Safety control device
A safety control device (1) for a people conveyor (101) includes a first safety control channel (2) configured to output a first safety control signal in response to one or more input signals (10, 12, 14). A second safety control channel (4) is configured to output a second safety control signal in response to one or more input signals (10, 12, 14). An override control channel (6) is configured to monitor a health of the first and second safety control channels (2, 4) and determine whether a fault has occurred in either of the first or second safety control channels (2, 4). The override control channel (6) is configured to override the first or second safety control signal in response to a determination that a fault has occurred in the corresponding safety control channel (2, 4). The override prevents activation of one or more safety systems.
1 . A safety control device ( 1 ) for a people conveyor ( 101 ), the safety control device ( 1 ) comprising:
a first safety control channel ( 2 ) configured to output a first safety control signal in response to one or more input signals ( 10 , 12 , 14 );
a second safety control channel ( 4 ) configured to output a second safety control signal in response to one or more input signals ( 10 , 12 , 14 ); and
an override control channel ( 6 ) configured to:
monitor a health of the first and second safety control channels ( 2 , 4 );
determine whether a fault has occurred in either of the first or second safety control channels ( 2 , 4 );
wherein the override control channel ( 6 ) is configured to override the first or second safety control signal in response to a determination that a fault has occurred in the corresponding safety control channel ( 2 , 4 ), the override preventing activation of one or more safety systems.
2 . The safety control device ( 1 ) of claim 1 , wherein the override control channel ( 6 ) is configured to monitor the health of the first and second safety control channels ( 2 , 4 ) by periodically instructing the safety control channels ( 2 , 4 ) to perform one or more tasks and monitor a response from the safety control channels ( 2 , 4 ) and/or monitor a debug output from each safety control channel ( 2 , 4 ).
3 . The safety control device ( 1 ) of claim 1 , wherein the first and second safety control channels ( 2 , 4 ) are further configured to:
monitor the health of the override control channel ( 6 );
determine whether a fault has occurred in the override control channel ( 6 ); and
deactivate the override control channel ( 6 ) in response to a determination that a fault has occurred in said channel ( 6 ).
4 . The safety control device ( 1 ) of claim 3 , wherein the first and second safety control channels ( 2 , 4 ) are configured to, in response to a determination that a fault has occurred in the override control channel ( 6 ), enable the people conveyor ( 101 ) to operate as normal and flag that a fault has occurred in the override control channel ( 6 ).
5 . The safety control device ( 1 ) of claim 1 , wherein the override control channel ( 6 ) is configured to override the first or second safety control signal on a temporary basis or for a predefined period of time or until the people conveyor ( 101 ) is positioned such that any users thereof may safely disembark.
6 . The safety control device ( 1 ) of claim 1 , wherein the override control channel ( 6 ) is configured to override the first or second safety control signal for a time period of no more than one minute.
7 . The safety control device ( 1 ) of claim 1 , wherein the same input signals ( 10 , 12 , 14 ) are received by both the first and second safety control channels ( 2 , 4 ), and wherein the one or more input signals ( 10 , 12 , 14 ) indicate one or more operational parameters of the people conveyor ( 101 ).
8 . The safety control device ( 1 ) of claim 1 , wherein the first and second safety control signals are configured to control the operation of one or more safety systems of the people conveyor ( 101 ).
9 . The safety control device ( 1 ) of claim 1 , wherein the first safety control channel ( 2 ) is configured to output the first safety control signal in order to control the operation of a first safety switch ( 44 , 52 ), and the second safety control channel ( 4 ) is configured to output the second safety control signal in order to control the operation of a second safety switch ( 46 , 54 ).
10 . The safety control device ( 1 ) of claim 9 , wherein the first safety control channel ( 2 ) comprises a first microcontroller unit ( 26 ) configured to output the first safety control signal to a first output circuit ( 40 ) configured to control the operation of the first safety switch ( 44 , 52 ); and wherein the second safety control channel ( 4 ) comprises a second microcontroller unit ( 28 ) configured to output the second safety control signal to a second output circuit ( 42 ) configured to control the operation of the second safety switch ( 46 , 54 ).
11 . The safety control device ( 1 ) of claim 9 , wherein a safety system of the people conveyor ( 101 ) is configured to be activated when one, or both, of the first safety switch ( 44 , 52 ) and the second safety switch ( 46 , 54 ) are deactivated in response to the first and second safety control signals respectively.
12 . The safety control device ( 1 ) of claim 9 , wherein the first safety switch ( 44 , 52 ) and the second safety switch ( 46 , 54 ) are connected in series and configured such that, when both the first safety switch ( 44 , 52 ) and the second safety switch ( 46 , 54 ) are activated, they:
activate an electromagnet ( 51 ) configured to prevent mechanical activation of one or more brakes of the people conveyor ( 101 ); or
activate a drive system ( 111 ) of the people conveyor ( 101 ), enabling it to impart a driving force or torque to the people conveyor ( 101 ) when controlled to do so.
13 . The safety control device ( 1 ) of claim 1 , wherein the people conveyor ( 101 ) is an elevator system ( 101 ).
14 . A method of controlling one or more safety systems of a people conveyor ( 101 ), the method comprising:
outputting a first safety control signal by a first safety control channel ( 2 ) in response to one or more input signals ( 10 , 12 , 14 );
outputting a second safety control signal by a second safety control channel ( 4 ) in response to one or more input signals ( 10 , 12 , 14 );
monitoring a health of the first and second safety control channels ( 2 , 4 );
determining whether a fault has occurred in either of the first or second safety control channels ( 2 , 4 ); and
overriding the first or second safety control signal in response to a determination that a fault has occurred in the corresponding safety control channel ( 2 , 4 ), the overriding preventing activation of one or more safety systems.
15 . A non-transitory computer readable medium comprising instructions configured to cause a safety control device ( 1 ) to operate in accordance with the method of claim 14 .