TECHNICAL FIELD

The invention concerns in general the technical field of elevators. More particularly, the invention concerns a safety solution for elevators.

BACKGROUND

Elevators have electromechanical hoisting machine brakes as safety devices to apply braking force to a traction sheave or a rotating axis of a hoisting machine of an elevator car. There are normally two, or even four, separate brakes working in tandem. These brakes shall be dimensioned to stop and hold standstill an elevator car in case of an operational anomaly. Such an operational anomaly may be an overload situation of an elevator car, undesired movement of an elevator car within a landing or an overspeed situation of an ascending elevator car, for example. Braking force of the electromechanical hoisting machine brakes may be compromised due to various reasons. For example, an error in conducting elevator maintenance, such as a misconduct in brake adjustment process or if foreign matter, such as oil or grease gets into the braking surfaces. Inadequate braking force may also be caused by an error in elevator masses, causing excessive unbalancing torque on the traction sheave of the elevator hoisting machine. Further reasons for the misbehavior may also exist.

Inadequate braking force may lead to undesired movement, i.e. undesired drifting of elevator car despite the hoisting machine brakes are engaged. Such undesired movement may be dangerous for elevator users during normal elevator operation, as well as for maintenance personnel working in elevator shaft outside the normal operation periods.

Consequently, there is a need to introduce complementary safety measures to ensure safe elevator operation. Patent application EP 2848568 A1 discloses a solution for stopping an elevator car using an elevator drive device, after an attempt to apply a hoisting machine brake has been made.

SUMMARY The following presents a simplified summary in order to provide basic understanding of some aspects of various invention embodiments. The summary is not an extensive overview of the invention. It is neither intended to identify key or critical elements of the invention nor to delineate the scope of the invention. The following summary merely presents some concepts of the invention in a simplified form as a prelude to a more detailed description of exemplifying embodiments of the invention.

An object of the invention is to present an elevator safety system, a method, an elevator system, and a computer program for safety operation of an elevator system. The objects of the invention are reached by an elevator safety system, a method, an elevator system, and a computer program as defined by the respective independent claims.

According to a first aspect, an elevator safety system for an elevator system is provided, the elevator system comprising an elevator drive system, the elevator drive system comprising: an elevator hoisting machine for shifting an elevator car in its travel path; and at least two hoisting machinery brakes; the elevator safety system comprising: at least one sensor configured to provide data indicative of a movement of an elevator, a controller configured to: determine operational state of each of the at least two hoisting machine brakes, obtain data from the at least one sensor, generate a control signal causing the elevator hoisting machine to generate a torque for limiting the movement of the elevator, the control signal is generated in response to: a detection of an unallowable movement of the elevator based on data obtained from the at least one sensor, and a detection that the operational state of each of the at least two hoisting machine brakes corresponds to a braking state.

The controller may be configured to perform the determining of the operational states of each of the at least two hoisting machine brakes by at least one of: inquiring the states from at least one elevator brake controller; obtaining measurement data representing control signals of the respective hoisting machine brakes; obtaining measurement data from respective brake sensors.

Moreover, the controller may be configured to perform the obtaining of data from the at least one sensor of the elevator safety system by at least one of: obtaining data from a motor encoder; obtaining data from a sensor mounted to an elevator car; obtaining data from a sensor mounted to a counterweight; obtaining data from a sensor mounted to an elevator shaft; obtaining data from a sensor mounted to a diverting pulley.

The controller may also be configured to perform the detection of the unallowable movement of the elevator by a detection that the data obtained from the at least one sensor exceeds a tolerance defined for a measurement of the respective at least one sensor. The controller may be configured to generate the control signal so that the control signal is arranged to carry data indicative of an amount of torque required for limiting the movement of the elevator.

Still further, the controller may be configured to generate the torque for stopping the movement of the elevator.

