1. An elevator safety system comprising: an elevator controller to move an elevator car; 5 a plurality of safety devices provided for a hoistway inside or an elevator car; and a safety controller supplied with signals from a plurality of the safety devices, wherein the elevator safety system stops the elevator 10 car when the safety device operates; and wherein the safety device includes: a manual group integrating a plurality of manually manipulated stop switches; a hoistway group integrating a plurality of switches 15 provided in a hoistway; and an elevator car group integrating a plurality of switches provided for an elevator car.

2. The elevator safety system according to claim 1, 20 wherein the manual group includes an uppermost elevator car emergency stop switch, a pit emergency stop switch, a lift-motor room emergency stop switch, and a floor emergency stop switch. 25 3. The elevator safety system according to claim 1, 16/19 wherein the hoistway group includes a floor door switch, a final limit switch, a maintenance limit switch, a buff er switch, a rope tension detector, and an overspeed detection switch. 5 4. The elevator safety system according to claim 1, wherein the elevator car group includes an elevator car door switch, an emergency stop switch, a safety fence operation detection switch on an elevator car and a rescue port switch. 10 5. The elevator safety system according to claim 1, wherein the manual group includes diagnosis switches to receive an instruction from one of an outside of the elevator safety system and the elevator controller. 15 6. The elevator safety system according to claim 1, comprising: a brake power supply contact being connected in parallel at an output side of the safety controller, the brake power supply contact braking the elevator car; and 20 a contact 20 system and a contact 21 system being provided between the output side of the safety controller and the brake power supply contact, the contact 20 system and the contact 21 system being connected each other in series; wherein the safety controller controls each of the 25 brake power supply contact, the contact 20 system and the contact 17/19 21 system; and wherein at least one of the contact 20 system and the contact 21 system normally remains conductive to supply power to the brake power supply contact and make the elevator car 5 movable.

7. The elevator safety system according to claim 1, comprising: a brake power supply contact being connected in parallel 10 at an output side of the safety controller, the brake power supply contact braking the elevator car; and a contact 20 system and a contact 21 system being provided between the output side of the safety controller and the brake power supply contact, the contact 20 system and the contact 15 21 system being connected each other in series; wherein when detecting that any of stop switches in the manual group operates and is reset again, the safety controller turns on the contact 20 system and the contact 21 system to be conductive and confirms presence of a feedback signal from 20 the contact 20 system and the contact 21 system. Dated this 20th day of August 2014 Of Anand and Anand Advocates Agent for the Applicant 18/19

TITLE OF THE INVENTION ELEVATOR SAFETY SYSTEM
BACKGROUND OF THE INVENTION
5 1. Field of the invention
The present invention relates to an elevator whose safety is improved. More specifically, the invention relates to an elevator safety system appropriate for a hoistway or an elevator car provided with a safety device.
0
2. Description of the Related Art
Conventionally, there is known a computerized safety system that supplies a safety device signal to a controller (safety controller) independent of the elevator system and
5 brings an elevator car to an emergency stop when the safety device operates. For example, there is a need to promote safe elevator operation and enables safe stop ifa hazardous condition is detected. For this purpose, the computerized safety system described in Patent Document 1 (Japanese Unexamined Patent
0 Application Publication No. 2002-538061) uses a communication
bus to exchange control and data signals between a
microprocessor-based controller and various sensors.
Further, there is a need to satisfy requirements for
sophisticated elevator systems, appropriately provide a safety
5 controller, and ensure and facilitate maintenance related to
2/19

reliability and safety. For this purpose, the known technology described in Patent Document 2 (Japanese Unexamined Patent Application Publication No. 2011-121726) controls a safety circuit to turn on or off the power supplied to an elevator 5 control system using the elevator control system and a safety controller supplied with signals from several safety devices. Furthermore, there is a need to troubleshoot each of two relay drivers correspondingly provided for relays to turn off the power supplied to a motor or a brake. For this purpose,
10 the known technology described in Patent Document 3 (WO2011/048664) self-diagnoses operation, namely, allows the arithmetic unit itself as a safety controller to issue an instruction and check operation.
The above-mentioned technologies of the related art as
15 described in Patent Documents 1 and 2 favorably need to provide several safety devices in parallel in order to specify an operated safety device . In this case, however, increasing the number of safety devices enhances the input circuit scale and enlarges a mounting area. An elevator having no lift-motor
20 room in particular needs to minimize an area occupied by devices
in the hoistway. Increasing an area to mount the safety
controller, for example, reduces an actual floor area for the
elevator with reference to a horizontal hoistway area.
Similarly, increasing the number of safety devices accordingly
25 increases the number of input points. The time needed for wiring
3/19

