Modular elevator system with configurable architecture

Abstract

A method and elevator system includes a master module operable in a configuration mode, a detection mode, and an elevator operation mode. When in the configuration mode, at least one sub-module is connectable to the main module, and the sub-module has an initialization mode and an identification mode. At least one activation tool is selectively actuated by a user to activate the detection mode. In response to activation of the detection mode, the master module returns to the configuration mode and initiates communication with the sub-module while in the initialization mode. In response to communication from the master module, the sub-module communicates a plurality of sub-module characteristics to the master module. In response to review and authentication of the plurality of sub-module characteristics, the main module accepts the sub-module as an approved sub-module, and the sub-module enters the identification mode.

Description

BACKGROUND

[0001] An elevator system can include a safety system having a master module that controls safety output actuation. Over time, the safety system can need to provide additional functionality, which will require the addition of additional sub-modules. Typically, this feature is implemented by designing optimized hardware and software at the architecture level. However, when additional modules are required and added, this approach must be subjected to frequent software updates and hardware modifications. SUMMARY

[0002] An illustrative example elevator system includes a master module operable in a configuration mode, a detection mode, and an elevator operation mode; at least one sub-module connectable to the master module in the configuration mode, wherein the at least one sub-module has an initialization mode and an identification mode; at least one activation tool selectively actuated by a user to activate the detection mode, and wherein: in response to activation of the detection mode, the master module returns to the configuration mode and initiates communication with the at least one sub-module while in the initialization mode; in response to communication from the master module, the at least one sub-module communicates a plurality of sub-module characteristics to the master module; and in response to review and authentication of the plurality of sub-module characteristics, the master module accepts the at least one sub-module as an approved sub-module and the at least one sub-module enters the identification mode.

[0003] In further non-limiting embodiments of any of the systems, the at least one sub-module includes a plurality of sub-modules sequentially connectable to the master module.

[0004] In further non-limiting embodiments of any of the systems, the configuration mode includes an initial setup or configuration mode of an elevator.

[0005] In further non-limiting embodiments of any of the systems, once all sub-modules are in the identification mode, the master module enters the elevator operation mode, wherein additional sub-modules are not permitted to be added.

[0006] In further non-limiting embodiments of any of the systems, in response to the user selectively actuating the at least one activation tool, the master module exits the elevator operation mode and enters the detection mode to identify additional sub-modules, and wherein, in response to review and authentication of the plurality of sub-module characteristics of the additional sub-modules, the master module accepts the additional sub-modules as approved sub-modules without any software updates or hardware modifications.

[0007] In further non-limiting embodiments of any of the systems, the master module includes a master safety module having a plurality of safety inputs and at least one safety actuator output, and wherein the at least one sub-module includes a plurality of safety sub-modules each having a unique safety input and safety output that are separately communicated to the master module.

[0008] In further non-limiting embodiments of any of the systems, the plurality of sub-module characteristics includes one or more of: identifier information; authentication information; a total number of inputs and outputs associated with the at least one sub-module.

[0009] In further non-limiting embodiments of any of the systems, once the at least one sub-module is in the identification mode, the master module and the at least one sub-module periodically communicate input / output signal states, and in response to the master module determining that the at least one sub-module fails to provide a requested input / output signal state, the master module shuts down an associated safety output.

[0010] In further non-limiting embodiments of any of the systems, the detection mode is enabled at the master module and includes via a user input of the at least one activation tool, the user input for generating a random output; and in response to the user repeating the random output, the master module enters the detection mode.

[0011] In further non-limiting embodiments of any of the systems, the user input includes a manual operation of an input device, and the random output includes a random pattern of illumination events.

[0012] An illustrative example elevator system includes a master safety module including one or more controllers, the master safety module operable in a configuration mode, a detection mode, and an elevator operation mode, wherein the master safety module has a plurality of safety inputs and at least one safety actuator output; a plurality of safety sub-modules connectable to the master safety module in the configuration mode, wherein each sub-module has an initialization mode and an identification mode, and wherein each safety sub-module has a unique safety input and safety output that is separately communicated to the master safety module; at least one activation tool selectively actuated by a user to activate the detection mode, and wherein: in response to activation of the detection mode, the master safety module returns to the configuration mode and initiates communication with one of the plurality of safety sub-modules while in the initialization mode; in response to the communication from the master safety module, the one safety sub-module communicates a plurality of safety sub-module characteristics to the master safety module; and in response to review and authentication of the plurality of safety sub-module characteristics of the one safety sub-module, the master safety module accepts the one safety sub-module as an approved safety sub-module and the one safety sub-module enters the identification mode.

