阅读说明：本技术 用于立即停止的主动制动 (Active braking for immediate stop ) 是由 P.纳加拉简 D.金斯伯格 S.克里什纳默西 D.J.马文 R.E.特博 于 2019-08-19 设计创作，主要内容包括：提供了一种电梯系统控制系统,并且其包含配置成感测电梯轿厢状况的传感器系统、生成指示事故的安全信号的安全系统信令元件和配置成对安全系统信号作出反应的控制系统。在控制系统接收到指示要求主制动器和辅制动器至少之一的接合的事故已发生的安全信号时,控制系统通过以下操作来在事故期间控制减速速率：操作主制动器,确定减速速率是否在目标范围内,以及基于来自传感器系统的信号来调整减速速率。(An elevator system control system is provided and includes a sensor system configured to sense a condition of an elevator car, a safety system signaling element that generates a safety signal indicative of an accident, and a control system configured to react to the safety system signal. When the control system receives a safety signal indicating that an accident has occurred requiring engagement of at least one of the primary and secondary brakes, the control system controls the rate of deceleration during the accident by: the method includes operating the foundation brake, determining whether the rate of deceleration is within a target range, and adjusting the rate of deceleration based on a signal from the sensor system.)

1. An elevator system control system comprising:

a sensor system configured to sense an elevator car condition;

a safety system signaling element to generate a safety signal indicative of an accident; and

a control system configured to react to the safety system signal;

wherein, when the control system receives the safety signal indicating that an accident requiring engagement of at least one of a primary brake and a secondary brake has occurred, the control system controls the rate of deceleration during the accident by:

the operation of the service brake is carried out,

determining whether the deceleration rate is within a target range, an

Adjusting the rate of deceleration based on a signal from the sensor system.

2. The elevator system of claim 1, wherein the control system includes a safety controller that operates the primary and secondary brakes in accordance with elevator car condition data and the safety signal.

3. The elevator system of claim 2, wherein the safety controller comprises:

a calculation unit for calculating at least one of a speed, an acceleration and a deceleration of the elevator car based on the elevator car condition data;

an electronic brake unit for operating the drive machine as said main brake or auxiliary brake;

a brake control unit for operating the brake assembly as said primary or secondary brake; and

a safety monitor and control logic unit for determining which of the drive machine and the brake assembly is to be operated as the main brake and the auxiliary brake and for controlling the electric brake unit and the brake control unit on the basis of the calculations of the calculation unit, the safety signals, elevator system information and brake commands.

4. The elevator system of claim 2, further comprising a drive assembly configured to operate the drive machine and the brake assembly,

wherein:

the safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculation of the calculation unit, the safety signal and elevator system information, and

the safety controller instructs the drive assembly to operate a drive machine and a brake assembly as the primary brake or the secondary brake according to the calculation of the calculation unit, the safety signal and the elevator system information.

5. The elevator system of claim 2, further comprising a drive assembly configured to operate the drive machine and the brake assembly normally autonomously,

wherein:

the safety controller instructs the drive component to operate the drive machine and the brake assembly as the primary brake or the secondary brake during an emergency according to the calculation of the calculation unit, the safety signal and elevator system information.

6. The elevator system of claim 2 wherein:

the safety controller resides in a drive assembly including a controller capable of receiving the elevator car condition data and a power supply portion configured to operate a drive machine and brake assembly autonomously and normally,

the safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculation of the calculation unit, the safety signal and elevator system information, and

the safety controller instructs the power supply section to operate the drive machine and the brake assembly as the primary brake or the secondary brake during an emergency according to the calculation of the calculation unit, the safety signal, and the elevator system information.

7. The elevator system according to claim 1, wherein the adjustment of the deceleration rate includes increasing or decreasing the deceleration rate.

8. An elevator system comprising:

an elevator car;

a drive machine for driving the elevator car to move;

a brake assembly for applying a braking force opposing movement of the elevator car; and

a control system configured to control a rate of deceleration during an accident requiring engagement of at least one of a primary brake and a secondary brake to decelerate movement of the elevator car by:

operating the drive machine or the brake assembly as the service brake,

determining whether the deceleration rate is within a target range, an

Adjusting the deceleration rate in the event that the deceleration rate is outside the target range.

