Emergency power elevator recovery and service system

A multi-elevator system operable in response to a group controller (FIG. 1) operates in a first phase (FIG. 9) in which each car is selected in a sequence to be run in a first phase (FIG. 4) in which each car is commanded to run to a designated landing (FIGS. 5 and 6). When an attempt has been made to recover all cars (30, FIG. 9; 22, FIG. 8), a second attempt is made, if necessary (28, FIG. 9; 11, 13, 15, FIG. 8). Then, in a second phase, cars are selected on a priority basis in which the highest level are cars with firemen in them or cars not at a designated landing (8, FIG. 10). A second priority level includes cars designated as preferred by the customer (22, FIG. 10) and a third level includes any available car (29, FIG. 10). Any car not recovered is caused to become available (10, FIG. 3) for selection (8, FIG. 10) on a periodic basis, the priority level section automatically deselecting one of the service cars for operation so as to permit selecting the unrecovered car for operation.

DESCRIPTION 
1. Technical Field 
This invention relates to elevator systems, and more particularly to 
improvements in recovering elevators to designated landings and 
designating elevators to provide service to the building, on emergency 
power, following loss of normal building power. 
2. Background Art 
It has long been the practice, particularly in high rise buildings having 
many floors, to provide a source of emergency power for operating 
elevators when normal building power, supplied by feeders, fails. The 
emergency power may be battery power or more likely power supplied by 
generators run by fueled engines. In the usual case, the emergency power 
supply will be inadequate to provide power for all of the elevators in a 
particular group of elevators, so that elevators must be selected to run 
on emergency power, one or several at a time (depending upon the 
elevator-capacity of the emergency power supply). 
When power fails, it is, in the normal case, quite likely that some of the 
elevator cars will have passengers therein. Therefore, the current 
practice has been to provide for operation of elevator systems under 
emergency power in two phases. In a first phase, the elevator cars are 
selected one (or more, depending upon capacity) at a time and directed to 
be recovered to a designated return landing. The designated return 
landing, in a simple case of loss of power, may be the main lobby. The 
purpose of this initial recovery phase is to control with precision the 
minimum required motion and operation of each elevator so as to permit 
passengers in all of the elevators to leave the cars. If the cars were 
allowed to continue to run in order to deliver their present passengers, 
other passengers may enter and prolong the process. Thus, delivering the 
passengers of one or two cars could cause passengers trapped in three or 
four other cars to remain trapped for many minutes, or indefinitely. In 
the second phase of operation, once it is known that all of the cars have 
returned to the designated landing so that their passengers could escape, 
one or more cars are designated to provide limited service (ordinary 
service, but utilizing only the one or two elevators which the emergency 
power system has the capacity to run at one time). 
In systems known to the art, provision is made for manual control during 
emergency power conditions as well as for automatic group control during 
emergency power conditions. In the manual mode, a building elevator 
service supervisor would operate switches on a main lobby panel (or the 
like) to select which elevators are to run, and to first command the 
selected elevators to return to the designated landing. Thereafter, the 
operator would cause one or two elevators to be operative, and shut the 
remaining elevators off so that normal operation could resume with the 
selected one or more elevators. In automatic systems, a group controller 
selects the elevators, in turn, to be recovered to the designated landing, 
and then selects elevators to provide normal, but curtailed service after 
each elevator has had an opportunity to be recovered to the designated 
landing. 
In many cases, the loss of normal building power may be accompanied by 
other electrical control problems. Also, conditions in any one car may 
prevent it from responding to an attempt to recover the car to the 
designated landing (such as maintenance personnel blocking a door open). 
Thus, during phase one operation, it is common that one or more cars may 
not respond and may not initially be recovered to the designated landing. 
In systems known to the prior art, once an attempt has been made to recover 
a car to a designated landing, if the car has not responded (referred to 
herein as emergency start delayed), the elevator is (in a sense) 
considered to be "lost", and not recoverable. The rescue of passengers in 
non-responding elevators must be effected by other means (i.e., 
intervention by service personnel). Even in manual systems, the only way 
in which an unrecovered car may be reselected in an attempt to recover it 
is to interrupt operation of one of the cars when it is at the recovery 
landing (such as at the main lobby and in view of the operating personnel) 
so that one of the cars providing normal but curtailed service can be 
taken off of the emergency power system to permit re-trying the recovery 
attempt. 
DISCLOSURE OF INVENTION 
Objects of the invention include provision of improvements in emergency 
power elevator recovery and service systems, including prolonging phase 
one recovery attempts whenever less than all cars are initially recovered, 
provision for repeated attempts to recover elevators initially delayed in 
a recovery process, and priority protocols for the selection of cars to be 
run, either in repetitive recover attempts or in the provision of building 
service, during the second phase of emergency power operations. 
According to the present invention, an elevator system having a group 
controller operable automatically upon the loss of building power to 
control the selection of as many elevators as can run on emergency power 
provides, during a second phase after an attempt has been made to recover 
all cars, operation of a number of selected cars to provide passenger 
service in the building with periodic attempt to recover any cars not 
previously recovered. According to another aspect of the invention, the 
selection of cars to run on emergency power during a second phase after an 
attempt has been made to recover all cars, is accomplished on a priority 
basis in which the highest level of priority for selection of cars 
includes those cars determined to not be at a designated return landing. 
According to the invention, the selection of cars with a highest priority 
level including cars not at the return landing automatically provides 
priority to periodic re-trying to recover cars previously not recovered. 
According to an aspect of this invention still further, a second priority 
level includes cars designated as preferred to be run on emergency power; 
and a third level includes any cars which are available to run. According 
to yet another aspect of the invention, early recovery of as many cars as 
possible following the loss of normal power is achieved by first 
attempting to recover each of the cars followed by a recycle in which a 
second attempt is made to recover any cars not recovered during the first 
attempt, prior to transferring operation to a second phase in which 
passenger service is provided by selected cars. 
The invention provides the greatest opportunity for ultimately recovering 
all of the cars after loss of normal building power, whereby passengers 
can escape from cars without intervention of maintenance personnel. The 
invention provides early escape in most cases by making at least two 
attempts to recover each car (if necessary) before devoting the limited 
emergency power resource to providing limited passenger service in the 
building. The invention enhances the ultimate desired operation on 
emergency power by providing an automatic priority system wherein 
initially cars on firemen service or not at a designated landing are given 
the highest priority, cars designated as preferred to be run on emergency 
power are given a second level of priority, and any other car whch can run 
is given lowest priority. Thus, any car may first be designated to run 
during the second phase for the provision of passenger service, but when a 
car more preferred becomes available to run, the first car will be dropped 
from selection so as to permit selection of a preferred car. And, any car 
not yet recovered automatically becomes a priority car by periodically 
forcing its delayed status to be reset so as to look eligible for running 
in view of its highest priority status, since it is not yet at the 
designated return landing. 
The invention may be implemented in a variety of fashions utilizing 
apparatus and techniques which are well within the skill of the art in the 
light of the teachings which follow hereinafter. The foregoing and other 
objects, features and advantages of the present invention will become more 
apparent in the light of the following detailed description of exemplary 
embodiments thereof, as illustrated in the accompanying drawing.

BEST MODE FOR CARRYING OUT THE INVENTION 
A simplified description of a multi-car elevator system, of the type in 
which the present invention may be practiced, is illustrated in FIG. 1. 
Therein, a plurality of hoistways, HOISTWAY "A" 1 and HOISTWAY "F" 2 are 
illustrated, the remainder are not shown for simplicity. In each hoistway, 
an elevator car or cab 3, 4 is guided for vertical movement on rails (not 
shown). Each car is suspended on a rope 5, 6 which usually comprises a 
plurality of steel cables, that is driven in either direction or held in a 
fixed position by a drive sheave/motor/brake assembly 7, 8, and guided by 
an idler or return sheave 9, 10 in the well of the hoistway. The rope 5, 6 
normally also carries a counterweight 11, 12 which is typically equal to 
approximately the weight of the cab when it is carrying half of its 
permissible load. 
Each cab 3, 4 is connected by a traveling cable 13, 14 to a corresponding 
car controller 15, 16 which is located in a machine room at the head of 
the hoistways. The car controllers 15, 16 provide operation and motion 
control to the cabs, as is known in the art. In the case of multi-car 
elevator systems, it has long been common to provide a group controller 17 
which receives up and down hall calls registered on hall call buttons 
18-20 on the floors of the buildings, allocates those calls to the various 
cars for response, and distributes cars among the floors of the building, 
in accordance with any one of several various modes of group operation. 
Modes of group operation may be controlled in part by a lobby panel 21 
which is normally connected by suitable building wiring 22 to the group 
controller in multi-car elevator systems. 
The car controllers 15, 16 also control certain hoistway functions which 
relate to the corresponding car, such as the lighting of up and down 
response lanterns 23, 24, there being one such set of lanterns 23 assigned 
to each car 3, and similar sets of lanterns 24 for each other car 4, 
designating the hoistway door where service in response to a hall call 
will be provided for the respective up and down directions. 
The foregoing is a description of an elevator system in general, and, as 
far as the description goes thus far, is equally descriptive of elevator 
systems known to the prior art, and elevator systems incorporating the 
teachings of the present invention. 
Although not required in the practice of the present invention, the 
elevator system in which the invention is utilized may derive the position 
of the car within the hoistway by means of a primary position transducer 
(PPT) 25, 26 which may comprise a quasiabsolute, incremental encoder and 
counting and directional interface circuitry of the type described in a 
commonly owned copending U.S. patent application of Marvin Masel et al, 
Ser. No. 927,242, filed on July 21, 1978, (a continuation of Ser. No. 
