The present invention relates to an elevator system and a method for controlling an elevator system.

Today's elevator systems comprise a monolithic software structure implemented by a single program for controlling the elevator. In these elevator systems, additional functions and specific elevator behavior can be integrated and tested only with high effort. Once having installed the original elevator system with the program, it is not easily possible to modify or add specific functions to the elevator system at a later point of time. Thus, a later technical modification of the elevator system is based on slow and complex configuration processes. US 2001/022252 A1 discloses an elevator system which allows a user to create a program that can be executed on an elevator by means of an interpreter.

Thus, it is an object of the present invention to technically improve and to simplify a configuration of an elevator system.

This object is solved by subject-matter according to the independent claims. Technically beneficial embodiments are subject to the dependent claims, the description and the drawings.

According to a first aspect this object is solved by an elevator system, comprising a replaceable software module for generating an elevator command and putting the elevator command in a command queue; and a basic software module for fetching the elevator command from the command queue and controlling the elevator on the basis of the elevator command. This elevator system has the technical advantage that it can be modified and configured easily, since a monolithic software structure is avoided. Instead one or more replaceable software modules can be used flexibly within the elevator system. However, the basic software module executes the elevator commands and enables a safe operation of the elevator system. The replaceable software modules form the functional part, whereas the basic software module forms the safety part of the control software of the elevator system. The basic software module and the replaceable software modules are coupled via the command queue as a data interface.

In a technically advantageous embodiment of the elevator system, the basic software module is adapted to control an elevator drive, an elevator brake, a door drive and/or an elevator cabin light. This yields the technical advantage that specific elevator features can be controlled by the basic software module on demand of the elevator commands.

In a further technically advantageous embodiment of the elevator system, the basic software module is adapted to test the elevator command before executing the elevator command. This yields the technical advantage that security is increased, and malfunctions can be avoided.

In a further technically advantageous embodiment of the elevator system, the basic software module is adapted to test whether the elevator command is within predefined execution limits. This yields the technical advantage that testing and admitting of elevator commands can be performed with low effort.

In a further technically advantageous embodiment of the elevator system, the basic software module is adapted to output a feedback message if an elevator command is not executed. This yields the technical advantage that a user is informed about non-execution.

In a further technically advantageous embodiment of the elevator system, the replaceable software module is adapted to assign a priority level to the elevator command. This yields the technical advantage that elevator commands can be executed in a defined priority order.

In a further technically advantageous embodiment of the elevator system, the basic software module is adapted to execute the elevator command based on the priority level. This yields also the technical advantage that elevator commands can be executed in a defined priority order.

In a further technically advantageous embodiment of the elevator system, the elevator system has a network interface for downloading a software module to be replaced. This yields the technical advantage that software modules can be replaced or updated easily with low technical effort.

In a further technically advantageous embodiment of the elevator the elevator system is adapted to re-sequence existing elevator commands within the command queue in dependence on the priority level of a newly inserted elevator command. This yields the technical advantage that elevator commands that are newly put in the command queue can be executed fist.

According to a second aspect, this object is solved by a method for operating an elevator system, comprising the steps of generating an elevator command by a replaceable software module; putting the elevator command in a command queue by the replaceable software module; fetching the elevator command from the command queue by a basic software module; and controlling the elevator on the basis of the elevator command by the basic software module. The same technical advantages are achieved by this method as by the elevator system according to the first aspect.

In a technically advantageous embodiment of the method, the basic software module controls an elevator drive, an elevator brake, a door drive and/or an elevator cabin light. This yields also the technical advantage that specific elevator features can be controlled by the basic software module on demand of the elevator commands.

In a further technically advantageous embodiment of the method, the basic software module tests the elevator command before executing the elevator command. This yields also the technical advantage that security is increased, and malfunctions can be avoided.

In a further technically advantageous embodiment of the method, the basic software module tests whether the elevator command is within predefined execution limits. This yields also the technical advantage that testing and admitting of elevator commands can be performed with low effort.

