Remote monitoring system state machine

Description

Technical Field

[0001] This invention relates to monitoring selected parameters of a plurality of operating systems at a plurality of remotes sites, to determining the presence of an alarm condition according to a state machine model, to transmitting alarm condition signals to a local office for initiating service actions, and to retransmitting alarm conditions signals to a central office for evaluation.

Brackground Art

[0002] Any number of systems operating at a plurality of remote sites may be monitored using sensors at the remote sites and transmitting information on the present status of the sensed parameters during the system's operation at the sites, such as elevator systems in a plurality of remote buildings. The parameters selected for monitoring are chosen according to their importance in evaluating the operational condition of a system. In the case of an elevator system, typical sensors would include, among others, an alarm button sensor, a door fully opened sensor, a leveling sensor, a demand sensor, and a brake fully engaged sensor. These sensors produce signals which may be multiplex into a transmitter for transmittal to a local office which monitors the status of the plurality of elevator systems. Upon receiving a signal indicating an abnormal condition, the local office personnel may logically infer the operational condition of the system by noting the presence or absence of other abnormal condition signals or other associated sensor parameters. For example, if an alarm button pressed and a door closed signal are both received, a condition in which a person is possibly trapped within an inoperative elevator car may be inferred. Additional pieces of information can be transmitted to make the evaluation task easier. Generally, the more information received, the more accurate the conclusions that may be drawn concerning the nature of conditions. For example, if in the above example, additional pieces of information are provided indicating that the car is within a door zone, that it has leveled properly with respect to a hall landing, and that the car brake is fully engaged, the type of inoperative condition that has occurred can be considerably narrowed. A service man is then dispatched to the remote location having at least some foreknowledge of the nature of the inoperative condition which permits him to make adequate preparations for quickly correcting the condition (see e.g. FR-A-2286096 and US-A-4418795).

[0003] As the number of monitored parameters increases, the task of evaluating whether and what kind of an alarm condition exists, if any, becomes more difficult. If a local office is monitoring a large number of systems, the amount of performance information received can be very high making the interpretative task even more difficult.

[0004] An additional difficulty in using large numbers of monitored parameters is that the interpretative task itself can become extremely complex, making it likely that the interpretative errors or oversights may occur. If such an error or oversight occurs, the owner of the building in which the inoperative elevator car is located will eventually telephone requesting a serviceman and providing whatever knowledge he may have concerning the nature of the inoperative condition. However, this is a highly undesirable form of receiving the information needed to efficiently deploy a service organization. This is especially true when a monitoring system has been installed in a building for the purpose of immediately detecting such inoperative conditions at a local service office.

[0005] Inventor Charles Whynacht invented a REMOTE ELEVATOR MONITORING SYSTEM, described in our European Patent Application No. 84308905.3, which monitors a large number of remote sites at local offices and a central office and which solves the above described problem for some systems including elevator systems. One of the objects of the Whynacht invention was to provide an operating system monitor capable of monitoring parameters and evaluating their states in order to form conclusions concerning the system's performance and to determine whether any predefined alarm conditions were present. According to the Whynacht invention the sensed parameters were stored by a signal processor and compared to previously received values in order to determine if any parameters had changed state. If so, the present value of the changed parameter(s) was plugged into a Boolean expression defining an alarm condition in order to determine if the Boolean expression was satisfied and hence the alarm condition was present. If so, an alarm condition signal was transmitted and displayed as an alarm message.

[0006] in addition, the Whynacht invention embraced a group of monitored systems in, for example, a particular geographical area and monitored the various individual systems at a central location in the local geographical area so that appropriate area service actions could be effectively managed. In addition, the Whynacht invention disclosed that many local offices may be grouped together into an overall group which all transmit their data to a headquarters office which monitors many local offices in different geographical areas.

[0007] During the development of the Whynacht invention, it became apparent that the approach of a timed scanned "snapshot" of elevator conditions did not in some circumstances offer a sufficient degree of confidence in the accurate detection of alarm conditions. In addition, the variability of elevator wiring encountered in the field often made the large number of functional input points from the elevator functionally inconsistent. This combination of circumstances resulted in an unacceptable correlation factor of alarm detection and installation complexity therein.

Disclosure of Invention

[0008] The object of the present invention is to provide improved apparatus for monitoring an operating system by monitoring selected parameters indicative of the present operating condition of the system and evaluating the parameter states in order to form accurate conclusions concerning the system's performance to a high degree of certainty and concerning whether any predefined alarm conditions are present.

[0009] According to the present invention, the sensed parameters to be evaluated are received and stored by a signal processor which compares the present received values of parameters selected according to the present operating condition of the system with values indicative of specific system conditions to determine if any parameter has entered a state indicative of a transition from the present operating condition to another operating condition or to an inoperative condition. The signal processor or an external counter can be employed to keep track of the number of occurrences of such transitions and to provide performance signals indicative of the total count of transitions from particular states to other states thus providing performance signals indicative of system performance. Transitions from inoperative conditions to alarm conditions are also monitored and alarm signals are generated for each such transition. Thus, a "state machine" is created which may take the form of a closed loop of normal operating states, each state of which be exited to an inoperative condition. Each inoperative condition may also serve as a transition point either to an alarm condition state or back to one of the operating states in the closed loop. Each alarm condition state may also serve as a transition point to another alarm state or back to an inoperative state or an operating state in the closed loop.

[0010] In further accord with the present invention, a plurality of such monitored systems may be grouped such that their individual performance and alarm condition signals are transmitted to a local office where they are evaluated by local service personnel so that appropriate service actions may be taken on a timely basis.

[0011] In still further accord with the present invention, a plurality of such local offices may retransmit performance data and alarm messages from their associated operating systems to a central office which monitors the local offices.

[0012] The remote system monitor of the present invention provides an intelligent means of automatically evaluating the operational status of an operating system. It also may be used for automatically evaluating the status of a plurality of systems organized in local geographical areas each reporting to an associated local office. The demanding task of evaluating many hundreds, thousands, or hundreds of thousands of performance data is greatly reduced by providing a "state machine" defining proper performance and alarm conditions. The automatic provision of alarm messages to the local office ensures that proper evaluation of the performance data leads to efficient deployment of the local office service force. When retransmitted to a central office essential information necessary for long term performance projections and for the evaluation of the effectiveness of local service offices is provided for use by central office personnel.

[0013] An embodiment of the invention will now be described by way of example and with reference to the drawings.

[0014] Brief Description of Drawing(s)

Fig. 1 is a system block diagram of a remote elevator monitoring system according to the present invention;

Fig. 2 is a simplified schematic block diagram of a slave unit used in the system of Fig. 1 ;

Fig. 3 is an illustration of signal waveforms used in the description of the embodiment of Fig. 1;

Fig. 4 is a simplified schematic block diagram of a master unit used in the embodiment of Fig. 1;

Fig. 5 is a simplified schematic diagram of the slave unit shown in Fig. 2;

Fig. 6 is a simplified schematic diagram of part of the master block diagram of Fig. 4;

Fig. 7 is a simplified schematic diagram of part of the master block diagram of Fig. 4; and

Fig. 8 is a simplified flowchart diagram of a state machine model of an elevator system in which transitions from state-to-state following a typical sequence of elevator operations is shown.

[0015] Fig. 1 illustrates a remote elevator monitoring system (REMS) for monitoring individual elevators in remotely located buildings 12, for transmitting alarm and performance information to associated local monitoring centers 14 and for retransmitting the alarm and performance information from the local centers to a central monitoring center 16. The method of communication between the remote buildings and the various local offices and the centralized office is an unidirectional communication system whereby inoperative elevators are identified and individual elevator performance information is transferred to a local monitoring center through the use of local telephone lines which may include microwave transmission paths. The local then forwards these messages to the central monitoring center also using telephone lines, but in this case, long distance area wide service is almost always used. It should be understood that although the remote elevator monitoring system (REMS) disclosed herein utilizes the public switch phone network available within the local community in which a particular local monitoring center and its associated remote buildings are located, other equivalent forms of communication may be utilized. Each remote building of the REMS system includes a master 18 and one or more slaves 20. The individual slaves are attached to sensors associated with an associated elevator and elevator shaft. The slaves transmit signals indicative of the status of selected parameters via a communications line 22 which consists of an unshielded pair of wires. The use of a two wire communications line between the master 18 and its associated slaves 20 provides both an inexpensive means of data transmission and the ability to inexpensively locate the master at a location remote from the slaves. For instance, if all of the slaves are located in an elevator machinery room having a hostile environment on top of the elevator shafts, the master may inexpensively be located in a more benign environment somewhere else in the building. Each master includes a microprocessor which evaluates the performance data and determines whether an alarm condition exists according to a state machine model which is coded within the software of the microprocessor. Each master communicates with a modem 24 which transmits alarm and performance data to a modem 26 in the associated local monitoring center 14. Although the architecture of the REMS within a remote building has been described as having a master communicating with one or more slaves using an efficient two wire communications line, it should be understood by those skilled in the art that other means of data collection and transmission including less efficient means may also be used. It should also be understood that because the number of slaves capable of being attached to a given communications line is finite, it may be necessary within a given remote building to utilize more than one master-slave group.

[0016] Each of the remote buildings 12 communicates with its associated local monitoring center 14 to provide alarm and performance data. The local processor 28 stores the received data internally and alerts local personnel as to the existence of an alarm condition and performance data useful for determining the cause of the alarm. The local processor 28 alerts local personnel of these conditions via a printer 30. It should be understood that other means of communicating with local personnel, such as a CRT may as easily be used. The local processor 28 also causes alarm and performance data from the local's remote buildings to be transmitted to a modem 32 within the central monitoring center 16. A central computer 34 receives data from the modem 32 and provides alarm and performance data to central personnel via a printer 36 and a CRT 38. It should be understood that although both a printer and a CRT are shown for use with the invention, the use of only one of them would be sufficient to fully communicate with the central personnel. A bulk data storage unit 40 is used to store alarm and performance data for a long term evaluation by central personnel. Although bulk data storage is a desirable feature of the present invention, it should be understood that bulk data storage for the purpose of long term performance evaluation is not absolutely essential for the practice of the present invention. The REMS described above in connection with the illustration of Fig. 1 is designed to permit a local office to monitor elevators located within its geographical area so that upon the detection of an abnormal condition a serviceman may be immediately dispatched for quick resolution of the problem. In this way, the quality of services performed for the elevator customer is greatly improved. In many cases, a deteriorating condition may be detected before it causes an elevator disablement. In cases where a disablement has occurred, the nature of the problem can often be identified before dispatching the serviceman so that the nature of the corrective action required may be determined in advance. Central office personnel are also kept informed as to performance, operating problems, and disablements in all elevators in the field. This provides an extremely valuable management tool the headquarters operation. Personnel at the central monitoring center 16 are enabled to closely monitor the performance of essentially all of the elevators in the field. Performance trends can thereby be detected and accurate forecast devised for use in business planning. The instantaneous nature of the knowledge provided as to the effectiveness of the service force in remedying field problems is also an invaluable aid to management in identifying and correcting local service offices having unsatisfactory service records.