641,798, filed Dec. 18, 1975, now abandoned), entitled HIGH RESOLUTION AND 
WIDE RANGE SHAFT POSITION TRANSDUCER SYSTEMS now abandoned. Such 
transducer is driven by a suitable sprocket 27, 28 in response to a steel 
tape 29, 30 which is connected at both its ends to the cab and passes over 
an idler sprocket 31, 32 in the hoistway well. Similarly, although not 
required in an elevator system to practice the present invention, detailed 
positional information at each floor, for more door control and for 
verification of floor position information derived by the PPT 25, 26, may 
employ a secondary position transducer (SPT) 32, 33 of the type disclosed 
and claimed in a commonly owned copending U.S. application filed on Nov. 
13, 1979, by Fairbrother, Ser. No. 093,475. Or, if desired, the elevator 
system in which the present invention is practiced may employ inner door 
zone and outer door zone hoistway switches of the type known in the art. 
The foregoing description of FIG. 1 is intended to be very general in 
nature, and to encompass, although not shown, other system aspects such as 
shaftway safety switches and the like, which have not been shown herein 
for simplicity, since they are known in the art and not a part of the 
invention herein. 
All of the functions of the cab itself may be directed, or communicated 
with, by means of a cab controller 34, 35 which may provide serial, 
time-multiplexed communications with the car controller as well as direct, 
hard-wire communications with the car controller by means of the traveling 
cables 13, 14. The cab controller, for instance, will monitor the car call 
buttons, door open and door close buttons, and other buttons and switches 
within the car; it will control the lighting of buttons to indicate car 
calls, and will provide control over the floor indicator inside the car 
which designates the approaching floor. 
The makeup of microcomputer systems, such as may be used in the 
implementation of the car controllers 15, 16, a group controller 17, and 
the cab controllers 33, 34, can be selected from readily available 
components or families thereof, in accordance with known technology as 
described in various commercial and technical publications. These include 
"An Introduction to Microcomputers, Volume II, Some Real Products" 
published in 1977 by Adam Osborne and Associates, Inc., Berkeley, Calif., 
U.S.A., and available from Sydex, Paris, France; Arrow International, 
Tokyo, Japan, L. A. Varah Ltd., Vancouver, Canada, and Taiwan Foreign 
Language Book Publishers Council, Taipei, Taiwan. And, "Digital 
Microcomputer Handbook", 1977-1978 Second Edition, published by Digital 
Equipment Corporation, Maynard, Mass., U.S.A. And, Simpson, W. E., Luecke, 
G., Cannon, D. L., and Clemens, D. H., "9900 Family Systems Design and 
Data Book", 1978, published by Texas Instruments, Inc., Houston, Tex., 
U.S.A. (U.S. Library of Congress Catalog No. 78-058005). Similarly, the 
manner of structuring the software for operation of such computers may 
take a variety of known forms, employing known principles which are set 
forth in a variety of publications. One basic fundamental treatise is "The 
Art of Computer Programming", in seven volumes, by the Addison-Wesley 
Publishing Company, Inc., Reading, Mass., and Menlo Park, Calif., U.S.A.; 
London, England; and Don Mills, Ontario, Canada (U.S. Library of Congress 
Catalog No. 67-26020). A more popular topical publication is "EDN 
Microprocessor Design Series" published in 1975 by Kahners Publishing 
Company (Electronic Design News), Boston, Mass., U.S.A. And a useful work 
is Peatman, J. B., "Microcomputer-Based Design" published in 1977 by 
McGraw Hill Book Company (worldwide), U.S. Library of Contress Catalog No. 
76-29345. 
The software structures for implementing the present invention, and 
peripheral features which may be disclosed herein, may be organized in a 
wide variety of fashions. However, utilizing the Texas Instruments' 9900 
family, and suitable interface modules for working therewith, an elevator 
control system of the type illustrated in FIG. 1, with separate 
controllers for the cabs, the cars, and the group, has been implemented 
utilizing real time interrupts, in which power-on causes a highest 
priority interrupt which provides system initialization (above and beyond 
initiation which may be required in any given function of one of the 
controllers). And, it has employed an executive program which responds the 
real time interrupts to perform internal program functions and which 
responds to communication-initiated interrupts from other controllers in 
order to process serial communications with the other controllers, through 
the communication register unit function of the processor. The various 
routines are called in timed, interleaved fashion, some routines being 
called more frequently than others, in dependence upon the criticality or 
need for updating the function performed thereby. Specifically, there is 
no function relating to elevatoring which is not disclosed herein that is 
not known and easily implemented by those skilled in the elevator art in 
the light of the teachings herein, nor is there any processor function not 
disclosed herein which is incapable of implementations using techniques 
known to those skilled in the processing arts, in the light of the 
teachings herein. 
The invention herein is not concerned with the character of any digital 
processing equipment, nor is it concerned with the programming of such 
processor equipment; the invention is disclosed in terms of an 
implementation which combines the hardware of an elevator system with 
suitably-programmed processors to perform elevator functions, which have 
never before been performed. The invention is not related to performing 
with microprocessors that which may have in the past been performed with 
traditional relay/switch circuitry nor with hard wired digital modules; 
the invention concerns new elevator functions, and the disclosure herein 
is simply illustrative of the best mode contemplated for carrying out the 
invention, but the invention may also be carried out with other 
combinations of hardware and software, or by hardware alone, if desired in 
any given implementation thereof. 
Communication between the cab controllers 34, 35, and the car controllers 
15, 16 in FIG. 1 is by means of the well known traveling cable in FIG. 1. 
However, because of the capability of the cab controllers and the car 
controllers to provide a serial data link between themselves, it is 
contemplated that serial, time division multiplexed communication, of the 
type which has been known in the art, will be used between the car and cab 
controllers. In such case, the serial communication between the cab 
controllers 33, 34, and the car controllers 15, 16 may be provided via the 
communication register unit function of the TMS-9900 microprocessor 
integrated circuit chip family, or equivalent. However, multiplexing to 
provide serial communications between the cab controller and the car 
controller could be provided in accordance with other teachings, known to 
the prior art, if desired. The controllers 15, 16, 17, may each be based 
on a microcomputer which may take any one of a number of well-known forms. 
For instance, they may be built up of selected integrated circuit chips 
offered by a variety of manufacturers in related series of integrated 
circuit chips, such as the Texas Instruments 9900 Family. Such a 
microcomputer may typically include a microprocessor (a central control 
and arithmetic and logic unit), such as a TMS 9900 with a TIM 9904 clock, 
random access memory, a read only memory, an interrupt priority and/or 
decode circuit, and control circuits, such as address/operation decodes 
and the like. The microcomputer is generally formed by assemblage of chips 
on a board, with suitable plated or other wiring so as to provide adequate 
address, data, and control busses, which interconnect the chips with a 
plurality of input/output (I/O) modules of a suitable variety. The nature 
of the I/O modules depends on the functions which they are to control. It 
also depends, in each case, on the types of interfacing circuitry which 
may be utilized outboard therefrom, in controlling or monitoring the 
elevator apparatus to which the I/O is connected. For instance, the I/Os 
which are connected to car call or hall call buttons and lamps and to 
switches and indicators may simply comprise buffered input and buffered 
output, multiplexer and demultiplexer, and voltage and/or power conversion 
and/or isolation so as to be able to sense cars hall or lobby panel button 
or switch closure and to drive lamps with a suitable power, whether the 
power is supplied by the I/O or externally. 
An I/O module may provide serial communication over current loop lines 13, 
14, 36, 37 between the car controllers 15, 16 and the cab controllers 34, 
35 and the group controller 17. These communications include commands from 
the group controller to the cars such as higher and lower demand, stop 
commands, cancelling hall calls, preventing lobby dispatch, and other 
commands relating to features, such as express priority service when 
requested by a switch 38, 39. These communications also include 
information concerning car calls, normally requested by buttons in panels 
40, 41 exchanged between cab and car controllers as well as the group 
controller. The group controller initiates communication with each of the 
car controllers in succession, and each communication operation includes 
receiving response from the car controllers, such as in the well known 
"handshake" fashion, including car status and operation information such 
as whether the car is in the group, is advancing up or down, its load 
status, its position, whether it is under a go command or is running, 
whether its door is fully opened or closed, and other conditions. And each 
car controller 15, 16 engages in similar communication with its own cab 
controller 34, 35. As described hereinbefore, the meanings of the signals 
which are not otherwise explained hereinafter, the functions of the 
signals which are not fully explained hereinafter, and the manner of 
transferring and utilizing the signals, which are not fully described 
hereinafter, are all within the skill of the elevator and signal 
processing arts, in the light of the teachings herein. Therefore, detailed 
description of any specific apparatus or mode of operation thereof to 
accomplish these ends is unnecessary and not included herein. 
Overall program structure of each controller, based upon a data processing 
system, in which the present invention may be practiced, is reached 
through a program entry point as a consequence of power up causing the 
highest priority interrupt, in a usual fashion. Then a start routine is 
run in which all RAM memory is cleared, all group outputs are set to zero, 
and building parameters (which tailor the particular system to the 
building, and may include such things as floor rise and the like) are read 
and formatted as necessary, utilizing ordinary techniques. Then the 
program will advance into the repetitive portion thereof, which, in 
accordance with the embodiment described herein, may be run on the order 
of every 200 milliseconds. This portion of the program commences with an 
initialize routine in which all forcing (FORC) and all inhibit or cancel 
(INH) functions are cleared from memory; field adjustable variables are 
read and formatted as necessary; the status of each car is read and 
formatted as necessary; and all the hall calls and car calls are read, and 
corresponding button lights for sensed calls are lit. Then, all inputs 
obtained by communication between the cars, the cabs and the group are 
distributed to the various maps and other stored parameter locations 
relating thereto. 
