EP3650387A1

EP3650387A1 - System and method for displaying safety related data

Info

Publication number: EP3650387A1
Application number: EP18204598.9A
Authority: EP
Inventors: designation of the inventor has not yet been filed The
Original assignee: Otis Elevator Co
Current assignee: Otis Elevator Co
Priority date: 2018-11-06
Filing date: 2018-11-06
Publication date: 2020-05-13

Abstract

A system (20) for displaying safety related data of an electronic elevator safety component (22) comprises an electronic elevator safety component (22) configured for providing and transmitting data to be displayed; and a display device (24) comprising a display (28) with at least two display portions (28a, 28b), the display device (24) being configured for receiving and displaying the data transmitted from the electronic elevator safety component (22) on the display (28). The electronic elevator safety component (22) is configured for transmitting the data to be displayed as at least two data portions (25a, 25b). The display device (24) is configured for displaying each data portion (25a, 25b) on a respectively associated display portion (28a, 28b) thereby forming a total image on the display (28) based on the received data such that modifications and/or errors in the data result in at least one inconsistency within the total image, said at least one inconsistency being apparent to a human watching the total image.

Description

The invention relates to a system and to a method for displaying safety related data of an electronic elevator safety component.
Modern elevator systems comprise electronic elevator safety components, such as electronic safety actuators, which are configured for providing generic safety functions in order to allow for a safe operation of the elevator system.
These electronic elevator safety components may use adjustable parameters which allow adapting the electronic elevator safety component to the respective elevator system. In order to allow a safe and reliable setting of such parameters, it is necessary to reliably display the parameters set within the electronic elevator safety component to a user (operator). The electronic elevator safety components are required to comply with predefined safety standards in order to ensure the necessary safety of the elevator system. For reducing the costs for the setting tools configured for setting and adjusting the parameters, it is preferable that the setting tools and the data connections between the electronic elevator safety components and the setting tools do not need to comply with such safety standards.
It therefore is desirable to provide a system and a method which allows displaying safety related data of an electronic elevator safety component such that the reliability of the displayed data may be checked easily even if the device used for displaying the data does not comply with a defined safety standard.
According to an exemplary embodiment of the invention, a system for displaying safety related data of an electronic elevator safety component comprises an electronic elevator safety component configured for providing and transmitting data to be displayed, and a display device including a display with at least two display portions. The display device is configured for receiving and displaying the data transmitted from the electronic elevator safety component on the display. The electronic elevator safety component is configured for transmitting the data to be displayed as at least two data portions. The display device is configured for displaying each data portion on a respectively associated display portion forming a total image on the display based on the received data such that modifications and/or errors in the data result in at least one inconsistency within the total image, wherein said at least one inconsistency is apparent to a human watching the total image.
Exemplary embodiments of the invention further comprise an elevator system comprising at least one elevator car configured for traveling along a hoistway between a plurality of landings; and a system for displaying safety related data of an electronic elevator safety component according to an exemplary embodiment of the invention.
Exemplary embodiments of the invention also include a method of displaying data provided by an electronic elevator safety component. The method includes transmitting the data to be displayed as at least two data portions from the electronic elevator safety component to an associated display device comprising a display with at least two display portions. The method further includes displaying data from each data portion on a display portion associated with the respective data portion, thereby forming a total image on the display based on the received data such that modifications and/or errors in the data result in at least one inconsistency within the total image, wherein said at least one inconsistency is apparent to a human watching the total image.
