Elevator safety system, elevator system and method for operating elevator system after failure

Abstract

An elevator safety system (100) is disclosed. The elevator safety system (100) comprises a safety controller (10) connected to an elevator safety chain (110) for monitoring the safety of the elevator system (300). The elevator safety system (100) is arranged to monitor a set of safety devices (12A-12D) in a first configuration (111) of the elevator safety system (100), and to reconfigure from the first configuration (111) of the elevator safety system (100) to a second configuration (112) in response to detection (420) of a failure or failure in a portion of the first configuration (111), where the elevator safety system (100) is arranged to monitor the set of safety devices (12A-12D) in the second configuration (112). The malfunctioning or failed parts are at least excluded functionally. An elevator system (300) and a method for continuing to operate an elevator system (300) after a fault or failure are also disclosed.

Description

Technical Field

[0001] The present invention generally relates to a safety system for an elevator. In particular, but not exclusively, the present invention relates to an elevator safety system comprising a safety controller connected to an elevator safety chain for monitoring the safety of the elevator system. Background Art

[0002] Conventional elevators are provided with a safety system, also called an elevator safety chain. It may have a plurality of safety contacts, such as landing door contacts and final limit switches, which are at least functionally connected in series with each other. The opening of the safety contacts usually indicates a safety risk leading to a safe shutdown of the elevator. This means that the elevator safety brake (such as a motor brake) is engaged and the use of the hoisting motor is blocked.

[0003] This solution is error-sensitive in the way that a single error or failure in the safety chain leads to an immediate stop of the elevator car. Thus, in the case where the elevator car has stopped between stopping floors, the elevator users will remain in the car until maintenance personnel arrive at the elevator site to release them. This may take some time and is inconvenient for the users trapped in the car.

[0004] Patent document EP 4074641 A1 shows a safety control device for an elevator. It has two safety control channels controlled by two microcontrollers. The safety control device also has an additional bypass processor that monitors the health of the two microprocessors. In the event of a single microcontroller failure, the additional processor bypasses the safety control channel of the failed microcontroller so that the elevator operation can continue. However, the additional processor increases the complexity and cost of the entire system. Summary of the invention

[0005] The object of the present invention is to provide an elevator safety system, an elevator system and a method for continuing to operate an elevator system after a malfunction or failure. Another object of the present invention is an elevator safety system, an elevator system and a method for allowing the operation of an elevator to continue, so that even in the event of a failure of the elevator safety chain, a user can be released from the car. This solution can be achieved without adding additional components to the elevator safety chain.

[0006] The objects of the invention are achieved by an elevator safety system, an elevator system and a method for continuing to operate an elevator system after a malfunction or failure as defined by the respective independent claims.

[0007] According to a first aspect, an elevator safety system is provided. The elevator safety system comprises a safety controller connected to an elevator safety chain for monitoring the safety of the elevator system.

[0008] The elevator safety system is arranged to monitor a set of safety devices in a first configuration of the elevator safety system and is arranged to reconfigure from the first configuration of the elevator safety system to a second configuration in response to detecting a malfunction or failure in a part of the first configuration, wherein in the second configuration the malfunction or failure part is at least functionally excluded.

[0009] In some embodiments, the first configuration may consist of components and devices that all actively contribute to monitoring elevator safety during normal elevator operation. In other words, the first configuration may not have any "extra safety components" that are idle during normal operation and are only introduced in the event of an operational anomaly. Thus, the first configuration may consist of a subset of components and devices used during normal operation.

[0010] Considering the safety devices, the second configuration may preferably include only a subset of the safety device group of the first configuration. Thus, the number of safety devices in the second configuration may be at least one (faulty or failed part) smaller than the number of safety devices in the first configuration, however, in some cases may be two or more smaller.

[0011] In various embodiments, the first configuration is configured for use during normal operating conditions of the elevator system.

