US3587785A

US3587785A - Elevator control system safety arrangement

Info

Publication number: US3587785A
Application number: US804242A
Authority: US
Inventors: Otto Albert Krauer; Sheldon Edwin Kornbluth
Original assignee: Otis Elevator Co
Current assignee: Otis Elevator Co
Priority date: 1969-03-04
Filing date: 1969-03-04
Publication date: 1971-06-28
Anticipated expiration: 1988-06-28
Also published as: BE752605A

Abstract

A SAFETY ARRANGEMENT FOR AN ELEVATOR CONTROL SYSTEM WHICH PROVIDES SAFE OPERATION WHILE THE ELEVATOR CAR IS LOCATED AT A LANDING WITH ITS DOOR OPEN. A RELATIVELY LARGE ZONE EXTENDING ON BOTH SIDES OF EACH LANDING IS ESTABLISHED SO THAT THE ELEVATOR CAR AND HOISTWAY DOORS MAY START TO OPEN WHILE THE CAR IS LEVELING INTO REGISTRY WITH ANY LANDING AT WHICH IT IS STOPPING. THIS PERMITS THE DOORS TO BE OPEN A SUBSTANTIAL AMOUNT BY THE TIME THE CAR STOPS AT THE LANDING. A SMALLER ZONE EXTENDING ON BOTH SIDES OF EACH LANDING IS ALSO ESTABLISHED SO THAT UPON ENTERING THIS ZONE THE CAR IS THEREAFTER RESTRICTED IN ITS LEVELING OPERATION TO THIS SMALLER ZONE. FAILURE OF THE CAR ORIGINALLY TO ENTER THE SMALLER ZONE OR AFTER ENTRY TO REMAIN THEREIN AS LONG AS ITS DOORS ARE OPEN RESULTS IN THE CAR BEING PREVENTED FROM SUBSEQUENTLY MAKING A TRIP TO ANOTHER LANDING. IN ADDITION TO SAFEGUARDING AGAINST THIS AND OTHER MISOPERATIONS OF THE ELEVATOR CAR AND ITS CONTROL EQUIPMENT THIS SAFETY ARRANGEMENT ALSO MONITORS ITS OWN OPERATION TO PROTECT AGAINST THE SAFETY EQUIPMENT FAILING AND PRODUCING AN UNSAFE CONDITION.

Description

United States Patent I 3,58'7,785

[72] Inventors Otto Albert Krauer Primary Examiner- Oris L. Rader Tuckahoe; Assistant Examiner-W. E. Duncanson, Jr. Sheldon Edwin Kornbluth, Brooklyn, N.Y. A!I0rneysJoseph L. Sharon and Robert T. Mayer i [2]] Appl. No. 804,242 r [22] Filed Mar. 4, I969 [45] Patented June 28, 1971 ABSTRAQT: A safety arrangement for an elevator control [73] Assignee Otis Elevator Company system which provides safe operat on while the elevator car is New myy located at a landing with its doors open. A relatively large zone extending on both sides of each landing is established so that the elevator car and hoistway doors may start to open while the car is leveling into registry with any landing at which [54] ELEVATOR CONTROL SYSTEM SAFETY it is stopping. This permits the doors to be open a substantial ARRANGEMENT amount by the time the car stops at the landing. A smaller 23 Claims, 39mm 518$ zone extending on both sides of each landing is also established so that upon entering this zone the car is thereafter [52] US. Cl l87/29R restricted in its leveling operation to this smaller Zone Failure 5:5 of the car originally to enter the smaller zone or after entry to le 0 re remain therein as long as its doors are open results in the car 3l8/456' 458' 20070 20085; 317/13 being prevented from subsequently making a trip to another I 5 6] Rekmm GM landing. In addition to safeguarding against this and other misoperations of the elevator car and its control equipment this UNITED STATES PATENTS safety arrangement also monitors its own operation to protect 2,867,292 1/1959 Bruns 187/29 against the safety equipment failing and producing an unsafe 3,138,223 6/1964 Keiper et al. 187/29 diti I Y ELEVATOR CONTROL SYSTEM SAFETY ARRANGEMENT This is an invention in the elevator art. Specifically it concerns an arrangement for making an elevator car safe particularly while it is located at a landing with its doors open.

Many features have been incorporated into elevator control systems over the years to make them safer. One of the earliest to be adopted prevents main operation of a car if either its car or one of its hoistway doors is open. Good elevator service, however, demands that a car maintain its registry with a landing while it is located there with the doors open, notwithstanding changes in its load which stretch or contract its hoist ropes. As a result, a leveling operation is provided which permits movement of the car toward a landing at reduced speed even though the doors are open. This is used to restore the car to substantial registry with a landing when necessary as well as to bring the car initially into such registry as it stops at a landing.

The need to provide the car some type of operation which enables it to move with the doors open has pennitted some advantage to be taken of this to improve service by reducing traveling time. Thus, when a car is approaching a landing at which it is stopping and after it has entered a zone to which the leveling operation is restricted its door and the landing hoistway door are permitted to open while the car is still moving. This enables the doors to be open a substantial amount as the car comes to a stop and eliminates delay in transfer time which would otherwise occur in waiting for the doors to open.

The foregoing arrangement is standard on many present day elevators. In case of a failure it permits the leveling equipment to move the car a substantial distance, albeit at reduced speed, before either the doors are forced to close or the car is stopped by its exit from the leveling zone.

It is an object of this invention to improve the safety of elevators.

It is another object of this invention to provide a safety arrangement for an elevator control system.

It is a further object of this invention not only to permit an elevator car door and a hoistway door to open while the elevator is within a predetermined distance of a landing at which it is stopping, but also to limit the movement of the car while it is thereafter located at that landing to a space within a smaller distance on either side of the landing than the predetermined distance.