The controller may further be configured to generate a control signal for causing a by-pass of a number of safety contacts of a safety chain of the elevator system for maintaining a power supply to the elevator hoisting machine in order to generate the torque. For example, the controller may be configured to enable the by-passing for a predefined period of time. Moreover, the controller may be configured to disable the by-passing by generating a control signal for disabling the by-pass in response to a lapse of the predefined period of time, the lapse is detected by the controller.

According to a second aspect, a method for safety operation of an elevator system is provided, the elevator system comprising an elevator drive system comprising: an elevator hoisting machine for shifting an elevator car in its travel path; and at least two hoisting machine brakes; the method, performed by a controller of an elevator safety system, comprises: determining operational state of each of the at least two hoisting machine brakes, obtaining data from at least one sensor of the elevator safety system, generating a control signal causing the elevator hoisting machine to generate a torque for limiting the movement of the elevator, the control signal is generated in response to: a detection of an unallowable movement of the elevator based on data obtained from the at least one sensor, and a detection that the operational state of each of the at least two hoisting machine brakes corresponds to a braking state.

The determining of the operational states of each of the at least two hoisting machine brakes may be performed by at least one of: inquiring the states from at least one elevator brake controller; obtaining measurement data representing control signals of the respective hoisting machine brakes; obtaining measurement data from respective brake sensors.

Moreover, the obtaining of data from the at least one sensor of the elevator safety system may be performed by at least one of: obtaining data from a motor encoder; obtaining data from a sensor mounted to an elevator car; obtaining data from a sensor mounted to a counterweight; obtaining data from a sensor mounted to an elevator shaft; obtaining data from a sensor mounted to a diverting pulley.

The detection of the unallowable movement of the elevator may be performed by a detection that the data obtained from the at least one sensor exceeds a tolerance defined for a measurement of the respective at least one sensor. The control signal may e.g. be generated so that it carries data indicative of an amount of torque required for limiting the movement of the elevator.

Still further, the torque may be generated for stopping the movement of the elevator.

The method may further comprise: generating a control signal for by-passing a number of safety contacts of a safety chain of the elevator system for maintaining a power supply to the elevator hoisting machine in order to generate the torque. For example, the by-passing may be enabled for a predefined period of time. Moreover, the by-passing may be disabled by generating a control signal for disabling the by-pass in response to a lapse of the predefined period of time, the lapse is detected by the controller.

According to a third aspect, an elevator system is provided, the elevator system comprising: an elevator car; a counterweight; an elevator drive system comprising: an elevator hoisting machine; at least two hoisting machine brakes; the elevator system further comprising: hoisting ropes arranged to run between the elevator car and the counterweight via a traction sheave of the elevator hoisting machine; and an elevator safety system according to the first aspect as defined above.

The elevator hoisting machine may comprise: an electric motor being a type of a permanent magnet motor; and a frequency converter for controlling the electric motor.

According to a fourth aspect, a computer program is provided the computer program comprising computer readable program code configured to cause performing of the method according to the second aspect as defined above when the computer readable program code is run on one or more computing apparatuses.

The expression "a number of” refers herein to any positive integer starting from one, e.g. to one, two, or three.

The expression "a plurality of” refers herein to any positive integer starting from two, e.g. to two, three, or four. Various exemplifying and non-limiting embodiments of the invention both as to constructions and to methods of operation, together with additional objects and advantages thereof, will be best understood from the following description of specific exemplifying and non-limiting embodiments when read in connection with the accompanying drawings.

The verbs “to comprise” and “to include” are used in this document as open limitations that neither exclude nor require the existence of unrecited features. The features recited in dependent claims are mutually freely combinable unless otherwise explicitly stated. Furthermore, it is to be understood that the use of “a” or “an”, i.e. a singular form, throughout this document does not exclude a plurality.

BRIEF DESCRIPTION OF FIGURES

The embodiments of the invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings.

Figure 1 illustrates schematically an elevator system according to an example.

Figure 2 illustrates schematically an elevator safety system according to an example.

