Patent Description:
It is known to provide a safety controller within an elevator system that monitors the status of the elevator system using a plurality of safety devices connected in series in a safety chain. Each safety device corresponds to a particular component of the elevator system, e.g. a sensing device such as a door sensor detecting whether a door lock has engaged. In conventional elevator systems, in the event that one of the safety devices in the safety chain detects a fault, the corresponding safety contact is opened, causing the safety chain to be disrupted. This causes the safety controller to automatically stop the elevator machine and deploy a brake, immediately arresting its motion. After deployment of the brake, the elevator car is stopped within the hoistway, and is unable to move until the fault associated with the open safety contact of the safety chain is fixed.

<CIT> describes an electronic safety system for elevators for preventing unsafe elevator operation having a central controller which monitors a variety of sensors, contacts, and switches over an electronic safety bus. A plurality of bus nodes are distributed throughout the elevator system and are in constant communication with the central controller over the safety bus. The bus nodes interface with sensors, switches, contacts, detectors, components, and other safety equipment of the elevator system at each location and provide status information back to the controller. The controller comprises a microprocessor board with an input/output port in communication with the safety bus and bus nodes. Upon sensing an unsafe condition, the controller sends control signals to an elevator control system and a drive and brake system to arrest the elevator car in a safe manner.

<CIT> describes an elevator safety system configured for monitoring an elevator system comprising at least one safety node and an evaluator. The at least one safety node is configured for monitoring at least one component of the elevator system and/or of the elevator safety system and providing signals representing the current status of the at least one monitored component. The evaluator configured for receiving the signals from the at least one safety node and for determining a safety status of the elevator system and/or of the elevator safety system from a combination of the received signals.

If the elevator car is between floors when a brake is triggered in response to disruption of the safety chain, entrapment of passengers within the elevator car (during normal operation) or a maintenance person on the roof of the car (during inspection) may occur.

The present disclosure seeks to address such issues.

According to a first aspect of this disclosure, there is provided an elevator system according to claim <NUM>.

According to a second aspect of the present disclosure, there is provided a method of controlling an elevator system according to claim <NUM>.

In an elevator system and method as disclosed herein, the condition of the elevator system can be determined by the safety controller in response to receiving a signal indicating a change in state of one or more safety devices, which may be indicative of a fault in the elevator system. After the condition of the elevator system is determined, movement of the elevator car can be controlled in response to the condition of the elevator system. If the elevator system is determined to be in a first condition (e.g. indicating that a safety-critical fault is present), the elevator brake is activated and the elevator car is stopped immediately, as is conventional.

However, if the elevator system is determined to be in a second condition (e.g. indicating that a fault has occurred, but that the fault is not safety-critical), the elevator car is allowed to move for a predetermined time or distance to the nearest landing. Allowing the elevator car to move in this way may allow passengers located within the elevator car or a maintenance person located on the roof of the elevator car (referred to in the following collectively as elevator car occupants) to exit the elevator car at the landing. The operation of the system as disclosed herein relies on recognition of the fact that in certain circumstances, although a safety device may change state, potentially due to a fault in the elevator system, the level of risk associated with certain faults is sufficiently low to allow a car movement for a limited distance or time in order to prevent entrapment of elevator car occupants.

In some examples, after receiving a signal in response to a change of state of one or more of the safety devices and rendering a determination that the elevator system is in the second condition, the safety controller causes an elevator brake to be deployed after the predetermined duration has elapsed or after the elevator car has travelled the predetermined distance. Thus, once the car has moved for a predetermined time or distance, e.g. to the nearest landing, the brake is activated, in order to prevent a hazardous situation occurring in the event that a fault were to occur in the elevator system. Deploying the elevator brake after a predetermined duration has elapsed or after the elevator car has moved a predetermined distance ensures that any further operation of the elevator car is prevented following a change of state of one or more safety devices, which may be indicative of a fault in the elevator system. Preventing movement of the elevator car before it is able to travel a significant distance within an elevator hoistway reduces the likelihood of faults occurring in the elevator system, potentially leading to a hazardous situation, and hence aims to minimise the risk to car occupants. The predetermined distance may be set to allow the elevator car to travel to a nearby landing. For example, the predetermined distance may be set such that the elevator car can travel to the closest landing within the elevator hoistway. In a preferred embodiment, the predetermined distance may be up to <NUM> metres, e.g. allowing the elevator car to travel to any landing within a range of <NUM> metres. The predetermined time may be between one and five minutes, for example about three minutes.