[0013] In further non-limiting embodiments of any of the systems, each safety sub-module is sequentially connectable to the master safety module.

[0014] In further non-limiting embodiments of any of the systems, the configuration mode includes an initial setup or configuration mode of an elevator, and wherein: in response to all safety sub-modules entering the identification mode, the master safety module enters the elevator operation mode, wherein additional safety sub-modules are not permitted to be added; and in response to the user selectively actuating the at least one activation tool, the master safety module exits the elevator operation mode and enters the detection mode to identify additional safety sub-modules, and wherein, in response to review and authentication of the plurality of safety sub-module characteristics of the additional safety sub-modules, the master safety module accepts the additional safety sub-modules as approved safety sub-modules without any software updates or hardware modifications.

[0015] In further non-limiting embodiments of any of the systems, once the one safety sub-module is in the identification mode, the master safety module and the one safety sub-module periodically communicate input / output signal states, and in response to the master safety module determining that the one safety sub-module fails to provide a requested input / output signal state, the master safety module shuts down an associated safety output.

[0016] An illustrative example method includes providing a master module of an elevator, the master module operable in a configuration mode, a detection mode, and an elevator operation mode; connecting one of a plurality of sub-modules to the master module while in the configuration mode, wherein the plurality of sub-modules have an initialization mode and an identification mode; selectively actuating at least one activation tool to activate the detection mode; responsive to activation of the detection mode, returning the master module to the configuration mode and initiating communication with the one sub-module while in the initialization mode; responsive to the communication from the master module, the one sub-module communicating a plurality of sub-module characteristics to the master module; and responsive to review and authentication of the plurality of sub-module characteristics, the master module accepting the one sub-module as an approved sub-module and the one sub-module entering the identification mode.

[0017] In further non-limiting embodiments of any of the methods, the method includes connecting each sub-module to the master module in sequence.

[0018] In further non-limiting embodiments of any of the methods, the method includes entering the elevator operation mode once all sub-modules are in the identification mode, wherein additional sub-modules are not permitted to be added; responsive to a user selectively actuating the at least one activation tool, exiting the elevator operation mode and entering the detection mode to identify additional sub-modules; and responsive to review and authentication of the plurality of sub-module characteristics of the additional sub-modules, accepting the additional sub-modules as approved sub-modules without any software updates or hardware modifications.

[0019] In further non-limiting embodiments of any of the methods, the method includes periodically communicating input / output signal status from the one sub-module to the master module once the one sub-module is in the identification mode, and responsive to a determination that the one sub-module fails to provide a requested input / output signal status, shutting down an associated safety output.

[0020] In further non-limiting embodiments of any of the methods, the master module includes a master safety module having a plurality of safety inputs and at least one safety actuator output, and wherein the plurality of sub-modules includes a plurality of safety sub-modules each having a unique safety input and safety output and including communicating the safety input and safety output from each safety sub-module separately to the master module.

[0021] In further non-limiting embodiments of any of the methods, the method includes enabling the detection mode at the master module via selective user input to the at least one activation tool for generating a random output; and responsive to a user repeating the random output, entering the detection mode.

[0022] Various features and advantages of the example embodiments will become apparent to those skilled in the art from the following detailed description. The drawings that accompany the detailed description can be briefly described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 Selected portions of an elevator system and associated control system are schematically illustrated.

[0024] Figure 2 A portion of a control system including a modular safety system having a configurable architecture is schematically illustrated.

[0025] Figure 3 An example activation pattern of the modular safety system of Figure 2 is schematically illustrated.

[0026] Figure 4 An example communication protocol between a master module and a sub-module of the modular safety system of Figure 2 is illustrated.

[0027] Figure 5 is a flowchart of an example method of configuring Figure 2 the modular safety system. DETAILED DESCRIPTION

[0028] Embodiments of the present disclosure provide an elevator system having a communication protocol and control system architecture that supports preconfigured sub-modules in a“plug and play” arrangement. In implementations, the communication protocol and control system architecture allow preconfigured sub-modules to be simply plugged in and detected without requiring software updates in order to add the sub-modules to the system.