9. The elevator system of claim 8, wherein the control system comprises:

a sensor system configured to sense a condition of the elevator car; and

a safety system signaling element to generate a safety signal indicative of the incident.

10. The elevator system of claim 8, wherein the control system comprises a safety controller.

11. The elevator system of claim 10, wherein the safety controller operates the drive machine and the brake assembly based on elevator car condition data, a safety signal indicative of the accident, and elevator system information.

12. The elevator system of claim 10, wherein the safety controller comprises:

a calculation unit for calculating at least one of a speed, an acceleration and a deceleration of the elevator car based on the elevator car condition data;

an electronic brake unit for operating the drive machine as the main brake or auxiliary brake;

a brake control unit for operating the brake assembly as the primary brake or the auxiliary brake; and

a safety monitor and control logic unit for determining which of the drive machine and the brake assembly is to be operated as the main brake and the auxiliary brake and for controlling the electric brake unit and the brake control unit on the basis of the calculations of the calculation unit, safety signals, elevator system information and brake commands.

13. The elevator system of claim 10, further comprising a drive assembly configured to receive elevator car condition data and to operate the drive machine and the brake assembly,

wherein:

the safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculation, safety signals and elevator system information of the calculation unit, and

the safety controller instructs the drive assembly to operate the drive machine and the brake assembly as the primary brake or the secondary brake according to the calculation of the calculation unit, the safety signal and the elevator system information.

14. The elevator system of claim 10, further comprising a drive assembly capable of receiving elevator car condition data and configured to operate the drive machine and the brake assembly normally autonomously,

wherein:

the safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculation, safety signals and elevator system information of the calculation unit, and

the safety controller instructs the drive component to operate the drive machine and the brake assembly as the primary brake or the secondary brake during an emergency according to the calculation of the calculation unit, the safety signal and the elevator system information.

15. The elevator system of claim 10 wherein:

the safety controller resides in a drive assembly including a controller capable of receiving the elevator car condition data and a power supply portion configured to operate the drive machine and the brake assembly autonomously and normally,

the safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of elevator car situation data and a safety monitor and control logic unit capable of receiving the calculation of the calculation unit, safety signals and elevator system information, and

the safety controller instructs the power supply section to operate the drive machine and the brake assembly as the primary brake or the secondary brake during an emergency according to the calculation of the calculation unit, the safety signal, and the elevator system information.

16. The elevator system according to claim 8, wherein the adjustment to the deceleration rate includes increasing or decreasing the deceleration rate.

17. A method of operating an elevator system, the method comprising:

during an accident requiring engagement of at least one of the primary brake and the secondary brake to decelerate the elevator, the deceleration rate is actively controlled by:

the operation of the main brake is carried out,

determining whether the deceleration rate is within a target range, an

Adjusting the deceleration rate when the deceleration rate is outside the target range.

18. The method of claim 17, wherein the active control comprises stopping the elevator at a landing.

19. The method of claim 17, further comprising determining that the incident is in progress, the determining comprising:

transmitting a status of the elevator car;

generating a safety signal indicative of the accident; and

communicating elevator system information to the elevator car.

20. The method of claim 17, wherein the adjustment to the deceleration rate comprises increasing or decreasing the acceleration rate.

Technical Field

The following description relates to elevator systems, and more particularly, to elevator systems with active braking capability for immediate stopping.

Background

Elevator systems are typically deployed in multi-floor buildings to transport individuals, baggage, and some other types of loads from floor to floor. A given elevator system can contain multiple elevators, and in some cases one or more freight elevators. The plurality of elevators and the freight elevator can each include an elevator car that moves up and down through the hoistway, a drive element that drives movement of the elevator car, and a control system that controls the drive element. Multiple elevators and freight elevators can also contain safety features, such as a set of brakes. The brake is typically operated by engaging the guide rail when the speed of the corresponding elevator exceeds a predefined level in order to generate an amount of friction sufficient to stop the elevator.