It is a further object of this invention to prevent an elevator car from exceeding a predetermined speed with its car or one of its hoistway doors open.

It is a still further object of this invention to provide a safety arrangement for an elevator control system which not only safeguards the system from misoperation but also monitors its own operation to insure its continued proper functioning.

ln carrying out the invention in a preferred embodiment there is provided a control system for an elevator car, which is movable throughout a building to serve a plurality of landings located therethrough by starting from and stopping at selected ones of them, and which includes a plurality of hoistway doorway closures including at least one door at each landing. The elevator car also has a doorway closure including at least one door. Both the car and the hoistway doors are movable between opened and closed positions. As the car approaches from either direction within a specific distance of a selected landing at which a stop is to be made, a leveling position means, which comprises part of the car's landing selector machine and includes a switching means common to all landings, operates to define a leveling zone which extends the specific distance on either side of the selected landing. Leveling control means including a distance controlled speed dictation signal generating device, which also comprises part of the landing selector machine, operates in response to the operation ofthe leveling position means. The leveling control means controls the movement of the car at a reduced speed in accordance with its distance from the selected landing during its approach through the leveling zone to level the car to a stop in substantial registry with the selected landing. The leveling control means also operates to relevel the car and maintain such registry after the car has stopped and it is enabled to cause both the leveling and releveling operations notwithstanding the opened positions of the car and hoistway doors.

Movement of the car through the leveling zone brings it within a second predetermined distance of the selected landing and an inner position means, comprising part of the landing selector machine and including another switching means common to all landings, operates to define an inner zone which extends this second predetermined distance on either side of the landing. After the car enters the leveling zone and before it enters the inner zone, door control means is actuated to move the hoistway door or doors at the selected landing and the car door or doors from their closed to their opened positions. Entry into the inner zone causes the actuation of a safety means including a reliability circuit which thereafter limits the zone in which the leveling control means is enabled to control the movement of the car while it remains at the selected landing with the doors open to the inner zone.

In addition to the foregoing, outer position means is also provided. This too comprises part of the landing selector machine and includes another switching means which is partially individual to each landing and partially common to all landings. It operates in response to the location of the car within a first predetermined distance on either side of the selected landing farther therefrom than the second predetermined distance. When operated it defines an outer zone for the selected landing. The operation of this outer position means actuates the door control means. The safety means operates in response to the operation of both the outer position means and the movement of the car and hoistway doors to their opened positions in conjunction with the failure of the car to enter the inner zone to prevent the car from making a trip from the selected landing to another.

The safety means also operates to stop the car and to prevent it from making a trip from a selected landing should the car overspeed while at the landing with its door or one of the hoistway doors open. To provide this protection the invention includes a speed responsive means comprising a tachometer generator and a switching means which responds to a predetermined speed of the car. The safety means operates if the speed responsive means indicates that the car is traveling at this predetermined speed when either the car door or the hoistway door at the selected landing is in its opened position.

The speed responsive means is also employed to protect against a misoperation in which either the elevator car or its selector machine functions in a manner other than that intended for it such that the operation of one is inconsistent with that of the other. The selector machine includes both a synchronous panel which moves in synchronism with the elevator car and an advancer carriage which moves in advance of the synchronous panel in a direction appropriate for the direction of car movement to select the next landing at which the car is to stop and to provide speed control signals to decelerate the car in accordance with its distance from the selected landing. If when the car, in moving in a predetermined direction, reaches the predetermined speed at which the speed responsive means operates, the selector machine advancer carriage is not a prescribed distance away from the position of the synchronous panel in the direction appropriate for the direction of car movement, as indicated by the operation of the leveling position means, the safety means operates to stop the car and prevent it from making a trip to another landing.

Finally the safety means operates to stop the car and prevent it from making a trip from a selected landing should the car change its acceleration too rapidly while its door or one of the hoistway doors is open.

In addition to safeguarding the intended operation of the elevator car, the safety means also monitors itself to protect against failure of its own equipment. Part of this self-monitoring operation includes preventing the car from making a trip from the selected landing to another in case the inner position means fails to operate after the outer position means operates and the car and hoistway doors move to their opened positions. Also the self-monitoring operation prevents the car from making a trip to another landing if the outer position means fails to operate and either the inner position means operates or the doors move to their opened position. Moreover, the self-monitoring operation prevents the car from making a trip to another landing if the outer position means operates to its unactuated condition before the inner position means operates to its unactuated condition.

The self-monitoring operation of the safety means also provides protection against the failure of the tachometer generator to produce an output signal. To this end, a circuit is provided which stops the car and prevents it from making a trip from the selected landing to another if the tachometer generator is not producing an output signal when the leveling position means on the landing selector machine operates to indicate the entry of the car into the leveling zone at the selected landing.

Other objects, features and advantages of the invention will be apparent to those skilled in the elevator art from the following description and appended claims when considered in conjunction with the following drawing in which,

FIG. 1 is a schematic diagram of an elevator control system employing the invention;

FIG. 2 is a wiring diagram in straight line form of relay circuits employed in the control system of FIG. 1; and

FIG. 3 is a plurality of comparator circuits in block diagram form together with associated relay coils and relay drive circuits.

Although it is adaptable to many elevator control systems, for simplification purposes, the invention will be described as applied to the elevator control system disclosed in the copending ELEVATOR CONTROL SYSTEM" application Ser. No. 495,585 of Otto Albert Krauer et al. filed Oct. l3, 1965 now U.S. Pat. No. 3,442,352 and assigned to the assignee of this application. It is to be realized, of course, that the system disclosed including the invention is simplified from that which would be used in a commercial installation and that in adapting the system to such an installation many changes might be made.

In the drawing the relays are shown with their coils in the deenergized condition. Consequently, all relay contact pairs are illustrated in what is referred to as their unactuated condition. They are in the opposite or their actuated condition when their associated coils are energized. The elevator system is illustrated as serving only three landings although the invention is not so limited and may be used in installations with any number of landings.

