EP3187449A1

EP3187449A1 - Mechanism for improving safety for an elevator system

Info

Publication number: EP3187449A1
Application number: EP15203148.0A
Authority: EP
Inventors: Ari Kattainen; Markku HÄIVÄLÄ
Original assignee: Kone Corp
Current assignee: Kone Corp
Priority date: 2015-12-30
Filing date: 2015-12-30
Publication date: 2017-07-05

Abstract

A safety device including means configured to receive a sensor signal being received from a sensor capable of detecting a presence of at least one person on a roof of an elevator car and/or in an elevator cabin of an elevator, means configured to process the sensor signal for determining whether at least one person is present on the roof of the elevator car and/or in the elevator cabin, and means configured to decide, on the basis of the result of the determining process whether to allow a reset of a drive restriction mode of the elevator for terminating the drive restriction mode, in case the result of the determining process is negative, or to maintain the drive restriction mode, in case the result of the determining process is affirmative.

Description

BACKGROUND

Field

The present invention relates to devices, methods, systems, and computer program products usable for improving safety of an elevator system, such as an elevator system where only a low headroom is provided, when access to a roof of an elevator car is provided and hence a person may be located on the elevator car roof.

Background Art

The following description of background art and examples may include insights, discoveries, understandings or disclosures, or associations, together with disclosures not known to the relevant prior art, to at least some examples of embodiments of the present invention but provided by the invention. Some of such contributions of the invention may be specifically pointed out below, whereas other of such contributions of the invention will be apparent from the related context.
Elevator systems provide the possibility to access a roof of an elevator car, for example, for maintenance purposes by authorized personnel. The roof of the elevator car can be accessed, for example, by moving and stopping the elevator car at a lower landing and by climbing on roof of the elevator car by opening the landing door directly above the landing where the elevator car has been stopped. Another option may be to provide an access door in the elevator car itself, which is accessible through the elevator cabin.
However, in case there is a possibility that a person is located on the roof of the elevator car, measures for protecting this person have to be considered, in order to avoid that the person suffers any harm e.g. due to an improper operation or movement of the elevator.
For this purpose, several regulations and specifications are defined which are to be considered when constructing and operating an elevator. For example, for the European Union, safety rules for the construction and installation of lifts or elevators, such as electric elevators, hydraulic elevators, rack and pinion elevators etc, are defined in specifications like EN 80-1, EN 80-2, EN 80-7, and EN 80-21. Here, requirements for elevators which were placed on the market in the European Union are described in order to deal with significant hazards, hazardous situations and hazardous events of permanently installed new elevators (e.g. with traction, drum or positive drive) serving defined landing levels and having a car designed for the transportation of persons or persons and goods, e.g. suspended by ropes or chains and moving between guide rails.
Embodiments of the present invention are related to a mechanism, i.e. devices, methods, systems and computer program products, by means of which the safety situation in elevators can be improved.

SUMMARY

According to an example of an embodiment, there is provided, for example, a safety device including means configured to receive a sensor signal being received from a sensor capable of detecting a presence of at least one person on a roof of an elevator car and/or in an elevator cabin of an elevator, means configured to process the sensor signal for determining whether at least one person is present on the roof of the elevator car and/or in the elevator cabin, and means configured to decide, on the basis of the result of the determining process whether to allow a reset of a drive restriction mode of the elevator for terminating the drive restriction mode, in case the result of the determining process is negative, or to maintain the drive restriction mode, in case the result of the determining process is affirmative.
Furthermore, according to an example of an embodiment, there is provided, for example, a method including receiving a sensor signal being received from a sensor capable of detecting a presence of at least one person on a roof of an elevator car and/or in an elevator cabin of an elevator, processing the sensor signal for determining whether at least one person is present on the roof of the elevator car and/or in the elevator cabin, and deciding, on the basis of the result of the determining process whether to allow a reset of a drive restriction mode of the elevator for terminating the drive restriction mode, in case the result of the determining process is negative, or to maintain the drive restriction mode, in case the result of the determining process is affirmative.
According to further refinements, these examples may include one or more of the following features:

the drive restriction mode may be implemented, and driving of the elevator may be controlled via a drive unit of the elevator;
a signal from an access detection unit indicating an end of an access provision to at least one of an elevator shaft and the roof of the elevator car may be received, wherein an operation for deciding whether to allow a reset of the drive restriction mode or to maintain the drive restriction mode may be triggered by the signal indicating the end of the access provision to the elevator shaft and the roof of the elevator car;
the processing of the sensor signal for determining whether at least one person is present on the roof of the elevator car and/or in the elevator cabin may further include recognizing at least one of a movement of a person, a breathing of a person, a heart beat of a person, and/or recognizing the presence of the at least one person on the basis of a signal processing including a threshold comparison, a signal pattern processing;
at least one sensor capable of detecting a presence of at least one person on a roof of an elevator car and/or in an elevator cabin of an elevator may be provided, wherein the at least one sensor may comprise one of an accelerometer, an image sensor, an infrared sensor, an acoustic sensor, a radar sensor, the at least one sensor may be located at a position comprising at least one of the elevator cabin, the car roof, an external location from which the roof of the elevator car is detectable, and the at least one sensor may be configured to communicate with the means configured to process the sensor signal by at least one of a wireless communication path and a wired communication path.

