HK1243050B - Elevator component separation assurance system and method of operation - Google Patents

Description

Elevator component spacing assurance system and operating method

Background Art

The present disclosure relates to elevator systems, and more particularly to an elevator brake control system for ensuring separation of moving components of an elevator system.

Self-propelled elevator systems, also known as ropeless elevator systems, are useful in certain applications (e.g., high-rise buildings) where the mass of the ropes used for roped systems is too great and/or multiple elevator cars are required in a single hoistway. For ropeless elevator systems, it can be advantageous to actuate the mechanical brakes of the elevator car from the car itself. Similarly, it can be advantageous to actuate or control the propulsion of the elevator car generally from the hoistway side for power distribution and other reasons. To achieve both of these advantages, a communication link should exist between the car and the hoistway side to perform reliable braking operations. Moreover, for systems with multiple elevator cars, actuating one car may affect the spacing between multiple cars. Improvements in elevator car brake control and/or ensuring car spacing would be desirable.

Summary of the Invention

A method of operating an elevator car separation assurance system according to one non-limiting embodiment of the present disclosure includes: determining, by a safe motion state estimator, a position and velocity of each of a plurality of cars; determining, by a safety assurance module, a separation map associated with a first car and an adjacent second car of the plurality of cars; initiating a first separation assurance-triggered event associated with at least one of the first car and the second car and based on the separation map; detecting, by a recovery manager, the first separation assurance-triggered event; and slowing, by the recovery manager, at least a third car of the plurality of cars based on the detection.

In addition to the foregoing embodiment, the event triggered by the first interval guarantee is Ustop.

In the alternative or in addition, in the preceding embodiment, the first interval guarantee-initiating event is an actuation of a secondary brake.

In the alternative or in addition, in the foregoing embodiment, the method includes: initiating a second spacing guarantee triggered event based on a second spacing map; and stopping at least one of the plurality of cars by the recovery manager based on initiation of the first spacing guarantee triggered event and the second spacing guarantee triggered event.

In the alternative or in addition, in the foregoing embodiment, the first car is in a way and the second car is in a transfer station.

In the alternative or additionally, in the preceding embodiments, the first car and the second car are in a transfer station.

In the alternative or in addition, in the foregoing embodiment, the first car and the second car are in a way.

In the alternative or in addition, in the preceding embodiment, the first car is in a transfer station and the second car is in a parking station.

An elevator component separation assurance system according to another non-limiting embodiment includes: a controller comprising: an electronic processor; a computer-readable storage medium; a safe motion state estimator configured to identify a speed and a position of each of a plurality of elevator components; and a safety assurance module configured to form a separation map for each of adjacent pairs of components in the plurality of elevator components to initiate a Ustop that maintains elevator component separation; and further including a brake controller carried by each of the plurality of elevator components and configured to actuate a secondary brake upon detecting a loss of communication with at least a portion of the controller.

In addition to the foregoing embodiments, the safe motion state estimator and the safety assurance module are software-based.

In the alternative or in addition to the aforementioned embodiment, the elevator component separation assurance system includes a recovery manager configured for communicating with the safety assurance module and reducing the speed of at least one of the plurality of elevator components based on actuation of the Ustop.

In the alternative or in addition to the preceding embodiment, the brake controller is configured to activate the secondary brake after communication with the safety assurance module is lost.

In the alternative or in addition to the preceding embodiment, the brake controller is configured to determine whether a Ustop has occurred before activating the secondary brake.

In the alternative or in addition to the foregoing embodiment, the safety assurance module is configured to actuate a secondary brake for maintaining elevator assembly separation, and the recovery manager is configured to reduce speed of the plurality of elevator assemblies based on actuation of the secondary brake.

In the alternative or in addition to the foregoing embodiment, the recovery manager is configured to stop at least one of the plurality of elevator assemblies based on actuation of a plurality of Ustops by the safety assurance module.

In the alternative or in addition to the aforementioned embodiment, the recovery manager is configured to stop at least one of the plurality of active elevator components based on at least one actuation of Ustop by the safety assurance module and at least one actuation of a secondary brake by the safety assurance module.

In the alternative or in addition to the aforementioned embodiment, said recovery manager is configured for confirming when it is safe to operate following said actuation of said Ustop.

In the alternative or in addition, in the foregoing embodiment, the pair of adjacent assemblies includes a first car positioned in the way and a second car positioned in the transfer station.

