ELEVATOR SAFETY SYSTEM, ELEVATOR SYSTEM, METHOD OF MONITORING A PASSAGEWAY IN AN ELEVATOR SYSTEM AND USE OF AN ELEVATOR SAFETY SYSTEM

Abstract

 An elevator safety system including a sensor and a controller. The sensor is configured for detecting entry events of at least one person entering a danger zone within an elevator shaft through a passageway, detecting exit events of the at least one person exiting the danger zone through the passageway, and providing a sensor signal indicative of the detected entry events and the detected exit events to the controller. The controller is configured for deriving, from the sensor signal, a presence indicator indicative of the presence of the at least one person within the danger zone.

Description

[0001] The present invention relates to the improvement of elevator safety, particularly during maintenance of an elevator system, with an elevator safety system and a method of monitoring a passageway in an elevator system. The invention particularly relates to an elevator safety system and method of monitoring with optical sensors. The elevator safety system and method provide a presence indicator indicative of the presence of persons within a danger zone of the elevator system.

[0002] Elevator systems typically include an elevator car movably provided in an elevator shaft. The installation, maintenance, inspection or repair of elevator systems may require a technician to enter the shaft, e.g. to access the elevator car roof or the shaft pit. Typically, the elevator system is not operational during such maintenance intervals, or may only be operated in a maintenance mode allowing only limited operation of the elevator system, e.g. with a reduced speed and limited motion.

[0003] Potential safety risks to persons present in these danger zones may arise when the elevator car or other components of the elevator system, such as doors, cables, counterweights or such start moving unexpectedly. Thus, inspection or emergency switches may be provided on the top of the elevator car or in the pit for disabling the elevator system while the technician is present in these danger zones, or for stopping the elevator system if an unexpected movement occurs. The elevator system may further include mechanical and/or electrical safety measures that prevent the elevator car from fully entering the shaft pit or the shaft top while in the maintenance mode.

[0004] While such measures generally improve the safety of the elevator system during maintenance, potentially dangerous situations may still occur if the elevator system, e.g. after performing the maintenance, is brought back in operation while one or more persons remain in a danger zone. Such situations may arise, for example, when teams of technicians are not aware of a remaining team member still being present in the danger zone, or if an unauthorized person gains access to the danger zone.

[0005] Detection systems for directly monitoring the danger zones with optical sensors are known. Such detection systems may be difficult to set up and require extensive calibration to avoid the generation of false-positive signals. Furthermore, the sensors may have blind spots that require adding redundancy, i.e. extra sensors covering the blind spot, thereby increasing the complexity of the system.

[0006] Thus, there is a need for reliably ensuing that the danger zones of an elevator system are safe, while reducing the cost and complexity of the safety system. The system and method described herein may solve these problems at least in part.

[0007] According to an aspect, an elevator safety system is provided. The elevator safety system includes a sensor and a controller. The sensor is configured for detecting entry events of at least one person entering a danger zone within an elevator shaft through a passageway, detecting exit events of the at least one person exiting the danger zone through the passageway, and providing a sensor signal indicative of the detected entry events and the detected exit events to the controller. The controller is configured for deriving, from the sensor signal, a presence indicator indicative of the presence of the at least one person within the danger zone.

[0008] According to an aspect, a method of monitoring a passageway in an elevator system is provided. The passageway provides access for a person to a danger zone within an elevator shaft. The method includes detecting, with a sensor, entry events of at least one person entering the danger zone, and detecting, with the sensor, exit events of the at least one person exiting the danger zone through the passageway. Detecting the entry events or the exit events comprises detecting a direction of the at least one person traversing the passageway. The method further includes deriving, from the entry events and exit events, a presence indicator indicative of the presence of the at least one person within the danger zone.

[0009] According to an aspect, a use of an elevator safety system according to embodiments described herein in an elevator system, particularly according to a method according to embodiments described herein, is provided.

[0010] According to an aspect, the elevator safety system may be configured for monitoring a passageway. The passageway may be any type of opening, particularly an opening suitable for the entry and exit of persons. The passageway may be, for example, a door, such as a landing door, a hatch, such as a hatch provided in the roof of an elevator car, an access port providing access to the elevator shaft, or the like. The passageway may, e.g. physically, architectonically, or even by designation through markers, signs, caution tape or the like, separate a first space from a second space. The passageway may not require the presence of physical features such as doors or barriers, e.g. the passageway may be a virtual border between a first space and a second space. The passageway may be defined or definable by the elevator safety system, i.e. by being monitored by the elevator safety system. The passageway may provide an entry point to a danger zone within the elevator shaft. In some cases, the passageway may provide access to the danger zone conditionally, e.g. a landing door may allow access to a danger zone such as the elevator pit or the elevator car roof only if the elevator car is positioned accordingly, and not lead to the danger zone if the car is positioned to be entered by a passenger through the landing door. According to an aspect, the passageway may be defined by the position of the sensor and thus be mobile in relation to the elevator system in cases where the sensor is provided on a mobile part of the elevator system, such as the elevator car, particularly the elevator car roof.

[0011] According to an aspect, a danger zone may be any zone, area or volume within the elevator shaft, particularly a zone that is not intended to be accessed by persons, e.g. passengers, during the normal operation of the elevator system. The inside of the elevator car, when in a state suitable for passenger transport, such as a normal operating state, is generally not considered a danger zone during normal operation of the elevator system, however, the inside of the elevator car may be considered a danger zone under certain conditions, such as during construction, maintenance, and/or refurbishment of the elevator system, or particularly if the elevator system is not considered safe for the transport of passengers. Typical examples for a danger zone include, but are not limited to, the shaft pit, i.e. the lowest point in the elevator shaft or the volume of the shaft below the elevator car, the elevator car roof, i.e. the area above the elevator car, or even the shaft top, i.e. the area below the top of the elevator shaft.