Furthermore, according to an example of an embodiment, there is provided, for example, an elevator system including at least one elevator car carrying an elevator cabin, a plurality of landing doors via which the elevator cabin or a roof of the elevator car is accessible, a drive unit configured to drive the at least one elevator car for passing the plurality of landing doors and stopping at one specified landing door, at least one sensor capable of detecting a presence of at least one person on the roof of the at least one elevator car and/or in the elevator cabin, and a controller configured to control the at least one elevator car, the landing doors and the drive unit, wherein the controller further includes a safety device as defined above.
The elevator system may further include an access detection unit indicating at least one of a start of an access provision to at least one of an elevator shaft and the roof of the at least one elevator car for a person and an end of the access provision to the at least one of the elevator shaft and the roof of the at least one elevator car, wherein a signal indicating at least one of the start and stop of the access provision may be communicated to the controller for triggering at least one of initiating or reset of the drive restriction mode.
In addition, according to embodiments, there is provided, for example, a computer program product for a computer, including software code portions for performing the steps of the above defined methods, when said product is run on the computer. The computer program product may include a computer-readable medium on which said software code portions are stored. Furthermore, the computer program product may be directly loadable into the internal memory of the computer or transmittable via a network by means of at least one of upload, download and push procedures.

BRIEF DESCRIPTION OF THE DRAWINGS

Some embodiments of the present invention are described below, by way of example only, with reference to the accompanying drawings, in which:

Fig. 1 shows a schematic diagram illustrating a configuration of an elevator system where some examples of embodiments are implementable;
Fig. 2 shows a block circuit diagram of a configuration of a safety mechanism and related equipment according to some examples of embodiments;
Fig. 3 shows a flow chart of a processing conducted in a safety processing according to some examples of embodiments;
Fig. 4 shows a flow chart of a processing conducted in a safety processing according to some examples of embodiments; and
Fig. 5 shows a diagram of a configuration of a safety device according to some examples of embodiments.

