Elevator safety supervising entity with two units having an option for e.g. autonomous passenger evacuation

Abstract

An elevator safety supervising entity (SSE) includes a car safety supervising unit (SSU) controlling functions of car safety components and having at least one car sensor sensing car-related parameters, a head SSU controlling functions of shaft safety components and having at least one shaft sensor sensing shaft-related parameters, and a data linkage transmitting signal data between the SSUs. Both SSUs detect a failure in the other one of the SSUs and in the data linkage signal data transmission and in response switch from a normal operation mode to a failure operation mode. In the failure operation mode, the SSUs operate autonomously to keep the elevator operative at least temporarily with a sufficiently high safety even when functions of the elevator SSE are disturbed due to failures and e.g. passengers may be evacuated from the elevator car before completely stopping elevator operation.

Claims

1. An elevator safety supervising entity for an elevator, the elevator including an elevator car displaceable within an elevator shaft and elevator safety components including car safety components provided on the elevator car and shaft safety components provided stationary in the elevator shaft, the elevator safety supervising entity comprising: a car safety supervising unit controlling functions of the car safety components and including at least one car sensor for sensing car-related parameters; a head safety supervising unit controlling functions of the shaft safety components and including at least one shaft sensor for sensing shaft-related parameters; a data linkage transmitting signal data between the car safety supervising unit and the head safety supervising unit; wherein both the car safety supervising unit and the head safety supervising unit are adapted to operate in each one of a normal operation mode and a failure operation mode; wherein the car safety supervising unit and the head safety supervising unit are adapted to detect a failure in the head safety supervising unit and the car safety supervising unit respectively, to detect a failure in the signal data transmission via the data linkage, and to switch from the normal operation mode to the failure operation mode upon detecting the failure; wherein, in the normal operation mode, the car safety supervising unit and the head safety supervising unit exchange the signal data, the car safety supervising unit generates control signals for controlling functions of the elevator safety components based on information derived from both the sensed car-related parameters and the sensed shaft-related parameters, and the head safety supervising unit generates control signals for controlling functions of the elevator safety components based on information derived from both the sensed car-related parameters and the sensed shaft-related parameters; and wherein, in the failure operation mode, the car safety supervising unit and the head safety supervising unit are adapted for operating autonomously, the car safety supervising unit is adapted for controlling at least the functions of the car safety components based on the information derived from the sensed car-related parameters but excluding the shaft-related parameters sensed by the at least one shaft sensor of the head safety supervising unit, and the head safety supervising unit is adapted for controlling at least the functions of the shaft safety components based on the information derived from the sensed shaft-related parameters but excluding the car-related parameters sensed by the at least one car sensor of the car safety supervising unit.

2. The elevator safety supervising entity according to claim 1 wherein at least one of the car safety supervising unit and the head safety supervising unit is adapted to, in the failure operation mode, control the functions of the elevator safety components to enable evacuating passengers from the elevator car.

3. The elevator safety supervising entity according to claim 1 wherein the car safety supervising unit is adapted for controlling an actuation of a car safety gear of the elevator car and wherein the car safety supervising unit is adapted for, in the failure operation mode, keeping the safety gear in a non-actuated state for at least a predetermined period.

4. The elevator safety supervising entity according to claim 1 wherein the car safety supervising unit is adapted for controlling an actuation of a car door lock of the elevator car and the car safety supervising unit is adapted for, in the failure operation mode, keeping the car door lock in an unlocked state for at least a predetermined period.

5. The elevator safety supervising entity according to claim 1 wherein the head safety supervising unit is adapted for at least one of controlling an actuation of a motor brake of the elevator and activating of a safe torque off mode of an elevator drive engine of the elevator, and the head safety supervising unit SSU is adapted for, in the failure operation mode, keeping the motor brake in a non-actuated state for at least a predetermined period.

6. The elevator safety supervising entity according to claim 1 wherein the head safety supervising unit is adapted for controlling an actuation of a motor brake of the elevator and for activation of a safe torque off mode of an elevator drive engine of the elevator, and the head safety supervising unit is adapted for, in the failure operation mode, closing the motor brake but releasing the motor brake intermittingly for short periods of time.

