CN109890738A - First security control unit, the method for operating the first security control unit, the second security control unit, the method and elevator device for operating the second control unit - Google Patents
First security control unit, the method for operating the first security control unit, the second security control unit, the method and elevator device for operating the second control unit Download PDFInfo
- Publication number
- CN109890738A CN109890738A CN201880003517.2A CN201880003517A CN109890738A CN 109890738 A CN109890738 A CN 109890738A CN 201880003517 A CN201880003517 A CN 201880003517A CN 109890738 A CN109890738 A CN 109890738A
- Authority
- CN
- China
- Prior art keywords
- control unit
- safety
- security control
- state
- safe input
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B66—HOISTING; LIFTING; HAULING
- B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
- B66B13/00—Doors, gates, or other apparatus controlling access to, or exit from, cages or lift well landings
- B66B13/22—Operation of door or gate contacts
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B66—HOISTING; LIFTING; HAULING
- B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
- B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
- B66B5/0006—Monitoring devices or performance analysers
- B66B5/0018—Devices monitoring the operating condition of the elevator system
- B66B5/0031—Devices monitoring the operating condition of the elevator system for safety reasons
Abstract
Provide a kind of the first security control unit (20a) of the secure network of elevator device, first security control unit (20a) is configured to determine that multiple safety input (202a, safe input state more than first 204a), and determine according to the multiple first safe input states the Safety output state of at least one Safety output (212a).
Description
Technical field
The present invention relates to the first security control units, the method for operating the first security control unit, the second security control list
The method and elevator device of member, the second control unit of operation.
Background technique
Current state-of-the-art elevator device is furnished with the safety circuit of hardware connection.Due to there is multiple safety contacts and its in electricity
Distribution in terraced system, these safety circuits are often very complicated.
Summary of the invention
According to the one side of this specification, a kind of the first security control unit of the secure network of elevator device is provided.
First security control unit include at least one processor, at least one include the memory of computer program code, at least one
A digital communications module, multiple safety inputs and at least one Safety output.At least one processor and computer program code
It is configured as and at least one processor, at least one digital communications module, multiple safety inputs and at least one Safety output
The first security control unit is set at least to determine more safe input states of multiple first inputted safely.First security control unit
It is additionally configured to receive more than second safe input states from the second security control unit of secure network by digital communications module,
And at least one Safety output is determined according to the multiple first safe input states and according to the multiple second safe input states
Safety output state.
The safe input state that physical security contact is monitored to dominance using parallel way, replaces the hardware of the prior art
The hardware connection safety circuit of wiring safety circuit, the prior art consumes a large amount of single cord.It is traditionally series connection and parallel connection
The complicated safety circuit wiring for connecting mixed network, simplifies due to wired in parallel.Parallel way (parallel supply)
Have the advantages that reduce pervious wiring.Therefore, because shorter strand, less wiring and the entire elevator safety electricity of realization
Simplifying for road and reduce costs.Shorter strand is that the partial points as where in physical security contact/safety sensor mention
For caused by security control unit and necessary safety input.Shorter strand allows to reduce the supply voltage water inputted safely
It is flat.Long safety circuit length is no longer problem, because cable length greatly reduces.Therefore, provided first security control list
Member, which can discharge car top space and simplify the equipment of the installation of pit, elevator control system and control cabinet, to be greatly simplified.Moreover,
It is feasible that voltage for providing safety contact, which reduces,.
The quantity of input and tie point for electric life controller system can greatly reduce, it ensure that hardware, system
Setting up time and system maintenance is easier, therefore cost can be significantly reduced.The safe condition of output can pass through correspondence
Configurable logic control function determine.For example, due to that can include by physics in multiple positions in logic control function
The safe input state of road contact, physical bypass contact/switch can have significantly less safety contact, such as only one
Safety contact can save space and cost.This is equally applicable to the urgent motor switch of physics or physics inspection switch.
Another advantage can be dispensed with the security module of complexity and valuableness for bypassing safety contact, and by the first peace
The corresponding portion substitution of the logic control function of full control unit.Moreover, it is no longer necessary to for the buffer lower than specified standards
With the security module of the pre- leveling that opens the door again.Especially it is no longer needed for the function of the elevator motor of safe torque shutdown frequency converter
Security module in rate module.
More than second a states of the safe input state of the second security control unit of expression received are mapped to safe electricity
In road network.More than first and second safe conditions obtained from the first security control unit can monitor all safe conditions.It changes
Sentence is talked about, and can be carried out simple to the physical security contact of all connections at any given time and completely be monitored (all to open
Pass is not concatenated, in parallel).Dominance: security control unit can be reduced in secure network between security control entity
Single-strand cable.Especially in the case where lift car, the removal cable of lower quality is connected to lift car and is advantageous.
