WO2017008849A1

WO2017008849A1 - Elevator control system

Info

Publication number: WO2017008849A1
Application number: PCT/EP2015/066164
Authority: WO
Inventors: Alexander PAETOW; Gerard Sirigu; Gianluca Foschini; Gregor STRICKER; Helmut Schroeder-Brumloop; Javier GARCIA-CASLA; Ricardo CANO-TORRES; Nicolas FONTENAU
Original assignee: Otis Elevator Company
Priority date: 2015-07-15
Filing date: 2015-07-15
Publication date: 2017-01-19
Also published as: EP3322660A1; CN107848743A; EP3322660B1; ES2935817T3; CN107848743B

Abstract

Disclosed is an elevator control system, comprising an elevator controller (18) configured to control an elevator car (12) such as to move along an elevator hoistway (14), and at least one control station configured to be operated by a person and to communicate with the elevator controller (18), such as to move the elevator car (12) along the hoistway (14), the at least one control station comprising a pit inspection control station (30) located in a pit (24) of the hoistway (14), the pit inspection control station (30) comprising at least one pit inspection control station safety switch (80, 86, 88, 90) being connected to the elevator controller (18) via a safety communication system, the at least one pit inspection control station safety switch (80, 86, 88, 90) being configured to enable movement of the elevator car (12) according to operation of the pit inspection control station (30), the pit inspection control station (30) further being connected to the elevator controller (18) via a further communication line (58) independent of the safety communication system, the further communication line (58) configured to communicate information with respect to an intended direction of movement of the elevator car (12).

Description

Elevator Control System

The present disclosure relates to an elevator control system comprising an elevator controller configured to control an elevator car such as to move along an elevator hoistway, and at least one control station configured to be operated by a person and to communicate with the elevator controller, such as to move the elevator car along the hoistway. More particularly, the control station is a pit inspection control station located in a pit of the hoistway. The pit inspection control station may be used to control movement of the elevator car during inspection and/or maintenance. The present invention also relates to an elevator system comprising such elevator control system.

Elevator systems involve particular safety requirements. Hardware or software used to control operation of elevators is to a significant part subject to specific conditions in order to meet such safety requirements. Particular levels of safety integrity requirements exist, depending on the degree of safety relevance of the respective functions or operations of the elevator system controlled, a set out in European standard EN 81 -20 issued November 2014 (cited herein according to the English translation of DIN EN 81-20:2014-11 ).

In elevator systems, safety critical operations are controlled, or at least monitored, using sensor and/or switching devices (in the following simply referred to as safety switches) connected to a safety controller which may be part of an elevator control system for operating the elevator system. Safety switches are often used at the various "safety points", at which the state of safety critical components (e.g. the position of movable components, such as doors) must be monitored prior to the initiation of an action and, if necessary, during the course of this action. In typical configurations a number of these safety switches are, in particular, connected in series to form a so-called "safety chain" so that the action can only be started or continued when all the safety switches or, in more general terms, switching devices take up a predetermined switching state. For example, in the case of an elevator system it must be ensured that before the start and during the travel of the elevator car all doors (car doors as well as landing doors on each floor) remain closed and mechanically locked. Therefore, travel of an elevator car is in general not allowed unless all of the safety switches in a safety chain connecting respective safety switches monitoring the closing state of the doors are closed.

To facilitate inspection and maintenance of an elevator system, specific inspection control stations are provided. These inspection control stations allow a technician to move the elevator car manually for carrying out specific inspection and maintenance tasks. Particularly, the inspection control station shall comprise an inspection mode enable switch, direction switches "Up" and "Down", and a switch "Run". Moreover, a stopping device for stopping movement of the car in case of an emergency shall be provided. All switches shall be protected against accidental operation. Conventionally, existing inspection control buttons and switches are directly wired into the safety chain.

In conventional elevator systems, an inspection control station is located on the car roof and an emergency electrical operation control station is located outside of the hoistway, usually on a floor. The above mentioned standard EN 81 -20 (2014) requires an additional inspection control station, particularly a permanently installed inspection control station, located in the pit of the hoistway (cf. sections 5.2.1.5, and 5.12.1 .5 of EN 81 -20 (2014). The additional inspection control station in the pit shall interact with the existing inspection control stations, particularly with the inspection control station on the top of the car. This requires additional hardware to connect the additional pit inspection control station into the existing safety chain such as to fulfil the safety requirements as set out in elevator safety codes like EN 81 -20 (2014). Particularly, the number of travelling cable wires increases dramatically and further power amplifiers in the safety chain might be needed because of the dramatically enlarged length of the cable wires.

EN 81 -20 (2014) is referred to herein only exemplary. Similar safety requirements exist for safety codes applying to other regions worldwide.

It would be beneficial to provide an elevator control system and an elevator system which allows to include an additional pit inspection control station in the elevator system efficiently, particularly in a way as to use existing hardware efficiently while still meeting safety requirements.

Embodiments described herein provide an elevator control system, comprising an elevator controller configured to control an elevator car such as to move along an elevator hoistway, and at least one control station configured to be operated by a person and to communicate with the elevator controller, such as to move the elevator car along the hoistway. The at least one control station comprises a pit inspection control station located in a pit of the hoistway. The pit inspection control station comprises at least one pit inspection control station safety switch being connected to the elevator controller via a safety communication system. The at least one pit inspection control station safety switch is configured to enable movement of the elevator car according to operation of the pit inspection control station. The pit inspection control station further is connected to the elevator controller via a further communication line independent of the safety

communication system. The further communication line is configured to

communicate information with respect to an intended direction of movement of the elevator car.

Further embodiments described herein provide an elevator system including a control system as described before.

Particular aspects and embodiments are described in more detail by way of exemplary embodiments as shown in the figures.

Fig. 1 schematically shows selected portions of an elevator system.

Fig. 2 is a schematic showing a safety arrangement for the elevator system of Fig. 1.

Fig. 3 is a block diagram showing communication in an elevator control system having various control stations including a pit control station, a top of car control station, and an emergency electrical operation control station, in relation to safety relevant operations and non-safety relevant operations. Fig. 4 is a diagram showing the circuitry of a pit inspection control station including a control circuit related to safety relevant operations and a communication circuit related to non-safety relevant operations.