[0012] According to an aspect, one or more persons, such as construction workers, technicians, maintenance personnel, mechanics or the like may access the danger zone. Entering a danger zone as described herein may be described in the context of maintenance, however, any access by a person, independent of the function performed by the person, may beneficially be detected by the safety system and method provided herein. Typically, maintenance procedures include deactivating a normal operation mode of the elevator system. During maintenance, the elevator system may be, fully or in part, deactivated and/or be operated in a maintenance mode. A maintenance mode may, for example, only allow a movement of the elevator car at reduced speed. In the maintenance mode, the elevator car may be prevented, e.g. by mechanical and/or electrical safety systems, from entering positions that could potentially cause harm to a person in the danger zone. Typical maintenance procedure may include only reactivating the normal operation mode of the elevator system after the danger zones have been checked to be safe. However, in rare cases, even such safety protocols may be insufficient to prevent potential accidents. Thus, it is an object of the present disclosure to provide additional safety, and prevent potentially dangerous situations such as described above.

[0013] Further advantages, features, aspects and details that can be combined with embodiments described herein are evident from the dependent claims, the description and the drawings.

[0014] Reference will now be made in detail to the various embodiments, one or more examples of which are illustrated in the figures. Within the following description of the drawings, the same reference numbers refer to same components. Generally, only the differences with respect to individual embodiments are described. Each example is provided by way of explanation and is not meant as a limitation. Further, features illustrated or described as part of one embodiment can be used on or in conjunction with other embodiments to yield yet a further embodiment. It is intended that the description includes such modifications and variations.

Fig. 1 shows a schematic drawing of an elevator safety system according to embodiments;

Fig. 2 shows a schematic drawing of an elevator safety system according to embodiments provided in a passageway;

Fig. 3 shows a schematic drawing of an elevator system including elevator safety systems according to embodiments; and

Fig. 4 shows a method of monitoring a passageway in an elevator system according to embodiments.

[0015] In the following, embodiments of an elevator safety system, such as the elevator safety system 100, may be described with respect to their position and/or orientation, e.g. in an elevator system or in respect to a passageway. To help understand the embodiments described herein, the axes X, Y and Z are shown in Fig. 1 and 2, the directions of the axes being constant with respect to the orientation of the elevator safety system 100. The elevator safety system 100 is not limited to the shown positions or orientations and may be provided in different positions or orientations than those described herein.

[0016] Fig. 1 shows a schematic drawing of an elevator safety system 100 according to embodiments in a front view, i.e. along the X-axis. The elevator safety system 100 may be providable in the passageway, such as shown in further detail in Fig. 2 and Fig. 3, or define the passageway. The elevator safety system, and/or an elevator system including the elevator safety system 100, may define or even include the passageway.

[0017] The elevator safety system 100 includes a sensor 110 and a controller 120. The sensor 110 is configured for detecting entry events and exit events of persons entering or exiting a danger zone within an elevator system through a passageway. The sensor 110 may be configured for monitoring the passageway, a portion of a passageway, and/or a volume in space comprising the passageway, adjacent to the passageway or associated with the passageway. The sensor 110 may be configured for sensing within a sensed field of view. The sensed field of view may be defined by the detector modules 112, 114 included in the sensor.

[0018] According to embodiments, an entry event may include a person traversing a passageway in one direction, e.g. towards the danger zone, and an exit event may include a person traversing the passageway in the opposite direction, e.g. from the danger zone. Detecting an entry event may include determining that a person is traversing the passageway or has just traversed the passageway in a first direction, and detecting an exit event may include determining that a person is traversing or has just traversed the passageway in a second direction opposite the first direction. According to embodiments, particularly in cases where the passageway is a physical structure with a length along the passageway, such as a corridor or a shaft, it is not required to monitor the whole length of the passageway, so long as monitoring the passageway results in the reliable detection of a person traversing or having traversed the passageway. Likewise, monitoring a volume of space outside the passageway may be understood as monitoring the passageway, provided that traversing the passageway is not possible without traversing the monitored volume. For example, the sensor 110 may monitor a plane parallel to and translated outside of a door, hatch or opening, and a person traversing the door, hatch or opening cannot traverse the door, hatch or opening without traversing the monitored plane.

[0019] According to embodiments, it may be beneficial to define, e.g. by programming the controller 120, e.g. during setup of the elevator safety system, the first direction to be either an entry or an exit direction, i.e. to define which direction leads to and which direction leads from the danger zone. However, according to embodiments, such a definition may not be required, for example in situations where a single passageway provides access to the danger zone and where the passageway is monitored by a single elevator safety system 100 or sensor 110. In such cases, entry events and exit events may be monitored without knowing which direction of a traversal constitutes an entry and which direction constitutes an exit.

[0020] According to embodiments, the sensor 110 is an optical sensor, particularly a photoelectric sensor, particularly a diffuse photoelectric sensor and/or an infrared sensor. The photoelectric sensor may be a passive photoelectric sensor. The infrared sensor may be a passive infrared sensor. The sensor may also be an active photoelectric sensor comprising a light emitter, such as a light emitting diode or a laser emitter. The detector modules 112, 114 may be active or passive optical detector modules, particularly photoelectric detector modules, particularly diffuse photoelectric detector modules and/or (passive) infrared detector modules. The sensor 110 may be configured for optically detecting a person traversing the passageway, and particularly detect a direction of traversal of the person traversing the passageway. Each detector module 112, 114 may individually be configured for detecting the person traversing the passageway. Information about the direction of the person traversing the passageway, i.e. triggering the entry event or exit event, may be derivable from a combination of the signals provided by the individual detector modules.

[0021] According to embodiments, a diffuse photoelectric sensor or a passive infrared sensor may beneficially utilize radiation reflected or emitted from the person traversing the passageway. Accordingly, the elevator safety system may be conveniently installed at only one point, i.e. not require separate emitter and receiver or reflector units, e.g. for setting up a light barrier. Furthermore, particularly diffuse photoelectric sensors are known to be cost-effective and reliable. Active sensors, particularly laser reflective photoelectric sensors, may beneficially be applicable under a wide range of lighting conditions and have clearly defined sensing ranges, thus potentially reducing the detection of false-positive entry or exit events.

