FAULT CLASSIFICATION IN ELEVATOR SYSTEMS

Abstract

An elevator system (2, 102) includes a drive system (10) including one or more drive components (11, 13) and drive hardware (15) for controlling the supply of power to the one or more drive components (11,13), a safety chain (16) arranged to break and thus interrupt a supply of power to the one or more drive components (11, 13) unless all of one or more safety condition(s) is satisfied; and a control device (12). The control device (12) is arranged to receive drive information from the drive hardware (15) indicative of a drive system fault; to receive safety chain information from the safety chain (16) indicative of a safety chain break; and to detect and classify a fault in the elevator system (2, 102) using the drive information and the safety chain information.

Claims

1. An elevator system (2, 102) comprising: a drive system (10) comprising one or more drive components (11, 13) and drive hardware (15) for controlling the supply of power to the one or more drive components (11, 13); a safety chain (16) arranged to break and thus interrupt the supply of power to the one or more drive components (11, 13), unless all of one or more safety condition(s) is satisfied; and a control device (12) arranged: to receive drive information from the drive hardware (15) indicative of a drive system fault; to receive safety chain information from the safety chain (16) indicative of a safety chain break; and to detect and classify a fault in the elevator system (2, 102) using the drive information and the safety chain information.

2. The elevator system (2, 102) of claim 1, wherein the safety chain is arranged to break and thus interrupt a supply of power to the one or more drive components (11, 13) on reception of a safety chain break command from the control device (12).

3. The elevator system (2, 102) of claim 2, wherein the control device (12) is arranged: to issue a safety chain break command to the safety chain (16) on reception of drive information from the drive hardware (15) indicative of a drive system fault; to measure a time delay between issuing the safety chain break command and receiving safety chain information from the safety chain (16) indicative of a safety chain break; to determine if the time delay is less than a minimum expected propagation time; and if the time delay is less than the minimum expected propagation delay, to classify the fault as a safety chain break.

4. The elevator system (2, 102) of claim 3, wherein the control device (12) is arranged, if the time delay is equal to or greater than the minimum expected propagation delay, to classify the fault as a drive system fault.

5. The elevator system (2, 102) of claim 1, wherein the safety chain (16) comprises a plurality of electrical switches (22) connected in series via a conducting path (24) and arranged to carry an electrical safety chain signal to an end of the conducting path (24), wherein each of the switches (22) is arranged to break the safety chain (16) by interrupting the conducting path (24) unless a respective safety condition is satisfied.

6. The elevator system (2, 102) of claim 5, wherein the safety chain (16) comprises a further switch (23) arranged to break the safety chain (16) by interrupting the conducting path (24) on reception of a safety chain break command from the control device (12).

7. The elevator system (2, 102) of claim 5, wherein the control device (12) is connected to the end of the conducting path (24) and is arranged to detect the presence or absence of the electrical safety chain signal at the end of the conducting path (24), wherein the safety chain information received by the control device (12) indicative of a safety chain break comprises the absence of the electrical safety chain signal at the end of the conducting path (24).

8. The elevator system (2, 102) of claim 7, wherein the control device (12) is connected to the conducting path (24) via one or more filters or amplifiers.

9. The elevator system (2, 102) of claim 5, comprising a power supply switch (20) controlled by the electrical safety chain signal and via which the one or more drive components (11, 13) is supplied with power, wherein the power supply switch (20) is arranged to conduct power only when the safety chain signal is present at the end of the conducting path (24).

10. The elevator system (2, 102) of claim 5, wherein the control device (12) is arranged to receive safety chain information comprising a plurality of measurements of one or more properties of the electrical safety chain signal carried by the safety chain (16).

11. The elevator system (2, 102) of claim 10, wherein the safety chain information comprises a plurality of measurements of one or more continuously variable properties of the electrical safety chain signal.

12. The elevator system (2, 102) of claim 10, wherein the control device (12) is arranged to store safety chain information and to classify retroactively a fault based on stored safety chain information.

13. The elevator system (20, 102) of claim 1, wherein the drive information comprises one or more of a power, current or voltage output of the drive hardware (15).

14. An elevator system (102) comprising: a drive system (10) comprising one or more drive components (11, 13) and drive hardware (15) for controlling the supply of power to the one or more drive components (11, 13); a safety chain (16) comprising a plurality of electrical switches (22) connected in series via a conducting path (24) and arranged to carry an electrical safety chain signal to an end of the conducting path (24), wherein each of the switches (22) is arranged to break the safety chain (16) by interrupting the conducting path (24) unless a respective safety condition is satisfied, wherein breaking the safety chain (16) causes the power supply to the one or more drive components (11, 13) to be interrupted; and a control device (12) arranged: to receive safety chain information comprising a plurality of measurements of one or more properties of the electrical safety chain signal carried by the safety chain (16); to identify a characteristic behaviour of one or more properties of the electrical safety chain signal using the plurality of measurements; and to classify a fault in the elevator system (2, 102) using the identified characteristic behaviour.