After initialization a variety of elevatoring functions are performed by 
various routines on various time bases. Such routines include assigning 
cars to answer hall calls, parking cars in zones, handling up peak and 
down peak traffic, and various other functions, including the emergency 
priority service described hereinafter with respect to the present 
invention. The car controllers 15, 16 may be implemented in a fashion 
similar to that described hereinbefore with respect to the group 
controller 17, having I/O devices suitable for communication with the cab 
controllers 33, 34 over lines 13, 14 and suitable for interacting with 
circuitry for controlling the sheave/motor/brake assemblies 7, 8 as well 
as any related transducers, such as the primary position transducers 25, 
26. The car controller has a principal task of controlling the motion of 
the cab, and at times controlling the cab door. These functions 
necessarily include other, known subfunctions such as recognizing car 
calls, and responding to car calls or floor calls assigned by the group 
(or otherwise) in conjunction with the position of the cab to cause the 
cab to open and close its doors at appropriate times. Since these 
functions, and the communications between the various controllers to 
effect them, are, except as provided hereinafter with respect to the 
present invention, generally known and within the skill of the art, no 
particular aspect of them being involved herein except as provided 
hereinafter, further discussion thereof is not otherwise provided herein. 
A car emergency power routine which is run in the microprocessor of each 
car controller 15, 16 (FIG. 1) is reached through an entry point 1 in FIG. 
2 and a first test 2 directly interrogates the status of the building main 
power line feeders to determine if the building has normal power. If it 
does, an affirmative result of test 2 leads to a step 3 which sets (or 
reinforces) a status bit indicating that the car is running on normal 
power, and a plurality of steps 4 in which the car emergency power status 
flag is set to the zero (not true) state, a status flag indicating that 
the car door is open at the return landing is set to zero, a pair of 
once-only flags utilized to control resetting of car calls during a car 
return operation and during shutdown of a car are reset to zero, a 
once-only delay clock flag and a once-only phase two re-try clock flag are 
set to zero. Then, other parts of the program of the microprocessor within 
the car controller 15, 16 (FIG. 1) are reverted to through an end of 
routine point 5. 
In FIG. 2, in the absence of normal building power, a negative result of 
test 2 will reach a step 6 which resets the car normal power status flag. 
When the car does not have either a normal power status or an emergency 
power status, the car becomes immobile and cannot run. However, a car will 
not have emergency power status except when it is selected to run on 
emergency power, in a manner described hereinafter. A test 7 determines if 
the particular elevator installation has automatic group control during 
emergency power, or not. This is an option of the building in which the 
elevator system is installed, and if the elevator system does not have the 
option in place, a negative result of test 7 will reach a test 8 to 
determine if a building car selection switch (typically in the lobby panel 
21, FIG. 1) is set to select the particular car in question, vs. all the 
other cars in group. If the building select switch is set to select this 
particular car, an affirmative result of test 8 will reach a step 9 which 
sets the car emergency power status bit that renders the car capable of 
operation, and a step 10 which resets the shutdown call reset flag (in the 
event that the car had previously been shut down and the flag may have 
been set in a manner described with respect to FIG. 3 hereinafter). Then 
an emergency car return routine 11, described hereinafter with respect to 
FIG. 5, is performed in order to cause the car to be recovered or returned 
to a designated emergency landing. And then the routine ends through point 
5. 
In FIG. 2, an affirmative result of test 7, indicating that the group 
controller will automatically perform the selection of cars for operation 
on emergency power, causes a test 12 to determine if the group has 
completed a phase one portion (within which the group attempts to cause 
all cars to return to an emergency landing): during the first phase of 
automatic group control, the building select switch is not allowed to 
designate cars since that would interfere with the group control automatic 
selection of cars which is about to be described. During the first phase, 
an affirmative result of test 12 will reach steps 13-15 in which hall 
stops, hall lantern and further demand functions of the car controller 
(15, 16, FIG. 1) are inhibited. This prevents the car from responding to 
any previously instituted group control, so that the car will respond only 
to either the phase one group control (described with respect to FIG. 4 
hereinafter) or to the car shutdown procedure described with respect to 
FIG. 3 hereinafter, alternatively, in dependence upon whether a test 14 
determines that the car is selected to run or not, respectively. If the 
group has not selected this car to run, a negative result of test 16 will 
cause a shut car down portion of the routine to be reached through a 
transfer point 17. But if the car is selected to run, a phase one portion 
of the routine will be reached through a transfer point 18. 
In FIG. 2, if phase one has been completed (in a manner described elsewhere 
herein), then a particular car may be selected by the group if the 
building select switch is set to automatic, giving the group controller 
(17, FIG. 1) the option of selecting the cars; otherwise, the building 
select switch can be set to select a particular car. Thus a negative 
result of step 12 (indicating phase two operation in which switch 
selection of the car is permitted) will reach a test 19 to determine 
whether the car is selected by either the group controller or the building 
select switch. If the car is selected, an affirmative result of test 19 
will reach a phase two portion of the routine through a transfer point 20; 
but if the car is not selected, a negative result of test 19 will reach 
the shut car down portion through the transfer point 17. 
The functions of FIG. 2 are therefore to determine whether or not the car 
is operating on normal power and whether or not the group controller (17, 
FIG. 1) is provided with the automatic emergency power option described 
with respect to FIGS. 7-10 hereinafter: and if not, to allow one elevator 
determined by the building select switch to be operated, the remainder to 
be shut down, or if so, to determine whether a first phase of automatic 
control or a second phase is involved, and to allow one or more cars at a 
time to operate under automatic control. 
In FIG. 3, the shut car down portion of the routine is reached through an 
entry point 1, and a plurality of steps 2-4 cause the car emergency power 
status, the delay clock flag, and the car return call reset flag to all be 
reset to zero (not true state). Then a test 5 determines if the shutdown 
call reset flag has been set, and if not, a command is given to reset all 
car calls in a step 6 and the shutdown call reset flag is set in a step 7. 
Once the shutdown call reset flag has been set, subsequent passes through 
FIG. 3 (prior to either return to normal operation or selection of this 
car to run) will cause the steps 6, 7 to be bypassed. Then, a step 8 
issues a command to inhibit scanning of car call buttons so that no new 
car calls can be registered in the car. 
In FIG. 3, a test 9 determines if the group controller has set a status 
flag indicating that all cars have either been returned to an emergency 
return landing or have been determined to be unable to return (that is, 
delayed). In a case where an elevator system does not have the automatic 
group control option in it, this status flag will necessarily always be 
absent, causing a negative result of test 9. This reaches a pair of steps 
10, 11 in which a status bit (indicating that the car involved has had its 
emergency start delayed) and the once-only re-try clock flag are both 
reset to zero. And the program reverts to other matters through an end of 
return point 12. Thus, in a system without automatic control, or in a 
system with automatic control which is still operating in the first phase 
of automatic emergency power control, a car is always indicated as not 
being a delayed car to permit the car to be selected during a recycling of 
phase one recovery procedures, described with respect to FIG. 9, 
hereinafter. And, the re-try clock flag is reset so that re-try may occur 
in phase two operation, as described hereinafter with respect to FIG. 10. 
In a case where automatic group emergency power control is provided, once 
all of the cars have been given the opportunity to return to an emergency 
floor landing (recovered), even though some of the cars might not have 
responded and may not have returned to a designated landing, phase two 
operation takes place and an affirmative result of test 9 in FIG. 3 will 
reach a test 13 which interrogates a status bit indicating whether or not 
this particular car was delayed in its attempt to start on emergency 
power. If this car did not have an excessive delay in starting on 
emergency power, when selected to do so, a negative result of step 13 
causes the program to revert to other matters through the end of return 
point 12. But if this car was unable to start in a reasonable time (such 
as 35 seconds, as described hereinafter), then it will have set its car 
emergency start delayed status bit so that an affirmative result of test 
13 will reach a test 14 to see if the once-only phase two re-try clock 
flag has been set or not. If not, a re-try timer is started so as to allow 
trying once again to recover this particular car every 2 minutes (or other 
suitable time interval). Thus a negative result of test 14 causes a step 
15 to set re-try time equal to real time (clock), and a step 16 sets the 
phase two re-try clock flag (so that step 15 will not be reached in 
subsequent passes through the routine portion of FIG. 3). In subsequent 
passes through FIG. 3, during phase two operation, so long as this car is 
not selected to run, an affirmative result of test 14 will reach a test 17 
which determines whether or not 120 seconds have elapsed since starting of 
the re-try clock. If not, the routine is simply ended. But an affirmative 
result of test 17 will reach the steps 10, 11 so as to cause the delayed 
status of the car to be removed, thereby making this car eligible for an 
attempt at movement, and the re-try clock flag is reset. The removal of 
this car's delayed status is necessary, as described with respect to the 
group phase two subroutine described with respect to FIG. 10 hereinafter, 
to allow selection of this car for running on emergency power in an 
attempt to recover it. This is one aspect of the present invention: 
continuously re-trying, on a periodic basis, to recover cars which 
initially are not responsive to a command to return to a designated 
landing when on emergency power. 