[0022] According to embodiments, the sensor may be a passage sensor with direction recognition, such as a known passage sensor with direction recognition. As shown in Fig. 1, the elevator safety system has two detector modules 112, 114. The detector modules 112, 114 may be spaced apart along a surface normal of the passageway. The detector modules 112, 114 may also be spaced apart a direction that is not exclusively a surface normal of the passageway, i.e. a direction of travel of a person along the passageway, provided that the detector modules 112, 114 are not spaced apart only in a direction parallel to the passageway, i.e. a direction that is not a direction of travel of a person along the passageway. In the elevator safety system shown in Fig. 1, and described in further detail with reference to Fig. 2, the detector modules 112, 114 are spaced apart along the Y-direction. The detector modules 112, 114 may each be configured for monitoring a detection field. The detection field may be a defined volume in space, e.g. as shown in Fig. 2. Each of the detector modules 112, 114 may be configured for monitoring an obstruction within the detection field. Monitoring an obstruction may be understood as monitoring the detection field and generating a signal, the signal indicating if an obstruction is detected. For example, the detector modules 112, 114 may generate a baseline signal, such as a voltage, if no obstruction is detected, and a detection of the obstruction may result in a change of the baseline signal, e.g. the voltage.

[0023] Accordingly, a person traversing a detection field may create an obstruction, and be detectable by the detector modules 112, 114. A person being detected by the detector modules 112, 114 traveling along the Y-direction may first be detected by a first detector module, e.g. detector module 112, and be later in time detected by a second detector module, e.g. detector module 114. Thus, an entry event and/or an exit may be identified by the sequence of detections of the detector modules 112, 114.

[0024] According to embodiments, the elevator safety system 100 may include more than two detector modules. As shown in Fig. 1, if a passageway is traversed by a person along the Z direction, the detector modules 112, 114 would potentially not detect a time offset, and the sensor signal may not be indicative of whether the detected traversal is an entry event or an exit event. Thus, one or more additional detector modules may be provided, e.g. along the Z-axis. This may beneficially allow the use of the elevator safety system in difficult architectural situations and/or reduce potential installation errors, e.g. prevent the installation of the elevator safety system such that the detector modules are not spaced apart along a surface normal of the passageway.

[0025] Referring now to Fig. 2, the elevator safety system 100 provided in a passageway 210 is shown in two views A and B. In the example, the passageway 210 is an open volume having at least one wall 212. The elevator safety system 100 is provided on the wall 212, e.g. by being mounted to the wall 212. In the example shown in Fig. 2B, the wall 212 is drawn as being less wide than the elevator safety system 100, which may be the case if the passageway is e.g. a door, and the elevator safety system 100 is installed on the inside of the doorframe, the doorframe being the wall 212. However, this is not to be understood as a limitation, e.g. if the passageway 210 is a corridor, the wall 212 may be wider than the elevator safety system 100. Likewise, the elevator safety system 100 is not limited to having any particular shape, such as the cube-like shape shown in Fig. 2, and the elevator safety system 100 is not limited to extend from the wall 212 as shown in Fig. 2, i.e. the elevator safety system 100 may be essentially flush with the wall or be provided in a recess or pocket inside the wall. Furthermore, the elevator safety system 100 is not limited to being provided directly inside the passageway, as is shown in Fig. 2B, i.e. the elevator safety system 100 may also be provided, for example, on either side of the wall 212 spanning the X/Z plane, i.e. offset along the Y direction, and/or even be recessed along the X direction, e.g. to be flush with the passageway.

[0026] As shown in Fig. 2, each detector module 112, 114 defines a detection field 220. The detection field 220 is the field inside which a detector module 112, 114 may detect an obstruction, and no obstruction is detectable outside of the detection field 220. The detection field 220 is drawn with a limited range in Fig. 2A, however, the detection field may typically have a range spanning at least the width of a passageway in a typical elevator installation, such as at least 1 m, at least 2 m, at least 3 m, at least 5 m or even at least 10 m. The detection field 220 may be definable by a three-dimensional shape projecting from the detector modules 112, 114 and is not limited to any particular shape, however, beneficially, the detection fields 220 of each detector module 112, 114, e.g. the shape of the detection field, may be essentially identical, particularly to prevent an earlier triggering of one of the detector modules 112, 114 due to a wider detection field of one detector module 112, 114. In the example shown in Fig. 2, the detection fields are planes along the X/Z direction projecting outwards from each detector module 112, 114 at an angle. The angle may be at least 50°, at least 60°, at least 90° or even at least 120°. The angle may cover up to 180°, such as up to 170° or up to 160°. For example, the angle may be in a range of 120° to 180°, or 90° to 170°, or 60° to 160°. The detection fields 220 may be essentially symmetrical along the X direction, i.e. be symmetrical along the direction defined by the mounting position of the elevator safety system 100. The detection fields 220 may also be asymmetrical, i.e. be offset at an angle with respect to the X direction, i.e. angled along the Y axis, e.g. at an angle of up to 10°, up to 20°, up to 30° or even up to 40°. Thus, the elevator safety system may be installable at a low or high point in the passageway, e.g. a corner of the passageway, and still fully monitor the passageway, thus beneficially preventing any blind spots. As shown in Fig. 2B, the detection fields may be planes, i.e. cover an angle of essentially 0° along the Y direction. According to embodiments, the angle of the detection fields along the Y direction, i.e. the direction along which the detector modules are spaced apart, may also be larger than essentially 0°, such as up to 5°, up to 10° or even up to 15°. Beneficially, a small angle fanning out the detection field 220 along the Y direction allows a better detection of entry events and exit events, since this may result in a clearer identification of the time offset of an obstruction within the detection fields. However, a larger angle along the Y direction may be mitigated by clearly defining the borders of the detection fields, particularly along the Y direction, and/or by advanced signal processing, e.g. by the controller 120. Allowing a larger angle of the detection field 220 along the Y direction may reduce the complexity, such as the complexity of the optical components, of the detector modules.