Numerals in parentheses after the reference characters associated with some of the connection lines in the drawing identify those FlGS. of the drawing on which the continuations of such lines are to be found.

In the description hereinafter and in the appended claims the car doorway closure will be referred to as a car door or as car door means and each of the hoistway doorway closures will be referred to as a hoistway door or as hoistway door means, it being understood that by this is meant any suitable type of car doorway closure and hoistway doorway closure whether of the single or plural door variety.

Referring to FIG. 1 of the drawing, traction sheave TS is mounted for rotation on the shaft of armature of the direct current elevator hoisting motor. Also driven in any suitable way by the same shaft is tachometer generator 34 which produces on line VT voltage signals whose magnitudes are proportional to the speed of rotation of armature l0 and whose polarities are indicative of the direction of such rotation.

In typical fashion hoist ropes 11 pass over sheave TS and support elevator car CA and its counterweight CW. The car moves whenever brake BR is lifted and the elevator hoisting motor enables sheave TS to rotate. Main field 14 of the hoisting motor is connected across a constant potential source represented as battery 15. In accordance with the well-known Ward Leonard principles of variable voltage control. motor armature 10 is connected to ground across the output circuit of a direct current generator whose armature 16 is mounted on the same shaft as the rotating element 18 of a drive motor, not otherwise shown. Main field 20 of the direct current generator is connected through contacts C 1-2 of potential switch C to receive excitation from operations and motor control equipment OMCS. As is well understood, this equipment is also connected through line W2 to receive distance controlled speed dictation signals from selector machine 42 during both main and leveling operations. Tape TA connected between car CA and counterweight CW rotates sprocket SDS to drive the selector machine.

Sensing coils CDC and CCDC are wound on C-shaped cores which permit the wire conductor between generator armature l6 and motor armature 10 to pass between the concave openings thereof. The material of these cores and the impedance of the coils and their connected circuitry are so chosen as to prevent the cores from saturating in response to a rate of change of acceleration with respect to time which is less than a predetermined amount.

In FIG. 2 lines L+ and L- are connected to a voltage source of suitable potential to operate the relays whose coils are connected across these lines. Gate switch GS represents a typical switch operated in accordance with the position of the car door means. Door switches IDS, ZDS and TDS represent typical switches operated in accordance with the position of the hoistway door means for the first, second and top landings, respectively. Each of the gate and door switches closes when its respective door means is approximately three-quarters of an inch from its fully closed position and opens when its respective door means is opened more than this distance. Such switches are well known in the art. Gate switch GS and switches lDS, 2DS and TDS and door relay GDS comprise a portion of any typical door control means suitable to move the car and hoistway door means between their opened and closed positions. The dotted line box identified by the reference characters DCC represents the remainder of the door control means including a door operating device. Such equipment comprising a closure means for the elevator car.

Outer zone brushes 10DB, 20DB and TODB are mounted on landing selector machine 42 at positions corresponding to the location in the hoistway of the first, second and top landings, respectively. Outer zone contacts ODC are also mounted on the selector machine 42. They are carried so as to move in synchronism with the elevator car and are bridged by one of the brushes 10DB, 20DB and TODB whenever the car is within a first suitable predetermined distance on either side of the landing associated with the respective bridging brush. Stated otherwise, contacts ODC are bridged by the brush 10DB, 20DB or TODB associated with a selected landing whenever the car is located within an outer zone at the selected landing which is defined by the space between two predetermined points one each within a suitable distance on either side of the selected landing. By a suitable distance is meant a sufficient distance to have the car and hoistway doors open a satisfactory amount while the car is leveling to a stop at a landing. This, of course, varies from installation to installation according to various factors including the type of door operating device and the weight and the size of the doors.

In the embodiment described and in the appended claims the outer zone will be described as being inside the leveling zone. In most instances this will be the case. However, it is to be understood that it is contemplated that the outer zone and the leveling zone might be coextensive.

Brushes 10DB, 20DB and TODB, contacts ODC and outer zone relay ODZ together comprise that part of the invention referred to as outer car position means or simply outer position means.

Contacts SPDSl correspond to those contacts identified by the same reference characters and shown in FIG. 10 of the foregoing Krauer et al. application. In the system of that application contacts SPDSI and a second pair of contacts SPDS2 of mechanical switch SPDS on selector machine 42 close and open, respectively, when the car approaches within one to two feet of a landing at which it is stopping. In so operating these two contact pairs transfer control of the elevator hoisting motor from a long range distance controlled speed dictation signal generating device including potentiometer POT operable to provide main operation to a short range one including potentiometer POTll operable to provide leveling operation. In this system contacts SPDS2 are eliminated and contacts SPDS1 are employed to energize the coil of leveling zone relay HXB. Contacts SPDSl close when the car enters a leveling zone at a selected landing at which it is stopping; such leveling zone being defined by the space between two points one on either side of the selected landing and each within one to two feet thereof. Contacts HXB 3-4 and HXB 5-6 (FIG. 1) of relay HXB are employed to perform the functions performed by contact pairs SPDSl and SPDS2 in the system of the foregoing Krauer et al. application. Switch SPDS, contact pair SPDSI and relay HXB comprise that part of the invention referred to as the leveling position means.

Contact pairs ADU and ADD are operated by mechanical switches mounted on selector machine 42 which operate in a manner similar to that of switch SPDS. Contacts ADU close when the advancer carriage is a specific distance from the synchronous panel in a direction corresponding to up car movement and contact ADD correspondingly operate for the down direction car movement.

The dotted line box identified by the reference character S represents the standard safety devices employed in the typical elevator control system.

