WO2023284938A1

WO2023284938A1 - Safety solution for elevators

Info

Publication number: WO2023284938A1
Application number: PCT/EP2021/069329
Authority: WO
Inventors: Juha-Matti Aitamurto; Juhamatti Nikander; Lauri Stolt; Ari Kattainen
Original assignee: Kone Corporation
Priority date: 2021-07-12
Filing date: 2021-07-12
Publication date: 2023-01-19
Also published as: CN116601100A

Abstract

The invention relates to an elevator safety system (200) for an elevator system (1000) comprising an elevator drive system (160) comprising: an elevator hoisting machine (165), an elevator brake composition (180); a brake controller (185), a motor drive (175), and a safety function (177), the elevator safety system (200) comprising: at least one sensor (195) and a safety controller (210) configured to: obtain (410) data on a control state of the elevator brake composition (180), obtain (420) sensor data, and generate (440) a safety signal to supply VVVF voltage signal in response to: a detection (430) that the control state corresponds to the braking state, and a detection (430) that the operation of the elevator brake composition(s) (180) does not correspond to a braking operation. The invention also relates to a method, an elevator system (1000), and a computer program.

Description

SAFETY SOLUTION FOR ELEVATORS

TECHNICAL FIELD

The invention concerns in general the technical field of elevators. More particularly, the invention concerns a safety solution for elevators.

BACKGROUND

Elevators have electromechanical hoisting machine brakes as safety devices to apply braking force to a traction sheave or a rotating axis of a hoisting machine of an elevator car. There are normally two, or even four, separate brakes working in tandem. According to elevator safety norms, these brakes shall be dimensioned to stop and hold standstill an elevator car in case of an operational anomaly. Such an operational anomaly may be an overload situation of an elevator car, undesired movement of an elevator car within a landing or an overspeed situation of an ascending elevator car, for example. Braking force of the electromechanical hoisting machine brakes may be compromised due to various reasons. For example, an error in conducting elevator maintenance, such as a misconduct in brake adjustment process or if foreign matter, such as oil or grease gets into the braking surfaces. Inadequate braking force may also be caused by an error in elevator masses, causing excessive unbalancing torque on the traction sheave of the elevator hoisting machine. Further reasons for the misbehavior may also exist.

Inadequate braking force may lead to undesired movement, i.e. undesired drifting of elevator car despite the hoisting machine brakes are engaged. Such undesired movement may be dangerous for elevator users during normal elevator operation, as well as for maintenance personnel working in elevator shaft outside the normal operation periods.

Consequently, there is a need to introduce complementary safety measures to ensure safe elevator operation. Patent application EP 2848568 A1 discloses a solution for stopping an elevator car using an elevator drive device, after an attempt to apply a hoisting machine brake has been made.

SUMMARY The following presents a simplified summary in order to provide basic understanding of some aspects of various invention embodiments. The summary is not an extensive overview of the invention. It is neither intended to identify key or critical elements of the invention nor to delineate the scope of the invention. The following summary merely presents some concepts of the invention in a simplified form as a prelude to a more detailed description of exemplifying embodiments of the invention.

An object of the invention is to present an elevator safety system, a method, a computer program, and an elevator system for safety operation of an elevator system. The objects of the invention are reached by an elevator safety system, a method, a computer program, and an elevator system as defined by the respective independent claims.

According to a first aspect, an elevator safety system for an elevator system is provided, the elevator system comprising an elevator drive system, the elevator drive system comprising: an elevator hoisting machine comprising an electric motor; an elevator brake composition comprising at least one elevator brake; a brake controller configured to set a control state of the elevator brake composition to one of: a braking state; an open state; a motor drive configured to supply a variable-amplitude, variable-frequency voltage, VVVF, signal to windings of the electric motor of the elevator hoisting machine; a safety function comprising an input for a safety signal, the safety function configured to selectively prevent or enable the supply of the VVVF voltage signal based on a status of the safety signal; the elevator safety system comprising: at least one sensor configured to generate data indicative of an operation of the elevator brake composition; and a safety controller configured to: obtain data indicative of the control state of the elevator brake composition, obtain data from the at least one sensor, and generate the safety signal to enable a supply of the VVVF voltage signal in response to: a detection that the control state of the elevator brake composition corresponds to the braking state, and a detection, based on the data obtained from the at least one sensor, that the operation of the elevator brake composition does not correspond to a braking operation.

For example, the at least one sensor may be configured to generate data indicative of a movement of an elevator as the data indicative of the operation of the elevator brake composition, and the safety controller may be configured to detect that the operation of the elevator brake composition does not correspond to, i.e. deviates from, the braking operation in response to a detection of an unallowable movement of the elevator. The at least one sensor may be configured to generate data indicative of a movement or a position of each armature of the elevator brake composition as the data indicative of the operation of the elevator brake composition, and the safety controller may be configured to detect that the operation of the elevator brake composition does not correspond to the braking operation based on data indicative of the position or the movement of each armature.

The safety controller may also be configured to cause the motor drive to generate a torque for limiting or braking a movement of the elevator car in response to the generation of the safety signal. Moreover, the safety controller may be configured to generate a safe brake control, SBC, signal for engaging the elevator brake composition.

The at least one sensor may be adapted to generate data indicative of the movement of at least one of: an elevator hoisting machine; a diverting pulley of an elevator. Still further, the safety controller may comprise a safety output for the safety signal. The safety output of the safety controller may be communicatively connected to an input of a safety function of the motor drive, the safety output is applicable for preventing or enabling a delivery of one or more control pulses to at least one of: control poles of high-side power switching devices of the motor drive; low-side power switching devices of the motor drive. The power switching devices of the motor drive may be one of: IGBT-transistors, MOSFET transistors, Silicon carbide, SiC, transistors; Gallium Nitride, GaIN, transistors.

In some examples, the safety controller may be integrated into the motor drive.

The safety controller may be configured to detect the unallowable movement by detecting at least one of: the elevator car is moving with doors open at the landing zone; a speed of the elevator car exceeds a predefined limit; a deceleration or an acceleration of elevator deviates from allowable limits; a safety contact is opened in an elevator safety chain during elevator run. Further, the safety controller may be configured to cause safety shutdown of the elevator upon arrival of elevator car to a shaft end terminal.