It can monitor safe input state.Therefore, complete safety circuit monitors are carried out by bus or is supervised by output
It is feasible for surveying several main standard safety circuit points.These outputs can be easily used for third party's controller system.It is special
Not, monitoring can easily test short circuit/bypass door safety contact.In addition, existing electric elevator installation can pass through security control
Unit is upgraded, horizontal to obtain the more higher operational safety than in the past.
In short, reducing the construction, transformation and dimension of elevator device when reaching necessary level of security to maintenance elevator device
The cost of shield.
According to advantageous example, the first security control unit includes monitoring output, wherein the first security control unit is configured
For the state for determining monitoring output according at least part of at least part of multiple first states and multiple second states.
Advantageously, security control unit offer monitoring output, monitoring output can be configured freely to provide and connect and received peace
The information needed of the case where full input state.For example, existing elevator control system can by Elevator Monitoring state output come
Determine whether to run, therefore existing elevator device can be transformed.In another example, it is controlled by monitoring output
Indicator light, to help maintenance staff quickly to check elevator device or part thereof of state.
According to advantageous example, the first security control unit is additionally configured to the signal edge according to the safe input state of setting type
Determining at least one Safety output state, wherein the safe input state of setting type opens or closes simulation self-lock switch, and according to
The signal edge of the safe input state of restoration type determines at least one Safety output state, wherein the safe input state of restoration type
Close or open self-locking (latching) switch of simulation.Advantageously, self-lock switch is simulated and for acting and resetting simulation certainly
The safety input of lock-switch provides reduction procedure, such as without using additional reset box.Particularly, it is no longer necessary to for pacifying
Self-holding contact/switch (such as safety tongs or limiter of speed) of full device.Magnet for resetting self locking safety circuit contacts is also
It is unwanted.
According to advantageous example, the state for simulating self-lock switch is remaining type (type remanent), and wherein first
Security control unit includes nonvolatile memory, wherein the first security control unit is also used to the simulation of remaining type certainly
Nonvolatile memory is written in the state of lock-switch, after starting the first security control unit, from nonvolatile memory
Fetch the state of the simulation self-lock switch of remaining type.It can be advantageous to after power breakdown from nonvolatile memory
Fetch remaining (remanent) state.Therefore, the distribution of residual state is maintained at determining source, i.e., in corresponding security control list
At member.In addition, for self-locking remaining contact/switch, it is no longer necessary to uninterruptible power supply, such as pit overhaul is monitored, because
These switches are replaced by corresponding security control unit.
According to advantageous example, the first security control unit includes another digital communications module, and wherein the first safety control
Unit processed is additionally configured to provide more than first and second a input states by other digital communications module with read-only mode.Have
Sharp ground, the other digital communications module provide diagnosis interface.For example, if other digital communications module is WLAN or ether
Net module, then laptop or handheld device can provide the on-line monitoring function of safety circuit.In addition, as Internet of Things service
Such third party's service can monitor the function (IoT: Internet of Things) of safety circuit
According to advantageous example, the first security control unit includes the first and second safety relays, wherein described at least one
A Safety output is the output of the series connection of the normally opened contact of safety relay.The series connection of normally opened contact provides safety
Mechanism.If one in two safety relays is not powered on, Safety output state will be zero, so that elevator machine stops moving
It is dynamic.
According to advantageous example, if first processing units detect in the first and second safety relays via feedback states
The failure of at least one, then first processing units determine the first driving signal open the first safety relay normally opened contact,
And wherein, if the second processing unit detects at least one of first and second safety relays by feedback states
Failure, then the second processing unit determines that the second driving signal opens the normally opened contact of the second safety relay.Advantageously, safety after
The regular event of electric appliance is monitored.
According to advantageous example, feedback states be the first safety relay normally-closed contact and the second safety relay it is normally closed
The output of the series connection of contact.By this series connection of the normally-closed contact of safety relay, one in safety relay
Failure and Safety output state can be determined that it is safe.
According to the another aspect of this specification, a kind of side that the first security control unit is operated by secure network is provided
Method.This method comprises: determine more safe input states of multiple first inputted safely, by digital communications module from safety net
Second security control unit of network receives more than second safe input states, and according to the multiple first safe input states and more
A second safe input state determines the Safety output state of at least one Safety output.
According to the another aspect of this specification, a kind of the second security control of the safety circuit network of elevator device is provided
Unit.Second security control unit include at least one processor, at least one include the memory, extremely of computer program code
A few digital communications module and multiple safety inputs.At least one processor and computer program code be configured as at least
One processor, at least one digital communications module and multiple safety inputs make the second security control unit at least together: really
Fixed multiple multiple safe input states inputted safely, and peace is sent for multiple safe input states by digital communications module
First security control unit of whole network.
According to advantageous example, the second security control unit includes another digital communications module, and wherein the second safety control
Unit processed is additionally configured to provide more than first and second a input states by other digital communications module with read-only mode.