Figure 3 illustrates schematically a method according to an example.

Figure 4 illustrates schematically an apparatus according to an example.

DESCRIPTION OF THE EXEMPLIFYING EMBODIMENTS

The specific examples provided in the description given below should not be construed as limiting the scope and/or the applicability of the appended claims. Lists and groups of examples provided in the description given below are not exhaustive unless otherwise explicitly stated.

Figure 1 illustrates schematically an elevator system 1000 according to an example embodiment. The elevator system 1000 as disclosed in Figure 1 may comprise an elevator car 110 arranged to be moved or movable in an elevator shaft 120 e.g. along guide rails mounted in the elevator shaft. The moving of the elevator car 110 may be implemented by a hoisting rope or belt 130 in connection with a counterweight 140 over a traction sheave 150 or the like. The traction sheave 150 belongs to an elevator drive system 160, and to an elevator hoisting machine 165 therein together with hoisting machine brakes 180 among other entities. Conceptually it may be considered that the elevator hoisting machine 165 comprises an electric motor 170, the traction sheave 150, the hoisting machine brakes 180, and other entities such as gears. The electric motor 170 may be controlled with a frequency converter 175 belonging to the elevator drive system 160. The elevator hoisting machine 165 is configured to operate the traction sheave 150 for moving the elevator car 110 in a known manner. The traction sheave 140 may be connected, via a mechanical connection 168, directly or indirectly via the gear to a shaft of the motor 170. The traction sheave may also be integrated with the electric motor 170 so that a rotor of the electric motor, such as a rotor of a permanent magnet motor, is formed in the same rotating part with the traction sheave 140. The elevator system 1000 may also comprise a machine room or be machine roomless, such as have the motor 170 in the elevator shaft 120.

The elevator system 1000 may preferably comprise a plurality of landings 10 or landing floors and, for example, landing floor doors and/or openings, between which the elevator car 110 is arranged to be movable during the normal elevator operation, such as to move persons and/or goods between said landings 10.

Moreover, the elevator system 1000, and the elevator hoisting machine 165 of the elevator drive system 160, may comprise at least two, or even three or four, hoisting machine brakes 180 configured to prevent a movement of the elevator car 110 in the elevator shaft 120 when such an operation is desired. The hoisting machine brakes 180 may be arranged to engage against the traction sheave 150, or against any other rotating part of the elevator hoisting machine 165, such as against a rotating shaft of the electric motor 170. The hoisting machine brakes 180 may be controlled with a brake controller 185 configured to operate the hoisting machine brakes 180. The brake controller 185 may further be in connection and / or integrated with other elements of the elevator 1000, such as an elevator controller 190. The brake controller 185 may comprise a control logic as well as an actuator (not shown) for operating the brakes 180 or at least be in connection with such an actuator.

The elevator controller 190 may also be in communicative connection with other entities, such as with the elevator hoisting machine 165, and the frequency converter 175, to cause a generation of applicable control signals within the elevator hoisting machine 165 to cause a movement of the elevator car 110 in the shaft 120. Moreover, the elevator controller 190 may also be communicatively connected to the brake controller 185 for causing braking operation when necessary. Still further, the elevator system 1000 may comprise other controllers as well as other components, such as sensors for obtaining measurement data of various events in the elevator system. The sensors are denoted with a reference 195 in Figure 1. For example, the elevator car 110 may be provided with a number of sensors 195 for providing measurement data indicative of a movement of the elevator car 110. Moreover, the sensors 195 may also be provided in the elevator hoisting machine 165, or the elevator hoisting machine 165 may comprise entities, such as motor encoder, from which it is possible to obtain data indicative of a movement of respective entities, and even on an operation of the hoisting machine brakes 180 as is described in the forthcoming description. Some sensors 195 may be arranged in the elevator shaft 120 and such sensors 195 may e.g. provide data from which a position the elevator car 110 within the elevator shaft may be derivable. Naturally, the elevator system 1000 may comprise further devices and apparatuses than the ones discussed so far and/or illustrated in Figure 1 . For example, a sensor 195 may be arranged in a diverting pulley of an elevator car or a diverting pulley of an elevator hoisting machine.