In the alternative or in addition to the foregoing embodiment, the pair of adjacent assemblies includes a first car positioned in a transfer station and a second car positioned in a parking station.

In the alternative or in addition, in the aforementioned embodiment, the plurality of elevator assemblies is a plurality of ropeless elevator cars.

The aforementioned features and elements can be combined in various combinations without exclusivity, unless otherwise expressly indicated. These features and elements and their operation will become more apparent in view of the following description and accompanying drawings. However, it should be understood that it is intended that the following description and accompanying drawings are exemplary in nature and are non-restrictive.

BRIEF DESCRIPTION OF THE DRAWINGS

Those skilled in the art will appreciate the various features from the description of the disclosed non-limiting embodiments. The drawings that accompany the detailed description can be briefly described as follows:

FIG1 depicts a multi-car elevator system in an exemplary embodiment;

FIG2 is a top view of the car and portions of the linear propulsion system in an exemplary embodiment;

FIG3 is a schematic diagram of a linear propulsion system;

FIG4 is a block diagram of an elevator component spacing assurance system for an elevator system;

FIG5 is a block diagram of an elevator component spacing assurance system illustrated in a first operational level;

FIG6 is a graph of time versus vertical displacement of adjacent elevator cars during a first floor scenario;

FIG7 is a block diagram of an elevator component spacing assurance system illustrated in a second operational layer;

FIG8 is a graph of time versus vertical displacement of adjacent elevator cars during a second floor scenario;

FIG9 is a block diagram of an elevator component spacing assurance system illustrated in a third operational layer;

FIG10 is a graph of time versus vertical displacement of adjacent elevator cars during a third floor scenario;

FIG11 is a block diagram of an elevator component spacing assurance system illustrated in a fourth operational layer;

FIG12 is a graph of time versus vertical displacement of adjacent elevator cars during a fourth floor scenario;

FIG13 is a block diagram of an elevator component spacing assurance system illustrated in the fifth operating layer;

FIG14 is a block diagram of an elevator component spacing assurance system illustrated in a sixth operational layer;

FIG15 is a graph of time versus vertical displacement of adjacent elevator cars during a fifth floor scenario;

FIG16 is a block diagram of an elevator component separation assurance system illustrating a safe motion state estimator, a safety assurance module, and a recovery manager;

FIG17 is a block diagram of a security assurance module; and

FIG18 is a block diagram of the recovery manager.

DETAILED DESCRIPTION

Ropeless Elevator System:

FIG1 depicts a self-propelled or ropeless elevator system 20 in an exemplary embodiment that can be used in a structure or building 22 having multiple levels or floors 24. The elevator system 20 includes a hoistway 26 defined by several boundaries and carried by the structure 22, and at least one car 28 adapted to travel in the hoistway 26. The hoistway 26 can include, for example, three lanes 30, 32, 34, with any number of cars 28 traveling in any lane and in any number of directions of travel (e.g., upward and downward). For example, and as illustrated, the cars 28 in the lanes 30, 34 can travel in an upward direction, and the car 28 in the lane 32 can travel in a downward direction.

Above the top floor 24 may be an upper transfer station 36 that facilitates horizontal movement of the elevator car 28 to move the car between the hallways 30, 32, 34. Below the first floor 24 may be a lower transfer station 38 that facilitates horizontal movement of the elevator car 28 to move the car between the hallways 30, 32, 34. It should be understood that the upper transfer station 36 and the lower transfer station 38 may be located at the top floor 24 and the first floor 24, respectively, rather than above and below the top floor and the first floor, respectively, or may be located at any intermediate floor. Each transfer station 36, 38 may further be associated with and communicate with a parking station 39 for storage and/or maintenance of the car 28. Furthermore, the elevator system 20 may include one or more intermediate transfer stations (not illustrated) vertically located between the upper transfer station 36 and the lower transfer station 38 and similar to the upper transfer station 36 and the lower transfer station 38.