[0012] Optionally, the elevator safety system is configured such that, in case of a detected malfunction or failure in one of the safety device group, the malfunctioning or failed safety device is excluded from the elevator safety chain in the second configuration.

[0013] The second configuration is preferably configured to be used during a limited operating condition of the elevator system. Optionally, the limited operating condition is a short-term operation or a single operation of the elevator system.

[0014] The safety controller may include at least two processing units connected to the elevator safety chain, respectively. Optionally, the elevator safety system is configured so that in the event of a malfunction or failure detected in one of the at least two processing units, at least another of the at least two processing units is used in a second configuration while at least functionally excluding the malfunctioning or failed processing unit.

[0015] One or more safety devices may have a functionally duplicated (i.e., redundant) dual channel structure so that a single channel failure of the safety device does not render the safety device inoperative. The dual channel structure can reduce short-term operation even in the event of a single channel failure. A dual channel structure means a dual processing structure. It may also include, for example, duplicate sensors and duplicate communication channels.

[0016] According to a second aspect, an elevator system is provided. The elevator system comprises a plurality of elevator devices and an elevator safety system according to the first aspect or any embodiment thereof. Furthermore, the set of safety devices of the elevator safety system are respectively at least functionally connected to the plurality of elevator devices.

[0017] The plurality of elevator installations may include at least one, such as one or both, of the following: a motor controller and an elevator brake.

[0018] The set of safety devices may include at least one of the following, for example any one, any two or all three: a safety contact, a safety sensor, a safety switch.

[0019] According to a third aspect, a method for continuing operation of an elevator system after a malfunction or failure is provided. The method comprises monitoring, by a safety controller, a set of safety devices of an elevator safety chain in a first configuration of the elevator safety system, detecting a malfunction or failure in a portion of the first configuration, reconfiguring the elevator safety system from the first configuration of the elevator safety system to a second configuration, wherein in the second configuration the malfunction or failure portion is at least functionally excluded, and continuing operation of the elevator system by using the second configuration.

[0020] The method may include, upon detecting a malfunction or failure in one of at least two processing units of the safety controller, utilizing at least one other of the at least two processing units in a second configuration while at least functionally excluding the malfunctioning or failed processing unit.

[0021] Alternatively or additionally, the method may comprise, in case of detection of a malfunction or failure in one of the set of safety devices (e.g. in a safety sensor), reconfiguring the elevator safety chain such that the malfunctioning or failed safety device (in the non-limiting example case, said safety sensor) is excluded from the elevator safety chain in a second configuration.

[0022] The method may preferably comprise using the first configuration during normal operating conditions of the elevator system.

[0023] The method may preferably include using the second configuration during a restricted operating condition of the elevator system. Optionally, the restricted operating condition is a short-term operation or a single operation of the elevator system.

[0024] The present invention provides an elevator safety system, an elevator system and a method for continuing the operation of the elevator system after a malfunction or failure. The present invention provides advantages over known solutions, because in the event of an operational anomaly, malfunction or malfunction / failure, the elevator car can automatically stop at a landing floor to release the user, thus avoiding the user being trapped in the elevator car.

[0025] Various other advantages will become apparent to the skilled person based on the following detailed description.

[0026] The expression "number" herein may refer to any positive integer starting from one (1).

[0027] The expression "plurality" may refer to any positive integer starting from two (2), respectively.

[0028] The terms "first," "second," and the like are used herein to distinguish one element from another and do not particularly prioritize or rank them unless explicitly stated otherwise.

[0029] The exemplary embodiments of the present invention presented herein should not be interpreted as limiting the applicability of the appended claims. The verb "comprise" is used herein as an open-ended limitation, which does not exclude the presence of unlisted features. Unless explicitly stated otherwise, the features recited in the appended patent claims can be freely combined with each other.

