Patent Description:
When performing maintenance operations, a serviceman may override the safety circuit intentionally or unintentionally. The safety circuit may also become short-circuited, for example, by dirt in shaft electronics or wear of a traveling cable, leaving safety measures in the shaft completely inoperable. This is a critical safety issue especially in elevators With elevator shafts having low/no headroom or pit, according to regulations there has to be a device limiting the elevator car travel, normally activated when the safety circuit is in the inspection mode. However, it may be possible that the device limiting the elevator car travel has also been short-circuited.

<CIT> discloses an elevator that includes an elevator cage, a drive arrangement, a first safety controller and a second safety controller. The first and the second safety controllers monitor a state of the elevator respectively by means of at least one first or second sensor and on detection of an unsafe state institute a measure in order to bring the elevator into a safe state. The first safety controller is arranged on the elevator cage and the second safety controller is arranged in the region of the drive arrangement.

Thus, it would be beneficial to have a solution that would alleviate at least one of these drawbacks.

According to at least some of the aspects, a solution is provided that enables stopping an elevator car even if all electrically controlled stopping devices have become non-operational.

According to the invention, there is provided an elevator system comprising an elevator car configured to move in an elevator shaft; a main safety controller comprising a main safety output and a secondary safety output, wherein the main safety output is configured to control machinery brakes of the elevator car; and a secondary safety circuit connected to the secondary safety output and arranged in the elevator car and comprising at least one safety contact configured to control stopping means arranged in the elevator car. When the at least one safety contact is triggered the secondary safety circuit is configured to control the stopping means to cause stopping of the elevator car. The stopping means comprises a solenoid, an engagement mechanism and a safety gear, wherein in response to triggering the at least one contact, the solenoid is configured to cause the engagement mechanism to move to a position enabling contact with a triggering device in the elevator shaft, the triggering device in turn causing activation of the safety gear. The main safety controller further comprises a first input connected to the solenoid, wherein the main safety controller is configured to test the operation of the solenoid by switching off the secondary safety output and determining whether feedback information is received from the solenoid at the first input.

In an embodiment, the main safety controller is configured to test the operation of the solenoid at each stop of the elevator car.

In an embodiment, the main safety controller is configured to test the operation of the solenoid when testing the operation of the machinery brakes of the elevator car.

In an embodiment, the at least one safety contact is associated with at least one balustrade contact.

In an embodiment, the main safety controller comprises a second input connected to the at least one balustrade contact, wherein the main safety controller is configured to receive a signal at the second input when the at least one balustrade contact is triggered.

In an embodiment, the at least one safety contact comprises an ascending car overspeed protection contact.

In an embodiment, the at least one safety contact comprises a safety light curtain configured to be triggered when detecting an obstacle under the elevator car.

In an embodiment, the at least one safety contact comprises at least one pressure sensor on the roof of the elevator car.

The accompanying drawings, which are included to provide a further understanding of the invention and constitute a part of this specification, illustrate aspects and embodiments of the invention and together with the description help to explain the principles of the invention. In the drawings:.

In the following a solution is provided in which a secondary safety circuit separate from a first safety circuit associated with machinery brakes of an elevator car is provided for securing a safety space when the roof of an elevator car or a shaft pit is occupied.

<FIG> illustrates a block diagram of an elevator system 100A according to an aspect. The elevator system 100A comprises a main safety controller <NUM> configured to control safety operations of the elevator system 100A comprising at least one elevator car. The main safety controller <NUM> is configured to monitor a status of a first safety circuit <NUM>, and if there are no issues with the first safety circuit <NUM>, the main safety controller <NUM> controls via a main safety output <NUM> power supply to the machinery and/or machinery brakes of the elevator. The safety circuit <NUM> may comprise a plurality of switches that monitor the operation of various elements, such as car and landing doors, car position and overspeed governor, in the elevator system.

In addition to the first safety circuit, the elevator system 100A comprises a secondary safety circuit <NUM>. The secondary safety circuit <NUM> is connected to a secondary safety output <NUM> of the main safety controller <NUM> and arranged in the elevator car. A power source <NUM> may be provided to provide power to the secondary safety circuit <NUM>. The secondary safety circuit <NUM> comprises at least one safety contact 114A. 114N configured to control stopping means <NUM> arranged in the elevator car. In an example, regardless of the status of the main safety circuit <NUM> or the machinery brakes, the secondary safety circuit <NUM> is able to cause stopping of the elevator car. When the at least one safety contact 114A. 114N is triggered, the secondary safety circuit <NUM> is configured to control the stopping means <NUM> to cause stopping of the elevator car.

The at least one safety contact 114A. 114N may comprise different types of elements. The at least one safety contact 114A. 114N may be related to one or more balustrades arranged on the roof of the elevator car. When the balustrade is moved from its resting position either upwards (as in setting it up) or downwards (as when a person is standing on a folded-down balustrade), this is detected, for example, by at least one switch arranged in connection with the balustrade. As the safety contact associated with the balustrade is a normally closed (NC) contact, the safety contact opens when the balustrade is deviated from its resting position and, thus, causes a state change in the secondary safety circuit <NUM>.