7. The elevator safety supervising entity according to claim 1 wherein, in the failure operation mode, at least one of the car safety supervising unit and the head safety supervising unit is adapted for controlling functions of the elevator safety components, which functions, in the normal operation mode, are controlled by the head safety supervising unit and car safety supervising unit respectively.

8. The elevator safety supervising entity according to claim 1 wherein, in the failure operation mode, at least one of the car safety supervising unit and the head safety supervising unit is adapted for deriving additional information on at least one of car-related parameters and shaft-related parameters based on knowledge about elevator operation parameters prior to detection of the failure.

9. The elevator safety supervising entity according to claim 8 wherein the additional information is derived with a lower safety integrity level than the sensed car-related parameters and the sensed shaft-related parameters.

10. The elevator safety supervising entity according to claim 1 wherein the car safety supervising unit includes at least one auxiliary car sensor, wherein, in the failure operation mode, the car safety supervising unit is adapted to derive additional information on shaft-related parameters based on signals acquired by the auxiliary car sensor.

11. The elevator safety supervising entity according to claim 10 wherein the additional information is derived with a lower safety integrity level than the sensed shaft-related parameters.

12. The elevator safety supervising entity according to claim 1 wherein the head safety supervising unit includes at least one auxiliary shaft sensor, wherein, in the failure operation mode, the head safety supervising unit is adapted to derive additional information on car-related parameters based on signals acquired by the auxiliary shaft sensor.

13. The elevator safety supervising entity according to claim 12 wherein the additional information is derived with a lower safety integrity level than the sensed car-related parameters.

14. The elevator safety supervising entity according to claim 1 wherein at least one of the car safety supervising unit and the head safety supervising unit is adapted to remain in the failure operation mode only for a predetermined period of time and to then automatically switch into a safe stop operation mode by controlling elevator safety components to stop operation of the elevator.

15. The elevator safety supervising entity according to claim 1 wherein, in the failure operation mode, the car safety supervising unit and the head safety supervising unit are adapted to control the functions of the car safety components and of the shaft safety components in accordance with enhanced safety rules.

16. The elevator safety supervising entity according to claim 1 wherein the at least one car sensor is an acceleration sensor for sensing an acceleration of the elevator car, a velocity sensor for sensing a velocity of the elevator car or a position sensor for sensing a position of the elevator car in the elevator shaft.

17. An elevator comprising; an elevator car displaceable within an elevator shaft; and the elevator safety supervising entity according to claim 1 wherein the car safety supervising unit is attached to the elevator car and the head safety supervising unit is arranged stationary relative to the elevator shaft.

Description

DESCRIPTION OF THE DRAWINGS

(1) FIG. 1 shows an elevator comprising an elevator safety supervising entity according to an embodiment of the present invention.

(2) The FIGURE is only schematic and not to scale.

DETAILED DESCRIPTION

(3) FIG. 1 shows an elevator 1 according to an embodiment of the present invention. The elevator 1 comprises an elevator car 3 and a counterweight 5 arranged in an elevator shaft 7. The elevator car 3 and the counterweight 5 are suspended by a suspension traction means 9 comprising several ropes or belts. The suspension traction means 9 is driven by a traction sheave 13 of a drive engine 11. An operation of the drive engine 11 is controlled by an elevator control 15. A motor of the drive engine 11 may be decelerated by a motor brake 14. Furthermore, a safe torque off switch 16 may interrupt energy supply to the drive engine 11 in order to prevent any torques or forces to be applied onto the suspension traction means 9 in certain situations. The elevator car 3 comprises a safety gear 31 which for example in case of an emergency such as a freefall may quickly stop the elevator car 3. Furthermore, a car door 28 is provided with a car door lock 30.

(4) In order to be able to control functions of the elevator 1 and/or to guarantee its safety, the elevator 1 comprises a multiplicity of car sensors 17, 19, 21 and shaft sensors 23, 25.