[0030] The novel features which are believed to be characteristic of the invention are particularly set forth in the appended claims.The invention itself, however, both as to its construction and its method of operation, together with additional objects and advantages thereof, will be best understood from the following description of specific embodiments when read in connection with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Some embodiments of the invention are illustrated by way of example and not limitation in the figures of the accompanying drawings.

[0032] Figure 1 An example of an elevator safety system is schematically shown in a first configuration.

[0033] Figure 2 An example of an elevator safety system is schematically shown in a second configuration.

[0034] Figure 3 An elevator system is schematically shown.

[0035] Figure 4 A flow chart of the method is shown. DETAILED DESCRIPTION

[0036] An elevator safety system according to various embodiments includes a safety controller connected to an elevator safety chain for monitoring the safety of the elevator system. The elevator safety system is arranged to monitor a set of safety devices in a first configuration of the elevator safety system, and is arranged to reconfigure from the first configuration of the elevator safety system to a second configuration in response to detecting a malfunction or failure in a portion of the first configuration, wherein in the second configuration, the malfunction or failure portion is at least functionally excluded.

[0037] Considering the safety devices, the second configuration may preferably include only a subset of the safety device group of the first configuration. Thus, the number of safety devices in the second configuration may be at least one (faulty or failed part) smaller than the number of safety devices in the first configuration, however, in some cases may be two or more smaller.

[0038] Therefore, the second configuration may have a simplified structure, and it may only provide limited operation, for example, short-term operation or single operation of the elevator system. This limited operation may be a result of the fact that the simplified structure of the second configuration means a higher probability of failure.

[0039] The first and second configurations may be implemented by using at least partially identical components.Preferably, the second safety function is implemented by using intact parts of the first configuration.

[0040] In various embodiments, the first configuration is configured for use during normal operating conditions of the elevator system.

[0041] Optionally, the elevator safety system is configured such that, in case a malfunction or failure is detected as one of the safety device group, the malfunctioning or failed safety device is excluded from the elevator safety chain in the second configuration.

[0042] The safety controller may include at least two processing units connected to the elevator safety chain, respectively. Optionally, the elevator safety system is configured so that in the event of a malfunction or failure detected in one of the at least two processing units, at least another of the at least two processing units is used in a second configuration while at least functionally excluding the malfunctioning or failed processing unit.

[0043] One or more safety devices may have a functionally duplicated (i.e., redundant) dual channel structure so that a single channel failure of the safety device does not render the safety device inoperative. The dual channel structure can reduce short-term operation even in the event of a single channel failure. A dual channel structure means a dual processing structure. It may also include, for example, duplicate sensors and duplicate communication channels.

[0044] Figure 1 and Figure 2 An example of an elevator safety system 100 is schematically shown in a first configuration 111 and a second configuration 112 , respectively. Figure 1An elevator safety system 100 is shown, which includes a safety controller 10 connected to an elevator safety chain 110 for monitoring the safety of the elevator system. In a first configuration 111 of the elevator safety system 100, the elevator safety system 100 is arranged to monitor a group of safety devices 12A-12D, in this particular case four. The group of safety devices 12A-12D may include at least one of a safety contact, a safety sensor, a safety switch, such as any one, any two or all three.

[0045] Figure 1 and Figure 2 The line connecting the set of safety devices 12A-12D together in FIG. 1 represents at least a functional (if not galvanic and / or electrical) series connection of the elevator safety chain 110. Figure 1 and Figure 2 It will be appreciated that if a malfunction or failure occurs in safety device 12B, elevator safety chain 110 will become broken and / or discontinuous. Figure 2 An example is shown where the faulty or failed portion (i.e., safety device 12B) is bypassed and the elevator safety chain 110 is reconfigured to be operable and / or continuous again in a second configuration 112. The bypass may be a software-based bypass accomplished in the safety software of the safety controller 10.