The safety controller is arranged to move the elevator car to the nearest landing upon rendering a determination that the elevator system is in the second condition. Moving the elevator car to the nearest landing may allow car occupants to exit the elevator car at a landing at the earliest opportunity, in order to prevent entrapment of elevator car occupants that may occur in conventional elevator systems if the elevator car is stopped between landings. This may serve to reduce the level of risk experienced by the elevator car occupants when compared to conventional approaches.

This movement may be performed manually by a maintenance person, who may provide an instruction to the safety controller to move the elevator car to the nearest landing. Such instruction may be sent from an elevator inspection control box located on the roof of the elevator car. The inspection control box may include an inspection operation switch which is manually operable to bring the control box into operation. This can be a bi-stable switch, so as to protect against involuntary operation.

It will be appreciated that movement of the elevator car may be independently controlled by either of the safety controller (following operation of one of the safety devices or during inspection operation) and the elevator controller (during normal operation). For example, the elevator controller is connected to the drive system in order to control normal operation of the elevator car (e.g. to move the car between landings in response to passenger requests for service) and the safety controller is independently connected to the drive system in order to control movement of the elevator car at other times (e.g. in response to a change of state of any of the safety devices, or e.g. during an inspection or maintenance mode when a maintenance person in riding on top of the car). The drive system may include a drive motor and a motor brake.

In various examples, the safety controller is arranged to deploy such a motor brake, also known as the "machine brake", so as to stop any further driven movement of the elevator car. Thus the elevator brake disclosed above may be a brake in the drive system. In various examples, the safety controller is directly connected to the drive system and arranged to deploy a brake in the drive system following determination of whether the elevator system is in a first condition or a second condition. In addition, the safety controller may also be directly connected to one or more elevator car safety brakes and arranged to deploy the elevator car safety brakes upon determining that the first condition is an overspeed condition.

In some examples, each of the plurality of safety devices is connected to the safety controller by a common bus, to form a safety chain for the elevator system. The safety controller may be part of a safety system, the safety system also comprising bus nodes, which are connected to the bus, wherein the bus is connected to the safety controller, and the bus nodes are connected to the safety devices, e.g. with a dedicated bus node for each safety device. The bus may be a Controller Area Network (CAN) bus. However, any other suitable communication means may be employed to connect the safety controller to the safety devices. The safety controller may include a microprocessor, which may run software. The microprocessor may poll the bus nodes, e.g. at regular intervals, to obtain the individual status information (i.e. current state) of the safety devices.

In some examples, one or more of the plurality of safety devices are safety contacts, and a change of state of an individual safety contact occurs in response to positive separation of the contact from its safety circuit, e.g. the safety contact operates as a switch being opened or closed. The plurality of safety devices may be a physical set of safety contacts or switches, or alternatively may be a virtual set of safety contacts or switches embedded in software within the safety controller. In some examples, one or more of the plurality of safety devices are safety sensors, configured to detect a condition of a component in the elevator system. In such examples, a change in state of an individual safety device may occur in response to the sensor detecting that a predetermined condition has been met. In one nonlimiting example, the safety chain includes a safety sensor arranged for overspeed detection. Such a safety sensor may comprise one or more position or velocity sensors, and the predetermined condition may be a threshold speed of the elevator car.

The plurality of safety devices may therefore be used to monitor the elevator system. Any of the plurality of safety devices may be a physical set of contacts or switches, for example a limit switch arranged in the hoistway, or alternatively may be a virtual set of contacts or switches embedded in software within the safety controller. The plurality of safety devices may include at least one stopping device (e.g. an emergency stop button) provided for stopping and maintaining the elevator car out of service. Such a stopping device may be located in the pit, in the machine room (where provided), and/or on the car roof, within reach of the inspection control box or at the inspection control box.

