Patent Description:
Modern people conveyors (e.g. elevators) typically have one or more in-built safety systems arranged to activate when the people conveyor develops a fault in order to protect its users. By way of example, typical safety systems may be arranged to disconnect a drive system (e.g. motor) of a people conveyor in order to prevent further motion being imparted to the conveyor (sometimes referred to as 'Safe Torque Off'), and/or to engage one or more emergency brakes in order to bring the people conveyor to a halt and hold it in place (sometimes referred to as 'Safe Brake Control'). These safety systems are used in order to protect the users of the people conveyors, as well as to prevent damage to the people conveyor itself.

People conveyors are typically equipped with a variety of sensors, encoders, etc. arranged to monitor various operational parameters of the people conveyor e.g. position, speed, acceleration, elevation, temperature, level of vibration, door open status, etc. Typical safety systems monitor the outputs of such sensors in real time in order to determine whether the people conveyor is functioning correctly, and thereby determine whether the safety systems should be activated. This is typically implemented through a safety control channel. The safety control channel typically includes a processor (e.g. microprocessor, microcontroller unit, FPGA, etc.) which receives the outputs from various sensors and/or other systems (e.g. an elevator controller) and is programmed to control the operation of one or more safety systems in response.

It is important that safety systems in people conveyors are tolerant of malfunctions, i.e. that they continue to operate as intended in the case of an internal failure. If a safety control channel fails to activate a safety system when required, it is possible that serious harm can occur to users of the people conveyor and/or damage may occur to the people conveyor itself. As a result of this, some safety systems employ multiple safety control channels configured to operate independently and in parallel so as to create redundancy in the system. If one channel fails, another channel can still activate the safety system appropriately.

However, the use of multiple independent safety control channels operating in parallel can be costly and power-inefficient. Each additional channel requires extra components, some of which are expensive (e.g. microcontroller units). Furthermore, adding extra safety control channels increases the space required (e.g. on a printed circuit board (PCB) or system-on-chip (SoC)) to fit the additional components. For example, adding a third parallel safety control channel would add about <NUM>% to the component cost as well as increasing the overall size and power draw.

In the case of an internal malfunction in a channel, the channel will normally operate in a fail-safe manner to activate the safety system, e.g. to engage a brake and/or remove power from a drive mechanism. Increasing the number of channels increases the probability of a channel malfunction and therefore increases the probability that the safety systems are activated due to a channel malfunction. This can be inconvenient and reduces the availability of the system. Further logic may be introduced to combine the outputs of the multiple channels so as to reduce this effect. However, as described above, such additional logic may be costly and space-inefficient.

<CIT> discloses an elevator system including a first communication controller installed in a cage, an elevating path or a platform, and a second communication controller connected to the first communication controller through a serial communication network and an individual communication line. Each communication controller is connected to a respective safety control device. <CIT> discloses a safety control device and a method according to he preambles of claims <NUM> and <NUM>, respectively.

According to a first aspect of the present invention there is provided a safety control device for a people conveyor, comprising:.

characterised in that the override control channel is configured to override the first or second safety control signal in response to a determination that a fault has occurred in the corresponding safety control channel, thereby preventing activation of one or more safety systems.

According to a second aspect of the present invention there is provided a method of controlling one or more safety systems of a people conveyor, the method comprising:.

characterised in that the method comprises overriding the first or second safety control signal in response to a determination that a fault has occurred in the corresponding safety control channel, thereby preventing activation of one or more safety systems.

According to a third aspect of the present invention there is provided a non-transitory computer readable medium according to the incependent claim <NUM>.

In some examples, the same input signals are received by the first and second safety control channels. In some examples each input signal is provided in parallel to each of the first and second safety control channels. It will be appreciated that if more than two safety control channels are provided, each input signal may be provided in parallel to each safety control channel. The one or more input signals may indicate one or more operational parameters of the people conveyor. For example, in an elevator system, the input signals may indicate a position, a speed, an acceleration, a vibration signature, a temperature signal, smoke detection signal, safety chain signal, etc. In an escalator system, the input signals may indicate a position, a speed, an acceleration of the steps and/or of the handrail, a temperature, etc. The one or more input signals may comprise one or more discrete input signals and a Controller Area Network (CAN) bus. The discrete input signals may be output by one or more sensors, encoders, etc. included in the people conveyor. The discrete signals can be direct analogue electric signals that may be input directly to a pin of a microcontroller. The CAN bus allows a broader range of operational conditions and/or parameters to be provided digitally to the microcontroller.

In some examples, the first and second safety control signals are configured to control the operation of one or more safety systems of the people conveyor. Examples of safety control systems include a brake control system and a drive control system.

The two safety control channels in parallel are more robust than a single safety control channel as failure of one channel still leaves the other channel fully operational and able to operate the safety control system. Total failure only occurs when both the first and second channels fail, but this is highly unlikely.

When a safety control channel fails it can either fail with its output indicating that the safety system should be activated or it can fail with its output indicating that the safety system should not be activated. The latter state is dangerous as inputs that indicate an unsafe state of the people conveyor may not result in that channel activating the safety system. This is why the second safety control channel is added, so that a redundant system is in place as a backup. However, the former state (safety control channel fails with its output indicating that the safety system should be activated) is also inconvenient as it results in the safety system being engaged when the only malfunction is in one of the two safety control channels. A particular inconvenience in elevator systems is that halting the elevator between floors can result in passengers becoming trapped in the elevator until a rescue operation can be carried out.