According to a second aspect, a method for safety operation of an elevator system is provided, the elevator system comprising an elevator drive system comprising: an elevator hoisting machine comprising an electric motor; an elevator brake composition comprising at least one elevator brake; a brake controller configured to set a control state of the elevator brake composition to one of: a braking state; an open state; a motor drive configured to supply a variable-amplitude, variable-frequency voltage, VVVF, signal to windings of the electric motor of the elevator hoisting machine; a safety function comprising an input for a safety signal, the safety function configured to selectively prevent or enable the supply of the VVVF voltage signal based on a status of the safety signal; the method, performed by a safety controller of an elevator safety system, comprises: obtaining data indicative of the control state of the elevator brake composition, obtaining data from the at least one sensor, and generating the safety signal to enable a supply of the VVVF voltage signal in response to: a detection that the control state of the elevator brake composition corresponds to the braking state, and a detection, based on the data obtained from the at least one sensor, that the operation of the elevator brake composition does not correspond to a braking operation.

The method may comprise: generating, by the at least one sensor, data indicative of a movement of an elevator as the data indicative of the operation of the elevator brake composition, and detecting, by the safety controller, that the operation of the elevator brake composition does not correspond to the braking operation in response to a detection of an unallowable movement of the elevator.

Further, the method may comprise: generating, by the at least one sensor, data indicative of a movement or a position of each armature of the at least one elevator brake composition as the data indicative of the operation of the elevator brake composition, and detecting, by the safety controller, that the operation of the elevator brake composition does not correspond to the braking operation based on data indicative of the position or the movement of each armatures.

The motor drive may be caused, by the safety controller, to generate a torque for limiting or braking a movement of the elevator car in response to the generation of the safety signal.

Moreover, a safe brake control, SBC, signal is generated, by the safety controller, for engaging the elevator brake composition.

Data indicative of the movement of at least one of: an elevator hoisting machine; a diverting pulley of an elevator may be generated by the at least one sensor.

Moreover, a safety output of the safety controller may be applied for preventing or enabling a delivery of one or more control pulses to at least one of: control poles of high-side power switching devices of the motor drive; low-side power switching devices of the motor drive.

The unallowable movement may be detected, by the safety controller, by detecting at least one of: the elevator car is moving with doors open at the landing zone; a speed of the elevator car exceeds a predefined limit; a deceleration or an acceleration of elevator deviates from allowable limits; a safety contact is opened in an elevator safety chain during elevator run.

Moreover, a safety shutdown of the elevator may be caused, by the safety controller, upon arrival of elevator car to a shaft end terminal.

According to a third aspect, a computer program is provided, the computer program comprising computer readable program code configured to cause performing of the method according to the second aspect as described above when the computer readable program code is run on one or more computing apparatuses.

According to a fourth aspect, an elevator system is provided, the elevator system comprising: an elevator car, an elevator hoisting machine comprising an electric motor; elevator brake composition comprising at least one elevator brake; a brake controller configured to set a control state of the elevator brake composition to one of: a braking state; an open state; a motor drive configured to supply a variable-amplitude, variable-frequency voltage, VVVF, signal to windings of the electric motor of the elevator hoisting machine; a safety function comprising an input for a safety signal, the safety function configured to selectively prevent or enable the supply of the VVVF voltage signal based on a status of the safety signal; an elevator safety system according to the first aspect as described above.

For example, the motor drive may comprise a relay or a contactor configured for selectively connecting or isolating the motor drive from its primary power supply.

Still further, the elevator brake composition may comprise at least two elevator brakes.

The expression "a number of” refers herein to any positive integer starting from one, e.g. to one, two, or three.

The expression "a plurality of” refers herein to any positive integer starting from two, e.g. to two, three, or four.

Various exemplifying and non-limiting embodiments of the invention both as to constructions and to methods of operation, together with additional objects and advantages thereof, will be best understood from the following description of specific exemplifying and non-limiting embodiments when read in connection with the accompanying drawings.

The verbs “to comprise” and “to include” are used in this document as open limitations that neither exclude nor require the existence of unrecited features. The features recited in dependent claims are mutually freely combinable unless otherwise explicitly stated. Furthermore, it is to be understood that the use of “a” or “an”, i.e. a singular form, throughout this document does not exclude a plurality.

BRIEF DESCRIPTION OF FIGURES

The embodiments of the invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings.

Figure 1 illustrates schematically an elevator system according to an example.

Figure 2 illustrates schematically an elevator safety system according to an example. Figures 3A-3C illustrate schematically implementations according to various examples.

Figure 4 illustrates schematically a method according to an example.

Figure 5 illustrates schematically an apparatus according to an example.

DESCRIPTION OF THE EXEMPLIFYING EMBODIMENTS

The specific examples provided in the description given below should not be construed as limiting the scope and/or the applicability of the appended claims. Lists and groups of examples provided in the description given below are not exhaustive unless otherwise explicitly stated.

Figure 1 illustrates schematically an elevator system 1000 according to an example embodiment. The elevator system 1000 as disclosed in Figure 1 may comprise an elevator car 110 arranged to be moved or movable in an elevator shaft 120 e.g. along guide rails mounted in the elevator shaft. The moving of the elevator car 110 may be implemented by a hoisting rope or belt 130 in connection with a counterweight 140 over a traction sheave 150 or the like. The traction sheave 150 belongs to an elevator drive system 160, and to an elevator hoisting machine 165 therein together with an elevator brake composition 180 comprising one or more elevator brakes among other entities. In Figure 1 the elevator brakes are a type of elevator hoisting machine brakes, but the present invention is applicable also with other types of the elevator brakes, such as with an elevator car brake or a rope brake. As is commonly known, the elevator hoisting machine brakes are configured to engage against an entity in the elevator hoisting machine 165, whereas the elevator car brake is configured to engage against the guide rail and the rope brake is configured to engage against, or grips to, the elevator rope 130. Hence, even though the invention is mainly described with respect to the elevator system 1000 comprising the hoisting machine brakes, it is not limited to only such an elevator brake composition 180. Conceptually it may be considered that the elevator hoisting machine 165 comprises an electric motor 170, the traction sheave 150 and the elevator brake composition 180. The elevator hoisting machine 165 may be gearless or it may be provided with a gear. The electric motor 170 may be controlled with a motor drive 175, such as with a frequency converter, belonging to the elevator drive system 160. The control of the electric motor 170 with the motor drive 175 is performed by supplying a variable-amplitude, a variable frequency voltage (VVVF) generated by the motor drive 175 to windings of the electric motor 170 wherein by variating the amplitude and the frequency of the signal a desired control operation may be achieved. Hence, the elevator hoisting machine 165 is configured to operate the traction sheave 150 for moving the elevator car 110 in a known manner. The traction sheave 140 may be connected, via a mechanical connection 168, directly or indirectly via the gear to a shaft of the motor 170. The traction sheave may also be integrated with the electric motor 170 so that a rotor of the electric motor, such as a rotor of a permanent magnet motor, is formed in the same rotating part with the traction sheave 140. The elevator system 1000 may also comprise a machine room or be machine roomless, such as have the motor 170 in the elevator shaft 120.