[0046] In addition, the safety controller 10 and / or the safety devices 12A-12D may have a functionally replicated (i.e., redundant) dual-channel structure so that a single-channel failure of the safety controller 10 (such as its processing units 11A, 11B) or the safety devices 12A-12D will not render them inoperative. The dual-channel structure can reduce short-term operation even in the event of a single-channel failure. The dual-channel structure may mean a dual-processing structure. It may also include, for example, duplicate sensors and duplicate communication channels, such as duplicate data buses and / or duplicate message transfers.

[0047] Figure 2 The elevator safety system 100 is schematically shown being reconfigured from a first configuration 111 of the elevator safety system 100 to a second configuration 112 in response to detecting 420 a fault or failure in a portion of the first configuration 111, wherein in the second configuration 112 the faulty or failed portion is at least functionally excluded, as shown for the safety device 12B. The portion in which the fault or failure occurred, i.e. the safety device 12B, has been detected as having failed or failed.

[0048] Figure 1 and Figure 2A plurality of elevator devices 14A-14D are further shown. The plurality of elevator devices 14A-14D may include at least one of the following, such as one or two: a motor controller, a landing door, a car door, an elevator brake. However, other elevator devices 14A-14D are also possible.

[0049] Figure 3 Schematically illustrated is an elevator system 300, which may include an elevator safety system 100 as described above. The elevator system 300 may include an elevator motion control system 104, such as including an electric converter. The elevator system 300 may include an elevator or "lifting" motor 102, such as a permanent magnet electric motor, for moving an elevator car 20 included in the elevator system 100. The elevator motor 102 may be arranged to rotate a traction sheave 108. The elevator car 20 may preferably be mechanically coupled to the electric motor 102 by, for example, a hoisting rope 106 extending via the traction sheave 108. The operation of the electric motor 102 may be controlled by an elevator motion control system 104, such as including a frequency converter or inverter. The elevator car 20 may be moved in and / or along an elevator shaft 140. The elevator car 20 may move in a normal operating mode to serve a landing or landing floor according to an elevator call. An elevator car door 28 and a landing floor door 30 are also shown.

[0050] In various embodiments, elevator car 20 is adapted to transfer passengers and / or cargo between landings, at least during normal operation of system 300 .

[0051] The lifting rope 106 may comprise, for example, steel or carbon fiber. The term "lifting rope" does not limit the form of the rope in any way. For example, the lifting rope 106 may be implemented as a rope or a belt.

[0052] The elevator motor 102 may be arranged to be mechanically coupled to the traction sheave 108. Furthermore, the elevator ropes 104 may be arranged to extend via the traction sheave 108 so that the elevator motor 102 can move the elevator car 20 coupled to the hoisting ropes 102. Further, connected to the hoisting ropes 102 may preferably be a counterweight 114 for the elevator car 20. Although in Figure 3 106 will be attached to the elevator car 20 from one end and to the counterweight 114 from the opposite end, and then simply run via the traction sheave 108, but in practice, the hoisting ropes 106 may run via one or more other pulleys and components and may terminate at a hoisting rope terminal, as known to those skilled in the art. Thus, depending on how the hoisting ropes 106 are arranged to run, e.g., how many pulleys are passed through and how such configuration is designed and arranged, the roping ratio may be different from one elevator system 300 to another.

[0053] The elevator system 300 may include an elevator control unit 1000 for controlling the operation of the elevator system 300, such as its various devices. The elevator control unit 1000 may be a separate device, or may be included in other components of the elevator system 100, such as in or as part of the elevator motion control system 104. In various embodiments, the elevator control unit 1000 includes the elevator motion control system 104.

[0054] In some embodiments, the elevator control unit 1000 may include the elevator motion control system 104, however, in other embodiments, they may be separate entities, in which case the elevator control unit 1000 may be communicatively connected to the elevator motion control system 104, such as providing input signals / data to and / or from it.