15. A method of classifying a fault in an elevator system (102), the elevator system (102) comprising: a drive system (10) comprising one or more drive components (11, 13) and drive hardware (15) for controlling the supply of power to the one or more drive components (11, 13); and a safety chain (16) comprising a plurality of electrical switches (22) connected in series via a conducting path (24) and arranged to carry an electrical safety chain signal to an end of the conducting path (24), wherein each of the switches (22) is arranged to break the safety chain (16) by interrupting the conducting path (24) unless a respective safety condition is satisfied, wherein breaking the safety chain (16) causes the power supply to the one or more drive components (11, 13) to be interrupted; wherein the method comprises: receiving safety chain information comprising a plurality of measurements of one or more properties of the electrical safety chain signal carried by the safety chain (16); identifying a characteristic behaviour of one or more properties of the electrical safety chain signal using the plurality of measurements; and classifying a fault in the elevator system (102) using the identified characteristic behaviour.

Description

DRAWING DESCRIPTION

[0042] One or more non-limiting examples will now be described, by way of example only, and with reference to the accompanying figures in which:

[0043] FIGS. 1 and 2 are schematic views of an elevator system according to an example of the present disclosure;

[0044] FIGS. 3 and 4 are partial schematic views of the elevator system when a safety chain break occurs;

[0045] FIG. 5 is a flow diagram illustrating the operation of the elevator system when a safety chain break occurs;

[0046] FIG. 6 is a partial schematic view of the elevator system when a drive system fault occurs;

[0047] FIG. 7 is a flow diagram illustrating the operation of the elevator system when a drive system fault occurs;

[0048] FIG. 8 is a schematic view of an elevator system according to another example of the present disclosure; and

[0049] FIG. 9 is a flow diagram illustrating the operation of the elevator system shown in FIG. 8 when a safety chain break occurs.

DETAILED DESCRIPTION

[0050] FIGS. 1 and 2 show an elevator system 2 comprising an elevator car 4 that is driven to move up and down a hoistway 6 to serve a plurality of landings of a building. Hoistway doors 8 facilitate access to the elevator car 4 from each landing. The elevator system 2 also comprises a drive system 10 and a safety chain 16. As shown in more detail in FIG. 2, the drive system 10 comprises a drive control device 12, drive hardware 15, a drive motor 11 arranged to drive the elevator car 4, and an electromagnetic safety brake 13 arranged to engage and stop the elevator car 4 when it is not provided with power. The drive control device 12 is arranged to control using the drive hardware 15 the supply of power from a power supply 14 to the drive motor 11 and the electromagnetic safety brake 13 (e.g. in response to control signals from an elevator controller, not shown).

[0051] The safety chain 16 comprises a plurality of electrical switches 22 connected in series via a conducting path 24. The switches 22 are arranged to open and break the safety chain 16 unless respective safety conditions are satisfied. The safety conditions include the hoistway doors 8 being closed, the elevator car 4 speed being below an overspeed limit and the elevator car 4 position in the hoistway 6 being within predetermined upper and lower limits. Although not illustrated, further switches corresponding to further safety conditions may also be provided. One end of the safety chain 16 is connected to a DC voltage source 26 which provides a DC electrical safety chain signal (e.g. a positive voltage), although in other examples an AC source may be used to provide an AC electrical safety chain signal. As shown in FIG. 1, when all the switches 22 are closed (i.e. when all the safety conditions are satisfied), the electrical safety chain signal from the DC voltage source 26 is carried to the other end of the safety chain 16 (i.e. the electrical safety chain signal is present at the node labelled B in FIG. 2).

[0052] Each of the switches 22 may monitor a safety condition directly (e.g. a switch 22 may comprise a reed switch coupled to a hoistway door 8 to monitor directly whether it is open or closed) or indirectly (e.g. a switch 22 may comprise a relay controlled by a separate hoistway door sensor).