According to advantageous example, a kind of method of the second security control unit of safe operation network is provided.This method packet
It includes: determining multiple multiple safe input states inputted safely, and via digital communications module by multiple safe input states
It is sent to the first security control unit of secure network.
According to the another aspect of this specification, a kind of elevator device is provided, which includes: according to above-mentioned corresponding
First security control unit of one of aspect, a safer contact more than first, is each connected respectively to the first security control unit
One safety input, according to the second security control unit of one of above-mentioned corresponding aspect, wherein the first and second control units are
A part of secure network, a safer contact more than second, a safety for being each connected respectively to the second security control unit are defeated
Enter and elevating mechanism, wherein elevator system configuration is at determining Safety output state, and if Safety output state instruction is beaten
It opens safety circuit and then stops elevating mechanism.
Detailed description of the invention
Fig. 1 schematically depicts elevator device；
Fig. 2 schematically depicts secure network；
Fig. 3 to each of 5 schematically depicts the first safe unit；
Fig. 6 schematically depicts the content of display；
Each of Fig. 7 and 8 depicts schematic flow diagram.
Specific embodiment
Fig. 1 schematically depicts elevator device 2.Carriage 4 is arranged in elevator shaft 6.Carriage 4 is grasped by elevating mechanism 8
Make to move up or down.Elevating mechanism 8 is arranged in computer room 9 and including mechanical brake 10 and motor 12.Certainly,
Elevator device 2 is only shown as example and can realize in another way.In another example, elevating mechanism 8 includes hydraulic
Motor.
First security control unit 20a is arranged in computer room 9.First security control unit 20a be used to control elevator
Tool 8, to stop carriage 4 in the case where opening safety circuit.Second control unit 20b is arranged in the car top of carriage 4.
Another second control unit 20c is arranged at pit 14.Most of installations of elevator device 2 will include these three security control lists
First 20a, 20b and 20c.Security control unit 20a, 20b and 20c pass through security bus 22 (such as SafetyBUSp or CAN-
Bus (Controller Area Network) or other buses) interconnection, data are exchanged in a secured manner and safety net is provided
Network 24.Security bus 22 is hardware connection or wireless, and meets safety integrity level 3 (SIL3) or higher peace
Full integrity levels.
For maintenance purpose, elevator device 2 includes operation controller 26a, 26b for moving up or down carriage 4
And 26c, i.e., so-called urgent electronic/audit function, this depends on the state of control element 28a, 28b or 28c, control element
28a, 28b or 28c include such as two buttons and are connected to unshowned electric life controller in Fig. 1.Operation controller 26a,
Switch 30a, 30b, 30c of 26b, 26c are connected to corresponding security control unit 20a, 20b, 20c and activate corresponding control
Element 28a, 28b or 28c.If two or more in switch 30a, 30b and 30c indicate corresponding control element 28a,
28b or 28c activation, then the first security control unit 20a triggers elevating mechanism 8 to stop carriage 4.The example describes a part
The binary system control function of Fig. 1, wherein the Safety output state instruction of the first security control unit 20a can operate (1) or can not
It operates (0), wherein 0 indicates safety circuit open circuit, 1 indicates safety circuit closure.Certainly, Safety output state depends on multiple peaces
Full input state, table 1 are merely exemplary.It is that activation (1) means only by next as one in controller 28a-c
Upper lower button.Advantageously, current state-of-the-art multiconductor rotary switch and corresponding complicated wiring will be replaced with from switch
The Safety output shape that 30a-30c and control unit 28a-28c is determined and/or logic and safe input state above-mentioned determine
State.
Table 1: example binary control function
By binary system control function, safety circuit can be adjusted for any controller system at any time if necessary, and
If the new specification of application in the future, system can be easily and quickly adjusted.Term " binary system " in binary system control function
Only for function as a result, i.e. Safety output state.Such binary system control function may include being explained than reference Fig. 6
Binary system connects the more functions of provided function.
The position mark being disposed with along elevator shaft 6 as multiple image position taggings 18.For example, in order to indicate carriage 4
Position within the scope of door area, carriage 4 include the position sensor 19 for being connected to the second security control unit 20b.For example, if
Position sensor 19 indicates that carriage 4 is in door area and the door of another switches/sensors instruction carriage 4 is in advance door opening position
The mobile carriage 4 of elevating mechanism 8 will not be prevented by setting so security control unit 20a.In another example, electric life controller is in door
Region carries out the leveling adjustment of carriage 4, and position sensor 19 will indicate that carriage 4 is in door region and the instruction of another safety contact is beaten
The door opened.Equally, in this case, security control unit 20a will not prevent the mobile carriage 4 of elevating mechanism 8.But such as
Fruit position sensor 19 does not indicate that carriage 4 is in door area and corresponding safety contact instruction door is opened, then security control list
First 20a will prevent the mobile carriage of elevating mechanism 8.