So long as a car is not selected to run on emergency power, in each cycle 
of its microprocessor program within its car controller (15, 16, FIG. 1), 
the routine will proceed through FIG. 2 through the transfer point 17 and 
through FIG. 3. But, as a consequence of the building select switch being 
set to indicate selection of this particular car or the group controller 
selecting this particular car to run on emergency power, this car's 
routine will proceed down through FIG. 2 initially to the transfer point 
18 (during phase one operation), or through the steps 9 and 10 in the case 
where there is no automatic group control, as described hereinbefore. In 
the normal case, where the invention is fully utilized, a selected car 
will have its program advanced through the transfer point 18 to the phase 
one portion of the car emergency power routine, which is reached through 
an entry point 1 in FIG. 4. In FIG. 4, once the car is selected to run, 
its car emergency power status is established by a step 2 and a step 3 
resets the once-only shutdown call reset flag (which will normally have 
been set because, in a normal case, a car will initially not be selected 
and thereafter become selected). Then the emergency car return subroutine 
described with respect to FIG. 5 hereinafter is reached at stage 4 of FIG. 
4, so as to cause the car to be recovered to a return landing, if at all 
possible. Until the car does reach the return landing and open its doors, 
a test 5 interrogates the status of this car having opened its door at a 
return landing and the negative result will cause a force door open 
command, in a step 6, that continuously tries to force the door open. 
Naturally, the door of an elevator will not open until it is proper to do 
so, so the forcing function will have no effect until the car is located 
suitably at a landing. Then a delayed status is set equal to the 
complement of the run status of the car in a step 7. If, when commanded to 
run in response to a forced car call (described with respect to FIG. 5 
hereinafter) the car does not in fact run, after a suitable period of 
time, then it is known that the car is delayed. If the car does not run, 
then a test 8 will have an affirmative result which will reach a test 9 to 
determine if the delay clock flag has been set yet, or not. If not, a 
negative result of test 9 will cause a step 10 to initiate the delay timer 
by setting delay time equal to the real time clock; and, a step 12 will 
set the delay clock flag so that step 10 will not be reached in subsequent 
passes through the routine. In subsequent passes, an affirmative result of 
test 9 will cause a test 13 to interrogate the status of the delay timer 
to see if 35 seconds have expired since the delay timer was initiated. If 
not, nothing happens; but after 35 seconds of delay (which is plenty of 
time to get an elevator running once it is commanded to do so), an 
affirmative result of test 13 will cause a step 14 to set a status bit 
indicating that this elevator car emergency start is delayed (this is the 
status bit which is automatically reset in step 10 of FIG. 3, as described 
hereinbefore). In FIG. 4, in case the car ultimately does respond within 
35 seconds, a negative result of test 8 will occur so that the car 
emergency start delayed indication will be reset (if it had previously 
been set) and the once-only delay clock flag is reset in a pair of steps 
15, 16. In any event, whether or not the car has reached the landing is 
determined in a step 17, in which the car not at landing status is 
determined to be true is the car does not have a committable floor 
position equal to the return landing (the return landing being one 
selected as described with respect to FIG. 5 hereinafter), or even if it 
is committed to that floor, if it is not within the inner door zone, or if 
it has advance status, which is the case whenever it is running without 
commitment to stop at the next floor. Thus a car is determined to not be 
at the landing if it is not near it, or if it is not close enough to it to 
open the doors (inner door zone), or, even if it is within the inner door 
zone at the desired landing, if it has been commanded to leave that 
landing and therefore will not remain there. Then, other parts of the 
program are reverted to through an end of routine transfer point 18. 
Referring again to FIG. 2, once all cars have had a chance to return to a 
landing, the automatic group controller will switch from phase one to 
phase two which is manifested in FIG. 2 by a negative result of test 12. A 
negative result of test 12 therefore indicates phase two operation and 
test 19 determines whether the car is selected or not. If not, the 
transfer point 17 will cause the car to be shut down (or continue to be 
reinforcing shutdown). But if the car is selected to run, whether by the 
building select switch or by the automatic selection process in the group 
controller (17, FIG. 1), as described with respect to FIGS. 7-10 
hereinafter, an affirmative result of test 19 will cause the program to 
advance through the transfer point 20 to an entry point 19 of the phase 
two portion of the car emergency power routine in FIG. 4. In the phase two 
portion, the car can be running either because it is being utilized as a 
car to provide service during emergency power conditions, or it could be 
running because it was a delayed car and the re-try timer has timed out 
(17, FIG. 3) and another attempt is being made to recover the car to the 
designated landing. 
In FIG. 4, the phase two portion, reached through the entry point 19, 
commences with a step 20 to set the car emergency power status so that the 
car can run, and the shutdown call reset flag is reset in step 21. Then 
the emergency car return routine, described with respect to FIG. 5 
hereinafter, is reached at point 22 of FIG. 4, and a series of tests 23-26 
determine whether the car should continue to run or whether the car should 
be forced to the return landing to allow other cars to run in its place. 
If the car status is firemen service, and the fireman has entered the car 
and taken over control of the car with a key switch, then the car is 
allowed to continue to run, since code requirements include absolute 
priority to firemen. Thus an affirmative result of test 23 will allow the 
car to continue to run during phase two. In the case where this car is a 
car designated as preferred for operation on emergency power (eg, because 
it has access to more landings or a rear door), a test 24 will be 
affirmative and the car is allowed to continue to run. But even if this 
car is not preferred, if there are no other preferred cars (as described 
hereinafter with respect to FIG. 10), then a map of preferred cars in 
storage will be all zeros and a test 25 will be affirmative allowing the 
present car to continue to run. If the particular car has the return 
landing as its committable floor, it is allowed to continue to reach that 
landing without any interference by an affirmative result of test 26. On 
the other hand, if the results of all of the tests 23-26 indicate that 
this car is not being run by a fireman, it is not a preferred car but 
there are other preferred cars to which this car should yield for service 
on emergency power, and this car is not directly headed to the return 
landing, then this car is forced to the return landing, so that it can 
possibly be taken off service to allow other cars to be run, by a step 27 
which forces a car call to the return landing. 
In FIG. 4, whether or not the car is allowed to continue to run during 
phase two, a delayed status bit is set in a step 28 to equal the car's go 
status ANDed with the complement of its run status. Thus, if the car has a 
go command for a long period of time without running, it is delayed. But, 
mere failure to run during phase two may only be indicative of no request 
for service (whereas in phase one, the car is commanded to return to the 
landing). This status is tested in test 8, and operation proceeds as 
described with respect to tests and steps 8 through 17, hereinbefore. 
Notice that a car could have previously been recovered to the emergency 
landing, and could have been put into emergency operation so as to provide 
service to passengers and thereafter become delayed. In such case, the 
recovery process will be repeated during the continuance of phase two 
operation, in the same fashion as for a car which initially was 
unresponsive during phase one (and subsequently phase two) recovery 
procedures. 
Referring to FIG. 5, the emergency car return subroutine is reached through 
an entry point 1, and a first step 2 sets a condition status bit if a fire 
condition status bit or an alternative condition status bit has been set. 
The fire condition status bit is set in response to a switch or an alarm 
whenever there is fire in the building; the alternative condition status 
bit is set (such as by a switch on the lobby panel 21, FIG. 1) in the case 
of a riot or other special condition concerning which it is decided that 
special elevator service should be provided. In the portion of the 
emergency car return subroutine illustrated in FIG. 5, the only function 
is to determine whether the emergency power situation is coupled to a 
fire, fire with smoke at the normal fire return landing, or some 
alternative condition (such as a riot), and to select an appropriate 
return landing. For instance, during normal emergency power failure 
(unrelated to the conditions in the building), the main lobby may be the 
selected return landing to which all cars are initially returned. On the 
other hand, during a fire, the fire code may require passengers be 
returned to a first basement. Thus, the first basement would be 
established as the fire landing to be used for the return landing. But if 
there were smoke detected in the first basement, then either the main 
lobby or a second basement may be used as a fire landing. And the 
alternative landing may be a first landing above the lobby (allowing 
people to avoid conditions in the lobby by using staircases and back 
entrances, and the like). All of this may be established for each building 
depending upon the landings selected as the normal emergency power 
landing, the fire landing, the smoke landing, or the alternative landing. 
In FIG. 5, if there is a special condition (fire or riot), a test 3 will be 
affirmative causing a step 4 to set a condition flag (used as described 
hereinafter). Then a test 5 determines if the condition is the fire 
condition or not. If not, a negative result of test 5 will cause a test 6 
to determine if a once-only alternative condition flag has been set or 
not. In the initial pass through FIG. 5, the flags will never have been 
set, and therefore the first pass through test 6 will be negative. This 
causes a series of steps 7 to set the alternative condition flag, to reset 
the fire, smoke and shutdown call reset flags, and to reset the door open 
at return landing status bit. Then a step 8 establishes the return landing 
as whatever landing is stored as the desired alternative landing, and the 
second portion of the emergency car return subroutine is reached through a 
transfer point 9. 
In FIG. 5, if there is a fire, test 5 will be affirmative causing a test 10 
to check for smoke detected at the fire landing. If there is, than a test 
11 determines if the smoke condition flag has been set or not, which 
initially will be not. This causes a series of steps 12 to reset the 
alternative condition flag, the fire condition flag and the shutdown call 
reset flag, to set the smoke condition flag (so that test 11 will be 
affirmative in subsequent passes through FIG. 5) and to reset the door 
open at return landing status bit. Then a step 13 causes the return 
landing to be established as the designated smoke landing (the landing to 
be used during a fire when smoke is detected at the normal fire landing), 
and the second portion of the subroutine is reached through point 9. 