[0055] The elevator control unit 1000 may also be implemented in a distributed manner, such that, for example, a portion of the elevator control unit 1000 may be included in the elevator motion control system 104, and another portion may be included in the elevator car 20. The elevator control unit 1000 may also be arranged in more than two locations or in more than two devices in a distributed manner. The elevator control unit 1000 may be arranged to communicate with at least various devices of the elevator system 300 (an example of such a connection is shown with a dashed double-headed arrow).

[0056] The elevator system 300 may further comprise an elevator braking device 112 comprising an elevator brake, preferably an electromechanical elevator brake.

[0057] There may also be a main power source 125 , such as a three-phase or single-phase electrical grid, an electrical connection 130 between the power source 125 and the elevator motion control system 104 , and another electrical connection 135 between the elevator motion control system 104 and the electric motor 102 .

[0058] Figure 4 A flow chart of the method is shown. In various embodiments, the method is used to continue the operation of the elevator system after a malfunction or failure. According to a non-limiting example, the method steps may be performed by the elevator safety system 100, such as by the safety controller 10 thereof.

[0059] Item or step 400 refers to the start-up phase of the method. Appropriate equipment and components are obtained, and the system is assembled and configured for operation.

[0060] Item or step 410 involves monitoring, by the safety controller 10 , a set of safety devices 12A- 12D of an elevator safety chain in a first configuration 111 of the elevator safety system 100 .

[0061] Item or step 420 involves detecting a malfunction or failure in a portion of the first configuration 111 .

[0062] In some embodiments, the method may include: in case of detecting 420 a fault or failure in one of the at least two processing units 11A, 11B of the safety controller 10, utilizing at least another processing unit of the at least two processing units 11A, 11B in the second configuration 112 while at least functionally excluding the faulty or failed processing unit. Therefore, according to an embodiment, the second configuration 112 may preferably be implemented by using a complete component (complete subset) of the first configuration 111.

[0063] Alternatively or additionally, the method may include, upon detecting 420 a fault or failure in one of the set of safety devices 12A-12D, reconfiguring the elevator safety chain such that the faulty or failed safety device 12A-12D is excluded from the elevator safety chain 110 in the second configuration 112.

[0064] Item or step 430 involves reconfiguring the elevator safety system 100 from a first configuration 111 of the elevator safety system to a second configuration 112 in which the faulty or failed part is at least functionally eliminated.

[0065] Item or step 440 involves continuing operation of the elevator system 300 by using the second configuration 112 .

[0066] Method execution may be stopped at item or step 499 .

[0067] Furthermore, the method may include utilizing the first configuration 111 during normal operating conditions of the elevator system 300. Normal operation means that there are no faults or such events in the elevator system 300 that affect the functions monitored by the safety chain 110, as initially set when the elevator system 300 is configured for use. During normal operation, there may be events that may be faults or malfunctions but do not involve safety critical functions. For example, there may be a fault in the entertainment system of the elevator system 300, and normal operation is still valid because the elevator system 300 can still be used without including safety.

[0068] Furthermore, the method may include utilizing the second configuration 112 during a restricted operating condition of the elevator system 300. Furthermore, the restricted operating condition may be a short-term operation or a single operation of the elevator system 300. For example, there may be a fault at the 7th landing floor detected by the safety device thereon, however, the elevator car 20 may still move from the 4th floor to the 1st floor under the restricted operating condition (single operation), or may continue to operate for a period of time by serving the landing floors between the 1st and 6th landing floors and any landing floors therebetween until the elevator is shut down (short-term operation).

[0069] It is also noted herein that, while the above describes example embodiments, these should not be viewed in a limiting sense. Rather, several variations and modifications may be made without departing from the scope of the present disclosure as defined in the appended claims.

[0070] As will be appreciated by a person skilled in the art, considerations previously presented with respect to various embodiments of the apparatus may be flexibly applied to embodiments of the method, and vice versa.

[0071] Some advantageous embodiments of the elevator safety system and method according to the invention have been described above. The invention is not limited to the above-described embodiments, but the inventive concept can be applied in a variety of ways within the scope of the claims. Unless explicitly stated otherwise, the features recited in the dependent claims can be freely combined with each other.