Limit switch 29 indicates when carriage 4 contacts with corresponding buffer.In this case, the first security control list
First 20a will trigger elevating mechanism 8 to stop the movement of carriage 4.It, can be by activating corresponding overlay switch for maintenance purpose
30a, 30b, 30c cover the state of limit switch 29.Therefore, its switch state is sent safe input by limit switch 29.
The safe condition of the limit switch 29 determined by safe unit 20c is can cover type.Therefore, if switch 30a, 30b or 30c
In one state be activation (1), then the state is when determining Safety output state prior to the safety of limit switch 29
State.This makes it possible to the mobile carriage 4 during maintenance.
The configuration of elevator device 2 is only an exemplary configuration, and describes to be not limited to the example.For example, in hydraulic electricity
In the case where terraced system, security control unit 20a and elevating mechanism 8 are arranged in pit 14.
Fig. 2 schematically depicts the peace including the first security control unit 20a and second security control unit 20b, 20c
Whole network 24.In the following, it is described that security control unit 20a, wherein the description is for second security control unit 20b, 20c
It is also effective, and wherein suffix a and suffix b or c are exchanged.
Security control unit 20a includes multiple safety input 202a to 204a, contact 206a, processor 208a, memory
210a, Safety output 212a, the contact 214a for distributing to Safety output 212a, monitoring output 216a, monitoring output is distributed to
Contact 218a, digital communications module 220a, another digital communications module 222a and the even other digital communications module of 216a
224a.Safety output 212a at least conforms to SIL3.Monitoring output 216a may conform to SIL0-SIL4, it means that 216a can be not required to
Meet security level.
Each of physical security contact s2a to s4a being mounted in same area is connected to multiple safety inputs
Corresponding one into 204a of 202a.In the case where the first security control unit 20a, which is that computer room 9. is certain,
The physical connection of more than one safety contact can be applied to one of safety input 202a into 204a.
Contact 206a allows specific supplier's apolegamy to be applied to the voltage swing that safety inputs 202a to 204a, usually
0V.In particular, current can also be used using the low-voltage safety circuit of old contact, and provided safety circuit can be used
Carry out upgrade-system.Moreover, eliminating safety circuit problem with different voltages.This is equally applicable to contact 218a, 214a.Root
According to example, there are multiple Safety outputs.According to another example, there are multiple monitorings outputs.
Processor 208a includes multiple processor core Ca, Da, in order to provide redundant processing capabilities to determine at least one
Safety output 212a.Memory 210a includes computer program code Ea, is configured as executing realization on processor 208a
The method of this description.Memory 210a includes electric erasable and re-programmable nonvolatile memory Na, even if disconnected
Also its information state is kept after electricity.Memory 210a includes the first binary system control function Xa, is configured as and processor
208a and computer program code Ea determines the state of Safety output 212a together.Memory 210a further includes the second binary system control
Function Za processed is configured as determining that the monitoring of monitoring output 216a is defeated together with processor 208a and computer program code Ea
It does well.
Safety output 212a is determined according to the first binary control function Xa.Safety output 212a is connected to elevating mechanism 8. and exists
In the case where the state instruction safety circuit closure of Safety output 212a, elevating mechanism 8 can be controlled by electric life controller 40.Peace
In the case that the state instruction safety circuit of full output 212a is opened, elevating mechanism 8 is operable to stop the movement of carriage, and
Electric life controller 40 is disabled to the control of elevating mechanism 8.
Monitoring output 216a is determined according to the second binary control function Za.Monitoring output 216a is connected to electric life controller
40. monitoring output 216a makes it possible to simply improve traditional elevator system in the case where being changed without conventional elevator controller 40
System.Optionally, or additionally, electric life controller 40 is connected to ALCL Assembly Line Communication Link 23.Electric life controller 40 is from security control unit
40 received information include for example: all closings, and Yishanmen is opened etc..
A) the safe input state quilt of each of safety input 202a to 204a
B) be fed to the first binary system control function Xa and
Secure network 24 is transferred to via digital communications module 220a.The object of security control unit 20a to 20c detection connection
Safety contact s2b, s4b, s2c are managed, the state of s4c is simultaneously mirrored in secure network 24, particularly, the first security control unit
20a receives these states of other security control units 20b, 20c via digital communications module 220a.Therefore, the first safety control
Unit 20a processed pacifies according to the safe input state of safety input 202a, 204a of the first security control unit 20a, according to second
The safe input state of the input 202b, 204b of full control unit 20b, and according to the second other security control unit 20c
The safe input state of input 202c, 204c determine the Safety output state of Safety output 212a.According to an example, cascade more
A security control unit is to guarantee a large amount of inputs in same area.
In one example, security control unit 20a does not provide the safe input state of safety input 202a to 204a
To secure network 24, but safe input state is only applied to the first binary control function Xa.