In FIG. 5, if test 10 is negative, a test 14 determines if the fire 
condition flag is set. Normally test 14 is initially negative so that a 
series of steps 15 will reset the alternative condition flag, the smoke 
condition flag and the shutdown call reset flag, as well as setting the 
fire condition flag and resetting the door open at return landing status 
bit. In step 16, the return landing is established as the fire landing and 
the second portion of the subroutine is reached through transfer point 9. 
In FIG. 5, if neither a fire nor a riot (or other alternate condition) is 
present, test 3 will be negative causing a test 17 to determine if the 
condition flag (step 4) had been set or not. This could occur when there 
has been a riot or a fire, but the normal power may not be restored. If 
there is a change from fire or alternate condition to ordinary emergency 
power conditions, test 17 will initially be affirmative; but if the 
emergency power routine is being run simply as a result of loss of normal 
power not concerning other matters in the building, test 17 would be 
negative. If test 17 is affirmative, a series of steps 18 will reset the 
alternative condition flag, the fire condition flag, the smoke condition 
flag and the shutdown call reset flag along with the door open at return 
landing status bit, and will reset the condition flag as well. Then a step 
19 will establish the return landing as the emergency power landing and 
the second portion of the emergency car return subroutine will be reached 
through the transfer point 9. Notice that conditions could change. 
Initially, there may be a riot; as a consequence, a fire may break out. 
But then smoke may appear at the normal fire landing, so that the landings 
could be changed from alternative, to fire, to smoke, in sequence. 
Therefore, the subroutine portion of FIG. 5 is run during each machine 
cycle, and any change in condition resets the door open at return landing 
status bit, to ensure that any car to be recovered will be recovered to a 
currently-correct landing. 
Once the correct landing has been established, the second portion of the 
emergency car return subroutine is reached in FIG. 6 through an entry 
point 1. A test 2 determines if this car's door is open and the car is at 
the return landing, in a manner described hereinafter. This is a status 
bit which is reset to zero during power on reset so that once it is set 
for any car it remains set thereafter. However, as is described with 
respect to FIG. 5, if the conditions (fire, smoke, riot) change, the door 
open at return landing status for the car is reset, so that it must 
immediately return to the newly-designated landing to suit present 
conditions, whether it is a delayed car or an operating car. Thus, when a 
car is initially recovered to the emergency landing, the door open at 
return landing status bit is set. If the car is thereafter pressed into 
normal service during emergency power conditions, the status bit remains 
set indicating that this is a car which does not need to be recovered, but 
is simply a car that is in use for service during emergency power. In the 
normal case, initially test 2 will be negative because the car must first 
be recovered before it can be pressed into service. This will cause a test 
3 to determine if the fireman is in the car (that is, whether the car is 
on fireman status and a fireman has entered the car and operated a key for 
independent fireman service). If not, a negative result of test 3 will 
reach a test 4 to determine if the car return call reset flag is set yet. 
Normally, an initial pass through FIG. 6 will find the car reset flag not 
set, so a negative result of test 4 will reach a step 6 which commands 
that all car calls be reset, and then a step 7 will set the car return 
call reset flag, so that the command to reset car calls (step 6) will not 
be reached in subsequent passes through FIG. 6. 
In the case of a car which is trying to be initially recovered to the 
return landing (or caused to be recovered to a new return landing 
following a change in conditions as described with respect to FIG. 5), 
tests 2 and 3 will be negative and ultimately a series of steps 8-14 are 
reached. In step 8, the force buzzer command is set equal to the force 
buzzer command or the not run condition of the car. This allows the buzzer 
to be forced for other purposes (such as if communications are lost 
between the cab controller and the car controller, and the doors are 
opened at a landing) or, when the car has reached the return landing under 
the routine of FIG. 6, in order to urge the passengers to leave the car. 
Then the steps 9-14 inhibit various operational modes of the car controller 
(15, 16, FIG. 1) so that the car will only respond to a car call as 
described hereinafter. The functions inhibited include the scanning of car 
call buttons, the car being in the group, car floor service cutoff 
(because the alternative landing, for instance, may be one to which this 
car normally is not permitted), express priority service (to avoid an 
operator from commandeering the car), wild car service (in the event that 
the group controller fails) and automatic returning of the car to the 
lobby for other purposes (since the lobby may not be the return landing). 
Then, a test 15 determines if the car committable floor (the next floor at 
which it could possibly stop) is equal to the return landing selected as 
described with respect to FIG. 5. If not, a step 16 forces a car call to 
the return landing and the subroutine is ended and the appropriate part of 
the car emergency power routine (transfer point 5 in FIG. 2, test 5 in 
FIG. 4 or test 23 in FIG. 4) is reverted to through a return point 17. 
Assuming the car does respond and advance toward the return landing, 
eventually test 15 will be affirmative. Then a test 18 will determine if 
the car still has go status; as long as it does, test 16 continues in each 
cycle to force a car call to the return landing. Eventually, the car will 
be close enough to the return landing so that the go status will be lost, 
and a negative result of test 18 will reach a test 19 to determine if the 
car door is fully open. If it is not, a step 20 issues a force door open 
command. But if the door is fully open, an affirmative result of test 19 
causes a step 21 to set the door open at return landing status for this 
particular car. And then the correct part of the car emergency power 
routine is reverted to through the return point 17. 
The car functions described with respect to FIGS. 2-6 hereinbefore relate 
only to emergency power service, and only to recovery of the cars. If the 
elevator system has group control over automatic emergency service, phase 
one, governing return of each car once to the selected landing (depending 
upon the particular condition) is controlled by the group. Thereafter, 
during phase two, either the group may select cars to run or the building 
select switch may select cars to run. If there is no group automatic 
emergency service control in the elevator system being considered, only 
the building select switch can cause cars to be recovered and to provide 
service thereafter. 
The functioning of the group controller 17 (FIG. 1) is governed by its 
microprocessor in response to a group emergency power routine illustrated 
in FIGS. 7-10. In FIG. 7, the group emergency power routine is reached 
through an entry point 1 and a first step 2 sets a condition status equal 
to fire condition or the alternative condition (in a manner analogous to 
that described with respect to FIG. 5 hereinbefore). If a fire condition 
or alternative condition exists, a test 3 will be affirmative so that a 
step 4 will set a condition flag. Then a test 5 determines if the fire 
condition is present, and if not, a test 6 will determine if an 
alternative condition flag has been set or not. It should be borne in mind 
that the conditions of FIG. 7 are the same as those in FIG. 5, but the 
flags of FIG. 7 are flags within the microprocessor of the group 
controller 17 (FIG. 1), whereas the flags of FIG. 5 are those within the 
related car controllers 15, 16 (FIG. 1). 
In FIG. 7, initially the alternative condition flag will not be set so that 
a negative result of test 6 will reach steps 7-9 in which the smoke and 
fire condition flags are reset and the alternative condition flag is set. 
Then a recycle once flag is reset in a step 10 and the all feeder status, 
feeder 1 status and feeder 2 status are each set to zero in steps 11-13. 
After that, a second part of the group emergency power routine is reached 
through a transfer point 14. 
In FIG. 7, if test 5 is affirmative indicating that there is a fire, a test 
15 will determine whether the smoke alarm has indicated smoke at the fire 
landing. If not, a step 16 will examine whether or not the fire condition 
flag has been set yet: if not, a series of steps 17-19 will set the fire 
condition flag and reset the smoke condition flag and the alternative 
condition flag. Then the steps 10-13 will be performed. 
If test 15 of FIG. 7 is affirmative, a test 20 will determine if the smoke 
condition flag has been set. If not, a series of steps 21-23 will reset 
the fire and alternative condition flags, and set the smoke condition 
flag. Then the steps 10-13 will be performed. 
In FIG. 7, if test 3 is negative, indicating there is not a fire or a riot 
or the like, then a test 24 will determine whether there previously had 
been a fire or alternative condition. In a normal case, loss of normal 
power will occur because of conditions outside of the building, so that 
the condition flag will not have been set in step 4 and therefore tests 3 
and 24 will normally be negative. Therefore, during a normal loss of 
power, the subroutine of FIG. 7 performs no function at all. But if the 
condition flag had been set, an affirmative result of test 24 will lead to 
steps 25-28 which reset the condition flag, the fire condition flag, the 
smoke condition flag and the alternative condition flag, and then cause 
the steps 10-13 to be performed. In any case, following one pass through 
FIG. 7, during which the flags are tested and set or reset for any given 
condition, and the steps 10-13 are performed, in any subsequent pass 
through FIG. 7, unless the conditions change, the only function performed 
in FIG. 7 is to interrogate the appropriate condition flags and reach the 
transfer point 14. 
In FIG. 8, a portion of the group emergency power routine determines 
whether there are one or two feeders (independent power lines) supplying 
power to the individual elevators within a particular group. Depending on 
whether there is more than one feeder and whether both feeders have 
failed, conditions are established to operate all the cars on the 
emergency power basis, or to operate only those cars on the failed one of 
two feeders to operate under emergency conditions. The portion of the 
group emergency power routine of FIG. 8 is reached through an entry point 
1 and a first test 2 determines if feeder 1 has failed. In the normal 
case, the group will not be on emergency power, and none of the feeders 
will have failed. Thus test 2 will normally be negative reaching a test 3 
which determines whether more than one feeder is used to power the group. 