[0017] Of course, it should be understood thatwhilethe illustration of Fig. 1 illustrates an embodiment of the invention as applied to a remote elevator monitoring system, the invention is not restricted only to applications in the elevator monitoring art. The invention is equally applicable to other system monitoring functions in which intelligent evaluation of system performance data is required. It is also equally applicable for applications in which only local monitoring of distributed systems is required. Of course, central monitoring of distributed local monitoring centers for any type of operating system is also embraced by the invention.

[0018] In Fig. 2, a block diagram of a slave unit 20 is shown. Elevator sensors (not shown) provide inputs on lines 100 to an opto-isolation, signal conditioning, and multiplexing unit 102 which isola- testhe input signals from the electronics contained within an industrial control unit 104, scales the input voltages, permits the setting of the relation between voltage presence or absence and the true or false condition, and multiplexes the multiple input lines 100 down to a smaller number of lines 106. The slave unit disclosed herein is capable of accepting 4, 8, or 12 elevator sensor inputs based on the structure of the communications protocol to be described in detail hereinafter. It should be understood, however, that the number of elevator inputs is not necessarily restricted to 4, 8 or 12. A different communications protocol could be used which might allow only a lesser number of inputs or which might permit a larger number, or which might utilize an intermediate number of inputs. The industrial control unit 104 scans the inputs on the lines 106 and sends the scanned information down a communications line 22a at the proper time. A unique address for a particular industrial control unit associated with a particular slave unit is configured by means of control jumpers, symbolized by an address configure and control block 108. The industrial control unit provides data on the line 22a when its unique address is identified in a timed sequence of addresses, each address corresponding to a unique slave. The industrial control unit (ICU) utilizes a crystal 110 for generating a 3.58 megahertz signal which is used internally by the ICU as a system clock. An externally generated communication clock signal is provided on a line 22b. A line termination network 112 is connected to the communication lines 22a, 22b close to the ICU in order to provide filtering for error free communications in a high noise environment. A power supply 114 receives unregulated 24 volts DC and provides a regulated output on a line 116 for the slave unit. The above description of the block diagram of a slave unit 20 illustrated in Fig. 2 will be described in more detail hereinafter.

[0019] The communication system protocol is synchronous, half duplex, serial line format by which the master of a local monitoring center can communicate bidirectionally with as many as 60 slave units. The serial line protocol is illustrated in Fig. 3, illustrations (a)-(c). The master is capable of transmitting data to and receiving data from each of the remote slaves in successive transceive cycles 200 (illustration (a)). Each cycle includes a sync frame 202 followed by 128 information frames divided equally between a transmit interval 204 (master transmits to slaves) and a receive interval 206 (master receives from slaves). Each information frame is marked by a line clock pulse transmitted by the master at the communication clock frequency. The sync frame 202 provides master-to-slave synchronization once per cycle. It includes two missing line clock intervals which, when added to the 128 information frame clock pulses, requires 130 equally spaced line clock intervals for each transceive cycle.

[0020] To provide the highest noise rejection the system frequency and baud rate is selected at the lowest frequency required to satisfy the particular control application, the band width being limited to compensate for the unshielded transmission line. The selected transceive cycle time is 104 milliseconds (ms) in the best mode embodiment to provide an approximate 9.6 hertz transceive frequency (i.e., sample time frequency). For the total 130 clock pulses and a selected 104 ms cycle time the line clock frequency is 1,250 hertz (i.e., the clock period is 800 microseconds). Illustration (b) shows the 130 clock pulses as including two sync frame clock pulses (S,, S_z) and 128 information frame clocks divided equally between the transmit frame 204 (clock pulses 1 -64) and receive frame 206 (clock pulses 65-128). The sync frame clock pulses are actually missing. The sync frame itself is defined as the "dead time" interval (which includes the missing clock pulses 5₁, S_z) between the 128th clock pulse of a preceding cycle and the first pulse of a present cycle. For the 104 ms cycle time the dead time is 2300 microseconds.

[0021] The 64 information frames in the transmit and receive intervals service up to a maximum of 60 slaves. The first group of four information frames in each interval 208, 210 (clock pulses 1 -4 and 65-68) are reserved for special command information to all masters and slaves, such as diag- nostic/maintenance testing, or control of any optional features which may be incorporated in any associated remote control devices (not used in the REMS); the remaining 60 information frames are data frames. The master is typical of transmitting information to each slave in a related transmit interval data frame and is capable of receiving data from each slave in a corresponding receive interval data frame. However, the REMS does not utilize the full capabilities of the communications system protocol in that no data is transmitted from the masters to their associated slaves in the first half of each transceive, i.e., the transmit interval 204 is not utilized in REMS. However, all slaves receive and store the commands of frames 1 -4 and 65-68 as internal commands related to their operation. These commands may include turn on and turn off of the slaves (all or a selected number), or may command the slaves to send specific data patterns in a diagnostic mode to allow integrity check by the central control.

[0022] Each slave has an assigned clock address. The line clock pulses are counted and decoded by the slaves following each sync frame to determine the presence of an assigned count address at which time the slave writes a data frame from or to the communication line 22a. The format for the information frames, both special command frames 208, 210 and data frames, are identical, as shown by information frame 212 in illustration (c). The frame time interval is divided into eight 100 microseconds states. The first state (0-100 microseconds) corresponds to the clock pulse interval 214 and must be a minimum of 50 microseconds wide to be valid. The second state 216 (100-200 microseconds) is a "dead time" interval which allows for response time tolerances and sample time delays between the frame clock pulse and the data bits. The next five states 218, 220, 222, 224, 226 (200-700 microseconds) are five signal bit time intervals, the first four of which (218, 220, 222, 224 correspond to the four data bits D1-D4). The bit time is equal to the state time, or 100 microseconds for the selected 104 ms transceive cycle time. The fifth bit is a special feature bit which may be received and transmitted by each of the slaves. This fifth bit is used for special feature information which may include test routines i.e., parity tests. In the best mode embodiment the fifth bit is used to convey the special information in 36 of the available 64 information. frames in each transmit and receive interval; specifically in information frames 5-40. The last state 228 is also a dead time interval prior to the beginning of the succeeding data frame.

[0023] As shown in Fig. 3 the signal data format is tristate, i.e., bipolar. The transmission line provides a differential, three state signal transmission in which the signal, as measured between the transmission line wires 22a, 22b, is in one of three states. The line 22b is the clock line input to the master and slaves; the line 22a is the data line input. The three differential states are measured with respect to the difference potential between line 22a and 22b. When the signal magnitude on the line 22b is greater than the sum of the signal magnitude on the line 22a plus a threshold voltage (V_th) 230 then the differential state is equal to a line clock pulse (214, illustration (c)). When the signal magnitude on the line 22a is greater than the sum of the line 22b magnitude plus the selected threshold voltage the differential state input is recognized as a logic one in signal bit times 218, 220, 222, 224, 226. If the line 22a-22b differential magnitude is less than the threshold value the differential state is recognized as a signal bit logic zero 232.

[0024] The approximate data rate for the selected 104 ms cycle time is 10 KBAUD for the first four data bits (D, -D4-) and special fifth (test) bit of each information frame. It should be understood, however, that the present system is not limited to either the illustrated baud rate or bit number. In the present REMS higher data rates and/or more information bits may be traded off against maximum line length and noise immunity requirements. It should also be understood that the communications system protocol utilized is notthe only protocol that could have been used to format the data. For example, alternate protocol and voltage levels of RS-232C, RS-423, or RS-422 could be used. In addition, information could be coded by pulse with modulation techniques as opposed to the tristate voltage levels described hereinbefore.

[0025] Fig. 4 is a master block diagram having a master/ slave communication interface 300 for receiving input information on the status of the elevators from each slave at a regular interval of 104 milliseconds. The information is transmitted on a communication line 22a which is part of the communication lines 22a, 22b continued from Fig. 2. The lines 22a, 22b are terminated with a line termination network 301 having a purpose similar to the network 112 of Fig. 2. The information is processed by a signal processor 302 to determine if an alarm condition is present and to record and maintain additional performance data collected daily on the elevators being monitored. Alarm condition criteria and acceptable limits for the daily performance data are defined according to Boolean logic equations coded within the software of the signal processor. Associated with the signal processor 302 is a random access memory (RAM) 304, a read only memory (ROM) 306, and a universal asynchronous receiver transmitter (UART) 308 which is used to communicate with and control the modem 24 of Fig. 1. In addition, circuitry is contained within the master to provide the necessary real time clock interrupts associated with counting and measuring of unit intervals of time for the purpose of determining alarm conditions and maintaining the correct time of day. The power supply 310 to the master can be 11 OV or 220V, 50 or 60 hertz. The outputs of the power supply are a regulated five volt supply and a plus or minus 12 volt supply to provide all of the power for the logic which is contained within the master and also an unregulated 24 volt supply which is sent to all of the slaves associated with the particular master. From the power supply an analog circuit derives 50 or 60 hertz interrupts. This circuitry takes a full wave AC sine wave from the power line and detects the zero voltage crossover of the wave to generate a periodic interrupt which is set at the same frequency as the line. This interrupt will occur every 16.6 milliseconds for a 60 cycle line and every 20 milliseconds for a 50 cycle line and is fed directly into the processor to automatically increment timers contained within the processor which denote the passage of time to the system. A clock generator 314 consists of a crystal control oscillator which provides all the synchronous clocking information for the master system circuitry. Interfaced to the processor on data line 316, address line 318, and control line 320, is 8K_x8 of ROM 306, which may also be erasable, programmable read only memory (EPROM). Contained within this memory are all of the logic functions associated with the performance of the master. In addition, 2Kx8 of random access memory (RAM) 304 is provided for local data retention. This memory can be written and read from the processor 302 and the master/slave communication interface 300. Contained within the RAM memory is a common storage area which is used to pass information between the master/slave communication interface 300 and the signal processor 302. This common memory area is accessed by the processor under software control to obtain the latest input data from each elevator. This input data is rewritten in registers of memory in the processor to become what is known as the "bit map" of the input data. Detection of a change in state of one of the bits in the bit map is used in the logical flow of predetermined algorithms to determine the presence of an alarm condition and/or significant performance data associated with the bit change. Upon detection of an alarm condition, the processor will forward a specific alarm message to its associated local monitoring center. The message is sent from the processor to the modem 24 (Fig. 1) via an universal asynchronous receiver transmitter (UART) chip 308 which provides the necessary formatting and control signals for operation of the modem. Data is transmitted from the UART to a driver circuit 322 on lines 324. A transmit data (Txd) line 326, a data terminal ready (DTR) line 328, and a request to send (RTS) line 330 operatively connect the driver circuitry 322 to the modem 24 (Fig. 1). Received back from the modem are received data (Rcd) on a line 332, a clear to send (CTS) signal on a line 334, a data carrier detect (DCD) signal on a line 336, and a ring indicator (RI) signal on a line 338 at a receiver circuit 340. The receiver circuit transmits signals to the UART via lines 342. In addition, a ground reference signal (not shown) is provided to the modem. The line 326 functions as the data line through which messages are transmitted to the modem. The data terminal ready (DTR) line 328 is required to provide a signal to the modem that indicates the master is ready for communication. When the master is ready to transmit a message through the modem the DTR is setto a logic one level which is then followed by an initialization sequence which is sent via the transmit data line 326 to the modem. Subsequent to transmission of the initialization sequence, a response is received on the received data (Rcd) line 332 from the modem indicating to the processor that the modem has been initialized and is prepared to dial. At that point, a dialing sequence is sent from the processor to the modem through the transmit data (Txd) line 326. The dialing sequence consists of a command function to dial followed by the necessary digits to call the local monitoring center 14 (Fig. 1). In most cases this will consist of a seven digit number; however, in those cases where the remote building's modem is interfaced to a private PBX within a building, 8 or 9 digits may be necessary and can be accommodated. In response to the dialing sequence, the processor will wait for the reception of a data carrier detect (DCD) signal on the line 336 from the modem. This occurs once the modem has completed the dialing cycle and has received a carrier signal back (the carrier signal is a tone frequency capable of being modulated with the signal on the line 332). Upon the reception of a data carrier detect (DCD) signal the master is now ready to trans- mitthe message to the local monitoring center detailing the alarm condition or performance data. This same sequence is also followed at the end of the 24 hour period designated as the performance day. This data, however, is not associated with an alarm condition but rather reflects operating performance data which has been accumulated by the processor during the last 24 hour period with regard to the elevators that it monitors. Upon transmission and reception of the message at the local monitoring center an aknowledgement signal will be received on the received data (Rcd) line 332. At that time the processor will "hang up" the modem by causing the DTR signal on the line 328 to go to the logic zero level. In response to the DTR signal at the logic zero level the modem disconnects from the local monitoring center and clears the telephone line. In the event that an error has occurred in the transmission instead of an aknowledgement, a not acknowledged (NAK) signal will be received on the line 332 from the local monitoring center. In response to the reception of a NAK, four more attempts will be made by the master to complete transmission to the local. If, after five attempts, communication has not been established correctly without error, the remote will "hang up" and reinitiate the entire sequence again in approximately 60 to 90 seconds. This process will continue until a successful communication has been accomplished. Therefore, if a failure of the local phone line occurs, a remote continues to attempt to communicate to a local until that line is restored. Upon initial power up or after a power failure occurs at a remote building the master will communicate, through the modem to the local monitoring center to receive the correct time of day. The local monitoring center contains a chronograph which contains a master clock for the remote building associated with that local office. In this way the remote master processor is synchronized with the master clock in the local monitoring center. Depending upon the remote processor's local address, which is its identification to the local processor, it will use this time of day to perform a daily performance data transfer which is related to its address, in a very specific equation.