In FIG. 3 inner zone comparator IDZCOM operates to provide a signal to relay driver RDIDZ which is in conjunction with the potential along line V3 is suitable to energize the coil of inner zone relay IDZ. Such operation occurs so long as the magnitude of the signal along either line V1+ or line V1 exceeds the magnitude of the signal of opposite polarity along line VS from landing selector machine 42. In this way, an inner position means is provided which operates in response to the location of the car inside an inner zone at a selected landing at which the car is stopping; such inner zone being inside the leveling zone and being defined by the space between two additional predetermined points in the hoistway one on either side of the selected landing. In the embodiment described it is suitable to have each of these points within 2 inches of a selected landing.

Like inner zone comparator IDZCOM maximum up and down speed comparators MZSUCOM and MZSDCOM operate to provide a signal to relay drivers RDMZSU and RDMZSD which in conjunction with the potential along line V3 is suitable to energize the coils of maximum up and down speed relays MZSU and MZSD. One of these is energized so long as the magnitude of the signal along either line V2+ or line V2 exceeds the magnitude of the signal of opposite polarity along line VT from tachometer generator 34. Should the magnitude of a signal of negative polarity along line VT exceed the magnitude of the positive signal along line V2+ or the magnitude of a signal of positive polarity along line VT exceed the magnitude of the negative signal along line V2-- the associated relay MZSU or MZSD releases. In this way, relays MZSU and MZSD operate to indicate that the speed of the car in the up and down directions respectively is below a predetermined magnitude.

Tachometer output comparator THOCOM operates to pro vide a signal to relay driver RDTHO which in conjunction with the potential along line V3 is suitable to energize the coil of tachometer output relay THO whenever the magnitude of the output signal from tachometer generator 34 along line VT exceeds the magnitude of the signal of opposite polarity along line V4+ or V4-. Since the magnitudes of the signals along lines V4+ and V4 are selected at values only slightly in excess of the noise level potential of tachometer generator 34 the operation of relay THO indicates that the tachometer generator is producing an output signal greater than its normal noise level. This is a suitable indication that the tachometer generator is operating satisfactorily.

Consider now the operation of the foregoing equipment in safeguarding the elevator car and its control equipment against misoperation. Assume car CA is traveling up approaching landing F2 at which it is stopping in accordance with the description of either one of the stopping operations contained in the foregoing Krauer et al. application. As the car approaches within one to two feet of the landing, contact pair SPDSl closes to energize the coil of relay HXB (FIG. 2). This closes contacts HXB 1-2 (FIG. 2) and contacts I-IXB 3-4 (FIG. 1) and opens contacts I-IXB 5-6 (FIG. 1). Contacts HXB 3-4 and HXB 5-6 in closing and opening respectively transfer the system from main operation to leveling operation. Contacts I-IXB 1-2 close to prepare circuits for door control equipment DCC and the coil of outer zone relay ODZ.

Movement of the car under leveling operation brings it within a first suitable predetermined distance of landing F2 whereupon brush 20DB bridges contacts ODC. This energizes the coil of relay ODZ closing contacts ODZ 7-8 ODZ 9-10 and ODZ 13-4 while at the same time opening contacts ODZ 1-2 and ODZ 3-4. At the same time door control equipment DCC is energized to open the door of car CA and the hoistway door at landing F2. This opens car door contacts GS and hoistway door contacts 2DS interrupting the circuit for the coil of door relay GDS. As a result, contacts GDS 11-12 in one of the circuits for the coil of second auxiliary potential relay CY2 open. This coil however remains energized through the circuit including now closed contacts ODZ 9-10. Also contacts GDS 9-10 open in the coil circuit of first auxiliary potential relay CYl to release that relay. Contacts GDS 7-8 open in the coil circuit of potential switch C that coil remaining energized through the circuit of now closed contacts ODZ 7-8. Contacts GDS 1-2 close to maintain a circuit for the coil of potential switch C after contacts CYl 11-12 disengage. The elevator car is now leveling into landing F2 and both the car door and the hoistway door for that landing are moving between their closed and opened positions.

Continued leveling of the car brings it to a point about 2 inches from landing F2. At this position the signal along line VS from selector machine 42 is insufficient to overcome the potential along line V 1- and inner zone comparator IDZCOM (FIG. 3) operates to cause relay driver RDIDZ to produce a signal sufficient to energize the coil of inner zone relay IDZ. This closes contacts IDZ 9-10 (FIG. 2) reenergizing the coil of first auxiliary potential relay CYI. Also contacts IDZ 7-8 engage in the coil circuit of potential switch C. In addition, contacts IDZ 3-4 disengage and interrupt the coil circuit for second auxiliary potential relay CY2. As a result, contacts CY2 13-14 open in the coil circuit of potential switch C. However, now closed contacts IDZ 7-8 maintain this circuit completed and the car continues leveling until it is within a desired distance of landing F2, usually within one-fourth inch thereof.

As can be seen, if the elevator car and its control equipment operate in their intended manner the safety equipment has no effect upon the system. However, assume now that while the car remains located at landing F2 with the doors open a misoperation occurs to cause it to move more than 2 inches away from the landing. As a result, the signal along line VS from selector machine 42 increases in magnitude sufficiently in one polarity or the other to overcome the potential along either line Vlor line Vl+ causing inner zone relay IDZ to release. This opens contacts IDZ 9-10 releasing first auxiliary potential relay CYl. Also contacts IDZ 7-8 open in the circuit for the coil of potential switch C and this in conjunction with the release of relay CYI and the subsequent opening of contacts CYl 1 1-12 releases potential switch C. The release of switch C in typical fashion prevents the car from making a trip to another landing such as by opening contact C 1-2 in the generator field circuit (FIG. 1) and by opening additional contacts (not shown) to release brake BR.