(5) For example, an acceleration sensor 17, a position sensor 19 and a car velocity sensor 21 are provided at the car 3 such that they are moved together with the car 3. The acceleration sensor 17 may determine the current acceleration of the car 3. For example, the acceleration sensor may be a microelectronics device which may output an acceleration signal being proportional to the current acceleration acting thereon. The position sensor 19 may determine a current position of the car 3 within the elevator shaft 7. For example, position marks 20 may be provided at predetermined positions within the elevator shaft 7 and by identifying these position marks, the position sensor 19 may determine its present position. The car velocity sensor 21 may determine a current velocity of the elevator car 3 upon displacement within the elevator shaft 7. Optionally, the car velocity sensor 21 and the position sensor 19 may cooperate or may be integrated into a single device.

(6) The elevator 1 may further comprise shaft sensors 23, 25 which are positioned stationary within the elevator shaft 7. For example, shaft door contacts 23 may be provided at each of a multiplicity of shaft doors 27 arranged at each of floors 29 of a building. These shaft door contacts 23 may determine whether or not an associated shaft door 27 is correctly closed. Furthermore, door zone contacts 25 may be provided. These door zone contacts 25 may determine whether or not the elevator car 3 is currently in close neighborhood to one of the shaft doors 27. Such door zone contacts 25 may either be arranged stationary within the elevator shaft 3 such as to sense a presence of a neighboring elevator car 3 or may be arranged at the elevator car 3 such as to sense for example markers provided stationary adjacent to each door zone.

(7) Signals of the multiplicity of sensors 17 to 25 may be processed within an elevator safety supervising entity (SSE) 33. In order to suitably process these signals and to suitably control elevator safety components such as the motor brake 14, the STO switch 16, the car door lock 30 and/or the safety gear 31, the elevator SSE 33 is composed of two separate SSUs, namely a car SSU 35 and a head SSU 37.

(8) During normal operation of the elevator 1, both the car SSU 35 and the head SSU 37 may cooperate and may communicate with each other via a data linkage 38. Furthermore, the car SSU 35 and the head SSU 37 may communicate with the elevator control 15 and with other components of the elevator 1 such as the elevator's safety components 14, 16, 30, 31 in order to control various functionalities and safety functions of the elevator 1.

(9) The car SSU 35 is attached to the elevator car 3 such as to be moved together with the elevator car 3. Using its acceleration sensor 17, position sensor 19 and velocity sensor 21, the car SSU 35 may detect car-related parameters such as the car's position, velocity and/or acceleration. Based for example on signals of the acceleration sensor 17 indicating a current acceleration of the elevator car 3, the car SSU 35 may then detect for example an occurrence of a freefall of the elevator car 3. Thereupon, the car SSU 35 may rapidly activate the car's safety gear 31.

(10) The car SSU 35 furthermore comprises a proprietary energy source 43 such as a buffer battery or a capacitor of sufficiently large capacitance for supplying electrical energy. Thus, the car SSU 35 may at least temporarily operate independent of any electricity supply from e.g. a building's grid.

(11) The head SSU 37 is connected to the plurality of shaft door sensors 23 and door zone sensors 25. Therein, each of the shaft door sensors 23 and the door zone sensors 25 may be connected to a bus 45 such as to enable signal transmittance to the head SSU 37 with a minimum of wiring efforts.

(12) Using the car SSU 35 and the head SSU 37 in corporation, the elevator SSE 33 may monitor a multiplicity of conditions in the elevator 1 using the variety of different sensors 17 to 25 and may control functions of the elevator 1 based on signals provided by these sensors, possibly after suitable processing thereof.