Generally speaking the present invention relates to an elevator safety system configured to monitor an operation of an elevator system 1000 and to generate measures in response to a detection of a maloperation of the elevator system 1000. The operation of the elevator safety system is related to a situation that the elevator car 110 travels to a landing and is instructed to stop there by controlling the elevator hoisting machine 165, and at some point the hoisting machine brakes 180 are instructed to engage against a counterpart of the elevator, such as the traction sheave 150 or any other rotating entity of the drive system 160, and it is assumed that the hoisting machine brakes 180 carry the elevator car 110 for the time being. In view of this, the elevator safety system may be implemented for an elevator system 1000 comprising an elevator drive system 160 having at least an elevator hoisting machine 165 for shifting an elevator car in its travel path and a number of hoisting machine brakes 180. As already mentioned, the number of the hoisting machine brakes 180 is at least two. As also said, the hoisting machine brakes 180 are configured to engage with an entity through which a movement of an elevator may be limited if the hoisting machine brakes 180 are operating properly e.g. when the elevator car 110 is instructed to be stopped e.g. at the landing 10. Such an entity, or the counterpart, may e.g. be a traction sheave or any other rotating part of the elevator drive system 160, and the elevator hoisting machine 165. For example, the rotating part may be a shaft of the electric motor 170. An example of the elevator safety system is schematically illustrated in Figure 2 wherein the elevator safety system 200 comprises a controller 210 and at least one sensor 195 arranged to measure an operation of the elevator system as is described in the forthcoming description in more detail. The controller 210 and the at least one sensor 195 are communicatively connected to each other with a wireless communication technology or via a wired connection, such as over a data bus.

In accordance with an example the at least one sensor 195 may be any device, or a system, which is suitable for providing data indicative of a movement of an elevator. The term “elevator” shall be understood in a broad manner and it may mean any entity of the elevator system 1000 from which it is possible to obtain information indicative of the movement of the elevator. Such an entity may e.g. be the elevator drive system 160 and the components therein, such as the entities in the elevator hoisting machine 165, but also the elevator car 110, the counterweight 140, or even the elevator rope 130. In accordance with an advantageous embodiment the data under monitoring is obtained from a motor encoder that converts an angular position or motion of a shaft or axle to analog or digital output signals obtainable by the controller 210. Hence, the motor encoder operates as a sensor 195 for providing data indicative of a movement of the elevator. The application of the motor encoder as the sensor 195 has an advantage that an output data obtainable from the motor encoder is reliable indicator of a movement of the elevator, in particular of a movement of a traction sheave 150 of an elevator hoisting machine 165. Alternatively or in addition, a movement of the elevator may be determined by monitoring of a movement of the elevator car 110 or the counterweight 140 or a diverting pulley with an applicable sensor 195. The sensor 195 may be arranged to the elevator car 110 or to the counterweight 140, or even to both. The sensor 195 may provide absolute or incremental position data, data indicative of a speed of the respective entity, or data indicative of an acceleration of the respective entity, for example. For example, the sensor 195 providing the data indicative of the speed of the respective entity may e.g. be a speedometer whereas the sensor 195 providing the data indicative of the acceleration of the respective entity may e.g. be an accelerometer. Still further, the data may be obtained from a sensor 195 mounted in the elevator shaft 120. The elevator shaft 195 may be provided with a plurality of such sensors 195 e.g. mounted at the landings so that a movement of the elevator car 110 may be detected. The detection may e.g. be based on magnetic, optical, or electromagnetic interaction between the sensor and a counterpart mounted e.g. on an outer surface of the elevator car 110 facing the sensor 195 mounted at the landing. Sensor may be a camera arranged to observe movement of elevator, in particular movement of a rotating part of an elevator hoisting machine 165. In some other embodiments, the sensor 195 in the elevator shaft 120 may be a radar based solution for detecting a movement of the elevator, such as the elevator car 110 or the counterweight 140. Such a radar based solution may be based e.g. on an acoustic or electromagnetic measurement signal. Still further, a sensor 195 may be mounted on a diverting pulley (not shown in Figure 1 ) wherein its possible rotation may be monitored and detected with an applicable sensor 195. The rotation of the diverting pulley directly follows any rotation of the traction sheave 150 if no slipping of the elevator rope is experienced. Still further, any data obtainable from an elevator car 1 10 encoder as the sensor 195 and / or a door zone sensor 195 may be used as data indicative of a movement of the elevator in at least some embodiments of the invention. Also, a barometer may be used for measuring the movement by detection pressure changes due to the movement.