work increases to increase the possibility of incorrect wiring. Incorrect wiring may prevent normal operation of the safety function provided by the safety controller.
According to the technology described in Patent Document
5 3, the safety controller issues a relay diagnosis instruction. It is impossible to confirm normal diagnosis operation including the safety controller . The technology insufficiently confirms whether the safety controller malfunctions, namely, whether the safety function operates normally.
0 The present invention has been made to solve the problems of the above-mentioned technologies of the related art. It is, therefore, an object of the invention to provide a safer elevator safety system by miniaturizing a safety controller, simplifying wiring work, and reliably confirming operation of
5 the safety function.
SUMMARY OF THE INVENTION
To achieve the above-mentioned object, an elevator safety
system according to the present invention includes : an elevator
0 controller tomove an elevator car; a plurality of safety devices
provided for a hoistway inside or an elevator car; and a safety
controller supplied with signals from a plurality of the safety
devices. The elevator safety system stops the elevator car
when the safety device operates. The safety device includes:
5 a manual group integrating several manually manipulated stop
4/19

switches; a hoistway group integrating several switches provided in a hoistway; and an elevator car group integrating several switches provided for an elevator car.
According to the invention, the safety devices are grouped 5 into the manual group integrating the manually manipulated stop switches, the hoistway group integrating the switches provided in a hoistway, and the elevator car group integrating the switches provided for an elevator car. This makes it possible to simplify the wiring work, easily confirm operation of the 10 safety function, and further improve the safety.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a block diagram illustrating an entire configuration according to an embodiment of the invention; 15 FIG. 2 is a block diagram illustrating a safety controller and its peripheral circuit according to an embodiment of the invention;
FIG. 3 is a block diagram illustrating internal processes of the safety controller according to an embodiment of the 20 invention; and
FIG. 4 is a timing chart illustrating diagnosis of a safety function according to an embodiment of the invention.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
25 FIG. 1 is a block diagram illustrating an entire
5/19

configuration according to an embodiment of the invention. An elevator controller 100 controls the movement of an elevator car 105. The elevator car 105 rises and descends across several floors in a hoistway formed in a building. The elevator car 5 105 is connected to a counter weight (not shown) via a rope to balance with the elevator car 105. The elevator car 105 is provided with an elevator car door (not shown) that opens and closes in cooperation with a floor door. An electric motor 103 drives a sheave 104 to move the elevator car 105 . An electric
10 power converter 101 supplies the electricmotor 103 with electric power for driving.
The electric power converter 101 outputs the power to control the electric motor 103 based on an elevator car position control instruction of the elevator controller 100. A pulse
15 generator (notshown) attached to the electricmotor 103 provides a two-phase encoder to control the electric motor 103. The elevator controller 100 counts pulses generated by rotation of the electric motor 103 to calculate a speed of the electric motor 103, a movement direction, a position, and a movement
20 distance of the elevator car 105 in the hoistway.
The elevator controller 100 outputs a stop instruction
to a brake power supply 2 and a drive power supply 3 to control
the elevator car 105. The stop instruction allows the brake
power supply 2 to operate a brake 102 and allows the drive power
25 supply 3 to stop supplying the power to the electric power
6/19

converter 101. The brake power supply 2 and the drive power supply 3 each use a circuit provided with an electromagnetic contactor which is called "contactor" (not shown).
A safety controller lis supplied with signals from several
5 safety devices and turns off the brake power supply 2 and the drive power supply 3 according to the operation of the safety devices. Namely, the safety controller 1 provides a safety system that controls the elevator car 105 independently of the elevator controller 100.
0 The safety devices are grouped instead of independently supplying signals to the safety controller 1. The safety devices are connected to each other in series to be integrated and supply signals to the safety controller 1. For example, a manual group 7 is one of the safety devices and provides stop
5 switches manipulated by a maintenance person such asan uppermost elevator car emergency stop switch 7a and a pit emergency stop switch 7b as well as emergency stop switches in a lift-motor room and at each floor.
A hoistway group 8 of safety devices is provided in the
0 hoistway and operates automatically. For example, thehoistway
group 8 includes a floor door switch 8a and a final limit switch
8b as well as a maintenance limit switch, a buffer switch, a
rope tension detector, and an overspeed detection switch. The
hoistway group 8 is provided in the hoistway and outputs a signal
5 for emergency stop.
7/19