[0053] The plurality of electrical switches 22 includes a software-controlled switch 23 which is controlled by drive software running on the drive controller 12. The software-controlled switch 23 is configured to open and break the safety chain upon receiving of a safety chain break command from the drive controller 12. This allows the drive controller 12 to break the safety chain 16 by issuing a safety chain break command, for example if the drive controller 12 itself detects a safety issue or a user wishes to trigger a safety chain break via software running on the drive controller 12. The drive controller 12 is, for instance, configured to issue a safety chain break command to the software-controlled switch 23 if it detects a problem with the supply of power to the drive motor 11 or the safety brake 13.

[0054] The safety chain 16 can itself exert control over the supply of power to the drive motor 11 and the safety brake 13 using the first and second power supply relays 18, 20 (two relays are provided to provide redundancy). When either of the first and second power supply relays 18, 20 is open (i.e. not conducting), the supply of power to the drive motor 11 and the safety brake 13 is interrupted. The first and second power supply relays 18, 20 are controlled by the safety chain 16. The first power supply relay 18 is configured to conduct only when the electrical safety chain signal is present at the node labelled A. Similarly, the second power supply relay 20 is configured to conduct only when the electrical safety chain signal is present at the node labelled B. Thus, if any of the plurality of switches 22 is open (i.e. if any one of the safety conditions is not satisfied), the supply of power is interrupted, thus automatically stopping the drive motor 11 and applying the safety brake 13.

[0055] In use, the drive controller 12 controls the supply of power to the drive motor 11 and the safety brake 13 by sending control signals to drive hardware 15 (e.g. comprising a plurality of switching devices that facilitate variable-voltage/variable-frequency control of the drive motor 11). For example, the drive controller 12 may cause power to be supplied to the drive motor 11 in response to an instruction from the elevator controller to move the elevator car 4 upwards (e.g. in response to an elevator call). At the same time, the drive controller 12 monitors the supply of power to the drive motor 11 and safety brake 13, receiving drive information from the drive hardware 15 indicative of the voltage, current, and/or power supplied by the drive hardware 15 to the drive motor 11 and the safety brake 13. If a drive system fault occurs (e.g. an electrical fault causing the drive motor 11 to fail) this is indicated by the drive information provided to the drive controller 12 (e.g. indicated by a sudden drop in the power supplied to the drive motor 11).

[0056] Similarly, the drive controller 12 is arranged to receive safety chain information from the safety chain 16. In this example the safety chain information comprises an indication of whether the safety chain signal is present at the node labelled B (i.e. at the end of the safety chain 16). The safety chain information thus provides an indication of whether the safety chain is intact (when the electrical safety chain signal is present at node B) or if there has been a safety chain break (when the electrical safety chain signal is absent from node B). Although not illustrated, the safety chain information from node B passes through a low pass filter to prevent transient changes in the electrical safety chain. In some examples, additionally or alternatively, a low pass filter may be located to the left of node B.

[0057] The operation of the elevator system 2 when a safety chain break occurs will now be explained with reference to FIGS. 3, 4, and 5.

[0058] At step 400, a hoistway door 8 is erroneously left open (e.g. due to a failure of its closing mechanism), causing its corresponding switch 22 to open and break the safety chain 16 (see FIG. 2). Because the electrical safety chain signal is no longer carried to nodes A or B, the first and second power supply relays 18, 20 open and the supply of power to the drive hardware 15 (and thus to the drive motor 11 and safety brake 13) is interrupted (step 402), as shown in FIG. 2. This stops the drive motor 11 and applies the safety brake 13, bringing the elevator car 4 to a halt (or preventing it from moving if it is already stopped).

[0059] At step 404, the drive controller 12 receives drive information from the drive hardware 15 indicating a sudden drop in power output to the drive motor 11 and safety brake 13 (due to the interruption of the power supply). The drive controller 12, which is not yet aware of the safety chain break (e.g. due to an inherent latency of the low pass filter through which safety chain information must pass), identifies this as a potential drive hardware (or drive motor/safety brake) problem and issues a safety chain break command to the software-controlled switch 23 in step 406, which opens as shown in FIG. 3. The safety chain break command is issued at t=0.

[0060] Subsequently in step 408, the safety chain information (i.e. the absence of the electrical safety chain signal at node B) indicative of the original safety chain break (i.e. caused by the open hoistway door 8) is received by the controller 12. The safety chain information is received at t=t.sub.delay The drive controller 12 recognises that t.sub.delay is less than the minimum propagation time t.sub.min it would take for safety chain information indicative of a safety chain break caused by the safety chain break command to be received by the drive controller 12. The drive controller 12 thus recognises that the safety chain information must be indicative of an independent safety chain break and that this must be the underlying cause of the drop in power output to the drive motor 11 and safety brake 13. The drive controller 12 thus, in step 410, classifies the fault as a safety chain break. The minimum delay t.sub.min is made up of the signal propagation delay along the control line from the controller 12 to the software-controlled switch 23, the activation time of the software-controlled switch 23 which breaks the safety chain 16 and the signal propagation delay from the software-controlled switch 23 to the controller 12 along the end of the safety chain 16. This latter path between the software-controlled switch 23 and the controller 12 may include a filter to process the safety chain signal, in which case the total delay also includes the signal delay introduced by that filter.