[0026] Referring back to Fig. 1, the local monitoring center 14 contains a modem 26, local processor 28, and a printer 30. The processor contains the data base for the remote elevator monitoring system within the geographic area, and the software to receive messages from each remote building and print the appropriate English message for that message received. In addition, the performance data is received and forwarded to the central monitoring center 16 on a daily basis. The communication between the processor 28 and the modem 26 is similar to that of the master 18. The modem 26 at the local monitoring center 14 will detect the occurrence of a ring indication and transmit a ring indicator (RI) to the local processor 28. Upon detecting a RI signal the local modem 26 will answer and establish connection to a remote building's modem 24. The message upon receipt will then be placed into memory of the processor 28 and software will then determine the type of message. If the message is received error free, an acknowledgment is then sent back to the remote building and the modem 24 at the remote building will hang up. Upon receipt of a message at the local monitoring center 14 of an alarm condition a printout will be generated on the alarm printer which will indicate the occurrence of thealarm condition and the condition of the elevator. In addition, if there is a person trapped on the elevator it will be highlighted as well. In this way, any alarm condition and its nature is known at the local monitoring center 14 in approximately 25 seconds from its detection within the remote building's master. The local monitoring center will also print a message whenever any elevator is placed on "attendant" operation indicative oftheturning of a switch contained within the elevator which removes it from automatic service, or that a service mechanic has thrown a switch in the master itself indicating that service actions are being taken on the elevator system within the building. At the end of the "attendant" operation or service within the building, the local will print a message "all clear". Any alarm condition is cleared upon receipt of an "all clear" message at the local monitoring center which is also forwarded to the central monitoring center via telephone line. These messages are transmitted by the local monitoring center 14 to the central monitoring center 16 in much the same manner that they are transmitted from a remote building to the local. However, in this case a slightly different message format is utilized to indicate to the central monitoring center the specific local monitoring center from which the message is being received. Contained within that, of course, is the necessary data to identify the remote building and its elevator from which the message was received at the local monitoring center. A duplicate copy of the printout obtained at the local monitoring center is obtained at the central monitoring center under this action so that two printouts of every alarm and "all clear" are obtained within the system. This is important in cases where the local may have experienced a failure in its printer which may be due to a mechanism break down, loss of paper, operator error, etc. In all such cases, any alarm not received at a local will be forwarded to the central where it will be identified and action can be taken.

[0027] In addition to alarms, daily performance data is forwarded from the locals to the central at specified time intervals. This data is stored under an archival system as received by central. Bulk storage may be implemented using tape, disk, etc. for instance retrieval and performance report generation. These reports can be automatically generated via the centralized computer program. The purpose of this daily performance data and its archival storage is to allow the operators of the REMS the ability to retrieve specific performance data collected via the system to evaluate past performance of the elevators in order to project long term performance. It is important to note that the daily performance called in, in addition to providing daily performance data about all elevators being monitored, also provides an important message verifying the operation of the individual units operating in the various remote buildings throughout the system. Since it is not uncommon not to receive any alarms from a particular elevator during the day, the daily call in is generally the major form of communication within the system. In the event that a remote building does not call in, it is immediately highlighted via the local monitoring center's computer printout and is also reiterated at the central printout. This provides the local monitoring center immediate notice that the system is not functioning in a particular remote building so that a service person can be dispatched the next day to investigate the cause of the failure, thus, the daily call in provides a supervisory function which detects a broken down system in a particular REM building within one day.

[0028] Fig. 5 is a detailed schematic diagram of a slave unit of the present invention shown interfaced to elevator sensor contacts 500 and associated 120 VAC sources 502. The contacts 500 and sources 502 are operatively connected on lines 504. Each contact is also operatively connected on a line 506 to an opto isolation and signal conditioning network 508. Each 120 VAC source is also connected on lines 510 to the opto isolation and signal conditioning network 508. Each 120 VAC source is also connected on lines 510 to the opto isolation and signal conditioning network 508. The elevator sensor contacts 500 are presented to the opto isolators 508 in order to completely isolate the slave unit from the elevator signals it is monitoring in order to eliminate high frequency noise spikes of high potential from entering the slave system via a common ground connection. Each opto isolation circuit 508 consists of two opto isolators (photo transistors) 512 which are placed back-to-back to provide for complete positive and negative signal conditioning. The opto isolators 512 turn on at any voltage greater than one-half the AC peak sine wave input value. Once either opto isolator turns on, it discharges a RC charge circuits, having a resistor 514, a resistor 515, and a capacitor 516, and thereby presents, through a buffer amplitude 518, on a line 520 a logic zero signal (0.5V) to an exclusive or gate 522. When the AC input drops below one-half of the peak voltage, the photo transistor 512 turns off and the RC charge circuit begins to recharge the capacitor 516 according to the relation V. = vi,, (1-et/RC). This charging time, however, is one-sixth the total time it takes to cover a complete AC cycle. Since the time constant of the charge circuit is 35 milliseconds the input voltage never reaches the level 2112 volts required to transition the control logic. The actual charge voltage input is approximately 0.534 volts or less. Therefore, as long as an AC signal is present, a logic zero is present on the line 520 into the exclusive or gate 522. In the absence of an AC signal for more than 34 milliseconds, the capacitor 516 charges towards a value of Vcc and the signal on the line 520 is not allowed to switch state indicating the absence of an AC signal. The purpose of the exlusive or gate 522 is to permit the presence or absence of an AC signal on the line 506 to indicate either a true or false condition depending upon the position of a switch 524. If the switch 524 is in the open position, a logic one on the line 520 will cause a logic zero to be present on output line 526. A logic zero on the line 520 will cause the output on the line 526 to be a logic one. Similarly, if the switch 524 is in the closed position, a logic one on the line 520 will cause the output on the line 526 to be logic one. If the value of the voltage on the line 520 is equivalent to a logic zero then the output on the line 526 will assume a logic zero value. It should be understood that it is not absolutely necessary in the practice of the invention to utilize relatively high (e.g., 120 VAC, 120VDC, or 24VDC) voltage sources for sensing purposes. A relatively high voltage is used to overcome any high noise voltages which may be induced on the wires used to connect to the sensor contacts which may be located in a noisy electromagnetic environment. It should also be understood that it is not necessary to isolate the sensor contacts from the control logic within the slave unit by means of opto isolators. Isolation may be achieved using traditional relay isolation methods. Or, if the sensor contacts 500 are located in a benign electromagnetic environment, isolation may not be required. It should also be understood that the setting of the meaning of the presence or absence of voltage on the line 526 by means of, in this case an exclusive or gate 522, could as easily be accomplished by other logic gates or circuit configurations. It should also be noted the Fig. 5 only illustrates several opto isolators and their associated signal conditioning networks and that many other inputs could have been illustrated in a theoretically unlimited number, although the practical number of inputs in the preferred embodiment is either4, 8, or 12 inputs.

[0029] In most cases, where many inputs are attached to a slave unit, it is necessary that multiplexing circuitry 528 be contained in the slave to select the proper set of four inputs at the assigned time within the communications system protocol so that the correct information is inserted into the proper information frame. This is accomplished by means of a multiaddressing binary counter 530 which counts the number of clock pulses transmitted on the line 22b and presenting the present value of its count on lines 532 to an address comparator 534. The permanent address of the particular slave unit is preset by setting a series of switches 536 or jumpers in a combination of open and closed positions depending on the binary value of the permanent address. The setting of the switches causes the lines 538 to carry the various voltage values equivalent to either a logic zero or a logic one in the combination necessary to represent the permanent binary address and present it to the address comparator 534. When the binary counter 530 reaches a count corresponding to the value set by the switches 536 the address counter transmits a signal on a line 540 to the multiplexer 528 which then presents the information contained on a first four group of output voltages on the lines 526 on lines 542 to an industrial control unit 544. The transmittal of the first group of four information bits in parallel form on the lines 542 causes the industrial control 544 to retransmit the four bits in serial form, each bit being transmitted during the appropriate data frame so that the particular bit is transmitted during an appropriate corresponding bit time 218, 220, 222, 224 (see Fig. 3c). After the data bits for the data frame have been transmitted, a subsequent clock pulse is sensed on the line 22b by means of a comparator 546 and its address output is increased by one on the lines 532 and the address comparator 534 provides a signal on the line 540 to the multiplexer 528 indicating that the transmission line is ready to receive the next group of four inputs. If there are more than four inputs associated with a particular slave, the next group of four inputs should be selected and their information transmitted on the lines 542 to the industrial control unit 544 for transmittal on the line 22a. The binary counter continues to increase its count as each clock pulse is received from the comparator 546 on a line 548 and the address comparator 534 continues to transmit a signal on the line 540 to the multiplexer 528 indicating that the next group of inputs are to be presented to the industrial control unit until there are no longer any more groups associated with the particular slave to transmit. After the groups of inputs from all the slaves on a given transmission line have been exhausted and after the conclusion of a particular transceive cycle (lasting 104 milliseconds), the count of the binary counter 530 and of all the counters in slaves on the same transmission line are zeroed after receiving a LSYNC signal on a line 550 at a reset (R) input. It should be understood that in systems using an industrial control unit having four parallel inputs, a multiplexer would not be necessary if only four inputs were used. Similarly, if a serial type transmission line were not used, the need for an industrial control unit, which transforms data from parallel to serial form (among other things) would not be necessary. In that case, the binary counter 530, the address comparator 534, the clock detector 536, and the address select switches 536 would not be necessary for practising the invention.