An elevator car group 9 of safety devices is provided for the elevator car and operates automatically. For example, the elevator car group 9 includes an elevator car door switch 9a and an emergency stop switch 9b as well as a safety fence 5 operation detection switch and a rescue port switch on the elevator car. The elevator car group 9 is provided for the elevator car and outputs a signal for emergency stop.
The manual group 7 includes a group of diagnosis switches correspond to switches that operate according to an instruction 10 of output 10 from the elevator controller 100 so as to be capable of diagnosing whether the safety controller malfunctions or whether the safety function operates normally at any timing triggered from the elevator controller 100. The result is similar to a case where the output 10 operates the stop switches 15 in the manual group 7.
The safety controller 1 includes a CPU (Central Processing Unit) to perform processes. The safety controller 1 further includes a watchdog timer to detect CPU errors and a circuit to monitor a power supply anomaly. To detect CPU processing 20 errors, the CPU favorably needs to be duplicated and thereby compare with each other. An elevator car position sensor 6 detects the position of the elevator car 105 in the hoistway in the height direction.
The safety controller 1 generates turn-off outputs to
25 the brake power supply 2 and the drive power supply 3. The
8/19

brake power supply 2 operates the brake 102. The drive power supply 3 turns off the power for the electric power converter 101 to stop the electric motor 103. Either output brakes the elevator car 105. 5 FIG. 2 illustrates a detailed configuration of the safety controller and its peripheral circuit. The safety controller 1 is supplied with signals concerning the safety devices. The signals include the manual group 7, the hoistway group 8, and the elevator car group 9. The manual group 7 is capable of
10 being supplied with the output 10 for diagnosis from the outside or the elevator controller 100 in order to perform diagnosis at a given cycle.
The following describes the advantage of grouping the safety devices. If a safety device operates to cause an
15 emergency stop, the subsequent recovery depends on whether the safety device operates automatically or manually. Different stop levels are acceptable because the safety devices are grouped according to the criterion whether the safety devices operate automatically or manually. For example, activation of an
20 emergency stop switch that operates manually signifies that
a person manipulates this switch. The person has already
decided whether to operate the elevator. If the elevator car
is stopped for maintenance purpose, the elevator car is
recoverable after a maintenance person completes the
25 maintenance and inspection. Then, the stop switch can be reset
9/19

to turn off.
By contrast, activation of a safety device that operates automatically signifies that the safety device for the elevator operated automatically regardless of a maintenance person's 5 action. If an emergency stop occurs in this case, the stop state needs to be maintained because of some anomaly. The function of the safety controller 1 needs to determine the stop state according to stop levels. For this purpose, the safety devices that operate automatically are categorized into a group
10 of safety devices to operate automatically and a group of safety devices not to operate manually. The safety devices are grouped based on whether or not the safety device maintains the stop state. Thiscan simplify the logicportionofaprogram included in the safety function, reduce incorrect operations, and
15 decrease the total number of input terminals. Accordingly, the safety can be improved advantageously.
Further, the safety devices are grouped based on whether they are installed in the hoistway or at the elevator car. This signifies grouping the safety device in terms of wiring lengths
20 for installation. A floor door switch or a limit switch in
particular increases the wiring length corresponding to the
building height. This requires a longer time for wiring work
and decreases a voltage applied to the safety circuit.
Consequently, the safety device is prone to malfunction due
25 to an electromagnetic noise. It is effective to shorten the
10/19