1-3 , a linear propulsion system 40 is used to propel the car 28. The linear propulsion system 40 may have two linear propulsion motors 41, which may be positioned generally on opposite sides of the elevator car 28, and a control system 46 (see FIG3 ). Each motor 41 may include a stationary primary portion 42, generally mounted to the building 22, and a movable secondary portion 44, mounted to the elevator car 28. The primary portion 42 includes a plurality of windings or coils 48, which generally form rows extending longitudinally along each of the passageways 30, 32, 34 and projecting laterally into each of the passageways 30, 32, 34. Each secondary portion 44 may include two opposing rows of permanent magnets 50A, 50B, mounted to each car 28. The plurality of coils 48 of the primary portion 42 are generally located between and spaced apart from the opposing rows of permanent magnets 50A, 50B. The primary section 42 is supplied with a drive signal from the control system 46 to generate a magnetic flux that imparts a force to the secondary section 44 to control the movement of the car 28 in its respective travelway 30, 32, 34 (e.g., upward, downward, or stationary). It is contemplated and understood that any number of secondary sections 44 may be mounted to the car 28, and any number of primary sections 42 may be associated with the secondary sections 44 in any number of configurations. It is further understood that each travelway may be associated with only one linear propulsion motor 41 or three or more motors 41. Furthermore, the primary section 42 and the secondary section 44 may be interchangeable.

3 , the control system 46 may include a power supply 52, a driver 54 (i.e., an inverter), a bus 56, and a controller 58. The power supply 52 is electrically coupled to the driver 54 via the bus 56. In one non-limiting embodiment, the power supply 52 may be a direct current (DC) power supply. The DC power supply 52 may be implemented using a storage device (e.g., a battery, a capacitor) and may be an active device that regulates power from another source (e.g., a rectifier). The driver 54 may receive DC power from the bus 56 and may provide a drive signal to the primary section 42 of the linear propulsion system 40. Each driver 54 may be an inverter that converts the DC power from the bus 56 into a multi-phase (e.g., three-phase) drive signal that is provided to a corresponding section of the primary section 42. The primary section 42 may be divided into a plurality of modules or sections, each of which is associated with a corresponding driver 54.

The controller 58 may include an electronic processor and a computer-readable storage medium for receiving and processing data signals and comparing this data with a pre-programmed profile via, for example, a pre-programmed algorithm. The profile may be related to car speed, acceleration, deceleration, and/or position within the passageway, transfer station, and/or parking station 39. The controller 58 may provide a thrust command from a motion regulator (not shown) to control the generation of a drive signal for the driver 54. The driver output may be pulse width modulated (PWM). The controller 58 may be implemented using a processor-based device programmed to generate a control signal. The controller 58 may also be part of an elevator control system or an elevator management system. The elements of the control system 46 may be implemented in a single integrated module and/or may be distributed along the hoistway 26.

4 , the control system 46 may generally include modules for ensuring spacing between the plurality of cars 28 in the travelways 30, 32, 34, transfer stations 36, 38, and parking stations 39. Any one or more of these modules may be software-based and part of the controller 58, and/or may include electronic and/or mechanical hardware including various detection devices. The modules of the controller 58 may include a supervisory control module 60, a reactive spacing assurance module 62, a normal car motion state estimator 64, a transfer station control module 66, a travelway supervisory module 68, a proactive spacing assurance module 70, and a vehicle control module 72. The control system 46 may further include a safety assurance module 74 (SAM) and a safe motion state estimator 76, both of which may be part of the controller 58 or separate from the controller 58.

Interface 78 provides communication between the supervisory control module 60 and the transfer station control module 66. Interface 80 provides communication between the supervisory control module 60 and the roadway supervision module 68. Interface 82 provides communication between the roadway supervision module 68 and the proactive spacing assurance module 70. Interface 84 provides communication between the proactive spacing assurance module 70 and the vehicle control module 72. Interface 86 provides communication between the reactive spacing assurance module 62 and the vehicle control module 72. A communication bus 88 provides communication between the plurality of drives 54 associated with a first roadway 30 and the cars 28 within the first roadway and the plurality of drives 54 associated with another roadway 32 and the cars 28 within the roadway 32. For each roadway 30, 32, 34, the communication bus 88 facilitates direct communication with the associated supervisory control module 60, the associated proactive spacing assurance module 70, the associated reactive spacing assurance module 62, and the associated normal car motion state estimator 64. The interfaces 80, 82, 84, 86 and bus 88 may generally be hardwired for reliable communication. However, it is contemplated and understood that any number of the interfaces or portions of the interfaces may be wireless.