[0030] The Xmit output of the industrial control unit 544 provides sufficient current on a line 552 to turn on a transistor 554 to transmit a data bit on the line 22a for each corresponding bit received from the lines 542 at the inputs I, -1₄. In addition to the communications line illustrated by the lines 22a and 22b, there exists a two wire DC power distribution line (not shown) connected to the industrial control unit.

[0031] The Xtal input to the industrial control unit can accept a zero to 10 volt 3.58 MHZ squarewave from the system clock or be connected to one side of a 3.58 MHZ series resonant color burst television crystal. The other side of the crystal should be connected to V_oo. Also a large resistor 556 (about 10 megohms) should be connected between XTAL and V_DD to ensure a reliable crystal operation. A bias clock output provides a 1.78 megahertz 50 percent duty cycle (XTAL/2) 0 to 8.0 volts CMOS output to a V_EE charge pump network. This circuit has two switching diodes and two small ceramic capacitors to invert the output of the 1.78 megahertz signal and produce a -6.0 VDC output which is applied to input line comparators within the industrial control unit so as to increase their negative common mode range. The SLAVE input is connected to V_cc for slave operation. Additional noise suppression is accomplished by the addition of a RC network on both the L1 and L2 inputs. A time constant of approximately 2.2 microseconds should be sufficient to limit common mode voltage transients without degrading performance. I n Fig. 5 a resistor 558 and a capacitor 560 are used on both the L1 and L2 ports. A termination network 562 serving the purpose of providing a DC signal return path and limiting the bandwidth of the transmission line to just what is needed by the industrial control units is attached to the line at the last slave on the line. This reduces large high frequency common mode voltage transients induced by such noise sources as relay coils, and induction motors.

[0032] In Figs. 6 and 7 are illustrated in more detail the block diagram of Fig. 4. Fig. 6 shows the master/ slave communication interface 300 and the UART 308 of Fig. 4 in a single chip 600 implementation of the master/slave communication interface and UART. Also shown, in common with Fig. 4, are a driver circuit 322 and a receiver circuit 340 which transmit and receive signals, respectively, from the modem 24 of Fig. 1.

[0033] In Fig. 7 is shown the processor 302, the RAM 304, the ROM 306, the 60 HZ interrupt 312, the power supply 310, and the clock 314 of Fig. 4. Of course, the common data lines 316, address lines 318, and control lines 320 of Fig. 4 are shown in both Figs. 6 and 7. The data lines 316 of Fig. 4 are designated alphanumerically as DO-D7, the address lines 318 are designated AO-A15, and the control lines 320 include a BUS ACK line 602, a BUS REQ line 604, a WR line 606, a MEM REQ line 608, a CLOCK line 610, and a VECTOR line 612.

[0034] Referring to Fig. 6, the communication lines 22a, 22b together connect the master with one or more slave units. A comparator 614 compares the voltages on lines 616 and 618 and provides a data bit on a line 620 to the single chip 600 whenever the voltage on the line 22a is 0.8 volts greater than the voltage on the line 618. A circuit 621 provides clock pulses on the line 226. A similar circuit 622 provides the capability of writing data onto line 22a; although this capability is not used in the present embodiment, it is included for possiblefut- ure use.

[0035] An eight bit latch circuit 623 is used to demultiplex data and address information provided on lines 316. The latch recovers the address information and holds it for a selected period for later presentation to the least significant bits (AO-A7) of the address bus. The most significant bits of the address bus (A8-A15) are provided directly to the address bus 318 from the single chip 600.

[0036] During the second half (the receive time) of each transceive cycle (see Fig. 3) the master receives data from the slaves on the communication lines 22a, 22b and stores the data in a discrete bit map in available memory, which in the single chip implementations consists of 128 bytes of RAM which, in the present embodiment, is a Zilog Z8601. After each transceive cycle is concluded and the data transmitted from the slaves to the single chip has been stored within the single chip's 128 bytes of RAM, a bus request signal is transmitted from the single chip on a line 604 to the processor 302 of Fig. 7 for direct memory access (DMA) by the single chip 600 (Z8601) into the 2K of RAM 304. The DMA technique momentarily interrupts the processor (which may be a Zilog Z80) 302 so that control of the address and data lines are relinquished by the processor 302 to the single chip 600. The processor does this by causing its internal drivers associated with each of the address and data lines to go into the high impedance state so that the single chip's drivers associated with the same lines may temporarily assume control of the address and data buses. Once the single chip has halted the processor and assumed control of the address and data buses, it then proceeds to write the discrete bit map from its 128 byte RAM into the RAM 304 of Fig. 7. It then releases the bus request line and the processor resumes operation.

[0037] In the present embodiment the ROM is an 8Kx 8 (8K words (bytes), 8 bits/word) electrically programmable read only memory (EPROM) which is a Toshiba TM M2764D. The RAM 304 of Fig. 7 is a 2Kx8Toshiba TMM2016P-2. Itshould be noted in Fig. 7 that although the data bus has 16 lines, which are capable of addressing 65,536 addresses (64K bytes) the EPROM is only on 8K byte device and the RAM 304 is only a 2K byte device. The EPROM is assigned the first 8K bytes of addressable memory and the RAM is assigned the last 2K of addressable memory, i.e., the EPROM has hexadecimal addresses from 0000 to 1 FFF and the RAM from F800 to FFFF. A memory decoder/ selector/multiplexer 700 is illustrated in Fig. 7 which permits the selection of the proper memory space according to the three most significant bits of the address presently on address lines A13-A15. The logic levels assumed by lines A13-A15 determines which memory (the EPROM or the RAM) is selected. If line A15 assumes the logic zero level then the selected address presently on the address bus must be between addresses 0000 and 7FFF. But since the EPROM is assigned addresses 0000 to 1 FFF this is not sufficient information to enable the EPROM. The EPROM is enabled by causing a line 702 to transition from a logic level 1 to a logic level 0 when A15=0, A14=0, and A13=0. The locations of the addresses selected for the RAM and the EPROM are within the 64K bytes of addressable memory. For the addresses between decimal 0 and 32,767 (hexadecimal 0 and 7FFF) the most significant hexadecimal numeral (HEX bit 3) increments from 0 to 7. The binary equivalent for the most significant bit (A15) remains at zero for all addresses between hexadecimal 0 and 7FFF, i.e., for the first 32K bytes of addressable memory. In a similarfashion, it may be discerned at any address on the address but having the lines A15-A13 at a binary logic level of zero must necessarily have its address in the first 8K bytes of memory (decimal 0 to 8,191; hexadecimal 0 to 1 FFF). Since the EPROM has had the first 8K of addressable memory assigned to it, the memory decoder/selector 700 of Fig. 7 provides a logic zero level output select on the line 702 whenever A15, A14, A13 all have assumed the logic zero level. This enables the processor 302 to read instructions out of the EPROM. In a similar fashion, when the logic level one is detected on all three lines A-15-A-13 the address on the data bus must be in the last 8K bytes addressable memory, i.e., somewhere between hexadecimal address E000 and FFFF (decimal 57,344 and 65,535). In re- sponseto all three lines being at the logic one level, the memory decoder/selector/multiplexer 700 causes a line 704 to assume the logic zero level which enables the 2K RAM 304 for selection of memory locations in the last 2K bytes addressable memory, i.e., from 62K to 64K.

[0038] If the processor 302 of Fig. 7 determines, in a program for determining whether an alarm condition exists to be described in more detail hereinafter, that an alarm condition exists, a signal is provided by addressing memory address C000 memory decoder/selector/multiplexer 700 that causes the line 612 in Figs. 6 and 7 provide a VECTOR signal to the single chip 600 which indicates that a message is to be sent to the local office. In response to a VECTOR, the single chip 600 in Fig. 6 provides a bus request signal on the line 604 to the processor 302 of Fig. 7 whereby operation of the processor is suspended and the single chip executes a DMA in order to read a location in RAM 304 having a code which corresponds to an instruction which indicates that a message is to be transmitted to a local office. In response to this information, the single chip then initiates a transfer sequence utilizing the modem to communicate with the local wherein the previously described sequence culminating in the reception of a carrier detect signal is executed whereby the master is in communication with the local office. At this point the single chip will execute a DMA into RAM to obtain the message for transmittal out through the modem.

[0039] The master clock 314 of Fig. 7 provides a clock for both the processor and the single chip so that they may be in synchronism. The clock 314 includes a crystal with associated circuitry 706 and a buffer circuit 708. An external signal may be provided on a line 710 which disables the master clock 314 and which permits the clock line 610 of Figs. 6 and 7 to be driven externally by an external clock for test purposes.

[0040] The 60 HZ interrupt circuit 312 shown in Fig. 7 generates 60 cycle interrupts on a line 712 which are presented to the processor 302 so it can keep track of time. The power supply 310 receives 120 VAC/60 HZpower on lines 714 which are presented to a transformer 716. The transformer provides a transformed signal on lines 718 to a full wave rectifier 720 which provides a rectified signal on lines 722 to the interrupt circuit 312. The interrupt circuit includes amplifiers 728, 730 which provide a 120 HZ signal on a line 732 to a divide by two flipflop 734 which provides the 60 cycle interrupt on the line 712 to the processor 302. It should be understood that another frequency interrupt could be used, e.g., 400 HZ or 50 HZ in Europe.

[0041] A small lithium battery 750 is provided along with associated resistors and diodes to ensure that upon a power failure the contents of the RAM are not lost.

[0042] Referring now to Fig. 8, a state machine model of an elevator system in which transitions from state-to-state following a typical sequence of elevator operations are shown. Because all elevators perform the same general functions, they contain similar rudimentary control and status points within their controllers. In addition, most elevators perform an equivalent sequence of operations when performing their normal functions. The state machine described herein, in connection with Fig. 8, when interfaced to such basic points, in effect monitors the entire sequence of operations that the elevator performs. If the elevator fails to follow the normal sequence, or fails to meet the criteria for transitioning between successive states representative of normal operation, an inoperative condition or a failure condition is detected by a transition out of the normal sequence of states into an inoperative or alarm state.