wiring length by grouping the safety devices installed as closely as possible. This can not only shorten the time for wiring work but also prevent safety device malfunction due to an electromagnetic noise. 5 Further, the input interface canbe uniformed. Allmodels can use a common substrate. As a consequence, the principal portion need not be modified even if an additional safety device is required.
Next, the output circuit portion will be described.
10 Output from the safety controller 1 is connected to a brake power supply contact 2 and a power-off contact 3 in parallel. The brake power supply contact 2 allows the brake 102 to brake the elevator car. The power-off contact 3 allows the power supply to turn off to brake the elevator car. To disconnect
15 the contacts, contacts 20a and 20b, and contacts 21a and 21b are each connected inseries. The contacts 2 0a and 2 0b configure a contact 20 system and the contacts 21a and 21b configure a contact 21 system.
The contact 20 system and the contact 21 system are
20 connected in parallel. The safety controller 1 controls the
contact 20 system and the contact 21 system. Normally, either
or both of the contact 20 system and the contact 21 system remain
conductive to supply the power to the brake power supply contact
2 and the power-off contact 3 and make the elevator movable.
25 The safety controller 1 may detect operations of the safety
11/19

devices or errors of the controller itself such as a clock error, a power supply voltage error, and a general invalid instruction in operation of the safety devices. In such a case, disconnecting contacts in the contact 20 system and the contact 5 21 system also disconnects the power supply to the brake power supply contact 2 and the power-off contact 3 and brakes the elevator car.
FIG. 3 is a block diagram illustrating internal processes of the safety controller 1. A safety device detection process
10 30 is supplied with inputs from the manual group 7 of safety devices, the hoistway group 8 thereof, and the elevator car group 9 thereof . The safety device detection process 30 detects operation states of the inputs from the groups and outputs the states to an output circuit diagnosis process 31 and a turn-off
15 output process 32. The output circuit diagnosis process 31 is supplied with feedback inputs (2A and 3A) from the contacts 20a, 20b, 21a, and 21b and is supplied with the output that is detected by the safety device detection process 30 and indicates operation states of the inputs from the groups. The
20 output circuit diagnosis process 31 outputs a diagnosis outputs
to the outside and instructions for the diagnosis to the turn-off
output process 32. The output circuit diagnosis process 31
detects the operation of the manual group 7 and may determine
that the manual group 7 is inactive. In such a case, the output
25 circuit diagnosis process 31 outputs a diagnosis instruction
12/19

after a predetermined time elapsed from the time of the operation detection.
The diagnosis output 5 provides information indicating a result of diagnosing a disconnected circuit based on the 5 contacts 20a, 20b, 21a, and 21b. The diagnosis output is connected to a device that displays character information. For example, the diagnosis output provides display to notify that a failure at the contact 20a is detected as a result of the diagnosis. Further, notifying the diagnosis in process can
10 ensure that the safety controller 1 performs the diagnosis operation.
The turn-off output process 32 is supplied with operation states of the groups from the safety device detection process 3 0 and is supplied with the diagnosis instruction from the output
15 circuit diagnosis process 31 and outputs an instruction to disconnect the contacts 20a, 20b, 21a, and 21b. The operation states may indicate that the groups of safety devices are active, namely, the safety devices are operating. In such a case, the turn-off output process 32 disconnects the contacts to brake
20 the elevator car.
The following describes the diagnosis method for the
output circuit portion. The output circuit is diagnosed after
a predetermined time elapsed from the time when operation of
the manual group 7 to operate manually is detected and the
25 recovery is complete. The predetermined time is configured
13/19

to be long enough to operate all the contacts 20a, 20b, 21a, and 21b.
FIG. 4 is a timing chart illustrating the diagnosis of the safety controller 1 and the safety function. The horizontal
5 axis represents the time. Lowering the thick line corresponding to input from the group 7 indicates the off state or the active state. Lowering the thick lines corresponding to the contacts 20a, 20b, 21a, and 21b indicates the off state or the disconnected state.
0 When detecting operation of the diagnosis switch or the manual group 7, the safety controller 1 disconnects the contacts 20a, 20b, 21a, and 21b (1). When detecting the recovery (2), the safety controller 1 turns on the output from the contact 20a to activate it. In addition, the safety controller 1
5 confirms a feedback signal from the contact 20a, namely, confirms that the feedback input which is outputted from the contact 20a changes to the on state. The safety controller 1 thereby determines that the contact 20a operates. Similarly, the safety controller 1 subsequently operates the contact 20 system
0 and the contact 21 system based on an output instruction from
the safety controller 1 and confirms operation of the contact
systems based on changes in the feedback signals from the
contacts 20a, 20b, 21a, and 21b.
The use of the output 10 in FIG. 2 can diagnose the manual
5 group 7 at any cycle. For example, a teleoperation device can
14/19