The vehicle control module 72 can communicate bidirectionally with each of the drives 54 via an interface 90. Each drive 54 of the control system 46 can include a normal inverter control module 92, a normal motion sensor 94, a safe motion sensor 96, and a Ustop inverter control 98. The SMA 74 can communicate directly with the normal inverter control module 92, the motor primary 42, and the Ustop inverter control module 98 of each of the multiple drives 54 via a corresponding interface 100. The safe motion sensor 96 communicates with the Ustop inverter control module 98 via an interface 102 and communicates with the safe motion state estimator 76 via an interface 104. The interfaces 90, 100, 102, 104 can generally be hardwired for reliable communication. However, it is contemplated and understood that any number of the interfaces or portions of the interfaces can be wireless.

Each elevator car 28 may carry components and/or modules of the control system 46, which may include a brake control module 106, a car speed and acceleration sensing module 108, at least one primary brake 110, at least one secondary brake 112, and at least one motion sensor target 114. The motion sensor target 114 is implemented in conjunction with each of the normal motion sensors 94 of each drive 54 to detect movement of the elevator car 28 relative to each drive 54. The brake control module 106 communicates with the primary brake 110 and the secondary brake 112 via an interface 116, and the car speed and acceleration sensing module 108 communicates with the brake control module via an interface 118. The interfaces 116, 118 may generally be hardwired for reliable communication. However, it is contemplated and understood that any number of the interfaces, or portions of the interfaces, may be wireless.

Ustop operation:

Stopping the elevator car 28 can generally occur in two stages. First, the elevator car 28 is decelerated by the drive 54 (i.e., inverter) and propulsion motor 41. Second, the final stop of the car 28 is achieved by applying the primary brake 110 (i.e., holding brake). During the deceleration stage, each drive 54 near the car 28 can apply current to the propulsion motor 41 in a manner that causes the car 28 to decelerate. This deceleration can continue until the speed of the car 28 becomes slow enough to apply the primary brake 110. The primary brake 110 is then applied to achieve the final stop of the car 28. The on-car brake control module 106 can receive a command signal at all times to raise or lower the primary brake 110. If no command is received, the brake control module 106 can default to a decision to lower the primary brake.

Before acting on the command to release the primary brake 110, the brake control module 106 can utilize the car speed and acceleration sensing module 108 (e.g., a speed sensor) to determine whether the speed is below an appropriate threshold. The SAM 74 can monitor the status from the brake control module 106 via the wireless interface 126 at all times, and if no status is received, the SAM 74 coupled to the Ustop inverter control module 98 can command the drive 54 and the associated primary section 42 to stop the car 28. As used herein, the term 'Ustop' can be understood to mean an emergency stop that can be initiated when the system determines that it may be undesirable for the elevator car to continue moving along the planned speed profile. Undesirable conditions that may not be related to interval assurance may cause a Ustop.

Multi-car interval ensures operation:

Referring to Figures 5 through 15 , the elevator assembly spacing assurance system 59 of the control system 46 provides spacing assurance between elevator assemblies 28 that may be in motion. The elevator assembly spacing assurance system 59 may be an elevator car spacing assurance system that, as a non-limiting example, operates in approximately six modes or operating levels, in a sequential order from the first level to the next sequential level. As shown in Figures 5 and 6 , the first level (i.e., the roadway supervision mode) assigns elevator assembly (e.g., car) destinations in a manner that prevents assembly conflicts and ensures sufficient spacing between elevator assemblies or cars 28. The first operating level prevents conflicting commands to multiple elevator cars 28. More specifically, during operation in the first level, the supervisory control module 60 may output control signals to the roadway supervisor 68, which in turn outputs control signals to the vehicle control module 72, which in turn outputs control signals to each of the drives 54. The normal inverter control module 92, the normal motion sensor 94, and the motor primary 42 generally operate under normal conditions. At the same time, the vehicle control module 72 outputs a control signal to the brake control module 106 via the interface 120, which may be wireless. The brake control module 106 can send a signal to the primary brake 110 to decelerate the elevator car 28 under normal operating conditions. That is, in the first floor, the primary brake 110 is used to generally hold the elevator car 28 after the elevator control system 46 confirms that the car has stopped at the floor of interest.

The first layer can operate substantially without knowledge of the prescribed profile and updates regarding car positions when the cars arrive at their destinations. The decision criteria for the first layer can always be proactive. The first layer output can be a car prescribed profile that ensures adequate car spacing.