If so, a test 4 will determine if the second feeder has failed. In the 
normal case, there will be no feeder failure so that either test 3 or test 
4 will be negative causing a series of steps 5 to be performed. This 
resets a number of the group emergency power routine status indicators 
including a recycle once flag, emergency power indicators 1 and 2, and the 
statuses of all feeders, feeder 1 or feeder 2, the significance of which 
is described hereinafter. Also, among the steps 5, a normal power 
indicator is set. Then a series of steps 6 are reached to reset to zeros a 
variety of status indicators and maps (maps being words having one bit per 
car which have the status designated by the word): the map of cars 
selected to run, a word indicating the number of cars which have been 
selected to run, a status bit indicating that all cars have been subject 
to attempted recovery and have been returned or determined to be delayed, 
a map of cars which have been returned, a map of cars determined to be 
delayed, and a map of cars determined to be returned or delayed. Then, 
other parts of the program of the microprocessor within the group 
controller 17 (FIG. 1) are reached through an end of routine point 7. 
In FIG. 8, if test 2 indicates that feeder 1 has failed, a test 8 
determines if there is more than one feeder. If so, a test 9 determines if 
the second feeder has also failed. If test 8 is negative or test 9 is 
affirmative, a test 10 will check an all feeder status to see if the 
status is 2. In the first instance, since the feeder status has been reset 
to zero in a normal case (step 5 of FIG. 8), test 10 will be negative 
reaching a plurality of steps 11 in which the all feeder status is 
incremented by one, the feeder 1 status and feeder 2 status are both set 
to zero, a map of cars on emergency power is set equal to all the cars in 
the group, and a word bearing a number equal to the number of cars which 
must be recovered is set to the total number of cars in the group. Then 
the steps 6 are performed and the routine is ended through point 7. 
Assuming that both feeders failed together, or there is only one feeder and 
it has failed, the second pass through FIG. 8 will again reach test 10 
which again will be negative, so that in steps 11 the all feeder status 
will be advanced from 1 to 2. And in the third pass through FIG. 8, the 
test 10 will be affirmative causing the program to advance in a different 
way which is described hereinafter. 
In a similar fashion, if feeder 1 has failed but test 8 is affirmative and 
test 9 is negative indicating that only feeder 1 has failed, then a 
negative result of test 9 will reach a test 12 to interrogate the status 
of feeder 1. Initially, test 12 will be negative because the status 
normally starts out at zero. Then a series of steps 13 will cause the all 
feeder status to be set at zero, will cause the feeder 1 status to 
increment from zero to 1, will cause the feeder 2 status to be zero, will 
set the map of cars on emergency power equal to those cars which are being 
powered by feeder 1, and will set the number of cars to be recovered to be 
equal to the number of cars which are fed by feeder 1. Then the steps 6 
will be performed. In the second pass through FIG. 8 with only feeder 1 
failed in a split feeder, test 12 will again be negative and within the 
steps 13 the feeder 1 status is incremented from one to two. In the third 
pass through FIG. 8, test 12 will be affirmative causing the program to 
advance in the manner to be described hereinafter. 
If in FIG. 8 test 2 determines that feeder 1 has not failed and test 3 
determines that there is a split feeder, and test 4 determines that feeder 
2 has failed alone, then a test 14 will determine the status of feeder 2. 
In a series of steps 15, similar to steps 11 and 13 hereinbefore, the 
other feeder statuses are set to zero and the map of cars on emergency 
power is established as the cars on the feeder 2 and the number of cars to 
be recovered is set equal to the number of cars being fed by feeder 2. 
After two passes through FIG. 8, test 14 is affirmative and the program 
will advance. Whenever one feeder failure condition exists, either one of 
two feeders failing or the only feeder failing, for two successive cycles, 
either tests 10, 12 or 14 will be affirmative causing a test 16 to be 
reached. But, if first only feeder 1 fails and its status has advanced, 
and subsequently feeder 2 is determined to have failed, then eventually 
test 10 will be reached before test 12 will be satisfied. This two-cycle 
delay ensures that the car controllers on the failed one or two feeders 
are properly brought to emergency power operation (FIG. 2) before the 
feeder failure status is acted upon in the group controller. 
In FIG. 8, once two cycles of the same feeder failure status have occurred, 
a test 16 determines whether feeder 2 has failed or not. If it has, a test 
17 determines if there are two failure indicators in the particular 
elevator system involved. In some cases, the customer may desire only one 
indicator to indicate some power failure, regardless of whether a split 
feeder is involved or not. In other cases, the customer may desire to have 
an indicator for each of the feeders. If there is only one indicator for 
two feeders, test 17 will be negative and the emergency power indicator 1 
will be set in a step 18 (in such case this is the only indicator in the 
system). But on the other hand, if feeder 2 has failed and two indicators 
are involved, both tests 16 and 17 will be affirmative so that only 
emergency power indicator 2 will be set in a step 19. If feeder 2 has not 
failed, test 16 will be negative. In the event that test 16 is affirmative 
and two indicators are involved, or test 16 is negative, a test 20 will 
determine if feeder 1 has failed. If it has, it will cause emergency power 
indicator 1 to be reset by step 18. When the indicators have been properly 
set, a step 21 will reset the normal power indicator of the group 
controller 17 (FIG. 1). Then, the group status condition of whether or not 
all cars have been returned or delayed (recovery has been attempted for 
all cars) is interrogated in a test 22. If test 22 is negative, phase one 
operation is reached through a transfer point 23; but if test 22 is 
affirmative (an attempt has been made to recover all of the cars), then 
the group emergency power return routine will advance to phase two 
operation through a transfer point 24. 
In phase one operation, the group selects the cars one at a time for 
recovery to the designated emergency landing. The phase one portion of the 
group emergency power routine is reached through an entry point 1 in FIG. 
9. A first test 2 determines if there is a split feeder. If there is, a 
test 3 determines if both feeders have failed. If no feeder is available, 
either test 2 will be negative or test 3 will be affirmative and a pair of 
steps, 4, 5 will reset all hall calls and inhibit scanning of further hall 
calls so that the group controller (17, FIG. 1) will not attempt to 
allocate hall calls for assignment to elevators. But if only one of two 
feeders has failed, those cars which are still on normal power can react 
to assignment of hall calls and therefore the hall calls are not reset and 
inhibited. 
In FIG. 9, a step 6 causes the phase one inhibit of the building select 
switch (that which is interrogated in test 12 of FIG. 2 in each of the 
cars) to be established in a map equal to the map of cars on emergency 
power (which is set in an appropriate one of the steps 11, 13, 15, FIG. 8, 
to relate to those cars on failed feeders only). This map must be reset to 
all zeros automatically in each cycle so as to be again set only in phase 
one cycles. If not reset in cyclic housekeeping routines, it could be 
reset at step 21 of FIG. 8. Then a step 7 sets a P pointer (this is a word 
containing one bit for each car, the bit of the car currently under 
consideration being a ONE, and the remaining bits being a zero) equal to 
the highest numbered car of the cars which are to be considered under 
group control during emergency power operation. This may include more than 
the number of cars normally included within group control in the case 
where one elevator is for special use only. But if there is no 
distinction, this would simply be the highest numbered car in the group. A 
step 8 then sets a map of cars available to be returned as the logical AND 
of those cars on emergency (on the failed feeder), the complement of cars 
which have been returned and the complement of cars which are delayed. 
Thus any car assigned to the failed feeder which has not been returned or 
delayed will be in the map of cars available to return (to recover the 
first time). Initially, this map will include all the cars on the failed 
feeder. 
In FIG. 9, a step 9 compares the map of cars available to return with the P 
pointer to see if the car under consideration is available to be returned. 
If it is, a test 10 determines if this car has already been selected to be 
run. Initially, no cars are selected to be run so that test 10 will be 
negative and reach a test 11 wherein the word containing the number of 
cars selected to run is compared to see if it is less than a stored number 
indicating how many cars can run on emergency power. This number may vary 
from one to several, depending upon the magnitude of the emergency power 
supply, and the power requirements of the elevators in the system. For 
purposes of description herein, it is assumed that more than one car can 
run on emergency power, thus illustrating full utilization of the present 
invention. Initially, no cars have been selected so that test 11 will be 
affirmative reaching a step 12 wherein the map of cars selected to run is 
updated by ORing with the P pointer so that the car under consideration 
has now become a car selected to run. And a step 13 will increment the 
number of cars selected. 
In FIG. 9, once a car has been considered, a step 14 (lower left of FIG. 9) 
will decrement the P pointer so as to cause consideration of the next 
lower numbered car. Then a test 15 determines if all cars have been 
considered. If not, test 9 is repeated for the next car in the sequence. 