DESCRIPTION OF EMBODIMENTS

In the following, different exemplifying embodiments will be described using, as an example of an elevator system to which the embodiments may be applied, an elevator system as depicted and explained in connection with Fig. 1. However, it is obvious for a person skilled in the art that principles of embodiments may also be applied to other kinds of elevator systems or lifts having e.g. driving units of different types, such as electric elevator systems, hydraulic elevator systems, rack and pinion elevator systems, and the like, wherein a plurality of landings (i.e. two or more floors) are reachable by one or more elevator cars in a corresponding number of elevator shafts. That is, examples of embodiments of the invention are applicable to a wide range of different kinds of elevator systems, such as traction elevators, winding elevators, hydraulic elevators, as well as to different kinds of suspension/roping configurations.
It is to be noted that the following examples and embodiments are to be understood only as illustrative examples. Although the specification may refer to "an", "one", or "some" example(s) or embodiment(s) in several locations, this does not necessarily mean that each such reference is related to the same example(s) or embodiment(s), or that the feature only applies to a single example or embodiment. Single features of different embodiments may also be combined to provide other embodiments. Furthermore, terms like "comprising" and "including" should be understood as not limiting the described embodiments to consist of only those features that have been mentioned; such examples and embodiments may also contain features, structures, units, modules etc. that have not been specifically mentioned.
The general elements and functions of described elevator systems, details of which also depend on the actual type of elevator system, are known to those skilled in the art, so that a detailed description thereof is omitted herein. However, it is to be noted that several additional devices and functions besides those described below in further detail may be employed in an elevator system.
Furthermore, elevator system elements, in particular operation elements, control elements or detection elements, as well as corresponding functions as described herein, and other elements, functions or applications may be implemented by software, e.g. by a computer program product for a computer, and/or by hardware. For executing their respective functions, correspondingly used devices, elements or functions may include several means, modules, units, components, etc. (not shown) which are required for control, processing and/or communication/signaling functionality. Such means, modules, units and components may include, for example, one or more processors or processor units including one or more processing portions for executing instructions and/or programs and/or for processing data, storage or memory units or means for storing instructions, programs and/or data, for serving as a work area of the processor or processing portion and the like (e.g. ROM, RAM, EEPROM, and the like), input or interface means for inputting data and instructions by software (e.g. floppy disc, CD-ROM, EEPROM, and the like), a user interface for providing monitor and manipulation possibilities to a user (e.g. a screen, a keyboard and the like), other interface or means for establishing links and/or connections under the control of the processor unit or portion (e.g. wired and wireless interface means etc.) and the like. It is to be noted that in the present specification processing portions should not be only considered to represent physical portions of one or more processors, but may also be considered as a logical division of the referred processing tasks performed by one or more processors.
Fig. 1 shows a schematic diagram illustrating a configuration of an elevator system where some examples of embodiments are implementable. It is to be noted that examples of embodiments are not limited to an elevator system structure with the number of levels, elevator cars and elevator shafts as shown in Fig. 1. Rather, the number of elements, functions, and structures may be different to that indicated in Fig. 1, i.e. there may be implemented or present more (or less) of the corresponding levels, elevator cars and elevator shafts than those shown in Fig. 1.
In Fig. 1, reference sign 10 denotes an elevator car containing an elevator cabin for transporting persons between the floors of a building or the like. The elevator car 10 is located and travels in a hoistway or elevator shaft 20 which reaches at least from the lowest floor to the highest floor and includes further spaces for accommodating, for example, devices used for driving and stopping the elevator car. Such devices comprises, without being limited thereto or being necessary in any system, for example, a moving system including e.g. a motor and a drive unit 30 , a counterweight, guiding rails, ropes or belts, brake systems, controllers, etc., which may be installed in the elevator shaft or at the elevator car, for example. Furthermore, an elevator machinery room etc. (not shown) may be provided. Reference sign 25 denotes a headroom, i.e. a space at the top end of the shaft, which is reserved for maintenance purposes, for example. It is to be noted that in other examples of elevator systems such a headroom (or unoccupied space) may be very small or even missing, e.g. in so-called no-headroom type elevators.
The elevator system further comprises one or more control units which may be provided at different locations, such as the elevator car 10 or in a control room or the like. The control units are responsible, for example, for operation of the elevator system, such as driving and braking control, power supply control, emergency control, safety procedure control, and the like. Moreover, operation panels in the elevator cabin and at each landing are provided which are coupled to the control units by suitable signaling links. Furthermore, several sensors are provided in the elevator system, such as a speed sensor, a door zone sensor, and the like.
At each floor or landing, a landing door 41, 42, 43 and 44 is provided for allowing entering or leaving the elevator cabin when the elevator car 10 has stopped at this floor. In the example illustrated in Fig. 1, it is assumed that the elevator car 10 has stopped on the second floor so that in a normal operation mode landing door 42 would be opened. In such a normal operation mode, the other landing doors are to be closed, which is indicated in Fig. 1 for landing doors 41 and 44.
However, in the example shown in Fig. 1, it is assumed that another operation mode, such as a maintenance operation mode or the like, is established in which maintenance personnel seeks access to the elevator shaft and/or the roof of the elevator car 10. For this purpose, by means of a suitable access system (described later), the landing door 43 directly above the floor level where the elevator car 10 has stopped is opened. Thus, it is possible to access the elevator shaft and thus the roof of the elevator car 10 via landing door 43. As an alternative to the roof access via a landing door (as shown in Fig. 1) it is also possible that an elevator system is equipped with an elevator car having a separate access door leading from the elevator cabin to the roof. Also other access ways for accessing the elevator shaft and/or the roof of the elevator car are conceivable, such as an access via a door at the top of the elevator shaft or the like.
However, when the possibility exists that a person is accessing the elevator shaft and hence the car roof, it is necessary to detect this situation, since a person-on-car-roof situation represents a safety risk, e.g. when the elevator moves to the top terminal floor, especially in case of low headroom elevators. For detecting the person-on-car-roof situation, it is possible, for example, to monitor the access system operation. For example, when access to the shaft/roof is provided via a landing door, which is opened by means of a specific access unit, like a key (e.g. a maintenance person's safety triangle key or the like), the opening operation is detected as an indication that a passage or access to the car roof is provided and hence a person-on-car-roof situation. In this case, a specific operation mode is entered, such as a maintenance operation mode, in which the normal operation of the elevator is inhibited and a drive restriction is established, so as to avoid that the elevator car is moved in an improper or hazardous manner (e.g. movement to the top level, in a safety space, with a speed being above a threshold value, and the like). That is, unlocking of a landing door by a triangular key triggers the elevator controller to change the operation mode of the elevator from normal to maintenance mode. This happens because unlocking of a landing door signals potential entry of a maintenance person to the elevator shaft. In this case, for example, for the sake of safety, it is possible to drive the elevator car only by inspection drive switches provided for the maintenance personnel, e.g. in a maintenance access panel at a landing and an inspection drive unit on the car roof.