The override control channel of the present invention monitors the health of the two safety control channels and identifies any faults that occur therein. If the override control channel detects a fault, it is able to override the safety control signal output by the detected faulty channel thereby preventing activation of one or more safety systems. In other words the override control channel can force the output of the faulty channel to an "on" or "normal" state, i.e. the state that represents normal safe operation of the people conveyor system. The operation of the override control channel is significantly less complex than the operation of a full safety control channel, and as a result the override control channel may comprise fewer, more power-efficient, and cheaper components. For example, the override control channel does not need to receive and monitor all of the analogue and/or digital inputs that the main channels receive (and can therefore be a smaller device), nor does the override channel need to monitor and/or evaluate those inputs and therefore it can be a less complex processing device. In some examples the override control channel may comprise a comparatively cheap, low-powered microprocessor, whereas the first and second safety control channels may each comprise a more expensive and powerful microcontroller unit in order to execute their more complex functions. In some examples, the override control channel comprises a <NUM>-pin microprocessor, and the first and second safety control channels each comprise a <NUM>-pin microcontroller unit.

In some examples, the override control channel is configured to monitor the health of the first and second safety control channels by periodically instructing the safety control channels to perform one or more tasks and to monitor a response from that safety control channel. This is sometimes referred to as the challenge-response method, and thus the override control may be configured to monitor the health of the first and second safety control channels using the challenge-response method. Additionally, or alternatively, the override channel can monitor one or more debug outputs from each safety control channel to check for proper operation of the safety control channel. Examples of tasks that may be instructed by the override control channel in order to monitor the health of the safety control channels may include a simple request for response, a request for a value of one of the inputs, or a mathematical calculation to perform or a problem to solve. It will be appreciated that these are simply given by way of example. A correct response from the microcontroller of the safety control channel would indicate that the microcontroller is functioning and that the safety control channel can be considered healthy. An incorrect response or a lack of response would indicate a fault in the microcontroller and that the corresponding safety control channel is unhealthy / malfunctioning. In the case of requesting the value of an input, the override controller can request the same value from both channels and compare the results. If the results differ by more than an acceptable amount then a fault may have occurred. The microcontrollers may be arranged to output a debug signal to the override control channel at various stages in a normal processing loop, e.g. discrete inputs read successfully, serial input (e.g. CAN bus) read successfully, evaluation of inputs completed successfully, output set successfully, etc. The override control channel may check, for example, based on the debug signals, whether program flow is being performed in the correct order, whether program flow is being carried out in a timely manner, or whether the microprocessors of the first and second channels are operating in the same manner (e.g. providing the same outputs and/or providing outputs in the same order and/or providing outputs sufficiently in sync, allowing or a degree of normal jitter). If signals are not received in the correct order, or if outputs are delayed more than a certain amount (which may be an absolute amount or an amount relative to the other controller, or both) then the corresponding safety control channel may be considered to be unhealthy / malfunctioning.

In some examples, the override control channel is configured to monitor the health of the entirety of the first and second control channels. For example, if a fault (e.g. a loss of signal) occurs on an input line to the microcontroller of one safety control channel, the override control channel may be able to detect the fault by comparing the values of the input signals in each channel. This may be done directly, e.g. before the signals reach the microcontrollers. Alternatively, the override control channel may determine whether the microcontroller is successfully able to receive the expected signal - e.g. through comparison with the signal received via the equivalent input for the microcontroller of the other safety control channel. This comparison may be done through the microcontrollers themselves.

In some examples, the override control channel is configured to monitor the health of one or more portions of the first and second safety control channels. For example, the override control channel may monitor one or more components or sub-circuits of the first and second safety control channels. The microcontroller may be one portion of a safety control channel. The override control channel may directly monitor the health of the one or more portions (e.g. where the override control channel is directly coupled to the one or more portions), or the override control channel may indirectly monitor the health of the one or more portions (e.g. via monitoring of the microprocessors of the first and second safety control channels). In some examples, the override control channel is configured to monitor the health of the microcontrollers of the first and second safety control channels only. By having the override control channel monitor the health of the microcontrollers only, the number of input pins required by the override control channel may be kept to a minimum. This may help enable the use of a small, cheap and low-powered microprocessor in the override control channel.

In some examples, the override control channel is coupled to the first and second safety control channels via a serial communication line. As only simple instructions and debug signals are transmitted between the override control channel and the two safety control channels, a serial communication line may be sufficient to facilitate communication between the safety control channels and the override control channel. Further, a serial communication line means that the override controller can be a small microprocessor with few pins, thereby keeping its cost low.

In some examples, the first and second safety control channels are further configured to monitor the health of the override control channel; determine whether a fault has occurred in the override control channel; and deactivate the override control channel in response to a determination that a fault has occurred in said channel. A faulty override control channel could be problematic for the safety device. For example it could incorrectly override one or both of the safety control signal outputs, thereby preventing a real safety signal from activating the safety control systems. Having the two safety control channels monitor the health of the override control channel, and deactivate the channel based on a determination that a fault has occurred, reduces the likelihood of this occurring. The monitoring of the override channel may be similar to the monitoring described above for the main channels, e.g. requesting simple tasks to be completed or monitoring debug outputs for correct operation.

In some examples, the first and second safety control channels are configured, in response to a determination that a fault has occurred in the override control channel, to enable the people conveyor to operate as normal and optionally provide an output indicating that a fault has occurred in the override control channel. When the override control channel is not operational, the system simply functions as a standard two-channel redundant safety system, which is already considered sufficiently safe for the people conveyor to function normally, as the two safety control channels provide redundant safety control. It may therefore only be necessary to flag that the override control channel is faulty e.g. to a maintenance worker or service department in order to allow repairs to be made at a convenient time. Thus, the availability of the elevator system is not compromised during this period until suitable repair can be made.