[0027] Referring again to Fig. 1, the sensor 110 is configured for providing a sensor signal indicative of the detected entry events and the detected exit events to the controller 120, as indicated in Fig. 1 by the line communicatively connecting the sensor 110 and the controller 120. The sensor signal may be a digital or binary signal, or an analog signal, such as a voltage signal, a current signal, or the like. The sensor signal may comprise raw data provided by the sensor 110, and be evaluated by the controller 120. For example, if the sensor includes one or more detector modules, such as the detector modules 112, 114, each detector module may provide a separate signal, and/or the separate signals may be combined into a sensor signal.

[0028] According to embodiments, the controller 120 may include one or more converters, such as analog-to-digital converters (A/D converters), for converting an analog sensor signal into a digital signal to be further processed by the controller. The controller 120 may include a processing unit, such as a microprocessor, a microcontroller, a microcomputer, or the like, particularly for processing the sensor signal. The controller may be configured for automatically removing signal jitter, such as signal jitter potentially occurring during a transition from a state in which no obstruction is detected in the detection field, to a state in which a clearly detectable obstruction is detected in the detection field. The controller may include a memory, such as a data memory, for having stored therein a set of instructions, such as a computer program, for performing, when executed on the controller 120, the functions described herein, particularly according to an embodiment of a method described herein.

[0029] The controller 120 is configured for deriving, from the sensor signal, a presence indicator indicative of the presence of a person, or a number of persons, such as at least one person, within the danger zone. The controller 120 may be configured for deriving, from the sensor signal, if an entry event or an exit event was detected. Particularly based on the time-offset of an obstruction detected independently by the detector modules 112, 114, the direction of travel of the person may be determined. As described above, the controller 120 may also identify entry and/or exit events without being aware if the event corresponds to an entry event or an exit event. In such cases, the controller 120 may identify an event that corresponds to the traversal of the passageway in a first direction, and register it as a first event, and identify an event that corresponds to the traversal of the passageway in a second direction opposite the first direction, and register it as a second event. The controller may be configured for determining, from the sensor signal, if either of the detector modules 112, 114 provided a signal before the other one of the detector modules 112, 114. For example, a person traveling along the Y-direction may first trigger the detector module 112 and, shortly after, trigger the detector module 114. Likewise, if the person proceeds to travel along the Y-direction, the detector module 112 may be un-triggered before the detector module 114 is un-triggered. The controller 120 may be configured for determining, from the sequence of trigger events and/or un-trigger events, or even from a combination of trigger and un-trigger events detected by the detector modules 112, 114 and provided as the sensor signal to the controller, if the recorded event was an entry event or an exit event, or a first event or a second event.

[0030] According to embodiments, the controller 120 may include a counter. The counter may increase for each entry event or first event, and decrease for each exit event or second event. The counter may be implemented as a counting software to be executed by the controller 120, e.g. by a processor. The counter values may be stored in a hardware, such as a memory. The controller may be configured for deriving a presence indicator from the counter. A counter value other than an initial counter value, for example the value 0, indicative of no persons present in the danger zone, may indicate that a person is present in the danger zone. Thus, the presence indicator may be, directly or indirectly, derived from the counter value, for example, any value other than 0 may indicate the presence of at least one person in the danger zone. For example, when the initial counter value is 0, if a person enters the danger zone through the passageway, the counter may increase or decrease, i.e. have a value of 1 or -1, and thus indicate the presence of the person. If the person then exits the danger zone through the passageway, the counter may decrease or increase, i.e. contrary to the increase or decrease of the entry of the person, and the counter value may revert back to 0. Accordingly, a presence indicator may be, directly or indirectly, derived from the counter, and the counter may both be an entry event counter and an exit event counter.

[0031] According to embodiments, the controller 120 may include two counters. A first counter may increase with each entry event or first event, and a second counter may increase with each exit event or second event. The first counter and/or the second counter may be implemented as a counting software to be executed by the controller 120, e.g. by a processor. The first counter values and/or the second counter values may be stored in a hardware, such as a memory. A counter value of the first counter being different to a counter value of the second counter may indicate that a person is present in the danger zone. Thus, the presence indicator may be derived, directly or indirectly, by comparing the two counters, e.g. by subtracting the first counter value from the second counter value, or by utilizing other mathematical or logical operations, such as boolean operations, that indicate if the counter values are identical. For example, in an initial state the counter values of the first counter and the second counter may be identical. If a person enters the danger zone through the passageway, the counter value of the first counter (or the second counter) may increase. Thus, an operation comparing the first counter to the second counter indicates that the counter values are not identical, and the presence indicator derivable from this comparison may indicate that a person is present in the danger zone. After the person exits the danger zone through the passageway, the value of the second counter (or the first counter) may increase, and a comparison between the values of the first counter and the second counter will indicate that no persons are present in the danger zone. Accordingly, a presence indicator may be, directly or indirectly, derived from the counters, the counters being an entry event counter and an exit event counter.

[0032] According to embodiments, the controller 120 may include a log. Each entry event, exit event, first event and/or second event may be logged in the log by the controller 120. The log may include the event type, the time of the event, and/or further data. The controller 120 may include an evaluator for evaluating the log, e.g. for determining the number of entry events, exit events, first events and/or second events from the log. The log may be stored in a hardware, such as a memory. The evaluator may be implemented as a software to be executed by the controller 120, e.g. by a processor. The evaluator may be configured for counting entry events, exit events, first events and/or second events. A presence indicator may be derived, by the evaluator evaluating on the log, as described herein according to embodiments utilizing counters. Beneficially, the evaluator may be configured for excluding log entries from evaluation e.g. according to data stored in the log, e.g. old entries, such as entries logged before a start of a maintenance period, may not be evaluated. Thus, the likelihood of false-positive results and/or the generation of persistent errors may be reduced. Accordingly, the evaluator may be an entry event counter and an exit event counter.