Other digital communications module 222a is connected to ALCL Assembly Line Communication Link 23.As personal computer/notebook computer
Diagnostic device 25 be connected to ALCL Assembly Line Communication Link 23.Diagnostic device 25 is by receiving safety input shape of the mirror image on ALCL Assembly Line Communication Link 23
State provides diagnostic function.ALCL Assembly Line Communication Link 23 can not need security level, that is, meet SIL0.According to example, ALCL Assembly Line Communication Link
23 are made of diagnostic device 25 and the first security control unit 20a.The safe condition of control unit 20a, 20b and 20c are by examining
Disconnected bus 23 is read-only.
By means of security bus 22, binary system control function Xa, each of Za can be 27 turns from managing device
Move on to memory 210a.
The monitoring output 216b of second security control unit 20b is connected to the indicator light 42 being arranged at carriage 4.Memory
210b further includes binary system control function Zb, is configured as determining prison together with processor 208b and computer program code Eb
Survey the state of output 216b.Therefore, monitoring output 216b allows additional function.
The configuration of secure network 24 is only an exemplary configuration.In another example, security control unit 20a includes son
There is unit the first subelement of safety input 202a to 204a and digital communications module 220a safety is inputted 202 to 204a
Safe input state be sent to security bus 22.Second subelement includes digital communications module, defeated for receiving safety
Enter state, which includes the safe input state from the first subelement, so as to defeated according to the safety received
Enter the Safety output state that state determines Safety output 212a.
Fig. 3 schematically shows a part according to exemplary first security control unit 20a.First security control list
First 20a includes the first and second positive orientation guide safety relays (positively-guided safety relay) 300,320,
It operates normally-closed contact 304,324 and normally opened contact 306,326 with coil 302,322.Contact 306 and 326 is connected in series
And elevating mechanism 8 is connected to by Safety output 212a, to allow or stop the operation of elevating mechanism 8.Positive orientation guide relay
Device 300,320 passes through the mechanically actuated structure operation switch 304 and 306/324 and 326 that is moved by coil 302,322.
Security control unit 20a further includes two processing units 310 and 330, wherein each processing unit 310 and 330 piece
It is operated according to the binary system control function Xa as described in about Fig. 1 and 2.In one example, processing unit 310 and 330 is corresponding
In processor core Ca, Da of Fig. 2.
First processing units 310 input the received multiple safe input state S202a of 202a to 204a according to via safety
To S204a, basis via the received multiple safe input state S220a of digital communications module 220a to S221a and according to peace
The feedback states S300 of all relay 300 and 320 determines the first driving signal 312.The second processing unit 330 is according to via safety
It inputs the received multiple safe input state S202a to S204a of 202a to 204a, received according to via digital communications module 220a
Multiple safe input state S220a to S221a and determine according to the feedback states S300 of safety relay 300 and 320
Two driving signal 332.First driving signal 312 drives 302. second driving signal 332 of coil of the first safety relay 300 to drive
The coil 322 of dynamic second safety relay 320.
By monitoring that feedback states S300, processing unit 310,330 are able to detect in safety relay 300 and 320 extremely
The failure of few one.If processing unit 310,330 detects failure, processing unit 310,330 via feedback states S300
Determine that driving signal 312,332 opens contact 306,326.
Fig. 4 schematically shows a part according to exemplary first security control unit 20a.First security control list
Member 20 includes internal switch 400, such as electronics operable switch.Contact 212a and 214a are connected to external security relay 402
Coil 404.Safety relay 402 includes multiple switches that can be moved simultaneously, and at least one of these switches, which are connected to, to be mentioned
Rise machinery 8.Another switch is connected to other monitoring contact 406a and 408a.Security control unit 20a passes through monitoring monitoring
The state of contact 406a and 408a verifies the state of safety relay 402, and is able to detect the operation of safety relay 402
Failure, so that it is determined that the opening of safety circuit.
Fig. 5 schematically shows a part according to exemplary first security control unit 20a.Security control unit
20a via contact 212a and 214a safe operation relay 402 and 502 coil 404 and 502.In this case, in the company
In the sense that filling sufficient SIL3, the connection between elevating mechanism 8 and safety relay is considered safe.
Fig. 6 schematically depicts the content of the display 606 of the diagnostic device 25 of Fig. 2.The display simulation of display 606 connects
Map interlinking 608, which depict at least part of binary system control function Xa.Simulating connection figure 608 includes that multiple physical securitys are defeated
The multiple safe input state S1 to S8 entered, each safe input state are connected to safer contact, and safer contact is arranged in elevator
In system.Each of safe input state S1 to S8 is connected at least one corresponding blocks, and each piece indicates that shown simulation connects
Switch B1 to B8 in map interlinking.
For example, the expression of self-locking normal open switch B1 is remaining type, it means that the state for simulating self-lock switch is written into
It nonvolatile memory Na and is fetched from nonvolatile memory Na after the Bootloader of security control unit.