In some examples, after receiving a signal in response to a change of state of one or more of the safety devices, the safety controller causes an alarm to be triggered. The alarm may provide a visual and/or audible indicator to elevator car occupants in the vicinity, e.g. in the form of a light and/or a buzzer, in order to inform them of a potential fault in the elevator system. In some examples in which the elevator car is in normal operation and may therefore contain passengers, the alarm may be provided to passengers within the elevator car. In some examples, in which the elevator car is being operated by a mechanic, e.g. in an inspection mode, the alarm may be located within the elevator hoistway, or may be located in the vicinity of a control box situated on the roof of the elevator car.

In at least some examples, the elevator system may comprise a position determination system connected to the elevator controller and/or safety controller. The position determination system may be any position reference system that is capable of outputting a position of the elevator car within the hoistway. For example, the position determination system may comprise an encoder associated with the drive system, which is capable of outputting a position of the elevator car within the hoistway based on measurements related to the movement of a drive motor. In some examples, the position determination system is an absolute position determination system, i.e. which accurately determines the absolute position of the elevator car relative to a hoistway in which the elevator car travels. In some examples, the absolute position of the elevator car may be analysed to determine an overspeed condition of the elevator car.

In some such examples, at least one of the plurality of safety devices is connected to a position determination system configured to detect the speed of the elevator car, e.g. an overspeed detection device configured to change state if the elevator car speed is determined to be greater than a threshold speed. In such examples, the safety controller is configured to receive a signal in response to the change of state of the at least one safety device, to determine that the first condition is an overspeed condition, and to cause an elevator car safety brake to be deployed.

In some examples of methods disclosed herein, upon determining that the elevator system is in the second condition, the method may further comprise causing an elevator brake to be deployed after the predetermined duration has elapsed or after the elevator car has travelled the predetermined distance.

In some examples of methods disclosed herein, upon receiving a signal in response to a change of state of one or more of the safety devices, the method may further comprise triggering an alarm.

In some examples of methods disclosed herein, in which at least one of the plurality of safety devices is connected to a position determination system, the method may further comprise detecting, using the position determination system, the speed of the elevator car, determining if the speed of the elevator car is greater than a threshold, causing the at least one safety device to change state if the speed of the elevator car is greater than the threshold, receiving a signal in response to the change of state of the at least one safety device, determining that the first condition is an overspeed condition, and causing an elevator car safety brake to be deployed.

Where reference is made to different examples or sets of examples, it should be understood that these are not necessarily distinct but may overlap.

Certain preferred examples of this disclosure will now be described, by way of example only, with reference to the accompanying drawings, in which:.

<FIG> illustrates an elevator system <NUM> comprising an elevator car <NUM> that runs in a hoistway <NUM> between various landings <NUM> of a building. Although a single landing <NUM> is shown for illustrative purposes, it will be appreciated that more landings are present within the building but are not shown in <FIG> for simplicity. The elevator car <NUM> is suspended in the hoistway <NUM> by the first end of a tension member <NUM> (e.g. one or more ropes or belts). The second end of the tension member <NUM> is connected to a counterweight <NUM>. The elevator car <NUM> and the counterweight <NUM> are moving components in the elevator system <NUM>. Although the elevator car <NUM> and the counterweight <NUM> shown in <FIG> are connected by a tension member <NUM>, it will be appreciated that in other examples the elevator system may be ropeless.

During normal operation, the elevator car <NUM> travels up and down in the hoistway <NUM> to transport passengers and/or cargo between landings <NUM> of the building. The elevator car <NUM> is driven by a drive system <NUM> comprising a drive motor <NUM> and a motor brake <NUM>. The tension member <NUM> passes over a drive sheave (not shown) that is driven to rotate by the drive motor <NUM> and braked by the motor brake <NUM>. Normal operation of the drive system <NUM> is controlled by an elevator controller <NUM>.