[0043] Each state that the elevator can assume is represented graphically in Fig. 8 by a circle. Mnemonics used within a circle identify the state. All permissible transitions between states of the elevator are represented graphically by arrows in between circles. Each transition is qualified by an expression whose value is either true or false. The elevator remains in its current state if all the expressions which qualify the transitions leading to the other states are not satisfied. The new state is entered immediately after the expression(s) become(s) satisfied unless a time value is specified. An expression consists of one or more state linkages or minimum time limits used in conjunction with the operators: AND, OR, or NOT. Time is represented by the symbol T. This symbol achieves a true value only after the elevator has been in the state for the time value specified. It will remain true until the state is exited. The AND operator is represented by the symbol The OR operator is represented by the symbol The AN D operator takes precedence over the OR operator within an expression unless specified by parenthesis. The NOT operator is represented by a horizontal bar placed over the portion of the expression to be negated. The resulting negated expression has a true value if, and only if, the value of the expression under the bar is false. If a transition is further qualified by a maximum time limit, then the state pointed to shall be entered within the specified amount of time after the expression becomes true. If a portion of an expression is optional or a "don't care" situation is indicated (in that its true value is not required for the complete expression to be true), then it is enclosed within square brackets.

[0044] Associated with certain states are messages which indicate that the REMS unit shall transmit a message to the local and/or the central location. These messages are represented graphically in Fig. 8 by an oval adjacent to states indicative of alarm conditions. Mnemonics used within an oval identify the message content to be explained in more detail below. These messages may be associated with the occurrence of a transition between states as well.

[0045] In the following description, any malfunction by the elevator or elevator controller which results in a failure to transition from a particular state in the normal sequence is detected. The specific transition out of the normal sequence is detected and identified by a transition to a particular inoperative condition. It should be kept in mind that the state machine illustrated in Fig. 8 serves a monitoring function whereas an actual failure of the elevator is the causal factor while the detection merely serves a monitoring function of the elevator system.

[0046] Definitions for the mnemonics for the states of Fig. 8 are a follows:

[0047] In addition to the state lists, the following message list definitions are provided:

A LIST OF THREE MESSAGES

Inoperative Elevator, INOP Message

Inoperative Elevator, OCC Message

Alarm Condition Clear Message, CLR

[0048] These messages are identical to and functionally equivalent to the messages for occupied and unoccupied messages as described in the original Whynacht invention referred to above.

[0049] In addition to detecting abnormal elevator conditions, performance data associated with the operation of the elevator is also collected. This data consists of the monitoring of a number of elevator functions. Contained within the diagram are octagon symbols with numbers contained within them. These numbers represent the moments in time when the specific counters and times are to begin operation and to cease operation and are described in more detail below.

[0050] The data input points listed below in Table are utilized by the elevator state machine of Fig. 8. The eight data inputs that are listed are those normally associated with a single, automatic, push-button (SAPB) configuration of elevator. It should be recognized thatthis isthe minimum configuration of the state machine and that this configuration represents the simplest elevator in operation today, i.e., a single shaft with a single hoist elevator.

[0051] In addition to this SAPB configuration, the state machine is functionally operational for multi-shaft way configurations, i.e., those buildings containing multiple elevators controlled by group dispatchers. To accommodate the additional complexity of these installations, it is usually necessary that four more inputs (Table IlI) be monitored by the state machine; it should be understood that these inputs only add to the complexity of the simple machine for the SAPB. A simple SAPB machine and a complex multi-group machine do not differ in theory of operation, but only in the ability to detect additional states. In the diagram of the state machine, "true" refers to the affirmed condition of the input in a logical sense only. The absence or presence of voltage from a field contact is not in this case defined, but is a function of the individual wiring at the field site. The preferred hardware implementation allows for either the presence or absence of voltage to assume the true function, as described fully in the previous Whynacht disclosure referred to above.

[0052] A detailed description of the operation of the state machine follows. Each state in the diagram of Fig. 8 will be described along with the requirements and conditions for transition out of the state to another succeeding state. It should be understood that the actual hardware implementation of the state diagram of Fig. 8 would require a programmer to encode all of the requirements of the figure in a particular language according to the particular hardware being used; however, the encoding details are not described because the particular hardware and programming techniques utilized are a matter of choice not embracing the inventive concept.

[0053] Upon application of power to the machine, a power-on state 1100 will be entered after all self- test checking by the processor unit is completed. After entering the power-on state 1100 the state machine will transition to a car idle state 1102 as signified by a transitional line 1104. It is anticipated that when an elevator is powered up, the elevator that is being monitored is running and in operation; therefore, no requirement is imposed upon alarming from the power-on state 1100. There is an implied entrance into the power-on state 1100 anytime power is applied or power is interrupted momentarily to the unit. Anytime a processor reset occurs, the state machine will begin from the power-on state 1100.

[0054] The car idle state 1102 functionally represents a car which has no demand and is waiting at a floor. Door positions are irrelevant. In orderto exitthe car idle state under normal operation, a button input usually from a passenger either at a hall landing or within a car is detected true for three seconds. The button will go true whenever a hall call or car call is registered on the car in a single automatic push-button configuration. In the case of a multi-car configuration, a button going true represents a "demand" or "go" signal from the group dispatcher function to the car. Upon detecting a true condition of the button input for greater than three seconds the state machine will sequence from the car idle state 1102 to a car called state 1106 as signified by a transitional line 1108. An abnormal transition from the car idle state 1102 can occur if the elevator power goes false for greater than one second. In this case, the state machine will sequence from the car idle state 1102 to an inoperative state 1 (INOP 1) 1110 as signified by a transitional line 1112. A third transition condition out of the car idle state 1102 occurs when service goes true indicating that maintenance is being performed on the elevator car itself. This condition will cause the state machine to sequence from the car idle state 1102 to an attendant state 1114 as indicated by a transitional line 1116.

[0055] The car called state 1106 functionally represents a car which has been dispatched true by either a call from a hall or car button for a SAPB configuration or via a demand/go signal from a group dispatcher. The car is still at a floor but now has been activated by a signal to cause it to move. Two transitions are possible from the car called state 1106. A normal transition occurs when the hoistway door locks make-up, i.e., the hoistway door lock variable goes true within a time period of twenty seconds from the entrance into the car call state. Upon this occurrence the state machine will sequence from the car called state 1106 to a car ready state 1118. In the event that the hoistway lock variable does not go true but remains false for a period of time greater than twenty seconds from the entrance into the car called state 1106 then an abnormal transition of the state machine will occur from the car called state 1106 to an inoperative 2 (lNOP2) state 1122, as indicated by a transitional line 1124.

[0056] The car ready state 1118 functionally represents the condition that the car has been commanded to go, and the hoistway door locks have closed. There are two transitions possible from the car ready state. The normal transition is the occurrence of a brakelift on the elevator car. This brakelift must occur within fifteen seconds after entering the car ready state 1118. Upon the occurrence of the brakelift within fifteen seconds, the state machine will sequence from the car ready state 1118 to a car active state 1126 as indicated by a transitional line 1128. In the event that the brakelift does not occur within fifteen seconds from entry into the car ready state, the state machine will sequence from the car ready state 1118 to an inoperative 3 (INOP 3) state 1130 as indicated by a transitional line 1132. This is an abnormal transition from the car ready state 1118.

[0057] The car active state 1126 functionally represents the condition that the car is in motion. It can not be assumed at anytime that the car is either in or outside of a door landing. Although in all probability, once entrance into the car active state 1126 is effected, the car will not be positioned at a floor, but will be in some intermediate position between landings. The car active state is the normal run mode for the elevator car and is the predominant mode that the elevator takes during a run. Upon approaching the terminal landing of the elevator run, whether it be a single floor or a multi-floor run, at some point the car will begin to decelerate and stop at the desired landing for which the button signal generated the initial go for the elevator car. At the appropriate time the controller for the elevator car will drop the brake for the car to stop it at the landing that has been determined to be correct for the initial go signal. The normal transition out of the car active state is the occurrence of this brake drop. It is signified by the input brake going false as indicated on a transitional line 1134 to a car stopped state 1136. The safety chain input variable is included in the transitional expression in order to provide a check for a normal elevator stopped condition. Upon the occurrence of this, the state machine will sequence from the car active state 1126 to the car stopped state 1136. Note that the state machine assumes no time limit between going from the car active state 1126 to the car stopped state, since it is not known how long actual run will take. Nor is it of any importance to the state machine in monitoring the sequence of operations. An abnormal transition from the car active state 1126 is the detection of the safety chain variable being false along with the brakelift variable being false as indicated by a transitional line 1138 to an inoperative 6 (INOP 6) state 1140. The transition on the line 1138 indicates a stoppage of the elevator car by the opening of the safety chain (the safety chain is a chain of series connected normally closed safety related contacts the opening of any one or more of which constitutes a breaking of "the safety chain" and the assumption by the safety chain of a false value).

[0058] The car stopped state 1136 functionally represents the condition that the brake has dropped on the elevator and the car has now stopped. At this point it is not known whether the car has stopped at a floor or at some indeterminate point between landings. It is the purpose of this state to detect which of these conditions is true. A normal transition from the car stopped state is the assumption by the door open variable of the true value within one second of entering the car stopped state 1136. An additional input, variable car parked recognition (true), is included in the transitional equation for the multi-car configuration since the parking of an elevator car under a group dispatcher function is possible for this configuration as indicated by a transitional line 1142 to a car door open state 1144. For the single automatic push button (SAPB) type the car parked recognition input variable does not exist. Upon the assumption of the door open variable of a true value within one second of entering the car stopped state 1136, the state machine will sequence from the car stopped state 1136 to the car door open state 1144. Another normal transition, in the case of the multi-car configuration, from the car stopped state 1136 is the assumption by the car parked recognition input variable of a false value after entering the car stopped state 1136. This results in an immediate transition to a car parked state 1146 as indicated by a transitional line 1148. As explained earlier, multi-car configuration systems provide the input car parked recognition variable and have an associated car parked state 1146 implemented in the state machine. An abnormal transition from the car stopped state 1136 is the detection of the door open variable remaining false for a period of greater than five seconds after entering the car stopped state 1136. This will result in a transition to an inoperative 4 (INOP 4) state 1150 as indicated by a transitional line 1152. The car parked recognition variable is included in this equation if the state machine supports a multi-car configuration.

[0059] The car door open state functionally represents the opening of the inner doors of the elevator after the car has stopped at a floor. It represents the conclusion of a normal elevator run. Upon entrance to the car door open state, the state machine performs a check of leveling (if leveling performance monitoring is installed for the particular elevator configuration). This leveling check is not a unique state and is therefore not illustrated in Fig. 8 but is rather a performance measure which is associated only with the occurrence of the car door open state 1144 itself. The normal transition from the car door open state occurs upon detection of the opening of the hoistway doors (the door switch variable going false) which results in a transition to the car idle state 1102. This represents a completed sequence of elevator operation and will result in the beginning of the entire sequence again. The abnormal transition condition from the car door open state 1144 is for the door switch to remain true for a period of greater than twenty seconds after the state machine enters the car door open state 1144 as indicated by a transitional line 1154 to an inoperative 5 (INOP 5) state 1156. This represents the occurrence of a locked hoistway door or a failure of the elevator doors to open for some other reason.