Assuming that two cars can run on emergency power, step 11 will again be 
affirmative and the car currently in consideration will be added to the 
map of cars selected to run. Then step 14 will be repeated and test 15 
will determine that all cars have not yet been considered, causing test 9 
to be repeated. For the third car under consideration, test 10 will 
initially be negative causing test 11 again to be reached. But if only two 
cars can be run on emergency power, and two have been assigned, test 11 
will be negative this time, causing the program to advance to a step 16 in 
which a map of cars having zone demand inhibited is updated by ORing with 
the map of cars which are selected to run under phase one (a recovery 
phase wherein no zone control over the cars is permitted). Then other 
parts of the program of the microprocessor within the group controller 17 
(FIG. 1) are reverted to through an end of routine point 17. In a 
subsequent cycle, passing through FIG. 9, assuming that the two cars 
previously selected have not yet reached the return landing, the tests and 
steps 2-8 will be performed as described hereinbefore. Test 9 will be 
affirmative since the two selected cars (including the highest car) are 
still available to be returned. But test 10 will be affirmative because 
the highest numbered car was selected to run in a previous cycle. This 
will cause a test 18 to determine if the particular car in question (here 
assumed to be the highest numbered car) is in the map of cars having their 
doors opened at the return landing one time (cars which have successfully 
been recovered). If the car in question has not yet reached the return 
landing, test 18 will be negative causing a test 19 to determine if the 
car is non-responsive or if the car is one which has been determined to be 
delayed. The map of cars which are determined to be non-responsive is a 
map of cars concerning which communications between the group controller 
17 and the related car controller 15, 16 (FIG. 1) have failed. That is, 
the normal microprocessor handshake procedure has indicated that normal 
communication of words between the microprocessors is not functioning 
properly. The map of cars having emergency start delayed is a map of cars 
within which the delayed status has been established in step 14 of FIG. 4, 
and this status has been communicated from the corresponding car 
controller (15, 16) to the group controller (17, FIG. 1). But if this 
particular car in consideration has not yet been determined to be delayed, 
test 19 will be affirmative since the complement of these maps are tested. 
This will cause further consideration of this car to be bypassed by 
proceeding to step 14 which decrements the P pointer to consider the 
second highest numbered car in the emergency group. Assuming the second 
highest numbered car has also been selected in a previous cycle, this will 
cause the tests 9, 10, 18 and 19 to be performed in the same fashion for 
the second car in the sequence, and the third car will then be selected by 
decrementing the P pointer in step 14. This will cause step 9 to be 
affirmative for the third car, step 10 will be negative, and step 11 will 
be negative because (assuming only two cars can be selected) two cars have 
already been selected. Therefore, the program will advance to step 16 as 
in the first cycle. Eventually, assuming one of the cars does reach the 
return landing, step 18 in FIG. 9 will be affirmative for that car, so 
that car will be added to the map of cars returned by ORing with the P 
pointer in a step 20. On the other hand, one of the first two selected 
cars may be delayed or may have become non-responsive due to a failure of 
communication. In such a case, step 18 would still be negative (since the 
delayed or non-responding car will not have reached its landing) but test 
19 will also be negative causing a step 21 to update a map of delayed cars 
by ORing with the P pointer. In either of these cases, the car is either 
returned or delayed and not to be given further consideration. Thus, after 
either step 20 or 21, a step 22 will decrement the number of cars left to 
be recovered (or attempted to be recovered). Note that the group 
controller uses the map of cars delayed set in step 21 to determine 
eligibility during phase one. Therefore, resetting of delayed status (10, 
FIG. 3) will not alter the car's phase one eligibility. Until all of the 
cars to be recovered have either been returned or determined to be delayed 
or non-responsive, a test 23 will indicate that the number of cars left to 
be recovered is greater than zero. This causes a negative result of test 
23 which causes a step 24 to update the map of cars selected to run so as 
to exclude the car currently in question (since it was either determined 
to have been returned by test 18 or to be delayed by test 19), by ANDing 
with a complement of the P pointer. And a step 25 will decrement the 
number of cars selected to run. Then step 14 is reached to decrement the P 
pointer so as to allow consideration of the next car in the sequence. 
Thus, whenever cars are determined to be returned or delayed, another car 
can be tried for recovery. 
Eventually, in subsequent passes through the program portion of FIG. 9, all 
of the cars will have had a chance to be recovered. The number of cars to 
recover will therefore have been decremented to zero in step 22 so that 
test 23 will be affirmative. If in this process, one or more cars were not 
actually recovered, then a test 26 will be negative because the map of 
delayed cars will not be all zeros. This will cause a test 27 to determine 
if a once-only, recycle once flag has been set or not. Initially, it will 
not be set so that a negative result of test 27 will cause steps 28 to be 
reached which reset the feeder statuses and then set the recycle once 
flag. With the feeder statuses reset, subsequent passes through the second 
portion of the group emergency power routine illustrated in FIG. 8 will 
cause a significant portion of the statuses and maps to be reset to zeros. 
However, the map of cars with their door open at the return landing it not 
reset to zeros, and still reflects all of the cars for which the door open 
at return landing status has been set in step 21 of FIG. 6. This will 
cause the phase 1 routine of FIG. 9 to begin as initially described 
hereinbefore, with all of the cars being available to be returned that are 
on the feeder. However, after each car is selected to run by step 12, in 
the next subsequent cycle (the next pass through FIG. 9) such car will 
cause an affirmative result of test 18 so that the map of cars returned is 
updated in step 20 after a number of cycles which is something less than 
the number of cars under consideration. Thus on the order of a second or 
so will pass before only the unrecovered cars will be given consideration 
in FIG. 9 during the recycle once portion of phase one. When in the 
recycle portion all of the cars have been given consideration again, step 
26 is again reached. If in fact some car still has delayed status (being 
unrecoverable), test 26 will again be negative but since the recycle once 
flag has been set, test 27 will be affirmative. Thus whether or not all 
cars were in fact recovered during the recycle once portion of phase one, 
in a step 29, a map of cars returned or delayed is set equal to the map of 
cars on emergency (the cars on the failed feeder or feeders) which is 
utilized to transmit, to all of the cars in that map, the fact that all of 
the cars have been returned or delayed, for use in test 9 of FIG. 3 within 
the microprocessor of each of the car controllers 15, 16 (FIG. 1). And, a 
single status bit equal to the same thing, indicating all cars have been 
returned or delayed, is set in a step 30 of FIG. 9, for use in test 22 of 
the second portion of the group emergency power routine of FIG. 8 as 
described hereinbefore. And then, other parts of the microprocessor 
program are reached through the end of routine point 17. 
Notice that in FIG. 9, in each cycle, after as many cars as can be, have 
been selected to run (including the fact that some are deselected and 
others are replaced), step 16 will inhibit zone demand for that cycle of 
those cars which are selected to run. Zone demand is reestablished in each 
cycle because it is reset (elsewhere) in each cycle. Alternatively, the 
map of cars to have their zone demand inhibited could be reset at the 
start of the group emergency power routine, if desired, such as in FIG. 7 
or near step 21 of FIG. 8. 
Once an attempt has been made to recover each of the cars which are on the 
failed feeder, and the all cars returned or delayed status has been set in 
step 30 of FIG. 9, subsequent passes through the group emergency power 
routine will reach test 22 of FIG. 8 and find that it is affirmative, 
causing the program to proceed through the transfer point 24 to the phase 
two portion of the program, which is reached through an entry point 1 in 
FIG. 10. Then a step 2 will reset the inhibit scan hall calls status so 
that hall calls can be scanned by the group controller. This is because 
during phase two one or more cars may be operated (except during the 
periof of time when all of the unrecoverable cars are utilizing all of the 
available power on re-try) in order to service calls in the building. And 
a pair of steps 3 set a priority level equal to 1 and a map of priority 
cars to all zeros, for purposes described hereinafter. 
In FIG. 10, a test 4 determines if the building select switch has been set 
to automatic or not. If not, a negative result of test 4 indicates that 
the group cannot select cars to run on phase two to provide service to the 
building, because an attendant desires to designate the cars by means of 
the building select switch (such as at the lobby panel 21, FIG. 1). This 
will cause a step 5 to cause the map of cars selected to run to be all 
zeros and the number of cars selected to be zero in a step 6. That is the 
only function performed in such a case, and other parts of the program of 
the microprocessor within the group controller 17 (FIG. 1) are reached 
through an end of routine point 7. In the event that the particular 
elevator system is not provided with automatic group control for emergency 
power, there will be no permitted automatic selection point on the 
building select switch, so that test 4 will always be negative. 
In the general case, utilizing the invention to its full extent, test 4 in 
FIG. 10 will typically be affirmative. This will cause a step 8 to set an 
initial map of priority cars equal to cars in which the fireman is present 
in the car and has taken over control of the car, or cars which are not at 
the designated emergency landing (a map of cars which have caused, at step 
17 of FIG. 4, their own car not at landing status to have been set). In 
addition, any of the cars not at the landing or having a fireman therein 
must also be cars on emergency, not delayed and not non-responsive, due to 
the ANDing of appropriate maps therewith. Thus, as a first consideration, 
step 8 causes a map of priority cars to be those cars with firemen or not 
at landing which are connected to the failed feeder or feeders and are not 
delayed or non-responsive. Note that the delayed status is determined from 
the map of cars with emergency start delayed, which is updated directly 
from each car (14, FIG. 4; 10, FIG. 3). Therefore, the car becomes 
eligibly non-delayed in response to its re-try timer (FIG. 3). 
In FIG. 10. a test 9 determines if there are any priority cars established 
in step 8. If there are, then the map will not be all zeros and a negative 
result of step 9 will cause the second part of the phase two process to 
commence. In a step 10 the P pointer is set equal to the highest emergency 
car (the highest car in the group during emergencies, whether it is on the 
failed feeder or not). Then a test 11 determines if the car under 
consideration is within the map of priority cars. If it is, a test 12 
determines if the number of cars selected is less than the number which 
can be run on emergency power. If it is, the map of cars selected to run 
is examined to see if this car has previously been selected to run in a 
test 13. If it has not, then the car is selected to run by updating the 
map of cars selected to run by ORing with the P pointer in a step 14 and 
the number of cars selected is incremented in a step 15. Thereafter, a 
step 16 will decrement the P pointer so as to designate the next lower 
numbered car and a test 17 determines if all cars have been tested or not. 
Initially, not all cars have been tested so the program reverts to test 11 
to determine if the car in question is a priority car. If it is not, then 
a test 18 will determine if the car has previously been selected to run. 
