EP1864935B1

EP1864935B1 - Elevator apparatus

Info

Publication number: EP1864935B1
Application number: EP05727358.3A
Authority: EP
Inventors: Kenichi C/o Mitsubishi Denki K.K. OKAMOTO; Tatsuo c/o Mitsubishi Denki K.K. MATSUOKA
Original assignee: Mitsubishi Electric Corp
Current assignee: Mitsubishi Electric Corp
Priority date: 2005-03-31
Filing date: 2005-03-31
Publication date: 2018-11-28
Anticipated expiration: 2025-03-31
Also published as: CN1953926B; CN1953926A; EP1864935A1; WO2006106575A1; KR101014917B1; JPWO2006106575A1; KR20090055031A; EP1864935A4

Description

Technical Field

The present invention relates to an elevator apparatus which employs an electronic safety controller for detecting abnormality of an elevator based on a detection signal from a sensor.

Background Art

In conventional elevator apparatuses, an elevator control device and an electronic safety controller are respectively provided with CPU's that are independent of each other. In order to enhance reliability of communication between the elevator control device and the electronic safety controller, a communication system of the elevator apparatus employs double redundancy configuration. When a communication error is detected by the electronic safety controller, operation of the elevator is prohibited (e.g. , see Patent Document 1).
Patent Document 1: JP 2002-538061 A

Disclosure of the Invention

Problems to be solved by the Invention

In a conventional elevator apparatus, however, only the electronic safety controller checks on whether or not there is a communication error. Therefore, a car of the elevator may be operated without a safety monitoring of the electronic safety controller in cases where the electronic safety controller is substantially absent, when, for example, a substrate of the electronic safety controller has been removed for maintenance reasons and the like, when the electronic safety controller does not function at all, or when an inappropriate electronic safety controller is connected. A conventional elevator apparatus of this type is described in US 6,173,814 .
The present invention has been made to solve the problem as discussed above, and it is therefore an object of the invention to obtain an elevator apparatus allowing detection of a substantially absent state of an electronic safety controller and thus enhancement of reliability.

Means for solving the Problem

An elevator apparatus according to the present invention includes: an elevator control portion for controlling operation of a car; and an electronic safety controller for detecting abnormality in an elevator based on a detection signal from a sensor for detecting a state of the elevator and outputting a command signal for shifting the elevator to a safe state, and in the elevator apparatus, the elevator control portion is capable of communicating with the electronic safety controller and is capable of confirming a state of communication with the electronic safety controller at predetermined timings.

Brief Description of the Drawings

[Fig. 1] A structural diagram of an elevator apparatus according to Embodiment 1 of the present invention.
[Fig. 2] A graph of patterns of overspeed set in speed governor and an ETS circuit portion of an electronic safety controller of Fig. 1.
[Fig. 3] A block diagram showing an essential part of Fig. 1.
[Fig. 4] An explanatory diagram showing a method of performing calculation processings by means of a second CPU and a third CPU of Fig. 3.
[Fig. 5] An explanatory diagram showing a method of performing a calculation processing by means of a first CPU of Fig. 3. Best Mode for carrying out the Invention

Preferred embodiments of the present invention will be hereinafter described with reference to the drawings.