Fig. 1 schematically shows selected portions of an elevator system 10. An elevator car 12 is movable within a hoistway 14 in a known manner. The elevator car 12 is driven by an elevator drive 16 (only indicated schematically by block 16 in Fig. 1) according to an elevator controller 18, such as to move the elevator car 12 in vertical direction along the hoistway 14. Usually, the elevator car 12 is coupled to the elevator drive 16 via a tension member, e.g. a rope or a belt (not shown in Fig. 1 ), e.g. in the way of a traction drive. The elevator drive 16 may include a drive machine including a motor, a drive sheave drivingly coupled to the tension member, and a brake for braking the drive sheave (not shown). Typically, the elevator system 10 will also include a counterweight (not shown) drivingly coupled to the elevator car 12 via the tension member such that the elevator car 12 and the counterweight will move in opposite direction along the hoistway 14 when the tension member is driven by the drive 16. Movement of the elevator car 12 and counterweight will usually be guided by respective guide means, e.g. guide rails (not shown in Fig. 1 ).

The hoistway 14 includes a plurality of landings serviced by the elevator car 12. Only a lowest landing 20 including landing doors 22 is schematically shown in FIG. 1. The hoistway 14 also includes a pit 24 located near a bottom of the hoistway 14 below the lowest landing 20. A pit sensor 26 is provided for detecting the presence of an individual within the pit 24. In an embodiment this pit sensor may be implemented as a contact which is linked to an emergency unlocking device 101 (see Fig. 4) of the landing door 22 at the lowest landing 20 . The pit sensor 26 communicates with the controller 18 to provide an indication of when an individual is in the pit 24. The controller 18 responds to an indication from the pit sensor 26 regarding the presence of an individual in the pit 24 by preventing movement of the elevator car 12. In one example, the elevator controller 18 is operative to disable the elevator drive 16 and/or apply a brake (not shown) so that the elevator car 12 cannot be moved.

Whenever the sensor 26 indicates the presence of an individual in the hoistway 14, the elevator controller 18 will not allow the elevator car 12 to move, except that an appropriate override signal is provided to the elevator controller 18. An override signal may be provided by a technician in the course of maintenance and inspection work, e.g. when it is required to operate the elevator car 12 manually in order to carry out specific maintenance and/or inspection procedures while the technician is in the hoistway (e.g. on top of the elevator car 12, or in the pit 24). The individual in the hoistway needs to take some action to provide such a signal to authorize car movement. The illustrated example includes a pit inspection control station (in short: PCS) 30 that can be manually operated by an individual in the pit 24. In one example, the pit inspection control station 30 may include at least one pit control activation switch that is to be manually manipulated by the individual in order to activate operation of the car by the pit inspection control station 30. The pit inspection control station 30, when properly activated, provides a pit override signal to the elevator controller 18 indicating that the individual in the pit 24 authorizes or accepts movement of the elevator car 12. In one example, the elevator controller 18, responsive to having received the pit override signal, may enable movement of the elevator car 12, but only may allow an inspection mode of car movement as long as an individual is in the pit 24. An inspection mode of car movement may include, for example, a limited range of movement, a slower speed of movement compared to a normal operating speed, or both.

In one example, the pit inspection control station (PCS) 30 may include a pit override device and also may include pit inspection control switches used for initiating an inspection mode and selecting/releasing movement of the elevator car 12, as described in detail below. In another example, the pit override device may be located in a separate location, and the pit inspection control station (PCS) only includes pit inspection control switches used for initiating an inspection mode and for manually controlling movement of the elevator car 12 in up direction and/or down direction, e.g switches for selecting direction of movement of the elevator car 12 and for releasing movement of the elevator car 12.

The illustrated example provides enhanced safety to an individual in the pit 24 while still allowing desirable movement of the elevator car 12 for inspection or maintenance procedures. The elevator controller 18 prevents movement of the elevator car 12 unless the individual in the pit 24 utilizes the pit inspection control station 30 to provide a signal indicating that it is acceptable to allow car movement (e.g., the individual is in a safe position or is at least aware of the car movement to avoid any undesirable contact with moving parts within the hoistway). In one example, a pit emergency stop switch (short: PCES) 32 is located in the pit 24 as well. Operating the pit emergency stop switch 32 immediately stops any movement of the elevator car 12. The pit emergency stop switch 32 must be utilized in a known manner by the individual in the pit 24. In one example, a proper combination of activations of the pit inspection control station 30 and the pit emergency stop switch 32 allows inspection mode movement while the individual is in the pit 24.

Fig. 1 shows a further sensor 36 indicating the presence of an individual in the hoistway 14. In embodiments this sensor can be implemented as the door contact of the landing door or a sensor that is located on the top 34 of the elevator car 12 and is similar to the pit sensor 26. In accordance with EN81 -20(2014), section 5.3.9.4, the door contact of the landing door may be configured as an electrical safety device for proving that the landing door is closed in operation of the elevator car 12. The further sensor 36 also communicates with elevator controller 18, such that the elevator controller 18 will not allow the elevator car 12 to move when the further sensor 36 provides as signal indicating the presence of a person in the hoistway 14. Also, with respect to the further sensor 36, it is possible to provide an appropriate override signal to the elevator controller 18 by operating a top of car inspection control station (TOCI) 40, such that elevator controller 18 allows movement of the elevator car 12, in particular in a maintenance and inspection mode as described above, in response to such override signal.

The top 34 of the elevator car 12 is provided with a railing which prevents a mechanic located on the elevator car top 34 from falling off. On the elevator car top 34 itself, the top of car inspection control station (TOCI) 40 is provided. Once the further sensor 36 detects presence of a person on top 34 of elevator car 12, the power supply to the elevator drive 16 will be interrupted unless the person, e.g. a mechanic or elevator operator entering the top 34 of the elevator car 12 operates the top of car inspection control station (TOCI) 40 within a predetermined time after entering the hoistway. top of car inspection control station

The top of car inspection control station (TOCI) 40 is configured to be activated manually by an individual to provide a car top override signal to the elevator controller 18. The car top override signal provides authorization to the elevator controller 18 to allow movement of the elevator car 12 even though an individual is on the top 34 of the car 12. In one example, the top of car inspection control station (TOCI) 40 may include a top of car override switch and also may include top of car inspection control switches used for initiating an inspection mode and for operating the car manually in the inspection mode, e.g. switches for selecting direction of movement of the elevator car 12 (e.g. "up" and "down" switches) and for releasing movement of the elevator car 12 (e.g. a "run" switch). In another example, a top of car override switch may be located in a separate location, and the top of car inspection control station (TOCI) 40 only includes top of car inspection control switches used for initiating an inspection mode and for selecting direction of movement and/or releasing movement of the elevator car 12.