[0061] The operation of the elevator system 2 when a drive system fault occurs will now be explained with reference to FIGS. 6 and 7.

[0062] At step 600, the drive hardware 15 fails (e.g. due to an electrical fault), causing the power output by the drive hardware 15 to drop suddenly. At step 602, the drive controller 12 receives drive information from the drive hardware 15 indicating the sudden drop in power output. The drive controller 12, identifies this as a potential drive hardware problem and issues a safety chain break command to the software-controlled switch 23 in step 604, which opens and breaks the safety chain 16, as shown in FIG. 5. The safety chain break command is issued at t=0.

[0063] Subsequently in step 606, safety chain information (i.e. the absence of the electrical safety chain signal at node B) indicative of the safety chain break is received by the drive controller 12. The safety chain information is received at t=t.sub.delay. Because the safety chain break was caused by the drive controller 12 issuing a safety chain break command, t.sub.delay is equal to or greater than the minimum propagation time t.sub.min. The drive controller 12 thus recognises that the safety chain information is indicative of the safety chain break it triggered itself and that the underlying cause of the drop in power output is indeed a drive hardware fault. The controller thus, in step 608, classifies the fault as a drive hardware fault.

[0064] FIG. 8 shows an elevator system 102 according to another example of the present disclosure. The elevator system 102 comprises all the components of the elevator system 2 shown in FIG. 1 and further comprises a voltage sensor 104 connected directly to the drive controller 12 and arranged to measure a voltage of the safety chain at node A of the safety chain 16 at a fast rate (e.g. making more than 50 measurements per second). The drive controller 12 thus receives substantially continuously safety chain information comprising measurements of the voltage of the electrical safety chain signal.

[0065] The operation of the elevator system 102 when a safety chain break occurs will now be explained with reference to FIGS. 8 and 9.

[0066] At step 800, a hoistway door 8 is erroneously left open (e.g. due to a failure of its closing mechanism), causing its corresponding switch 22 to open and break the safety chain 16. Because the electrical safety chain signal is no longer carried to nodes A or B, the first and second power supply relays 18, 20 open and the supply of power to the drive hardware 15 is interrupted (step 802). This stops the drive motor 11 and applies the safety brake 13, bringing the elevator car 4 to a halt (or preventing it from moving if it is already stopped).

[0067] At step 804, the drive controller 12 receives drive information from the drive hardware 15 indicating a sudden drop in power output (due to the interruption of the power supply). At step 806 the drive controller 12 reviews the voltage measured by the voltage sensor 104 from a time period leading up to the drive information being received.

[0068] In step 806, the drive controller identifies behaviour of the voltage at the safety chain at node A in the reviewed time period that is characteristic of a safety chain break. The drive controller 12 therefore classifies in step 808 the fault as a safety chain break which subsequently caused the supply of power to the drive hardware 10 to be interrupted. In other examples different properties of the electrical safety chain signal may be measured. Thus, in other examples, the voltage monitor 104 may be replaced with a more general safety chain monitoring device 104 capable of measuring different (and possibly several) properties of the safety chain 16. For example, in the case of an AC safety chain 16, the safety chain monitoring device 104 may monitor the frequency of the AC signal. It may, of course, also monitor the voltage of the safety chain 16 (e.g. peak voltage, RMS voltage, etc.). In some examples, the safety chain monitoring device 104 (or the drive controller 12) may be arranged to determine the frequency of the AC signal using a plurality of voltage measurements over time. In some examples the safety chain monitoring device 104 may be an integral part of the drive controller 12.

[0069] While the disclosure has been described in detail in connection with only a limited number of examples, it should be readily understood that the disclosure is not limited to such disclosed examples. Rather, the disclosure can be modified to incorporate any number of variations, alterations, substitutions or equivalent arrangements not heretofore described, but which are commensurate with the scope of the disclosure. Additionally, while various examples of the disclosure have been described, it is to be understood that aspects of the disclosure may include only some of the described examples. Accordingly, the disclosure is not to be seen as limited by the foregoing description, but is only limited by the scope of the appended claims.