The elevator system <NUM> also comprises a safety system <NUM>, including a safety controller <NUM> connected to a bus <NUM>. The safety controller <NUM> is connected, via the bus <NUM>, to various safety devices, as will be described in the following. The safety controller <NUM>, bus <NUM> and the plurality of safety devices together form a safety chain as is known in the art, such that if any of the safety devices changes state (e.g. a safety switch changes from a closed position in which the safety chain is intact, to an open position in which the safety chain is broken), a signal is received by the safety controller <NUM>, which may then take appropriate action as described below. It is therefore understood that the safety controller <NUM> is connected to a plurality of safety devices that monitor the elevator system <NUM>.

Some exemplary safety devices 126a, 126b, <NUM>, <NUM>, <NUM>, 138a, 138b, <NUM>, <NUM> are described below, but the elevator system <NUM> may include any required number N of safety devices.

The elevator system <NUM> includes a position determination system in the form of an absolute position reference system <NUM>, configured to determine the absolute position and velocity of the elevator car <NUM> in the hoistway <NUM>, and to output a measurement of the absolute position and velocity of the elevator car <NUM> to the safety controller <NUM> over the bus <NUM>. The absolute position reference system <NUM> is connected to the safety controller <NUM>, via the bus <NUM>, by two APRS safety devices 126a, 126b, in order to provide redundancy in the measurement of the position and velocity of the elevator car <NUM>. The APRS safety devices 126a, 126b may change state in the event that the absolute position reference system <NUM> determines an overspeed condition of the elevator car <NUM>. The absolute position reference system <NUM> may interact with a coded tape (not shown) extending at least part of the way along the hoistway <NUM> and include two sensors (not shown) mounted on the elevator car <NUM> and arranged to read the coded tape to determine the absolute position and velocity of the elevator car <NUM> in the hoistway <NUM>.

The elevator system <NUM> also comprises a pit safety device <NUM>, associated with a stopping device in the elevator pit, which may change state when a maintenance person is detected as working in the elevator pit. The elevator system <NUM> further comprises a hoistway door safety device <NUM>, which may change state in the event that the hoistway door is open/not fully closed while the elevator car <NUM> is not present at the landing <NUM> at which the hoistway door is located, and a car door safety device <NUM>, which may change state in the event that the elevator car door is open/not fully closed while the elevator car <NUM> is not present at any landing <NUM>.

The elevator system <NUM> also includes electronic safety actuators 133a, 133b, connected to respective safety brakes 134a, 134b. The electronic safety actuators 133a, 133b are expected to remain connected to the safety controller <NUM> at all times in order to ensure that emergency stopping of the elevator car <NUM> is possible. To monitor this, the electronic safety actuators (ESAs) 133a, 133b may each include an ESA safety device 138a, 138b that changes state in the event that connection to the safety controller <NUM> is lost.

The elevator system <NUM> further includes a safety device <NUM> of an emergency stop button <NUM> located on the roof of the elevator car <NUM>, which may change state if a mechanic operates the emergency stop button <NUM> when working on the roof the elevator car <NUM>. The emergency stop button <NUM> may be connected to, or form part of, an inspection operation control box <NUM> located on the roof of the elevator car <NUM>, operable by elevator maintenance personnel to control operation of the elevator car <NUM> in an inspection mode. Commands may be input through the elevator inspection operation control box <NUM> and provided to the safety controller <NUM> in order to control the movement of the elevator car <NUM>, for example when operating in an inspection mode. The emergency stop button <NUM> is located proximate to a safety barrier <NUM>, which forms a physical barrier at the edges of the elevator car <NUM>, and is arranged to protect the maintenance person from falling into the elevator hoistway <NUM> when working on the roof of the elevator car <NUM>.

It will be appreciated that further safety devices may be present in the elevator system <NUM> in some examples, such as safety devices connected to, for example, temperature sensors or further command buttons which may be operated by elevator maintenance personnel from different locations in the elevator car <NUM> or elevator hoistway <NUM>.