Thus, it can be seen that the present invention provides an arrangement which enables an elevator car to open its door and the hoistway door of the landing at which it is stopping while the car is leveling and after it has entered a relatively large outer zone at the landing. However, once the car levels into a smaller inner zone it is thereafter prevented from leaving that inner zone as long as the doors remain open. In this way, the leveling operation is restricted to this smaller inner zone once the car has entered it. Systems in which cars stop at landings without opening their doors similarly can be arranged to limit the leveling operation of their cars while located at such landings with their doors closed to the smaller inner zone.

Additionally, the car is prevented from making a trip to another landing if a misoperation prevents it from entering the smaller inner zone at any landing. Assume as before that the car has entered the leveling zone at landing F2, has leveled into the outer zone and has started to open its door and the hoistway door at that landing. in these circumstances, door relay GDS is deenergized, relay CYl is deenergized, relay CY2 is energized through contacts lDZ 3-4, ODZ 9-10 and CY2 11-12, and potential switch C is energized through the circuit including contacts GDS l-2, CY2 13-14 and ODZ 7-8. If the car thereafter fails to enter the inner zone, inner zone relay lDZ remains deenergized and contacts lDZ 7-8 and lDZ 9-10 remain open. As a result relay CY1 also remains deenergized and its contacts CYl 11-12 remain open. This in conjunction with the open condition of contacts lDZ 7-8 eliminates the parallel paths for the coil of potential switch C which otherwise would be provided through these contacts if the car and its control equipment operated in their intended manner.

Continued failure of the car to enter the inner zone and to cause the energization ofinner zone relay lDZ indicates a misoperation. As a result, the car is not permitted thereafter to make a trip from landing F2. If the doors try to close to enable the car to make such a trip, when they reach three-quarters of an inch from their fully closed positions contacts GS and 2DS close to energize door relay GDS. This opens contacts GDS 1-2 and interrupts the circuit for the coil of potential switch C causing its deenergiza tion. Switch C releases and, as explained before, this prevents the car from making a subsequent trip.

Under the foregoing condition, i.e. failure of the car to enter the inner zone, if the car should attempt to make a trip from landing F2 without closing its door and the hoistway door at that landing, door relay GDS remains deenergized. This maintains contacts GDS 7-8 separated. Movement of the advancer carriage from the position of the synchronous panel sufficiently to open contacts SPDSl to release relay HXB and open contacts HXB 1-2 or movement of the car more than the first predetermined distance to separate brush DB from its bridging relationship with contact ODC interrupts the circuit for the coil of outer, zone relay ODZ causing its deenergization. This releases relay ODZ to open contacts ODZ 7-8 interrupting the circuit for the coil of potential switch C causing its deenergization. As previously described switch C releases to bring the car to a stop and prevent it from making a subsequent trip.

As is evident from the foregoing the above described circuitry comprises a safety means for an elevator control system. In addition it also. comprises a reliability circuit means which operates to provide protection against failure of its own components. For example, it is apparent that if inner zone relay lDZ or its coils energizing circuit misoperates and relay lDZ fails to transfer its contacts to their actuated condition upon the car entering the inner zone, the circuit operates to prevent the car from starting on a trip to another landing the same as it does if relay [D2 is not operated because the car fails to enter the inner zone. Also, should inner zone relay [D2 or its coils energizing circuit misoperate and transfer its contacts from their actuated to their unactuated condition while the car is in the inner zone the circuit operates to release potential switch C and prevent the car from making a trip to another landing the same as it does if relay lDZ released because the car departed from the inner zone with its or the hoistway door open.

Moreover, however, should inner door zone relay [D2 or its coils energizing circuit misoperate so that relay lDZ transfers its contacts from their unactuated to their actuated condition before the car enters the outer door zone, contacts [02 l-2 open and interrupt the circuit for the coil of potential switch C causing its deenergization. This, as described previously, releases switch C bringing the car to a stop and preventing it from making a subsequent trip. Should this misoperation of the inner zone relay or its coils energizing circuit occur after the car enters the outer zone, the car would come to a stop in its intended manner but in attempting to leave the landing thereafter contacts lDZ l-2 would remain open to release potential switch C upon outer zone relay ODZ releasing to open contacts ODZ 7-8. As previously explained relay ODZ releases upon the advancer carriage moving sufficiently from the position of the synchronous panel to open contacts SPDS1 and release relay HXB to open contacts HXB 1-2 or upon movement of the car more than the first predetermined distance from the landing to separate brush 20DB from its bridging relationship with contacts ODC.

The reliability circuit also provides protection against failures of outer zone relay ODZ. Assume as before that the car has entered both the leveling zone and the outer zone at landing F2 and that for some reason outer zone relay ODZ fails to transfer its contacts from their unactuated to their actuated condition. As soon as the doors open beyond threequarters of an inch from their fully closed positions door relay GDS releases to open contacts GDS 7-8. Because contacts ODZ 7-8 have not closed this interrupts the circuit for the coil of potential switch C and deenergizes it. Thus, switch C releases to stop the car and prevent it from making a subsequent trip, as previously explained.

Similarly, if a misoperation occurs so that outer zone relay ODZ transfers its contacts from their actuated to their unactuated condition after the car enters the outer zone and after door relay GDS releases, contacts ODZ 7-8 open to release potential switch C with the same result.

A misoperation can also occur to cause door relay GDS to transfer its contacts from their actuated to their unactuated condition when the car is outside the outer zone. If this occurs contacts GDS 7-8 open to release potential switch C to stop the car and prevent it from making a subsequent trip.

As a further precaution against unsafe conditions the relays desirable for use at least as door relay GDS, outer zone relay ODZ and inner zone relay [D2 are of a type which cannot operate their contacts from one condition to another if one of the contact pairs has welded.