An example for the operation to start a maintenance mode (or inspection driving mode) is e.g. as follows. The elevator car 10 has to be empty when commencing the maintenance mode and inspection drive. This may be ensured by first calling the elevator to the landing from which the entry to the shaft will take place. The maintenance personnel verifies that the car is empty when it arrives to the landing and opens the doors. Then, the doors are closed and only then the triangle key is operated (e.g. turned) to unlock the landing door and switch to the maintenance mode, in which the elevator car is driven e.g. to the landing below the current landing.
On the other hand, a reset of the person-on-car-roof situation, i.e. the end of the maintenance operation mode and the return to a normal operation mode, is made from the landing (where the landing door for access to the roof is opened) by closing the landing door and locking it, for example, with the triangle key. This indicates a return from the maintenance operation mode.
However, when only the closing of the landing door is used as a basis for the decision to return to the normal operation mode, there is still the possibility of hazardous situations. For example, in case more than one person is working with the elevator in the maintenance operation mode, there is a risk that one person is still on the car roof while the other person closes the landing door and does the reset from the landing. Pressure sensors or a switch under a car roof tread plate (a movable car roof platform) do not provide a sufficient protection, since it is easy to manipulate them (by placing wedges or the like under the plate).
Consequently, in order to prevent such risks which may occur due to a reset of person-on-car-roof by mistake, embodiments of the present invention provide an improved safety mechanism including corresponding devices, methods, systems and computer program products which enhances safety of an elevator system when a person-on-car-roof situation is detected.
According to examples of embodiments, a corresponding safety mechanism is based on additional measures to detect and determine that no person is on the car roof. That is, as soon as it is detected that access to the elevator shaft 20 and/or the roof of the elevator car 10 has been granted, e.g. by opening a landing door for giving access to the car roof (e.g. with a triangle key), it is to be confirmed that the elevator car (the cabin) and in particular the elevator car roof are empty of persons before a reset of person-on-car-roof situation (and thus a return to the normal operation mode) is possible. Otherwise, the person-on-car-roof situation and the drive restriction accompanied therewith are maintained.
Fig. 2 shows a block circuit diagram of a configuration of a corresponding safety mechanism and related equipment according to some examples of embodiments.
The safety mechanism comprises a control element or function (controller) 50 which is in charge of conducting the required processing for improving the safety in the person-on-car-roof situation. The controller 50 is, for example, a processing element like a microcomputer including a CPU (central processing unit), a memory (ROM, RAM), and an interface means for receiving and transmitting signals related to the safety control. For example, the controller is included in an external element, such as a laptop or maintenance device connectable to a control unit of the elevator, or an internal part of the control unit of the elevator.
Reference sign 60 denotes a sensor which allows to detect whether a person is present on the roof of the elevator car 10 and/or in the elevator cabin, wherein an output signal of the sensor 60 is sent to the controller 50 by means of a suitable connection (e.g. wireless or wired connection, like a network connection). For example, the sensor is an accelerometer included in or attached to the elevator car 10 which measures parameters allowing to derive an acceleration of the elevator car.
Reference sign 70 denotes a drive unit of the elevator system. The drive unit is connected, for example, to the motor, a hydraulic system and the like used for moving the elevator car 10. The drive unit supplies power, e.g. electric power to the motor, and modulates the power in accordance with control signals from an elevator controller for moving and stopping the elevator car 10. The controller 50 is connected to the drive unit for transmitting a control signal indicating an operation mode, such as a maintenance operation mode with drive restriction, or a normal operation mode without drive restriction. For example, an allowance signal for allowing a return to a normal operation is provided by the controller 50.
Reference sign 80 denotes an access detection element. The access detection element serves to determine that an access to the elevator shaft 20 and/or the roof of the elevator car 10 is granted, and includes, for example, a switch or the like being activated when using the access system like the triangle key for opening and closing the landing door (e.g. landing door 43 in Fig. 1). The access detection element 80 outputs a corresponding signal to the controller 50 for indicating, for example, start or stop of the provision of access to the elevator shaft and/or car roof, e.g. opening and closing of a landing door by means of the triangle key or the like. This signal serves, for example, as a trigger for the operation of the controller 50 regarding the safety procedures according to some examples of embodiments of the invention. Specifically, according to some examples of embodiments, a signal indicating the start of the access may be used as a trigger to start a drive restriction mode, while according to some examples of embodiments a signal indicating the stop of the access is used to start a determination processing regarding allowance or inhibition of a reset of the person-on-the-roof situation (and thus the termination of the drive restriction mode). Hence, when the access to the elevator shaft or roof is granted (e.g. the landing door giving access to the elevator car's roof is opened with the triangle key), the controller 50 implements such a control that the roof and also the car must be empty of persons before the reset of person-on-car-roof is possible.
Fig. 3 shows a flow chart of a processing conducted in a safety processing according to some examples of embodiments. Specifically, the example according to Fig. 3 is related to a procedure conducted by the controller 50 of Fig. 2 when being used in an elevator system as depicted in Fig. 1.
In S100, a sensor signal is received from a sensor capable of detecting a presence of at least one person on a roof of the elevator car and/or in the elevator cabin of the elevator, such as sensor 60.
In S110, the sensor signal is processed in order to determine whether at least one person is present on the roof of the elevator car and/or in the elevator cabin. For this purpose, a suitable signal processing is used.
In S120, on the basis of the result of the determining process whether at least one person is present, a decision for the further course of action is made. When no person is determined to be present, (NO in S120), it is decided in S140 to allow a reset of a drive restriction mode of the elevator for terminating the drive restriction mode. That is, it is allowed to end a drive restriction mode and to return, for example, to a normal operation mode. Otherwise, in case the result of the determining process is affirmative and a person is determined to be present (YES in S120), it is decided in S130 to maintain the drive restriction mode.
Then, in S150, a processing of the decision result is made. For example, a condition that the person-on-the-car-roof situation is (still) present is recorded in a (non-volatile) memory, so that a change of the operation mode (e.g. to a normal operation mode) is not allowed. On the other hand, in case the person-on-the-car-roof situation is not present anymore, a control signal reflecting the decision of S140 is generated and output to an elevator controller or the drive unit 80 of the elevator in order to allow the return to normal drive operation.
According to some examples of embodiments, the drive restriction mode which is entered when the access to the roof of the elevator car 10 is granted includes one or more of the following modes.