[0060] The service state 1114 functionally represents the performance of some maintenance action upon an elevator by a qualified repair man. The service variable achieves a true value when the service switch associated with the elevator is turned to the true position. The detection of the occurrence of the service variable going true will cause a transition from the car idle state 1102 to the service state 1114 (the service state is also referred to as the attendant state). As a result of this transition, all performance monitoring in abnormal elevator shutdowns with the exception of an occupied trapped passenger are overridden, i.e., they are ignored. The normal transition from the attendant state is the detection of the service variable in the false condition as indicated by a transition line 1158 back to the car idle state 1102. This normal transition represents the time when the maintenance operator releases the switch indicating that he has performed his maintenance action on the elevator. At that time, the state machine sequences from the attendant state 1114 to the car idle state 1102 and begins again to monitor all operations of the elevator for abnormal, occupied, and unoccupied shutdowns along with monitoring performance criteria. An abnormal transition from the attendance state can occur if the alarm bell variable is held true for a period of greater than one second as indicated by a transitional line 1160 to an occupied wait 1 (OCCW 1) state 1162. This represents the case where somehow the maintenance operator or a passenger has managed to trap himself within an elevator while undergoing maintenance service.

[0061] Upon detection of the power variable going false for greater than one second the state machine transitions from the car idle state 1102 to the inoperative 1 state 1110. Upon entrance into the inoperative 1 state 1110, a twenty minute timer begins to measure the elapsed time starting at the time the state machine entered the inoperative 1 state 1110. If the elevator does not perform a normal transition from the IN 0 1 state 1110 back to the car idle state 1102 within the twenty minutes allowed, a transition will occur from the inoperative 1 state 1110 to an unoccupied 1 (UNNOC 1) state 1162 as indicated by a transitional line 1164. This transition signifies the detection of an abnormal elevator shutdown. The normal transition condition from the inoperative 1 state 1110 is the detection of the power variable going true within the twenty minute time period as indicated by a transitional line 1166. In this case, the state machine will sequence from the inoperative 1 state 1110 back to the car idle state 1102 and will resume monitoring of the elevator. A second abnormal transition from the inoperative 1 state 1110 occurs upon the detection of the alarm bell variable going true for greater than one second as indicated by a transitional line 1168 to the occupied wait 1 state 1162. If a passenger were to somehow become trapped in the elevator from the car idle state, the detection of the alarm bell variable in the true condition for greater than one second would generate this transition.

[0062] Upon entering the unoccupied 1 state 1162, the state machine will immediately send an inoperative abnormal elevator shutdown message to the local 14 of Fig. 1. The unoccupied 1 state 1162 functionally represents an abnormal elevator shutdown which has occurred dueto a powerfailure of the elevator. As such, a detection of this state represents an abnormal elevator shutdown. The only transition from the unoccupied 1 state 1162 is back to the car idle state 1102 as indicated by a transitional line 1170. The transition from the unoccupied 1 state 1162 to the car idle state 1102 occurs when the power variable goes true and will result in the sending of an alarm condition corrected message (CLR) to the local 14.

[0063] The inoperative 2 state 1122 functionally represents a failure of a ho istway door to close. Upon entrance into the inoperative 2 state 1122, a check is made of the emergency stop input variable. If it is true, then the emergency stop button has been pressed and a transition to an emergency stopped state 1172 occurs as indicated by a transitional line 1174. If the emergency stop variable is false, a timer begins measuring the time from when the state machine enters the INOP 2 state 1122 until twenty minutes have elapsed. For multi-car operation, a check is also performed on the normal input variable to ensure that it is true before transitioning as indicated by a transitional line 1176 to an UNNOC 2 state 1178. The normal input variable represents the capability of an operator in multi-car configuration to place one of the elevator cars upon attendant operation. For that specific case, the timer is disabled. Upon the accumulation of twenty minutes by the timer (and the normal variable having a true value in a multi-car configuration) an immediate transition is made into the unoccupied 2 state 1178. A transition from the unoccupied 2 state 1178 occurs upon the door switch variable going true as indicated by a transitional line 1180 to the car idle state 1102. This transition will cause the generation of an alarm clear message indicating that the inoperative message previously sent upon entering the unoccupied 2 state 1178 is no longer valid. A third transition from the inoperative 2 state 1122 is the detection of the alarm bell variable going true for greater than one second as indicated by a transitional line 1182 to the occupied wait 1 state 1162. This functionally represents the occurrence of a passenger being within the elevator when the hoistway doors have failed to close up.

[0064] As previously discussed, upon entrance to the unoccupied 2 state 1178 due to the accumulation of more than twenty minutes while waiting in the inoperative 2 state 1122, the state machine will immediately transmit an inoperative abnormal elevator shutdown message to the local. The state machine remains in the unoccupied 2 state 1178 until the detection of the door switch variable going true at which time an immediate transition is made to the car idle state 1102. Upon this transition an "alarm condition corrected" (CLR) message is transmitted to the local.

[0065] The inoperative 3 state 1130 functionally represents the failure of the brake to lift for the elevator car within fifteen seconds of the state machine entering the car ready state and the brakelift variable atthe same time being false. Upon entrance to the state 1130 a twenty minute timer begins to time how long the state machine remains in the inoperative 3 state 1130. If this timer measures twenty minutes, an immediate transition is made to the unoccupied 3 (UNNOC 3) state 1184 as indicated by a transitional line 1186. The normal input variable, for multi-car applications is included in the transitional expression shown accompanying the transitional line 1186 for the same reasons it was included in connection with the transitional line 1176 which defined a transition from the inoperative 2 state 1122 to the unoccupied 2 state 1178. While the state machine is in the unoccupied 3 state 1184, should a brakelift occur prior to twenty minutes of accumulated time, the state machine will make an immediate transition to the car active state 1126 as indicated by a transitional line 1188. Another possible transition from the inoperative 3 state 1130 to the car door open state 1144 occurs when the door open variable is detected going true within twenty minutes of entering the inoperative 3 state 1130. This produces an immediate entrance to the car door open state 1144 as indicated by a transitional line 1190. A transition from the inoperative 3 state occurs upon the detection of the alarm bell variable going true for a period of greater than one second as indicated by a transitional line 1192 to the occupied wait 1 state 1162. This would represent a passenger being trapped within the car. The state machine, in addition to the above mentioned transitions from the inoperative 3 state 1130, contains a counter which is incremented upon every entrance into the inoperative 3 state 1130. This counter is cleared if the brakelift variable goes true causing a transition to the car active state 1126 as indicated by a transitional line 1194 or if the button variable is false for greater than five seconds as indicated by a transitional line 1196 to the car idle state 1102. Upon every entrance into the inoperative 3 state 1130, after incrementing the counter, the value of the counter is tested for a value of five. It is possible for a controller malfunction to cause the brake to fail to lift and to sequence through the states: car door open, car idle, car called, car ready, and I NO P 3 without having the car ever move. This would represent the condition whereby a passenger gains entrance to a car, creates a demand, has the doors close, but then the car does not move due to a brake failure. A passenger may at that time push the door open button contained within the car and exit the car. Such an elevator is inoperative. In the event that five such sequences of the above mentioned states occur without a breakelift, a message is immediately sent to the local of an abnormal elevator shutdown. In addition, the total number of entrances into the inoperative 3 state by the state machine is accumulated during each performance period (typically one day) as a monitor of the elevator's performance, since it is possible for a deteriorating brake as evidence by a slow brake condition to be detected in this way.

[0066] If the state machine occupies the inoperative 3 state 1130 for greater than twenty minutes an immediate transition is made to the unoccupied 3 state 1184. This represents the occurrence of a brake failure and results in an abnormal elevator shutdown message being transmitted to the local. The only exit from the unoccupied 3 state 1184 occurs upon the detection of the brakelift variable going true which will produce an immediate transition as indicated by the line 1188 to the car active state 1126. Such a transition will immediately generate an alarm condition correction message (CLR) at the local.

[0067] The inoperative 4 state 1150 represents the condition of the door open variable going false corresponding to a door open actuator failure. Upon entrance into the inoperative 4 state 1150 a twenty minute timer begins to measure the length of time the state machine remains in the inoperative 4 state. If after twenty minutes a door opens or brakelift has not occurred, the state machine will enter an unoccupied 4 (UNNOC 4) state 1198 as indicated by a transitional line 1200. The normal variable is included in the expression adjacent to the transitional line 1200fora a multi-car configurations. In all other cases it would be omitted, as in the transitional lines 1186, 1176. It is possible to transition from the inoperative 4 state 1150 to the car door open state 1144 upon detecting the door open variable going true as indicated by a transitional line 1202. It is also possible to transition from the inoperative 4 state 1150 to the car active state 1126 upon detection of the brakelift variable going true as indicated by a transitional line 1204. As described in connection with the inoperative 3 state 1130, successive occurrences of the inoperative 4 state 1150 are counted. The occurrence of the door open variable going true clears this counter. If five successive occurrences of the following sequence occur: inoperative 4 state 1150, to car active state 1126, to car stop state 1136, to inoperative 4 state 1150, then an abnormal elevator failure has occurred in the which door open mechanism has failed with no one inside a car. This generates a message to the local of an abnormal elevator shutdown. A transition from the inoperative 4 state 1150 to the occupied wait 1 state 1162 occurs upon the detection of the alarm bell variable going true for greater than one second as indicated by a transitional line 1206. This transition represents a trapped passenger.

[0068] Upon entrance by the state machine into the unoccupied 4 state 1198 an abnormal elevator shutdown message (INOP) is sent to local. The state machine will remain in the unoccupied 4 state 1198 until the door open variable is detected as going true. This causes an immediate transition to the car door open state 1144 as indicated by a transitional line 1208. A condition corrected message (CLR) is generated upon the occurrence of such a transition.

[0069] The occupied wait 1 (OCCW 1) state 1162 represents the detection of the alarm bell variable going true for greater than one second from any of the inoperative states 1110, 1122, 1130, 1140, 1150 or from the service (attendant) state 1114. Upon entrance into the occupied wait state 1162 by the state machine a timer begins accumulating up to three minutes. At the end of three minutes, if the state machine is still in the occupied wait 1 state 1162 an immediate transition will be made to an occupied 1 (OCC 1) state 1210 as indicated by a transitional line 1212. It is possible to transition from the occupied wait 1 state 1162 upon the detection of the door open variable going true as indicated by a transitional line 1214 to the car door open state 1144. This would represent the escape of a trapped passenger out of the elevator car and would therefore cancel any potential occupied alarm.

