Safety management and control method and system outside elevator hall and computer readable storage medium

Abstract

The invention provides a safety management and control method and system outside an elevator hall and a computer readable storage medium, and relates to the technical field of elevator safety. The management and control method comprises the following steps: identifying the state of a feedback signal of each layer of buttons; the floor corresponding to the button with the abnormal feedback signal is calibrated as an inspection layer, wherein the feedback signal abnormity comprises that no signal exists after a preset time period or the signal frequency exceeds a preset value in a preset time period; and when the elevator runs to the inspection layer, the elevator door is controlled to be kept in an open state. The risk of abnormal closing of floors can be actively recognized, and safety blind areas of scenes such as building construction and decoration transition periods are filled up; a sensor does not need to be newly added, an existing communication link and MPU resources are reused, and high robustness, low invasiveness and high engineering implementability are achieved; and the scheduling efficiency is considered while the trapped person is ensured to be rescued in time.

Description

Technical Field

[0001] This invention relates to the field of elevator safety technology, and in particular to a method, system, and computer-readable storage medium for safety management outside elevator halls. Background Technology

[0002] In elevator systems, the hall call box (external call) is a crucial human-machine interface for passengers to initiate elevator requests. To ensure the reliability of the external call function, existing technologies generally employ a simple fault detection mechanism based on static time thresholds. For example, some manufacturers configure an "external call button stuck detection" function: when an external call button on a certain floor continuously outputs a valid signal for more than 5 minutes, the main processing unit (MPU) determines that it is in a mechanical stuck or electrical short-circuit state and records the corresponding fault code; this type of fault only serves as a maintenance reminder, does not trigger real-time response actions, and does not interfere with the elevator's current operating logic.

[0003] However, such detection mechanisms have significant technical blind spots: their design is only intended to address equipment malfunctions (such as physical button adhesion or electrical leakage), and they cannot identify and respond to safety risks caused by sudden changes in the environmental state at different floor levels. In practice, newly built or renovated buildings are often under phased construction before delivery. Although some floors have completed elevator shaft and car installation, they may be physically closed off by the construction unit (such as blocking hall doors, removing call boxes, or disconnecting external call power supply) due to incomplete decoration, failure to pass fire safety inspection, or temporary safety control needs. In this case, if the external call device has been removed or its power supply is interrupted, the status signal it sends to the MPU will completely disappear; if only the hall door is blocked but the external call is still powered, there may be situations where there is no feedback for a long time after the button is accidentally pressed, or the signal frequency may be abnormal due to repeated testing by construction personnel. In the above scenarios, the external call signal presents a non-faulty abnormality (i.e., not caused by equipment damage, but by forced environmental intervention), but the existing detection logic cannot distinguish between this type of abnormality and normal idle state (such as no passenger operation for a long time), so it will neither trigger an alarm nor initiate any active intervention measures.

[0004] This leads to a pressing technical problem: when passengers mistakenly take the elevator to an enclosed floor due to navigation errors, unclear signage, or delayed information, and fail to return before the car doors close, they will be trapped in the enclosed space due to blocked hall doors, missing call boxes, or communication interruptions, posing a serious safety hazard. This problem stems from the lack of dynamic modeling capabilities in current technology to understand the relationship between the spatiotemporal behavior of call signals and the actual availability of floors, as well as the absence of a corresponding automated response mechanism to proactively identify and control the handling of at-risk floors. Summary of the Invention

[0005] The purpose of this invention is to provide a method, system, and computer-readable storage medium for safety management outside elevator lobbies, in order to solve the safety hazard of passengers being trapped after mistakenly entering an enclosed floor.

[0006] In a first aspect, the elevator hall safety control method provided by the present invention includes the following steps: Identify the status of feedback signals from buttons on each layer; The floor corresponding to the button with abnormal feedback signal is marked as the inspection floor. The abnormal feedback signal includes no signal for a preset time or the signal frequency exceeding a preset value within a preset time period. When the elevator reaches the inspection floor, the elevator door is kept open.

[0007] In conjunction with the first aspect, the present invention provides a first possible implementation of the first aspect, wherein the elevator hall safety control method further includes: When the elevator is at the inspection floor and the elevator door remains open, if a call signal from another floor is received, the elevator will be controlled to run to the corresponding floor.

[0008] In conjunction with the first possible implementation of the first aspect, the present invention provides a second possible implementation of the first aspect, wherein the elevator hall safety control method further includes: If there is a floor that is marked as being inspected due to the signal frequency exceeding a preset value within a preset time period, after completing the call command for another floor, the elevator is controlled to return to the inspected floor, and the elevator door is controlled to remain open.