A system and a method according to exemplary embodiments of the invention allow a user to easily check the reliability of the transmitted and displayed data since errors in the transmission and/or display of the data result in inconsistencies within the resulting displayed total image. In consequence, the transmitted and displayed data may be reliably checked without employing a safety certified display device, i.e. a display device complying with a defined safety standard. As a result, a display device, which may be provided at low costs, may be used without deteriorating the safety of the elevator system.
A number of optional features are set out in the following. Unless explicitly mentioned otherwise, any of these features may be realized in particular embodiments, alone or in combination with any of the other features.
The total image displayed on the display device may include at least one predefined pattern. Inconsistencies in predefined patterns may be recognized easily and reliably by a human. The at least one predefined pattern in particular may include at least one alphanumeric character or a series of alphanumeric characters representing parameters of the electronic elevator safety component.
The system may comprise a programming device configured for monitoring the electronic elevator safety component. The display device may be included in the programming device. The programming device in particular may allow programming and/or changing the parameters of the electronic elevator safety component in order to adjust the electronic elevator safety component to the respective elevator system.
The display device and/or the programming device may be stationary devices attached to an elevator car and/or to an elevator control. Alternatively, the display device and/or programming devices may be mobile devices carried by a service person and configured for being connected with the electronic elevator safety component only temporarily for setting and maintenance purposes. A mobile display device and/or the programming device may be used for a plurality of different elevator systems.
The electronic elevator safety component and the display device may be configured for wireless data transmission. Wireless data transmission in particular is advantageous in the case of a mobile display/programming device as it avoids the need of establishing a wired data connection between the electronic elevator safety component and the display device.
The electronic elevator safety component and the display device may be configured for wired data transmission. A wired data transmission may be implemented at low costs and has a high reliability.
The at least two display portions may be arranged above each other forming two or more rows of the display. Alternatively the at least two display portions may be arranged side by side forming two or more columns of the display.
In further configurations, the at least two display portions may be arranged in other geometric patterns. The geometrical arrangement of the display portions in particular may be chosen based on the kind of data to be displayed in order to allow for an easy and reliable recognition of inconsistencies in the displayed total image. The electronic elevator safety component may be configured for transmitting the at least two data portions sequentially, i.e. one after the other. For sequential data transmission, only a single communication channel / communication line is necessary. The data portions in particular may be transmitted in a predefined order, wherein the position of each data portion within the predefined order defines the associated display portion. Such a configuration allows associating each data portion easily with one of the display portions.
Alternatively, the electronic elevator safety component may be configured for transmitting the at least two data portions parallel to each other, in particular over different communication channels. Each communication channel in particular may be associated with one of the display portions. The communication channels may be logical communication channels or physical communication channels associated with different physical data connections, such as wires.
The data portions also may include synchronization data indicating the respectively associated display portion. This allows associating the data portions very flexibly to the display portions. In such a configuration, the association in particular does not depend on external parameters such as the order of transmitting the individual data portions and/or the use of specific communication channels.
The association of the plurality of data portions to the different display portions may change over time in order to enhance the safety of the data transmission. Moreover, an erroneous condition may be determined more easily in case it causes a time variable feature on the display, such as a flickering feature.
In order to ensure the desired safety of the elevator system, the electronic elevator safety component may comply with a defined safety standard, in particular with the SIL 2 or SIL 3 safety standard according to EN 61508-1:2010. The display device, however, may be a display device which does not comply with said safety standard. A display device, which does not need to comply with a defined safety standard, may be produced at reduced costs.
In the following, an exemplary embodiment of the invention is described in more detail with respect to the enclosed figure.