Each of the safety devices 126a, 126b, <NUM>, <NUM>, <NUM>, 138a, 138b, <NUM>, <NUM> described above is connected to the safety controller <NUM> (through the bus <NUM>) via one or more respective bus nodes (not shown in <FIG>), such that the safety controller <NUM> is able to monitor the elevator system <NUM>, and take action in response to changes, i.e. a signal resulting from a change of state of one or more of the safety devices (e.g. a transition from a 'closed' state to an 'open' state for a safety switch) as will be described in the following. The safety controller <NUM> is also connected to the elevator controller <NUM>, with a two-way communications line, such that the elevator controller <NUM> can request and receive status information from the safety controller <NUM> indicative of the status of the various safety devices of the elevator system <NUM>.

Based on the signals received from the safety devices (i.e. whether the state of any safety device has changed, potentially indicating a fault in the elevator system <NUM>), the safety controller <NUM> is configured to determine the condition of the elevator system <NUM>. The safety controller <NUM> is further configured to perform appropriate stopping of the elevator car <NUM> based on the determined condition.

Detection of a change of state of one of the safety devices of the elevator system <NUM> using the safety controller <NUM> will now be described with reference to <FIG>, which shows the safety system <NUM> of the elevator system <NUM> in greater detail, together with associated components.

It can be seen in <FIG> that the safety system <NUM> comprises the safety controller <NUM>, which is in signal communication with the safety devices described above via the bus <NUM> (represented by a dashed line in <FIG>), and a plurality of bus nodes associated with the respective safety devices, as will be described in the following.

The absolute position reference system safety devices 126a, 126b and safety devices 138a, 138b associated with the electronic safety actuators 133a, 133b, are connected to the safety controller <NUM> via a pair of APRS nodes 226a, 226b, and a pair of safety brake actuator nodes 233a and 233b, respectively. The APRS safety devices 126a, 126b and ESA safety devices 133a, 133b are both connected to the bus <NUM> by a pair of nodes, as both systems comprise two safety devices in order to provide redundancy in operation. However, other safety devices are connected to the safety controller <NUM> by a single node. For example, the hoistway door safety devices <NUM> and the car door safety devices <NUM> are connected to the safety controller <NUM> via the bus <NUM> by a single hoistway door node <NUM> and a single car door node <NUM>, respectively. Similarly, the pit safety device <NUM> and the emergency stop button safety device <NUM> are connected to the safety controller <NUM> via the bus <NUM> by a single pit safety device node <NUM> and a single emergency stop button node <NUM>, respectively. The safety controller <NUM> may, in some examples, also be connected to additional safety devices, represented here by the 'Nth relevant safety device' <NUM>, which is connected to the safety controller <NUM> over the bus <NUM> by an 'Nth relevant safety device node' <NUM>.

In addition to its connection to the bus <NUM>, the safety controller <NUM> is also connected to the elevator controller <NUM>, to the drive system <NUM> (comprising the drive motor <NUM> and the motor brake <NUM>), and to the ESAs 133a, 133b that can trigger the elevator safety brakes 134a, 134b, such that it may perform appropriate control of the elevator car <NUM> based on the determined condition of the elevator system.

In conventional operation of an elevator system <NUM>, in response to determination of a fault during normal operation (i.e. through the opening of a safety switch or other change in state of a safety device), a stopping operation is initiated by the safety controller <NUM>. For example, if it is determined that a hoistway door is open while the elevator system <NUM> is running (e.g. if the hoistway door safety device <NUM> has changed state), or it is determined, by the absolute position reference system <NUM>, that the elevator car <NUM> is travelling too quickly within the hoistway <NUM>, a stopping operation is immediately performed by the safety controller <NUM>.

When such a stopping operation is performed, power to the elevator drive motor <NUM> is disconnected, and the motor brake <NUM> of the elevator system <NUM> is activated by the safety controller <NUM> (e.g. by disconnecting the electric supply to the motor brake <NUM>). After a stopping operation has been performed in this way, it is known for the elevator system <NUM> to be configured such that movement of the elevator car <NUM> cannot be restored until a maintenance person attends the elevator system <NUM>, inspects the elevator system <NUM>, and manually overrides the safety controller <NUM>.

