Patent Publication Number: US-6707374-B1

Title: Elevator access security

Description:
TECHNICAL FIELD 
     This invention relates to monitoring authorization for persons gaining access to elevators and floor landings of a building by means of an elevator. 
     BACKGROUND ART 
     For security purposes, it has been known to prevent elevator start-up in the event that an unauthorized passenger has entered the elevator. Typically, passengers carry portable devices which emit identification numbers (IDs) usually using RF or IR electromagnetic radiation. In commonly owned, copending U.S. patent application Ser. No. 09/111,355, filed Jun. 7, 1998, now abandoned an elevator system determines when a passenger has entered an elevator, other than the elevator assigned to respond to an automatically entered, destination call. However, no prior systems determine if a passenger, generally authorized to use the elevator, nonetheless exits on a floor for which the passenger is not authorized, or if a passenger without a portable device may be impermissibly on an elevator. 
     DISCLOSURE OF INVENTION 
     Objects of the invention include determining when a passenger, not authorized to do so, attempts to ride an elevator during a restricted trip, or exits an elevator onto a secure floor landing; and determining when passengers without IDs are on or exiting an elevator. 
     According to the present invention, directional motion detectors at the entrance to each elevator on a secure floor of a building, when an elevator is present with its doors open, count the number of passengers who enter and leave the elevator, to maintain a current passenger count; a poll of passengers wearing portable, ID-emitting devices, determines whether unknown passengers and which particular known passengers are in the elevator, by default determining if unauthorized passengers have left the elevator at a secure floor; a comparison of exiting passenger ID numbers with authorized passenger ID numbers will set an alarm if unauthorized or unknown persons have left the elevator at a secure floor, the doors on the floor may be locked, security personnel notified, and/or an alarm condition set, or sounded. 
     In further accord with the invention, passengers boarding and exiting an elevator are counted; a count of IDs sensed indicates if passengers without IDs are on board and IDs are compared with authorizations on secure elevator trips to restrict elevator passengers to those authorized for a particular, secure trip; otherwise the car is disabled. 
     In one embodiment, motion detectors on either side of the hoistway door entrance and on either side of the elevator door entrance determine the direction of passenger movement differentially, depending on which devices sense motion first. In a second embodiment of the invention, doppler motion detectors (of the type used in stores to prevent exiting through automatic entrance doors) determines the direction of passenger movement. 
     Other objects, features and advantages of the present invention will become more apparent in the light of the following detailed description of exemplary embodiments thereof, as illustrated in the accompanying drawing. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a stylistic, schematic, plan illustration of a pair of elevators utilizing pairs of motion detectors in accordance with the invention. 
     FIG. 2 is a stylistic, schematic, plan illustration of a pair of elevators utilizing doppler motion detectors in accordance with the invention. 
     FIGS. 3-5 are illustrative, functional flow diagrams illustrating principles of the present invention. 
    
    
     BEST MODE FOR CARRYING OUT THE INVENTION 
     Referring to FIG. 1, a pair of elevators  6 ,  7  each include a cab  8  having a car operating panel  9 , guide rails  11 , counterweights  13  with guide rails  14 , and doors  16 . The elevators are disposed in a building  17  to serve floor landings  18 , access to which is gained through hoistway doors  20 . The description thus far is of a conventional elevator system. 
     For this invention, all authorized passengers carry conventional portable devices that transmit ID numbers assigned to the corresponding passenger. These may be passive RFIDs (such as are used in gasoline stations) or other RF or IR transmitters. 
     According to the invention, each elevator has a pair of motion detectors  22  which may be conventional, having a sensitivity pattern which causes them to sense only motion on the elevator car  6 ,  7 , and not on an adjacent landing  18 . Adjacent to the hoistway doors  20  on each landing  18 , there is a pair of motion detectors  23  which may be conventional, having a sensitivity pattern that causes them to sense motion only on the landing  18 , and not within one of the elevators  6 ,  7 . As a passenger moves from the landing  18  into the elevator  7 , for instance, the motion detectors  23  will provide a signal prior to the detectors  22 , thus indicating that passenger movement is in the entering direction. As a passenger leaves the elevator  7 , for instance, the motion detectors  22  will provide a signal prior to the motion detectors  23 , thus indicating that passenger movement is in the exiting direction. 
     Referring to FIG. 2, each of the elevators in another embodiment of the invention have a doppler motion detector  25  disposed in a suitable position, such as above the entrance, which may be conventional, and which may be mounted in any conventional fashion to suit the particular installation involved. Similarly, each entrance to an elevator from the elevator corridor  18  through hoistway doors  20  has a doppler motion detector  26  disposed in a suitable position, such as above the entrance, which may be conventional, and which may be mounted in any conventional fashion to suit the particular implementation of the invention. Passengers entering the elevator  7 , for instance, will cause the detector  25  to provide a signal, whereas the detector  26  will provide no signal. Passengers leaving the elevator  7 , for example, will cause the detector  26  to provide a signal, whereas the detector  25  will provide no signal. Thus a signal from the detector  25  indicates passenger motion in the entering direction, whereas a signal from the detector  26  indicates passenger motion in the exiting direction. The detectors  22 ,  23 ,  25 ,  26  may be used to keep a running count of passengers in the elevator for dispatching and other purposes, as well as to service the functions of the invention (FIG.  3 ). The detectors  22 ,  25  will be interconnected with a processor disposed within the building by means of the traveling cable, or such other communication medium as is used between the elevators and the building. The detectors  23 ,  26  will be connected by wire or in any other suitable fashion to the processor. 