[0033] According to embodiments, the controller 120 may be configured for determining a safety state indicator based on the presence indicator. The safety state indicator may indicate a safe state under the condition that the presence indicator indicates the presence of no persons within the danger zone. The safety state indicator may be a binary signal, i.e. indicate either a safe state or an unsafe state. The safety state indicator may be directly or indirectly derived from the presence indicator, e.g. a safety state indicator may only indicate a safe state if the presence indicator indicates the presence of no persons within the danger zone, and indicate an unsafe state for all other cases, particularly if one or more persons are indicated to be present, or even if an impossible number of persons is indicated to be present, such as a negative number of persons. The safety state indicator may further include additional information, such as the number of persons currently present within the danger zone.

[0034] According to embodiments, as shown in Fig. 1, the elevator safety system 100 may include a communication module 130 for communicatively connecting the controller 120 to an elevator controller. The controller 120 may be communicatively connectable to an elevator controller, such as the elevator controller 310 shown in Fig. 3.

[0035] According to embodiments, the controller 120 may be configured for blocking the normal operation of an elevator system, particularly an elevator system including the elevator safety system 100 being communicatively connected with the elevator safety system 100, based on the safety state indicator indicating an unsafe state. For example, the elevator safety system 100 may provide the safety state indicator or an indicator derived from the safety state indicator to the elevator system, and the elevator system may be configured for not allowing a transition into a normal operating state of the elevator system unless the safety state indicator indicates a safe state. For example, a blocking signal may be provided by the elevator safety system 100 for the duration that the safety state indicator indicates an unsafe state, or a confirmation signal may only be provided by the elevator safety system 100 if the safety state indicator indicates a safe state.

[0036] According to embodiments, a value indicative of the number of persons present in the danger zone, such as a counter value described above, may be provided to the elevator system. The safety state indicator may include the value indicative of the number of persons present in the danger zone. This may beneficially allow the elevator system, e.g. a controller of the elevator system, to determine if a person has entered a danger zone through a first passageway being monitored by a first elevator safety system, and left the danger zone through a second passageway being monitored by a second elevator safety system. Such events may be identifiable particularly in cases where both the first and the second elevator safety systems are aware of the direction of the danger zone, i.e. are configured for identifying entries into the danger zone as entry events and exits from the danger zone as exit events, and are configured for determining and providing presence indicators indicative of negative presence numbers, i.e. in the example described above, the first elevator safety system may indicate the presence of +1 persons in the danger zone, and the second elevator safety system may indicate the presence of -1 persons in the danger zone. The elevator system may then, e.g. following a confirmation by a technician, revert back to normal operation, even while the first and the second elevator safety system indicate an unsafe state.

[0037] Referring now to Fig. 3, an elevator system 300 according to an embodiment is described. The elevator system 300 includes an elevator shaft and an elevator car 320 movably provided within the elevator shaft. Some components of the elevator system 300, such as a driving mechanism, were omitted in the drawing for clarity. The elevator system 300 has three landings with landing doors 330, 332, 334 on different levels of the elevator system, however, the number of levels and/or landing doors is not limited to the example shown in Fig. 3. Particularly, the invention may be at least equally suitable for elevator systems having more or less than three levels and/or landings, and elevator systems having more than one landing door per level.

[0038] A hatch 322 is provided in the roof of the elevator car 320, which may be traversed, e.g. by a technician, as a passageway to reach the elevator car roof. Likewise, the landing door 334 may be used as a passageway to reach the elevator car roof. The landing door 330 may be used as a passageway to reach the shaft pit. If the elevator car 320 were positioned adjacent to landing door 330, the landing door 332 may be used as a passageway to reach the elevator car door, i.e. the shown configuration is only one of multiple alternatives.

[0039] Each of the shown potential passageways, i.e. the landing doors 330 and 334, as well as the hatch 322, have an elevator safety system 100a-c provided thereby. Further elevator safety systems (not shown) may be provided, e.g. by the landing door 332, or any other passageway of the elevator system 300. The elevator safety systems 100a-c are not drawn to scale and have been largened in the drawing for clarity, i.e. the elevator system 300 according to embodiments may include elevator safety systems of a size significantly lower than depicted in Fig. 3. The elevator safety systems 100a-c may be an elevator safety system according to embodiments described herein, such as the elevator safety system 100 shown in Fig. 1 and Fig. 2. Each of the elevator safety systems 100a-c have a sensed field of view, such as at least one detection field, e.g. at least two detection fields, such as the detection fields 220 shown in Fig. 2, for monitoring the passageway. The detection fields of the elevator safety systems 100a and 100c are configured for monitoring a traversal of the passageway along the horizontal direction, and the detection fields of the elevator safety system 100b is configured for monitoring a traversal along the vertical direction.

[0040] As shown in Fig. 3, according to embodiments, the elevator system 300 includes an elevator controller 310. The elevator controller 310 and the elevator safety systems 100a-c are communicatively connected, as shown by the dotted line between each elevator safety system 100a-c and the elevator controller 310. The connection may be a wireless connection, such as a wireless network connection, i.e. the elevator safety systems 100a-c may include a communication module 130 configured for wireless communication, and/or the connection may be wire-based, such as a wired network connection, i.e. the elevator safety systems 100a-c may include a communication module 130 configured for wired communication. The communication module may be a module configured for wireless and/or wire-based communication, such as an ethernet module or a WLAN-module.

[0041] According to embodiments, the elevator safety systems 100a-c may be permanently activated and send information, such as the safety state indicator, to the elevator controller 310. Alternatively, the elevator safety systems 100a-c may be selectively activated, e.g. by receiving an activation signal from the controller when a maintenance mode is entered. The elevator controller 310 may include elevator layout information, including information indicative of the position of the elevator safety systems 100a-c, and the danger zones 340, 342 and potential passageways associated with the respective elevator safety system 100a-c in the position of the elevator car. The layout information may be dynamic, e.g. dependent on the position of the elevator car 320. The layout information may be provided, e.g. by a display device communicatively connected to the elevator controller 310, to a service technician during maintenance, and may be modifiable by the service technician.