In certain circumstances, in which a determination is made that a first condition exists in the elevator system that represents an immediate danger to car occupants, the elevator safety brakes 134a, 134b may be activated by the ESAs 133a, 133b (e.g. in addition to the motor brake <NUM>), in order to ensure the elevator car <NUM> is stopped as quickly as possible. For example, both the motor brake <NUM> and the elevator car safety brakes 134a, 134b may be activated in response to a determination of an overspeed condition by the absolute position reference system <NUM>. If an emergency stopping operation is performed in this manner, and the elevator safety brakes 134a, 134b are activated, movement of the elevator car <NUM> cannot be restored until a maintenance person attends the elevator system <NUM>, inspects the elevator system <NUM>, manually overrides the safety controller <NUM> and additionally physically resets the elevator safety brakes 134a, 134b.

Performing any stopping of the elevator car in response to determination of a fault during normal operation ensures the safety of passengers inside the elevator car <NUM> or a maintenance person working on the elevator car <NUM> (referred to collectively in the following as 'car occupants'), but may cause complications for the car occupants. For example, if a stopping operation is performed when either a maintenance person is present on the roof of the elevator car <NUM>, or when passengers are inside the elevator car <NUM>, the car occupants will become trapped if the elevator car <NUM> is stopped between landings <NUM>, as an override of the safety controller <NUM> is required in order to allow the elevator car <NUM> to be moved to a landing <NUM> within the hoistway <NUM>.

In the case of a maintenance person trapped on the roof of the elevator car <NUM>, a hoistway access ladder may be used to allow the maintenance person to reach the nearest landing <NUM>, which may be between <NUM>-<NUM> metres from the roof of the elevator car <NUM>, depending on where the stopping operation is performed in the hoistway <NUM>. However, leaving the hoistway <NUM> in this way carries a risk of injury to the maintenance person, who must subsequently inspect the elevator system <NUM>, and manually override the safety controller <NUM> to enable movement of the elevator car <NUM>.

In the case of passengers trapped inside the elevator car <NUM>, there is typically no means to allow escape from the elevator car <NUM> until a maintenance person attends the elevator system <NUM>, inspects the elevator system <NUM>, and manually overrides the safety controller <NUM>.

Although such stopping operations are typically justified in order to reduce the risk to car occupants, occasionally an unnecessary stopping operation is automatically triggered in response to a 'non-critical' fault with the elevator system <NUM>. Such 'non-critical' faults do not pose an immediate risk to the car occupants, although they may contribute to a hazardous situation if further faults occur.

For example, a stopping operation may be triggered automatically in response to a loss of connection between the safety controller <NUM> and a single safety device 138a, 138b of the pair of ESAs 133a, 133b, even though one of the car safety brakes 134a, 134b may remain operational. Similarly, a stopping operation may be performed in response to loss of one channel of a two channel absolute position reference system <NUM> (i.e. comprising safety devices 126a, 126b), despite one channel functioning correctly. Depending on the nature of the safety devices forming part of the safety chain, other scenarios, such as an associated component becoming overheated, may trigger a 'non-critical' stopping operation. It has been recognised that such stoppering operations are not necessary in the same way as an emergency stopping operation is absolutely required in response to the first condition being an overspeed condition.

In these circumstances, elevator passengers or an elevator maintenance person may become trapped within an elevator car <NUM> even when the risk level is relatively low. The present inventors have recognised that, as the risk to car occupants may be low, an immediate stopping operation may represent a disproportionate response that prevents the car occupants from being recovered from the hoistway <NUM> quickly and conveniently.

An improved method of operating a safety system as shown in <FIG> that aims to address these issues is described below, with reference to <FIG> and <FIG>.

<FIG> shows a flow diagram illustrating a method of operating the safety system <NUM> of <FIG> in the elevator system of <FIG> in the event that one or more safety devices connected to the bus <NUM> change state.

In step <NUM>, a safety device, e.g. one safety device 126a of the automatic position reference system <NUM>, changes state, activating its respective APRS node 226a. This change of state of the safety device 126a causes a signal to be sent over the bus <NUM> which is received by the safety controller <NUM>.

In step <NUM>, the safety controller <NUM> determines whether the cause of the received signal can be identified, i.e. whether the node that was activated, and the safety device that caused the node to be activated, is known.