In one example, a top of car emergency stop switch (TOCES) 42 is located on the top 34 of the elevator car 12 as well. Operating the top of car emergency stop switch 42 immediately stops any movement of the elevator car 12. The top of car emergency stop switch 42 must be utilized in a known manner by the individual in the top 34 of the elevator car 12. In one example, a proper combination of activations of the top of car inspection control station 40 and the top of car emergency stop switch 42 allows inspection mode movement while the individual is on the top 34 of the elevator car 12.

The elevator controller 18 will not allow movement of the elevator car 12 whenever an individual is present on top 34 of the elevator car 12 or in the pit 24 as indicated by either of the sensors 26 or 36. Wherever an individual is present, a

corresponding override signal is required by the elevator controller 18 before allowing any movement of the elevator car 12.

The elevator controller 18 is also connected to an emergency electrical operation control station (in short: ERO ) 44. ERO 44 may be provided at any location inside or outside the hoistway being accessible in case of an emergency, e.g. ERO 44 often will be located at any one of the floors serviced by the elevator, typically in the vicinity of the landing doors. ERO 44 is used in case the elevator car 12 is trapped in between two landing positions in the hoistway 14, in order to move the elevator car 12 to the next landing and to allow any passengers to escape from the car. In normal operation, ERO 44 remains inactive. Usually, to prevent access by unauthorized person, ERO 44 is closed by a front panel locked by a key lock.

Once the front panel is opened, an emergency electrical operation activation switch and a number of emergency electrical operation switches of the ERO 44 are accessible (these switches are not shown in Fig. 1 ). By operating the emergency electrical operation activation switches, emergency electrical operation is activated and the elevator car 12 can be moved slowly towards the next safe landing position by manually operating emergency electrical operation switches of the ERO 44. . In some embodiments the ERO 44 may be configured to carry out manual movement of the elevator car 12 for purposes of inspection/maintenance procedures as well.

As indicated schematically in Fig. 3, the controller system provides a safety control system and an operation control system. The safety control system is outlined in the left part of Fig. 3 and controls any safety relevant operations of the elevator system 10, as required according to safety requirements. Particularly, the safety control system controls sensor and/or switching devices (in the following simply referred to as safety switches) connected to various "safety points" in the elevator system 10, at which the state of safety critical components (e.g. the position of movable components, such as doors) must be monitored prior to the initiation of an action and, if necessary, during the course of this action. In typical configurations a number of these safety switches are connected in series to form a so-called safety chain 50 so that the action can only be started or continued when all the safety switches 30, 32, 40, 42, 52 (see e.g. Fig. 2) or, in more general terms, switching devices take up a predetermined switching state. For example, in the case of an elevator system 10 it must be ensured that before the start and during the travel of the elevator car 12 all doors (car doors as well as landing doors 22 on each floor) remain closed and mechanically locked. Therefore, travel of the elevator car 12 is in general not allowed unless all of the safety switches 30, 32, 40, 42, 52 in the safety chain 50 monitoring the closing state of the doors are closed. This is shown in more detail in Fig. 2.

As indicated in Fig. 3, according to embodiments disclosed herein the safety control system particularly controls safety relevant operations like enabling movement of the car in response to input of control commands to any of the pit inspection control station 30, top of car inspection control station 40, and the emergency electrical operation control station 44. In the embodiment, such safety relevant operations do not include control of the direction of movement of the elevator car (e.g. by operation "up" or "down" switches on a respective operation panel of the control stations 30, 40, 44), but merely activation of the control station (e.g. by switching the pit inspection control station 30, the top of car inspection control station 40 or the emergency electricaloperation control station 44 into the inspection mode, respectively) and releasing movement of the elevator car 12 (e.g. by simultaneously operation a "run" switch and any of an "up" or "down" switch, after the respective control station has been activated).

According to the scheme shown in Fig. 3 the safety operation control system provides control to enable or prevent any movement of the elevator car 12, regardless of the direction in which the elevator car 12 is to be moved. This safety control is realized by contacts in the safety chain 50.

The elevator control also controls other operations of the elevator system which are not subject to specific safety requirements. According to embodiments disclosed herein, such non safety relevant operations particularly include direction control of the elevator car 12 by operation of any of the pit inspection control station 30, the top of car inspection control station 40, and/or the emergency electrical operation control station 44. Direction control may imply that the information on the desired direction of movement of the elevator car 12 (e.g. according to operation of an "up" or "down" switch on an operating panel of the pit inspection control station 30, the top of car inspection control station 40, or the emergency electrical operation control station 44) is communicated to the elevator controller 18 controlling operation of the elevator drive 16. Thereby, the operation control system provides for a non-safety relevant information path 68, particularly controlling the direction of movement of the elevator car 12. The non-safety relevant information path 68 includes as one branch the communication line 58 connecting the pit inspection control station 30 to the elevator controller 18. As the information to be exchanged between the pit inspection control station 30 and the elevator controller 18 is not safety critical, the embodiments disclosed herein do not provide respective contacts in the safety chain 50 for this purpose. Rather, the controller 18 and the pit inspection control station 30 may communicate via a non- safety data connection, e.g. a serial bus, as indicated by reference sign 58 in Figs. 2 and 3, and the communication may be controlled by software evaluation.

Fig. 2 shows in an extremely schematic and simplified form the safety architecture of an elevator 10 in accordance with an embodiment, as shown in Fig.1 . In reality, the circuit configuration may be much more complex than shown in Fig. 2.

The safety architecture is controlled by the elevator controller 18, in particular by a subsystem of elevator controller 18 controlling the safety control system. The elevator controller 18 is in communication with the elevator drive 16 via line 56. A drive safety device 46 including at least one safety switch (e.g. in the form of a safety relay) is connected in between the elevator controller 18 and the elevator drive 16. The elevator drive 16 is connected via an electric power line 48 to a voltage source Us which provides the power supply of the elevator drive 16. The drive safety device 46 may comprise a safety power relay configured to interrupt supply of power Us to the elevator drive 16 in an open condition. The drive safety device 46 may be controlled by the elevator controller 18. Communication between the elevator controller 18 and the drive safety device 46 is safety critical and therefore controlled by the safety control system.

The controller 18 includes a main controller, a drive controller, a door controller, etc.. The safety control system controls a safety chain 50 formed by a plurality of safety switches 42, 40, 52, 32, 30 connected in series. Information on the state of any of the safety switches may be communicated via respective data connections, e.g. using a fail-safe bus system. A popular bus system includes a serial field bus system, e.g. a CAN bus system having a particular fail-safe configuration and using a fail-safe data protocol. For example, a safety unit (not shown) comprised in the elevator controller 18 receives status information from any of the safety switches and evaluates this information in the configuration of the safety chain 50. Usually, such safety unit controls a plurality of safety chains relevant with respect to different subsystems of the elevator system, respectively (e.g. a safety chain with respect to the main power supply of the elevator system, a safety chain with respect to the drive of a car, or a safety chain with respect to the door drive of a car, etc.). A safety chain has the configuration of a serial connection of all relevant safety switches. In case only a single one of the safety switches in the safety chain does not show a proper status information (e.g. indicates a not fully closed state of a door), the status of that safety switch will be considered open. Due to the serial connection of the safety switches in the safety chain, any safety chain including that safety switch will be considered open indicating that the elevator system, or a respective subsystem of the elevator system (e.g. the car door drive), is

considered to be in an unsafe condition. In such case, the safety unit will stop further operation of the elevator system, or of the respective elevator subsystem, until the safety chain is closed again. For example, the safety unit may interrupt power supply to the drive controller, in order to stop further movement of the car, interrupt power supply to the door controller to stop further movement of the car door, and/or interrupt power supply to the main controller to completely shut down the elevator system. In Fig. 2, the safety chain 50 comprises a number of safety devices 42, 40, 52, 32, 30 which are connected in series. Each of the safety devices 42, 40, 52, 32, 30 includes at least one safety switch. A voltage U is applied to one end of the safety chain 50. The other end of the safety chain is connected to the elevator controller 18. In other configurations, the voltage U may be supplied to the safety chain 50 by the elevator controller 18. In general, any safety switch or safety device 42, 40, 52, 32, 30 connected in the safety chain 50 represents a potentially insecure state of the elevator 10, where an insecure state is indicated in case the respective safety switch or safety device is in an open condition. Therefore, in case any one of the safety devices or safety switches 42, 40, 52, 32, 30 is open, the safety chain 50 will be open, and therefore in the configuration shown in Fig. 2 no voltage U will be applied to the elevator controller 18. In case the elevator controller 18 detects that voltage U is not applied at the end of the safety chain 50 connected to elevator controller 18, the elevator controller 18 switches the safety device 46 into an open condition, thereby interrupting supply of power Us to the elevator drive 16. Loss of power supply will also lead to engagement of a brake of elevator drive 16 (not shown). Communication between the elevator controller 18 and the safety devices connected in the safety chain 50 also is safety critical and therefore controlled by the safety control system.

Various types of safety switches are connected in the safety chain 50. The safety switches 52 are door safety contacts which are provided at each of the landing doors in the hoistway 14. In case one of the landing doors is opened, but the car 12 is not at that landing, the respective safety switch 52 at that landing opens and in consequence the power supply to the elevator drive 16 is interrupted by the elevator controller 18. It does not matter which of the landing door safety switches 52 is opened, since the elevator controller 18 receives the same information in case any of the landing doors is open. Therefore, the elevator controller 18 has no information at all concerning which of the landing doors is open or whether more than one landing doors are open.

The safety chain 50 also comprises the top of car emergency stop switch 42 and the top of car operation station 40 which are provided on the top of the elevator car 12. In FIG. 1 , both the top of car emergency stop switch 42 and the top of car operation station 40 are drawn schematically in the form of a box. In Fig. 2 the top of car emergency stop switch 42 is indicated as a single safety switch connected in the safety chain 50, while the top of car inspection control station 40 is indicated as a safety device connected in the safety chain 50. The safety device may include one or a plurality of safety switches. For example, the safety device may include a first safety switch enabling manual operation of the elevator car 12, and may also include further safety switches to enable movement of the elevator car in one direction, i.e. movement in up direction or movement in down direction, respectively. By means of these switches, the mechanic is able to move the car up or down at slow travel when the top of car inspection control station 40 is active. As a consequence of the various safety switches, the communication line between the top of car inspection control station 40 and the elevator controller 18 in reality is much more complicated than indicated in the schematic representation in FIG. 2.

The safety chain 50 extends to the pit 24 of the hoistway 14 as well. The pit emergency stop switch 32 as well as the pit inspection control station 30 provided in the pit 24 are connected in the safety chain 50 as well. If a mechanic or an elevator operator enters the pit 24, he must activate the pit inspection control station 30 in accordance with maintenance instructions.

A separate communication line 58 connects the pit inspection control station 30 to the controller 18. Via the communication line 58 the controller 18 may receive information from the pit inspection control station 30 independent of the safety chain 50. As outlined in more detail below, communication line 58 need not necessarily be a fail safe communication line, in contrast to the safety chain 50 and the communication line 56. In one embodiment, communication line 58 may be a serial communication line, in particular a serial field bus, e.g. a CAN bus.

FIG. 2 further indicates a hoistway monitoring sensor 54 in the form of a motion sensor which is not integrated in the safety chain 50, but connected to a separate input of the elevator controller 18.

In certain periods of time, or upon installation in the elevator system, the elevator system 10 may be subject to inspection or maintenance to be performed by one or more technicians. For example, specific test procedures may be carried out for checking the correct operation of each of the safety switches in the safety chain(s). For controlling the elevator system 10 in inspection or maintenance operation, the elevator system 10 is provided with an inspection control station, such as the pit inspection control station 30 and the top of car inspection control station 40. The inspection control station is configured for operating at least one function of the elevator system 10 in an inspection or maintenance operation mode, for example, at least one function as set out in standard EN 81 -20(2014). For example, one function may be to control movement of the elevator car in up and down direction. Another function may be the control of opening and closing of the elevator car doors. In principle, the inspection control station 30, 40 is capable of

communicating with and controlling any of the functions of the elevator controller 18, such as main controller, drive controller and/or door controller.

In the elevator system 10, two permanently installed inspection control stations are provided, namely the pit inspection control station 30 and the top of car inspection control station 40. Moreover, the emergency electrical operation control station 44 may also be used for carrying out manual control of the elevator for

inspection/maintenance purposes, if desired. In this way, a readily operable inspection control station can be permanently installed in any one of, e.g., on the elevator car roof, in the pit, and/or within or proximate to the elevator shaft. If desired, further control stations may be provided in the elevator car 12 (not shown).

Fig. 3 also indicates schematically the interplay between operation of the various control stations, particularly the pit inspection control station 30, the top of car inspection control station 40, and the emergency electrical operation control station 44. With respect to the safety relevant control system shown in the left part of Fig. 3, the pit inspection control station 30 can be connected at any desired location in the existing safety chain 50. The pit inspection control station 30 is connected in series to the top of car inspection control station 40. This allows to operate the elevator car simultaneously via both the pit inspection control station 30 and the top of car inspection control station 40. At the same time, this ensures that the elevator car stops immediately when any safety switch in either the pit inspection control station 30 or the top of car inspection control station 40 is opened in the course of an inspection operation involving two technicians, one technician operating the car via the pit inspection control station 30 and the other technician operating the car via the top of car inspection control station 40. E.g. when the "inspection mode" activation switches in both the pit inspection control station 30 and the top of car inspection control station 40 are activated, the respective safety switches in the pit inspection control station 30 and the top of car inspection control station 40 are connected serially in the safety chain 50. Thus, all safety switches in both control stations 30, 40 have to be closed simultaneously in order to allow manual operation of the car by both technicians. For example, in the inspection mode with both control stations 30, 40 activated to "inspection mode", the "run" switches on both the pit inspection control station 30 and the top of car inspection control station 40 are connected serially in the safety chain 50 in the safety chain path 62. Therefore, the car 12 is allowed to move only in case the technician in the pit 24 enables movement of the car by operating the "run" switch together with one of the "up" and "down" switches in the pit inspection control station 30 and at the same time the technician on the top 34 of the car enables movement of the car by operating the "run" switch together with the same one of the "up" and "down" switches in the top of car inspection control station 40.

When switched to inspection mode, each of the pit inspection control station 30 and top of car inspection control station 40 is configured to prevent an emergency electrical operation by interrupting the safety chain path 64 through the emergency electrical operation control station 44, as indicated by the horizontally hatched boxes 30, 40 in Fig. 3. Moreover, in emergency electrical operation mode any movement of the car 12 invoked by operating the pit inspection control station 30 or invoked by operating the top of car inspection control station 40 takes preference over an operation of the emergency electrical operation control station 44, as indicated by the vertically hatched boxes 30, 40 in Fig. 3.

As indicated in the right part of Fig. 3, the controller 18 also includes a non-safety relevant control system which includes a non-safety relevant communication path 68 connecting the pit inspection control station 30, the top of car inspection control station 40, and the emergency electrical operation control station 44 in parallel to the elevator controller 18. The non-safety relevant communication path 68 does not include a safety chain and is handled by software only. The state of the direction buttons and inspection switches of the pit inspection control station 30, the top of car inspection control station 40 and the emergency electrical operation control station 44 is transmitted via the non-safety communication path 68 and is evaluated by software in the elevator controller 18. One branch of the non-safety communication path 68 includes the additional communication path 58 connecting the pit inspection control station 30 with the elevator controller 18. Both the non- safety communication path 68 as well as the additional communication path 58 may have the configuration of a conventionally known serial bus. Fig. 4 shows in more detail the configuration of the control circuit of the pit inspection control station 30. The control circuit includes a safety relevant control subcircuit 72 shown in the left part of Fig. 4 and a non-safety relevant control subcircuit 74 shown in the right part of Fig. 4.

The safety relevant control subcircuit 72 includes the safety chain 50 which enters at a safety chain entrance 76 and exits at a safety chain exit 78. As a first safety switch, the pit emergency stop switch (PCES) 32 is provided. When the pit emergency stop switch is opened, the safety chain 50 is open and any movement of the elevator car 12 is blocked. As a further safety switch, the pit inspection control station enable switch (PCS) 80 is connected in series to the pit emergency stop switch 32. The pit inspection control station enable switch 80 is a complex switch having four sub-switching elements 80a, 80b, 80c, 80d. Operation of the pit inspection control station enable switch 80 simultaneously operates all four sub- switching elements 80a, 80b, 80c, 80d, as follows: In normal operation (i.e. when the pit inspection control station 30 is disabled), the pit inspection control station enable switch 80 is disabled, thus connecting safety chain entrance 76 to safety chain exit 78 via a main path 82 of safety chain 50 (i.e. sub-switching element 80a is closed). At the same time, the pit control path 84 of the safety chain 50 is disabled, i.e. the respective sub-switching element 80b is open. The further sub- switching elements 80c and 80d are open as well. In this configuration operation of the elevator system 10 is controlled by the normal elevator controller 18 and the pit inspection control station 30 is bypassed, i.e. operation of any switches on the pit inspection control station 30 (except for pit emergency stop switch 32) does not have any influence on operation of the elevator system 10.

When the pit inspection control station enable switch 80 is operated, all four sub- switching elements 80a, 80b, 80c, 80d change their configuration. Thus, in an activated condition of the pit inspection control station enable switch 80, sub- switching element 80a is open and sub-switching element 80b is closed.

Therefore, the status of the safety chain 50 is now determined by the pit inspection control station 30, particularly by the further safety switches connected in the pit control path 84 of the safety chain 50: pit inspection control station car travel release switch (PCIB) 86, pit inspection control station direction down switch (PDIB) 88, and pit inspection control station direction up switch (PUIB) 90. All switches 86, 88, 90 are normally open switches, i.e. without being manually operated these switches remain open. The pit inspection control station direction down switch (PDIB) 88 and the pit inspection control station direction up switch (PUIB) 90 are connected in parallel. The pit inspection control station car travel release switch (PCIB) 86 is connected in series to each of the pit inspection control station direction down switch (PDIB) 88 and the pit inspection control station direction up switch (PUIB) 90. Therefore, simultaneous operation of the pit inspection control station car travel release switch (PCIB) 86 and any of the pit inspection control station direction down switch (PDIB) 88 or the pit inspection control station direction up switch (PUIB) 90 is required to close the safety chain 50 and release movement of the elevator car 12.

Activation of the pit inspection control station enable switch 80 also closes the third sub switching element 80c. This closes a bypass path of safety chain 50 allowing to bypass the emergency electrical operation control station 44. Therefore, emergency electrical operation is not possible when the pit inspection control station 30 is activated. Also, manual movement of the elevator car 12 via the emergency electrical operation control station 44 is disabled when the pit inspection control station 30 is activated, because the pit inspection control station direction down/up switches (see switches PDIB 88/PUIB 90 in Fig. 4) and the pit inspection control station car travel release switch (see switch PCIB 86 in Fig. 4) are not activated and therefore the safety chain is kept open.

Moreover, the pit inspection control station enable switch 80 also includes the fourth sub switching element 80d. The fourth sub-switching element 80d couples the safety relevant control subcircuit 72 to the non-safety relevant control subcircuit 74. When the pit inspection control station enable switch 80 is not operated, the fourth sub-switching element 80d is open. Operation of the pit inspection control station enable switch 80 includes closing of the fourth switching element 80d.

The pit inspection control station direction down switch (PDIB) 88 includes first and second sub-switching elements 88a, 88b which are operated simultaneously when the pit inspection control station direction down switch is manually operated. In the same way, the pit inspection control station direction up switch (PUIB) 90 includes first and second sub-switching elements 90a, 90b which are operated

simultaneously when the pit inspection control station direction up switch is manually operated. The second sub-switching elements 88b, 90b couple the safety relevant control subcircuit 72 to the non-safety relevant control subcircuit 74 as well. As shown in the right part of Fig. 4, the non-safety relevant control subcircuit 74 includes a serial bus output terminal 92. Serial bus output terminal 92 includes a reference potential 94, and three registers 96, 98, 100. The first register 96 is connected to the reference potential 94 via the fourth sub-switching element 80d of the pit inspection control station enable switch 80. The second register 98 is connected to the reference potential 94 via the second sub-switching element 88b of the pit inspection control station direction down switch (PDIB) 88. The third register 100 is connected to the reference potential 94 via the second sub- switching element 90b of the pit inspection control station direction up switch (PDIB) 90. In this way the serial output terminal 92 provides for a digital signal reflecting the state of the pit inspection control station 30, in particular whether the pit inspection control station 30 is activated (via the state of the first register 96), and whether the pit inspection control station direction up switch 88 is manually operated (via the state of the second register 98), and whether the pit inspection control station direction down switch 88 is manually operated (via the state of the second register 98). The information provided by the three registers 96, 98 and 100 is communicated to the elevator controller 18 via serial bus, e.g. using a field bus protocol like CAN. Such communication does not need to be configured in a fail-safe way (e.g. by providing redundant signal paths).

Embodiments as disclosed above to integrate an additional pit inspection control station in an elevator system efficiently. Particularly, integration of an additional pit inspection control station may be achieved in a way as to use existing hardware efficiently while still meeting safety requirements.

In an embodiment the elevator control system comprises an elevator controller configured to operate an elevator car such as to move along an elevator hoistway, and at least one control station configured to be operated by a person and to communicate with the elevator controller, such as to move the elevator car along the hoistway. The at least one control station comprises a pit inspection control station located in a pit of the hoistway.

The pit inspection control station comprises at least one pit inspection control station safety switch being connected to the elevator controller via a safety communication system, the at least one pit inspection control station safety switch being configured to enable movement of the elevator car according to operation of the pit inspection control station. The pit inspection control station further is connected to the elevator controller via a further communication line independent of the safety communication system, the further communication line configured to communicate information with respect to an intended direction of movement of the elevator car.

The pit inspection control station may be an inspection and/or maintenance control station, used to control operation of the elevator car during inspection and/or maintenance. Often inspection/maintenance procedures require manual operation of the car, e.g. by a technician operating the pit inspection control station manually. Control stations for similar purposes and of similar construction are usually provided at other locations as well, particularly at the top of the car, in a hall outside the hoistway such as to be accessible from a floor, or even inside the car. Control panels as described her may also be used for manually rescuing passengers in case the car is stopped in between landings.

The pit of a hoistway usually is located in the most bottom part of the hoistway. Often, the space underneath a lowest landing in the hoistway is referred to as the pit.

A safety communication system as set out herein is a communication system fulfilling particular safety requirements for safety relevant information, as set out in elevator safety codes, particularly in EN 81-20 (2014). According to embodiments described herein, only safety relevant information is communicated via the safety communication system. Such information includes information with respect to release of movement of the car according to operation a control station (e.g. the pit inspection control station or a top of the car inspection control station) by a person. It may also include information with respect to activation of such control station (particularly, the pit inspection control station or the top of the car inspection control station). However, normally no other information is communicated via the safety communication system. In particular, information with respect to intended direction of movement of the car is not communicated between the pit inspection control station and the elevator control via the safety communication system, but via the further communication line.

Embodiments as described above provide for the possibility of having an additional control station for controlling movement of the car in inspection and/or maintenance, e.g. for manually operating the car such as to move along the hoistway. The additional control station is located in the pit and thus may be operated by a person in the pit. Although the distance from the pit to the elevator controller often is large, particular in cases where the elevator controller is positioned close to the top of the hoistway, the number of travelling cable wires is kept the same as without the additional pit inspection control station. Therefore, the number of required additional wires in the hoistway is kept small. In addition, the proposed solution does not require additional power amplifiers in the safety chain with respect to embodiments not having an additional control station in the pit.

The embodiments set out above use two independent information paths for communicating safety relevant information and non-safety relevant information between the pit inspection control station and the elevator controller. The safety relevant information path communicates any information to prevent or enable movement of the elevator car. No information on the desired direction of car movement is communicated via the safety relevant communication path. The safety relevant communication path uses contacts in the safety communication system of the elevator, e.g. in the safety chain. The direction of movement of the car is communicated via another, independent communication path, the non-safety information path, and is carried out largely by software evaluation without additional hardware. For instance, any existing bus connection between the pit inspection control station and the elevator controller may be used for establishing the non-safety communication path, e.g. by modifying a bus protocol used for communication on an existing bus. A serial bus, i.e. a bus using a serial data protocol, is particularly well suitable for such purposes. The state of the direction switches (e.g. realized as push-buttons on the pit control station) and inspection switches (e.g. realized as rotary control switch on the pit control station) may easily be transmitted via an existing communication bus and evaluated by software in the elevator controller, as there are no particular safety requirements. This information may also be used to control the elevator drive, i.e. to send a drive signal to the motor of the elevator in order to start movement of the elevator car in a desired direction.

Particular embodiments may include any of the following optional features, alone or in combination: The safety communication system may comprise at least one safety chain, the at least one pit inspection control station safety switch being connected in the safety chain. The pit inspection control station may be connected at any desired location in the existing safety chain.

The further communication line may have the configuration of a serial bus, particularly a CAN bus. Such serial bus is used in most elevator systems in order to communicate non-safety relevant information between devices located in the pit and the elevator controller. It is relatively easy to modify the serial bus protocol used to exchange data over the bus, in order to include the additional information related to desired direction of movement of the elevator car and further information as desired. For example, the further communication line may be configured to further communicate information with respect to activation of the pit control station. Moreover, the elevator controller may be configured to operate an elevator drive according to information communicated via the further communication line, particularly according to the information with respect to the intended direction of movement of the elevator car. Without such information being received at elevator controller, no drive signal will be provided to elevator drive and the car will not start moving, as the holding brake will be engaged and no drive signal is provided to the elevator motor. This is an inherently safe feature, such that it is not necessary to provide a fail-safe data communication path.

The at least one pit inspection control station safety switch may be configured to change the status of the safety communication system and affect communication via the further communication line when being operated. Changing the status of the safety communication system may refer to switching a safety chain from a normal operation path to a pit control operation path. When configured in the normal operation path, the safety chain is unaffected by any control commands invoked via the pit inspection control station (and usually also unaffected by any commands invoked via other special control stations like

inspection/maintenance/emergency electrical operation control stations). When configured in the pit control operation path, movement of the car may be effected by operating the pit control station. Other status changes of the safety

communication system may be conceivable as well, e.g. switching to top of car control operation path (in which movement of the car may be effected by operation a top of car inspection control station), emergency electrical operation control path (in which movement of the car may be effected by operation an emergency electrical operation control station). Simultaneous activation of particular configurations may be conceivable, particularly the pit control operation path and the top of car operation path may be active at the same time, so the car can be operated by two persons, one person in the pit and another person on the top of the car. Activation of the pit control operation path and/or top of car operation path may at the same time disable other operation paths, particularly may disable the emergency electrical operation control path. In further embodiments, also an operation from inside the car operation path may be provided, which may also be activated together with the pit control operation path and/or the top of car control operation path.

The at least one pit inspection control station safety switch may include a first pit inspection control station safety switch configured to provide two functions when being activated: First, operation of the first pit inspection control station safety switch may activate or deactivate the pit control station, i.e. switch the safety communication system between the normal operation configuration and the pit control operation configuration. This is a pre-requisite to allow operating the elevator car by the pit control station. Second, operation of the first pit inspection control station safety switch may simultaneously communicate via the further communication line the switched configuration of the safety communication system to the elevator controller. Thereby, operation of the first pit inspection control station safety switch simultaneously has an effect on both the safety

communication system of the elevator control system and the non-safe

communication for controlling the elevator via the further communication line.

Moreover, the at least one pit inspection control station safety switch may be configured to allow operation of the elevator car by: (i) releasing movement of the elevator car according to operation of the pit control station, and (ii) communicating via the further communication line the intended direction of movement of the elevator car to the elevator controller. Particularly, the pit inspection control station safety switch may be configured such that operation of the pit inspection control station does not have an effect to release movement of the elevator car, until the safety communication system has been switched to the pit control configuration.

The at least one pit inspection control station safety switch may include a second pit inspection control station safety switch configured to release movement of the elevator car according to operation by the pit inspection control station and a third pit inspection control station switch configured to command an intended direction of movement of the elevator car. The third pit inspection control station safety switch may be configured to (i) release movement of the elevator car according to operation of the pit control station, and (ii) communicate via the further

communication line an intended direction of movement of the elevator car to the elevator controller. In particular embodiments, releasing movement of the elevator car according to operation of the pit inspection control station may require operating the third pit inspection control station safety switch together with the second pit inspection control station safety switch. The second pit inspection control station safety switch and the third pit inspection control station safety switch may be connected serially such that both the second pit inspection control station safety switch and the third pit inspection control station safety switch have to be operated simultaneously in order to release movement of the elevator car.

The elevator control system further may comprise a top of car inspection control station comprising at least one top of car inspection control station safety switch serially connected to the at least one pit inspection control station safety switch. The top of car inspection control station is provided such as to allow operation of the car by a person standing on the top of the car, e.g. for inspection and/or maintenance purposes. Simultaneous operation of car via the top of car inspection control station and the pit inspection control station may be possible. Indeed, sometimes carrying out specific tasks during inspection/maintenance requires to operate the car simultaneously by two technicians, one technician operating the car from the top of the car and the other technician operating the car from the pit. In order to meet safety requirements, moving the car requires simultaneous operation of both the top of car inspection control station safety switch and pit inspection control station safety switch. This is realized by the serial connection.

Similarly, an in-car inspection control station may be provided for operation of the car from inside the car, e.g. for inspection and/or maintenance purposes.

Configuration of the in-car inspectiobn control station will be corresponding to configuration of top of car inspection control station. Particularly, the in-car inspection control station may comprise at least one in-car inspection control station safety switch serially connected to the at least one pit inspection control station safety switch and/or the at least one top of car inspection control station safety switch. Thereby, simultaneous operation of car via any pair of top of car inspection control station, in-car inspection control station and pit inspection control station is possible, but requires simultaneous operation of the respective two of the top of car inspection control station safety switch, in-car inspection control station safety switch and pit inspection control station safety switch.

The elevator control system further may comprise an emergency electrical operation control station, wherein the at least one pit inspection control station safety switch is configured to disable operation of the emergency electrical operation control station upon activation of the pit inspection control station.

Particularly, any of the pit inspection control station, the top of car inspection control station and the emergency electrical operation control station may be configured to be operated manually.

The embodiments set out herein also relate to an elevator system, comprising an elevator control system as set out in the paragraphs above.

While the invention has been described by taking reference to specific exemplary embodiments, it is to be understood that the invention is not limited to these embodiments and is defined by the scope of the appended claims.

List of reference signs:

10: Elevator system

12: Elevator car

14: Hoistway

16: Elevator drive

18: Elevator controller

0: Landing

2: Landing door

4: Pit

6: Pit sensor

0: Pit inspection control station (PCS)

2: Pit emergency stop switch (PCES)

4: Top of car

6: Further sensor, particularly top of car sensor

0: Top of car inspection control station (TOCI) : Top of car emergency stop switch (TOCES)

: Emergency electrical operation control station (ERO) : Drive safety device

: Electric power line

: Safety chain

: Door safety contact

: Hoistway monitoring sensor

: Safety line

: Further communication line

: Main safety chain path

: Safety chain path through ERO

: Non-safety communication path

: Safety relevant control subcircuit

: Non-safety relevant control subcircuit

: Safety chain entrance

: Safety chain exit

: Pit inspection control station enable switch

a: First sub-switching element

b: Second sub-switching element

c: Third sub-switching element

d: Fourth sub-switching element

: Main safety chain path

: Pit control safety chain path

: Pit inspection control station car travel release switch (PCIB): Pit inspection control station direction down switch (PDIB)a: First sub-switching element

b: Second sub-switching element

: Pit inspection control station direction up switch (PUIB)a: First sub-switching element

b: Second sub-switching element

: Serial bus output terminal

: Reference potentially

: First register

: Second register

0: Third register

1 : Emergency unlocking contact (KSL)

2: Down limit switch during Pit inspection control operation (5LS

Claims

1. An elevator control system, comprising an elevator controller (18) configured to control an elevator car (12) such as to move along an elevator hoistway (14), and at least one control station configured to be operated by a person and to communicate with the elevator controller (18), such as to move the elevator car (12) along the hoistway (14),

the at least one control station comprising a pit inspection control station (30) located in a pit (24) of the hoistway (14),

the pit inspection control station (30) comprising at least one pit inspection control station safety switch (80, 86, 88, 90) being connected to the elevator controller (18) via a safety communication system, the at least one pit inspection control station safety switch (80, 86, 88, 90) being configured to enable movement of the elevator car (12) according to operation of the pit inspection control station (30),

the pit inspection control station (30) further being connected to the elevator controller (18) via a further communication line (58) independent of the safety communication system, the further communication line (58) configured to communicate information with respect to an intended direction of movement of the elevator car (12).

2. The elevator control system according to claim 1 , wherein the safety

communication system comprises at least one safety chain (50), the at least one pit inspection control station safety switch (80, 86, 88, 90) being connected in the safety chain (50).

3. The elevator control system according to claim 1 or 2, wherein the further

communication line (56) has the configuration of a serial bus.

4. The elevator control system according to claim 3, wherein the serial bus is a serial field bus.

5. The elevator control system according to any of claims 1 to 4, wherein the

further communication line (58) is configured to further communicate information with respect to activation of the pit inspection control station (30).

6. The elevator control system according to any of claims 1 to 5, wherein the elevator controller (18) is configured to operate an elevator drive (16) according to the information communicated via the further communication line (58).

7. The elevator control system according to any of claims 1 to 6, wherein the at least one pit inspection control station safety switch (80, 86, 88, 90) is configured to change the status of the safety communication system and affect communication via the further communication line (58) when being operated.

8. The elevator control system according to claim 7, wherein the at least one pit inspection control station safety switch (80, 86, 88, 90) includes a first pit inspection control station safety switch (80) configured to (i) switch the safety communication system between a normal operation configuration and a pit control operation configuration, and (ii) communicate via the further communication line (58) the switched configuration to the elevator controller (18).

9. The elevator control system according to claim 7 or 8, wherein the at least one pit inspection control station safety switch (80, 86, 88, 90) is configured to (i) release movement of the elevator car (12) according to operation of the pit inspection control station (30), and (ii) communicate via the further communication line (58) the intended direction of movement of the elevator car (12) to the elevator controller (18).

10. The elevator control system according to claim 9, wherein the at least one pit inspection control station safety switch (80, 86, 88, 90) includes a second pit inspection control station safety switch (86) configured to release movement of the elevator car (12) according to operation by the pit inspection control station (30) and a third pit inspection control station switch (88, 90) configured to command an intended direction of movement of the elevator car (12).

11. The elevator control system according to claim 10, wherein the third pit

inspection control station safety switch (88, 90) is configured to (i) release movement of the elevator car (12) according to operation of the pit inspection control station (30), and (ii) communicate via the further communication line (58) an intended direction of movement of the elevator car (12) to the elevator controller (18).

12. The elevator control system according to claim 10 or 11 , wherein the second pit inspection control station safety switch (86) and the third pit inspection control station safety switch (88, 90) are connected serially.

13. The elevator control system according to any of claims 1 to 12, wherein the at least one control station further comprises a top of car inspection control station (40) comprising at least one top of car inspection control station safety switch serially connected to the at least one pit inspection control station safety switch (80, 86, 88, 90).

14. The elevator control system according to any of claims 1 to 13, further

comprising an emergency electrical operation control station (44), wherein the at least one pit inspection control station safety switch (80, 86, 88, 90) is configured to disable operation of the emergency electrical operation control station (44) upon activation of the pit inspection control station (30).

15. The elevator control system according to any of claims 1 to 14, wherein any of the pit inspection control station (30), the top of car inspection control station (40) and the emergency electrical operation control station (44) is configured to be operated manually.

16. Elevator system (10), comprising an elevator control system according to any of the previous claims.