[0070] The occupied 1 state 1210 is entered upon expiration of the three minute timer from the occupied wait state. It represents the detection of a trapped passenger. Upon entrance into the occupied 1 state 1210 a message of an occupied abnormal elevator shutdown (OCC1) is immediately transmitted to the local. The only way to exit the occupied 1 state 1210 is by the detection of the door open variable going true as indicated by a transitional line 1216 to the car door open state 1144. This represents the escape of a passenger from the trapped elevator and causes the generation of a message of alarm condition corrected (CLR) to the local.

[0071] The inoperative state 5 1156 represents the failure of the hoistway door actuators to open. It is entered from the car door open state 1144 if the hoistway doors do not open within twenty seconds after entering the car door open state 1144. Upon entrance into the inoperative 5 state 1156 the state machine begins a timer which measures how log the state machine remains in the inoperative 5 state 1156. If after twenty minutes the hoistway car doors have not opened, a transition is made into an unoccupied 5 (UNNOC 5) state 1218 as indicated by a transitional line 1220. It is possible to transition from the inoperative 5 state 1156 to the car idle state 1102 before twenty minutes elapses if the door switch variable goes false as indicated by a transitional line 1222. It is also possible to transition from the inoperative 5 state 1156 if the alarm bell variable is detected true for a period of greater than one second as indicated by a transitional line 1224 to an occupied wait 3 (OCCW 3) state 1226.

[0072] The unoccupied 5 state 1218 is entered upon the state machine remaining in the inoperative 5 state 1156 for greater than twenty minutes. Upon entering the unoccupied 5 state 1218 an immediate message of an abnormal elevator shutdown (I NO P) is transmitted to the local. The state machine will remain in the unoccupied 5 state 1218 until the detection of the door switch variable going false which produces an immediate transition to the car idle state 1102 as indicated by a transitional line 1228. This also results in the transmission of a message to the local of the alarm condition corrected (CLR).

[0073] The occupied wait 3 state 1226 is entered from the inoperative 5 state 1156 upon detection of the alarm bell variable going true for greater than one second. It represents the detection of a trapped passenger due to the hoistway door failure. A timer is enabled upon entering the occupied wait 3 state 1226. If after three minutes, the hoistway doors have not been detected in the opened condition, i.e., the door switch variable remains true, an immediate transition is made to an occupied 3 (OCC 3) state 1230 as indicated by a transitional line 1232. Detection of the door switch variable going false (this would represent the opening of the hoistway doors and the escape of the trapped passenger) from the car produces an immediate transition to the car idle state 1102 as indicated by a transitional line 1234.

[0074] Upon entering the occupied 3 state 1230 from the occupied wait 3 state 1226 a message is transmitted to the local of an occupied abnormal elevator shutdown (OCC). The state machine remains in the occupied 3 state 1230 until the detection of the hoistway door switch variable going false. This represents the escape of the trapped passenger via the hoistway doors and will generate a message to the local of alarm condition corrected (CLR). Upon detecting the hoistway door switch variable going false the state machine will sequence from the occupied 3 state 1230 to the car idle state 1102 as indicated by a transitional line 1236. This also results in the transmission of a message to the local of the alarm condition corrected (CLR).

[0075] The emergency stopped state 1172 functionally represents the pushing of the emergency stop button in the elevator car to prevent the car doors from closing in their normal sequence. A transition into the emergency stopped stop state 1172 from the inoperative 2 state 1122 prevents the sending of either an unoccupied or occupied alarm while the car is being held at the floor. The only exit from the emergency stopped state 1172 is the release of the emergency stopped button. This generates an immediate transition back to the inoperative 2 state 1122 as indicated by a transitional line 1238.

[0076] The inoperative 6 state 1140 functionally represents the stoppage of the elevator car by an opening of the safety chain. Upon entrance into the inoperative 6 state, a twenty minute timer begins to measure the time that the state machine occupies the inoperative 6 state 1140. If after twenty minutes the safety chain variable does not go true, the state machine will transition to an unoccupied 6 (UNNOC 6) state 1240 as indicated by a transitional line 1242. Detection of the safety chain variable going true will abort the twenty minute timer and result in an immediate transition to the car stopped state 1136 as indicated by a transitional line 1244. The normal variable is included in the expression adjacent to the transitional line 1242 in Fig. 8 for the multi-car configuration as explained earlier in connection with transitional lines 1176, 1186, 1200, 1220. A transition from the inoperative 6 state 1140 is the detection of the alarm bell variable going true for greater than one second as indicated by a transitional line 1246 to the occupied wait 1 state 1162. This would represent a trapped passenger.

[0077] Upon entrance into the unoccupied 6 state 1240, an abnormal elevator shutdown message (INOP) is sent to local. The state machine will remain in the unoccupied 6 state 1240 until the detection of the safety chain variable going true. This generates an immediate transition to the car idle state 1102 as indicated by a transitional line 1248. It also generates a message to the local of an alarm condition corrected message (CLR).

[0078] The car parked state 1146 represents the car parking function associated with multiple hoist- ways and multi-car groups. The car parked state is entered from the car stopped state 1136 if the car parked recognition variable goes false. A transition from the car parked state 1146 to the car idle state 1102 occurs when the button variable is detected with a true value. This would represent a generated go signal from a controller to dispatch a car to a designated hall call. It is represented by a transitional line 1250. An abnormal transition from the car parked state 1146 occurs if the alarm bell variable goes true for a period of greater than one second as indicated by an transitional line 1252 to an occupied wait 2 (OCCW 2) state 1254. This would represent the occurrence of a trapped passenger due to the car parked recognition relay. A second abnormal transition can occur if the door open variable goes true as indicated by a transitional line 1256 to the car door open state 1144. This represents the escaping of a trapped passenger from the elevator car.

[0079] The occupied wait 2 state 1254 represents the detection of a trapped passenger due to the car parked recognition relay failure. Upon entrance into the occupied wait 2 state 1254 a timer is enabled. If this timer accumulates three minutes of time then an immediate transition is made to an occupied 2 (OCC 2) state 1258 as represented by a transitional line 1260. If the door open actuator input variable goes true before three minutes elapse the timer is disabled and a transition is made to the car door open state as indicated by a transitional line 1262. This represents the escaping of a trapped passenger from the elevator car.

[0080] The occupied 2 state 1258 represents the detection of a trapped passenger. Entrance into the occupied 2 state 1258 results in a message of occupied abnormal elevator shutdown (OCC) to the local. The state machine remains in the occupied 2 state until the door open variable is detected true which results in a transition from the occupied 2 state 1258 to the car door open state 1144 as indicated by a transitional line 1264. This transition generates the transmittal of a message to the local of alarm condition corrected (CLR).

[0081] The state machine described herein performs the functions of monitoring normal elevator performance. Contained within the state diagram of Fig. 2 are numbered hexagons. These hexagons represent the enabling and disabling of timers and counters for the accumulation of performance data. Entrance into abnormal elevator conditions as designated by inoperative conditions or the occurrence of entrance into occupied wait conditions will, in general, disable the accumulation of performance data associated with the state of the car. This is to prevent excessive counting of elevator demand time, run time, etc., as a result of an abnormal elevator shutdown. The functions of the various timers and counters as represented by the numbered hexagons of Fig. 8 are described more fully in Table IV which is self-explanatory when viewed in connection with Fig. 8 and the description below.

[0082] Upon a transition from the car idle state 1102 to the car call state 1106 a demand timer (notshown) begins accumulating time in seconds. This is indicated by hexagon 1 in Fig. 8. This timer will be disabled upon the transition from the car active to the car stop state as indicated by hexagon 2. The total accumulated demand time associated with a car is accumulated over the twenty-four hour period of performance monitoring (the normal period for performance monitoring).

[0083] Upon transition from the car ready state 118 to the car active state 1126 due to a brakelift, a machine run timer (not shown) begins the accumulation of time in seconds. The initiation of the machine run timer is indicated by hexagon 3. This timer is disabled upon the detection of a brakedrop as indicated by hexagon 4 as a result of a transition from the car active state 1126 to the car stop state 1136. The total machine run time for the elevator car is accumulated over the performance period of twenty-four hours. The number of runs for the elevator is accumulated by counting the transitions from car ready state 1118 to the car active state 1126.

[0084] Upon a transition from the car door open state 1144 to the car idle state 1102 as a result of detecting a hoistway door opening, a door operations counter (not shown) is incremented as indicated by hexagon 5. The total accumulation of door open operations is maintained over the performance period of twenty-four hours.

[0085] When the elevator doors close, a transition of the door open variable from a true to false value occurs. A door closed timer (not shown) begins incrementing time in seconds upon the occurrence of this transition as indicated by hexagon 6. Upon the transition from the car call state 1106 to the car ready state 1118 due to the detection of the hoistway door closing, this timer shall be inhibited as indicated by hexagon 7. The amount of accumulated time is then compared to the door close limit value for the elevator. In the event that this time is greater than the door closed limit time, a door closed exceedance is detected. This is added to an accumulated value for door closed ex- ceedances over the twenty-four performance monitoring period.

[0086] Any transition from the car ready state 1118 to the inoperative 3 state 1130 results in the incrementing of a slow brake counter (not shown) as indicated by hexagon 8. In this way, all occurrences of brakelifts of greater than fifteen seconds are counted over the performance period. The monitoring of this performance value will give an indication to the local office of an impending failure.

[0087] Any transition from the car stop state 1136 to the inoperative 4 state 1150 due to the failure of the door open actuator to open within five seconds results in the incrementing of a door open actuator failure counter (not shown) as indicated by hexagon 9. The total number of counts over the performance period shall in this way be monitored. This number gives an indication of an impending door open actuator failure.

[0088] Every transition from the car stopped state 1136 to the car parked state 1146 results in the incrementing of a car parked recognition counter (not shown) as indicated by hexagon 10. In this way excessive car parking for an elevator can be detected over the performance period measured.

[0089] Every transition from the car call state 106 to the inoperative 2 state 1122 results in the incrementing of a hoistway door closure failure counter (not shown), as indicated by hexagon 13. In this way, pending failure of a hoistway door closure shall be detected over the performance period.

[0090] Every transition from the car door open state 1144 to the inoperative 5 state 1156 due to the failure of the hoistway doors to open within twenty seconds results in the incrementing of the hoistway open door failure counter (not shown) as indicated by hexagon 14. In this way an impending failure of hoistway doors to open can be monitored over the performance period.

[0091] For all of the inoperative states, a value limit can be associated therewith. The exceedance of this limit by a counter may be set up to generate an alarm to the local office indicating the exceedance of the limit value specified. The purpose of this alarm is to alert the local office of a performance malfunction within an elevator prior to an actual elevator shutdown.

[0092] Upon entering the car door open state 1144, the state machine checks for a true master floor condition in order to perform a levelling check. In other words, one of the floors is selected as the master floor and a levelling check is performed each time the car stops at that floor. If levelling has occurred within established acceptability limits a levelling variable is set to a true value which indicates that the car has stopped within a fixed level distance of the floor landing. A failure to level at the master floor results in the incrementing of a levelling failure counter (not shown) as indicated by hexagon 11. In this way, levelling failures can be monitored over the performance period. On some elevator configurations it is desirable to measure levelling at all floor landings.