[0029] Figure 1 Selected portions of an elevator system 20 are schematically illustrated. An elevator car 22 is supported by a roping arrangement or suspension assembly 24 that includes a plurality of suspension members 26. In one example, the elevator system 20 is a traction-based system in which a controller of a control system C controls operation of a machine 16 to cause selected movement of the elevator car 22. The elevator car 22 is coupled to a counterweight 28 by the suspension members 26. The suspension members 26 are driven by the machine 16 about a traction sheave 30, as well as any additional deflector sheaves 18, as the elevator car 22 moves between landings or levels within a hoistway 32. The hoistway 32 can be located in various locations within a building depending on the building configuration, and includes a plurality of walls 34.

[0030] In implementations, the present disclosure provides a factory process configuration to provide a control system by connecting one or more sub-modules to a master module of an elevator system. The sub-modules can be any type of sub-module that would be suitable for use in an elevator control system.

[0031] In one example shown in Figure 2 , the control system includes a modular system 40 that allows for the addition or removal of sub-modules as part of the factory configuration. This includes the combination of a set of multi-purpose sub-modules to create a wide range of system architectures. This is because it is important to define and protect the system architecture at the factory level, thereby linking it with approved and certified configurations.

[0032] In implementations, it can also be possible to add additional sub-modules at the construction site. This type of arrangement can include a plug-and-play system at the site.

[0033] In implementations, the example control system C includes a safety system 40 Figure 2 that has a master module 42 that can house various safety inputs 44 and is responsible for activating and deactivating one or more safety outputs 46 of the elevator system, such as safety actuation.

[0034] In implementations, one or more sub-modules 48 are connected to the master module 42 via a network 50. In one example, the network 50 includes CAN or Ethernet; however, other networks can also be used. In implementations, the one or more sub-modules 48 are added during a configuration mode during setup of the elevator system during construction of the building.

[0035] Over time, the system can require additional input signals or bypass functions, which can be added as additional sub-modules 48. Thus, the system 40 is configured to accept any number of modules, such as N+1.

[0036] In implementations, the present disclosure enables the addition of additional sub-modules 48 in operation by following a specific procedure, where the master module 42 retains additional safety module information and continuously monitors the health status and safety input status of each of the sub-modules 48.

[0037] In implementations, the master safety module 42 has a special mode for identifying the addition of safety sub-modules 48 and the associated safety input status.

[0038] Figure 2 The master module 42 is shown schematically, and in implementations, the master module 42 is operable in at least a configuration mode, a detection mode, and an elevator operation mode.

[0039] In one example, when the master module 42 is in the configuration mode, at least one sub-module 48 is connectable to the master module 42. Each sub-module 48 has at least an initialization mode and an identification mode.

[0040] In one example, at least one activation tool 52 is selectively actuated by a user 54 to activate the detection mode, asFigure 3 The configuration mode is illustrated in FIG. 4.

[0041] In implementations, in response to activation of the detection mode, the master module 42 returns to the configuration mode and initiates communication with the sub-modules 48 while in the initialization mode.

[0042] In implementations, in response to the communication from the master module 42, the sub-modules 48 communicate a plurality of sub-module characteristics to the master module 42.

[0043] In implementations, the plurality of sub-module characteristics can include one or more of identifier information, authentication information, a total number of inputs and outputs associated with the at least one sub-module, etc.

[0044] In implementations, in response to review and authentication of the plurality of sub-module characteristics, the master module 42 accepts the sub-modules 48 as approved sub-modules and the sub-modules enter the identification mode.

[0045] In implementations, each sub-module is sequentially connectable to the master module 42. In other words, while the master module 42 is in the configuration mode, each sub-module 48 is connected one after another in sequence until all of the sub-modules 48 have been connected.

[0046] In one example, the configuration mode includes an initial setup or build-out mode for the elevator system 20. For example, when the elevator 22 is installed within a building, the master module 42 is installed and then powered on. Then, a first sub-module 48a is connected to the master module 42 and undergoes a verification process. Once the first sub-module 48a is verified, a second sub-module 48b is subsequently connected and undergoes a verification process. Once the second sub-module 48b is verified, an additional sub-module 48c is subsequently connected and undergoes a verification and registration process / mode. This process continues until all of the sub-modules have been connected and verified / identified.