Generally, elevator brakes have a high braking torque and a relatively high coefficient of belt friction characteristics. Thus, elevator brakes often cause hard stops of their elevators in situations where immediate stops are required. That is to say if there is an emergency or a power outage, the elevator brake performs an immediate stop and, due to the above-mentioned characteristics, the effect is a high deceleration rate of the elevator. This can cause passenger discomfort for any passenger in the elevator.

Disclosure of Invention

According to an aspect of the disclosure, an elevator system control system is provided and includes a sensor system configured to sense a condition of an elevator car, a safety system signaling element that generates a safety signal indicative of an accident, and a control system configured to react to the safety system signal. When the control system receives a safety signal indicating that an accident has occurred requiring engagement of at least one of the primary and secondary brakes, the control system controls the rate of deceleration during the accident by: the method includes operating the foundation brake, determining whether the rate of deceleration is within a target range, and adjusting the rate of deceleration based on a signal from the sensor system.

According to a further or alternative embodiment, the control system comprises a safety controller which operates the primary brake and the secondary brake in dependence on the elevator car condition data and the safety signal.

According to a further or alternative embodiment, the safety controller comprises: a calculation unit for calculating at least one of speed, acceleration and deceleration of the elevator car based on the elevator car condition data; an electronic brake unit for operating the drive machine as a main brake or an auxiliary brake; a brake control unit for operating the brake assembly as a primary brake or an auxiliary brake; and a safety monitor and control logic unit for determining which of the drive machine and the brake assembly is to be operated as a main brake and an auxiliary brake, and controlling the electronic brake unit and the brake control unit on the basis of the calculations of the calculation unit, the safety signals, the elevator system information and the brake commands.

According to a further or alternative embodiment, the drive assembly is configured to operate a drive machine and a brake assembly. The safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculations of the calculation unit, safety signals and elevator system information. The safety controller instructs the drive assembly to operate the drive machine and the brake assembly as a primary brake or a secondary brake based on the calculations of the calculation unit, the safety signal and the elevator system information.

According to a further or alternative embodiment, the drive assembly is configured to operate the drive machine and the brake assembly normally autonomously. The safety controller instructs the drive assembly to operate the drive machine and the brake assembly as a primary brake or a secondary brake during an emergency based on the calculations of the calculation unit, the safety signals and the elevator system information.

According to an additional or alternative embodiment, the safety controller resides in a drive assembly that includes a controller capable of receiving elevator car condition data and a power supply portion configured to operate the drive machine and brake assembly autonomously and normally. The safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculations of the calculation unit, safety signals and elevator system information. The safety controller instructs the power supply section to operate the drive machine and the brake assembly as a service brake or an auxiliary brake during an emergency according to the calculations of the calculation unit, the safety signals and the elevator system information.

According to a further or alternative embodiment, the adjustment of the deceleration rate comprises increasing or decreasing the deceleration rate.

According to another aspect of the invention, an elevator system is provided and comprises: an elevator car; a drive machine for driving the elevator car to move; a brake assembly for applying a braking force opposing movement of the elevator car; and a control system configured to control a rate of deceleration during an accident requiring engagement of at least one of a primary brake and a secondary brake to decelerate movement of the elevator car by: the method includes operating the drive machine or brake assembly as a foundation brake, determining whether the deceleration rate is within a target range, and adjusting the deceleration rate in the event the deceleration rate is outside the target range.

According to a further or alternative embodiment, the control system comprises a sensor system configured to sense a condition of the elevator car and a safety system signaling element to generate a safety signal indicative of an accident.

According to a further or alternative embodiment, the control system comprises a safety controller.

According to an additional or alternative embodiment, the safety controller operates the drive machine and the brake assembly based on the elevator car condition data, the safety signal indicating the accident, and the elevator system information.