If the cause of the received signal cannot be identified, i.e. the safety controller <NUM> is unable to determine which node, and hence to which safety device the node relates, was activated, the process continues immediately to step <NUM>, and a stopping operation is performed. In such a stopping operation, power to the elevator drive motor <NUM> is disconnected, and the motor brake <NUM> is activated by the safety controller <NUM>, bringing the elevator car <NUM> to a stop regardless of its position within the elevator hoistway <NUM>. This may therefore result in the elevator car <NUM> coming to a stop in a location between landings <NUM> of the elevator hoistway <NUM>.

If the cause of the received signal can be identified, i.e. the safety controller <NUM> can determine which node, and hence to which safety device the node relates, was activated, the process continues to step <NUM>.

In step <NUM>, the safety controller <NUM> determines whether the detected node is connected to a standalone safety device (e.g. the hoistway door node <NUM>), or is a node of a pair of nodes connected to two related safety devices (e.g. one safety device 126a of the automatic position reference system <NUM>).

If the determined node is one of a pair of nodes, the safety controller <NUM> determines, in step <NUM>, whether the other node of the pair has also been activated. If the other node of the pair has been activated, it is determined that neither safety device of this pair is operational, and the process continues to step <NUM>, in which a stopping operation is immediately performed, as described above.

If the other node of the pair has not been activated, or the determined node is a single node, the process continues to step <NUM>, in which the safety controller <NUM> determines what action should be taken based on the node that has been activated, i.e. based on the associated condition of the elevator system <NUM>.

For each activated node or combination of nodes (i.e. based on the state of each safety device), a condition of the elevator system <NUM> may be preset. The condition of the elevator system determines a corresponding safety function to be performed by the safety controller <NUM>. This function may be set in advance and stored in a memory of the safety controller <NUM>. Specifically, having identified the node that has been activated, the safety controller <NUM> performs one of two safety functions based on the condition of the elevator system, determined by the identified node.

If the identified node is connected to a safety device that relates to a 'safety critical' fault in the elevator system <NUM>, the elevator system <NUM> is determined to be in a first condition, and the process continues to step <NUM>, in which a stopping operation is immediately performed, as described above.

However, if the identified node is connected to a safety device that relates to a 'non-critical' fault in the elevator system <NUM>, the elevator system <NUM> is determined to be in a second condition and the process instead continues to step <NUM>, in which actions are taken to prevent entrapment of elevator car occupants.

Unlike in conventional elevator systems, in which a stopping operation is performed as soon as any safety device forming part of the safety chain is opened, the disclosed system may delay stopping in the event that the change of state of the safety device relates to a 'non-critical' fault. Rather than stopping the elevator car <NUM> immediately, which may result in the elevator car <NUM> coming to rest in an area of the hoistway <NUM> located far from a landing <NUM>, potentially trapping passengers within the elevator car <NUM> or a maintenance person working on the elevator car <NUM>, further movement of the elevator car <NUM> may be temporality permitted. Specifically, movement of the elevator car <NUM> using the drive motor <NUM> under the control of the safety controller <NUM> for a predetermined duration of time (e.g. three minutes) or a predetermined distance (e.g. one floor) is made possible in order to allow the car to be moved to the nearest landing <NUM>, where car occupants can safely leave the elevator car <NUM>, before performing a final stopping operation.

Thus, if during normal operation of the elevator car <NUM>, the determined node is connected to a safety device that relates to a 'non-critical' fault in the elevator system <NUM> (i.e. the elevator system is in the second condition), the safety controller <NUM> may transmit a signal to the elevator controller <NUM> indicating that a stopping operation will be initiated after a predetermined duration of time, or after the elevator car <NUM> has moved a predetermined distance, and the safety controller <NUM> controls the elevator car <NUM> to move to the nearest landing <NUM>. Once the elevator car <NUM> is present at the nearest landing <NUM>, the safety controller <NUM> determines that the elevator car <NUM> is stopped at the landing <NUM> and the process continues to step <NUM>, as described above. If no such determination is made, the safety controller <NUM> nonetheless performs a stopping operation after either the predetermined duration has passed, or after the elevator car <NUM> has travelled the predetermined distance.