[0047] In implementations, the master module 42 will maintain a record of registered devices until a subsequent registration mode is initiated, which prevents accidental deletion of registered modules within the security system. Further, during the registration mode, the master module 42 will not only check and validate new device registrations, but also monitor regular messages from each device for validation. If a regular message is not received, the system will initiate deletion of the corresponding device. Upon completion of the registration process, the master module 42 will visually indicate the total count of registered devices by flashing or using a light source 68 (see FIG. 1), such as an LED indicator. Figure 3

[0048] ​In implementations, once all of the sub-modules 48 are in the identified mode, the master module 42 enters an elevator operation mode in which the elevator system 20 is normally operated by transporting passengers and cargo between various landings in the building. In implementations, when the elevator is in the elevator operation mode, additional sub-modules 48 are not permitted to be added, e.g., the control system is in a lockout mode to prevent any additional modules from being added without specific authorization.

[0049] However, as noted above, over time, additional sub-modules 48 can need to be added to provide additional functionality. In implementations, in response to a user or mechanic 54 selectively actuating the activation tool 52, the master module 42 exits the elevator operation mode and enters a detection mode to identify additional sub-modules 48. In response to review and authentication of a plurality of sub-module characteristics of the additional sub-modules, the master module 42 accepts the additional sub-modules as approved sub-modules. This acceptance occurs without any software updates or hardware modifications, which reduces the time and cost to add increased functionality.

[0050] In implementations, for example, after the sub-modules 48 installed during the factory process are operated in the elevator operation mode, it can be determined that two additional sub-modules 48 should be added. Alternatively, after the factory installation process has been completed, but before field operation, it can be determined that two additional sub-modules 48 should be added. In either example, the mechanic would then activate the detection mode and add a first new sub-module 48 to the system. The system would detect the first new sub-module 48 and then review, authenticate, and identify / register the first new sub-module 48.

[0051] In one example, once registered, the system can automatically return to the operation mode in which new sub-modules cannot be added. Thus, to add a second new sub-module 48, the mechanic would have to repeat the above process, e.g., the mechanic would have to re-activate the detection mode.

[0052] In another example, when more than one sub-module 48 is to be added, the system can be configured to require the mechanic to deactivate the detection mode once all of the new sub-modules 48 have been added, and then the system can automatically return to the operation mode or the mechanic can re-activate the operation mode. In implementations, once each sub-module 48 is in the identified mode, the master module 42 and the sub-modules 48 periodically communicate regarding the input / output signal states, and in response to the master module determining that a sub-module 48 fails to provide a requested input / output signal state, the master module 42 shuts down an associated safety output.

[0053] In implementations, as Figure 2As shown in FIG. 1, the main module 42 includes a main safety module having a plurality of safety inputs 44 and at least one safety actuator output 46. In implementations, at least some of the sub-modules 48 include safety sub-modules each having a unique safety input 56 and safety output 58 that are separately communicated to the main module 42 via the network 50.

[0054] Figure 3 An example is shown of how to activate the detection mode by activating a tool 52 (e.g., a button, a rotary switch, a lever, a screen interface, a smart device) to avoid any unpermitted activation. This activation method allows the main module to recognize additional safety sub-modules and associated safety inputs without requiring any software modification. In other words, the system provides for simple plug-and-detect.

[0055] Accordingly, the detection mode is designed to detect additional safety systems so that they can be added to the configuration without requiring software changes. Once additional sub-modules are added, the main safety module will periodically check the associated health status of the sub-modules. If the sub-module cannot provide the requested information, the main safety module 42 will shut down the associated safety output.

[0056] In one example, to activate the detection mode, a user 54 (e.g., a mechanic or technician) is the person that enables the mode. This selective manual input helps to prevent the addition of unpermitted sub-modules. In implementations, the user 54 can enable the detection mode from the main safety module 42 by following a particular sequence.

[0057] For example, the detection mode includes a user input via the activation tool 52 to generate a random output 60. In implementations, in response to the user 54 repeating the random output, the main module 42 enters the detection mode.

[0058] In one example, the user input includes a manual operation of an input device (e.g., a button, a screen interface, etc.) and the random output includes a random pattern of illumination events.

