Wireless safety chain for elevator system

This invention relates generally to the field of safety equipment used in elevator systems, and more particularly to a safety chain which is implemented using wireless communication.

The elevator controller, located in the machine room, interfaces to a number of devices in the hoistway and the hall. These devices are characterized into three functional area: user input devices (such as fixtures), diagnostic devices (non safety critical sensors) and safety chain devices (safety critical sensors). The current wired architecture includes a main trough that runs the length of the hoistway. From the main trough, smaller local conduit runs to each device in the hall fixture and safety chain systems. The hoistway devices are connected to the machine room via wires. These wires are usually enclosed in a rigid and non-rigid conduit. Local building codes regulate the size and material of the main trough and local conduit (metallic, plastic, flex or rigid). In addition, in some regions the local conduit is not required if appropriately insulated wire is used.

The system configuration depends on customer needs. Some elevators have a lantern on every floor, others have one only at the lobby. In a bank of elevators (multiple elevators side by side) there may be any number of buttons (not to exceed the number of elevators) depending on the customer requirement.

The safety circuit is a separate circuit with a discrete number of switches designed to indicate the status of the doors and the position of the elevator at the extremes of the hoistway (terminal switches). In addition there are a number of other switches designed to monitor the safety status of other elevator components. Some of these safety switches are controlled by the car such as the overspeed governor and the limit switch. Others are controlled by the doors, such as the switches and the locks of the landing doors. These switches are wired together in a serial circuit known as the “safety chain.” If this circuit is “open”, i.e. one of the physical switches is not closed, the elevator is deemed “unsafe” and is shutdown by the controller.

Because of the critical nature of the safety chain, the latency, i.e., the amount of time it takes to query the status of the system, must be very small, approximately 100 ms. In addition, the system must fail in a safe manner, i.e., the malfunction of any of the components in the safety chain must not cause the elevator to operate in an unsafe manner.

U.S. Pat. No. 6,173,814 (Herkel et al.) discloses an electronic safety system having a dual redundant safety bus, incorporated herein by reference. The electronic safety system still requires a lot of wiring in the hoistway to handle the safety system communications.

Briefly stated, a wireless safety chain for an elevator system includes a base transceiver connected to a system controller. A plurality of safety chain components each includes a physical sensor such as a switch, and a wireless transceiver. The physical sensor monitors the component status. The wireless transceiver communicates among the other safety chain components and the system controller. The wireless safety chain preferably employs a token scheme, where a token is sent from the base transceiver to one component, which in turn sends the token to another component, and so on, until the token returns to the base transceiver. Failure of the token to return to the base transceiver in a predetermined amount of time signals that the elevator system is unsafe.

According to an embodiment of the invention, a safety chain for an elevator system includes a controller in wireless communication with a plurality of component nodes; each component node including at least one sensor and communication means for communicating with the controller; each sensor monitoring an operating condition of the elevator system, such that when the operating condition fails, the means for communicating with the controller is switched off; and means for sending at least one token from the controller to each component node and back to the controller, wherein failure of the token to return to the controller within a predetermined amount of time signals that the elevator system is unsafe.

FIG. 1 shows a wireless safety chain architecture according to an embodiment of the invention.

FIG. 2 shows a wireless safety chain architecture according to an embodiment of the invention.

FIG. 3 shows a token ring scheme used in the present invention.

Referring to FIG. 1, a safety chain architecture 10 includes a base transceiver 12 connected to a controller 14 . Controller 14 is typically inside a machine room 16 . Base transceiver 12 and controller 14 are connected via wireless transceivers to a number of safety chain components. Each component includes a physical sensor, usually a switch, and a wireless transceiver. Power for the transceiver is preferably supplied by battery, hardwire, or a combination of the two, or possibly an inductively coupled system with a recharging circuit riding on the car.

Components include such switches as an overspeed switch 20 in machine room 16 , an inspection switch 22 , an emergency stop switch 24 , and a door switch 26 in an elevator cab 28 , and a top limit switch 30 , a bottom limit switch 32 , and door interlock switches 34 , 36 , 38 on each floor of a hoistway 40 . Other examples of safety chain switches (not shown) are pit emergency switches, governor switch, broken rope switch, etc. The physical sensor or switch monitors the status of the component. For example, door interlock switch 34 monitors whether a landing door 42 is open or closed.

Referring to FIG. 2, an alternate embodiment is shown in which components grouped in the same area, such as one floor, or within the elevator cab, share the same transceiver. In cab 28 , for example, switches 22 ′, 24 ′, and 26 ′ are connected to a transceiver 50 . On the first floor of hoistway 40 , door switch 38 ′ and bottom limit switch 32 ′ are connected to a transceiver 56 . On the second floor, door switch 36 ′ is connected to a transceiver 54 , while on the third floor, top limit switch 30 ′ and door switch 34 ′ are connected to a transceiver 52 . Base transceiver 12 and transceivers 50 , 52 , 54 , and 56 can be low power, high power, spread spectrum, analog, digital, or any other known wireless communication type.

Referring to FIG. 3, the wireless transceiver portion of each component communicates between other safety chain components. In normal operation, the wireless safety chain circuit preferably employs a token scheme, where a token is sent from the base transceiver to a first component, Component 1 . This token is then passed from Component 1 to the second component, Component 2 , and so on until the token reaches the last component, Component n. At this point the token is sent back to the base transceiver.

The protocol in the system is preferably designed such that in normal operation a given component only receives valid tokens from the previous component in the chain. This can be accomplished using the component addresses so that in normal operation a given component can only receive tokens from a component with a given address and ignore tokens coming from other components.

If the base transceiver receives the token back from the last component within a predetermined amount of time from sending it out, then the elevator is deemed “safe” and allowed to run. If the token is not received in the predetermined amount of time, then the elevator is deemed “unsafe” and is stopped by the controller.

If the elevator is deemed “unsafe”, the controller preferably queries each individual component to determine which one has failed, thus providing detailed diagnostics information to a troubleshooting mechanic. This is currently not possible with series wired safety chains, as most of them are, because the components are wired in series and the controller can only detect whether all of the “switches” are closed or open, and not which one is closed.

For added safety, the token sent between components is optionally encoded with any one of a number of standard encryption schemes.

While the present invention has been described with reference to a particular preferred embodiment and the accompanying drawings, it will be understood by those skilled in the art that the invention is not limited to the preferred embodiment and that various modifications and the like could be made thereto without departing from the scope of the invention as defined in the following claims.