In a first mode, a limited maintenance driving of the elevator is allowed. That is, a maintenance or inspection drive of the elevator is possible, for example when an additional authorization or instruction is input in the controller 50 (e.g. a code or the like or operation of inspection drive switches provided for the maintenance personnel, e.g. on a maintenance access panel at a landing or in an inspection drive unit on the elevator car roof), so that the elevator car can be moved from the current level. For example, while in normal operation mode the elevator car never goes beyond the lowest and the highest landing in the shaft, in maintenance mode a maintenance person can use the inspection drive to move the car in the shaft beyond the terminal landings (e.g. when the maintenance work in the shaft requires), wherein additional safety measures stop the car before it enters a safety space. For example, the dimensions of the shaft may be such that in normal operation mode the car enters the space which is defined as safety space when it arrivers to the respective terminal landing, but in maintenance mode, the safety space is established only when a person-in-shaft detection is made. According to examples of embodiments, in maintenance driving, levels which can be instructed to drive to may not include a top and/or bottom landing. Additional inspection limit switches or the like may provided which prevent a movement in the safety space during maintenance drive (e.g. any movement closer than 2 m from a terminal landing).
Another drive restriction mode may be a mode where driving of the elevator by means of the drive unit is completely stopped or inhibited. That is, here the elevator can not be moved to another level as long as the person-on-the-roof situation is not reset, which includes also that a determination is made in S110/S120 that no person is in or on the elevator car 10. A further drive restriction mode may be a mode where elevator car driving is exernally controlled, e.g. by a central control station or the like. Also other modes or combination of modes including those described above may be used as drive restriction modes according to examples of embodiments.
In examples of embodiments where either of these modes can be set, for example, an input of the authorization is used as a selection criterion between modes (i.e. when the authorization is input, the stop mode is replaced by maintenance driving mode or other modes).
According to some further examples of embodiments, the safety device is only in charge of deciding as to whether or not the drive restriction mode is to be maintained or may be reset. The corresponding decision is then transmitted to other control units, such as a drive controller, which act accordingly.
According to some further examples of embodiments, the safety device is also responsible for implement (i.e. starting) the drive restriction mode, and to control driving of the elevator via the drive unit. For example, an elevator controller which is responsible for a plurality of functions of the elevator system, is used also as the safety device. When the elevator controller is still receiving the person-on-roof signal from the respective sensor, it persistently maintains the maintenance operation mode, denying operation mode reset if such is attempted from a landing, e.g. by turning the triangular key. For example, the controller 50 may be further configured to react on a trigger by the access detection element 80 when e.g. the access to the shaft/roof (e.g. the landing door) is opened, in order to implement the drive restriction mode. In this context, the drive unit may be controlled directly by the controller 50. For example, in this case, the controller 50 is part of the main control unit of the elevator.
According to some further examples of embodiments, the safety device receives a signal from access detection element 80 indicating an end of an access provision to the elevator shaft or roof of the elevator car for a person, e.g. via a landing door of the elevator or another access. In this case, the signal that the access provision ends is used as a trigger for starting the operation for determining as to whether or not a person is present in the elevator car or on the roof thereof. In other words, when the end of the access provision is indicated, it is decided whether to allow a reset of the drive restriction mode or to maintain the drive restriction mode. According to some examples of embodiments, a corresponding signal is provided to the controller 50 by means of an interface to an external access detection unit. Alternatively, according to some examples of embodiments, the access detection unit 80 is part of the safety device.
With regard to the access detection unit, while the above described examples of embodiments indicate a detection of an operation of a triangle key or the like, it is to be noted that the invention is not limited to such an access detection unit. The access may be provided also by other means, e.g. mechanical or electric/electronic key or authorization means, such as code input or the like, which are detected by the access detection unit as a measure to provide access to the roof of the elevator car.
According to some further examples of embodiments, the processing of the sensor signal for determining whether at least one person is present on the roof of the elevator car and/or in the elevator cabin is based on one or more of the following procedures. For example, for determining the presence of the person, the sensor signal is evaluated in order to determine a movement of a person in the detected area. For a more sophisticated determination, the sensor signal may be evaluated for detecting a breathing of a person or a heart beat of a person (for example in order to detect also a person not moving, such as an unconscious person). Signal processing for evaluating the received signal may include, for example, a threshold comparison or a signal pattern processing. Measures for noise compensation or the like can be used as well.
According to some further examples of embodiments, the sensor capable of detecting a presence of at least one person on a roof of an elevator car and/or in an elevator cabin of an elevator is one of different sensor types. For example, depending on the desired detection profile (e.g. a person's movement, breathing or heartbeat), the sensitivity of the sensor is selected. It is also possible to use more than one sensor of the same type or of different types.
The sensor is further provided on such a location that a person can be located on the car roof and/or inside the car. For example, the sensor is located at a position covering the elevator cabin, on the car roof, at an external location (e.g. in the elevator shaft) from which the roof of the elevator car is detectable.
According to examples of embodiments described above, the type of the sensor is an accelerometer. Such an accelerometer may be provided only for the purpose of detecting the presence of a person in the cabin or on the roof, or may be an accelerometer used also for other purposes in the elevator, such as for vibration damping or drive control. For example, the accelerometer is mounted in a door zone sensor (DZS). Moreover, the accelerometer may be configured to detect acceleration in one or more directions (e.g. vertical or horizontal acceleration and the like) of the elevator car. Types of suitable accelerometers comprise, for example, capacitive accelerometers, piezoelectric accelerometers, optical accelerometers, strain gauges, and the like.
However, according to some further examples of embodiments, also other types of sensors usable for detecting the presence of a person on the roof or in the cabin are implemented. For example, an image sensor like a video camera or an infrared sensor is used wherein the presence of a person is determined by means of a corresponding image processing. Alternatively, an acoustic sensor (like an ultrasonic sensor), a radar sensor, or the like are applicable.
As described above, the safety device according to examples of embodiments of the invention comprises a function or element corresponding to the controller 50 of Fig. 2 and capable to perform a processing according to Fig. 3. This is implemented, for example, by means of a standalone maintenance device or software loaded on a computer which is connected by means of a suitable interface to a control unit and sensors of an elevator system.
However, the safety device according to further examples of embodiments may also include at least one of elements and functions according to the sensor 60, the drive unit 70 and the access detection element 80. In the following, an example is described where the security mechanism includes functions or elements corresponding to the elements shown in Fig. 2. This is the case, for example, in a security mechanism being fully integrated in an elevator system, wherein corresponding control or processing functions are conducted by an elevator control unit being in charge for the overall control of the elevator.
Fig. 4 shows a flow chart of a corresponding processing conducted in a safety processing according to those examples of embodiments.