If the determination that the node is connected to a safety device that relates to a 'non-critical' fault in the elevator system <NUM> (i.e. the elevator system <NUM> is in the second condition) is made during a maintenance operation, e.g. operating in an inspection mode in which a maintenance person is present on the roof of the elevator car <NUM>, the safety controller <NUM> transmits a signal to the elevator controller <NUM> indicating that a stopping operation is required.

In response, the elevator controller <NUM> informs the maintenance person on the roof of the elevator car <NUM> that a fault has been detected and a stopping operation is required, e.g. using a visual and/or audible alarm <NUM> located in the elevator hoistway <NUM>. On hearing this alarm, the maintenance person controls the elevator car <NUM> to move to the nearest landing <NUM>. Movement of the elevator car <NUM> may be controlled using the inspection operation control box <NUM> located on the roof of the elevator car <NUM>, through which commands can be sent to the safety controller <NUM> to control the drive motor <NUM>. Once the elevator car <NUM> is present at the landing <NUM>, the maintenance person may signal to the safety controller <NUM> that a stopping operation can now be performed, and the process continues to step <NUM> as described above. If no such signal is received, the safety controller <NUM> nonetheless performs a stopping operation after either the predetermined duration has passed, or after the elevator car <NUM> has travelled the predetermined distance.

In this way, the elevator car <NUM> may be moved to the nearest landing <NUM> before a stopping operation is performed in certain circumstances, preventing elevator passengers within the elevator car <NUM>, or a maintenance person on the roof of the elevator car <NUM> from becoming trapped in the hoistway <NUM> between landings.

In order to preserve the safe operation of the elevator system, a stopping operation is nonetheless performed after a predetermined time has elapsed or the elevator car <NUM> has moved a predetermined distance. After such an a stopping operation, movement of the elevator car <NUM> cannot be restored until a maintenance person attends the elevator system <NUM>, inspects the elevator system <NUM>, and manually overrides the safety controller <NUM>, as is conventional.

Claim 1:
An elevator system (<NUM>), comprising:
an elevator car (<NUM>) and a drive system (<NUM>) configured to drive movement of the elevator car (<NUM>);
an elevator controller (<NUM>), configured to control operation of the elevator car (<NUM>);
a safety controller (<NUM>); and
a plurality of safety devices (126a, 126b, <NUM>, <NUM>, <NUM>, 138a, 138b, <NUM>, <NUM>) connected to the safety controller (<NUM>), wherein the plurality of safety devices (126a, 126b, <NUM>, <NUM>, <NUM>, 138a, 138b, <NUM>, <NUM>) monitor the elevator system (<NUM>);
wherein the safety controller (<NUM>) is configured to receive a signal in response to a change of state of any of the safety devices (126a, 126b, <NUM>, <NUM>, <NUM>, 138a, 138b, <NUM>, <NUM>);
wherein, after receiving a signal in response to a change of state of one or more of the safety devices (126a, 126b, <NUM>, <NUM>, <NUM>, 138a, 138b, <NUM>, <NUM>), the safety controller (<NUM>) determines a condition of the elevator system (<NUM>);
wherein if the safety controller (<NUM>) renders a determination that the elevator system (<NUM>) is in a first condition, the safety controller (<NUM>) causes an elevator brake (<NUM>) to be deployed, preventing movement of the elevator car (<NUM>);
wherein if the safety controller (<NUM>) renders a determination that the elevator system (<NUM>) is in a second condition, the safety controller (<NUM>) allows movement of the elevator car (<NUM>) for a predetermined duration or until the elevator car (<NUM>) has travelled a predetermined distance; and
wherein the safety controller (<NUM>) is arranged to move the elevator car (<NUM>) to the nearest landing (<NUM>) upon rendering a determination that the elevator system (<NUM>) is in the second condition;
characterised in that:
the elevator system (<NUM>) comprises an inspection operation control box (<NUM>) located on the roof of the elevator car (<NUM>); and in that
the safety controller (<NUM>) is arranged to move the elevator car (<NUM>) in response to commands input through a user interface of the inspection operation control box (<NUM>).