[0009] In conjunction with the first aspect, the present invention provides a third possible implementation of the first aspect, wherein identifying the state of the feedback signals of each layer of buttons includes: The trigger signals of the external call buttons on each layer are obtained at a preset period. The preset period is a configurable time interval between 20ms and 100ms.

[0010] In conjunction with the third possible implementation of the first aspect, the present invention provides a fourth possible implementation of the first aspect, wherein the determination of no signal exceeding the preset duration includes: A certain call button on a certain floor fails to generate a valid trigger signal within N consecutive preset cycles, where N≥50.

[0011] In conjunction with the third possible implementation of the first aspect, the present invention provides a fifth possible implementation of the first aspect, wherein the determination of the signal frequency exceeding the preset value within the preset time period includes: A certain external call button continuously generates a trigger signal within M consecutive preset cycles, where M≥7500; The number of trigger signals generated by a certain external call button within a unit time T exceeds the threshold K, where T=1s and K≥5 times.

[0012] In conjunction with the first aspect, the present invention provides a sixth possible implementation of the first aspect, wherein a timer is synchronously started while the elevator door remains open; If no call signal is received from another layer after the timer reaches the preset duration L, then it is re-evaluated whether the layer is still an inspection layer. Where L is a configurable time between 30s and 300s.

[0013] Secondly, the elevator hall safety control system provided by the present invention includes: The external call status acquisition unit is configured to acquire the status signals of the external call buttons on each floor in real time and send them to the central processing unit at a preset period. The central processing unit is configured to execute the aforementioned elevator hall safety control method, identify the inspected floors and generate elevator operation instructions and door control instructions; The elevator operation control unit is configured to respond to the operation command and dispatch the traction system to move the car to the corresponding floor. The door control execution unit is configured to respond to the door control command, control the hall door and car door to open and maintain the open state.

[0014] In conjunction with the second aspect, the present invention provides a first possible implementation of the second aspect, wherein the system further includes a human-computer interaction unit configured to output voice prompts during a stay at the inspection layer.

[0015] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the elevator hall safety control method as described in the first aspect.

[0016] The embodiments of this invention bring the following beneficial effects: It can proactively identify and respond to potential risks of floor closure, enabling timely detection and rescue of personnel who have mistakenly entered closed floors, significantly improving the inherent safety level of the elevator system during construction transitions or temporary floor closure scenarios. Unlike existing technologies that passively record "button stuck" faults and rely on manual post-incident troubleshooting, this solution samples the feedback signals from external call buttons in real time, dynamically judging signal loss (e.g., prolonged no response, indicating the call box has been removed or power is off) or persistent abnormal signals (e.g., prolonged inactivity, indicating physical obstruction or short circuit). This intelligently infers that the floor is in an abnormally closed state and automatically triggers elevator inspection actions. After completing its current task, the elevator prioritizes running to the "inspection floor" and remains open. This mechanism shifts safety control from "post-fault handling" to "intervention at the first sign of risk," filling the safety blind spots of traditional elevator control systems in high-risk stages such as before building handover and during the decoration period.

[0017] This solution boasts strong robustness, low invasiveness, and engineering feasibility: it requires no additional infrared, camera, or door magnetic sensors, fully utilizing the elevator's existing external call communication link and MPU processing capabilities; its judgment logic is based on signal timing characteristics (duration, frequency), exhibiting strong anti-interference capabilities and effectively distinguishing between genuine closure (no signal), malicious obstruction (constant signal), and transient jitter; the door-opening response strategy balances safety and operational efficiency, providing trapped personnel with a clear and stable escape route while immediately restoring dispatch upon a new call, avoiding prolonged idle delays that impact overall service performance. Therefore, this solution achieves automated closed-loop management of significant personal safety risks with minimal hardware and software modification costs, demonstrating outstanding substantive features and significant progress.

[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the specific embodiments or related technologies of the present invention, the drawings used in the description of the specific embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating the elevator lobby safety control method provided in an embodiment of the present invention; Figure 2 This is a partial flowchart of the elevator hall safety management method provided in an embodiment of the present invention. Detailed Implementation

[0021] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used only to describe differences in name and should not be construed as indicating or implying relative importance. Physical quantities in formulas, unless otherwise specified, should be understood as basic quantities in the International System of Units (SI), or derived quantities derived from basic quantities through mathematical operations such as multiplication, division, differentiation, or integration.

[0023] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0024] like Figure 1 and Figure 2 As shown, an embodiment of the present invention provides a method for safety management outside an elevator lobby, which includes the following steps: Identify the status of feedback signals from buttons on each layer; The floor corresponding to the button with abnormal feedback signal is marked as the inspection floor. Abnormal feedback signal includes no signal for more than a preset time or the signal frequency exceeding the preset value within a preset time period. When the elevator reaches the inspection floor, keep the elevator door open.

[0025] In a feasible implementation, the system uses a 40ms sampling period as the baseline (this period can be adjusted online via the MPU parameter configuration interface within the range of 20ms–100ms). The external call electronic board on each floor continuously monitors the physical on / off status of its corresponding call button and encapsulates the digitized high and low level signals (effective trigger defined as "active low," duration ≥5ms to filter out jitter) into status frames. These frames are then sent to the elevator mainboard (MPU) every 40ms via the CAN bus (or RS-485, depending on the existing elevator communication protocol). The MPU has a built-in status buffer that maintains a 1000-byte circular signal queue for each floor (covering approximately 40 seconds of history) and updates the latest status values ​​in real time.

[0026] The MPU executes the following anomaly detection logic: If a floor does not receive any valid trigger signal within N=50 consecutive sampling periods (i.e., all messages in the queue are marked as "invalid"), and there are currently no registered operation calls (including internal and external calls) for that floor, it is determined to be a "long-term no-signal anomaly" and the floor is designated as an "inspection floor". If a floor maintains a valid trigger signal for M=7500 consecutive sampling periods (i.e., all messages in the queue are marked as "valid"), or accumulates ≥K=5 valid signals within a unit time window of T=1s (e.g., construction workers repeatedly tapping buttons to test), and there are no valid internal or external call registrations for that floor, it is determined to be a "high-frequency / constant signal anomaly" and is also designated as an "inspection floor".

[0027] Once calibration is complete, the MPU immediately records "floor number and its external call signal are abnormal, and it has been set as an inspection floor" in the fault log and enters the dispatch intervention process: After all currently registered calls (including in-car selection and external calls to other floors) have been responded to, the inspection floor is added to the first position of the highest priority idle dispatch queue; when the elevator is in an idle state (i.e., no calls are waiting to be responded to, the car door is closed, and the position is stable), the MPU sends a running command to the traction control system to drive the car to run at the rated speed to the level position of the inspection floor; after arriving at the position, the MPU simultaneously sends a "keep door open" command to the door operator electronic board (not pulsed, but continuously outputting a high level to keep the door operator in the electromagnetic lock released state) and starts the door open holding timer (initial value L=120s, configurable).

[0028] Furthermore, the safety control methods outside the elevator hall also include: when the elevator is on the inspection floor and the elevator door is open, if a call signal is received from another floor, the elevator will be controlled to run to the corresponding floor.

[0029] Once the elevator has reached the inspection floor and entered the "keep door open" state, the MPU continuously monitors external call signals and in-car selection signals from all floors. If a valid call signal (including same-direction / reverse external call or in-car selection) is received from any other floor during the door-open holding period (i.e., before the timer expires), the MPU immediately terminates the current door-open holding logic, resets the timer, and inserts the newly called floor into the dispatch queue; simultaneously, it sends a standard "close door" command to the door operator's electronic board. After the door is fully closed, the car is driven to the new target floor along the optimal path. This mechanism ensures seamless switching between "rescue standby" and "normal service," preventing empty-load delays.

[0030] Furthermore, the safety control method outside the elevator hall also includes: if there is an inspection floor marked due to the signal frequency exceeding the preset value within a preset time period, after completing the call command for another floor, control the elevator to return to the inspection floor and control the elevator door to remain open.

[0031] If a floor is designated as an inspection floor due to ≥5 triggers within a unit time T=1s (typically due to frequent testing by construction workers), the MPU, after completing all currently registered calls (including invalid calls that may have been mistakenly triggered by the floor itself), will forcibly re-add it to the end of the scheduling queue and prioritize the "return to inspection floor, door open and hold" action during idle periods. This design prevents the inspection status from being cleared due to brief misoperations, ensuring a robust response to scenarios involving continuous human interference. For example, if a button on a renovation floor is stuck shut with tape, the system will inspect and open the door upon initial identification; if the button subsequently loosens due to vibration and returns to normal, the MPU will still return to confirm in the next idle cycle until no signal abnormalities are found after 3 consecutive inspections, at which point the inspection mark will be removed.