In a further technically advantageous embodiment of the method, the replaceable software module assigns a priority level to the elevator command. This yields also the technical advantage that elevator commands can be executed in a defined priority order.

In a further technically advantageous embodiment of the method, the basic software module executes the elevator command based on the priority level. This yields also the technical advantage that elevator commands can be executed in a defined priority order.

Specific embodiments are shown in the figures and are explained in the following.

Fig. 1

shows a systematic view of an elevator system;

Fig. 2

shows steps when setting and fetching elevator commands in a command queue;

Fig. 3

shows a structure of the elevator system; and

Fig. 4

shows a block diagram of a method for controlling an elevator system.

Fig. 1 shows a systematic view of an elevator system 100. The elevator system 100 serves for controlling and operating an elevator 107 that vertically moves people or goods between floors, levels or decks. Floors to move the elevator 107 to can be manually selected by pressing a corresponding button of the elevator system 100. The elevator 107 comprises fixtures 117.

The elevator system 100 has in general numerous technical features that can be subject to a technical control, like an elevator drive, an elevator brake, a door drive and/or an elevator cabin light. In general, also other features of the elevator system can be controlled in a specific manner.

Direct controlling is performed by a basic software module 101-2. To this end elevator commands 103, i.e. control commands, are used that are transmitted to the basic software module 101-2. The basic software module 101-2 processes the elevator commands 103 and performs an elevator control as requested within the elevator commands 103.

The elevator commands 103 are digital datasets describing the task to be executed by the elevator system 100. The elevator commands 103 define the requested elevator behavior. Elevator commands 103 comprise for example:

• driving commands / go to floor x:
• disable incoming requests;
• delete all current requests;
• switch on/off cabin light; and/or
• open/close elevator doors.

The elevator commands 103 are generated by various replaceable software modules 101-1 (App - Applications) that are executed based on a common underlying operating system. The software modules 101-1 can be embedded in the underlying operating system. The software modules 101-1 can be replaced and adapted easily to address specific demands of the elevator system 100.

Several software modules 101-1 can be active simultaneously in a multitasking fashion. Nevertheless, parallel execution of specific software modules 101-1 can also be set as inadmissible. In addition, an activation of software modules can be changed during normal operation of the elevator system 100. The replaceable software modules 101-1 (App) are supplemental and can be replaced and installed as individually required within the elevator system 100.

For example, one of the software modules 101-1 serves for receiving user requests for moving the elevator 107 to a particular floor, while another software module 101-1 serves for adapting and controlling cabin light of the elevator system 100. Each of the software modules 101-1 is independent from the others and generates specific elevator commands 103 based on incoming event objects 113, like cabin calls, floor calls, emergency calls or VIP calls or cloud calls. In addition, the elevator status can be considered by the software modules 101-1 for generating elevator commands 103, like elevator 107 moves upward, elevator 107 stands on floor X, or elevator 107 not available.

A command scheduler 109 takes the generated elevator commands 103 and puts the elevator command 103 in a command queue 105. The command queue 105 is a particular kind of data collection in which the elevator commands 103 in the collection are kept in order and the operations on the collection are the addition of elevator commands 103 to a selected position, known as enqueue, or removal of elevator command 103 from a position, known as dequeue. The command queue 105 is the data interface between the replaceable software modules 101-1 and the basic software module 101-2. Elevator commands 103 are passed from the software modules 101-1 via the command queue 105 to the basic software module 101-2. The command scheduler 109 is in connection with a connector 115.

The basic software module 101-2 takes the elevator command 103 from the command queue 105 and performs a controlling of the elevator 107 on the basis of the elevator command 103. The basic software module 101-2 determines whether the picked elevator command 103 can be executed or not, for example due to safety or operational reasons. If for example the doors of the elevator are open, a "goto" elevator command 103 is not executed. Therefore, all elevator command 103 are automatically examined within the basic software module 101-2 with respect to safety requirements.