Protection is also provided against the elevator car exceeding a predetermined speed with either its car or one of its hoistway doors open. If the speed is exceeded in the up direction the negative polarity voltage from tachometer generator 34 along line VT is of sufficient magnitude to exceed the positive polarity potential along line V2+ to cause the release of maximum speed up relay MZSU to open its contacts MZSU 1-2. If the predetermined speed is exceed in the down direction the positive polarity voltage from tachometer generator 34 is of sufficient magnitude to exceed the negative polarity potential along line V2 to cause the release of maximum speed down relay MZSD to open its contacts MZSD l-2. If any of the doors are in their opened position at the time contacts MZSU 1-2 or MZSD 1-2 open, door relay GDS is released and contacts GDS 13-14 are open. As a result, potential switch C releases to stop the car and prevent it from making a subsequent trip.

Since the output signal from tachometer generator 34 is used to provide protection against overspeeding with the doors open it is desirable to monitor the tachometer generator in order to safeguard against an unsafe condition resulting from its failure to produce an output signal. This monitoring is performed during each trip of the car. Every time the car receives a signal to start from a landing on a trip to another,

tachometer monitoring relay T is energized if tachometer generator 34 produced an output signal while the car was stopping at the landing from which it is to start.

in order to understand this, assume that as the car was stopping and after the engagement of contacts HXB 7-8 of leveling position relay HXB, the speed of the car was sufficient to produce an output signal from tachometer generator 34 along line VT which overcame the signal of opposite polarity along line V4+ or line V4. This caused the energization of the coil of tachometer output relay THO and the closing of contacts THO l-2. Accordingly, the coil of tachometer monitoring relay T was energized and contacts T 1-2 engaged. Thus notwithstanding the output signal from tachometer generator 34 decreased below a value sufficient to maintain relay THO operated when the car stopped, relay T remained operated through its own contacts T 1-2 and contacts HXB 7-8. This maintains contacts T 3-4 engaged throughout the time the car remains at the landing from which it is starting so that the coil of potential switch C remains energized throughout this period.

As the selector advancer carriage moves from the position of the synchronous panel in response to the signal to start contacts SPDSl separate to release relay HXB. This closes contacts HXB 9-10 to maintain the circuit for the coil of switch C and separates contacts HXB 7-8 to interrupt the circuit for the coil of relay T. If after the car starts on its trip from the landing tachometer generator 34 does not produce an output signal sufficient to cause the energization of relay THO, contacts THO 3-4 remain open in the coil circuit of switch C and contacts THO 1-2 remain open in the coil circuit of relay T. With its coil circuit interrupted relay T remains deenergized throughout the trip maintaining contacts T 3-4 separated. Thus when the car approaches within 1 to 2 feet of the next selected landing at which it is to stop and contacts SPDSl engage to cause the energization of relay HXB, the consequent opening of contacts HSB 9-10 interrupt the circuit for the coil of potential switch C. This releases switch C and prevents the car from making a subsequent trip from the selected landing.

Just described is that part of the safety means by which equipment operated by landing selector machine 42, in particular contacts SPDSl and the associated leveling position relay GXB are used to monitor the proper functioning of tachometer generator 34. In turn, the output signal produced by tachometer generator 34 is used to monitor the proper functioning of landing selector 42. In this regard, if the speed of the car has exceeded a predetermined magnitude in a par ticular direction the advancer carriage must be a prescribed distance from the synchronous panel in a direction associated with the particular direction in which the car is moving or else potential switch C is released to cause the car to come to a stop and to prevent it from making a subsequent trip to another landing.

For an explicit explanation of this, assume the car is traveling at a fast enough speed in the up direction to cause the negative polarity output signal from tachometer generator 34 along line VT to exceed the positive polarity signal along line V2+. This releases maximum up speed relay MZSU and opens contacts MZSU 3-4. if as intended under normal operating conditions, the selector machine advancer carriage is a prescribed distance away from the synchronous panel, mechanical switch contacts ADU on selector machine 42 are closed. This maintains potential switch C energized so as not to interfere with the operation of the car. If when relay MZSU operates, however, the advancer carriage is not the prescribed distance away from the synchronous panel in the direction associated with the up direction of movement of the car, contacts ADU are open and the circuit for the coil of potential switch C is interrupted to release the switch. This, as previously explained, stops the car and prevents it from making a subsequent trip to another landing.

Contacts MZSD 3-4 of maximum down speed relay MZSD and mechanical switch contacts ADD on selector machine 42 operate in a similar fashion to protect against inconsistent operation of the selector machine when the car is traveling down.

Finally, protection is also provided against the elevator car changing its acceleration too rapidly with either its car or one of its hoistway doors open. If the rate of change of acceleration with respect to time exceeds a predetermined amount one or the other of the sensing coils CDC or CCDC, depending upon the direction of current flow through the generator armature l6motor armature l0 circuit (FIG. 1), produces a signal of sufficiently positive potential to saturate transistor TDA. This causes the transistor to conduct which lowers its collector potential sufficiently to release relay DADT. This opens contacts DADT l-2 (FIG. 3) and if at this time either the car or one of the hoistway doors is open the circuit for the coil of potential switch C is interrupted. As a result switch C releases stopping the car and preventing it from making a trip to another landing.

Although contacts of the same relays MZSU and MZSD which are used to protect against overspeeding with the doors open are used to monitor the proper operation of the selector machine in this description, it should be understood that it is contemplated that it might be desirable to monitor the proper operation of the selector machine by using contacts of a relay which is operable at a different speed than the relay which is used to protect against overspeeding with the doors open.

Also, in the illustrated embodiment contacts of leveling position relay HXB are employed in the circuits that monitor the proper functioning of tachometer generator 34. Here too, it is contemplated either to use contacts of a mechanical switch which operates directly in response to the distance of the car from a selected landing other than contacts SPDSI or contacts of a relay which operates in response to the operation of this other mechanical switch.

Furthermore, it should also be understood that it is desirable to arrange the system so that after potential switch C has been released it can only be restored to its actuated condition by qualified personnel working in the equipment machine room. Such arrangements are well known and for simplification purposes have not been described herein.