The controller 210 of the elevator safety system 200 may be a dedicated apparatus configured to serve the elevator safety system 200 only. Alternatively, the operation for the elevator safety system 200 may be integrated to another controller of the elevator system 1000, such as to the elevator controller 190. The operation of the controller may also be shared between a plurality of apparatuses as a distributed computing environment wherein the apparatuses may reside locally at a space the elevator system is operating or remotely or at both locations.

Next, some aspects of the present invention are described in the following by referring to Figure 3 illustrating schematically a method implemented by an apparatus configured to operate as the controller 210 of the elevator safety system 200. First, the controller 210 is configured to determine 310 operational states of the hoisting machine brakes 180. The operational states of the hoisting machine brakes 180 refers to either that the hoisting machine brakes 180 are instructed to be engaged or that the hoisting machine brakes 180 are instructed to be not engaged (i.e. they are released). The engagement means that the hoisting machine brakes 180 are instructed to hold the respective entity stationary when the hoisting machine brakes 180 are operating normally and as expected. Flence, the determination 310 of the operational states of the hoisting machine brakes 180 may be implemented so that the controller 210 performing the method obtains data indicative of the state of the hoisting machine brakes 180. The obtainment of the data may comprise a generation of an inquiry to the elevator brake controller 185, or to a plurality of elevator brake controllers 185 if the brakes 180 are controlled with dedicated brake controllers 185, configured to control the respective brakes 180 and the brake controller 185 may respond to the inquiry by providing an indicator of the current state of the hoisting machine brakes 180. Alternatively or in addition, the operational states of the hoisting machine brakes 180 may be obtained by providing access to a control signal of the hoisting machine brakes 180 for the controller 210, such as by measuring a brake coil current e.g. with a current sensor wherein an interruption of the coil current may be interpreted to correspond to an engagement of the respective hoisting machine brakes. Hence, the control signal may e.g. represent a magnetization state of the permanent magnets of the hoisting machine brakes 180 either directly or indirectly. Naturally, the hoisting machine brakes 180 may be equipped with applicable brake sensors, such as brake switches, from which a measurement data is obtained for determining the operational states. For sake of clarity, in case the hoisting machine comprises a plurality of hoisting machine brakes 180 which are individually controlled, the operational states of each of the individual hoisting machine brakes 180 are determined in accordance with the present invention. By applying any of the approaches for determining 310 the operational states of the hoisting machine brakes 180 the controller 210 may perform a detection if all the hoisting machine brakes 180 are controlled to be engaged or not. Alternatively or additionally, the operational states of the hoisting machine brakes 180 may be obtained by reading a control state of the brake control logic.