[0059] For example, the user can initiate the detection mode by holding one or more buttons 62 for an extended period of time, or can use a menu 64 on a touchscreen or control panel 66 of the tool 52. The buttons 62 and / or menu 64 can be associated with the control panel 66, which can be part of the main module 42. In one example, the control panel 66 can also be associated with one or more light sources 68 (e.g., LEDs or other similar types of lights).

[0060] In one example, to verify the user's intent to enable the detection mode, the system displays a randomly generated flashing pattern on the display (e.g., 0 = short off, and 1 = short on: starts with 1; ends with 1; and has a specified number of random values in between, ensuring that no consecutive 1s or 0s occur more than the desired number of times) through the light source 68 as observed 70. The user 54 then enters the same pattern using the buttons or screen interface (see 72), and if the user input matches the system's query message (e.g., the randomly generated flashing pattern), the display flashes / illuminates in a predefined pattern indicating that the detection mode is activated. Thus, the user's intent to activate the detection mode is verified.

[0061] In implementations, once the detection mode is activated, the control board 66 monitors the communication channel, comparing newly identified sub-module IDs to previously identified sub-module IDs. When a new ID is identified, the module initiates a registration process.

[0062] In implementations, as long as the sub-modules follow a predefined message template, the master module 42 will recognize messages from newly added sub-modules 48. Upon detecting a new, added sub-module, the security module will store the new device information into memory (e.g., EEPROM) to ensure that the module does not lose its slave module information during a power cycle or reset event.

[0063] Figure 4 A sequence diagram illustrating details of the master module 42 and sub-modules 48 verifying each other's identification and the security signal information of the associated sub-modules is shown. When a new sub-module 48 is added and powered on, the sub-module is in an initialization mode. After the master module 42 has exited the detection mode and reentered the configuration mode, and while the sub-module is in the initialization mode, the master module 42 has realized that there is a new sub-module 48, which then communicates a unique message back to the master module 42 identifying the sub-module as a new device and identifying the security inputs to be passed to the master module (see 80). For example, the new sub-module 48 can communicate an identification code, an authentication, and a total number of security inputs / outputs.

[0064] The master module 42 then receives the message, and the master module 42 reviews the information, and if the information is verified, the master module 42 responds with a master module authentication, as indicated at 82.

[0065] Next, the sub-module then communicates additional information, including the identification code, the total number of security inputs / outputs, and a non-secure status value, as indicated at 84.

[0066] The master module 42 then receives the additional information, and after verification, the master module communicates a confirmation ID and repeats the total number of security inputs / outputs and the non-secure status value, as indicated at 86.

[0067] The master module 42 then stores the new sub-module ID and the number of inputs / outputs and the safety status value as indicated at 88. The sub-module 48 then stores the master module ID as indicated at 90.

[0068] Finally, after the sub-module has been verified, the sub-module enters the identification mode and the sub-module 48 periodically communicates the safety input / output status as indicated at 92. This allows the master module 42 to monitor the health of each of the sub-modules.

[0069] In implementations, the control system C and associated safety system 40 can include one or more controllers that can include a processor, a memory, and one or more input and / or output (I / O) device interfaces that are communicatively coupled via a local interface. The local interface can include, for example and without limitation, one or more buses and / or other wired or wireless connections. A controller can include hardware devices (e.g., a custom-made or off-the-shelf processor, central processing unit (CPU), co-processor in a plurality of processors associated with a computing device, semiconductor-based microprocessor (in the form of a microchip or chip set), or generally any device for executing software instructions) for executing software (particularly software stored in the memory). The controller can be a custom-made or off-the-shelf processor, central processing unit (CPU), co-processor in a plurality of processors associated with a computing device, semiconductor-based microprocessor (in the form of a microchip or chip set), or generally any device for executing software instructions. The memory can include any one or a combination of volatile memory elements (e.g., random access memory) and / or nonvolatile memory elements. The software in the memory can include one or more separate programs, each of which comprises an ordered listing of executable instructions for implementing logical functions. The one or more controllers can be configured to execute software stored in the memory to communicate data to and from the memory, as well as generally control operations of the computing device pursuant to the software.