In S200, the access detection unit 80 detects that access to the elevator shaft 20 and/or the roof of the roof of the elevator car 10 is granted, e.g. by detecting unlocking of the landing door 43 by a triangular key. Consequently, a corresponding signal is sent to the controller 50 for triggering the drive restriction mode, e.g. a maintenance operation mode, allowing the elevator car to be moved only by inspection drive switches provided for the maintenance personnel, e.g. in a maintenance access panel at a landing and an inspection drive unit on the car roof.
In S220, the controller 50 receives from sensor 60 a sensor signal in order to detect a presence of at least one person on the roof of the elevator car and/or in the elevator cabin of the elevator.
In S230, the sensor signal is processed in order to determine whether at least one person is present on the roof of the elevator car and/or in the elevator cabin. For this purpose, a suitable signal processing is used.
In S240, on the basis of the result of the determining process whether at least one person is present, a decision for the further course of action is made. When no person is determined to be present, (NO in S240), it is decided in S280 to allow a reset of a drive restriction mode of the elevator for terminating the drive restriction mode when a trigger for such a reset is received (e.g. a corresponding signal from the access detection element 80 that the access is stopped (e.g. landing door 43 is locked again). That is, it is allowed to end a drive restriction mode and to return, for example, to a normal operation mode. In S290, a corresponding control processing is done by means of the drive unit (e.g. power supply is allowed, brake is released for normal operation).
Otherwise, in case the result of the determining process is affirmative and a person is determined to be present (YES in S240), reset of the drive restriction mode is inhibited, e.g. the maintenance drive is maintained.
It is to be noted that according to some examples of embodiments the drive restriction mode comprises only the maintenance driving mode while other examples may consider also modes, as described above, e.g. a complete stop of the elevator. In the maintenance mode, when a corresponding drive instruction from an inspection drive unit or maintenance access panel is received the drive unit is controlled correspondingly (e.g. power is supplied, brake is released etc. for maintenance drive operation with limitations as described above).
Alternatively or additionally, a condition that the person-on-the-car-roof situation is (still) present is recorded in a (non-volatile) memory, so that a change of the operation mode (e.g. to a normal operation mode) is not allowed.
Fig. 5 shows a diagram of a configuration of a safety device according to some examples of embodiments, which is configured to implement a safety procedure for an elevator system as described in connection with some of the examples of embodiments. It is to be noted that the safety device 90, which comprises function of the controller 50 of Fig. 2, may include further elements or functions besides those described herein below. Furthermore, even though reference is made to a device like a controller, the device or function may be also another device or function having a similar task, such as a chipset, a chip, a module, an application etc., which can also be part of a controller or attached as a separate device to a controller, or the like. It should be understood that each block and any combination thereof may be implemented by various means or their combinations, such as hardware, software, firmware, one or more processors and/or circuitry.
The safety device 90 shown in Fig. 5 may include a processing circuitry, a processing function, a control unit or a processor 901, such as a CPU or the like, which is suitable for executing instructions given by programs or the like related to the control procedure. The processor 901 may include one or more processing portions or functions dedicated to specific processing as described below, or the processing may be run in a single processor or processing function. Portions for executing such specific processing may be also provided as discrete elements or within one or more further processors, processing functions or processing portions, such as in one physical processor like a CPU or in one or more physical or virtual entities, for example. Reference sign 902 denotes input/output (I/O) units or functions (interfaces) connected to the processor or processing function 901. The I/O units 902 may be used for communicating with the other elements or function as described in connection with Fig. 2, for example, the sensor 60, the drive unit 70 and/or the access detection element 80. The I/O units 902 may be a combined unit including interface or communication equipment towards several elements, or may include a distributed structure with a plurality of different interfaces for different elements. Reference sign 904 denotes a memory usable, for example, for storing data and programs to be executed by the processor or processing function 901 and/or as a working storage of the processor or processing function 901. It is to be noted that the memory 904 may be implemented by using one or more memory portions of the same or different type of memory.
The processor or processing function 901 is configured to execute processing related to the above described safety procedures. In particular, the processor or processing circuitry or function 901 includes one or more of the following sub-portions. Sub-portion 905 is a processing portion which is usable as a portion for receiving and processing a sensor signal. The portion 905 may be configured to perform processing according to S100 of Fig. 3 or S220 of Fig. 4. Furthermore, the processor or processing circuitry or function 901 may include a sub-portion 906 usable as a portion for determining the presence of a person. The portion 906 may be configured to perform a processing according to S110 of Fig. 3 or S230 of Fig. 4. In addition, the processor or processing circuitry or function 901 may include a sub-portion 907 usable as a portion for deciding on the reset of a drive restriction mode. The portion 907 may be configured to perform a processing according to S120 to S140 of Fig. 3 or S240, S250 and S280 of Fig. 4. Moreover, the processor or processing circuitry or function 901 may include a sub-portion 908 usable as a portion for processing a decision result. The portion 908 may be configured to perform a processing according to S150 of Fig. 3 or S290 of Fig. 4.
In addition, according to another example of embodiments, there is provided an apparatus comprising at least one processing circuitry, and at least one memory for storing instructions to be executed by the processing circuitry, wherein the at least one memory and the instructions are configured to, with the at least one processing circuitry, cause the apparatus at least: to receive a sensor signal from a sensor capable of detecting a presence of at least one person on a roof of an elevator car and/or in an elevator cabin of an elevator, to process the sensor signal for determining whether at least one person is present on the roof of the elevator car and/or in the elevator cabin, and to decide, on the basis of the result of the determining process whether to allow a reset of a drive restriction mode of the elevator for terminating the drive restriction mode, in case the result of the determining process is negative, or to maintain the drive restriction mode, in case the result of the determining process is affirmative.
Furthermore, according to some other examples of embodiments, in the above defined apparatus, the at least one memory and the instructions may be further configured to, with the at least one processing circuitry, cause the apparatus to conduct at least one of the processing defined in the above described methods, for example a method according that described in connection with Fig 3 or Fig. 4.
As described above, according to some examples of embodiments, procedures allowing to improve safety of an elevator are provided, in particular for systems where only a limited headspace is available, by detecting the presence of a person on the roof of an elevator car and/or in the elevator cabin and by deciding on a reset of a drive restriction mode on the basis of the detection result.
By means of the proposed procedures being described above, it is possible to make a person-on-car-roof-detection more tamper proof. Furthermore, an additional protection layer for the elevator operation is provided, for example when a movable car roof is used which may be blocked by deliberate action to an up-position. Thus, additional redundancy in case of manipulation or disturbances of other protection systems is provided.
Moreover, examples of embodiments are easy to implement. For example, when using already existing sensors such as accelerometers, no additional elements are required to be installed. Furthermore, also already installed elevator systems can be modified, e.g. by software update, to allow application of the invention. When using sensors being installed at the elevator car, no additional means in the elevator shaft are required.
It should be appreciated that