Embodiment 1

Fig. 1 is a structural diagram of an elevator apparatus according to Embodiment 1 of the invention. In the drawing, a hoistway 1 includes a pair of car guide rails (not shown) and a pair of counterweight guide rails (not shown). A car 3 is raised and lowered in the hoistway 1 while being guided by the car guide rails. A counterweight 4 is raised and lowered in the hoistway 1 while being guided by the counterweight guide rails.
Provided in a lower part of the car 3 is a safety device 5 that engages with the car guide rails to stop the car 3 in an emergency. The safety device 5 has a pair of braking pieces that performs braking operation due to mechanical operation to be pushed against the car guide rails.
In the lower part of the hoistway 1, a driving apparatus (hoisting machine) 7 that raises and lowers the car 3 and the counterweight 4 via a main rope 6 is provided. The driving apparatus 7 has: a drive sheave 8; a motor portion that rotates the drive sheave 8; a brake portion 10 that brakes the rotation of the drive sheave 8; and a motor encoder 11 that generates a detection signal according to the rotation of the drive sheave 8.
The brake portion 10 is, for example, an electromagnetic brake apparatus. In the electromagnetic brake apparatus, a spring force of a braking spring is used to push a brake shoe against a braking surface to brake the rotation of the drive sheave 8 and an electromagnetic magnet is excited to separate the brake shoe from the braking surface to cancel the braking.
An elevator control portion (control panel) 12 is disposed in, for example, the lower part or the like in the hoistway 1. The elevator control portion 12 is provided with an operation control portion for controlling the operation of the drive device 7. A detection signal from the motor encoder 11 is input to the operation controlportion. Based on the detection signal from the motor encoder 11, the operation control portion calculates a position and a speed of the car 3 and controls the drive device 7. The elevator control portion 12 has a function of detecting an abnormal speed of the car 3 through a comparison between the calculated speed of the car and an operation command value.
The elevator control portion 12 is connected to a safety circuit (relay circuit) 30 for suddenly stopping the car 3 when the elevator is in an abnormal state. When the relay circuit of the safety circuit 13 is opened, an electric current to the motor portion 9 of the driving apparatus 7 is blocked and an electric current to the electromagnetic magnet of the brake portion 10 is also blocked, whereby the drive sheave 8 is braked.
In the upper part of the hoistway 1, a speed governor (mechanical speed governor) 14 is provided. The speed governor 14 includes: a speed governor sheave, an overspeed detection switch, a rope catch, and a speed governor encoder 15 serving as a sensor. The speed governor rope 16 is wound at a speed governor sheave. Both ends of the speed governor rope 16 are connected to the operational mechanism of the safety device 5. The lower end of the speed governor rope 16 is wound around a tightening pulley 17 provided in the lower part of the hoistway 1.
When the car 3 is raised or lowered, the speed governor rope 16 is moved in circulation and the speed governor sheave is rotated at a rotation speed corresponding to a traveling speed of the car 3. The speed governor 14 mechanically detects that the traveling speed of the car 3 reaches an overspeed. Set as overspeeds to be detected are a first overspeed (OS speed) that is higher than a rated speed and a second overspeed (Trip speed) that is higher than the first overspeed.
When the traveling speed of the car 3 reaches the first overspeed, the overspeed detection switch is operated. When the overspeed detection switch is operated, the relay circuit of the safety circuit 13 is opened. When the traveling speed of the car 3 reaches the second overspeed, the rope catch grips the speed governor rope 16 to stop the circulation of the speed governor rope 16. When the circulation of the speed governor rope 16 is stopped, the safety device 5 provides a braking operation.
The speed governor encoder 15 generates a detection signal according to the rotation of the speed governor sheave. The speed governor encoder 15 employs a dual sense type encoder that simultaneously outputs two types of detection signals, i.e., a first detection signal and a second detection signal.
The first detection signal and the second detection signal from the speed governor encoder 15 are input to an ETS circuit portion 22 of an Emergency Terminal Slowdown apparatus (ETS apparatus) provided at an electronic safety controller 21. The ETS circuit portion 22 detects, based on a detection signal from the speed governor encoder 15, abnormality of an elevator and outputs a command signal for shifting the elevator to a safe state. More specifically, the ETS circuit portion 22 calculates, independently from the elevator control portion 12, a traveling speed and a position of the car 3 based on the signal from the speed governor encoder 15, and monitors whether the traveling speed of the car 3 in the vicinity of a terminal landing reaches an ETS monitoring overspeed.