[0070] In implementations, a method of configuring a safety system 40 can include the following steps as identified in Figure 5

[0071] As indicated at 100, the method can include the step of providing a master module of an elevator, the master module operable in a configuration mode, a detection mode, and an elevator operation mode.

[0072] As indicated at 200, the method can include the step of connecting one of a plurality of sub-modules to the master module while in the configuration mode, wherein the plurality of sub-modules have an initialization mode and an identification mode.

[0073] As indicated at 300, the method can include the step of selectively actuating at least one activation tool to activate the detection mode.

[0074] ​As indicated at 400, the method can include the steps of, in response to activation of the detection mode, causing the master module to return to the configuration mode and initiating communication with the one sub-module while in the initialization mode;

[0075] As indicated at 500, the method can include the steps of, in response to the communication from the master module, the one sub-module communicating a plurality of sub-module characteristics to the master module; and

[0076] As indicated at 600, the method can include the steps of, in response to review and authentication of the plurality of sub-module characteristics, the master module accepting the one sub-module as an approved sub-module and the one sub-module entering an identification mode.

[0077] The method can include any of the following steps, alone or in any combination.

[0078] The method can include connecting each sub-module to the master module in turn.

[0079] The method can include, upon all sub-modules being in the identification mode, entering an elevator operation mode in which additional sub-modules are not permitted to be added; in response to a user selectively actuating at least one activation tool, exiting the elevator operation mode and entering the detection mode to identify additional sub-modules; and in response to review and authentication of a plurality of sub-module characteristics of the additional sub-modules, accepting the additional sub-modules as approved sub-modules without requiring any software updates or hardware modifications.

[0080] The method can include, upon the one sub-module being in the identification mode, periodically communicating input / output signal states from the one sub-module to the master module and, in response to a determination that the one sub-module fails to provide a requested input / output signal state, shutting down an associated safety output.

[0081] The method can include, wherein the master module comprises a master safety module having a plurality of safety inputs and at least one safety actuator output, and wherein the plurality of sub-modules comprises a plurality of safety sub-modules each having a unique safety input and safety output, and the method further comprises communicating the safety inputs and safety outputs from each safety sub-module separately to the master module.

[0082] The method can include, enabling the detection mode at the master module via selective user input to at least one activation tool for generating a random output and, in response to the user repeating the random output, entering the detection mode.

[0083] The foregoing description is exemplary rather than limiting in nature. Variations and modifications to the disclosed examples can become apparent to those skilled in the art upon access to the present disclosure. The legal scope of the present application is set by the below claims.

Claims

1. An elevator system, comprising: The main module is operable in configuration mode, detection mode and elevator operation mode; At least one submodule, which can be connected to the main module in the configuration mode, wherein the at least one submodule has an initialization mode and an identification mode; At least one activation tool, said activation tool being selectively actuated by a user to activate the detection mode, wherein: In response to the activation of the detection mode, the main module returns to the configuration mode and initiates communication with the at least one sub-module while in the initialization mode; In response to communication from the main module, the at least one submodule transmits multiple submodule features to the main module; and In response to the review and authentication of the characteristics of the plurality of submodules, the main module accepts at least one submodule as an approved submodule, and the at least one submodule enters the identification mode.

2. The elevator system according to claim 1, wherein, The at least one submodule includes multiple submodules, which can be sequentially connected to the main module.

3. The elevator system according to claim 2, wherein, The configuration modes include the elevator's initial setup or construction mode.

4. The elevator system according to claim 3, wherein, Once all submodules are in the recognition mode, the main module enters the elevator operation mode, in which adding additional submodules is not permitted.

5. The elevator system according to claim 3, wherein, In response to the user selectively activating the at least one activation tool, the main module exits the elevator operation mode and enters the detection mode to identify the additional submodule, wherein, in response to the review and certification of the multiple submodule characteristics of the additional submodule, the main module accepts the additional submodule as an approved submodule without any software update or hardware modification.

6. The elevator system according to claim 1, wherein, The main module includes a main safety module having multiple safety inputs and at least one safety actuator output, and wherein the at least one sub-module includes multiple safety sub-modules, each having a unique safety input and safety output that are separately passed to the main module.

7. The elevator system according to claim 1, wherein, The multiple submodule characteristics include one or more of the following: Identifier information; Authentication information; The total number of inputs and outputs associated with the at least one submodule.