Therefore, each of switch B1, B2 representative simulation self-lock switch.When detecting rising edge in safe input state S1,
Self-locking normal open switch is arranged to be closed.When detecting rising edge in safe input state S2, self-locking normal open switch is set
It is set to opening.
Self-locking normally closed switch B2 is non-remainder type, wherein the state of switch B2 guides journey in the starting of security control unit
It is reset as being closed after sequence.Safe input state S2 reset switch B2.For self-lock switch, reset input be it is main,
In if the two exists simultaneously, reset input better than setting input.
Normal open switch B3 includes reversed input, wherein when safe input state S4 logic is that vacation (FALSE) Shi Kaiguan B3 is closed
It closes.Safe input state S4 is also used to driving switch B8, therefore the another position in binary system control function Xa is multiplexed peace
Full input state S4.
Multiple Safety output 212a, 212xa are provided, wherein Safety output 212a, 212xa according to safe input state S1 extremely
S8 and binary system control function Xa is determined.
Fig. 7 schematically depicts the flow chart of the first security control unit of operation.According to step 702, multiple peaces are determined
More than first inputted entirely safe input state.According to step 704, via digital communications module from the second safety of secure network
Control unit receives more than second safe input states.According to step 706, according to the multiple first safe input states and according to
Multiple second safe input states determine the Safety output state of at least one Safety output.
Fig. 8 schematically depicts the flow chart for operating one of them the second control unit.According to step 802, determination is more
A multiple safe input states inputted safely.According to step 804, multiple safe input states are transmitted by digital communications module
To the first security control unit of secure network.
Claims (15)
1. a kind of the first security control unit (20a) of secure network of elevator device, first security control unit (20a)
Including at least one processor, at least one processor including computer program code, it is multiple safety input (202a,
204a), at least one Safety output (212a) and at least one digital communications module, at least one processor and meter
Calculation machine program code is configured to and at least one described processor, the multiple safety input (202a, 204a), at least one peace
Full output (212a) and at least one digital communications module make the first security control unit (20a) at least determine multiple safety together
More than first safe input states of (202a, 204a) are inputted,
More than second safety inputs are received from the second security control unit (20b, 20c) of secure network by digital communications module
State, and
According to the multiple first safe input states and according to the multiple second safe input states, at least one Safety output is determined
The Safety output state of (212a).
2. the first security control unit (20a) according to claim 1, wherein the first security control unit (20a) includes
Supervision output, and wherein the first security control unit (20a) is configured at least one according to the multiple first safe input states
Part and/or the supervision output state that supervision output is determined according at least part of the multiple second safe input states.
3. the first security control unit (20a) according to any one of the preceding claims, wherein the first safety control
Unit (20a) processed is additionally configured to determine at least one safety according to the signal edge indicated by the safe input state of setting type (S1)
Output state (212a), wherein the safe input state of setting type opens or closes simulation self-lock switch, and pacifies according to by restoration type
The signal edge that full input state (S2) indicates determines at least one Safety output state (212a), and wherein restoration type inputs safely
State closes or opens simulation self-lock switch.
4. the first security control unit (20a) according to claim 3, wherein the safe input state of simulation self-lock switch
It is remaining type, and wherein the first security control unit (20a) includes nonvolatile memory, wherein the first security control list
First (20a) is also used to the safe input state of the simulation self-lock switch of remaining type nonvolatile memory is written, and
After starting the first security control unit (20a), the simulation that remaining type is fetched from nonvolatile memory is self-locking
The safe input state of switch.
5. the first security control unit (20a) according to any one of the preceding claims, wherein the first security control list
First (20a) includes another digital communications module, and wherein the first security control unit (20a) is additionally configured to through other number
Word communication module provides a input state and more than second a input states more than read-only first.
6. the first security control unit (20a) according to any one of the preceding claims, wherein the first security control list
First (20a) includes the first and second safety relays (300,320), and wherein at least one Safety output (212a) is safety
The output of the series connection of the normally opened contact (306,326) of relay (300,302).
7. the first security control unit (20a) according to claim 6, wherein if first processing units (310) pass through
Feedback states (S300) detect the failure of at least one of first and second safety relays (300,320), then at first
Reason unit (310) determines the first driving signal (312) to open the normally opened contact (306) of the first safety relay (300), and
Wherein if the second processing unit (310) by feedback states (S300) detect the first and second safety relays (300,
At least one of 320) failure, then the second processing unit (320) determines the second driving signal (322) to open the second safety
The normally opened contact (326) of relay (300).
8. the first security control unit (20a) according to claim 7, wherein feedback states (S300) be the first safety after
The output of the series connection of the normally closed interlock (324) of the normally closed interlock (304) and the second safety relay (320) of electric appliance (300).
9. a kind of method of the first security control unit (20a) of safe operation network, wherein this method includes determining multiple peaces
More than first safe input states of full input (202a, 204a),
Via digital communications module from the second security control unit (20b of secure network；20c) receive more than second safety inputs
State, and
At least one Safety output is determined according to the multiple first safe input states and according to the multiple second safe input states
The Safety output state of (212a).