In addition to the determination 310 of the operational states of the hoisting machine brakes 180 the controller 210 is configured to obtain 320 data from at least one sensor 195. The obtained data from the at least one sensor 195 is such that it is indicative of a movement of an elevator and the controller 210 may determine, based on the data, if the elevator is moving or not. A detection of the movement of the elevator may be performed so that a tolerance for an allowable movement of the monitored entity on which the sensor 195 provides the data may be defined and if the movement determined from the obtained data exceeds the tolerance a detection of an unallowable movement may be generated. In a strictest implementation it may be defined that the tolerance is zero which means that no movement is accepted. Moreover, the amount of tolerance may be dependent on the sensor 195, or sensors 195, and the entity, or entities, measured by the sensors 195. For example, for the motor encoder as the sensor 195 may be defined a smaller tolerance than to a sensor 195 residing in the elevator car 110. Furthermore, in some embodiments the tolerance may be dependent on existing safety standards or a manufacturer defined requirements.

The determination 310 of the operational states of the hoisting machine brakes 180 and the obtainment 320 of the data from the at least one sensor 180 may advantageously be arranged to occur concurrently to enable a reliable detection at step 330 of the method. In step 330, the above described detections based on the data may be performed, if they are not performed in the steps 310 and 320, but especially in the step 330 it is detected if the elevator system experiences a situation in which each of the hoisting machine brakes 180 are instructed to be engaged but an unallowable movement of the elevator is detected at the same time. In practice this means that all the hoisting machine brakes 180 concurrently fail to operate as expected. This is a situation which may cause risks to users of the elevator system e.g. at landings where passengers may enter and exit the elevator car 110, but for some reason the hoisting machine brakes 180 do not maintain the elevator stationary.

Flence, in response to a concurrent detection 330 of an unallowable movement of the elevator and that the operational state of each of the hoisting machine brakes 180 corresponds to a braking state, the controller 210 is configured to generate 340 a control signal causing the elevator hoisting machine 165 to generate a torque for limiting the movement of the elevator. The control signal may be delivered to the elevator hoisting machine 165 to cause the motor 170 to generate the torque to the traction sheave 150 to brake the movement of the elevator. In other words, the controller 210 may generate the control signal to the frequency converter 175 having its own controller for defining and generating a desired control for the electric motor 170. In order to define an optimal control to the electric motor for causing a limitation of the movement of the elevator the frequency converter 175 may receive data indicative of a necessary braking torque from the controller 210. For example, the data may define one or more parameters relating to the movement of the elevator, i.e. the monitored entity, or the part of the elevator system. The parameter may e.g. represent a speed of the respective entity based on which the frequency controller may define a necessary torque for the motor 170 to brake the movement, and make e.g. the respective entity to stop, or at least to limit the movement within defined tolerances, or limits, e.g. with respect to a speed and / or an acceleration if such approach is selected. Such an allowable speed may be, for example, 0.3 m/s. For understanding of the described aspects in relation to the present invention it may be mentioned a drifting of the elevator car 110 having e.g. heavy load downwards from the landing e.g. during a course of loading the elevator car 110 may be an example of the situation in which the present invention is applied for limiting the movement by generating the braking torque against the gravity with the elevator hoisting machine. Still further, the generation of the torque for limiting the movement of the elevator may also covers a generation of the torques which causes returning of the elevator car 110 at a desired location, such as to the landing 10, which may correspond to a relevelling operation of the elevator car 110.

Moreover, further safety measures may be associated to an application of the present invention. Namely, in accordance with some example embodiments the controller 210 of the elevator safety system 200 may be configured to generate an indication to users of the elevator system, such as to the passengers of the elevator car 110, for requesting the users to exit from the elevator car 110 in response to the torque is generated. This may occur with output devices suitable for providing visual or audible, or any other applicable, indications. The generation of the indication may be triggered when the elevator car 110 is detected to reside at a door zone of the landing. In response to that the passengers have exited from the elevator car 110 the elevator system 1000 may be set to service mode and its use is prevented. This may include, but is not limited to, shifting of the empty elevator car to a safety location, which may e.g. correspond to a space above a topmost door zone so that there is no access to the elevator car 110.

At least some aspects of the present invention may be related to an elevator safety chain of the elevator system 1000. Namely, the elevator safety chain contains an electronic safety controller and / or a series connection of plurality of elevator safety contacts. The safety chain is configured for controlling the safety-related power disconnect circuit of the elevator hoisting machine 165, e.g. STO function or main contactor of elevator drive system 160. With this measure power supply of the hoisting motor 170 is selectively allowed or blocked based on operational state of the elevator safety chain. This may mean that power supply to the hoisting motor 170 may be blocked by means of a contactor arranged to the power supply circuit of the hoisting motor 170. Additionally or alternatively, safety chain may be configured such that control signals of low-side and/or high-side transistors in the power inverter of motor controller (e.g. frequency converter of hoisting motor 170) are blocked in response to an operational anomaly is detected e.g. through a detection of a disconnection of one or more safety contacts. In order to safeguard the safety measures in accordance with the present invention the safety chain may be configured to allow power supply of the elevator motor 170, at least for a pre defined period of time e.g. by keeping the safety-related power disconnect circuit in a state capable of supplying power to the elevator hoisting machine 165, and the motor 170 therein, also when elevator car 110 has arrived to a desired location, such as to a destination landing 10, and hoisting machine brakes 180 have been applied to. Preferably, the same holds true and power supply to hoisting motor 170 is still allowed when elevator car 110 is located at door zone with landing doors and / or car doors at least partially open which in normal operation causes a disconnection of the respective safety contacts (i.e. car door contacts). The supply of the power to the elevator hoisting machine 165, and the motor 170 therein, may be arranged by implementing a by-pass arrangement, or by-passing circuit to a number of safety contacts which by pass arrangement is controllable either directly or indirectly by the controller 210 of the elevator safety system 200. For example, the by-pass arrangement may be implemented to selected safety contacts which are e.g. set to a non- conductive state when the elevator car 110 arrives at a landing 10. Such safety contacts may e.g. refer to a number of car door contacts and / or landing door contacts which are set to non-conductive state in response to that the car doors are opened. By setting the by-pass arrangement to a conductive state over the non-conductive safety contacts, the safety circuit is maintained closed which, in turn, allows an operation of the elevator hoisting machine 165, and the motor 170 therein in order to provide the torque in accordance with the present invention when the defined conditions for the generation of the torque are fulfilled.

The above described solution for by-passing of the number of safety contacts for the present invention may be improved by setting a predefined period of time for allowing the by-passing. This may be arranged by arranging the controller 210 of the safety circuit to disable the by-passing e.g. with a control signal generated after the predefined period of time has occurred from an event caused the by-passing, such as from a generation of a first control signal causing an activation of the by-passing. The control of the by-passing circuit may e.g. be implemented with a controllable switch residing in the by-passing circuit. Alternatively, the by-pass function may be implemented with a software based solution executable by an elevator safety controller.

Moreover, according to a further embodiment, the safety chain may be configured to control SBC (safe brake control) function of the hoisting machine brakes 180 as well. This means that power supply of brake coils of the hoisting machine brakes 180 may be allowed or interrupted based on operational state of the elevator safety chain, e.g. by means of separate contactor or a brake control unit. Safety chain may be configured such that power supply to brake coils will be interrupted in case an operational anomaly, such as undesired movement of elevator car 110 is detected based on the method in accordance with the present invention.

In the description above it is mentioned that the entity arranged to perform the method is a controller 210. An example of an apparatus configurable to take a role of the controller 210 is schematically illustrated in Figure 4. For sake of clarity, it is worthwhile to mention that the block diagram of Figure 4 depicts some components of an entity that may be employed to implement a functionality of the apparatus. The apparatus comprises a processor 410 and a memory 420. The memory 420 may store data, such pieces of data as described but also computer program code 425 causing the safety operation in the described manner. The apparatus may further comprise a communication interface, such as a wireless communication interface or a communication interface for wired communication, or both. The communication interface may thus comprise one or more modems, antennas, and any other hardware and software for enabling an execution of the communication e.g. under control of the processor 410. Furthermore, I/O (input/output) components may be arranged, together with the processor 410 and a portion of the computer program code 425, to provide a user interface for receiving input from a user, such as from a technician, and/or providing output to the user of the apparatus when necessary. In particular, the user I/O components may include user input means, such as one or more keys or buttons, a keyboard, a touchscreen, or a touchpad, etc. The user I/O components may include output means, such as a loudspeaker, a display, or a touchscreen. The components of the apparatus may be communicatively connected to each other via data bus that enables transfer of data and control information between the components.