[0032] In an optional implementation, identifying the status of the button feedback signal of each layer includes: acquiring the trigger signal of the external call button of each layer at a preset period; the preset period is a configurable time interval between 20ms and 100ms.

[0033] Specifically, the external call board incorporates an STM32F407 microcontroller, whose GPIO ports connect to the button's mechanical contacts. Configured as a pull-up input (VCC=5V, pull-up resistor 10kΩ), it eliminates contact bounce through a hardware debouncing circuit (RC filter + 10ms software delay). The MCU uses a 40ms baseline timer interrupt (SysTick), scanning all button ports in each interrupt and encoding the status into a 1-byte data frame (bit0–bitN corresponding to layers 1–N). This frame is then packaged and sent to the elevator mainboard via a CAN controller (model TJA1050). The MPU employs a double-buffered reception mechanism to ensure no signal loss during the 40ms cycle. This cycle can be dynamically configured by field engineers via the MPU HMI interface to 20ms (high-sensitivity scenario) or 100ms (anti-interference scenario for older lines). Configuration parameters are stored in EEPROM and are retained even after power loss.

[0034] Furthermore, the determination of no signal exceeding the preset time period includes: a certain floor's external call button fails to generate a valid trigger signal within N consecutive preset cycles, where N≥50 (i.e., no valid signal for 2000ms). The continuous invalid sampling cycle counter increments by 1 each time an invalid signal is received and resets to zero upon receiving a valid signal.

[0035] In an optional implementation, the determination of whether the signal frequency exceeds a preset value within a preset time period includes: If a certain floor's external call button continuously generates a trigger signal within M consecutive preset cycles, where M≥7500, it is determined to be "button physically stuck or circuit short-circuited", and the inspection floor is calibrated. If the number of trigger signals generated by the call button on a certain floor exceeds the threshold K within a unit time T, where T = 1s and K ≥ 5 times, the floor inspection calibration is triggered, and the trigger time is recorded for subsequent analysis (such as determining whether it is a regular construction test). Both of the above scenarios must meet the premise that "there is currently no valid call on this floor" to avoid confusion with genuine elevator calls.

[0036] In addition, a timer is started synchronously while the elevator door remains open. If no call signal is received from another floor after the timer reaches a preset duration L, the floor is re-evaluated to determine if it is still a patrol floor. L is a configurable time between 30 and 300 seconds. The timer uses an independent RTC module (not the main CPU clock, to prevent infinite loop failure) and continuously monitors for call signals before the timeout. If no new call is received after the timeout, the MPU executes the following: sends a standard door-closing command to the door operator's electronic board; reads the signal sequence of the most recent 1000 cycles for that floor again; if the feedback signal anomaly is still met, the floor is re-marked as a patrol floor and the door is opened again; if the signal has returned to normal (e.g., power is restored after construction), the patrol mark is cleared, and the system switches to regular monitoring. This mechanism forms a closed-loop safety mechanism of detection, intervention, verification, and re-intervention, preventing missed safety measures due to single misjudgments.

[0037] This invention also provides an elevator hall safety control system comprising: an external call status acquisition unit configured to acquire status signals of external call buttons on each floor in real time and send them to a central processing unit at a preset period; a central processing unit configured to execute the elevator hall safety control method described in the above embodiments, identify the inspected floors and generate elevator operation instructions and door control instructions; an elevator operation control unit configured to respond to the operation instructions and dispatch the traction system to move the car to the corresponding floor; and a door control execution unit configured to respond to the door control instructions, control the opening of the hall door and car door and maintain the open state.

[0038] The elevator's external call status acquisition unit consists of N distributed external call electronic boards (N = number of floors). Each board integrates a signal conditioning circuit (Schmitt trigger shaping), an MCU (STM32F407), and a CAN communication module. It supports active reporting at a 40ms cycle and also supports MPU polling (compatible with old elevator retrofits). The central processing unit, i.e., the elevator motherboard (MPU), is based on an ARM Cortex-A9 dual-core processor, runs a customized RTOS (such as Zephyr), and has a built-in signal analysis engine (including a ring buffer, sliding window statistics, and multi-condition criterion FSM). It features fault code generation (compliant with EN81-20 standard format), log storage (SD card / Flash), and remote parameter configuration. The elevator operation control unit sends operation commands to the traction inverter (such as Yaskawa A1000) via the CANopen protocol, including the target floor, running direction, and acceleration / deceleration curve selection. It supports precise leveling (±1mm error). The door control execution unit consists of a door operator electronic board (based on DSP). The TMS320F28034 receives the "keep door open" command from the MPU and maintains the door motor current through PID control to ensure a constant opening torque. It also integrates door zone sensor feedback to prevent the door from holding open if it is not fully open. All units are interconnected via an industrial-grade CAN bus with a communication rate of 500kbps, and feature automatic retransmission of error frames and node fault isolation capabilities.