[0093] The number of one-floor runs for the elevator are accumulated on the transition into the car active state 1126. The detection of a one-floor run is accumulated over the performance period. This is indicated by hexagon 4.

[0094] The transition into the car idle state 1102 as a result of the hoistway door lock opening increments the door operation counter. This results in the accumulation of door operations over the performance period as indicated by hexagon 5.

[0095] It should be understood that although the present invention has been described in detail in connection with the remote elevator monitoring system of Figs. 1 through 8, the invention is not necessarily restricted thereto. For instance, the state machine described in Fig. 8 for use in the master 18 of Fig. 1 in a remote building 12 could easily be adapted to another type of operating system which operates in a manner which may be modeled in a state machine description similar to Fig. 8.

[0096] Thus, although the invention has been shown and described with respect to a preferred embodiment thereof, it should be understood by those skilled in the art that the foregoing and various other changes, and additions may be made therein without departing from the scope of the invention.

Claims

1. Apparatus for evaluating the performance of at least one remote operating system by monitoring the states of a plurality of two-state parameter signals provided by each monitored system, each parameter signal representative of a different one of a plurality of operating system performance parameters, said apparatus providing periodic performance messages indicative of the various operating conditions of each monitored system including inoperative conditions indicative of system degradation, said apparatus providing alarm messages indicative of system failures, comprising: remote signal processor means, responsive to said two-state parameter signals from its associated operating system(s), and having means for storing signals including said two-state parameter signals, and having means for comprising the states of parameter signals selected according to the present operating condition of each monitored system with stored signals indicative of transitions from said present operating condition to a subsequent operating condition for detecting such transitions, and for detecting transitions from said present operating condition to an inoperative condition, from an inoperative condition to an operative condition, from an inoperative condition to an alarm condition, and from an alarm condition to other than an alarm condition, said signal processor means having means for counting transitions between operating conditions of each monitored system and for counting transitions between operating conditions and inoperative conditions and for periodically providing performance signals indicative of detected transitions for each monitored system, said signal processor means having means for providing alarm signals for its associated operating system(s) indicative of detected transitions from inoperative conditions to alarm conditions.

2. Apparatus as claimed in claim 1 further comprising display means, responsive to said alarm signals for displaying alarm messages corresponding to each alarm condition detected in each monitored system, and responsive to said performance signals for displaying performance messages corresponding to said detected transitions in each monitored system.

3. Apparatus as claimed in claim 1 or 2, further comprising: remote communication element means, one for each remote signal processor means, responsive to said alarm signals for transmission thereof.

4. Apparatus as claimed in claim 3, further comprising at least one local communication element means, responsive to said alarm signals transmitted from at least one associated remote communication element means for providing each associated operating system's alarm signals; and at least one local display means responsive to said alarm signals from an associated local communication element means, for displaying alarm messages corresponding to each inoperative system condition detected in each of said associated operating systems.

5. Apparatus as claimed in claim 4, wherein the or each said local communication element means retransmits said alarm and performance signals, and further comprising: central communication element means, responsive to said retransmitted alarm signals from said local communication element means, for providing each operating system's alarm signals; and central display means, responsive to each operating system's alarm signals from said central communication element means, for displaying alarm messages corresponding to each inoperative system condition detected in each operating system.

Ansprüche

1. Vorrichtung zum Bewerten der Funktion wenigstens eines entfernten Betriebssystems durch Überwachen der Zustände von mehreren binären Parametersignalen, die von jedem überwachten Betriebssystem erzeugt werden, wobei jedes Parametersignal für einen anderen von mehreren Betriebssystem-Funktionsparametern repräsentativ ist, wobei die Vorrichtung periodische Funktionsmeldungen erzeugt, welche die verschiedenen Betriebszustände jedes überwachten Systems einschliesslich von eine Systemverschlechterung anzeigenden inoperativen Zuständen anzeigt, wobei die Vorrichtung Systemausfälle anzeigende Alarmmeldungen erzeugt, mit: einer entfernten Signalverarbeitungseinrichtung, die auf die binären Parametersignale aus dem oder den ihr zugeordneten Betriebssystem bzw. -systemen anspricht und eine Einrichtung zum Speichern von Signalen einschliesslich der binären Parametersignale sowie eine Einrichtung zum Vergleichen der Zustände von dem gegenwärtigen Betriebszustand jedes überwachten Systems entsprechend ausgewählten Parametersignalen mit Übergänge von dem gegenwärtigen Betriebszustand in einen folgenden Betriebszustand anzeigenden gespeicherten Signalen zum Erfassen solcher Übergänge und zum Erfassen von Übergängen von dem gegenwärtigen Betriebszustand in einen inoperativen Zustand, von einem inoperativen Zustand in einen operativen Zustand, von einem inoperativen Zustand in einen Alarmzustand und von einem Alarmzustand in einen von einem Alarmzustand verschiedenen Zustand aufweist, wobei die Signalverarbeitungseinrichtung eine Einrichtung zum Zählen von Übergängen zwischen Betriebszuständen jedes überwachten Systems und zum Zählen von Übergängen zwischen Betriebszuständen und inoperativen Zuständen sowie zum periodischen Erzeugen von Ausführungssignalen aufweist, welche erfasste Übergänge für jedes überwachte System anzeigen, wobei die Signalverarbeitungseinrichtung eine Einrichtung zum Erzeugen von Alarmsignalen für das oder die ihr zugeordnete Betriebssystem bzw. zugeordneten Betriebssysteme aufweist, welche erfasste Übergänge von inoperativen Zuständen in Alarmzustände anzeigen.

2. Vorrichtung wie in Anspruch 1 beansprucht, ausserdem mit einer Anzeigeeinrichtung, die zum Anzeigen von Alarmmeldungen entsprechend jedem in einem überwachten System erfassten Alarmzustand auf die Alarmsignale anspricht und zum Anzeigen von Funktionsmeldungen entsprechend der in jedem überwachten System erfassten Übergänge auf die Funktionssignale anspricht.

3. Vorrichtung wie in Anspruch 1 oder 2 beansprucht, ausserdem mit: einer entfernten Kommunikationselementeinrichtung für jede entfernte Signalverarbeitungseinrichtung, die auf die Alarmsignale zu ihrer Übertragung anspricht.

4. Vorrichtung wie in Anspruch 3 beansprucht, ausserdem mit wenigstens einer lokalen Kommunikationselementeinrichtung, die auf die von wenigstens einerzugeordneten entfernten Kommunikationselementeinrichtung übertragenen Alarmsignale anspricht, um Alarmsignale jedes zugeordneten Betriebssystems zu erzeugen, und mit wenigstens einer lokalen Anzeigeeinrichtung, die auf die Alarmsignale aus einer zugeordneten lokalen Kommunikationselementeinrichtung anspricht, um Alarmmeldungen anzuzeigen, die jedem inoperativen Systemzustand entsprechen, der in jedem derzugeordneten Betriebssysteme erfasst ist.

5. Vorrichtung wie in Anspruch 4 beansprucht, wobei die oder jede lokale Kommunikationselementeinrichtung die Alarm- und Funktionssignale rücküberführt und mit: einer zentralen Kommunikationselementeinrichtung, die auch auf die rück- überführten Alarmsignale aus der lokalen Kommunikationselementeinrichtung anspricht, um Alarmsignale jedes Betriebssystems zu erzeugen und einer zentralen Anzeigeeinrichtung, die auf die Alarmsignale jedes Betriebssystems aus der zentralen Kommunikationselementeinrichtung entspricht, um Alarmmeldungen anzuzeigen, die jedem inoperativen Systemzustand entsprechen, der in jedem Betriebssystem erfasst wird.

Revendications

1. Dispositif d'évaluation du fonctionnement d'au moins un système éloigné en exploitation par contrôle des états d'une série de signaux de paramètre à deux états fournis par chaque système contrôlé, chaque signal de paramètre représentant un paramètre différent parmi une série de paramètres de fonctionnement du système en exploitation, le dispositif fournissant des messages périodiques de fonctionnement indiquant les différentes conditions de fonctionnement de chaque système contrôlé y compris les conditions de non-fonctionnement indiquant une détérioration du système, le dispositif fournissant des messages d'alarme indiquant les défaillances du système, caractérisé en ce qu'il comprend des moyens éloignés de traitement de signal, sensibles aux signaux de paramètre à deux états provenant du ou des systèmes en fonctionnement associés et ayant des moyens pour enregistrer des signaux comprenant les signaux de paramètres à deux états et ayant des moyens pour comparer les états des signaux de paramètres choisis en fonction de la condition de fonctionnement actuelle de chaque système contrôlé avec des signaux enregistrés indiquant les transitions entre la présente condition de fonctionnement et une condition de fonctionnement ultérieure de manière à détecter ces transitions, et pour détecter les transitions entre la condition de fonctionnement actuelle et une condition de non-fonctionnement, entre une condition d'alarme et une condition autre que la condition d'alarme, ces moyens de traitement de signal comportant des moyens pour compter les transitions entre les conditions de fonctionnement de chaque système contrôlé et pour compter les transitions entre les conditions de fonctionnement et les conditions de non-fonctionnement et pour fournir périodiquement des signaux de fonctionnement indiquant les transitions détectées pour chaque système contrôlé, les moyens de traitement de signaux ayant des moyens pour fournir des signaux d'alarme pour son ou ses systèmes en fonctionnement associés indiquant les transitions détectées entre des conditions de non-fonctionnement et des conditions d'alarme.

2. Dispositif selon la revendication 1, comprenant en outre des moyens d'affichage, répondant aux signaux d'alarme pour afficher des messages d'alarme correspondant à chaque condition d'alarme détectée dans chaque système contrôlé et répondant auxdits signaux de fonctionnement pour afficher des messages de fonctionnement correspondant aux transitions détectées dans chaque système contrôlé.

3. Dispositif selon la revendication 1 ou 2, comprenant en outre des moyens de communication éloignés, un pour chaque moyen éloigné de traitement, répondant aux signaux d'alarme pour assurer leur transmission.

4. Dispositif selon la revendication 3, comprenant en outre des moyens locaux de communication sensibles aux signaux d'alarme transmis par au moins un des moyens éloignés de communication associés pour fournir les signaux d'alarme de chaque système en fonctionnement associé; et au moins des moyens locaux d'affichage répondant aux signaux d'alarme provenant d'un moyen local de communication associé, pour afficher des messages d'alarme correspondant à chaque condition de non-fonctionnement du système détectée dans chacun des systèmes en exploitation associés.

5. Dispositif selon la revendication 4, dans lequel le ou chacun des moyens locaux de communication retransmet les signaux d'alarme et de fonctionnement et comportant en outre des moyens centraux de communication, répondant aux signaux d'alarme retransmis par chaque moyen local de communication pour fournir les signaux d'alarme de chaque système en fonctionnement; et des moyens centraux d'affichage sensibles aux signaux d'alarme de chaque système en fonctionnement provenant du moyen de communication central, pour afficher des messages d'alarme correspondant à chaque condition de non-fonctionnement du système détectée dans chacun des systèmes en exploitation.

Drawing