Claims

1. An elevator safety system (100), comprising a safety controller (10) connected to an elevator safety chain (110) for monitoring the safety of an elevator system (300), wherein the elevator safety system (100) In a first configuration (111) of the elevator safety system (100), the system is arranged to monitor a set of safety devices (12A-12D), and arranged to reconfigure from the first configuration (111) of the elevator safety system (100) to a second configuration (112) in response to detecting (420) a malfunction or failure in a portion of the first configuration (111), wherein In the second configuration (112), the malfunctioning or failed part is at least functionally excluded.

2. The elevator safety system (100) according to claim 1, wherein the safety controller (10) comprises at least two processing units (11A, 11B) respectively connected to the elevator safety chain (110).

3. The elevator safety system (100) according to claim 2 is configured so that, in the event that the malfunction or failure is detected (420) in one of the at least two processing units (11A, 11B), at least another processing unit of the at least two processing units (11A, 11B) is used in the second configuration (112), while at least functionally excluding the malfunctioning or failed processing unit.

4. The elevator safety system (100) according to claim 1 or 2, being configured such that, in the event that the malfunction or failure is detected (420) in one of the group of safety devices (12A-12D), the malfunctioning or failed safety device (12A-12D) is excluded from the elevator safety chain in the second configuration.

5. The elevator safety system (100) according to any one of claims 1 to 4, wherein the first configuration is configured to be used during normal operating conditions of the elevator system.

6. The elevator safety system (100) according to any one of claims 1 to 5, wherein the second configuration is configured to be used during a restricted operating condition of the elevator system.

7. The elevator safety system (100) according to claim 6, wherein the limited operating condition is a short-term operation or a single operation of the elevator system.

8. An elevator system (300), comprising: a plurality of elevator devices (14A-14D), and The elevator safety system (100) according to claim 1, wherein a group of safety devices (12A-12D) of the elevator safety system (100) are respectively at least functionally connected to the plurality of elevator devices (14A-14D).

9. The elevator system (300) according to claim 8, wherein: The plurality of elevator devices (14A-14D) include at least one of a motor controller and an elevator brake.

10. The elevator system (300) according to claim 8 or 9, wherein the set of safety devices (12A-12D) comprises at least one of a safety contact, a safety sensor, and a safety switch.

11. A method for continuing operation of an elevator system (300) after a malfunction or failure, the method comprising: monitoring (410) a set of safety devices (12A-12D) of the elevator safety chain in a first configuration (111) of the elevator safety system (100) by a safety controller, detecting (420) a malfunction or failure in a portion of said first configuration (111), reconfiguring (430) the elevator safety system from the first configuration (111) of the elevator safety system (100) to a second configuration (112), wherein in the second configuration (112) the malfunctioning or failed part is at least functionally eliminated, and Operation of the elevator system (300) is continued (440) using the second configuration (112).

12. The method according to claim 11, comprising: In case it is detected (420) that the malfunction or failure is in one of the at least two processing units (11A, 11B) of the safety controller, at least another processing unit of the at least two processing units (11A, 11B) is utilized in the second configuration (112) while at least functionally excluding the malfunctioning or failed processing unit.

13. The method according to claim 11, comprising: In the event that the malfunction or failure is detected (420) in one of the set of safety devices (12A-12D), the elevator safety chain is reconfigured so that the malfunctioning or failed safety device (12A-12D) is excluded from the elevator safety chain in the second configuration.

14. The method according to any one of claims 11 to 13, comprising using the first configuration (111) during normal operating conditions of the elevator system (300).

15. The method according to any one of claims 11 to 14, comprising using the second configuration (112) during restricted operating conditions of the elevator system (300).

16. The method according to claim 15, wherein: The limited operation condition is a short-term operation or a single operation of the elevator system (300).

Images