embodiments suitable to be implemented as software code or portions of it and being run using a processor or processing function are software code independent and can be specified using any known or future developed programming language, such as a high-level programming language, such as objective-C, C, C++, C#, Java, Python, Javascript, other scripting languages etc., or a low-level programming language, such as a machine language, or an assembler.
implementation of embodiments is hardware independent and may be implemented using any known or future developed hardware technology or any hybrids of these, such as a microprocessor or CPU (Central Processing Unit), MOS (Metal Oxide Semiconductor), CMOS (Complementary MOS), BiMOS (Bipolar MOS), BiCMOS (Bipolar CMOS), ECL (Emitter Coupled Logic), and/or TTL (Transistor-Transistor Logic).
embodiments may be implemented as individual devices, apparatuses, units, means or functions, or in a distributed fashion, for example, one or more processors or processing functions may be used or shared in the processing, or one or more processing sections or processing portions may be used and shared in the processing, wherein one physical processor or more than one physical processor may be used for implementing one or more processing portions dedicated to specific processing as described,
a device may be implemented by a semiconductor chip, a chipset, or a (hardware) module including such chip or chipset;
embodiments may also be implemented as any combination of hardware and software, such as ASIC (Application Specific IC (Integrated Circuit)) components, FPGA (Field-programmable Gate Arrays) or CPLD (Complex Programmable Logic Device) components or DSP (Digital Signal Processor) components.
embodiments may also be implemented as computer program products, including a computer usable medium having a computer readable program code embodied therein, the computer readable program code adapted to execute a process as described in embodiments, wherein the computer usable medium may be a non-transitory medium.