The ETS circuit portion 22 also converts the signal from the speed governor encoder 15 to a digital signal to perform a digital calculation processing and determine whether the traveling speed of the car 3 reaches an ETS monitoring overspeed. When the ETS circuit portion 22 determines that the traveling speed of the car 3 has reached the ETS monitoring overspeed, the relay circuit of safety circuit 13 is opened.
The electronic safety controller 21 can also detect abnormality of the electronic safety controller 21 itself and abnormality of the speed governor encoder 15. When the electronic safety controller 21 detects abnormality of the electronic safety controller 21 itself or abnormality of the speed governor encoder 15, a nearest floor stop command signal is output from the electronic safety controller 21 to the operation control portion 12 as a command signal for shifting the elevator to a safe state. Interactive communication is also possible between the electronic safety controller 21 and the operation control portion 12.
In predetermined positions in the hoistway 1, there are provided a first reference location sensor 23 and a second reference location sensor 24 for detecting that the car 3 is located at a reference position in the hoistway. Top and bottom terminal landing switches can be used for the reference location sensors 23 and 24. Detection signals from the reference location sensors 23 and 24 are input to the electronic safety controller 21. Based on the detection signals from the reference location sensors 23 and 24, the electronic safety controller 21 corrects the information for the position of the car 3 calculated in the ETS circuit portion 22.
In the lower part of the hoistway 1, a car buffer 27 and a counterweight buffer 28 are provided. The car buffer 27 and the counterweight buffer 28 reduce an impact caused when the car 3 and the counterweight 4 collides with a bottom part of the hoistway 1. These buffers 27 and 28 may be, for example, an oil-filled-type or spring-type buffer.
A pair of car suspending pulleys 41a and 41b are provided in a lower part of the car 3. A counterweight suspending pulley 42 is provided in an upper part of the counterweight 4. Car-side return pulleys 43a and 43b and a counterweight-side return pulley 44 are disposed in the upper part of the hoistway 1. The main rope 6 has a first end 6a and a second end 6b, which are connected to a top portion of the hoistway 1 via rope stop portions.
The main rope 6 is wound, sequentially from the first end 6a side, around the car suspending pulleys 41a and 41b, the car-side return pulleys 43a and 43b, the drive sheave 8, the counterweight-side return pulley 44, and the counterweight suspending pulley 42. That is, in this example, the car 3 and the counterweight 4 are suspended within the hoistway 1 according to a 2:1 roping method.
Fig. 2 is a graph of overspeed patterns set in the speed governor 14 and the ETS circuit portion 22 of Fig. 1. In the drawing, when the car 3 travels at a normal speed (rated speed) from a bottom terminal landing to a top terminal landing, the car 3 draws a normal speed pattern V0. A first second overspeed patterns V1 and a second overspeed pattern V2 are set in the speed governor 14 by a mechanical position adjustment. An ETS monitoring overspeed pattern VE is set in the ETS circuit portion.
The ETS monitoring overspeed pattern VE is set to be higher than the normal speed pattern V0. The ETS monitoring overspeed pattern VE is also set to have about equal intervals from the normal speed pattern V0 in the entire raising/lowering process. In other words, the ETS monitoring overspeed pattern VE changes according to a car position. More specifically, the ETS monitoring overspeed pattern VE is set to be held constant in the vicinity of an intermediate floor and is set to continuously and smoothly decline, in the vicinity of a terminal landing, as ends (upper end and lower end) of the hoistway become closer. In this manner, the ETS circuit portion 22 monitors the traveling speed of the car 3 not only in the vicinity of a terminal landing but also in the vicinity of an intermediate floor (a fixed speed traveling zone in the normal speed pattern V0). However, the ETS circuit portion 22 does not always have to monitor the traveling speed of the car 3 in the vicinity of the intermediate floor.
The first overspeed pattern V1 is set to be higher than the ETS monitoring overspeed pattern VE. The second overspeed pattern V2 is set to be further higher than the first overspeed pattern V1. The first overspeed patterns V1 and the second overspeed pattern V2 are fixed at all heights in the hoistway 1.
Fig. 3 is a block diagram showing an essential part of Fig. 1. The elevator control portion 12 has a first computer having a first CPU (a calculation processing portion) 31, a storage portion (a ROM, a RAM, a hard disk, and the like), and signal input/output portions . A function of the elevator control portion 12 is realized by the first computer. In other words, a control program for realizing the function of the elevator control portion 12 is stored in the storage portion of the first computer. The first CPU 31 performs a calculation processing regarding the function of the elevator control portion 12 based on the control program.