10. a kind of the second security control unit (20b, 20c) of the safety circuit network of elevator device, second security control
Unit (20b, 20c) includes at least one processor, at least one processor including computer program code, at least one number
Word communication module and multiple safety input (202b, 204b；202c, 204c),
At least one processor and computer program code be configured to at least one described processor, it is described at least one
Digital communications module and the multiple safety input make the second security control unit (20b, 20c) at least determine multiple safety together
Input (202b, 204b；202c, 204c) multiple safe input states, and
Multiple safe input states are sent to by digital communications module the first security control unit (20a) of secure network.
11. the second security control unit (20b) according to claim 10, wherein the second security control unit (20b) is also
It is configured to determine one of multiple safe input states according to the signal edge indicated by the safe input state of setting type (S1),
Wherein the safe input state of setting type (S1) opens or closes simulation self-lock switch, and
One of multiple safe input states are determined according to the signal edge indicated by the safe input state of restoration type (S2),
The middle safe input state of restoration type closes or opens simulation self-lock switch, and
One of multiple safe input states are sent to by digital communications module the first control unit of secure network
(20a)。
12. the second security control unit (20b) according to claim 11, wherein multiple safety of simulation self-lock switch are defeated
Entering one of state is remaining type, and wherein the second security control unit (20a) includes nonvolatile memory, wherein
Second security control unit (20b) is additionally configured to be written one of multiple safe input states of remaining type non-volatile
Memory, and
After starting the second security control unit (20b), the simulation that remaining type is fetched from nonvolatile memory is self-locking
One of multiple safe input states of switch.
13. the second security control unit (20b according to any one of claims 10 to 12；20c), wherein the second safety
Control unit (20b；It 20c) include another digital communications module, and wherein the second security control unit (20b；20c) also configure
To provide a input state and more than second a input states more than read-only first by another digital communications module.
14. a kind of the second security control unit (20b of safe operation network；Method 20c), which comprises
Determine multiple safety input (202b, 204b；202c, 204c) multiple safe input states, and
Multiple safe input states are sent to by digital communications module the first security control unit (20a) of secure network.
15. a kind of elevator device, comprising:
First security control unit (20a) according to any one of claim 1 to 8,
A safety contact more than first, each safety contact be connected to the first security control unit (20a) safety input (202a,
One of 204a), further include the second control unit described in any one of 0 to 13 according to claim 1, wherein first and
Two control units (20a, 20b, 20c) are a part of secure network,
A safer contact more than second, each safer contact are connected to the safety input of the second security control unit (20b, 20c)
(202b,204b；One of 202c, 204c), and
Elevating mechanism (8), wherein elevator system configuration is at determining Safety output state, and if Safety output state shows to pacify
Whole circuit is to open, then stops elevating mechanism.
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2018/106833 WO2020056701A1 (en) | 2018-09-21 | 2018-09-21 | First safety control unit, a method to operate the first safety control unit, a second safety control unit, a method to operate the second control unit, and an elevator system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109890738A true CN109890738A (en) | 2019-06-14 |
| CN109890738B CN109890738B (en) | 2021-07-02 |
Family
ID=66926781
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201880003517.2A Active CN109890738B (en) | 2018-09-21 | 2018-09-21 | First safety control unit of safety network of elevator system and elevator system |
Country Status (3)
| Country | Link |
|---|---|
| EP (1) | EP3672897A4 (en) |
| CN (1) | CN109890738B (en) |
| WO (1) | WO2020056701A1 (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114093068A (en) * | 2020-04-24 | 2022-02-25 | 松下知识产权经营株式会社 | Safety switch and switch system |
| CN115196454A (en) * | 2021-04-14 | 2022-10-18 | 奥的斯电梯公司 | Safety control device |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3915921A1 (en) * | 2020-05-26 | 2021-12-01 | Otis Elevator Company | Emergency terminal stopping systems |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPH072472A (en) * | 1990-05-07 | 1995-01-06 | Otis Elevator Co | Elevator safety network, movement prohibition device of elevator car, method of giving safe chain circuit state signal and method of operating elevator |