The elevator system 1000 may preferably comprise a plurality of landings 10 or landing floors and, for example, landing floor doors and/or openings, between which the elevator car 110 is arranged to be movable during the normal elevator operation, such as to move persons and/or goods between said landings 10.

Moreover, the elevator system 1000, and the elevator hoisting machine 165 of the elevator drive system 160, may comprise an elevator brake composition 180 comprising at least one, such as two to four, or even more, elevator brakes configured to prevent a movement of the elevator car 110 in the elevator shaft 120 when such an operation is desired. The elevator brake of the brake composition 180 being e.g. the type of the hoisting machine brake(s) may be arranged to engage against the traction sheave 150, or against any other rotating part of the elevator hoisting machine 165, such as against a rotating shaft of the electric motor 170 during the breaking. Therefore, the hoisting machine brake 165 has a brake armature, which moves into brake position to reduce the speed of the elevator car or hold elevator car standstill in elevator shaft. When braking is not needed, the brake armature moves into a release position. The elevator brake composition 180 may be controlled with a brake controller 185 configured to operate the elevator brake composition 180. The brake controller 185 may further be in connection and / or integrated with other elements of the elevator 1000, such as an elevator controller 190. The brake controller 185 may comprise a control logic as well as an actuator (not shown) for operating the brake composition 180 or at least be in connection with such an actuator. The brake controller 185 may be configured to set a control state of the elevator brake composition 180 to either a braking state or to an open state, as is described in more detail in the forthcoming description.

The elevator controller 190 may also be in communicative connection with other entities, such as with elevator call-giving devices, with the elevator hoisting machine 165, and the motor drive 175, to cause a generation of applicable control signals within the elevator hoisting machine 165 to cause a movement of the elevator car 110 in the shaft 120. Moreover, the elevator controller 190 may also be communicatively connected to the brake controller 185 for causing braking operation when necessary. The term “braking operation” refers to a situation wherein brakes are in working order such that, when operated, they provide an adequate braking force to stop and hold elevator car standstill, in accordance with available elevator safety norms. Still further, the elevator system 1000 may comprise other controllers as well as other components, such as sensors for obtaining measurement data of various events in the elevator system. The sensors are denoted with a reference 195 in Figure 1. For example, the elevator car 110 may be provided with a number of sensors 195 for providing measurement data indicative of a movement of the elevator car 110. Moreover, the sensors 195 may also be provided in the elevator hoisting machine 165, or the elevator hoisting machine 165 may comprise entities, such as motor encoder, from which it is possible to obtain data indicative of a movement of respective entities which motor encoder may be considered as a sensor 195 as such. Further one or more sensors 195 may be configured to generated data indicative on an operation of the hoisting machine brakes. For example, the sensor(s) 195 may be positioned in the hoisting machine brake so that they may provide data indicative of a position or a movement of a brake armature. In the contexts of other types of the at least one elevator brake, the sensor(s) 195 may be positioned respectively to generate data indicative of the operation of the elevator brake composition 180. Some sensors 195 may be arranged in the elevator shaft 120 and such sensors 195 may e.g. provide data from which a position the elevator car 110 within the elevator shaft may be derivable. Naturally, the elevator system 1000 may comprise further devices and apparatuses than the ones discussed so far and/or illustrated in Figure 1. For example, a sensor 195 may be arranged in a diverting pulley of an elevator car or a diverting pulley of an elevator hoisting machine.

Still further, a safety function 177 is implemented to the elevator drive system 160, and specifically to the motor drive 175, which safety function 177 comprises an input for a safety signal receivable from an elevator safety system. The safety function 177 is configured at least to selectively control, i.e. to prevent or to enable, a supply of the variable-amplitude, the variable frequency voltage (VVVF) signal to windings of the elevator hoisting machine. The decision of the supply of the VVVF voltage signal may be based on a status of the safety signal input to the safety function 177. The safety function 177 may be implemented with a hardware solution or a software solution, or any combination of these. The hardware solution may e.g. be based on a dedicated circuit board, or on a dedicated logic circuit, for example.

Generally speaking, the present invention relates to an elevator safety system 200 configured to monitor an operation of an elevator system 1000 and to generate measures in response to a detection of a maloperation of the elevator system 1000. The operation of the elevator safety system may e.g. be related to a situation that the elevator car 110 remains at the landing zone with the elevator brakes of the elevator brake composition 180 engaged, or travels to a landing, or to any other destination, and is instructed to stop there by controlling the elevator hoisting machine 165, and at some point the elevator brakes of the elevator brake composition 180 are instructed to engage against a counterpart of the elevator, such as the traction sheave 150 or any other rotating entity of the drive system 160 or any other entity corresponding to the type of the elevator brake, and it is assumed that the elevator brakes of the elevator brake composition 180 are capable of holding the elevator car 110 still for the time being. The operation may also be related to a situation wherein the elevator safety system commands an emergency stop of an elevator car 110 upon detecting a dangerous situation, such as an overspeed situation or that a deceleration or an acceleration of the elevator is not within allowable limits, or that a safety contact is opened in an elevator safety chain during elevator run. In the present context, a dangerous situation may occur if the elevator brakes of the brake composition 180 are not operational or are not fully operational. For example, when a brake control signal corresponding to a braking state has been issued, but the actual operation of the elevator brake composition 180 does not correspond to the braking state. This may e.g. lead to an unallowed movement, e.g. elevator car moving with doors open within a landing zone even if brakes activated, or deceleration of elevator car being too low in an emergency stopping situation. Consequently, operation of the elevator brakes may be monitored e.g. by measuring movement of elevator or movement or position of brake armature with respect to the corresponding brake control signal. In view of this, the elevator safety system may be implemented for an elevator system 1000 comprising an elevator drive system 160 having at least an elevator hoisting machine 165 for shifting an elevator car in its travel path and a number of elevator brakes constituting an elevator brake composition 180. As also said, the elevator brake(s) of the elevator brake composition 180 are configured to engage with an entity through which a movement of an elevator may be limited if the elevator brake composition 180 is operating properly e.g. when the elevator car 110 is instructed to be stopped e.g. at the landing 10. Such an entity, or the counterpart, may e.g. be a traction sheave, a shaft of the electric motor 170 or any other applicable entity as described in the foregoing description. An example of the elevator safety system is schematically illustrated in Figure 2 wherein the elevator safety system 200 comprises a safety controller 210 and at least one sensor 195 arranged to measure an operation of the elevator system as is described in the forthcoming description in more detail. The safety controller 210 and the at least one sensor 195 are communicatively connected to each other with a wireless communication technology or via a wired connection, such as over a data bus. Furthermore, the elevator safety system 200 is communicatively connected to the safety function 177 of the elevator drive system through the input of the safety function 177 to selectively control the supply of the VVVF voltage signal based on a status of a safety signal generated by the safety controller 210.