Another example of possible safety contacts 114A. 114N comprises an ascending car overspeed protection (ACOP) contact associated with a specific speed limit. For example, the safety contact may be a <NUM>% normally closed safety contact. This means that when a specific speed limit of the elevator car is exceeded by <NUM>%, the normally closed safety contact opens and causes a state change in the secondary safety circuit <NUM>.

Another example of possible safety contacts 114A. 114N comprises a safety light curtain configured to be triggered when detecting an obstacle under the elevator car. The safety light curtain may be used to detect obstacles below the elevator car in the elevator shaft.

Another example of possible safety contacts 114A. 114N comprises at least one pressure sensor on the roof of the elevator car. For example, a pressure mat may be arranged on the roof of the elevator car to detect any person present on the roof.

According to the invention, the stopping means <NUM> comprises a solenoid, an engagement mechanism and a safety gear. The secondary safety circuit <NUM> is connected to the solenoid. Normally, when all the safety contacts 114A. 114N of the secondary safety circuit <NUM> are in their normal state, i.e. in the normally closed state, electricity flows to the solenoid and its plunger is in a retracted position. When the state of one of the safety contacts 114A. 114N changes, the electricity flow to the solenoid is interrupted. This causes the plunger to protrude and make contact with the engagement mechanism. The engagement mechanism in turn moves to a position that enables a contact with a triggering device located in the elevator shaft. The triggering device causes activation of the safety gear of the elevator car. The triggering device may be located close to the upper end of the elevator shaft. Thus the stopping means <NUM> together with the secondary safety circuit <NUM> and the triggering device enable creating a safety space in the elevator shaft.

<FIG> illustrates a block diagram of an elevator system according to another aspect. The example illustrated in <FIG> is similar than was already illustrated in <FIG>, and already discussed elements are not discussed again, and reference is made to the description of <FIG>.

As illustrated in <FIG>, the elevator system 100B additionally comprises a feedback loop from the stopping means <NUM> received at a first input <NUM> at the main safety controller <NUM>. The stopping means <NUM> comprise the earlier discussed solenoid, and the main safety controller <NUM> is configured to switch off the secondary safety output <NUM>. This causes interruption of the electrical power supply to the solenoid. If the solenoid works properly, the end result should be that the plunger of the solenoid protrudes. If the solenoid is faulty, it may be that nothing happens. In any case, information about the state change of the solenoid is received at the first input <NUM> of the main safety controller <NUM>. Thus, if an expected signal in response to switching off the secondary safety output <NUM> is not received from the solenoid, the solenoid is determined to be faulty.

When the main safety controller <NUM> is configured to switch off the secondary safety output <NUM>, the main safety controller <NUM> may stop controlling a normally open (NO) switch or switches of the secondary safety output <NUM>. This in turn breaks the secondary safety circuit <NUM>, and the electrical power supply to the solenoid is interrupted, as already discussed above.

The testing of the solenoid can be performed, for example, at each stop of the elevator car. This ensures continuous monitoring of the solenoid and if the solenoid is faulty, this can be detected quickly. In another example, the testing of the solenoid is performed simultaneously when testing the operation of the machinery brakes of the elevator car. The machinery brake testing and thus also the solenoid testing, may be performed, for example, once in every <NUM> hours. It is evident that the testing period of the solenoid may also be any other time period, for example, one day.

<FIG> illustrates an elevator car <NUM> in an elevator shaft <NUM> according to an embodiment.

The secondary safety circuit <NUM> has been arranged in the elevator car <NUM>. The operation of the secondary safety circuit <NUM> has been discussed in more detail in relation to <FIG> and <FIG>, and therefore, this discussion is not repeated here, and reference is made to the description of <FIG> and <FIG>. The solenoid <NUM> is connected to the secondary safety circuit <NUM>.

<FIG> discloses a simplified illustration of how the solenoid <NUM> is behaving when the electricity flow to the solenoid <NUM> is interrupted in response to triggering at least one safety contact of the secondary safety circuit <NUM>. This causes an engagement mechanism <NUM>, for example, a plunger to protrude. The engagement mechanism <NUM>, i.e. the plunger, then in turn moves to a position that will contact the triggering device <NUM> located in the elevator shaft <NUM> when the elevator car <NUM> moves upwards in the elevator shaft <NUM>. When the engagement mechanism <NUM> contacts the triggering device <NUM> and when the elevator car <NUM> continues to move upwards in the elevator shaft, the triggering device <NUM> prevents the engagement mechanism <NUM> to move freely with the elevator car <NUM>. This in turn prevents a speed limiting rope <NUM> to move freely with the elevator car <NUM>, causing a safety gear <NUM> of the elevator car <NUM> to tighten to a guide rail in the elevator shaft, eventually stopping the elevator car <NUM>. Thus, by using the secondary safety circuit and the solenoid and depending on the position of the triggering device <NUM> in the elevator, a safety space having a desired size can be created in the elevator shaft <NUM>. Although <FIG> illustrates one exemplary form for the triggering device <NUM>, it is evident that the triggering device <NUM> may take any other appropriate form that is able to cooperate with the plunger <NUM>.

<FIG> illustrates an elevator car <NUM> in an elevator shaft according to another embodiment. <FIG> discloses a different view of the arrangement illustrated in <FIG>. The elevator car <NUM> is configured to move in the elevator shaft. It is evident that <FIG> may not necessarily disclose all elements present in the elevator shaft.

When the elevator car moves in the elevator shaft, the speed limiting rope <NUM> moves together with the elevator car <NUM>. Diverting pulleys <NUM> may be used at each end of the elevator shaft in connection with the speed limiting rope <NUM>. When the electricity flow to the solenoid <NUM> is interrupted, this causes an engagement mechanism <NUM>, for example, a plunger to protrude. The engagement mechanism <NUM>, i.e. the plunger, then in turn moves to a position that will contact the triggering device <NUM> located in the elevator shaft <NUM> when the elevator car <NUM> moves upwards in the elevator shaft <NUM>. When the engagement mechanism <NUM> contacts the triggering device <NUM> and when the elevator car <NUM> continues to move upwards in the elevator shaft, the triggering device <NUM> prevents the engagement mechanism <NUM> to move freely with the elevator car <NUM>. This in turn prevents the speed limiting rope <NUM> to move freely with the elevator car <NUM>, causing a safety gear <NUM> of the elevator car <NUM> to tighten to a guide rail <NUM> in the elevator shaft, eventually stopping the elevator car <NUM>.

One or more of the above embodiments may provide at least one of the following benefits. As the disclosed solution provides a mechanical solution for stopping the elevator car, the solution works even if the elevator car approaches an end of the elevator shaft during a power failure. Further, if the first safety circuit is short-circuited, this does not have any effect on the operation of the secondary safety circuit. Further, even if it happens that the secondary safety circuit is short-circuited, this will be realized when testing the solenoid. Further, it is not possible to perform the short-circuiting of the secondary safety circuit from a maintenance access panel as the wiring associated with the solenoid and the at least one safety contact is in the elevator car.

Example embodiments may be implemented in software, hardware, application logic or a combination of software, hardware and application logic. The example embodiments can store information relating to various methods described herein. This information can be stored in one or more memories, such as a hard disk, optical disk, magneto-optical disk, RAM, and the like. One or more databases can store the information used to implement the example embodiments. The databases can be organized using data structures (e.g., records, tables, arrays, fields, graphs, trees, lists, and the like) included in one or more memories or storage devices listed herein.

All or a portion of the example embodiments can be conveniently implemented using one or more general purpose processors, microprocessors, digital signal processors, micro-controllers, and the like, programmed according to the teachings of the example embodiments, as will be appreciated by those skilled in the computer and/or software art(s). Stored on any one or on a combination of computer readable media, the examples can include software for controlling the components of the example embodiments, for driving the components of the example embodiments, for enabling the components of the example embodiments to interact with a human user, and the like. Such computer readable media further can include a computer program for performing all or a portion (if processing is distributed) of the processing performed in implementing the example embodiments. In the context of this document, a "computer-readable medium" may be any media or means that can contain, store, communicate, propagate or transport the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer. A computer-readable medium may include a computer-readable storage medium that may be any media or means that can contain or store the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer. A computer readable medium can include any suitable medium that participates in providing instructions to a processor for execution. Such a medium can take many forms, including but not limited to, non-volatile media, volatile media, transmission media, and the like.

Claim 1:
An elevator system (100A, 100B) comprising:
an elevator car (<NUM>) configured to move in an elevator shaft (<NUM>);
a first safety circuit (<NUM>);
a main safety controller (<NUM>) comprising a main safety output (<NUM>) and a secondary safety output (<NUM>), wherein the main safety output (<NUM>) is configured to control machinery brakes of the elevator car (<NUM>) based on the first safety circuit (<NUM>); and
a secondary safety circuit (<NUM>) connected to the secondary safety output (<NUM>) and arranged in the elevator car (<NUM>) and comprising at least one safety contact (114A...114N) configured to control stopping means (<NUM>) arranged in the elevator car (<NUM>);
wherein when the at least one safety contact (114A...114N) is triggered the secondary safety circuit (<NUM>) is configured to control the stopping means (<NUM>) to cause stopping of the elevator car (<NUM>),
characterized in that
the stopping means (<NUM>) comprises a solenoid (<NUM>), an engagement mechanism (<NUM>) and a safety gear, wherein in response to triggering the at least one contact (114A...114N), the solenoid (<NUM>) is configured to cause the engagement mechanism (<NUM>) to move to a position enabling contact with a triggering device (<NUM>) in the elevator shaft (<NUM>), the triggering device (<NUM>) in turn causing activation of the safety gear, and
wherein the main safety controller (<NUM>) comprises a first input (<NUM>) connected to the solenoid (<NUM>), wherein the main safety controller (<NUM>) is configured to test the operation of the solenoid (<NUM>) by switching off the secondary safety output (<NUM>) and determining whether feedback information is received from the solenoid at the first input (<NUM>).