Although the present invention has been described herein before with reference to particular embodiments thereof, the present invention is not limited thereto and various modifications can be made thereto.

Claims

A safety device (50) including
means configured to receive a sensor signal being received from a sensor (60) capable of detecting a presence of at least one person on a roof of an elevator car (10) and/or in an elevator cabin of an elevator,

means configured to process the sensor signal for determining whether at least one person is present on the roof of the elevator car (10) and/or in the elevator cabin, and

means configured to decide, on the basis of the result of the determining process whether to allow a reset of a drive restriction mode of the elevator for terminating the drive restriction mode, in case the result of the determining process is negative, or to maintain the drive restriction mode, in case the result of the determining process is affirmative.
The safety device (50) according to claim 1, further including
means configured to implement the drive restriction mode, and

means configured to control driving of the elevator via a drive unit (70) of the elevator.
The safety device (50) according to any of claims 1 and 2, further including
means configured to receive a signal from an access detection unit (80) indicating an end of an access provision to at least one of an elevator shaft (20) and the roof of the elevator car (10), wherein an operation of the means configured to decide whether to allow a reset of the drive restriction mode or to maintain the drive restriction mode is triggered by the signal indicating the end of the access provision to the elevator shaft (20) and the roof of the elevator car (10).
The safety device (50) according to any of claims 1 to 3, wherein
the means configured to process the sensor signal for determining whether at least one person is present on the roof of the elevator car (10) and/or in the elevator cabin is further configured

to recognize at least one of a movement of a person, a breathing of a person, a heart beat of a person, and/or

to recognize the presence of the at least one person on the basis of a signal processing including a threshold comparison, a signal pattern processing.
The safety device (50) according to any of claims 1 to 4, further including
at least one sensor (60) capable of detecting a presence of at least one person on a roof of an elevator car (10) and/or in an elevator cabin of an elevator, wherein
the at least one sensor (60) comprises one of an accelerometer, an image sensor, an infrared sensor, an acoustic sensor, a radar sensor,

the at least one sensor (60) is located at a position comprising at least one of the elevator cabin, the car roof, an external location from which the roof of the elevator car is detectable, and

the at least one sensor (60) is configured to communicate with the means configured to process the sensor signal by at least one of a wireless communication path and a wired communication path.
A method including
receiving (S100) a sensor signal being received from a sensor (60) capable of detecting a presence of at least one person on a roof of an elevator car (10) and/or in an elevator cabin of an elevator,

processing (S110) the sensor signal for determining whether at least one person is present on the roof of the elevator car (10) and/or in the elevator cabin, and

deciding (S120), on the basis of the result of the determining process whether to allow (S140) a reset of a drive restriction mode of the elevator for terminating the drive restriction mode, in case the result of the determining process is negative, or to maintain (S130) the drive restriction mode, in case the result of the determining process is affirmative.
The method according to claim 6, further including
implementing the drive restriction mode, and

controlling driving of the elevator via a drive unit (70) of the elevator.
The method according to any of claims 6 and 7, further including
receiving a signal from an access detection unit indicating an end of an access provision to at least one of an elevator shaft (20) and the roof of the elevator car (10), wherein a decision whether to allow a reset of the drive restriction mode or to maintain the drive restriction mode is triggered by the signal indicating the end of the access provision to the elevator shaft (20) and the roof of the elevator car (10).
The method according to any of claims 6 to 8, wherein
the processing of the sensor signal for determining whether at least one person is present on the roof of the elevator car (10) and/or in the elevator cabin further includes

recognizing at least one of a movement of a person, a breathing of a person, a heart beat of a person, and/or

recognizing the presence of the at least one person on the basis of a signal processing including a threshold comparison, a signal pattern processing.
The method according to any of claims 6 to 9, further including
detecting a presence of at least one person on a roof of an elevator car (10) and/or in an elevator cabin of an elevator, wherein
the detecting uses at least one of an accelerometer, an image sensor, an infrared sensor, an acoustic sensor, a radar sensor,

the detecting is conducted at a position comprising at least one of the elevator cabin, the car roof, an external location from which the roof of the elevator car is detectable, and

the sensor signal is communicated for processing by at least one of a wireless communication path and a wired communication path.
An elevator system including
at least one elevator car (10) carrying an elevator cabin,

a plurality of landing doors (41-44) via which the elevator cabin or a roof of the elevator car (10) is accessible,

a drive unit (30, 70) configured to drive the at least one elevator car (10) for passing the plurality of landing doors (41-44) and stopping at one specified landing door,

at least one sensor (60) capable of detecting a presence of at least one person on the roof of the at least one elevator car (10) and/or in the elevator cabin, and

a controller (50) configured to control the at least one elevator car (10), the landing doors (41-44) and the drive unit (30, 70), wherein the controller further includes a safety device according to any of claims 1 to 6.
The elevator system according to claim 11, further including
an access detection unit (80) indicating at least one of a start of an access provision to at least one of an elevator shaft (20) and the roof of the at least one elevator car (10) for a person and an end of the access provision to the at least one of the elevator shaft (20) and the roof of the at least one elevator car (10), wherein a signal indicating at least one of the start and stop of the access provision is communicated to the controller for triggering at least one of initiating or reset of the drive restriction mode.
A computer program product for a computer, including software code portions for performing the steps of any of claims 6 to 10 when said product is run on the computer.
The computer program product according to claim 13, wherein
the computer program product includes a computer-readable medium on which said software code portions are stored, and/or

the computer program product is directly loadable into the internal memory of the computer or transmittable via a network by means of at least one of upload, download and push procedures.