[0042] According to embodiments, the elevator system 300 shown in Fig. 3 may be in a maintenance mode, e.g. a mode entered after a service technician has provided an instruction to enter the maintenance mode to the elevator controller 310. The mode of the elevator system 300, particularly the maintenance mode and/or a normal operation mode suitable for passenger transport, may be controlled by the elevator controller 310. Entering the maintenance mode may include stopping the elevator car 320 in a defined position, such as next to landing door 332, preventing any further movement of the elevator car 320 until the maintenance mode is exited, unlocking potential passageways for entering the first and second danger zones 340, 342 and/or activating the elevator safety systems 100a-c. Alternatively, the maintenance mode may allow the service technician to control the elevator car 320 to move at limited speed, e.g. while the service technician is standing on the elevator car roof. Entering the maintenance mode may further include activating and/or resetting the elevator safety systems 100a-c, such as e.g. by sending a reset signal, the reset signal causing the elevator safety systems to reset e.g. any counters, storing a "maintenance start" log entry in a log or the like. After being activated and/or reset, the elevator safety systems 100a-c may be in a state indicating no persons present in the danger zone, and the elevator safety systems 100a-c may begin monitoring the passageways.

[0043] Alternatively, the elevator safety systems 100a-c may not be reset and/or permanently activated, and the safety state indicator comprising a current value derived from the presence indicator, such as e.g. a counter value, may be communicated to the elevator controller 310. The elevator controller may store the value, and determine the current counter value to correspond to a safe state indicating that no persons are present in the danger zone.

[0044] According to an embodiment, the elevator system 300 may include one or more elevator safety systems 100 according to embodiments described herein. The elevator system 300 may include an elevator shaft with a pit, a plurality of landing doors 330, 332, 334 provided along the elevator shaft, the plurality of landing doors 330, 332, 334 including a lowest landing door 330 closest to the pit. The lowest landing door 330 may include a passageway, and the pit may include the danger zone 340.

[0045] According to an embodiment, the elevator system 300 may include one or more elevator safety systems 100 according to embodiments described herein. The elevator system 300 may include an elevator shaft, and an elevator car 320 movably provided within the elevator shaft. The elevator car 320 may include an elevator car roof. The elevator car roof may include a hatch 322. The hatch 322 may include the passageway. The space above the elevator car roof may include the danger zone 342.

[0046] According to an embodiment, the elevator system 300 may include one or more elevator safety systems 100 according to embodiments described herein. The elevator system 300 may include an elevator shaft, and an elevator car 320 movably provided within the elevator shaft. The elevator system 300 may include a plurality of landing doors 330, 332 provided along the elevator shaft. A landing door of the plurality of landing doors 330, 332 may include the passageway. The space above the elevator car roof may include the danger zone 342.

[0047] According to beneficial embodiments, combinations of one or more elevator safety systems 100 provided at different types of passageways of an elevator system 300 may be provided.

[0048] As shown in Fig. 3, the elevator system 300 has two danger zones 340 and 342. The shaft pit is a first danger zone 340, and the elevator car roof, i.e. the area above the elevator car 320, is a second danger zone 342. While the first danger zone 340 may generally be static, it may not be accessible in cases where the elevator car 320 resides on the lowest level. The second danger zone 342 generally changes with the position of the elevator car 320 within the shaft. Accordingly, in embodiments where the second danger zone 342 may be entered through several landing doors on different levels, multiple passageways may be present and multiple elevator safety systems such as elevator safety system 100c may be provided, e.g. for several landing doors or each landing door. Generally, for each maintenance operation, the elevator car may be stationary throughout the maintenance operation, and thus only one of the landing doors 332, 334 may be useable as a passageway, however, providing an elevator safety system for more than one or even each landing door may beneficially allow the second danger zone 342 to be entered more safely, due to several or all potential passageways being monitored by an elevator safety system. This may beneficially increase the flexibility of the maintenance operation, since the elevator car roof may be safely accessed from any level.

[0049] According to embodiments, particularly in cases where the service technician can operate the elevator car during maintenance to move along the passageway, the service technician may enter the second danger zone, such as danger zone 342, through a first landing door and exit the second danger zone through a second landing door, e.g. on a different level. In the embodiment, several passageways, such as at least two passageways, may be present and each passageway may be monitored by an elevator safety system 100.

[0050] In the example shown in Fig. 3, only one passageway is present for entering the pit, i.e. the danger zone 340. Thus, the elevator safety system 100a is not required to be aware which direction of entry constitutes an entry event or an exit event. A presence indicator may be derived from determining that a person has traversed the passageway through landing door 330 in a first direction, after which the safety state indicator would indicate the presence of at least one person within the danger zone. A second person subsequently traversing the passageway in the first direction would, again, result in an entry event of a person, and the presence indicator would indicate the presence of two persons within the danger zone. Both persons leaving the danger zone through the passageway, i.e. in a second direction opposite the first direction, would result in the detection of two exit events, and thus result in a presence indicator indicating that no persons are present in the danger zone, and a safety state indicator would indicate a safe state. Likewise, this may be applicable for any danger zone in an elevator system, such as the elevator system 300, having only one passageway.

[0051] In the example shown in Fig. 3, two passageways are available for entering and exiting the danger zone 342, the hatch 322 and the landing door 334. For example, a person may enter the danger zone 342 through one passageway and exit the danger zone through another passageway. Accordingly, reliably determining a presence indicator may require the associated elevator safety systems 100b and 100c to be aware of which direction of traversal constitutes an entry event, and which direction constitutes an exit event. The elevator safety systems 100b and 100c may be configured or configurable accordingly, i.e. programmed during installation, or be configured for being installed or mounted in a predetermined manner, e.g. such that an indicator provided on the housing of the elevator safety system 100b, 100c points towards the danger zone. Furthermore, the elevator system 300, particularly the elevator controller 310, may be configured for further processing of the data provided by the elevator safety systems 100b and 100c during the maintenance procedure.

[0052] In the example stated above, with a person entering through the landing door 334 and exiting through the hatch 322, the elevator safety system 100c would indicate that a person has entered the danger zone 342, thus, the presence indicator of elevator safety system 100c would indicate the presence of one person and the safety state indicator would indicate an unsafe state. The elevator safety system 100b would indicate that no person has entered the danger zone 342, but that one person has left the danger zone 342. Thus, the presence indicator would indicate the presence of -1 persons, and the safety state indicator would indicate an unsafe state.