In some examples the override control channel is configured to override the first or second safety control signal on a temporary basis or for a predefined period of time. The override control channel may be configured to temporarily override the first or second control signal until the people conveyor is positioned such that any users thereof may safely disembark. For example, in the case of an elevator system, the override may last long enough to move the elevator car to the next floor (or to the requested destination floor) in order to allow passengers to disembark safely, without getting trapped in the elevator car. The override control channel may be configured to override the first or second safety control signal for a time period of no more than a predetermined period of time, thus placing a limit on the time during which the system operates without two full redundant safety channels. In some examples, the override control channel may be configured to override the first or second safety control signal for a time period of no more than thirty seconds, or one minute, or two minutes, or five minutes. In some examples, it may be considered safe enough to operate the system with one main channel and the override channel for an hour or a few hours so as to provide continued availability of the service until repairs can be made. During this period when the override control channel is overriding the output of the faulty control channel, the override control channel still provides a level of redundancy as it still controls the output of the faulty control channel. If an input to the remaining safety control channel indicates that the safety control system(s) should be activated, that control channel notifies the override control channel so that the override signal can be removed from the faulty control channel. In this way, two output signals are still provided and used to activate the safety control system(s). Only one of these output signals is required to activate the safety control system(s), so the required redundancy is still provided.

During this period when the override control channel is overriding the output of the faulty safety control channel, it is possible (although quite unlikely) that the remaining safety control channel will also develop a fault. If this occurs, the override control channel can detect the fault in that channel and, knowing that both safety control channels are now faulty, can immediately remove its override signal from the faulty channel. Providing at least one of the faulty safety control channels has failed to a state in which its output triggers the safety control systems, the safety control systems will be activated. In some examples, the override channel may be arranged, in this scenario, to override one or both of the safety control channel outputs to force them to a safe state, i.e. a state in which they should both activate the safety control system(s).

In some examples, the first safety control channel is configured to output the first safety control signal in order to control the operation of a first safety switch, and the second safety control channel is configured to output the second safety control signal in order to control the operation of a second safety switch. The first safety control channel may comprise a first microcontroller unit configured to output the first safety control signal to a first output circuit configured to control the operation of the first safety switch. The second safety control channel may comprise a second microcontroller unit configured to output the second safety control signal to a second output circuit configured to control the operation of the second safety switch. The first microcontroller unit may be coupled to the second microcontroller unit in order to enable communication between the first and second safety control channels. The first and second output circuits may be used to convert the low voltage signal from the microcontroller into a suitable drive signal for the safety control system. For example, a safety brake system may operate at <NUM> V and a motor drive circuit may operate in the region of <NUM> V. Accordingly, the first and second output circuits may be used to provide suitable control at the necessary voltages based on a microcontroller input (at e.g. <NUM> V). Where more than one safety control system is to be controlled, the output circuit may be arranged to control all or a plurality of the safety control systems based on a single signal from the microcontroller unit. In such cases, the first output circuit may control a plurality of first safety switches (one for each safety control system) and the second output circuit may control a plurality of second safety switches (one for each safety control system).

In some examples, a safety system of the people conveyor is configured to be activated when one, or both, of the first and second safety switches are deactivated in response to the first and second safety control signals respectively. In other examples, the safety system of the people conveyor is configured to be activated when one, or both, of the first and second safety switches are activated. The safety system may comprise a 'Safe Torque Off' or a 'Safe Brake Control' safety system. As discussed above, both of these safety systems may be used and controlled simultaneously.

In some examples, the first and second safety switches are connected in series and configured such that, when both of the safety switches are activated, they: activate an electromagnet configured to prevent mechanical activation of one or more brakes of the people conveyor; or activate a drive system of the people conveyor, enabling it to impart a driving force or torque to the people conveyor when controlled to do so. The safety switches being connected in this manner enables the outputs of the first and second safety control channels to act in a redundant manner: if either one of the outputs deactivates its associated safety switch using its associated safety control signal, the associated safety system is thereby activated.

In some examples, the first and second safety switches each comprise a transistor. The transistor may be suitably sized and designed for the voltage of the safety system that it is to control.

In some examples, the people conveyor is an elevator system. In such cases the safety brake control system may be a brake applied to the drive machine or it may be safety brakes on the elevator car itself. The safe torque off system may disconnect the drive control signals from the drive machine so as to prevent torque being applied.

Certain preferred examples of this disclosure will now be described, by way of example only, with reference to the accompanying drawings in which:.

The position reference system <NUM> can be any device or mechanism for monitoring a position of an elevator car and/or counterweight, as known in the art.

For example, the controller <NUM> may provide drive signals to the machine <NUM> to control the acceleration, deceleration, levelling, stopping, etc. of the elevator car <NUM>.

For example, embodiments may be employed in ropeless elevator systems using a linear motor or pinched wheel propulsion to impart motion to an elevator car. <FIG> is merely a nonlimiting example presented for illustrative and explanatory purposes.

In one example, embodiments disclosed herein may be applicable to conveyance systems such as an elevator system <NUM> and a conveyance apparatus of the conveyance system such as an elevator car <NUM> of the elevator system <NUM>. In another example, embodiments disclosed herein may be applicable to conveyance systems such as an escalator system and a conveyance apparatus of the conveyance system such as a moving stair of the escalator system.

<FIG> shows a safety control device <NUM> for a people conveyor. In this example, the safety control device <NUM> is for an elevator system such as the elevator system <NUM> shown in <FIG>, though it will be appreciated that the safety control device <NUM> is suitable for any conveyance system as described above. In this example, the safety control device <NUM> may be the final node in a chain of elevator safety systems.

The safety control device <NUM> comprises a first safety control channel <NUM>, a second safety control channel <NUM>, and an override control channel <NUM>. The first safety control channel <NUM> comprises a first microcontroller unit (MCU) <NUM> configured to control the operation of two safety switches <NUM> and <NUM> in response to a number of input signals indicating one or more operational parameters of the elevator system <NUM>. The second safety control channel <NUM> is operationally identical to the first safety control channel <NUM> and comprises a second MCU <NUM> configured to control the operation of two safety switches <NUM> and <NUM> in response to a number of input signals indicating one or more operational parameters of the elevator system <NUM>. The same input signals are fed to both the first and second safety control channels <NUM> and <NUM>, thereby allowing both safety control channels <NUM>, <NUM> to independently determine whether the elevator system <NUM> is operating correctly, and to control the operation of the respective safety switches <NUM>, <NUM> and <NUM>, <NUM> in response to determining that the elevator system <NUM> is not operating correctly.