[0039] Furthermore, the elevator hall safety control system also includes a human-machine interface (HMI) unit, which is configured to output voice prompts during its stay on the inspection floor. The HMI unit hardware includes a voice broadcast module (including a DAC, power amplifier, and speaker) installed on the top of the car, driven by the car's electronic board (based on ESP32-WROVER). After the MPU calibrates the inspection floor and issues an opening command, it simultaneously sends a broadcast command frame (including floor number and language ID) to the car's electronic board via the CAN bus. The voice content is a pre-stored TTS (Chinese / English) synthesized voice library, broadcasting: "The elevator is inspecting the [XX] floor; please enter and ride." Safety enhancement: Simultaneously with the broadcast, the car's ceiling light flashes (1Hz), and the LED indicator on the hall's call box remains constantly red, creating a combined audio-visual warning, significantly improving the awareness rate for trapped personnel.

[0040] The present invention also provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it implements the elevator hall safety control method described in the above embodiments. The steps of the elevator hall safety control method can be executed on a corresponding computer device using the computer-readable storage medium, and it has the beneficial effects of the control method, which will not be elaborated here.

[0041] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for safety management and control outside elevator lobbies, characterized in that, Includes the following steps: Identify the status of feedback signals from buttons on each layer; The floor corresponding to the button with abnormal feedback signal is designated as the inspection floor. Abnormal feedback signal includes no signal for a preset time period or the signal frequency exceeding a preset value within a preset time period. When the elevator reaches the inspection floor, the elevator door is kept open.

2. The elevator lobby safety control method according to claim 1, characterized in that, The elevator lobby safety management method also includes: When the elevator is at the inspection floor and the elevator door remains open, if a call signal from another floor is received, the elevator will be controlled to run to the corresponding floor.

3. The elevator lobby safety control method according to claim 2, characterized in that, Also includes: If there is a floor that is marked as being inspected due to the signal frequency exceeding a preset value within a preset time period, after completing the call command for another floor, the elevator is controlled to return to the inspected floor, and the elevator door is controlled to remain open.

4. The elevator lobby safety control method according to any one of claims 1 to 3, characterized in that, The status of the feedback signals from each layer of buttons is identified as follows: The trigger signals of the external call buttons on each layer are obtained at a preset period. The preset period is a configurable time interval between 20ms and 100ms.

5. The elevator lobby safety control method according to claim 4, characterized in that, The conditions under which no signal is detected for a period exceeding the preset time include: A certain call button on a certain floor fails to generate a valid trigger signal within N consecutive preset cycles, where N≥50.

6. The elevator hall safety control method according to claim 4, characterized in that, The determination of whether the signal frequency exceeds the preset value within the preset time period includes: A certain external call button continuously generates a trigger signal within M consecutive preset cycles, where M≥7500; The number of trigger signals generated by a certain external call button within a unit time T exceeds the threshold K, where T=1s and K≥5 times.

7. The elevator lobby safety control method according to claim 1, characterized in that, A timer is started synchronously while the elevator door remains open. If no call signal is received from another layer after the timer reaches the preset duration L, then it is re-evaluated whether the layer is still an inspection layer. Where L is a configurable time between 30s and 300s.

8. An elevator lobby exterior safety control system, characterized in that, include: The external call status acquisition unit is configured to acquire the status signals of the external call buttons on each floor in real time and send them to the central processing unit at a preset period. The central processing unit is configured to execute the elevator hall safety control method as described in any one of claims 1 to 7, identify the inspection floor and generate elevator operation instructions and door control instructions; The elevator operation control unit is configured to respond to the operation command and dispatch the traction system to move the car to the corresponding floor. The door control execution unit is configured to respond to the door control command, control the hall door and car door to open and maintain the open state.

9. The elevator hall exterior safety control system according to claim 8, characterized in that, The system also includes a human-computer interaction unit configured to output voice prompts during the stay at the inspection layer.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the elevator hall safety control method as described in any one of claims 1 to 7.

Images