If it has, but is is not a priority car, an affirmative result of test 18 
will reach a step 19 which causes the map of cars selected to run to be 
updated by deleting the car in question, which is effected by ANDing with 
the complement of the P pointer. And the number of cars selected is 
decremented in a step 20. Then the P pointer is again decremented in step 
16, and test 17 is made to determine if all cars have been tested or not. 
In FIG. 10, if the car under consideration (designated by the P pointer) is 
a priority car but the number of cars selected is no longer less than the 
permitted number to run, step 12 will be negative and nothing further will 
happen with respect to that car. If the car under consideration is not a 
priority car, but the car has not previously been selected to run, tests 
11 and 18 are both negative and nothing further happens with respect to 
that car. Thus, the second half of the phase two portion simply tries to 
select priority cars for running, and delete those which are not priority 
cars, keeping the number of cars selected equal to or less than the number 
which are allowed to run on emergency power. 
In FIG. 10, following step 8, if test 9 determines that there are no 
priority cars for assignment, then a test 21 will determine if there are 
any customer preferred cars by examining a map of customer preferred cars 
to see if it is all zeros. Each car in the map of customer preferred cars 
also has a status bit indicating that it is preferred, for use in test 24 
of FIG. 4. If there is one or more cars designated as preferred by the 
customer (as indicated in a map in storage), a negative result of test 21 
will cause a step 22 to set a map of preferred cars equal to the map of 
customer preferred cars ANDed with cars on emergency (fed by the failed 
one or more feeders) and cars which are neither delayed nor 
non-responsive, in a fashion analogous to step 8. If there is a customer 
preferred car on the failed feeder which is neither delayed nor 
non-responsive, then a test 23 will be negative and a step 24 will set the 
priority level number equal to 2. A step 25 will set a status flag 
indicating that there are qualified preferred cars (which flag is 
interrogated in test 25 of FIG. 4) and the map of priority cars is updated 
by ORing it with the map of preferred cars. Then, during the second 
priority level, assignment of cars to run during phase two is made through 
steps and tests 10-17 as described hereinbefore. Note that use of 
non-fireman, non-preferred cars is permitted, but such cars are always 
urged to the lobby (FIG. 4) so as to lose their priority status in step 8 
(FIG. 10) to permit searching for a qualified (not delayed) preferred car 
in step 22. Thus the system inherently trends toward use of preferred 
cars. 
In FIG. 10, if tests 9 and 21 determine that there are no cars with firemen 
in them or cars not at landings and no customer preferred cars, then a 
step 27 will ensure that the preferred cars status is reset. This step can 
also be reached by an affirmative result of step 23 indicating that 
although the customer has designated some preferred cars, none of them are 
available (qualified) for assignment. Following step 27, a step 28 will 
set the priority level equal to 3, and the map of priority cars is 
indicated as being any car on emergency (any car on the failed one or more 
feeders) which is not delayed or non-responsive. 
Following step 29 of FIG. 10, the steps and tests 10-17 are repeated in 
order to attempt to select cars to run in the third priority level of 
phase 2. Each time that the map of priority cars is updated in one of the 
successive priority levels (step 8 and test 9 in priority level 1, step 22 
and test 23 in the second priority level, and following step 29 in the 
third priority level) when all the cars have been tested as indicated by 
an affirmative result of test 17, a test 30 determines whether a 
sufficient number of cars have been selected or not. If test 30 is 
negative, this means that more cars can be selected to run than have been 
thus far. A negative result of test 30 causes a test 31 to determine if 
priority level 1 is current. If it is, priority level 2 is attempted by an 
affirmative result of test 31 reaching test 21. But if priority level 1 is 
not involved (meaning that it is either priority level 2 or priority level 
3), a negative result of test 31 will reach a test 32 that determines 
whether priority level 3 is involved. If priority level 2 is current, a 
negative result of test 32 will cause step 28 to be reached to establish 
priority level 3. But once priority level 3 is current, an affirmative 
result of test 32 will cause the program to revert through the end of 
routine point 7. In other words, determining the selection of cars in each 
of three priority levels until all three levels have been attempted or 
until the number of cars selected equals the number which can be run on 
emergency power (as indicated in test 30) constitutes operation of phase 
two. During the highest priority level, step 8 gives precedence to cars 
with firemen in them as well as to cars not at landings. This means that 
any car which is operating in phase two and is not at the return landing 
can be a car selected to run until it reaches its return landing, in a 
fashion described with respect to phase two operation of the car at test 
26 in FIG. 4. Thus, whenever the car is away from its landing it continues 
to have permission to operate by virtue of being a priority car as set in 
step 8 of FIG. 10. And in FIG. 10, if the second priority level has not 
been reached with customer preferred cars established as priority cars (or 
as some of the priority cars), then it is known that priority level 3 will 
be reached so that each individual car controller (FIG. 4) is allowed to 
continue to run by virtue of the negative result of test 25 (FIG. 4). But 
if the car in question is operating during phase two without a fireman in 
its car, and it is not a preferred car, and the second priority level is 
reached by the group controller (FIG. 10), then the affirmative result of 
step 25 (FIG. 4) will force the car to give up its selection status by 
causing it to return to the designated return landing, thereby allowing 
another car to be selected. 
Notice that, in the phase two portion of the routine illustrated in FIG. 
10, there may be one fireman car, one customer preferred car and any other 
car, each being selected from a different one of the priority levels (in a 
case where three cars may be permitted to run). The priority levels simply 
establish the preferential basis upon which cars are to be selected to 
run, and are exclusive only to the extent that one of the higher priority 
levels will be assured selection whereas the lower levels will be selected 
only in the event that there is a capability to run more cars than those 
selected at the higher priority level. 
A first and simple aspect of the invention is the fact that the group 
control during phase one (during an initial attempt to bring all the cars 
down in a recovery procedure) is repeated immediately, in any case in 
which not all cars are recovered in the first attempt to recover each of 
the cars. This is as a consequence of the steps 28 at the bottom of FIG. 9 
resetting the statuses, which are utilized in FIG. 8 to require two cycles 
of initialization within which the number of cars to recover is 
established as the number of cars on the failed feeder. And in FIG. 9, 
this will cause the car selection process to repeat through all of the 
cars until test 23 indicates that there are no further cars to recover or 
attempt to recover. As a consequence, the opportunity for cars to be 
recovered and passengers to rapidly escape therefrom is increased because, 
having recovered as many cars as can be, the group then attempts to 
recover those cars which were not successfully recovered in original pass 
through phase one group control operation. Were it not for this recycling 
(a second attempt at recovering any delayed cars), the passengers therein 
would have to wait until service to passengers by other cars were 
initiated and then interrupted in accordance with the inventive procedures 
utilized herein in phase two. Of course, in prior art systems, after a 
single attempt to recover cars, no further attempt is made by a group 
controller (only operator intervention at a control panel could make 
further attempts to recover the cars on emergency power). 
A second significant aspect of the invention is utilization of priority 
levels for car selection as described at the top of FIG. 10. Since any car 
not at a landing has a highest priority level, those cars which are 
providing service to passengers but are away from the designated landing 
continue to have operational priority so that the service can be provided. 
But, as is described with respect to phase two operation in FIG. 4, each 
car controller will tend to force a call call to the return landing unless 
it is carrying a fireman or it is a preferred car or there are no other 
qualified preferred cars. Thus, the cars providing service which are not 
preferred cars will tend to return to the landing so that more preferred 
cars or delayed cars can be selected as necessary. In the case of only 
preferred cars providing service when there is still a delayed car, normal 
group control may provide for forcing lobby calls whenever there is no car 
in the group headed toward the lobby, in a known manner. In such case, 
test 25 of FIG. 4 can be eliminated. Thus, it will not be mere chance that 
even preferred cars which are providing service will ultimately reach the 
lobby and therefore lose their priority status. This will permit an 
unrecovered car (not at a landing) to be selected (step 8, FIG. 10) as a 
consequence of resetting its emergency start delayed status as a 
consequence of its re-try timer time-out at test 17 in FIG. 3. This 
provides an orderly way to permit re-trying the recovery of an as-yet 
unrecovered car without causing disruption of passenger service. 
Obviously, if when the re-try timer timed out, the unrecovered car was 
automatically given operational status to the detrement of any other car 
which had been selected to provide passenger service, then the other car 
would become stopped at some point in the building and the passengers 
therein would have to be rescued as well. Thus it is that the priority 
levels herein not only aid in achieving a principal objective of the 
invention (the automatic re-trying to recover cars during curtailed 
operation in phase two), but also tends to substitute preferred cars for 
non-preferred cars as they become available (the delaying condition is 
removed and the cars are returned to the designated landing). 
Of course, various aspects of the invention can be achieved in a slightly 
different way without using all of the aspects of the invention. And, 
although the invention is shown in terms of unique routines which are 
readily implementable by ordinary programming of a wide variety of 
computers which may be selected for use within the group controller 17 
(FIG. 1) and the car controllers 15, 16 (FIG. 1), it should be obvious 
that dedicated digital hardware, relay logic, or combinations of them may 
be utilized to perform the same functions as those performed by the 
controller microprocessors in accordance with the logic flow diagrams 
illustrated herein. 
Similarly, although the invention has been shown and described with respect 
to exemplary embodiments thereof, it should be understood by those skilled 
in the art that the foregoing and various other changes, omissions and 
additions in the form and detail thereof may be made therein and thereto, 
without departing from the spirit and the scope of the invention.