In accordance with an example the at least one sensor 195 may be any device, or a system, which is suitable for providing data indicative of an operation of the elevator brake composition 180. The at least one sensor 195 may be associated to any entity of the elevator system 1000 from which it is possible to obtain data indicative of the operation of the elevator brake composition 180. The data may indicate the operation either directly or indirectly wherein the latter may refer to that the data is processed in a predefined manner. Such an entity may e.g. be the elevator drive system 160 and the components therein, such as the entities in the elevator hoisting machine 165, but also the elevator car 110, the counterweight 140, or even the elevator rope 130. In accordance with an advantageous embodiment the data under monitoring is obtained from a motor encoder that converts an angular position or motion of a shaft or axle to analog or digital output signals obtainable by the safety controller 210. Flence, the motor encoder operates as a sensor 195 for providing data indicative of a movement of the elevator which may be used for evaluating the operation of the elevator brake composition 180. The application of the motor encoder as the sensor 195 has an advantage that an output data obtainable from the motor encoder is reliable indicator of a movement of the elevator, in particular of a movement of a traction sheave 150 of an elevator hoisting machine 165. Alternatively or in addition, the movement of the elevator may be determined by monitoring of a movement of the elevator car 110 or the counterweight 140 or a diverting pulley with an applicable sensor 195. The sensor 195 may be arranged to the elevator car 110 or to the counterweight 140, or even to both. The sensor 195 may provide absolute or incremental position data, data indicative of a speed of the respective entity, or data indicative of an acceleration of the respective entity, for example. For example, the sensor 195 providing the data indicative of the speed of the respective entity may e.g. be a speedometer whereas the sensor 195 providing the data indicative of the acceleration of the respective entity may e.g. be an accelerometer. Still further, the data may be obtained from a sensor 195 mounted in the elevator shaft 120. The elevator shaft 195 may be provided with a plurality of such sensors 195 e.g. mounted at the landings so that a movement of the elevator car 110 may be detected. The detection may e.g. be based on magnetic, optical, or electromagnetic interaction between the sensor and a counterpart mounted e.g. on an outer surface of the elevator car 110 facing the sensor 195 mounted at the landing. Sensor may be a camera arranged to observe movement of elevator, in particular movement of a rotating part of an elevator hoisting machine 165. In some other embodiments, the sensor 195 in the elevator shaft 120 may be a radar-based solution for detecting a movement of the elevator, such as the elevator car 110 or the counterweight 140. Such a radar-based solution may be based e.g. on an acoustic or electromagnetic measurement signal. Still further, a sensor 195 may be mounted on a diverting pulley (not shown in Figure 1) wherein its possible rotation may be monitored and detected with an applicable sensor 195. The rotation of the diverting pulley directly follows any rotation of the traction sheave 150 if no slipping of the elevator rope is experienced. Still further, any data obtainable from an elevator car 110 encoder as the sensor 195 and / or a door zone sensor 195 may be used as data indicative of a movement of the elevator in at least some embodiments of the invention. Also, a barometer may be used for measuring the movement by detection pressure changes due to the movement. The above provided examples are mainly suitable of providing data indicative of the movement of the elevator based on which it is possible to determine aspects on the operation of the elevator brake 180. Such sensors may be e.g. an encoder mounted to elevator car, to a rope pulley or to elevator hoisting machine. Movement may be measured also for example by measuring electromotive force (emf) induced in the windings of the elevator hoisting motor. Having sensors e.g. mounted on the elevator brake composition 180, such as to measure a movement or a position of the armatures of the hoisting machine brake, corresponding data for evaluating the operation of the elevator brake composition 180 may be obtained. Such sensors may be e.g. brake switches or inductive proximity sensors.

The safety controller 210 of the elevator safety system 200 may be a dedicated apparatus configured to serve the elevator safety system 200 only. Alternatively, the operation for the safety controller 210 may be integrated to another entity, such as to another controller, of the elevator system 1000, like as to the elevator controller 190. Its operation may also alternatively be integrated into the motor drive 175 in some implementations. For example, similar safety software may run in the DSP (digital signal processing) unit of the motor drive 175, which DSP processing unit also takes care of control of power switching devices of the motor drive 175. Moreover, the operation of the safety controller 210 may also be shared between a plurality of apparatuses as a distributed computing environment wherein the apparatuses may reside locally at a space the elevator system is operating or remotely or at both locations. Independently of the implementation of the safety controller 210 the safety system 200, and especially the safety controller 210, may comprise a safety output for delivering a safety signal to other entities, such as to the input of the safety function 177.

For sake of completeness it is also worthwhile to mention that by controlling the switching devices with the motor drive 175 it is possible to increase power losses of the electric motor 170 while braking elevator car movement. In more detail, this may be achieved by controlling the switching devices to control the electric 170 motor to operate in a field-weakening mode to increase the power losses. This way regenerative energy caused by braking of elevator car with elevator hoisting motor may be consumed into heat in the windings of the elevator hoisting motor.

Figures 3A, 3B, and 3C illustrate schematically examples of implementing of the present invention. In the non-limiting examples, the braking of the elevator is arranged so that the elevator brake composition 180 may be used for controlling a rotation of the electric motor 170 e.g. by instructing them to engage against a shaft of the electric motor 170, but as already mentioned the entity referred with 170 in Figures 3A-3C may be any other known entity against which the braking operation may be established, such as a traction sheave of a hoisting machine. The brakes of the elevator brake composition 180 may be controlled with a brake controller 185 which may e.g. be a control circuit dedicated to control the operation of the elevator brake composition 180 in accordance with a control from other entities of the elevator system 1000, such as by motor drive 175. The safety system 200 may also control elevator brakes independent of the motor drive control command. The operation of the electric motor 170 may be controlled by the motor drive 175 comprising so- called motor bridge circuit 310 used for modulating the control signal of the electric motor 170 in order to generate a desired VVVF voltage signal in accordance with an input to a safety function 177 of the motor drive 175. Furthermore, the examples according to Figures 3A-3C may comprise one or more sensors 195 belonging to the safety system 200. The sensors 195 may be associated to any of the entities, as described, and the sensor 195 may e.g. be a motor encoder (denoted with a character Έ” in the figures) or reside e.g. in the brake assembly, for example. The data from the motor encoder may be delivered to motor drive 175, and from there e.g. to the safety system 200 as is described in the following.