be connected to the elevator controller 100 and can instruct the elevator controller 100 to generate the output 10 for diagnosis. This can allow the elevator controller 100 to diagnose the output circuit of the safety controller 1 as needed. 5 Further, the online diagnosis is made easy.
As described above, inputs from the safety devices are grouped according to uses and positions. At least three inputs are sufficient instead of more inputs needed otherwise. The input circuit can be miniaturized without loss in the basic
10 function of the safety device. An input from a group of manually performed safety devices may be provided with a means to input the diagnosis performed at any cycle. When the safety controller detects an input from the group of manually performed safety devices, a disconnected circuit may be diagnosed after
15 a predetermined time elapsed from the time of releasing the input. A maintenance person can allow the safety controller to start the diagnosis. This makes it easy to confirm whether the diagnosis function of the controller operates normally.
20 Reference Signs List:
l-'-safety controller, 2---brake power supply , 3---drive power
supply, 6'-'elevator car position sensor, 7, 8, 9-"safety device
(7•••manual group, 8---hoistway group, 9---elevator car group) ,
100---elevator controller, 102---brake, 103---electric motor, 105
25 •••elevator car
15/19

WE CLAIM:
1. An elevator safety system comprising:
an elevator controller to move an elevator car; 5 a plurality of safety devices provided for a hoistway inside or an elevator car; and
a safety controller supplied with signals from a plurality of the safety devices,
wherein the elevator safety system stops the elevator 10 car when the safety device operates; and wherein the safety device includes:
a manual group integrating a plurality of manually manipulated stop switches;
a hoistway group integrating a plurality of switches 15 provided in a hoistway; and
an elevator car group integrating a plurality of switches provided for an elevator car.
2. The elevator safety system according to claim 1,
20 wherein the manual group includes an uppermost elevator
car emergency stop switch, a pit emergency stop switch, a lift-motor room emergency stop switch, and a floor emergency stop switch.
25 3. The elevator safety system according to claim 1,
16/19

wherein the hoistway group includes a floor door switch, a final limit switch, a maintenance limit switch, a buff er switch, a rope tension detector, and an overspeed detection switch.
5 4. The elevator safety system according to claim 1,
wherein the elevator car group includes an elevator car door switch, an emergency stop switch, a safety fence operation detection switch on an elevator car and a rescue port switch.
10 5. The elevator safety system according to claim 1,
wherein the manual group includes diagnosis switches to receive an instruction from one of an outside of the elevator safety system and the elevator controller.
15 6. The elevator safety system according to claim 1, comprising:
a brake power supply contact being connected in parallel at an output side of the safety controller, the brake power supply contact braking the elevator car; and
20 a contact 20 system and a contact 21 system being provided
between the output side of the safety controller and the brake
power supply contact, the contact 20 system and the contact
21 system being connected each other in series;
wherein the safety controller controls each of the
25 brake power supply contact, the contact 20 system and the contact
17/19

21 system; and
wherein at least one of the contact 20 system and the contact 21 system normally remains conductive to supply power to the brake power supply contact and make the elevator car 5 movable.
7. The elevator safety system according to claim 1, comprising:
a brake power supply contact being connected in parallel 10 at an output side of the safety controller, the brake power supply contact braking the elevator car; and
a contact 20 system and a contact 21 system being provided between the output side of the safety controller and the brake power supply contact, the contact 20 system and the contact 15 21 system being connected each other in series;
wherein when detecting that any of stop switches in the manual group operates and is reset again, the safety controller turns on the contact 20 system and the contact 21 system to be conductive and confirms presence of a feedback signal from 20 the contact 20 system and the contact 21 system. Dated this 20th day of August 2014
Of Anand and Anand Advocates Agent for the Applicant
18/19