| CN1342129A (en) * | 1999-03-04 | 2002-03-27 | 奥蒂斯电梯公司 | Electronic safety system for elevators |
| CN100357167C (en) * | 2003-11-11 | 2007-12-26 | 因温特奥股份公司 | Elevator installation and monitoring system for an elevator installation |
| JP2012224448A (en) * | 2011-04-20 | 2012-11-15 | Mitsubishi Electric Corp | Safety protection device for elevator |
| CN103562107A (en) * | 2011-05-25 | 2014-02-05 | 株式会社日立制作所 | Elevator safety system |
| CN104555641A (en) * | 2013-10-11 | 2015-04-29 | 株式会社日立制作所 | Safety system of elevator |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2189410B1 (en) | 2004-06-02 | 2013-12-25 | Inventio AG | Elevator supervision |
| EP2022742B1 (en) * | 2007-08-07 | 2014-06-25 | ThyssenKrupp Elevator AG | Lift system |
| EP2594519A1 (en) * | 2011-11-15 | 2013-05-22 | Inventio AG | Lift with safety device |
| CN202625540U (en) * | 2012-05-03 | 2012-12-26 | 中山市卓梅尼控制技术有限公司 | Elevator safety circuit detection system |
| CN202744135U (en) * | 2012-08-22 | 2013-02-20 | 苏州麦道快速电梯有限公司 | Elevator brake |
| US10745243B2 (en) * | 2014-10-21 | 2020-08-18 | Inventio Ag | Elevator comprising a decentralized electronic safety system |
| CN107572328A (en) * | 2017-08-03 | 2018-01-12 | 江苏速度信息科技股份有限公司 | The device and method of the monitoring and management of elevator |
-
2018
- 2018-09-21 WO PCT/CN2018/106833 patent/WO2020056701A1/en unknown
- 2018-09-21 EP EP18867311.5A patent/EP3672897A4/en active Pending
- 2018-09-21 CN CN201880003517.2A patent/CN109890738B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPH072472A (en) * | 1990-05-07 | 1995-01-06 | Otis Elevator Co | Elevator safety network, movement prohibition device of elevator car, method of giving safe chain circuit state signal and method of operating elevator |
| CN1342129A (en) * | 1999-03-04 | 2002-03-27 | 奥蒂斯电梯公司 | Electronic safety system for elevators |
| CN100357167C (en) * | 2003-11-11 | 2007-12-26 | 因温特奥股份公司 | Elevator installation and monitoring system for an elevator installation |
| JP2012224448A (en) * | 2011-04-20 | 2012-11-15 | Mitsubishi Electric Corp | Safety protection device for elevator |
| CN103562107A (en) * | 2011-05-25 | 2014-02-05 | 株式会社日立制作所 | Elevator safety system |
| CN104555641A (en) * | 2013-10-11 | 2015-04-29 | 株式会社日立制作所 | Safety system of elevator |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114093068A (en) * | 2020-04-24 | 2022-02-25 | 松下知识产权经营株式会社 | Safety switch and switch system |
| CN114093068B (en) * | 2020-04-24 | 2024-04-16 | 松下知识产权经营株式会社 | Safety switch and switching system |
| CN115196454A (en) * | 2021-04-14 | 2022-10-18 | 奥的斯电梯公司 | Safety control device |
Also Published As
| Publication number | Publication date |
|---|---|
| EP3672897A1 (en) | 2020-07-01 |
| EP3672897A4 (en) | 2021-03-24 |
| CN109890738B (en) | 2021-07-02 |
| WO2020056701A1 (en) | 2020-03-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109890738A (en) | First security control unit, the method for operating the first security control unit, the second security control unit, the method and elevator device for operating the second control unit | |
| RU2604633C2 (en) | Interface unit, conveying system and method for monitoring operating condition of input circuit in safety circuit of conveying system | |
| CN107848742B (en) | Elevator control system and elevator system comprising same | |
| CN103328366B (en) | The safety control of elevator | |
| EP2310921A1 (en) | Method and system for safety monitored terminal block | |
| CN111434600B (en) | Remote monitoring system for elevator system and method for remotely monitoring elevator system | |
| JP2008230742A (en) | Maintenance control system of elevator | |
| EP3403970A1 (en) | A method and system for generating maintenance data of an elevator door system | |
| EP3166218B1 (en) | Power converter | |
| KR930009954B1 (en) | Elevator control device | |
| EP3178768A1 (en) | Drive device | |
| EP2911968B1 (en) | Electronic wire bridge with safety circuit | |
| CN111137773B (en) | Method and system for detecting faults in an elevator system | |
| CN110884972B (en) | Door lock detection method based on elevator safety loop | |
| US20220018903A1 (en) | Disconnect Verification | |
| JPH092764A (en) | Operation controller for elevator | |
| US6715586B1 (en) | Upgraded elevator control circuit and method dealing with fire danger | |
| CN109890739B (en) | Elevator, elevator control device, and elevator control method | |
| JP4594856B2 (en) | Electric switchgear control system | |
| KR100372761B1 (en) | A device for monitoring door status of an elevator system and a method thereof and an elevator controller using the same | |
| CN109132813B (en) | Elevator door circuit and short circuit detection method thereof | |
| WO2007020326A1 (en) | Elevator system | |
| US11718506B2 (en) | Resetting a state in an elevator system | |
| KR102452204B1 (en) | Failure prediction apparatus and method for platform screen door | |
| CN113460823B (en) | Door lock short-circuit fault diagnosis system, method, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |