a drive motor, and the safety controller can be configured to interrupt power to the drive motor (as well as apply a brake) to help stop the elevator car.

[0035] According to another aspect of the disclosure, there is provided a method of monitoring an elevator car moving with an elevator car door open in an elevator system comprising an elevator car arranged to move in an elevator shaft between a plurality of landings, the method comprising:

[0036] measuring a position of the elevator car within the elevator shaft;

[0037] monitoring the position of the elevator car at least when the elevator car is moving in a given landing’s designated unlock area with the elevator car door open, and applying a brake to the elevator car upon determining that the position of the elevator car moving with the elevator car door open is outside the given landing’s designated movement area; and

[0038] further monitoring the position of the elevator car after the brake has been applied to stop the elevator car with the elevator car door open, and comparing the position of the stopped elevator car to the given landing’s designated unlock area.

[0039] In some examples, the method further comprises making one or more decisions related to a safety state after the elevator car has exited the designated movement area.

[0040] In some examples, the method further comprises allowing the brake to be released upon determining that the position of the stopped elevator car is within the given landing’s designated unlock area.

[0041] In some examples, the method further comprises preventing the brake from being released without external intervention upon determining that the position of the stopped elevator car is outside the given landing’s designated unlock area. For example, the required external intervention can be a manual reset of the safety controller configured to perform the steps of the method disclosed herein.

[0042] In various examples, the steps of the method for monitoring an elevator car moving with an elevator car door open disclosed herein are performed by a safety controller, e.g., a safety controller acting independently of an elevator controller. In such examples, the elevator controller is configured to control an elevator drive to control movement of the elevator car in the elevator shaft, including movement of an elevator car moving with an elevator car door open, e.g., during a car releveling operation. This means that the monitoring provided by the safety controller is independent of the elevator controller that is actually controlling the movement of the elevator car. Attached Figure Description

[0043] Some examples of this disclosure will now be described with reference to the accompanying drawings, in which:

[0044] Figure 1 This is a schematic diagram of a typical elevator system that can be used as an example of the present disclosure;

[0045] Figure 2 This is a schematic diagram of an elevator system according to an example of this disclosure;

[0046] Figure 3 This is a schematic diagram of the position of an elevator car relative to a given floor when the elevator car doors are open, in one example, where: (a) the brake can be released; (b) the brake needs to be stopped.

[0047] Figure 4 This is a flowchart illustrating a method for monitoring an elevator car moving when the elevator car door is open, according to an example of this disclosure. Detailed Implementation

[0048] Figure 1 This is a perspective view of an elevator system 101 including an elevator car 103, a counterweight 105, a tensioning member 107, a guide rail 109, an elevator drive 111, an encoder 113, and a controller 115. The elevator car 103 and the counterweight 105 are connected to each other via the tensioning member 107. The tensioning member 107 may include or be constructed as, for example, ropes, cables, and / or coated steel strips. The counterweight 105 is configured to balance the load of the elevator car 103 and is configured to facilitate simultaneous and opposite movement of the elevator car 103 relative to the counterweight 105 within the elevator shaft 117 and along the guide rail 109.

[0049] Tensioner 107 engages elevator drive 111, which is part of the overhead structure of elevator system 101. Elevator drive 111 is configured to control movement between elevator car 103 and counterweight 105, and thus control the position of elevator car 103 within elevator shaft 117. Encoder 113 may be mounted on a fixed component at the top of elevator shaft 117, such as on a bracket or guide rail, and may be configured to provide a position signal related to the relative position of elevator car 103 within elevator shaft 117. Encoder 113 is typically connected to controller 115, allowing controller 115 to monitor the speed and motion profile of elevator car 103 as it is driven to move between one or more floors 125 within elevator shaft 117.

[0050] The controller 115 is shown as being located in a controller room 121 of the elevator shaft 117 and is configured to control operation of the elevator car 103. For example, the controller 115 can provide drive signals to the elevator drive 111 to control acceleration, deceleration, leveling, stopping, re-leveling, etc. of the elevator car 103. The controller 115 can also be configured to receive position signals from the encoder 113 or any other desired position reference system. The elevator car 103 can be stopped at one or more landings 125 when moving up or down the hoistway 117 by the controller 115 controlling the movement. While shown in the controller room 121, one skilled in the art will appreciate that the controller 115 can be located and / or configured at other locations or positions within the elevator system 101. For example, the controller can be located remotely or in the cloud.

[0051] The elevator drive 111 can include a motor or similar driving mechanism, as well as a brake. The elevator drive 111 can be configured to include an electric drive motor and an electric release brake. The power supply for the motor and / or brake can be any power supply, including a power grid, which in combination with other components, is supplied to the elevator drive 111. The elevator drive 111 can include a traction sheave moved by the motor, which applies force to the tension member 107 to move the elevator car 103 within the elevator shaft 117.

[0052] While shown and described with a rope system including a tension member 107, elevator systems employing other methods and mechanisms to move an elevator car within an elevator shaft can employ examples of the present disclosure with the omission of the tension member 107. For example, a ropeless elevator system can use a linear motor or hydraulic device to directly drive movement of the elevator car 103. Figure 1 The non-limiting examples presented are for illustrative and explanatory purposes only. Features of the elevator system 101 can be applied to elevator systems described in more detail below.

[0053] Figure 2 is a schematic view of an elevator system 201 according to examples of the present disclosure. As shown, the elevator system 201 includes an elevator car 203 that is movable in an elevator shaft between multiple landings. The elevator car 203 is suspended by a tension member 207, which is driven by an elevator drive 211. The elevator drive 211 is thus configured to move the elevator car 203 in the elevator shaft by the tension member 207.

[0054] The elevator drive 211 includes a motor 206 and a brake 208, for example in the form of a machine brake, arranged to act directly on the motor 206 (or its associated traction sheave) such that when the brake 208 is applied, movement of the motor 206 is stopped, and thus the elevator car 203 is stopped from moving within the elevator shaft.

[0055] The elevator system 201 includes an elevator controller 230 and a safety controller 232. The elevator controller 230 is operably connected to the elevator drive 211 to control movement of the elevator car 203 within the elevator shaft. The safety controller 232 is operably connected to the elevator drive 211 independently of the elevator controller 230 in order to control the brake 208. An exemplary safety device 234 is also shown operably coupled to the safety controller 232. The safety device 234 can monitor a portion of the elevator system, such as a sensor that detects opening of one or more doors of the elevator car 203. While the safety device 234 is shown as a single safety device 234, it can include multiple safety devices in a safety chain, such as limit switches, landing door sensors, load sensors, speed sensors, emergency stop buttons, etc.

[0056] The elevator system 201 also includes a dedicated position reference system 240. The position reference system 240 can be mounted to the elevator car 203, as shown, or elsewhere in the elevator shaft. The position reference system 240 can be any suitable system capable of determining a relative or absolute position of the elevator car 203 within the elevator shaft. In this example, the position reference system 240 is in direct communication with the safety controller 232. Although not shown, the position reference system 240 can also optionally be in communication with the elevator controller 230.

[0057] Operation of the elevator system 201 will now be described with reference to the flowcharts of Figure 2 and 3 and Figure 4 Operation of the elevator system 201 will now be described with reference to the flowcharts of

[0058] When the elevator car 203 is moving near a landing 125 with the elevator car doors open, such as during a releveling operation of the elevator car 203 to align the floor of the elevator car 203 with the floor of a given landing, the safety controller 232 is configured to monitor the car position information received from the position reference system 240. Figure 3 The motion profile of the elevator car 203 is shown as an overlay of velocity (s) versus time (t) when the elevator car 203 is moving near a landing 125 with the elevator car doors open. As understood with reference to Figure 3 The safety controller 232 monitors the received car position information to assess whether the elevator car 203 has exited the designated movement (e.g., releveling) region 250 and requires application of the brake 208. After the brake 208 has been applied in an “estop,” the safety controller 232 continues to monitor the received car position information to assess whether the elevator car 203 remains within the designated unlock region 260. The safety controller 232 compares the position of the stopped elevator car (indicated by the square) to the designated unlock region 260.

[0059] Based on this evaluation, the safety controller 232 can decide whether the stopped elevator car has an unsafe condition (e.g. outside the designated unblocking area 260 with the elevator car doors open) as shown in Figure 3 (b) or a safe condition (e.g. inside the designated unblocking area 260 with the elevator car doors open) as shown in Figure 3 (a). When determining a safe condition, the safety controller 232 can allow the brake 208 to be released to allow the elevator controller 230 to move the elevator car 203 again, e.g. to attempt another releveling operation (as indicated by the dashed line). In the example shown in Figure 3 (a), this allows the releveling operation to resume without the need to invoke external intervention.

[0060] This further monitoring of the position of the stopped elevator car and comparison with the designated unblocking area 260 can prevent unnecessary (i.e. “annoying”) blockages from occurring. This approach is also helpful for elevator systems with increased blocking sensitivity, e.g. due to a relatively small designated movement area 250, e.g. ±40mm from the landing 125. For example, if a fault in the safety chain causes the safety controller 232 to apply the brake 208 (i.e. “emergency stop”), then a blockage would be triggered without further monitoring if the elevator car 203 is only 2mm within the designated movement area 250 and the subsequent releveling run has a rollback of 3mm, see Figure 3 a. Thus, the monitoring system and method described herein allows the movement of the elevator car to resume without external intervention.

[0061] Some steps of this exemplary method are shown in Figure 4 At step 350, the safety controller 232 monitors the position of the elevator car 203 during a car releveling operation using car position information received from the position reference system 240. At step 352, the safety controller 232 evaluates whether the position of the elevator car 203 is outside the designated releveling area 250. As long as the elevator car 203 remains within the designated releveling area 250, the car releveling operation can continue, as shown at step 354. When the elevator car 203 is outside the designated releveling area 250, the safety controller 232 applies the brake 208 to stop the elevator car 203 at step 356.

[0062] Unlike the conventional system, the safety controller 232 continues to monitor the position of the elevator car 203 even after the brake 208 has been applied and the elevator car is about to stop. At step 358, the safety controller 232 evaluates whether the position of the stopped elevator car falls outside the specified unlock area 260. If the stop position of the elevator car 203 is outside the specified unlock area 260, the safety controller 232 registers a blockage, as shown at step 360. This corresponds to Figure 3 (b). However, if the stop position of the elevator car 203 is within the specified unlock area 260, the safety controller 232 can allow the brake 208 to be released, as shown at step 362. This corresponds to Figure 3 (a), where the annoying blockage is avoided.

Claims

1. An elevator system (201), comprising: an elevator car (203) arranged to move within an elevator shaft (117); an elevator drive (211) comprising a brake (208); an elevator controller (230) configured to control the elevator drive (211) to control movement of the elevator car (203) in the elevator shaft (117) between a plurality of landings (125); a position reference system (240) configured to measure a position of the elevator car (203) within the elevator shaft (117); a safety controller (232) connected to the position reference system (240) to receive car position information and configured to selectively apply the brake (208) of the elevator drive (211) to stop the elevator car (203), wherein the safety controller (232) is configured to monitor the received car position information at least when the elevator car (203) is moving in a designated unlocked area (260) of a given landing (125) with elevator car doors open, and to apply the brake (208) of the elevator drive (211) when it is determined from the received car position information that the position of the elevator car (203) is outside a designated movement area (250) of the given landing (125), and wherein the safety controller (232) is further configured to monitor the received car position information after the brake (208) has been applied to stop the elevator car (203) with elevator car doors open, and to compare the position of the stopped elevator car to the designated unlocked area (260) of the given landing (125), wherein the brake (208) is allowed to be released by the safety controller (232) when the safety controller (232) determines that the position of the stopped elevator car is within the designated unlocked area (260) of the given landing.

2. The elevator system of claim 1, wherein, The safety controller (232) is further configured to make one or more decisions related to a safety state after the elevator car (203) has left the designated movement area (250).

3. The elevator system of any preceding claim, wherein, The brake (208) can only be released by an external intervention to reset the safety controller (232) when the safety controller (232) determines that the position of the stopped elevator car is outside the designated unlocked area (260) of the given landing.

4. The elevator system of any preceding claim, wherein, The designated movement area (250) of the given landing (125) is smaller than the designated unlocked area (260) of the given landing.

5. The elevator system of any preceding claim, wherein, The safety controller (232) is configured to monitor the received car position information during an elevator car releveling operation.

6. The elevator system of any preceding claim, wherein, The position reference system (240) is configured to measure a relative position of the elevator car (203) from the given landing.

7. The elevator system of any preceding claim, wherein, The position reference system (240) is configured to continuously measure an absolute position of the elevator car within the elevator shaft.

8. The elevator system of any preceding claim, wherein, The safety controller (232) is connected to a plurality of safety devices (234) in a safety chain.

9. A method of monitoring an elevator car (203) moving with open elevator car doors in an elevator system (201) comprising elevator cars arranged to move in an elevator shaft (117) between a plurality of landings (125), the method comprising: measuring a position of the elevator car (203) within the elevator shaft; monitoring the position of the elevator car (203) at least when the elevator car moves with open elevator car doors in a designated unlocking area (260) of a given landing (125) and applying a brake (208) to the elevator car (203) when it is determined that the position of the elevator car moving with open elevator car doors is outside a designated movement area (250) of the given landing; and further monitoring the position of the elevator car (203) after the brake (208) has been applied to stop the elevator car with open elevator car doors and comparing the position of the stopped elevator car with the designated unlocking area (260) of the given landing; allowing the brake (208) to be released when it is determined that the position of the stopped elevator car is within the designated unlocking area (260) of the given landing.

10. The method of claim 9, further comprising: making one or more decisions related to a safety state after the elevator car (203) has left the designated movement area (250).

11. The elevator system of claim 9 or 10, further comprising: preventing the brake (208) from being released without external intervention when it is determined that the position of the stopped elevator car is outside the designated unlocking area (260) of the given landing.

Images