Various other modifications in the foregoing arrangement are possible and it is intended that the invention not be limited to the particularly described embodiment.

We claim:

1. A control system for an elevator car having a closure means and movable to make trips to serve a plurality of landings by stopping at most a desired distance from selected ones of said landings and by operating its closure means upon so stopping to permit passenger transfers to and from the car, comprising; outer car position means operating from a first condition to a second condition in response to the location of said car within a first predetermined distance on either side of a selected landing at which said car is stopping; inner ear position means operating from a first condition to a second condition in response to the location of said car within a second predetermined distance on either side of said selected landing closer thereto than said first predetermined distance and farther therefrom than said desired distance; said first conditions of said outer and inner ear position means signifying the location of said car outside said first and said second predetermined distances, respectively; said second conditions of said outer and inner ear position means signifying the location of said car inside said first and second predetermined distances, respectively; said outer and inner car position means being two separate means each capable of operating independently of the other; and safety means operating in response to the operation of said outer car position means to said second condition and to the operation of said closure means to permit passenger transfers and to the failure of said inner car position means to operate to said second condition preventing said car from making a trip from said selected landing to serve another landing.

2. A control system according to claim 1, wherein, said safety means also operates to prevent said car from making a trip from said selected landing to serve another landing in response to the operation of said inner ear position means to said second condition and the failure of said outer car position means to operate to said second condition.

3. A control system for an elevator car movable to make trips to serve a plurality of landings by starting from and stopping at selected ones of said landings, comprising; outer car position means operating in response to the location of said car inside an outer zone defined by the space within a first predetermined distance on either side of a selected landing at which said car is stopping and signifying by said operation the location of said car inside said outer zone; inner ear position means operating in response to the location of said car inside an inner zone defined by the space within a second predetermined distance on either side of said selected landing closer thereto than said first predetermined distance and signifying by said operation the location of said car inside said inner zone; said outer and inner ear position means being two separate means each capable of operating independently of the other; and safety means operating in response to the loca tion of said car inside said outer zone and the failure of said car to enter said inner zone and preventing said car from making a trip from said selected landing to serve another landing; said safety means also operating in response to both the operation of said inner ear position means to signify the location of said car within said inner zone and the failure of said outer car position means to operate to signify the location of said car within said outer zone and preventing said car from making a trip from said selected landing to serve another landing.

4. A control system according to claim 3, wherein said safety means also operates to prevent said car from making a trip from said selected landing to serve another landing in response to the operation of said outer car position means to signify the location of said car inside said outer zone and the failure of said inner ear position means to operate to signify the location ofsaid car inside said inner zone.

5. A control system for an elevator car movable on trips throughout a building hoistway to provide service to a plurality of landings by starting from and stopping at any selected ones of said landings, comprising; leveling position means operating in response to the location of said car inside a leveling zone at a selected landing at which said car is stopping, said leveling zone being defined by the space between two predetermined points in said hoistway one on either side of said selected landing; inner position means operating in response to the location of said car inside an inner zone at said selected landing, said inner zone being inside said leveling zone and being defined by the space between two other predetermined points in said hoistway, one on either side of said selected landing; car door means on said car movable between a closed position and an opened position; hoistway door means at each landing, each movable between a closed position and an opened position; door control means operating while said car is located inside the leveling zone at said selected landing and before it enters the associated inner zone and controlling said car door means and the hoistway door means at said selected landing to move from their closed positions to their opened positions; leveling control means operating in response to the operation of said leveling position means and controlling the movement of said car at a reduced speed during its entire travel through said leveling zone to level said car to a stop in substantial registry with said selected landing and to relevel said car to maintain such registry after said car has stopped at said selected landing, said leveling and releveling operations being enabled notwithstanding the opened positions of said car and hoistway door means; and safety means operating in response to the operation of said inner position means and limiting the zone in which said leveling control means is effective to control the movement of said car while it remains at said selected landing with either of said door means in the opened position to said inner zone.

6. A control system according to claim 5, including outer position means operating in response to the location of said car inside an outer zone at said selected landing, said outer zone being inside said leveling zone and surrounding said inner zone and being defined by the space between two additional predetermined points in said hoistway, one on either side of said selected landing; and wherein said safety means operates to prevent said car from making a trip from said selected landing to provide service to any other landing in response to both the operation of said outer position means and the failure of said inner position means to operate.

7. A control system according to claim 6, wherein said safety means also operates to prevent said car from making a trip from said selected landing to provide service to any other landing in response to both the operation of said inner position means and the failure of said outer position means to operate.

8. A control system according to claim 7, wherein said door control means operates in response to the operation of said outer position means.

9 A control system according to claim 8, wherein said inner position means includes an inner zone relay having a plurality of contacts which are transferred from an unactuated to an actuated condition in response to the location of said car inside said inner zone; and said safety means includes circuitry comprising contacts of said inner zone relay through which said leveling control means is enabled to operate said circuitry being completed to enable the operation of said leveling control means in response to the transfer of the contacts of said ihner zone relay to their actuated condition.

10. A control system according to claim 9, wherein said door control means includes a door relay having a plurality of contacts which are transferred from an unactuated to an actuated condition in response to said car door means and all said hoistway door means being in their closed positions; said outer position means includes an outer zone relay having a plurality of contacts which are transferred from an unactuated to an actuated condition in response to the location of said car inside said outer zone; and said safety means includes additional circuitry comprising contacts of said inner zone relay, said door relay and said outer zone relay through which said leveling control means is enabled to operate, said additional circuitry being rendered ineffective to enable the operation of said leveling control means upon the contacts of said inner zone relay transferring to their actuated condition.

11. A control system according to claim 10, wherein all the circuitry constituting said safety means forms a reliability circuit means which monitors the operation of said inner zone relay, said outer zone relay and said door relay to protect against failure of said relays producing an unsafe condition for said elevator car.