The memory 420 and a portion of the computer program code 425 stored therein may further be arranged, with the processor 410, to cause the apparatus to perform at least a portion of a method for managing the maintenance as is described herein. The processor 410 may be configured to read from and write to the memory 420. Although the processor 410 is depicted as a respective single component, it may be implemented as respective one or more separate processing components. Similarly, although the memory 420 is depicted as a respective single component, it may be implemented as respective one or more separate components, some or all of which may be integrated/removable and/or may provide permanent / semi-permanent / dynamic / cached storage.

The computer program code 425 may comprise computer-executable instructions that implement functions that correspond to steps of the method when the computer program code 425 is loaded into the processor 410 of the controller 210 and executed therein. As an example, the computer program code 425 may include a computer program consisting of one or more sequences of one or more instructions. The processor 410 is able to load and execute the computer program by reading the one or more sequences of one or more instructions included therein from the memory 420. The one or more sequences of one or more instructions may be configured to, when executed by the processor 410, cause the apparatus to perform a method as explicitly described in the description herein. Hence, the apparatus may comprise at least one processor 410 and at least one memory 420 including the computer program code 425 for one or more programs, the at least one memory 420 and the computer program code 425 configured to, with the at least one processor 410, cause the apparatus to perform the method.

The computer program code 425 may be provided e.g. a computer program product comprising at least one computer-readable non-transitory medium having the computer program code 425 stored thereon, which computer pro gram code 425, when executed by the processor 410 causes the apparatus to perform the method. The computer-readable non-transitory medium may comprise a memory device or a record medium such as a CD-ROM, a DVD, a Blu-ray disc, or another article of manufacture that tangibly embodies the computer program. As another example, the computer program may be provided as a signal configured to reliably transfer the computer program.

Still further, the computer program code 425 may comprise a proprietary ap plication, such as computer program code for causing an execution of the method in the manner as described in the description herein. Any of the programmed functions mentioned may also be performed in firm ware or hardware adapted to or programmed to perform the necessary tasks.

The entity performing the method may also be implemented with a plurality of apparatuses, such as the one schematically illustrated in Figure 4, as a distributed computing environment. For example, one of the apparatuses may be communicatively connected with other apparatuses, and e.g. share the data of the method, to cause another apparatus to perform at least one portion of the method. As a result, the method performed in the distributed computing environment generates the safety operation in the elevator system 1000 in the manner as described.

Still further, some aspects of the invention relate to an elevator system 1000 comprising an elevator car 110, a counterweight 140, and an elevator drive system 160. The elevator drive system comprises an elevator hoisting machine 165 and at least two hoisting machine brakes 180. Still further, the elevator system 1000 may comprise hoisting ropes 130 arranged to run between the elevator car 110 and the counterweight 140 via a traction sheave 150 of the elevator hoisting machine 165 and an elevator safety system 200 as described in the foregoing description. For sake of completeness, it may be mentioned that the elevator hoisting machine 165 may comprise an electric motor 170 being a type of a permanent magnet motor and a frequency converter 175 for controlling the electric motor 170. Flence, the elevator system 1000 in accordance with the present invention may correspond to one as schematically illustrated in Figure 1 wherein the elevator safety system 200 is arranged to. The specific examples provided in the description given above should not be construed as limiting the applicability and/or the interpretation of the appended claims. Lists and groups of examples provided in the description given above are not exhaustive unless otherwise explicitly stated.