In the example according to Figure 3A a safety controller 210 is arranged to implement the safety operation for the elevator system 1000. The safety controller 210 may e.g. be implemented with one or more microprocessors, with a logic circuit and / or a relay logic. The safety controller 210 is configured to receive input from a safety chain 320 comprising a number of safety contacts wherein a state of the safety chain 320 may be obtained from a safety relay. As already mentioned the safety system 200, and the safety controller 210, may comprise a safety output 330 to provide control to other entities of the elevator system 1000, such as to a safety function 177 of the motor drive 175 by controlling the operation of the motor bridge 310. At least some aspects of the present invention is now described with respect to the implementation of Figure 3A in a situation that the safety chain 320 indicates a malfunction in some entity of the elevator system 1000 by disconnecting the safety relay therein. This is detected by the safety controller 210 of the safety system 200 and it causes a removal of a voltage from the motor bridge 310 and from the brake controller 185 which, in turn, in a normal situation would result a removal of an energy from the electric motor 170 and an engagement of the elevator brake composition 180. However, in accordance with the present invention the safety controller 210 may be configured to determine an control state of the elevator brake composition 180 e.g. by deriving a state of the brake controller 185 such as by identifying if the brake controller 185 instructs the brakes of the elevator brake composition 180 to be engaged i.e. that the control state of the elevator brake composition 180 corresponds to a braking state. Additionally, the safety controller 210 may obtain data from at least one sensor 195 to detect if the operation of the elevator brake composition 180 does not correspond to, i.e. deviates from, a braking operation. The detection may e.g. be based on that it is detected that the elevator performs an unallowable movement, such as continues moving even if the control state of the elevator brake composition 180 indicates it is engaged. In response to such a detection the safety controller 210 may be configured to activate the safety output 330 by controlling a switch followed by a by-pass switch 340 which, in turn, provides voltage to the safety output so activating the motor bridge 310 of the motor drive 175. As a result, the electric motor 170 may be again controlled, and the motor bridge is instructed to generate such a VVVF voltage signal which causes controlling of a movement of the elevator car 110 with the electric motor 170, which may correspond to limit or brake the movement, and in that manner support the elevator brake composition 180.

Depending on the implementation, the energy provided for modulating the VVVF voltage signal with the motor bridge may be obtained from mains electricity and/or from an energy regenerated by the rotating electric motor 170, or from any other source called as a primary source. The latter is especially advantageous if the provision of the energy from the mains current is prevented by the safety system 200. Generally speaking, the motor drive 175 may e.g. comprise a relay or a contactor configured for selectively connecting or isolating the motor drive 175 from its primary power supply. A technical effect of this feature is when isolated from primary power supply that the electric motor 170 is prevented to generate acceleration torque which might be dangerous for elevator passengers.

In another implementation according to Figure 3B the safety operation according to an embodiment of the invention is implemented by arranging two separately controllable safety outputs to the safety controller 210 which are referred with 330 and 350 in Figure 3B. Now, when the safety chain indicates the malfunction in the elevator system 1000, but safety outputs 330, 350 are disconnected which removes the voltages from the motor bridge 310 and from the brake controller 185 having the same effect as described in the context of the example of Figure 3A. In response to that the safety controller 210 may again start determining if the elevator brake 180 is malfunctioning, e.g. if the movement of the elevator, or elevator car 110, continues even if brakes of the elevator brake composition 180 are instructed to be engaged, i.e. the control state of the elevator brake composition 180 corresponds to the braking state. In response to such a detection the safety controller 210 may control the safety output 330 to connect, i.e. to output a voltage therein by closing the relay contact of the safety output 330, which, in turn, re-activates the motor bridge 310 and the limitation of the movement may be performed by controlling the electric motor 170 through an applicable modulation.

The same sources of energy for modulation may be used as described in the context of the example of Figure 3A.

Figure 3C illustrates a still further example of an implementation of the present invention. There the safety controller 210, or its functionality, is integrated to the motor drive 175 and/or to the brake controller 185. The implementation itself may correspond to the one as illustrated in Figure 3B and the functionalities may be shared between the motor drive 175 and/or to the brake controller 185 in a physical sense. For example, the safety function may be implemented in a software of a DSP processor, which is configured to generate VVVF control pulses for the power switching device of the motor bridge 310.

For sake of clarity, it is worthwhile to mention that the safety output 330 of the safety controller 210 that is communicatively connected to an input of a safety function 177 of the motor drive 175 as shown in the above described examples may be applied for preventing or enabling a delivery of one or more control pulses to at least one of: control poles of high-side power switching devices of the motor drive 175; low-side power switching devices of the motor drive 175. This operation is often referred to as a safety torque off (STO) safety function, in accordance with IEC61508 safety norm. High-side switching devices mean e.g. power transistors connected to positive DC link busbar and low-side switching devices mean transistors connected to negative DC link busbar, respectively, of one phase leg of the motor bridge 310. Flere, the power switching device may correspond to the motor bridge 310 as described in the foregoing description. For example, the power switching devices may be a type of one of the following: IGBT-transistors, MOSFET transistors, Silicon carbide, SiC, transistors; Gallium Nitride, GaIN, transistors.

Next, some aspects of the present invention are described in the following by referring to Figure 4 illustrating schematically a method implemented by an apparatus configured to operate as the safety controller 210 of the elevator safety system 200. As is derivable from the foregoing description the at least one brake of the elevator brake composition 180 is controlled by the brake controller 185 by setting the control state of the elevator brake composition 180 to either a braking state or to an open state and the operation of the elevator is monitored at least with the at least one sensor 195 associated to a predefined entity. Now, in accordance with the method, the safety controller 210 is configured to obtain 410 data indicative of the control state of the elevator brake composition 180. The control state of the elevator brake composition 180 refers to either that each of the at least one elevator brake 180 of the brake composition are instructed to be engaged or that at least one of the at least one elevator brake of the elevator brake composition 180 is instructed to be not engaged (i.e. it is released) which control states are herein referred as the braking state (when engaged) and the open state (when not engaged), respectively. The obtainment of the data 410 performed by the safety controller 210 may comprise a generation of an inquiry to the elevator brake controller 185, or to a plurality of elevator brake controllers 185 if a plurality of elevator brakes of the elevator brake composition 180 are controlled with dedicated brake controllers 185, configured to control the respective brakes and the brake controller 185 may respond to the inquiry by providing an indicator of the current control state of the one or more brakes of the elevator brake composition 180. Alternatively or in addition, the control state of the elevator brake composition 180 may be obtained by providing access to a control signal of the elevator brake composition 180 for the safety controller 210, such as by measuring a brake coil current of each brake of the elevator brake composition 180 e.g. with a current sensor wherein an interruption of the coil current may be interpreted to correspond to an engagement of the respective elevator brakes. Hence, the control signal may e.g. represent a magnetization state of the electromagnets of the elevator brakes in the elevator brake composition 180 either directly or indirectly. Naturally, the brakes of the elevator brake composition 180 may be equipped with applicable brake sensors, such as brake switches, from which a measurement data is obtained by the safety controller 210 either directly or indirectly for determining the control states. For sake of clarity, in case the hoisting machine comprises a plurality of elevator brakes of the elevator brake composition 180 which are individually controlled, the control states of each of the individual elevator brakes are determined in accordance with the present invention. By applying any of the approaches for obtaining 410 the data indicative of the control states of the elevator brakes 180 the safety controller 210 may perform a detection between the braking state and the open state of each brake of the elevator brake composition 180. For example, if the elevator brake composition 180 (meaning all the elevator brakes in the elevator brake composition) is controlled to be on the braking state or not. Alternatively or additionally, the control states of the elevator brake composition 180 may be obtained by reading the control states from the brake control logic.

In addition to the obtainment 410 of data indicative of the control state of the elevator brake composition 180 the safety controller 210 is configured to obtain 420 data from at least one sensor 195. The obtained data from the at least one sensor 195 is such that it is indicative of an operation of the elevator brake 180 either directly or indirectly. The data shall be such that in indicates, or it is derivable from the data, if the elevator brake 180 composition provides a braking operation, i.e. brakes, at a predefined braking force, or not. The predefined braking force may be an elevator dependent and follow specifications set for the elevators.

The obtainment 410 of the data indicative of the control state of the elevator brake composition 180 and the obtainment 420 of the data from the at least one sensor 195 may advantageously be arranged to occur concurrently and/or continuously to enable a reliable detection in step 430 of the method. In the step 430, detections based on the pieces of data may be performed. First, it is detected if the control state of the elevator brake composition 180 corresponds to the braking state. Second, it is detected, based on the data obtained from the at least one sensor 195, if the operation of the elevator brake composition 180 does not correspond to a braking operation, i.e. deviates from the braking operation, with adequate braking force. If these two occur concurrently, or within a predefined time window, it may be decided that the elevator brake composition 180 fails to operate properly, or as expected, and in response to it a safety signal may be generated 440 to enable a supply of the VVVF voltage signal to the electric motor 170, because the state of the elevator may cause risks to users of the elevator system e.g. at landings where passengers may enter and exit the elevator car 110, but for some reason the elevator brake composition 180 does not maintain the elevator stationary. As a result of the generation 440 of the safety signal to enable a supply of the variable- amplitude, variable-frequency voltage, VVVF, signal to windings of the electric motor 170 of the elevator hoisting machine 165 the elevator hoisting machine 165 is caused to generate a torque for supporting the operation, or non operation, of the elevator brake composition 180. This may e.g. allow to limit, or to brake, the movement of the elevator. For sake of completeness, the VVVF voltage signal may be delivered to the motor bridge 310 of the motor drive 175 in the elevator hoisting machine 165 to cause the electric motor 170 to generate the torque to the traction sheave 150, or any other applicable entity, to brake the movement of the elevator. In other words, the safety controller 210 may generate the safety signal to the motor drive 175 e.g. having its own controller for defining and generating a desired control for the electric motor 170. In order to define an optimal control to the electric motor 170 for causing a limitation of the movement of the elevator the motor drive 175 may receive data indicative of a necessary braking torque from the safety controller 210. For example, the data may define one or more parameters relating to the movement of the elevator, i.e. the monitored entity, or the part of the elevator system. The parameter may e.g. represent a speed of the respective entity, or any respective parameter, based on which the controller may define a necessary torque for the motor 170 to brake the movement, and make e.g. the respective entity to stop, or at least to limit the movement within defined tolerances, or limits, e.g. with respect to a speed and / or an acceleration if such approach is selected. Such an allowable speed may be, for example, 0.3 m/s. For understanding of the described aspects in relation to the present invention it may be mentioned a drifting of the elevator car 110 having e.g. heavy load downwards from the landing e.g. during a course of loading the elevator car 110 may be an example of the situation in which the present invention is applied for limiting the movement by generating the braking torque against the gravity with the elevator hoisting machine. Still further, the generation of the torque for limiting the movement of the elevator may also covers a generation of the torques which causes returning of the elevator car 110 at a desired location, such as to the landing 10, which may correspond to a relevelling operation of the elevator car 110.

Moreover, further safety measures may be associated to an application of the present invention. Namely, in accordance with some example embodiments the safety controller 210 of the elevator safety system 200 may be configured to generate an indication to users of the elevator system, such as to the passengers of the elevator car 110, for requesting the users to exit from the elevator car 110 in response to the torque is generated. This may occur with output devices suitable for providing visual or audible, or any other applicable, indications. The generation of the indication may be triggered when the elevator car 110 is detected to reside at a door zone of the landing. In response to that the passengers have exited from the elevator car 110 the elevator system 1000 may be set to service mode and its use is prevented. This may include, but is not limited to, shifting of the empty elevator car to a safety location, which may e.g. correspond to a space above a topmost door zone so that there is no access to the elevator car 110. Moreover, it may also be arranged that the safety controller 210 is configured to cause safety shutdown of the elevator upon arrival of elevator car 110 to a shaft 120 end terminal.

The safety controller 210 may be configured to control SBC (safe brake control) function of the elevator brake composition 180 as well. This means that power supply of brake coils of the elevator brake composition 180 may be allowed or interrupted based on operational state of the elevator safety controller 210. Operation state of the safety controller may be determined based on status of elevator safety chain. Safety chain may be configured such that power supply to brake coils will be interrupted in case an operational anomaly, such as undesired movement of elevator car 110 is detected or opening of a safety contact is detected based on the method in accordance with the present invention. In accordance with the present invention, the safety controller 210 may be configured to, independently of a state of the safety signal, generate the SBC signal for engaging the elevator brake composition 180.

The above discussed safety chain related issues are already also discussed in the context of Figures 3A-3C.

In the description above it is mentioned that the entity arranged to perform the method is a safety controller 210. An example of an apparatus configurable to take a role of the safety controller 210 is schematically illustrated in Figure 5. For sake of clarity, it is worthwhile to mention that the block diagram of Figure 5 depicts some components of an entity that may be employed to implement a functionality of the apparatus. The apparatus comprises a processor 510 and a memory 520. The memory 520 may store data, such pieces of data as described but also computer program code 525 causing the safety operation in the described manner. The apparatus may further comprise a communication interface, such as a wireless communication interface or a communication interface for wired communication, or both. The communication interface may thus comprise one or more modems, antennas, and any other hardware and software for enabling an execution of the communication e.g. under control of the processor 510. Furthermore, I/O (input/output) components may be arranged, together with the processor 510 and a portion of the computer program code 525, to provide a user interface for receiving input from a user, such as from a technician, and/or providing output to the user of the apparatus when necessary. In particular, the user I/O components may include user input means, such as one or more keys or buttons, a keyboard, a touchscreen, or a touchpad, etc. The user I/O components may include output means, such as a loudspeaker, a display, or a touchscreen. The components of the apparatus may be communicatively connected to each other via data bus that enables transfer of data and control information between the components.

The memory 520 and a portion of the computer program code 525 stored therein may further be arranged, with the processor 510, to cause the apparatus to perform at least a portion of a method for managing the maintenance as is described herein. The processor 510 may be configured to read from and write to the memory 520. Although the processor 510 is depicted as a respective single component, it may be implemented as respective one or more separate processing components. Similarly, although the memory 520 is depicted as a respective single component, it may be implemented as respective one or more separate components, some or all of which may be integrated/removable and/or may provide permanent / semi-permanent / dynamic / cached storage.

The computer program code 525 may comprise computer-executable instructions that implement functions that correspond to steps of the method when the computer program code 525 is loaded into the processor 510 of the safety controller 210 and executed therein. As an example, the computer program code 525 may include a computer program consisting of one or more sequences of one or more instructions. The processor 510 is able to load and execute the computer program by reading the one or more sequences of one or more instructions included therein from the memory 520. The one or more sequences of one or more instructions may be configured to, when executed by the processor 510, cause the apparatus to perform a method as explicitly described in the description herein. Hence, the apparatus may comprise at least one processor 510 and at least one memory 520 including the computer program code 525 for one or more programs, the at least one memory 520 and the computer program code 525 configured to, with the at least one processor 510, cause the apparatus to perform the method.

The computer program code 525 may be provided e.g. a computer program product comprising at least one computer-readable non-transitory medium having the computer program code 525 stored thereon, which computer pro gram code 525, when executed by the processor 510 causes the apparatus to perform the method. The computer-readable non-transitory medium may comprise a memory device or a record medium such as a CD-ROM, a DVD, a Blu-ray disc, or another article of manufacture that tangibly embodies the computer program. As another example, the computer program may be provided as a signal configured to reliably transfer the computer program.

Still further, the computer program code 525 may comprise a proprietary ap plication, such as computer program code for causing an execution of the method in the manner as described in the description herein. Any of the programmed functions mentioned may also be performed in firmware or hardware adapted to or programmed to perform the necessary tasks.

The entity performing the method may also be implemented with a plurality of apparatuses, such as the one schematically illustrated in Figure 5, as a distributed computing environment. For example, one of the apparatuses may be communicatively connected with other apparatuses, and e.g. share the data of the method, to cause another apparatus to perform at least one portion of the method. As a result, the method performed in the distributed computing environment generates the safety operation in the elevator system 1000 in the manner as described.

Still further, some aspects of the invention relate to an elevator system 1000 comprising an elevator car 110, a counterweight 140, and an elevator drive system 160. The elevator drive system comprises an elevator hoisting machine 165 and elevator brake composition 180. Still further, the elevator system 1000 may comprise hoisting ropes 130 arranged to run between the elevator car 110 and the counterweight 140 via a traction sheave 150 of the elevator hoisting machine 165 and an elevator safety system 200 as described in the foregoing description. For sake of completeness, it may be mentioned that the elevator hoisting machine 165 may comprise an electric motor 170 being a type of a permanent magnet motor and a motor drive 175 for controlling the electric motor 170. Flence, the elevator system 1000 in accordance with the present invention may correspond to one as schematically illustrated in Figure 1 wherein the elevator safety system 200 is arranged to. The specific examples provided in the description given above should not be construed as limiting the applicability and/or the interpretation of the appended claims. Lists and groups of examples provided in the description given above are not exhaustive unless otherwise explicitly stated.

Claims

WHAT IS CLAIMED IS:

1. An elevator safety system (200) for an elevator system (1000) comprising an elevator drive system (160), the elevator drive system (160) comprising: an elevator hoisting machine (165) comprising an electric motor (170); an elevator brake composition (180) comprising at least one elevator brake; a brake controller (185) configured to set a control state of the elevator brake composition (180) to one of: a braking state; an open state; a motor drive (175) configured to supply a variable-amplitude, variable- frequency voltage, VVVF, signal to windings of the electric motor (170) of the elevator hoisting machine (165); a safety function (177) comprising an input for a safety signal, the safety function (177) configured to selectively prevent or enable the supply of the VVVF voltage signal based on a status of the safety signal; the elevator safety system (200) comprising: at least one sensor (195) configured to generate data indicative of an operation of the elevator brake composition (180); and a safety controller (210) configured to: obtain (410) data indicative of the control state of the elevator brake composition (180), obtain (420) data from the at least one sensor (195), and generate (440) the safety signal to enable a supply of the VVVF voltage signal in response to: a detection (430) that the control state of the elevator brake composition (180) corresponds to the braking state, and a detection (430), based on the data obtained from the at least one sensor (195), that the operation of the elevator brake composition (180) does not correspond to a braking operation.

2. The elevator safety system (200) of claim 1 , wherein: the at least one sensor (195) is configured to generate data indicative of a movement of an elevator as the data indicative of the operation of the elevator brake composition (180), and the safety controller (210) is configured to detect that the operation of the elevator brake composition (180) does not correspond to the braking operation in response to a detection of an unallowable movement of the elevator.

3. The elevator safety system (200) of claim 1 or claim 2, wherein: the at least one sensor (195) is configured to generate data indicative of a movement or a position of each armature of the elevator brake composition (180) as the data indicative of the operation of the elevator brake composition (180), and the safety controller (210) is configured to detect that the operation of the elevator brake composition (180) does not correspond to the braking operation based on data indicative of the position or the movement of each armature.

4. The safety system (200) of any of the preceding claims, wherein the safety controller (210) is configured to cause the motor drive (175) to generate a torque for limiting or braking a movement of the elevator car (110) in response to the generation of the safety signal.

5. The safety system (200) of any of the preceding claims, wherein the safety controller (210) is configured to generate a safe brake control, SBC, signal for engaging the elevator brake composition (180).

6. The safety system (200) of any of the preceding claims, wherein the at least one sensor (195) is adapted to generate data indicative of the movement of at least one of: an elevator hoisting machine (165); a diverting pulley of an elevator.

7. The safety system (200) of any of the preceding claims, wherein the safety controller (210) comprises a safety output (330) for the safety signal.

8. The safety system (200) of claim 7, wherein the safety output (330) of the safety controller (210) is communicatively connected to an input of a safety function (177) of the motor drive (175), the safety output (330) is applicable for preventing or enabling a delivery of one or more control pulses to at least one of: control poles of high-side power switching devices of the motor drive (175); low-side power switching devices of the motor drive (175).

9. The safety system (200) of claim 8, wherein the power switching devices of the motor drive are one of: IGBT-transistors, MOSFET transistors, Silicon carbide, SiC, transistors; Gallium Nitride, GaIN, transistors.

10. The safety system (200) of any of the preceding claims, wherein the safety controller (210) is integrated into the motor drive (175).

11. The safety system (200) of any of the preceding claims 2 - 10, wherein the safety controller (210) is configured to detect the unallowable movement by detecting at least one of: the elevator car (110) is moving with doors open at the landing zone; a speed of the elevator car (110) exceeds a predefined limit; a deceleration or an acceleration of elevator deviates from allowable limits; a safety contact is opened in an elevator safety chain during elevator run.

12. The safety system (200) of any of the preceding claims, wherein the safety controller (210) is configured to cause safety shutdown of the elevator upon arrival of elevator car (110) to a shaft (120) end terminal.

13. A method for safety operation of an elevator system (1000), the elevator system (1000) comprising an elevator drive system (160) comprising: an elevator hoisting machine (165) comprising an electric motor (170); an elevator brake composition (180) comprising at least one elevator brake; a brake controller (185) configured to set a control state of the elevator brake composition (180) to one of: a braking state; an open state; a motor drive (175) configured to supply a variable-amplitude, variable- frequency voltage, VVVF, signal to windings of the electric motor (170) of the elevator hoisting machine (165); a safety function (177) comprising an input for a safety signal, the safety function (177) configured to selectively prevent or enable the supply of the VVVF voltage signal based on a status of the safety signal; the method, performed by a safety controller (210) of an elevator safety system (200), comprises: obtaining (410) data indicative of the control state of the elevator brake composition (180), obtaining (420) data from the at least one sensor (195), and generating (440) the safety signal to enable a supply of the VVVF voltage signal in response to: a detection (430) that the control state of the elevator brake composition (180) corresponds to the braking state, and a detection (430), based on the data obtained from the at least one sensor (195), that the operation of the elevator brake composition (180) does not correspond to a braking operation.

14. The method of claim 13, wherein: generating, by the at least one sensor (195), data indicative of a movement of an elevator as the data indicative of the operation of the elevator brake composition (180), and detecting, by the safety controller (210), that the operation of the elevator brake composition (180) does not correspond to the braking operation in response to a detection of an unallowable movement of the elevator.

15. The method of claim 13 or claim 14, wherein: generating, by the at least one sensor (195), data indicative of a movement or a position of each armature of the at least one elevator brake composition (180) as the data indicative of the operation of the elevator brake composition (180), and detecting, by the safety controller (210), that the operation of the elevator brake composition (180) does not correspond to the braking operation based on data indicative of the position or the movement of each armatures.

16. The method of any of the preceding claims 13 - 15, wherein the motor drive (175) is caused, by the safety controller (210), to generate a torque for limiting or braking a movement of the elevator car (110) in response to the generation of the safety signal.

17. The method of any of the preceding claims 13 - 16, wherein a safe brake control, SBC, signal is generated, by the safety controller (210), for engaging the elevator brake composition (180).

18. The method of any of the preceding claims 13 - 17, wherein data indicative of the movement of at least one of: an elevator hoisting machine (165); a diverting pulley of an elevator is generated by the at least one sensor (195).

19. The method of any of the preceding claims 13 - 18, wherein a safety output (330) of the safety controller (210) is applied for preventing or enabling a delivery of one or more control pulses to at least one of: control poles of high- side power switching devices of the motor drive (175); low-side power switching devices of the motor drive (175).

20. The method of any of the preceding claims 14 - 19, the unallowable movement is detected, by the safety controller (210), by detecting at least one of: the elevator car (110) is moving with doors open at the landing zone; a speed of the elevator car (110) exceeds a predefined limit; a deceleration or an acceleration of elevator deviates from allowable limits; a safety contact is opened in an elevator safety chain during elevator run.

21. The method of any of the preceding claims 13 - 20, wherein safety shutdown of the elevator is caused, by the safety controller (210), upon arrival of elevator car (110) to a shaft (120) end terminal.

22. A computer program comprising computer readable program code configured to cause performing of the method according to any of claims 13 to 21 when the computer readable program code is run on one or more computing apparatuses.

23. An elevator system (1000) comprising: an elevator car (110), an elevator hoisting machine (165) comprising an electric motor (170); elevator brake composition (180) comprising at least one elevator brake; a brake controller (185) configured to set a control state of the elevator brake composition (180) to one of: a braking state; an open state; a motor drive (175) configured to supply a variable-amplitude, variable- frequency voltage, VVVF, signal to windings of the electric motor (170) of the elevator hoisting machine (165); a safety function (177) comprising an input for a safety signal, the safety function (177) configured to selectively prevent or enable the supply of the VVVF voltage signal based on a status of the safety signal; an elevator safety system (200) according to any of the claims 1 to 12.

24. The elevator system (1000) of claim 23, wherein the motor drive (175) comprises a relay or a contactor configured for selectively connecting or isolating the motor drive from its primary power supply.

25. The elevator system (1000) of any of the claims 23 or 24, wherein elevator brake composition (180) comprises at least two elevator brakes.