The first safety control channel <NUM> comprises two input level converters <NUM>, a first power supply voltage converter <NUM>, a first MCU <NUM>, first output circuitry <NUM>, and two safety switches <NUM> and <NUM>, which in this example are metal-oxide-semiconductor field-effect-transistors (MOSFETs). The second safety control channel <NUM> comprises two input level converters <NUM>, a second power supply voltage converter <NUM>, a second MCU <NUM>, second output circuitry <NUM>, and two safety switches <NUM> and <NUM>, which in this example are also MOSFETs. The override control channel comprises a power supply voltage converter <NUM> and a microprocessor <NUM>. The number of input level converters <NUM> and <NUM> provided for the respective safety control channels <NUM> and <NUM> is not limited to two as shown in this example, but may be any number dependent upon the number of input signals that are provided to the safety control channels <NUM> and <NUM>. In this example, the MCUs <NUM> and <NUM> of the first and second safety control channels <NUM> and <NUM> comprise one hundred and forty four pin MCUs, and the microprocessor <NUM> of the override control channel <NUM> comprises a fourteen pin microprocessor. The MCUs <NUM> and <NUM> and the microprocessor <NUM> are not limited to one hundred and forty-four pins and fourteen pins respectively as in this example, but may comprise any suitable size. However, it is advantageous that the microprocessor <NUM> of the override channel <NUM> can be smaller and have fewer pins than the MCUs <NUM>, <NUM> so that it can be less costly. The transistors <NUM>, <NUM>, <NUM> and <NUM> are not limited to MOSFETs as in this example, but may comprise any suitable type of transistor e.g. MOSFET, PMOS, NMOS, BJT, NPN, PNP, etc..

A power supply <NUM> (e.g. from the electricity grid or from a generator or battery) is fed via a power supply input <NUM> to a power supply voltage regulator <NUM> which outputs a regulated DC supply voltage at a suitable voltage level (e.g. 12V) to two <NUM>. 3V voltage converters <NUM> and <NUM> and a <NUM>. 8V voltage converter <NUM>. The output of the <NUM>. 3V voltage converter <NUM> supplies power to the MCU <NUM> of the first safety control channel <NUM>, the output of the <NUM>. 3V voltage converter <NUM> supplies power to the MCU <NUM> of the second safety control channel <NUM>, and the output of the <NUM>. 8V voltage converter <NUM> supplies power to the microprocessor <NUM> of the override control channel <NUM>. It will be appreciated that the voltage converters <NUM>, <NUM> and <NUM> are not limited to producing outputs of <NUM>. 3V and <NUM>. 8V respectively, but may comprise any suitable voltage converters depending on the voltage requirements of the respectively coupled MCUs <NUM> & <NUM> and microprocessor <NUM>, e.g. 5V, <NUM>.

A first discrete input signal <NUM> is fed via a first input <NUM> to one of the input level converters <NUM> of the first safety control channel <NUM> and to one of the input level converters <NUM> of the second safety control channel <NUM>. An nth discrete input signal <NUM> is fed via a second input <NUM> to the other of the input level converters <NUM> of the first safety control channel <NUM> and to the other of the input level converters <NUM> of the second safety control channel <NUM>.

In this example, two discrete input signals <NUM> and <NUM> are shown for the sake of simplicity, however it will be appreciated that the number of discrete input signals provided to the two safety control channels <NUM> and <NUM> is not limited to two as shown in this example, but may be any number, and each of the safety control channels <NUM> and <NUM> may comprise an input level converter <NUM>, <NUM> for each input signal <NUM>, <NUM>. The discrete input signals <NUM> and <NUM> comprise analogue signals output by sensors within the elevator system <NUM> - e.g. temperature sensors, accelerometers, vibration sensors, light sensors, encoders, etc..

The input level converters <NUM> and <NUM> are configured to convert the discrete input signals <NUM> and <NUM> to operational voltage levels that can be received and analysed by the MCUs <NUM> and <NUM>. Each of the outputs of the input level converters <NUM> are fed to input pins of the MCU <NUM> of the first safety control channel <NUM>, and each of the outputs of the input level converters <NUM> are fed to input pins of the MCU <NUM> of the second safety control channel <NUM>. The input level converters <NUM>, <NUM> may be voltage transformers that may convert a current input into a voltage input or they may be analogue to digital converters or digital to analogue converters as required.

The safety control device <NUM> further comprises a Controller Area Network (CAN) bus <NUM>, coupled to a CAN bus interface <NUM>, which is in turn coupled to the MCUs <NUM> and <NUM>. The CAN bus <NUM> enables the MCUs <NUM> and <NUM> to communicate with the MCUs and microprocessors of other systems (e.g. safety nodes) of the elevator system <NUM> (not shown). Digital signals are sent and received by the MCUs <NUM> and <NUM> over the CAN bus <NUM>, enabling the MCUs <NUM> and <NUM> to receive information from other systems of the elevator system <NUM> as well as transmit information to other systems of the elevator system <NUM>. Information such as whether a brake of the elevator system <NUM> is engaged, whether a driving motor of the elevator system <NUM> is engaged, the current position, speed and/or acceleration of the elevator, etc. may be received by the MCUs <NUM> and <NUM> via the CAN bus <NUM>. These inputs supplement the discrete inputs <NUM>, <NUM> and all inputs can be processed together within the MCUs <NUM>, <NUM>.

The MCU <NUM> of the first safety control channel <NUM> is configured to analyse the discrete input signals <NUM>, <NUM> and the CAN bus signals <NUM> in order to determine whether the elevator system <NUM> is operating correctly, and accordingly whether any safety mechanisms of the elevator system <NUM> should be activated, and to output a safety control signal to the output circuit <NUM> dependent upon this determination. The output circuit <NUM> is arranged to output two switch control signals in response to the safety control signal received from the MCU <NUM>: the first switch control signal is provided to the gate terminal of a first 'Safe Brake Control' (SBC) MOSFET <NUM>, and the second switch control signal is provided to a first 'Safe Torque Off' (STO) MOSFET <NUM>. The switch control signals output by the output circuit <NUM> therefore determine whether the first SBC MOSFET <NUM> and the first STO MOSFET <NUM> allow current to flow across their respective source and drain terminals.

Similarly, the MCU <NUM> of the second safety control channel <NUM> is configured to analyse the discrete input signals <NUM>, <NUM> and the CAN bus signals <NUM> in order to determine whether the elevator system <NUM> is operating correctly in the same way as the MCU <NUM>, and to output a safety control signal to the output circuit <NUM> dependent upon this determination. The output circuit <NUM> is arranged to output two switch control signals in response to the safety control signal received from the MCU <NUM>: the first switch control signal is provided to the gate terminal of a second SBC MOSFET <NUM>, and the second switch control signal is provided to the gate terminal of a second STO MOSTFET <NUM>. The switch control signals output by the output circuit <NUM> therefore determine whether the second SBC MOSFET <NUM> and the second STO MOSFET <NUM> allow current to flow across their respective source and drain terminals.

The MCUs <NUM> and <NUM> may be coupled to (or may contain) a memory (not shown) containing logic instructions that, when executed by the MCUs <NUM> and <NUM>, cause the MCUs <NUM> and <NUM> to analyse the input signals <NUM>, <NUM> and <NUM> in order to determine whether the elevator system <NUM> is functioning correctly.

The output circuits <NUM> and <NUM> are provided because the operating output voltage ranges of the MCUs <NUM> and <NUM> are too small relative to the required operating voltage ranges to control the SBC and STO MOSFETs <NUM>, <NUM>, <NUM> and <NUM>. Furthermore, the SBC MOSFETs <NUM> and <NUM> require different operating voltage ranges to the STO MOSFETs <NUM> and <NUM>. The output circuits <NUM> and <NUM> take the control signals output by the MCUs <NUM> and <NUM> as inputs (typically at around <NUM> V), and output switch control signals within the required operating voltage ranges for the MOSFETs <NUM>, <NUM>, <NUM> and <NUM> (for example at <NUM> V or <NUM> V), thereby allowing the MCUs <NUM> and <NUM> to control the operation of the MOSFETs <NUM>, <NUM>, <NUM> and <NUM>.

The first and second SBC MOSFETs <NUM> and <NUM> are used to control a 'Safe Brake Control' safety mechanism of the elevator system <NUM>. When both SBC MOSFETs <NUM> and <NUM> are enabled (i.e. the voltage at their gate terminals output by the respective output circuits <NUM> and <NUM> enables current to flow across their respective source and drain terminals), current is allowed to flow from an SBC drive control input <NUM> to a brake coil output <NUM>. The SBC drive control input <NUM> is coupled to an output of a drive control system <NUM> of the elevator system <NUM> which provides a constant voltage supply to the SBC drive control input <NUM>.

The SBC brake coil output <NUM> is coupled to a brake coil <NUM> of the elevator system <NUM>. The brake coil <NUM> is configured to prevent the brakes of the elevator system <NUM> from being engaged whilst it is supplied with current. In this example, the brakes of the elevator system <NUM> are mechanically configured to constantly apply (e.g. by a spring) a braking force in order to slow and stop the movement of an elevator car. The brake coil <NUM> is configured, when current is applied thereto, to apply a counteracting force to this mechanical braking force, thereby releasing the brakes and allowing the elevator to move. When a current is not applied to the brake coil <NUM>, the counteracting force is removed and the elevator brakes are consequently engaged.

The first and second SBC MOSFETs <NUM> and <NUM> must therefore both be enabled in order for current to be supplied to the brake coil <NUM>, thereby releasing the brakes of the elevator system <NUM> and enabling the elevator car to move. If either one, or both, of the safety control channels <NUM> or <NUM> disables their respective SBC MOSFETs <NUM> or <NUM> in response to one or more of the input signals <NUM>, <NUM> or <NUM>, the brakes of the elevator system <NUM> are engaged thereby stopping movement of the elevator car as a safety precaution.

The first and second STO MOSFETs <NUM> and <NUM> are used to control a 'Safe Torque Off' safety mechanism of the elevator system <NUM>. When both STO MOSFETs <NUM> and <NUM> are enabled, current is allowed to flow from an STO drive control input <NUM> to a machine output <NUM>. The STO drive control input <NUM> is coupled to a second output of a drive control system <NUM> of the elevator system <NUM> which provides a constant voltage supply to the STO drive control input <NUM>.

The STO machine output <NUM> is coupled to the machine <NUM> of the elevator system <NUM>. The machine <NUM> is configured to only apply a driving force or torque to the elevator system <NUM> when it receives a current from the STO machine output <NUM>. When no current is received from the STO machine output <NUM>, the machine <NUM> is prevented from applying a force or torque in order to drive movement of the elevator system <NUM>. In some examples, the STO machine output <NUM> is coupled directly to a power supply input of the machine <NUM>. In other examples, the STO machine output <NUM> is coupled to a control input of the machine <NUM>.

The first and second STO MOSFETs <NUM> and <NUM> must therefore both be enabled in order for current to be supplied to the machine <NUM>, thereby enabling the application of force or torque by the machine <NUM> in order to drive movement of the elevator system <NUM>. If either one, or both, of the safety control channels <NUM> or <NUM> disable their respective STO MOSFETs <NUM> or <NUM> in response to one or more of the input signals <NUM>, <NUM> or <NUM>, the machine <NUM> is prevented from driving movement of the elevator system <NUM>.

It will be appreciated that the brake control safety circuit and drive safety control circuit could equally be arranged to enable normal operation of the elevator system <NUM> when no current is supplied to the brake coil <NUM> or machine <NUM> respectively (i.e. the circuits are arranged to activate an associated safety system by supplying a current to the system rather than by preventing a current supply as in the previous example). For example, the brake control safety circuit could be arranged to energise the coil <NUM> in order to apply the brakesin response to a safety event and the drive safety control safety circuit could be arranged to disable the machine <NUM> by supplying a current thereto. In such cases, the two switches <NUM> and <NUM>, or <NUM> and <NUM>, could be connected in parallel instead of in series so as to provide the required redundancy, as the activation of either, or both, parallel switches would then supply a current to the relevant safety system in order to activate it.

The first and second safety control channels <NUM> and <NUM> operate in a parallel manner, with the MCUs <NUM> and <NUM> of both channels independently analysing the input signals <NUM>, <NUM> and <NUM> in order to determine whether the elevator system <NUM> is operating correctly. If either one of the channels <NUM> or <NUM> detects a fault, it disables its associated SBC MOSFET <NUM>, <NUM> and/or STO MOSFET <NUM>, <NUM>, thereby activating one or both of the SBC or STO systems, bringing the elevator to a halt and preventing further damage to the system or occupants of an elevator car. This two channel setup of the safety control device <NUM> increases the reliability of the system: in the event that one of the safety channels <NUM> or <NUM> malfunctions and does not detect a fault in the system based on the input signals <NUM>, <NUM> and <NUM> when a fault has occurred, it is very likely that the other safety channel <NUM> or <NUM> will detect the fault and activate the safety systems of the elevator. It is very unlikely that both safety channels <NUM> and <NUM> will malfunction simultaneously and that both fail to detect a fault in the elevator system <NUM>.

However, if one of the safety control channels <NUM> or <NUM> malfunctions as a result of e.g. a component failure, a fault in an electrical connection, an MCU logic fault, etc., it is possible that the faulty channel will deactivate one or both of its associated SBC or STO MOSFETs <NUM>, <NUM>, <NUM> or <NUM> and activate the associated safety mechanism when no fault has occurred in the elevator system <NUM>. Consequently an emergency stop is performed and there is a risk that any occupants of an elevator car will become entrapped as the car may be caused to come to a halt between two floors where it is not possible for the occupants to disembark. Furthermore, it is possible that the activation of any safety systems could cause unnecessary harm to any occupants of the elevator, or the elevator itself, as a result of sharp deceleration caused by brake activation or motor deactivation. Therefore an override control channel <NUM> is provided in order to monitor the health of the two safety control channels <NUM> and <NUM> and temporarily override their output signals if an internal fault in one of the safety channels <NUM>, <NUM> is detected.

The override control channel <NUM> comprises a microprocessor <NUM> configured to monitor the health, function and/or operation of the first and second safety control channels <NUM> and <NUM> in order to determine whether a fault has occurred in either channel. The microprocessor <NUM> is powered by the <NUM>. 8V power supply voltage converter <NUM>. The microprocessor <NUM> is coupled to the MCU <NUM> of the first safety control channel <NUM> via the serial communication connections <NUM>, and to the MCU <NUM> of the second safety control channel <NUM> via the serial communication connections <NUM>. This serial connections between the microprocessor <NUM> and the MCUs <NUM> and <NUM> enable the microprocessor <NUM> to communicate with the MCUs <NUM> and <NUM>. The microprocessor <NUM> is configured to send instructions via the serial communication connections <NUM> and <NUM> to the MCUs <NUM> and <NUM> respectively, and to receive responses provided by the MCUs <NUM> and <NUM>. The connections <NUM> and <NUM> between the microprocessor <NUM> and the MCUs <NUM> and <NUM> are not limited to being serial communication connections as in this example, but may comprise any suitable connection enabling transmission and reception of instructions and information between the microprocessor <NUM> and the MCUs <NUM> and <NUM>. However, serial connections can be made with a single pin and are sufficient for the communications required here. This allows the size and cost of the microprocessor <NUM> to be minimised.

Additionally, the MCUs <NUM> and <NUM> are coupled together via a serial communication connection <NUM> thereby enabling the two MCUs <NUM> and <NUM> to transmit and receive instructions and information between one another. The connection <NUM> between the MCUs <NUM> and <NUM> is not limited to a serial communication connection as in this example, but may comprise any suitable connection enabling transmission and reception of instructions and information between the MCUs <NUM> and <NUM>. This connection <NUM> may be used for mutual health and status monitoring. For example, one MCU <NUM>, <NUM> can notify the other MCU <NUM>, <NUM> if it has detected a safety scenario that requires action, thereby allowing the other MCU <NUM>, <NUM> to decide whether or not to take action too.

The MCU <NUM> of the first safety control channel <NUM> is coupled to the power supply voltage converter <NUM> of the override control channel <NUM> via a shut off control line <NUM>, and the MCU <NUM> of the second safety control channel <NUM> is coupled to the power supply voltage converter <NUM> of the override control channel <NUM> via a shut off control line <NUM>. The MCUs <NUM> and <NUM> are therefore able to enable and disable the microprocessor <NUM>, and therefore the override control channel <NUM>, using the shut off control lines <NUM> and <NUM> respectively. This may be useful where either MCU <NUM>, <NUM> detects an internal fault in the override channel <NUM>.

The microprocessor <NUM> is also coupled to the outputs of the MCUs <NUM> and <NUM> via the override lines <NUM> and <NUM> respectively. The override lines <NUM> and <NUM> enable the microprocessor <NUM> to override the safety control signals output by the MCUs <NUM> and <NUM>. For example, the microprocessor <NUM> may use the override lines <NUM>, <NUM> to 'force on' the output of the respective MCU <NUM>, <NUM>, e.g. by setting the voltage on that line to high. This has the same effect on output circuits <NUM>, <NUM> as if the respective MCU <NUM>, <NUM> had output a high signal indicating normal operation. It will of course be appreciated that in examples where a low signal indicates normal operation than the override lines <NUM>, <NUM> may 'force off' the respective outputs instead.

The microprocessor <NUM> of the override control channel <NUM> is configured to monitor the health of the first and second safety control channels <NUM> and <NUM> over the serial connections <NUM> and <NUM> to the MCUs <NUM> and <NUM> respectively. The microprocessor <NUM> may be coupled to a memory (not shown) containing logic instructions that, when executed by the microprocessor <NUM>, cause the microprocessor <NUM> to monitor the health of the first and second safety control channels <NUM> and <NUM>.

The microprocessor <NUM> in this example is configured to monitor the health of the first and second safety control channels <NUM> and <NUM> by transmitting instructions to the MCUs <NUM> and <NUM> over the serial communication connections <NUM> and <NUM> respectively that cause the MCUs <NUM> and <NUM> to perform simple tasks. The MCUs <NUM> and <NUM> then perform the instructed tasks and return results to the microprocessor <NUM> over the serial communication connections <NUM>, <NUM>. The microprocessor <NUM> then checks the result and if the result is incorrect or if no reply was received then the microprocessor <NUM> determines that a fault has occurred in that MCU <NUM>, <NUM>. The microprocessor <NUM> can also be arranged to receive debug signals from each of the MCUs <NUM>, <NUM> at each stage of the normal processing cycle of the MCU <NUM>, <NUM>. These debug signals can also be received by the microprocessor <NUM> over the serial communication connections <NUM> and <NUM> respectively. The microprocessor <NUM> is configured to receive and analyse the debug signals that it receives from the MCUs <NUM> and <NUM> in order to determine if a fault has occurred in the first or second safety control channels <NUM> or <NUM>. For example, the presence and/or the timing and/or the order of the debug signals may be used to check for correct operation. If debug signals are not received, or are received in the wrong order, or are received with unusual delays, then the microprocessor <NUM> can determine that there is a fault in the respective MCU <NUM>, <NUM>. The microprocessor <NUM> can also compare the order and the timing of the debug signals received from the two MCUs <NUM>, <NUM>. In normal operation, the two MCUs <NUM>, <NUM> should operate substantially in synchrony as they are identical in design. Therefore any discrepancies that fall outside normal process variation and jitter may indicate a fault in one of the MCUs <NUM>, <NUM>.

Examples of tasks that may be transmitted from the microprocessor <NUM> to the MCUs <NUM> and <NUM> in order to monitor the health of the safety control channels <NUM> and <NUM> may include: a simple request for response, a request for a value of one of the inputs (e.g. a discrete input or a value from the CAN bus <NUM>), or a mathematical calculation to perform or a problem to solve. Debug signals received from the MCUs <NUM>, <NUM> may include discrete inputs read successfully, serial input read successfully, evaluation of inputs completed successfully, output set successfully, etc. The microprocessor <NUM> analyses whether a fault has occurred in either of the safety control channels <NUM> or <NUM> in response to these tasks and/or debug signals. The microprocessor <NUM> may check, based on the response and/or debug signals whether the MCUs <NUM> and <NUM> perform calculations correctly, whether program flow is being performed in the correct order, whether instructions are being carried out in a timely manner, whether input signal readings are correct, whether output signal readings are correct, etc..

The microprocessor <NUM> is configured to temporarily transmit a signal over the override line <NUM> in order to override the safety control signal output by the MCU <NUM>, if it detects a fault in the first safety control channel <NUM>. Similarly, the microprocessor <NUM> is configured to transmit a signal over the override line <NUM> in order to override the safety control signal output by the MCU <NUM>, if it detects a fault in the second safety control channel <NUM>. In doing this, the microprocessor <NUM> temporarily overrides control of the MOSFETs <NUM> and <NUM> or <NUM> and <NUM> from the MCU <NUM> or <NUM>, allowing the microprocessor <NUM> to prevent the faulty safety control channel <NUM> or <NUM> from activating the SBC or STO safety systems, i.e. preventing an emergency stop. The internal fault of one safety channel is not sufficiently severe to warrant an emergency stop while the override channel <NUM> can provide the necessary redundancy in control of the MOSFETs of the faulty channel. Thus the system still has a two-switch redundancy in the safety control systems even though fault detection is now reliant on a single main safety control channel. In some examples, the override channel <NUM> may also be arranged to provide a further level of redundancy by detecting a fault in both main safety control channels <NUM>, <NUM> and forcing off the output signals on both channels <NUM>, <NUM> so as to activate an emergency stop.

The time period for which the microprocessor <NUM> is configured to override control of the outputs of the MCU <NUM> or <NUM> may be any appropriate value in accordance with system design, regulations and safety assessments. In some examples, the microprocessor <NUM> is configured to receive instructions from the MCU <NUM> or <NUM> of the non-faulty safety control channel <NUM> or <NUM> over the serial communication connections <NUM> or <NUM> respectively which instruct the microprocessor <NUM> as to how long the output of the MCU <NUM> of <NUM> of the faulty safety control channel <NUM> or <NUM> should be overridden. In other examples it is the microprocessor <NUM> that is configured to determine how long to override the output of the MCU <NUM> or <NUM> of the faulty channel <NUM> or <NUM>.

In some examples the microprocessor <NUM> is configured, whether it is using its own instructions or receiving instructions from the MCU <NUM> or <NUM> of the non-faulty safety control channel <NUM> or <NUM>, to override the output of the MCU <NUM> or <NUM> of the faulty safety control channel <NUM> or <NUM> for a period of no longer than one minute. The risk of a genuine fault occurring in the elevator system <NUM> during the up to one minute period of override by the override control channel <NUM>, and that fault not being detected by the non-faulty safety control channel <NUM> or <NUM>, is extremely small. The risk of the non-faulty safety control channel <NUM> or <NUM> developing a fault in the up to one minute period of override by the override control channel <NUM> is also extremely small. For comparison, the design lifetime of the safety control channels <NUM>, <NUM> is typically about twenty years.

The microprocessor <NUM> may be configured to override the faulty safety control channel <NUM> or <NUM> until the elevator car has reached the nearest landing floor at which any occupants may disembark. The microprocessor <NUM> may be configured to override the faulty safety control channel <NUM> or <NUM> until the elevator car has reached the nearest landing that would not require excessive deceleration of the elevator car, thereby avoiding discomfort and distress to the occupants of the elevator car,. Alternatively, the microprocessor <NUM> may be configured to override the faulty safety control channel <NUM> or <NUM> until the elevator car has reached the current destination landing floor requested by the passengers.

By temporarily overriding the output of the MCU <NUM> or <NUM> of the first or second safety control channels <NUM> or <NUM> when a fault is detected therein, the override control channel <NUM> prevents the safety systems of the elevator system <NUM> from being activated inconveniently and when safety considerations do not require it, thus preventing entrapment of elevator passengers. When a fault is detected in one of the safety control channels <NUM> or <NUM>, the microprocessor <NUM> may be configured to notify the fault to the non-faulty safety control channel <NUM> or <NUM>, which can then notify the fault to other systems of the elevator system <NUM> via the CAN bus <NUM>. Once the elevator system <NUM> has moved to a landing where occupants can disembark, further use of the elevator system <NUM> may be prevented until maintenance has been performed on the faulty safety control channel <NUM> or <NUM> to correct the fault. In some examples, the maintenance required may be a simple reset of the faulty safety control channel <NUM> or <NUM> or may require replacement of the safety control board. Where a reset is all that is required, this can be performed automatically and the system can be restored to operation very quickly. Such a reset is normally only performed while the elevator car is stopped and held safely at a landing and operation is not resumed until the reset has completed successfully and the system is verified as being healthy. With the override channel <NUM> described here, such resets can be performed on the fly, e.g. while the elevator car is moving. To do so, the override channel takes over the control of the faulty safety control channel while the reset is performed. A reset typically takes <NUM>-<NUM> seconds, i.e. a time period during which the chance of a fault is minimal. During this time, the override channel maintains the redundant control of the two switches of each safety system so that in the event of a fault, both redundant switches will still be triggered, thereby providing the necessary safety fallback during the reset period. This improves the availability and efficiency of the system as there is no need to stop the elevator car at a landing in order to perform the reset.

In this example, the microprocessor <NUM> is configured to override the output of the MCUs <NUM> and <NUM> via the override lines <NUM> and <NUM>. In other examples, however, the microprocessor <NUM> may instead be configured to override the outputs of the output circuits <NUM> and <NUM>. The override channel <NUM> could have its own output circuit so as to convert voltages as required.

The MCUs <NUM> and <NUM> are also configured to monitor the health of the override control channel <NUM> via the serial communication connections <NUM> and <NUM> respectively. The monitoring of the health of the override control channel <NUM> by the MCUs <NUM> and <NUM> is performed in much the same manner as the monitoring of the health of the two safety control channels <NUM> and <NUM> by the microprocessor <NUM>, as described above. If either of the MCUs <NUM> or <NUM> detects a fault in the override control channel, it transmits a signal over the shut off control line <NUM> or <NUM> respectively in order to disable the power supply voltage converter <NUM> from providing power to the microprocessor <NUM>. As a result, the override control channel <NUM> is disabled when one of the MCUs <NUM> or <NUM> detects a fault therein. When a fault is detected in the override control channel <NUM>, the MCUs <NUM> and <NUM> are configured to notify the fault to other systems of the elevator system <NUM>, e.g. via the CAN bus <NUM>. In this example, however, use of the elevator system <NUM> is not prevented by the notification of a fault in the override control channel <NUM> - instead a maintenance report is generated indicating that the override control channel <NUM> requires maintenance, and the elevator system <NUM> is configured to continue normal operation. Without the override channel <NUM>, the remaining two safety control channels <NUM> and <NUM> provide the normal and accepted level of redundancy for normal operation, although until the override channel <NUM> is fixed, there will be a risk of passenger entrapment in the event of an internal fault in either of the safety control channels <NUM>, <NUM>.

As the functionality of the override control channel <NUM> is low in complexity, the microprocessor <NUM> is not required to be powerful. As a result, the microprocessor <NUM> in this example is a small fourteen pin microprocessor. This enables the override control channel <NUM> to be physically small, minimises the cost of including the override control channel <NUM> (as small low-powered microprocessors are inexpensive), and reduces the overall power consumption of the override control channel <NUM>.

The safety control device <NUM> is not limited to two safety control channels and one override control channel as shown in this example, but may comprise any number of safety control channels and override channels, depending on the requirements of the elevator system <NUM>. For example, the safety control device <NUM> may comprise three safety control channels and a single override control channel, four safety control channels and a single override control channel, three safety control channels and two override control channels, etc..

Claim 1:
A safety control device (<NUM>) for a people conveyor (<NUM>), the safety control device (<NUM>) comprising:
a first safety control channel (<NUM>) configured to output a first safety control signal in response to one or more input signals (<NUM>, <NUM>, <NUM>);
a second safety control channel (<NUM>) configured to output a second safety control signal in response to one or more input signals (<NUM>, <NUM>, <NUM>); and
an override control channel (<NUM>) configured to:
monitor the health of the first and second safety control channels (<NUM>, <NUM>); and
determine whether a fault has occurred in either of the first or second safety control channels (<NUM>, <NUM>);
characterised in that the override control channel (<NUM>) is configured to override the first or second safety control signal in response to a determination that a fault has occurred in the corresponding safety control channel (<NUM>, <NUM>), thereby preventing activation of one or more safety systems.