Figure 1 schematically depicts an elevator system in which a system for displaying safety related data according to an exemplary embodiment of the invention may be employed.
Figure 2 schematically illustrates a system for displaying safety related data of the at least one electronic elevator safety component according to an exemplary embodiment of the invention.
Figure 3 shows a display displaying correct data.
Figure 4 shows a display displaying non-correct data.

Figure 1 schematically depicts an elevator system 2 in which a system 20 for displaying safety related data according to an exemplary embodiment of the invention may be employed.
The elevator system 2 includes an elevator car 6 which is movably arranged within a hoistway 4 extending between a plurality of landings 8. The elevator car 6 in particular is movable along a plurality of car guide members 14, such as guide rails, extending along the vertical direction of the hoistway 4. Only one of said car guide members 14 is visible in Figure 1. Although only one elevator car 6 is depicted in Figure 1, the skilled person will understand that exemplary embodiments of the invention may include elevator systems 2 having a plurality of elevator cars 6 moving in one or more hoistways 4.
The elevator car 6 is movably suspended by means of a tension member 3. The tension member 3, for example a rope or belt, is connected to a drive unit 5, which is configured for driving the tension member 3 in order to move the elevator car 6 along the height of the hoistway 4 between the plurality of landings 8, which are located on different floors.
Each landing 8 is provided with a landing door 11, and the elevator car 6 is provided with a corresponding elevator car door 12 for allowing passengers to transfer between a landing 8 and the interior of the elevator car 6 when the elevator car 6 is positioned at the respective landing 8.
The exemplary embodiment of an elevator system 2 depicted in Figure 1 uses a 1:1 roping for suspending the elevator car 6. The skilled person, however, easily understands that the type of the roping is not essential for the invention and that different kinds of roping, e.g. a 2:1 roping or a 4:1 roping, may be used as well.
The elevator system 2 includes further a counterweight 19 attached to the tension member 3 opposite to the elevator car 6 and moving concurrently and in opposite direction with respect to the elevator car 6 along at least one counterweight guide member 15. The skilled person will understand that the invention may be applied to elevator systems 2 which do not comprise a counterweight 19 as well.
The tension member 3 may be a rope, e.g. a steel core, or a belt. The tension member 3 may be uncoated or may have a coating, e.g. in the form of a polymer jacket. In a particular embodiment, the tension member 3 may be a belt comprising a plurality of polymer coated steel cords (not shown). The elevator system 2 may have a traction drive including a traction sheave for driving the tension member 3. In an alternative configuration, which is not shown in the figures, the elevator system 2 may be an elevator system 2 without a tension member 3, comprising e.g. a hydraulic drive or a linear drive. The elevator system 2 may have a machine room (not shown) or may be a machine room-less elevator system.
The drive unit 5 is controlled by an elevator control 9 configured for moving the elevator car 6 along the hoistway 4 between the different landings 8.
Input to the elevator control 9 may be provided via landing control panels 7a, which are provided on each landing 8 close to the landing doors 11, and/or via an elevator car control panel 7b, which is provided inside the elevator car 6.
The landing control panels 7a and the elevator car control panel 7b may be connected to the elevator control 9 by means of electrical wiring, which is not shown in Figure 1, in particular by an electric bus, or by means of wireless data connections.
The elevator system 2 comprises at least one electronic elevator safety component 22. The elevator safety component 22 in particular may be an electronic safety actuator ("ESA") mounted to the elevator car 6. Although not explicitly shown in Figure 1, the elevator safety component 22 also may be a stationary electronic elevator safety component 22 located at the elevator drive 5 or at the elevator control 9. Figure 2 schematically illustrates a system 20 for displaying safety related data of the at least one electronic elevator safety component 22 according to an exemplary embodiment of the invention.
The system 20 comprises an electronic elevator safety component 22 configured for providing and transmitting data to be displayed. The data to be displayed in particular may include parameters and/or settings of the electronic elevator safety component 22.
The system 20 further comprises a display device 26 including a display 28. The display device 26 is configured for receiving the data transmitted from the electronic elevator safety component 22 and for displaying the received data on the display 28. The display 28 depicted in Figure 2 comprises two display portions 28a, 28b arranged on top of each other.
The electronic elevator safety component 22 and the display device 26 are connected with each other by a data connection 24. The data connection 24 is configured for transferring the data to be displayed on the display device 26 from the electronic elevator safety component 22 to the display device 26. The data connection 24 may be a wired data connection 24 comprising one or more electric conductors, such as wires, extending between the electronic elevator safety component 22 and the display device 26. Alternatively, the data connection 24 may be a wireless data connection 24 configured for transferring data from the electronic elevator safety component 22 to the display device 26 without the need for a wired connection. The wireless data connection 24 may employ electromagnetic data transmission, such as WLAN, Bluetooth® or a similar technology; in another configuration, the wireless data connection 24 may employ optical data transmission.
The display device 26 may be combined with or integrated in a programming device 30 configured for programming the electronic elevator safety component 22. The programming device 30 may include an input device 32, such as a keyboard, which allows entering commands into the programming device 30.
The programming device 30 in particular may be used for checking and/or modifying parameters of the electronic elevator safety component 22. Modifying parameters of the electronic elevator safety component 22 allows adjusting the electronic elevator safety component 22 to the specific elevator system 2 in which it is used.
For example, in case the electronic elevator safety component 22 is an electronic safety actuator (ESA), the modified parameters may include positional limits, speed limits and/or acceleration limits of the elevator car 6. These parameters may be adjusted using the electronic elevator safety component 22.
In a typical application, the electronic elevator safety component 22 is a safety device configured to fulfill a well-defined safety standard, such as the SIL 2 or the SIL 3 standard as it is defined by EN 61508-1:2010.