Referring to Fig. 6, the scenario of the normal operating condition under the first operating layer is described with position contrast time. In this embodiment, the leading car 28L can experience the acceleration of the command (see line segment 122A). The leading car 28L can subsequently rise several floors (see line segment 122B) at a specified speed until the deceleration (see line segment 122C) of the command is received. Under the first layer, the trailing car 28T must keep trailing, but the car can become closer to the leading car 28L. In this embodiment, the trailing car 28T must first make a motion request and is not allowed to accelerate (see line segment 124A) before the passageway supervision module 68 permits. Once in motion, the trailing car 28T just moves upward (see line segment 124B) and until the trailing car 28T is ordered to decelerate (see line segment 124C) at a specified speed.

7 and 8 , the second level (i.e., proactive separation assurance mode) generally checks commands before they are executed, thereby preventing commands that would conflict with another car. More specifically, the second level is activated when there is a problem with the roadway supervision module 68. During operation at the second level, the normal car motion state estimator 64 and the proactive separation assurance module 70 interact. The proactive separation assurance module 70, having received input from the normal car motion state estimator 64, sends command signals to the vehicle control module 72, which then communicates with the drive 54 and elevator car 28 as described for the first level.

The second layer operates by generally accepting or rejecting the first layer specifications (i.e., commands/requests from the corridor supervision module 68). The inputs for the second layer operation may include knowledge of the prescribed profiles and position and velocity updates for all cars in the corridor. The decision criteria for the second layer may include a check of the prediction interval spacing before accepting the prescribed profile. The output of the second layer is the acceptance or rejection of the prescribed profile.

Referring to FIG8 , a scenario illustrating operating conditions at the second operating level is illustrated using position versus time. In this embodiment, the leading car 28L may undergo a commanded acceleration (see line segment 122A). The leading car 28L may then ascend several floors at the specified speed (see line segment 122B) until an unexpected braking scenario occurs in which the leading car 28L does not stop at the intended destination (i.e., represented by dashed line segment 122E). At the second level, the trailing car movement request from the lane supervision module 68 is problematic and denied. That is, the proactive spacing assurance module 70 denies the lane supervision module request, and the trailing car 28T does not accelerate and remains at the initial position or floor 24 (i.e., floor).

9 and 10 , the third level (i.e., reactive interval assurance mode) generally checks actual car motion against an expected motion profile. The third level protects against deviations in the normal motion profile from the expected profile. More specifically, the third level activates when there are issues with the roadway supervision module 68 and the proactive interval assurance module 70. During operation of the third level, the reactive interval assurance module 62 and the vehicle control module 72 interact. The reactive interval assurance module 62, having input received from the normal car motion state estimator 64, sends command signals to the vehicle control module 72, which then communicates with the drive 54 and elevator car 28 as described for the first level.

The third layer operates by commanding normal deceleration of the trailing car 28T when necessary. Inputs for the third layer operation may include position/velocity updates for all cars 28 in the corridor. Decision criteria for the third layer may include a check of the predicted interval spacing during any point in time and a determination of whether the trailing car 28T needs to be stopped. The output action of the third layer may include stopping the trailing car 28T at a time-based deceleration rate using the nominal vehicle motion control system.

Referring to FIG. 10 , a position versus time scenario is illustrated for operating conditions at the third operating level. In this embodiment, both the leading car 28L and the trailing car 28T are traveling in an upward direction at a prescribed speed (see corresponding segments 122B and 124B). The leading car 28L ascends several floors 24 until an unexpected braking scenario occurs in which the leading car 28L does not stop at the intended destination. Below the third level, the trailing car movement request from the roadway supervision module 68 is questioned and denied, and the trailing car 28T is commanded to undergo a commanded timed deceleration from the reactive spacing assurance module 62 (see segment 124C).

11 and 12 , the fourth layer (i.e., SAM plus Ustop mode) generally checks the car position and speed against structural constraints (e.g., car, bracket, terminal) for an aggressive stopping profile. The fourth layer can provide protection to prevent motion control failure. More specifically, the fourth layer is activated when there is a problem with the lane supervision module 68, the proactive interval assurance module 70, the reactive interval assurance module 62, the vehicle control module 72, the normal car motion state estimator 64, the normal inverter control module 92, and the motion sensor 94. During operation of the fourth layer, the SAM 74 and the safe motion state estimator 76 interact. The SAM 74 can then output commands to the Ustop inverter control module 98 and the motor primary section 42 via the interface 100. The SAM 74 can further communicate with the brake control module 106 via the interface 126, which can be wireless.