     Referring to FIG. 3, if hardware associated with the detectors  22 ,  23  or  25  sense that there is passenger movement in the entering direction, an entering interrupt  29  will reach a step  30  to increment a P counter, which keeps a running count of the passenger population within the elevator car. And then other programming is reverted to through a return point  31 . Similarly, if hardware associated with the detectors  22 ,  23  or  26  determine that there is passenger movement in the exiting direction, an exiting interrupt  32  will reach a step  33  to decrement the P counter. Periodically, the programming reaches a count reset routine through an entry point  34  and a test  35  determines if the elevator is shut down, or not. By that, is meant that the elevator is parked with its doors closed and its motor off. Whenever such is the case, an affirmative result of test  35  will reach a step  36  to reset the P counter to all zeroes, in order to assure that the elevator will start with a correct count when it resumes operation. When the elevator is not shut down, a negative result of test  35  reaches other programming through the return point  31 . 
     Referring to FIG. 4, an exemplary diagram of trip security functions which may be performed in order to practice the present invention includes entrance into a trip security subroutine through an entry point  36 . A first test  37  determines if a trip alarm has been set. Initially, it will not, so a test  38  will determine if the doors of the elevator are fully closed or not. If so, the remainder of the routine of FIG. 4 is bypassed and other programming is reverted to through a return point  39 . When the doors are at least partially open, a negative result of test  38  reaches a test  40  to see if a timing delay, described hereinafter, is underway or not. Initially it will not be, so a test  41  determines if this is a secure trip or not. If not, the remainder of FIG. 4 is bypassed through return point  39 . But if it is a secure trip, the routine continues with a step  42  which sets a security stop flag that will interact with the safety chain of the elevator and absolutely prevent if from running, unless the flag is subsequently reset. This provides the security feature of not allowing the elevator to run unless all the passengers thereon are authorized for the particular secure trip involved. Then, passenger IDs are polled, in a subroutine  43 , a step  44  sets a value, I, equal to the number of lDs that responded, and the IDs of the passengers are checked in a subroutine  45  to see if they are authorized to make the particular trip (which may be defined as the particular elevator at a particular time of day, or in some other fashion). If not all of the passengers are authorized for the trip, a negative result of a test  46  will reach a step  49  to force the door open (whether or not it is open), and a step  50  to make an announcement that there are unauthorized persons on the elevator, hopefully to cause someone who innocently entered the elevator by mistake to leave the elevator. Following the announcement, a test  51  determines if a timing interval is underway or not. Initially it will not be, so a negative result of test  51  reaches a step  52  to initiate the interval timer and a step  53  to set the timing latch to indicate that the timing interval is now underway. Then other programming is reached through the return point  39 . 
     In the next pass through the routine of FIG. 4, results of tests  37  and  38  will be negative, and this time test  40  will be affirmative reaching a test  55  to determine if the time interval has timed out or not. If not, the passengers are once again polled and checked in the subroutines  43  and  45  and if there still are unauthorized persons on board, a negative result of test  46  causes step  50  to again make the announcement about unauthorized passengers. In a typical system, the announcement will take more time than it takes to repetitively reach the routine of FIG. 4 in the processor, so that the announcement process will simply be reinforced to repeat the announcement until it is cancelled, thereby rendering the step  50  to be redundant in subsequent passes. The test  51  will be affirmative this time, so that the steps  52  and  53  are bypassed as other programming is reached through the return point  39 . This process may continue through an affirmative result of test  40 , a negative result of test  55 , a negative result of test  46  and an affirmative result of test  51 , until either all unauthorized passengers leave the elevator car or the interval timer times out. Assuming the interval timer times out, a pass through the routine of FIG. 4 will find affirmative results of test  40  and test  55 , causing a step  56  to set a trip alarm, which will leave the elevator with the security stop flag set, thus interrupting the safety chain and causing the elevator to remain where it is, while the alarm condition continues. Steps  57  and  58  may store the unauthorized IDs, and the difference between the number of passengers and the number of IDs, thus indicating why the alarm was set, and a step  59  resets the timing interval flag. Subsequent passes through the routine of FIG. 4 will pass through an affirmative result of test  37 , and a negative result of a test  60  will cause all of the routine to be bypassed, preserving the status quo until security personnel take charge. When a trip alarm reset button is pressed, the alarm condition is reset in a step  61 . 