It is desirable that data provided by the electronic elevator safety component 22 is displayed reliably, even in case at least one of the display device 26, the programming device 30 and the data connection 24 does not comply with a safety standard such as SIL 2 or the SIL 3. When a system 20 for displaying safety related data according to an exemplary embodiment of the invention is employed, modifications of the data resulting from transmission errors or from an incorrect functionality of one of the devices 26, 30 not complying with a safety standard are visualized as distortions of the total image displayed on the display 28.
According to an exemplary embodiment of the invention, the electronic elevator safety component 22 is configured for transmitting the data to be displayed as at least two data portions 25a, 25b. The two data portions 25a, 25b may be transmitted in parallel, i.e. via different wires or using different communication channels, or sequentially, i.e. one after the other.
The display device 26 is configured for displaying contents of each data portion 25a, 25b on a respectively associated display portion 28a, 28, thereby forming a total image on the display 28 based on the received data. As a result, modifications and/or errors of the data caused by transmission errors and/or an erroneous functionality of the electronic elevator safety component 22 result in at least one inconsistency within the total image. Said at least one inconsistency is easily apparent to the human eye. Thus, a person watching the total image may easily recognize that the data is erroneous or has been modified and therefore could not be relied upon.
Examples of images displayed on the display 28 are illustrated in more detail in Figures 3 and 4.
Figure 3 shows a display 28 displaying correct data; and Figure 4 shows a display 28 displaying non-correct data.
In the exemplary embodiment depicted in Figures 2 to 4, the data is transmitted from the electronic elevator safety component 22 to the display device 26 in two portions, namely a first data portion 25a to be displayed on the upper display portion 28a, and a second data portion 25b to be displayed on the lower display portion 28b, respectively.
In an alternative configuration, the first data portion 25a may be displayed on the lower display portion 28b, and the second data portion 25b may be displayed on the upper display portion 28a. The skilled person understands that in further configurations, which are not depicted in the figures, more than two data portions 25a, 25b may be displayed on a display comprising more than two display portions 28a, 28b.
The first and second data portions 25a, 25b may be transmitted sequentially. In such a configuration, the first and second data portions 25a, 25b may be identified based on there respective position within the transmitted sequence of data. In other words, the data portion 25a transmitted first may be the first data portion 25a, and the data portion 25b transmitted second may be the second data portion 25b. This principle may be expanded to an arbitrary number of data portions 25a, 25b.
Alternative or additionally, the first and second data portions 25a, 25b may be transmitted via different data lines or channels, with each data line or channel being associated with a corresponding data portion 25a, 25b. I.e. the data transmitted via a first data line or channel may be considered as a first data portion 25a, and the data transmitted via a second data line or channel may be considered as a second data portion 25b. Apparently this concept may be extended to more than two data portions 25a, 25b as well.
The data portions 25a, 25b also may include synchronization data identifying the respective data portion 25a, 25b.
Optionally, the association of the plurality of data portions 25a, 25b to the display portions 28a, 28b may change overtime based on predetermined rules and/or schedules. For example, in a first data transmission, the first data portion 25a may be configured to be displayed on the first display portion 28a, and the second data portion 25b may be configured to be displayed on the second display portion 28b. In a following second data transmission, the first data portion 25a may be configured to be displayed on the second display portion 28b, and the second data portion 25b may be configured to be displayed on the first display portion 28a. Such a configuration enhance the safety even further, as it makes an intentional but unauthorized alternation of the transmitted data more difficult.
In the examples depicted in Figures 3 and 4, the data to be transmitted and displayed is considered to be "2350", but the skilled person understands that the concept of the present invention may be applied to arbitrary displayable data, in particular alphanumeric data.
Figure 3 illustrates a configuration, in which the data is transferred and displayed correctly. In this configuration, the upper parts of the digits "2", "3", "5", and "0" are transmitted as the first data portion 25a and the lower parts of the digits "2", "3", "5", and "0" are transmitted as the second data portion 25b. The contents of the first data portion 25a is displayed on the first (upper) display portion 28a, and the second data portion 25b is displayed on the second (lower) display portion 28b.
As in the configuration depicted in Figure 3 the transmission and the display of the two data portions 25a, 25b are correct, the two half images display on the first and second display portions 28a, 28b match with each other forming a total image displaying the correct data "2350".
Figure 4 illustrates a situation in which the data is not transferred and displayed correctly, for example due to an error in data transmission and/or due to an unauthorized modification of the data in the display device 26.
As in the embodiment depicted in Figure 3, the data to be displayed is "2350".
In the embodiment depicted in Figure 4, the first data portion 25a representing the upper half of "2350" has been transferred correctly. In consequence, the upper half of "2350" is displayed correctly on the first (upper) display portion 28a.
The second data portion 25b, which should represent the lower half of "2350", however, has not been transferred correctly and/or it has been altered after receipt. In consequence, the lower portion of "2450" instead of the lower portion of "2350" is displayed on the second display portion 28b. This results in an evident inconsistency of the second digit. In consequence, a person watching the total image, i.e. the combination of the partial images displayed on the first and second display portions 28a, 28b, recognizes that the displayed data is not correct and therefore could not be relied upon.
As result, a system 20 for displaying safety related data according to exemplary embodiments of the invention allows a user to easily and reliably check whether the data is displayed correctly, or whether transmitted data has been altered and therefore should not be relied upon.
While the invention has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adopt a particular situation or material to the teachings of the invention without departing from the essential scope thereof. Therefore, it is intended that the invention shall not be limited to the particular embodiment disclosed, but that the invention includes all embodiments falling within the scope of the dependent claims.