The fourth layer operates by commanding the Ustop deceleration of the trailing elevator car 28T when necessary. The input for the fourth layer operation can include position and speed updates for all cars in the passage. The decision criteria for the fourth layer can include an examination of the predicted interval spacing during any point in time and a determination of whether the trailing car 28T needs to stop. The output action of the fourth layer can include using the backup Ustop control system to stop the trailing car 28T at a time-based deceleration rate. The output action can further include marking the fourth layer event as an integrity management function (i.e., part of the first layer), which indicates that the fourth layer reaction is activated.

Referring to FIG. 12 , a scenario illustrating operating conditions at the fourth operating level is illustrated using position versus time. In this embodiment, both the leading car 28L and the trailing car 28T are traveling in an upward direction at a specified speed (see corresponding segments 122B, 124B). The leading car 28L ascends several floors 24, and an unexpected Ustop scenario occurs in which the leading car 28L does not stop at the intended destination (i.e., both the primary brake 110 and the secondary brake 112 are actuated, see segment 122D). In this scenario, the scheduled deceleration for the third floor (described above, see segment 124C) fails, and the SAM 74 performs a Ustop on the trailing car 28T (see segment 124D).

Referring to Figures 13 and 15, the fifth layer (i.e., SAM plus secondary brake 112) activates the secondary brake 112 to protect against propulsion failure. More specifically, when there is a problem with the lane supervision module 68, the proactive interval assurance module 70, the reactive interval assurance module 62, the vehicle control module 72, the normal car motion state estimator 64, the normal inverter control module 92, the motion sensor 94, the primary part 42, the secondary part 44, the Ustop inverter control module 98, and the primary brake 110, the fifth layer is opened. During operation on the fifth layer, the SAM 74 and the safe motion state estimator 76 interact. The SAM 74 can then output a command to the brake control module 106 via the wireless interface 126. The brake control module 106 can then actuate the secondary brake 112.

The fifth layer operates by commanding deceleration of the trailing elevator car 28T when needed (i.e., a higher level of deceleration provided by activation of the secondary brake 112 on the car) and activation of the secondary brake 112 when needed. Inputs for fifth layer operation may include position and velocity updates for all cars 28 in a roadway (e.g., roadway 30). Decision criteria for the fifth layer may include a check of the predicted interval spacing during any point in time and a determination of whether the trailing car 28T needs to be stopped by braking. Output actions for the fifth layer may include stopping the trailing car 28T by activation of the secondary brake 112 and marking a fifth layer event as an integrity management function (i.e., part of the first layer) indicating that a fifth layer reaction is activated.

Referring to FIG. 15 , a scenario illustrating operating conditions at the fifth operating level is illustrated using position versus time. In this embodiment, both the leading car 28L and the trailing car 28T are traveling in an upward direction at a prescribed speed (see respective segments 122B, 124B). The leading car 28L ascends several floors 24 until an unexpected braking event occurs in which the leading car 28L does not stop at the intended destination. In this scenario, the scheduled deceleration for the third floor of the trailing car 28T (described above, see segment 124C) fails. Furthermore, the Ustop deceleration for the fourth floor of the trailing car 28T (described above, see segment 124D) also fails, and the secondary brake 112 is activated (see segment 124E) via the brake control module 106, which receives input from the car speed and acceleration sensing module 108.

Referring to Figure 14, the sixth layer (i.e., the secondary brake 112 on the car is actuated) activates the secondary brake 112 when the communication link (i.e., the interface 120, 126) fails or has a problem and therefore the Ustop 'response' fails. The sixth layer thus protects against propulsion failures (i.e., Ustop failures) associated with wireless interface failures and/or SAM 74 failures. More specifically, the sixth layer is activated when there is a problem with the communication link 126 and/or SAM 74. The sixth layer will be activated regardless of whether there is a problem with the following components: the passageway supervision module 68, the proactive interval assurance module 70, the reactive interval assurance module 62, the vehicle control module 72, the normal car motion state estimator 64, the normal inverter control module 92, the motion sensor 94, the primary part 42, the secondary part 44, the Ustop inverter control module 98, and the primary brake 110. During operation at the sixth floor, the car speed and acceleration sensing module 108 is active and configured to actuate the secondary brake 112 .