[0053] According to embodiments, to determine if the danger zone 342 is in a safe state, the elevator safety systems 100b, 100c may provide the number of persons perceived to be within the danger zone to the elevator controller 310, i.e. a count of entry events and exit events, such as the presence indicator, with the safety state indicator. The elevator controller 310 may be configured to then, particularly based on layout information stored within the elevator controller 310, determine a safety state indicator based on the entry events and exit events recorded by both elevator safety systems 100b, 100c in a manner as described for each individual elevator safety system 100 herein, e.g. by comparing the combined number of entry events and exit events for the elevator safety systems 100b, 100c associated with the danger zone 342. For example, the presence indicators of the elevator safety systems 100b, 100c may be added, and an addition resulting in a value other than 0, or equal or higher than 1, may indicate a presence of at least one person in the danger zone.

[0054] According to embodiments, additionally, or alternatively, a function for combining the entry and exit events of more than one elevator safety system associated with a danger zone may be implemented in one or both of the elevator safety systems 100b, 100c, such as in the controller 120 of the elevator safety system 100b, 100c. The elevator controller 310 and/or a technician may, for example, provide the layout information, or an instruction derived from the layout information, to each of the elevator safety systems 100b, 100c, and the elevator safety systems 100b, 100c may be, based on the layout information or the instruction derived from the layout information, configured for communicating with each other to exchange data, such as a safety state indicator including the number of detected entry events and exit events, therebetween. The exchanged data may then be evaluated as described for a single elevator safety system, such as elevator safety system 100. For example, the entry and exit events associated with the first danger zone may be compared, and/or the entry and exit events associated with the second danger zone may be compared, to determine a safety state indicator for each of the zones. Additionally, or alternatively, all entry and exit events of both the first danger zone and the second danger zone may be compared for determining the safety state indicator.

[0055] While the elevator safety system 100 was described in the context of the exemplary elevator system 300 shown in Fig. 3, the elevator safety system 100 and the elevator system 300 are not limited to the specific embodiment. According to embodiments, an elevator system such as the elevator system 300 may be devoid of a hatch 322. The service technician may enter and exit the second danger zone 342 through the landing doors having an elevator safety system 100, such as landing doors 332 or 334. The service technician may enter and exit through the same landing door, or enter through a first landing door and exit through a second landing door. For example, the elevator car may move to a different level during maintenance, and the service technician may enter the second danger zone 342 on a first level and exit the second danger zone on a second level different to the first level. In another example, the elevator system may have multiple landing doors on the same level, and the maintenance technician may enter the first danger zone and/or the second danger zone through a first landing door and exit the second danger zone through a second landing door on the same level. An elevator safety system, or a plurality of elevator safety systems, may, according to the embodiment, be operated as described with reference to the elevator system 300. Particularly, the entry events and exit events of the more than one elevator safety system may be combined, as described for elevator safety systems 100b, 100c.

[0056] According to embodiments, additionally or alternatively, one or more elevator safety systems, such as the elevator safety system 100, may be provided on the roof of the elevator car. The elevator safety system may move with the elevator car. Accordingly, the passageway may move, shift and/or change with the position of the elevator car, i.e. be dependent from the position of the elevator car within the shaft. The elevator safety system may be provided such that e.g. a service technician entering the second danger zone traverses a passageway defined, at least in part, by the elevator safety system. For example, the elevator safety system may monitor a space that, when the elevator car is positioned for allowing a service technician to access the elevator car roof through a landing door, the landing door through which the service technician may access the elevator car roof comprises the passageway. The elevator safety system may be provided, for example, on the floor of the elevator car roof. Additionally, or alternatively, the elevator car roof may comprise a balustrade, an opening in the balustrade for accessing the elevator car roof comprising the passageway. Accordingly, the elevator safety system may be configured for monitoring the opening in the balustrade. Beneficially, providing the elevator safety system on the roof of the elevator car may allow the use of a lower number of elevator safety systems, since it may be possible to monitor entry and exit events from different landing doors with a lower number of elevator safety systems.

[0057] Referring now to Fig. 4, a method 400 of monitoring a passageway in an elevator system is described. The passageway provides access for a person to a danger zone within an elevator shaft, and may be a passageway according to aspects and/or embodiments described herein. The elevator system may be an elevator system according to aspects and/or embodiments described herein, such as the elevator system 300. The method 400 may include monitoring a passageway, as described for an elevator safety system according to embodiments described herein, such as the elevator safety system 100. The method includes operations 410 and 420. Operation 410 includes detecting, with a sensor, such as the sensor 110, entry events of at least one person entering the danger zone. Operation 420 includes detecting, with the sensor, such as the sensor 110, exit events of at least one person exiting the danger zone. Detecting entry events and/or exit events includes detecting a direction of the at least one person traversing the passageway. In operation 430, a presence indicator is derived from the detected entry events and exit events. The presence indicator is indicative of the presence of the at least one person within the danger zone. The presence indicator may be derived as described for the elevator safety system 100, particularly the controller 120.

[0058] According to an embodiment, the method 400, particularly operation 430 deriving the presence indicator, may include counting a number of entry events with an entry event counter, and counting a number of exit events with an exit event counter. The entry event counter and the exit event counter may be separate counters, e.g. such as the counters described for the controller 120. The entry event counter and the exit event counter may be a combined counter, and the counter may, for example, be increased with each entry event and decreased with each exit event. The entry event counter and the exit event counter may be an evaluator, e.g. an evaluator configured for evaluating a log, as described for the controller 120.

[0059] According to embodiments, the method may include operation 440. In operation 440, the entry event counter and the exit event counter may be compared, and a presence indicator may be set. Under the condition that comparing the entry event counter and exit event counter indicates that the entry event counter and the exit event counter are not equal, the presence indicator may be set to indicate the presence of at least one person in the danger zone. For example, setting the presence indicator may include calculating, based on the counters, i.e. the number of entry events and exit events represented by the counters, the difference of the number of entry events and exit events, e.g. by subtracting the value of the exit event counter from the value of the exit event counter. The result of the calculation may represent the current number of persons present within the danger zone, and the presence indicator may represent the result, i.e. the number of persons present within the danger zone.