According to a further or alternative embodiment, the safety controller comprises: a calculation unit for calculating at least one of speed, acceleration and deceleration of the elevator car based on the elevator car condition data; an electronic brake unit for operating the drive machine as a main brake or an auxiliary brake; a brake control unit for operating the brake assembly as a primary brake or an auxiliary brake; and a safety monitor and control logic unit for determining which of the drive machine and the brake assembly is to be operated as a main brake and an auxiliary brake, and controlling the electronic brake unit and the brake control unit on the basis of the calculations of the calculation unit, the safety signals, the elevator system information and the brake commands.

According to additional or alternative embodiments, the drive assembly can receive elevator car condition data and be configured to operate the drive machine and the brake assembly. The safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculations of the calculation unit, safety signals and elevator system information. The safety controller instructs the drive assembly to operate the drive machine and the brake assembly as a primary brake or a secondary brake based on the calculations of the calculation unit, the safety signal and the elevator system information.

According to additional or alternative embodiments, the drive assembly can receive elevator car condition data and be configured to operate the drive machine and brake assembly normally autonomously. The safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculations of the calculation unit, safety signals and elevator system information. The safety controller instructs the drive assembly to operate the drive machine and the brake assembly as a primary brake or a secondary brake during an emergency based on the calculations of the calculation unit, the safety signals and the elevator system information.

According to an additional or alternative embodiment, the safety controller resides in a drive assembly that includes a controller capable of receiving elevator car condition data and a power supply portion configured to operate the drive machine and brake assembly autonomously and normally. The safety controller comprises a calculation unit for calculating at least one of the speed, acceleration and deceleration of the elevator car on the basis of the elevator car situation data and a safety monitor and control logic unit capable of receiving the calculations of the calculation unit, safety signals and elevator system information. The safety controller instructs the power supply section to operate the drive machine and the brake assembly as a service brake or an auxiliary brake during an emergency according to the calculations of the calculation unit, the safety signals and the elevator system information.

According to a further or alternative embodiment, the adjustment of the deceleration rate comprises increasing or decreasing the deceleration rate.

According to another aspect of the disclosure, a method of operating an elevator system is provided and includes actively controlling a deceleration rate during an accident requiring engagement of at least one of a primary brake and a secondary brake to decelerate the elevator by: the method includes operating the foundation brake, determining whether the deceleration rate is within a target range, and adjusting the deceleration rate when the deceleration rate is outside the target range.

According to a further or alternative embodiment, the active control comprises stopping the elevator at the landing.

According to a further or alternative embodiment, the method further comprises determining that an accident is in progress, and the determining comprises sensing a condition of the elevator car, generating a safety signal indicative of the accident, and communicating elevator system information to the elevator car.

According to a further or alternative embodiment, the adjustment to the deceleration rate comprises increasing or decreasing the acceleration rate.

These and other advantages and features will become more apparent from the following description taken in conjunction with the accompanying drawings.

Drawings

The subject matter which is regarded as the disclosure is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other features and advantages of the disclosure are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:

fig. 1 is a perspective view of an elevator system according to an embodiment;

fig. 2 is a perspective view of a brake assembly of an elevator system according to an embodiment; and

fig. 3 is a schematic view of a control system of an elevator system according to an embodiment;

fig. 4 is a schematic view of a control system of an elevator system according to an embodiment;

fig. 5 is a schematic view of a control system of an elevator system according to an embodiment;

fig. 6 is a schematic view of a control system of an elevator system according to an embodiment; and

fig. 7 is a flow chart illustrating a method of operation of an elevator control system according to an embodiment.

These and other advantages and features will become more apparent from the following description taken in conjunction with the accompanying drawings.

Detailed Description

As will be described below, a supervisory control is provided for an elevator system. The supervisory control has a high safety integrity level and actively controls the deceleration rate of the elevator in the event that an immediate stop is necessary. This allows the elevator to decelerate at a relatively low rate and thereby improves passenger comfort.