If the elevator command 103 is not executed, the basic software module 101-2 generates and returns a corresponding feedback message (not acknowledge). This feedback message can be processed again by the corresponding software module 101-2 that generated the elevator command 103. In addition, a warning message can be output to a user.

Fig. 2 shows steps when setting in and fetching elevator commands 103 from the command queue 105. In response to a call event 111 the software modules 101-1 generates a "goto" elevator command 103.

The "goto" elevator command 103 is enqueued in the command queue 105 that already contains other elevator commands 103.

A priority level can be assigned to each elevator command 103. This priority level determines how and where the elevator command 103 is enqueued within the command queue 105 or the position of the elevator command 103 within the command queue 105. Existing elevator commands 103 within the command queue 105 can be re-sequenced in dependence on the priority level of a newly inserted elevator command 103. Re-sequencing can be performed in an increasing or decreasing order of the priority level within the command queue.

In this way, a priority and an order of the elevator command 103 within the command queue 105 can be established and maintained. If the elevator command 103, like the "goto" elevator command, is on the first position of the command queue 105 it is processed and executed by the basic software module 101-2. After being executed, the elevator command 103 is dequeued from the command queue 105. Then the next elevator command 103 is fetched from the command queue 105. In this way all elevator commands 103 are executed subsequently.

Fig. 3 shows a structure of the elevator system 100. Incoming events 113 given by signals trigger the software module 101-1 to generate the elevator command 103. The elevator command 103 is transferred to the command scheduler 109 that places the elevator command 103 in the requested order in the command queue 105 with the requested logic. From this command queue 105, the elevator commands 103 are transferred to the basic software module 101-2 that tests and executes the task as specified by the elevator command 103. After that, the basic software module 101-2 returns feedback and status information to the software module 101-1, like information on the successful execution.

Fig. 4 shows a block diagram of a method for controlling an elevator system 100. The method for operating an elevator system 100 comprises the step S101 of generating an elevator command 103 by a replaceable software module 101-1; the step S102 of putting the elevator command 103 in the command queue 105; the step S103 of fetching the elevator command 103 from the command queue 105 by a basic software module 101-2; and the step S104 of controlling the elevator 107 on the basis of the elevator command 103.

Generic functions, that are likewise requested by many software modules 101-1, like call acknowledgement, can again be implemented by special purpose software modules 101-1 also running on the underlying operating system and in communication with the command queue 105. Behavior of these special purpose software modules 101-1 can be controlled by means of transferring arguments or parameters. These special purpose software modules 101-1 can generate elevator commands 103 in dependence on the received arguments or parameters.

Replaceable software modules 101-1 can be downloaded via a network interface and can be installed within the elevator system in replacement or addition to existing software modules 101-1. The interface is for example an internet interface or a network interface for downloading software modules 101-1 from an external server.

Replaceable software modules 101-1 can be programmed and developed by independent suppliers. Local or individual adaptations to customers' needs can be carried out easily, while overall safety is maintained.

The software modules 101-1 and 101-2 can be executed as computer programs on a microcontroller of the elevator system 100 that has a processor for executing the instructions of the software modules 101-1 and 101-2 and a storage for storing the software modules 101-1 and 101-2 and the command queue 105.

All features discussed in the description or shown in the figures with respect to particular embodiments of the invention can be provided in various combinations in order to simultaneously realize the beneficial technical effects.

All method steps can be implemented by means that are adapted for carrying out the corresponding method step. All functions carried out by a specific structural feature can be a method step of a method.

The legal scope of protection of the present invention is defined by the claims and is not reduced by features discussed in the description or shown in the figures.

100

elevator system

101-1

replaceable software module

101-2

basic software module

103

elevator command

105

command queue

107

elevator

109

command scheduler

111

call event

113

event object

115

connector

117

fixture