12. A control system according to claim ll, wherein said reliability circuit means operates to prevent said elevator car from making a trip from said selected landing, firstly immediately if said inner zone relay fails and transfers its contacts from their actuated condition to their unactuated condition when the car is located inside the inner zone, and secondly, upon the car door means and the hoistway door means at said selected landing moving to their closed positions, if said inner zone relay fails, when said car is located inside said outer zone, and prevents its contacts from transferring from their unactuated condition to their actuated condition in response to the entry of said car into said inner zone, and thirdly, immediately, if said inner zone relay fails and transfers its contacts from their unactuated condition to their actuated condition when said car is located outside the outer zone, and fourthly, upon the departure of said car from the outer zone, if said inner zone relay fails when said car is located inside said inner zone, and prevents its contacts from transferring from their actuated condition to their unactuated condition in response to the departure of said car from said inner zone.

13. A control system according to claim 12, wherein said reliability circuit means operates to prevent said elevator car from making a trip from said selected landing, firstly, immediately, if said outer zone relay fails and transfers its contacts from their actuated to their unactuated condition when said car is located inside the inner zone or when it is located inside the outer zone and said door relay contacts are in their unactuated condition, secondly, upon the car entering said inner zone or upon said door relay contacts transferring to their unactuated condition if said outer zone relay fails, either when the car is outside said outer zone, and prevents its contacts from transferring from their unactuated to their actuated condition when the car enters the outer zone, or, when the car is located inside the outer zone, and transfers its contacts from their actuated to their unactuated condition before the car enters the inner zone or said door relay contacts transfer to their unactuated condition.

14. A control system according to claim 13, wherein said reliability circuit means operates to prevent said elevator car from making a trip from said selected landing, firstly, immediately, if said door relay fails, when said car is located outside said outer zone, and transfers its contacts from their actuated condition to their unactuated condition and secondly, upon said car departing from said outer zone if said door relay fails, when said car is located inside said outer zone, and prevents its contacts from transferring from their unactuated condition to their actuated condition upon all doors reaching their closed positions.

15. A control system according to claim 14, including speed responsive means operating in response to a predetermined speed of said car and wherein said safety means operates to stop said car if said speed responsive means operates when said door relay contacts are in their unactuated condition.

16. A control system-according to claim 15, including rate of change of acceleration responsive means operating in response to a predetermined rate of change of acceleration of said car with respect to time and wherein said safety means operates to stop said car if said rate of change of acceleration responsive means operates when said door relay contacts are in their unactuated condition.

17. A control system for an elevator car movable on trips throughout a building hoistway to provide service to a plurality of landings by starting from and stopping at any selected ones of said landings, comprising; car door means on said car movable between a closed position and an opened position; hoistway door means at each landing, each movable between a closed position and an opened position; door control means operating in response to the approach of said car to within a predetermined distance of a selected landing at which it is stopping and controlling said car door means and the hoistway door means at said selected landing to move from their closed to their opened positions; speed responsive means operating in response to a predetermined speed of said car; and safety means operating to prevent said car from making a trip from said selected landing if said speed responsive means operates when either said car door means or said hoistway door means at said selected landing is in its opened position.

18. A control system according to claim 17 wherein said door control means includes a door relay having a plurality of contacts which are transferred from an unactuated to an actuated condition in response to said car door means and all said hoistway door means being in their closed positions; and said safety means operates if said speed responsive means operates when said door relay contacts are in their unactuated condition.

19. A control system according to claim 17, including car position means operating in response to the location of said car within a prescribed distance on either side of a selected landing at which said car is stopping; wherein said speed responsive means includes a tachometer generator operable to produce an output signal signifying the speed of said car; and said safety means operates to prevent said car from making a trip from said selected landing if said tachometer generator fails to produce an output signal when said car position means operates.

20. A control system for an elevator car movable on trips throu bout a building hoistway to provide service to a plurality of andlngs by starting and stopping at any selected ones of said landings, comprising; speed responsive means operating in response to a predetermined speed of said car in a predetermined direction of travel and signifying said speed and direction; a landing selector machine including a synchronous part operable to signifymovement in synchronism with the movement of said car and an advancer part operable to signify movement in advance of the movement of said car in a direction appropriate for the direction of car movement; advancer position means operating in response to the signified location of said advancer part a prescribed distance away from the signified location of said synchonous part in a direction appropriate for said predetermined direction; and safety means operating to prevent said car from making a trip to another landing if said speed responsive means operates to signify the predetermined speed for said car in the predetermined direction and the advancer position means has failed to operate.

21. A control system for an elevator car movable on trips throughout a building hoistway to provide service to a plurality of landings by starting from and stopping at any selected ones of said landings, comprising; rate of change of acceleration responsive means operating in response to a predetermined rate of change of acceleration of said car with respect to time; and safety means operating in response to the operation of said rate of change of acceleration responsive means to stop said car and to prevent it from making a trip to another landing 22. A control system according to claim 21, further comprising; car door means on said car movable between a closed position and an opened position; hoistway door means at each landing, each movable between a closed position and an opened position; door control means operating in response to the approach of said car to within a predetermined distance of a selected landing at which it is stopping and controlling said car door means and the hoistway door means at said selected landing to move from their closed to their opened positions and wherein said safety means operates in response to the operation of said rate of change of acceleration responsive means to stop said car and to prevent it from making a trip from said selected landing if said rate of change of acceleration responsive means operates when either said car door means or said hoistway door means at said selected landing is in its opened position.

23. A control system according to claim 22 wherein said door control means includes a door relay having a plurality of contacts which are transferred from an unactuated to an actuated condition in response to said car door means and all said hoistway door means being in their closed positions; and said safety means operates if said rate of change of acceleration responsive means operates when said door relay contacts are in their unactuated condition.