Fig. 1 is a perspective view of an elevator system 101, the elevator system 101 including an elevator car 103, a counterweight 105, roping 107, guide rails 109, a drive machine 111, a speed sensor 113, and a controller 115. The elevator car 103 and the counterweight 105 are connected to each other by a roping 107. The lanyard 107 may include or be configured as, for example, a rope, a steel cable, and/or a coated steel band. The counterweight 105 is configured to balance the load of the elevator car 103 and to facilitate movement of the elevator car 103 within the hoistway 117 and along the guide rails 109 simultaneously and in an opposite direction relative to the counterweight 105.

The roping 107 engages a drive machine 111, which drive machine 111 is part of the overhead structure of the elevator system 101. The drive machine 111 is configured to control movement between the elevator car 103 and the counterweight 105. The speed sensor 113 can be mounted on an upper sheave of the governor system 119 and can be configured to provide a position signal related to the position of the elevator car 103 within the hoistway 117. In other embodiments, speed sensor 113 may be mounted directly to the moving components of drive machine 111, or may be located in other locations and/or configurations as known in the art.

As shown, the controller 115 is located in a controller room 121 of the hoistway 117 and is configured to control operation of the elevator system 101, and in particular, operation of the elevator car 103. For example, the controller 115 can provide drive signals to the drive machine 111 to control acceleration, deceleration, leveling, stopping, etc. of the elevator car 103. The controller 115 may also be configured to receive a speed signal from the speed sensor 113. The elevator car 103 can stop at one or more landings 125 as controlled by the controller 115 as it moves up or down the hoistway 117 along guide rails 109. Although the controller 115 is shown in the controller room 121, one skilled in the art will appreciate that the controller 115 can be located and/or configured in other locations or positions within the elevator system 101.

The drive machine 111 may comprise a motor or similar drive mechanism. According to an embodiment of the present disclosure, the drive machine 111 is configured to comprise an electrically driven motor. The power supply for the motor may be any power source including an electrical grid that, in combination with other components, supplies the motor.

Although shown and described with a roping system, elevator systems that employ other methods and mechanisms for moving an elevator car within a hoistway, such as hydraulic elevators and/or ropeless elevators, can employ embodiments of the present disclosure. FIG. 1 is merely a non-limiting example presented for purposes of illustration and explanation.

Referring to fig. 2, the elevator car 103 of fig. 1 can also include a brake assembly 222. The brake assembly 222 is secured to the elevator car 103 by a support body 224 and includes a brake caliper 226 having one or more brake pads 228. Brake pads 228 are movable to engage guide rail 109 between brake pads 228 and one or more brake pads 230 on opposite sides of guide rail 109. In some embodiments, the brake pads 228 are movable via a braking actuator (braking actuator) 232. The brake actuator 232 may be, for example, a solenoid, linear motor, or other type of actuator. The brake actuator 232 includes one or more brake actuator plungers 234 that extend toward one or more brake pad pins 236.

When the brake actuator 232 is energized, such as during operation of the elevator system 101 of fig. 1, the brake actuator plunger 234 is pulled into the brake actuator 232. When it is desired to activate the brake assembly 222, the brake actuator 232 is de-energized such that the one or more plunger springs 238 bias the brake actuator plunger 234 outwardly, away from the brake actuator 232 and toward and into an extended position. As the brake actuator plunger 234 moves outward, the brake actuator plunger 234 contacts the brake pad pins 236 and pushes the brake pad pins 236 toward the guide rail 109. Brake pad pins 236, in turn, move brake pads 228 to contact guide rail 109 and slow and/or stop movement of elevator car 103 relative to guide rail 109 through frictional forces between brake pads 228 and guide rail 109 and between brake pads 230 and guide rail 109. To deactivate brake assembly 222, brake actuator 232 is energized, pulling brake actuator plunger 234 into brake actuator 232, overcoming the bias of plunger spring 38 and thus allowing brake pad 228 to move away from rail 109.

While the braking assembly 222 is described herein as being coupled to or provided as a component of the elevator car 103, it is understood that other embodiments and configurations are possible. For example, the brake assembly can be coupled to or provided as a component of the drive machine 111. The following description will refer to any of these alternative embodiments and configurations.