8. The elevator system according to claim 1, wherein, Once the at least one submodule is in the identification mode, the main module and the at least one submodule periodically transmit input / output signal status, and in response to the main module determining that the at least one submodule has failed to provide the requested input / output signal status, the main module disables the associated security output.

9. The elevator system according to claim 1, wherein: The detection mode is enabled at the main module and includes user input via the at least one activation tool, the user input being used to generate random output; as well as In response to the user repeating the random output, the main module enters the detection mode.

10. The elevator system according to claim 9, wherein, The user input includes manual operation of the input device, and the random output includes random patterns of lighting events.

11. An elevator system, comprising: The main safety module includes one or more controllers. The main safety module is operable in configuration mode, detection mode and elevator operation mode. The main safety module has multiple safety inputs and at least one safety actuator output. Multiple security submodules are connected to the main security module in the configuration mode, wherein each submodule has an initialization mode and an identification mode, and wherein each security submodule has unique security inputs and security outputs that are separately passed to the main security module; At least one activation tool, said activation tool being selectively actuated by a user to activate the detection mode, wherein: In response to the activation of the detection mode, the main security module returns to the configuration mode and, while in the initialization mode, initiates communication with one of the multiple security submodules. In response to communication from the main security module, the one security submodule transmits multiple security submodule features to the main security module; and In response to the review and authentication of the characteristics of the plurality of security submodules of the one security submodule, the main security module accepts the one security submodule as an approved security submodule, and the one security submodule enters the identification mode.

12. The elevator system according to claim 11, wherein, Each security submodule can be sequentially connected to the main security module.

13. The elevator system according to claim 11, wherein, The configuration modes include the elevator's initial setup or construction mode, and wherein: In response to all safety submodules entering the identification mode, the main safety module enters the elevator operation mode, in which the addition of additional safety submodules is not permitted; and In response to the user selectively activating the at least one activation tool, the main safety module exits the elevator operation mode and enters the detection mode to identify additional safety submodules, wherein, in response to the review and certification of the multiple safety submodule characteristics of the additional safety submodules, the main safety module accepts the additional safety submodules as approved safety submodules without any software updates or hardware modifications.

14. The elevator system according to claim 11, wherein, Once a security submodule is in the identification mode, the main security module and the security submodule periodically transmit input / output signal status, and in response to the main security module determining that the security submodule has failed to provide the requested input / output signal status, the main security module disables the associated security output.

15. A method comprising: A main module for an elevator is provided, which is operable in configuration mode, detection mode and elevator operation mode; When in the configuration mode, one of the multiple submodules is connected to the main module, wherein the multiple submodules have an initialization mode and an identification mode; Selectively actuate at least one activation tool to activate the detection mode; In response to the activation of the detection mode, the main module returns to the configuration mode and initiates communication with the sub-module while in the initialization mode; In response to communication from the main module, the submodule passes multiple submodule features to the main module; and In response to the review and authentication of the characteristics of the plurality of submodules, the main module accepts one of the submodules as an approved submodule, and the one submodule enters the identification mode.

16. The method of claim 15, further comprising connecting each submodule sequentially to the main module.

17. The method of claim 15, comprising: Once all submodules are in the recognition mode, the elevator operation mode is entered, in which adding additional submodules is not allowed; In response to the user selectively activating the at least one activation tool, the elevator operation mode is exited and the detection mode is entered to identify the additional sub-module; as well as In response to the review and certification of the characteristics of the plurality of submodules of the additional submodule, the additional submodule is accepted as an approved submodule without any software updates or hardware modifications.

18. The method according to claim 15, wherein, Once a submodule is in the identification mode, it periodically transmits the input / output signal status from the submodule to the main module, and in response to the submodule failing to provide a determination of the requested input / output signal status, it disables the associated security output.

19. The method according to claim 15, wherein, The main module includes a main safety module having multiple safety inputs and at least one safety actuator output, and wherein the multiple sub-modules include multiple safety sub-modules, each having unique safety inputs and safety outputs, and include separately transmitting the safety inputs and safety outputs from each safety sub-module to the main module.

20. The method of claim 15, comprising: The detection mode is enabled at the main module via selective user input to the at least one activation tool for generating random output; as well as In response to the user repeating the random output, the system enters the detection mode.

Images