The sixth floor operates by first verifying that a Ustop deceleration of the trailing elevator car 28T has not occurred. Due to the loss of communication with the SAM 74, this verification is essentially a self-assessment. That is, the brake control module 106 receives signals from the car speed and acceleration sensing module 108. These signals are then processed to determine whether the elevator car speed and deceleration are consistent with a Ustop event. If not, the brake control module 106 (i.e., operating in sixth floor mode) can command activation of the secondary brake 112.

Inputs for the sixth layer of operation may include on-car accelerometer signals and diagnostics indicating the health of the SAM 74 to the on-car brake communication network. Decision criteria for the sixth layer may include a check of the wireless connection, and if the wireless connection is lost (i.e., fails), a determination is made as to whether the car 28T is executing a deceleration rate consistent with the Ustop. If the deceleration is not consistent with the Ustop, the secondary brake 112 is actuated. The output actions of the sixth layer may include stopping the trailing car 28T by activating the secondary brake 112, and marking the sixth layer event to the recovery manager 128, indicating that the sixth layer reaction is activated. It is further understood and anticipated that the sixth layer of operation generally provides more than just the elevator car spacing guarantee. That is, the sixth layer can be opened after the communication link 126 is lost and regardless of the elevator car position.

Car interval guarantee management:

16 to 18 , the car separation assurance system 59 can include a safe motion state estimator 76, a SAM 74, and a recovery manager 128. The estimator 76, the SAM 74, and the recovery manager 128 can be substantially software-based and at least partially programmed into the controller 58. The safe motion state estimator 76 can be configured to identify which elevator cars 28 are active (e.g., moving) and their positions relative to each other in the elevator system 20. These positions can include positions in the roadways 30, 32, 34, transfer stations 36, 38, and parking stations 39 (see FIG1 ). When an elevator car 28 is identified as active, data signals output by the position and velocity sensors are made available to the car separation assurance system 59. The safe motion state estimator signals can include continuous and discrete information and the sensed states of the elevator cars 28.

The SAM 74 is configured to make decisions regarding whether to apply the primary brake 110 or the secondary brake 112 based on sensory inputs (e.g., speed, position, and status) of two adjacent cars 28 (i.e., see car A and car B in FIG. 17 as one example) and preprogrammed spacing diagrams 200, 202, 204, 206 that are generally based on the physical layout of the elevator system 20. That is, the spacing diagram 200 may be based on adjacent elevator cars A and B both being in the same travelway 30. The spacing diagram 202 may be based on one elevator car being in the travelway 30 and the other elevator car being in a transfer station 36. The spacing diagram 204 may be based on both elevator cars A and B being in a transfer station 36. The spacing diagram 206 may be based on one elevator car being in a transfer station 36 and the other elevator car being in a parking station 39.

The recovery manager 128 is configured to detect and provide notification of an event triggered by car spacing assurance. The event can be the activation of Ustop (i.e., brake on, see box 208 in Figure 17) or the activation of the secondary brake 112 (i.e., safety on, see box 210 in Figure 17). The notification is provided to the supervisory control module 60 (see Figure 4) and is used to temporarily reduce the car speed to minimize any possibility that all cars are not sufficiently spaced from each other (see box 212 in Figure 18). If multiple safety actions are detected, the recovery manager 128 can be configured to stop all elevator cars 28 at the nearest accessible floor 24 (see box 214). It is further expected and understood that the recovery manager 128 can be configured to confirm when "running is safe" (see box 216) after an event triggered by spacing assurance. It is further expected and understood that the event triggered by car spacing assurance can be an event other than the activation of Ustop or the secondary brake. It is further understood that the recovery manager's 128 reactions to events may include other actions and/or that a different number of events must occur for certain actions to be initiated.

It is understood and contemplated that the elevator assembly spacing assurance system 59 may provide for spacing of the cars as previously described, but may also provide for spacing of the cars from empty bays in, for example, transfer stations and/or dynamic terminals.

Although the present disclosure has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the spirit and scope of the present disclosure. In addition, various modifications may be applied to adapt the teachings of the present disclosure to specific circumstances, applications, and/or materials without departing from the basic scope of the present disclosure. The present disclosure is therefore not limited to the specific embodiments disclosed herein, but encompasses all embodiments falling within the scope of the appended claims.