Referring to fig. 3-6, wherein the elevator system 101 of fig. 1 includes an elevator car 103 and a drive machine 111 and the elevator car 103 includes the brake assembly 222 of fig. 2, the elevator system 101 further includes a control system 301. The control system 301 is configured to react to an accident requiring engagement of at least one of the primary and secondary brakes (described below as the drive machine 111 and the brake assembly 222, respectively, or vice versa) to effectively decelerate upward and downward movement of the elevator car 103 and actively control the rate of deceleration during the accident. The control system 301 achieves such deceleration rate control by: operating the drive machine 111 or the brake assembly 222 as a primary brake, determining whether the deceleration rate is within a target range, and operating the other of the drive machine 111 or the brake assembly 222 as a secondary brake in the event the deceleration rate is outside the target range.

The control system 301 includes a sensor system 302, a security system signaling element 303, and/or a communication link 304. The sensor system 302 is configured to sense a condition of the elevator car 103 and can be provided as one or more of an encoder, an accelerometer, a laser, an optical or sonar measuring device, a motor current sensor, and the like. The security system signaling element 303 may be configured to generate a security signal indicative of an accident. The communication link 304 is configured to communicate elevator system information, such as floor location, door or floor area information, run type, drive failure information, etc., to the elevator car 103. According to an alternative embodiment, the safety system signaling element 303 can also provide elevator system information to the elevator car 103. Control system 301 may further include a brake command unit 305 configured to generate a brake command that is independent and separate from any other brake command generated by control system 301.

In addition, the control system 301 includes a safety controller 310. The safety controller 310 comprises a calculation unit 311 able to receive elevator car condition data from the sensor system 302 and a safety monitor and control logic unit 312 able to receive safety signals from the safety system signaling element 303 or the communication link 304, elevator system information from the communication link 304 and brake commands from the brake command unit 305 or the communication link 304. The safety controller 310 operates the drive machine 111 and the brake assembly 222 based on the elevator car condition data, safety signals indicating an accident, and elevator system information.

As shown in fig. 3, safety controller 310 further includes an electric brake unit 320 configured to operate drive machine 111 as a primary brake or a secondary brake and a brake control unit 330 configured to operate brake assembly 222 as a primary brake or a secondary brake. In this case, the safety monitor and control logic unit 312 determines which of the drive machine 111 and the brake assembly 222 will operate as the primary brake and which of the drive machine 111 and the brake assembly 222 will operate as the secondary brake. In addition, the safety monitor and control logic unit 312 is configured to control the electronic brake unit 320 and the brake control unit 330 based on at least one of the speed, acceleration and deceleration, the safety signal, the elevator system information, and the brake command calculated by the calculation unit.

Thus, in the event that the drive machine 111 is provided as a primary brake and the brake assembly 222 is provided as a secondary brake, the drive machine 111 will be engaged by the electronic brake unit 320 to slow the upward or downward movement of the elevator car 103 while an accident requiring the elevator car to stop is in progress. At this time, the rate of deceleration of the elevator car 103 can be sensed by the sensor system 302. If the rate of deceleration is sensed to be too great and thus uncomfortable to the occupant, the operation of the drive machine 111 can be adjusted by the electronic brake unit 320. Conversely, if the deceleration rate is sensed to be too slow in stopping the elevator car 103 in view of the nature of the accident, the brake assembly 222 can be engaged by the brake control unit 330 to increase the deceleration rate. If the deceleration rate is thus increased to a point where there is a risk of passenger discomfort, a determination can be made as to whether a hazard is necessary in order to effect a stop of the elevator car.

It is to be understood that one skilled in the art will recognize that the operations described above can be reversed in the event that brake assembly 222 is provided as the primary brake, and drive machine 111 is provided as the secondary brake. Therefore, this case need not be described in further detail.

In an exemplary situation, the primary brake can be operated to slow the elevator car 103 and can be provided as the drive machine 111 or the brake assembly 222 while the secondary brake is provided as the brake assembly 222 or the drive machine 111. If the primary brake is the brake assembly 222, and the brake assembly 222 is configured with its own primary and secondary controls in a dual braking configuration, the drive machine 111 may not actually be necessary. On the other hand, the drive machine 111 can be configured as a set of resistors across the three-phase windings of the motor, a set of switches or diodes across all 3-phase windings, a single switch (e.g., an IGBT) and a resistor that can be provided as the motor windings themselves. Here, the "system safety signal" can be a physical or logical input through the communication link 304, and the "brake command" can be a physical or logical input through the communication link 304.

As shown in fig. 4, the control system 301 further comprises a drive assembly 401. Drive assembly 401 includes a controller 410 capable of receiving a "drive safe in" signal and a communication link signal and a power supply portion 420 operable by controller 410 to control the operation of drive machine 111 and brake assembly 222.

In the embodiment of fig. 4, safety controller 310 generally operates in a similar manner as described above with respect to fig. 3, except that drive machine 111 would typically be provided as a primary brake, and braking assembly 222 would typically be provided as a secondary brake, and would be engaged in the event that drive machine 111 could not be used to achieve a sufficient rate of deceleration in a given accident.

As shown in fig. 5, the control system 301 further comprises a drive assembly 501. Drive assembly 501 includes a controller 510 capable of receiving communication link signals and a power supply portion 520 capable of receiving Pulse Width Modulation (PWM) signals from safety controller 310 and operable by safety controller 310 and controller 510 to control the operation of drive machine 111 and brake assembly 222.

In the embodiment of fig. 5, the safety controller 310 generally operates in a similar manner as described above with respect to fig. 3, except that during normal operation, the power supply portion 520 is operated by the controller 510, but if an emergency stop is detected, the power supply portion 520 is operated by the safety controller 310. Likewise, the drive machine 111 will typically be provided as a primary brake and the brake assembly 222 will typically be provided as a secondary brake and will be engaged in the event that the drive machine 111 cannot be used to achieve a sufficient rate of deceleration in a given accident.

As shown in fig. 6, the safety controller 310 can reside in the drive assembly 501 along with the controller 510 and the power supply portion 520.

According to additional or alternative embodiments, it is understood that in particular the brake module 222 of fig. 4-6 can be controlled by another external device than the drive assembly 401 of fig. 4 or the drive assembly 501 of fig. 5 and 6.

3-6, various controllers and components are referenced, however, one skilled in the art will appreciate that controllers and components may be combined into fewer components and/or controllers or further partitioned into more controllers and/or components, and that components and controllers are shown in the figures to reflect logical functions and not necessarily physical components.

Referring to fig. 7, a method of operating an elevator system is provided and includes determining whether an accident requiring engagement of at least one of a primary brake and a secondary brake to decelerate movement of an elevator car is in progress (701) and actively controlling a deceleration rate (702) during the accident to, for example, stop the elevator car at a landing. The active control is achieved by: determining whether the deceleration rate is within a target range by operating the drive machine or the brake assembly as the primary brake (7021), adjusting the operation of the drive machine or the brake assembly as the primary brake in the event the deceleration rate is above the target range (7023) and operating the other of the drive machine or the brake assembly as the secondary brake in the event the deceleration rate is below the target range (7024). The method may further comprise an optional operation of determining whether the target range should be adjusted (703) and adjusting the target range accordingly (704) or leaving the target range unaffected (705).

A technical effect and benefit of the present disclosure is an improvement in the ride provided by an elevator system in the event of an immediate stop.

While the disclosure has been presented in detail in connection with only a limited number of embodiments, it should be readily understood that the disclosure is not limited to such disclosed embodiments. Rather, the disclosure can be modified to incorporate any number of variations, alterations, substitutions or equivalent arrangements not heretofore described, but which are commensurate with the spirit and scope of the disclosure. Additionally, while various embodiments of the present disclosure have been described, it is to be understood that the exemplary embodiment(s) may include only some of the described exemplary aspects. Accordingly, the disclosure is not to be seen as limited by the foregoing description, but is only limited by the scope of the appended claims.