References

2: elevator system
3: tension member
4: hoistway
5: drive unit
6: elevator car
7a: landing control panel
7b: elevator car control panel
8: landing
9: elevator control
10: landing door switch
11: landing door
12: elevator car door
14: car guide member
15: counterweight guide member
18: safety chain
19: counterweight
20: system for displaying safety related data
22: electronic elevator safety component
24: data connection
25a: first data portion
25b: second data portion
26: display device
28: display
28a: first display portion
28b: second display portion
30: programming device
32: input device

Claims

System (20) for displaying safety related data of an electronic elevator safety component (22), the system comprising:
an electronic elevator safety component (22) configured for providing and transmitting data to be displayed; and

a display device (24) comprising a display (28) with at least two display portions (28a, 28b), the display device (24) being configured for receiving and displaying the data transmitted from the electronic elevator safety component (22) on the display (28);

wherein the electronic elevator safety component (22) is configured for transmitting the data to be displayed as at least two data portions (25a, 25b);

wherein the display device (24) is configured for displaying each data portion on a respectively associated display portion (28a, 28b) thereby forming a total image on the display (28) based on the received data such that modifications and/or errors in the data result in at least one inconsistency within the total image, said at least one inconsistency being apparent to a human watching the total image.
System (20) according to claim 1, wherein the total image includes at least one predefined pattern, in particular at least one alphanumeric character or a series of alphanumeric characters.
System (20) according to claim 1 or 2, wherein the system comprises a programming device (30) configured for monitoring the electronic elevator safety component (22) and including the display device (24).
System (20) according to claim 3, wherein the programming device (30) allows programming and/or changing parameters of the electronic elevator safety component (22).
System (20) according to any of the preceding claims, wherein the display device (24) is a stationary programming device (30) or a mobile programming device (30).
System (20) according to any of the preceding claims, wherein the electronic elevator safety component (22) and the display device (24) are configured for wireless data transmission.
System (20) according to any of the preceding claims, wherein the at least two display portions (28a, 28b) are arranged above each other forming rows of the display (28), or wherein the at least two display portions (28a, 28b) are arranged side by side forming columns of the display (28).
System (20) according to any of the preceding claims, wherein the electronic elevator safety component (22) is configured for transmitting the at least two data portions (25a, 25b) sequentially.
System (20) according to claim 8, wherein the at least two data portions (25a, 25b) are transmitted in a predefined order, wherein the position of each data portion (25a, 25b) within the predefined order defines the associated display portion (28a, 28b).
System (20) according to any of the preceding claims, wherein the electronic elevator safety component (22) is configured for transmitting the at least two data portions (25a, 25b) parallel to each other, in particular over different communication channels.
System (20) according to any of the preceding claims, wherein the data portions (25a, 25b) include synchronization data indicating the respectively associated display portion (28a, 28b).
System (20) according to any of the preceding claims, wherein the electronic elevator safety component (22) complies with a defined safety standard, in particular the SIL 2 or SIL 3 safety standard according to EN 61508-1:2010, and wherein the display device (24) does not comply with said safety standard.
Elevator system (2) comprising:
at least one elevator car (6) configured for traveling along a hoistway (4) between a plurality of landings (8); and

a system (2) for displaying safety related data according to any of the preceding claims.
Method of displaying data provided by an electronic elevator safety component (22), wherein the method includes:
transmitting data to be displayed as at least two data portions (25a, 25b) from the electronic elevator safety component (22) to an associated display device (24) comprising a display (28) with at least two display portions (28a, 28b); and

displaying data from each data portion (25a, 25b) on a display portion (28a, 28b) associated with the respective data portion (25a, 25b), thereby forming a total image on the display (28) based on the received data such that modifications and/or errors in the data result in at least one inconsistency within the total image, said at least one inconsistency being apparent to a human watching the total image.
Method according to claim 14, wherein the association of the plurality of data portions (25a, 25b) to the different display portions (28a, 28b) changes over time.