(13) Particularly, during normal operation of the elevator 1, the elevator SSE 33 may supervise all safety critical conditions such as an occurrence of a freefall of the elevator car 3, the elevator car 3 reaching an end zone of the elevator shaft 7, at least one of the shaft doors 27 being open without the car 3 being stopped adjacent to this shaft door 27 and/or other safety-related conditions. During such normal operation, each of the car SSU 35 and the head SSU 37 may receive signals from its associated sensors 17 to 25 and may process these signals and/or may transmit signals to the other one of the head SSU 37 and the car SSU 35. Based on a combination of several or even all of sensed car-related functions and shaft-related functions, the car SSU 35 and the head SSU 37, respectively, may control functions of the car safety components, such as the car door lock 30 and the safety gear 31, and functions of the shaft safety components, such as the motor brake 14 and the STO switch 16, in order to satisfy elevated safety requirements during elevator operation. In other words, the entire safety supervising efforts may be shared between the car SSU 35 and the head SSU 37 during normal operation.

(14) However, additional to such normal operation mode, the car SSU 35 as proposed herein shall be specifically adapted to provide for at least some basic safety supervising functionalities in an autonomous manner in situations in which the head SSU 37 and/or the data linkage 38 shows some failures, i.e. in cases in which the car SSU 35 may no more be able to communicate with the head SSU 37. Same may be true, vice versa, for the head SSU 37 in case failures occur in the car SSU 35 and/or the data linkage 38.

(15) For example, when a failure in the head SSU 37 or in the data linkage 38 is detected, the car SSU 35 may automatically switch into its failure operation mode, in which the velocity and/or the position of the car may be autonomously supervised by the car SSU 35. In such situation, the safety gear 31 is generally kept open, i.e. kept in a released mode in which is does not stop the elevator car 3. Specifically, limits of the velocity and/or the position of the car 3 may be adapted to the specific failure operation mode. Such operation mode may allow to continue moving the elevator car 3 without immediate activation of the safety gear 31. The safety gear 31 may be beneficially implemented in a manner such as to be effective in both of opposing directions of a car motion.

(16) In another example, upon failure of the head SSU 37 or of the data linkage 38, the car SSU 35 may automatically switch into its failure operation mode in which it autonomously monitors the door zone. Therein, the car door lock 30 is kept in a mode in which it may be deactivated. Accordingly, the car door 28 in the door zone may be opened in case of an evacuation.

(17) Upon a failure of the car SSU 35 or the data linkage 38, the head SSU 37 may switch into a failure operation mode in which controlled releasing of the motor brake 14 is allowed at least for a predetermined period of time, preferably in a pulsed electronic brake opening (PEBO) mode. The head SSU 37 supervises opening and closing of the motor brake 14 autonomously and thereby enables a controlled motion of the elevator car 3 in case of an evacuation of passengers.

(18) Upon a failure in the car SSU 35 or the data linkage 38, the head SSU 37 may obtain an alternative velocity signal or position signal with which the head SSU 37 may keep open the motor brake 14 and the STO 16 at least for a predetermined period of time, in order to enable an evacuation run of the elevator car 3.

(19) Generally, safety functions which are normally embedded in the head SSU 37 may be taken over by the car SSU 35 in case of a failure, and vice versa.

(20) The car SSU 35 comprises an auxiliary car sensor 22 formed by a distance measurement device, which allows determining the current position of the elevator car 3 based on a measured distance to a top of the elevator shaft 7. Thereby, additional information about the car position may be obtained e.g. in cases where a data exchange with the head SSU 37 and its shaft end sensors 25 is interrupted.

(21) The head SSU 37 comprises an auxiliary shaft sensor 24 enabling measuring a rotation velocity of the traction sheave 13 of the drive engine 11, thereby providing additional information about a current velocity of the elevator car 3 in case e.g. data transmission between the car SSU 35 and its velocity sensor 19, on the one side, and the head SSU 37, on the other side, is disturbed.

(22) With the elevator SSE 33 described herein, the elevator 1 may be kept operative at least temporarily with a sufficiently high safety even when functions of the elevator SSE 33 are disturbed due to failures and e.g. passengers may be evacuated from the elevator car 3 before e.g. completely stopping elevator operation.

(23) Finally, it should be noted that the term “comprising” does not exclude other elements or steps and the “a” or “an” does not exclude a plurality. Also elements described in association with different embodiments may be combined.

(24) In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.