[0060] According to an embodiment, the method 400 may, particularly before executing operations 410 through 440, include providing the sensor. The sensor may be provided together with, for example, an elevator safety system according to aspects and/or embodiments described herein, such as the elevator safety system 100. Providing the sensor may include mounting an elevator safety system in a position suitable for monitoring a passageway. Providing the sensor may include communicatively connecting the elevator safety system to an elevator system, such as an elevator controller, such as the elevator controller 310. Providing the sensor may include providing the sensor such that the sensor has a sensed field of view, the sensed field of view comprising the passageway to be monitored by the sensor.

[0061] According to an embodiment, the method 400 may include monitoring more than one passageway through which a danger zone may be accessed. Monitoring more than one passageway may include detecting entry events and exit events with more than one sensor, particularly by providing a sensor for each passageway. The entry events and exit events of each sensor may be counted in combination by a single counter, particularly such that an entry event through either passageway is counted as an entry event, and such that an exit event through either passageway is counted as an exit event. The method may include communicatively connecting elevator safety systems including the sensors, and/or communicatively connecting the sensors to a device comprising the counters, such as an elevator controller 310.

[0062] While the invention has been described with reference to embodiments, the invention is not limited to any particular embodiment. Instead, any aspect described herein can be combined with any other aspect(s) or embodiments described herein unless specified otherwise, and the scope of the invention is defined by the claims that follow.

Claims

1. Elevator safety system (100), comprising

a sensor (110), and

a controller (120), wherein

the sensor (110) is configured for

detecting entry events of at least one person entering a danger zone (340, 342) within an elevator shaft through a passageway,

detecting exit events of the at least one person exiting the danger zone (340, 342) through the passageway, and

providing a sensor signal indicative of the detected entry events and the detected exit events to the controller (120), and wherein

the controller (120) is configured for deriving, from the sensor signal, a presence indicator indicative of the presence of the at least one person within the danger zone (340, 342).

2. The elevator safety system (100) according to claim 1, wherein

the controller (120) is configured for determining a safety state indicator based on the presence indicator, wherein

the safety state indicator indicates an unsafe state unless the presence indicator indicates the presence of no persons within the danger zone (340, 342).

3. The elevator safety system (100) according to claim 2, wherein
the controller (120) is configured for blocking the normal operation of an elevator system (300) based on the safety state indicator indicating an unsafe state.

4. The elevator safety system (100) according to any of the preceding claims, wherein the sensor (110) comprises a passage sensor with direction recognition.

5. The elevator safety system (100) according to any of the preceding claims, wherein the sensor (110) is an optical sensor, particularly a photoelectric sensor, particularly a diffuse photoelectric sensor or an infrared sensor.

6. The elevator safety system (100) according to any of the preceding claims, wherein

the sensor (110) comprises at least two detector modules (112, 114), wherein

the detector modules (112, 114) each define a detection field (220), and wherein

the detector modules (112, 114) are configured for monitoring an obstruction within the detection field (220), and wherein

the detector modules (112, 114) are spaced apart along a surface normal of the passageway.

7. The elevator safety system (100) according to any of the preceding claims, wherein the controller (120) is communicatively connected to an elevator controller (310), particularly wherein the elevator safety system (100) comprises a communication module (140) for communicatively connecting the controller (120) to the elevator controller (310).

8. Elevator system (300) comprising the elevator safety system (100) according to claims 1 to 7, the elevator system (300) further comprising

an elevator shaft with a pit,

a plurality of landing doors (330, 332, 334) provided along the elevator shaft, the plurality of landing doors (330, 332, 334) including a lowest landing door (330) closest to the pit, wherein

the lowest landing door (330) comprises the passageway, and

the pit comprises the danger zone (340).

9. Elevator system (300) comprising the elevator safety system (100) according to claims 1 to 7, the elevator system (300) further comprising,

an elevator shaft, and

an elevator car (320) movably provided within the elevator shaft, the elevator car (320) comprising an elevator car roof, wherein

the elevator car roof comprises a hatch (322), wherein the hatch (322) comprises the passageway, and/or

the elevator system (300) comprises a plurality of landing doors (332, 334) provided along the elevator shaft, wherein a landing door of the plurality of landing doors (332, 334) comprises the passageway, wherein

the space above the elevator car roof comprises the danger zone (342).

10. The elevator system (300) according to claims 8 and 9.

11. Method (400) of monitoring a passageway in an elevator system (300), the passageway providing access for a person to a danger zone (340, 342) within an elevator shaft, the method comprising:

detecting (410), with a sensor (110), entry events of at least one person entering the danger zone (340, 342), and

detecting (420), with the sensor (110), exit events of the at least one person exiting the danger zone (340, 342) through the passageway, wherein

detecting (410, 420) the entry events or the exit events comprises detecting a direction of the at least one person traversing the passageway;

deriving (430), from the entry events and exit events, a presence indicator indicative of the presence of the at least one person within the danger zone (340, 342).

12. The method (400) according to claim 11, wherein deriving (430) the presence indicator comprises

counting a number of entry events with an entry event counter, and

counting a number of exit events with an exit event counter.

13. The method (400) according to claim 12, wherein deriving (430) the presence indicator comprises

comparing the entry event counter and the exit event counter, and

setting (440) the presence indicator, comprising: under the condition that comparing the entry event counter and the exit event counter indicates that the entry event counter and the exit event counter are not equal, setting the presence indicator to indicate that at least one person is present in the danger zone (340, 342).

14. The method (400) according to any of the claims 11 to 13, comprising:
providing the sensor (110), wherein the sensor (110) has a sensed field of view, the sensed field of view comprising the passageway.

15. Use of an elevator safety system (100) according to claims 1 to 7 in an elevator system (300), particularly according to a method (400) according to claims 11 to 13.

Drawing