Claims (20)

1. A method for operating an elevator car interval guarantee system, comprising: The position and velocity of each of the multiple cars are determined by a safe motion state estimator; The safety assurance module selects a pre-programmed interval diagram associated with the first car and the adjacent second car among the plurality of cars; Initiate an event triggered by a first interval guarantee, the event being associated with at least one of the first car and the second car and based on the interval diagram; The event triggered by the first interval guarantee is detected through the recovery manager; and The recovery manager slows down at least the third of the plurality of cars based on the detection. 2. The method of operating the elevator car interval guarantee system as claimed in claim 1, wherein the event triggered by the first interval guarantee is an emergency stop, the emergency stop being initiated when it is determined that it is undesirable for the elevator car to continue moving along the planned speed distribution. 3. The method of operating the elevator car interval guarantee system as described in claim 1, wherein the event triggered by the first interval guarantee is the actuation of the secondary brake. 4. The method for operating the elevator car interval guarantee system as described in claim 1, further comprising: Events triggered by the second interval guarantee based on the second interval diagram; and The recovery manager stops at least one of the plurality of cars based on the events triggered by the first interval guarantee and the second interval guarantee. 5. The method for operating an elevator car spacing guarantee system as described in claim 1, wherein the first car is in the passageway and the second car is in the transfer station. 6. The method of operating an elevator car spacing guarantee system as claimed in claim 1, wherein the first car and the second car are in a transport station. 7. The method of operating the elevator car spacing guarantee system as claimed in claim 1, wherein the first car and the second car are in the passageway. 8. The method for operating an elevator car spacing guarantee system as described in claim 1, wherein the first car is in the transport station and the second car is in the parking station. 9. An elevator component spacing guarantee system, comprising: A controller includes: an electronic processor; a computer-readable storage medium; a safe motion state estimator configured to identify the speed and position of each of a plurality of elevator components; and a safety assurance module configured to select from a plurality of pre-programmed interval maps for each of adjacent component pairs among the plurality of elevator components to initiate an emergency stop to maintain the interval between elevator components, wherein the emergency stop is initiated when it is determined that continued movement of the elevator components along a planned speed distribution is undesirable; and A brake controller, carried by each of the plurality of elevator components, is configured to actuate a secondary brake upon detecting a loss of communication with at least a portion of the controller. 10. The elevator component spacing guarantee system of claim 9, wherein the safe motion state estimator and the safety guarantee module are software-based. 11. The elevator component spacing guarantee system as claimed in claim 9, further comprising: The recovery manager is configured to communicate with the safety assurance module and reduce the speed of at least one of the plurality of elevator components based on the actuation of the emergency stop. 12. The elevator component spacing guarantee system of claim 9, wherein the brake controller is configured to activate the secondary brake after loss of communication with the safety guarantee module. 13. The elevator component spacing guarantee system of claim 12, wherein the brake controller is configured to determine whether an emergency stop has occurred before the secondary brake is activated. 14. The elevator component spacing guarantee system of claim 11, wherein the safety guarantee module is configured to actuate a secondary brake to maintain elevator component spacing, and the recovery manager is configured to reduce the speed of the plurality of elevator components based on the actuation of the secondary brake. 15. The elevator component interval guarantee system of claim 11, wherein the recovery manager is configured to stop at least one of the plurality of elevator components based on the actuation of the safety guarantee module to a plurality of emergency stops. 16. The elevator component interval guarantee system of claim 11, wherein the recovery manager is configured to stop at least one of the plurality of operating elevator components based on at least one actuation of the emergency stop by the safety guarantee module and at least one actuation of the secondary brake by the safety guarantee module. 17. The elevator component spacing guarantee system of claim 11, wherein the recovery manager is configured to confirm when it is safe to operate after the actuation of the emergency stop. 18. The elevator component spacing guarantee system of claim 9, wherein the adjacent component pair comprises a first car disposed in the passageway and a second car disposed in the transfer station. 19. The elevator component spacing guarantee system of claim 9, wherein the adjacent component pair comprises a first car disposed in a transport station and a second car disposed in a parking station. 20. The elevator component spacing guarantee system of claim 9, wherein the plurality of elevator components are a plurality of cordless elevator cars.