     Assume that any unauthorized ID passenger has left the elevator car, in a subsequent pass through the routine of FIG. 4, an affirmative result of test  46  will reach a test  64  to see if the passenger count exceeds the number of IDs. If so, an affirmative result of test  64  triggers all the functions referred to hereinbefore with respect to a negative result of test  46 . If no unknown persons are on board, a negative result of test  64  reaches a step  65  which resets the timing interval flag utilized in tests  40  and  51 , which may be redundant if no unauthorized passengers had been present in the first place. A step  66  resets the security stop which allows the elevator car to move, and a step  62  will cancel the announcement, either to cause the announcement to cease if one is being made, or redundantly if no unauthorized passengers had been on board the elevator. A step  63  will reset the force door open flag, to indicate to the conventional door close routine that the security check has been successfully completed, and the door close routine may commence. 
     The functions illustrated in FIG. 4 will continue to be performed so long as the doors are not fully closed. Thus, should a passenger enter the elevator at the last minute, the step  42  will again set the security stop flag. And as described hereinbefore, the routine will attempt to cause the passenger to leave in a period of time, or will end up causing the alarm to be set with the security stop flag in place, immobilizing the elevator. 
     In FIG. 5, a floor security routine is reached through an entry point  67  and a first test  68  determines if the doors are fully closed or not. If they are, that means there can be no change in passenger population, so an affirmative result of test  68  reaches a subroutine  69  to poll the passenger IDs. Then a step  70  stores a list of the responding IDs, a step  72  sets a number, I, equal to the number of IDs determined in the poll, a step  73  sets a number, U, equal to P-I, so that U represents the number of unknown passengers in the car, and a step  74  sets a number, N, equal to the current population of passengers, P, in the car. Then other programming is reverted to through a return point  76 . 
     In a subsequent pass through the routine of FIG. 5, if the doors are even partially open, a negative result of test  68  will reach a test  77  to determine if the floor of the car (C) is a secure floor or not. If not, all of the other functions in FIG. 5 are bypassed and other programming is reached through the return point  76 . But if the floor is secure, a test  78  determines if the number of passengers, N, in the car at the time it reached the floor is larger than the current number of passengers, P, thereby indicating a decrement in the passenger count. If so, a subroutine  79  will poll all of the portable devices of the passengers within the car to determine their IDs, a step  80   a  sets I equal to the present number of IDs in the car, and a subroutine  80   a  will provide an exit security check, to compare the passengers presently in the elevator with a list of passengers made during the trip in subroutine  69  to determine whether the passengers with IDs who are now missing are all on the list of authorized passengers for the particular floor at which the elevator is stopped. Then a test  81  determines if all of the exited passengers were authorized; if not, a step  82  will store the IDs of those unauthorized persons who have exited. Then a step  83  will lock all doors on the floor, a step  84  will notify security and a step  85  will cause an alarm to be set. If desired, in order to not warn the unauthorized passengers that they have been detected, setting of the alarm may not include sounding an audible alarm, if desired. 
     On the other hand, if all of the passengers with IDs who exited were authorized, an affirmative result of test  81  will bypass steps  82 - 85 . Whether or not any passengers with IDs made unauthorized exits onto the secure floor, a test also has to be made to see if any unknown passengers (not having IDs) may have exited onto the secure floor. Therefore, a test  88  determines if the present total number of passengers, P, minus the present number of passengers who bear IDs, I, minus the number of original unidentified passengers, U, is less than zero. This will occur only if the unidentified passenger count has decreased after the car reached the floor. If this count is not less than zero, a negative result of test  88  will bypass the remainder of the routine, through the return point  76 . This is true whether or not the alarm may already be set. On the other hand, if an unidentified person has left the elevator on the secure floor, an affirmative result of test  88  reaches a step  90  to store the count of unidentified persons who have left the elevator car, and a test  83  determines if the floor alarm has been set yet or not. If it has, there is no point in performing the functions of steps  83 - 85  again so an affirmative result of test  93  bypasses the rest of the program through the return point  76 . However, if no unauthorized passengers with IDs have been detected as leaving the elevator, the floor alarm will not have been set in step  85  so a negative result of step  93  causes a series of steps  95 - 97  to lock the doors, notify security, and set the floor alarm. If there has been no decrement in the passenger count, a negative result of test  78  bypasses the steps and tests  79 - 97 . If the car is not stopped at a secure floor, all of the steps and tests  77 - 97  are bypassed by a negative result of test  77 . 
     The description with respect to FIGS. 3-5 is illustrative, merely, there being a wide variety of manners in which to utilize the present invention. 
     The aforementioned patent application is incorporated herein by reference. 
     Thus, although the invention has been shown and described with respect to exemplary embodiments thereof, it should be understood by those skilled in the art that the foregoing and various other changes, omissions and additions may be made therein and thereto, without departing from the spirit and scope of the invention.