The elevator control portion 12 is also provided with a motor drive portion 32 (an inverter or the like) for driving the motor portion 9. In addition, the elevator control portion 12 is provided with a first safety relay 33 for opening the safety circuit 13. When an emergency stop command is output from the first CPU 31 to the first safety relay 33, the safety circuit 13 is opened. When the safety circuit 13 is opened, a motor contactor 34 is opened to shut off the supply of electric power to the motor portion 9, and a brake contactor 35 is opened to shut off the supply of electric power to the electromagnet of the brake portion 10.
The electronic safety controller 21 has a second computer having second and third CPU's (a calculation processing portion) 36 and 37, a storage portion (a ROM, a RAM, a hard disk, and the like), and signal input/output portions. A function of the electronic safety controller 21 is realized by the second computer. In other words, a safety program for realizing the function of the electronic safety controller 21 is stored in the storage portion of the second computer. The second and third CPU's 36 and 37 perform a calculation processing regarding the function of the electronic safety controller 21 based on the safety program.
The electronic safety controller 21 is provided with a second safety relay 38 and a third safety relay 39 for opening the safety circuit 13. The second CPU 36 and the third CPU 37 correspond to the second safety relay 38 and the third safety relay 39 on a one-to-one basis. When emergency stop commands (forcible slowdown commands) are output from the second CPU 36 and the third CPU 37 to the second and third safety relays 38 and 39 respectively, the safety circuit 13 is opened.
The safety program includes a first safety program and a second safety program of the same contents. The second CPU 36 performs the calculation processing based on the first safety program. The third CPU 37 performs the calculation processing based on the second safety program.
The second and third CPU's 36 and 37 can have mutual communication via an interprocessor bus and a dual port RAM. The second and third CPU's 36 and 37 can also check the soundness of the second and third CPU's 36 and 37 themselves by mutually comparing the results of the calculation processing. In other words, the soundness of the second and third CPU's 36 and 37 is checked by causing the second and third CPU's 36 and 37 to perform an identical processing and the processing results are communicated and compared.
The electronic safety controller 21 can also detect abnormality in the electronic safety controller 21 other than abnormalities in the CPU' s 36 and 37 themselves, through the calculation processing.
Fig. 4 is an explanatory diagram showing a method of performing the calculation processings by means of the second CPU 36 and the third CPU 37 of Fig. 3. The second CPU 36 and the third CPU 37 repeatedly perform the calculation processings according to the program stored in the ROM, on a predetermined calculation cycle (e.g., 50 milliseconds) based on a signal from a fixed cycle timer in the second computer.
A program executed in one cycle includes a safety program for detecting abnormality of an elevator and a failure/abnormality check program for detecting the failure/abnormality of the electronic safety controller 21 itself and various sensors. The failure/abnormality check program may be executed only when predetermined states are satisfied.
In the failure/abnormality check program, for example, detection of clock abnormality, detection of abnormality in a stack region of the RAM, detection of abnormality in a sequence of calculation processings, detection of abnormality in a relay contact, detection of abnormality in power supply voltage, and the like are sequentially carried out.
Fig. 5 is an explanatory diagram showing a method of performing the calculation processings by means of the first CPU 31 of Fig. 3. The first CPU 31 repeatedly perform the calculation processings according to the program stored in the ROM, on a predetermined calculation cycle based on a signal from a fixed cycle timer in the first computer.
A program executed in one cycle includes a control program for controlling operation of an elevator and a communication check program for checking the communication with the electronic safety controller 21. The communication check program may be executed only when predetermined states are satisfied.
As described above, the elevator control portion 12 communicates with the electronic safety controller 21 on a predetermined cycle for the purpose of checking on a state of communication therewith. When a normal response is not returned from the electronic safety controller 21 (when a communication error is detected), the elevator control portion 12 stops the car 3 safely (nearest floor stop command) if the car 3 is running, and renders normal automatic operation impossible if the car 3 is stopped. When normal automatic operation is rendered impossible, the elevator control portion 12 may permit at least only one of manual operation and low-speed automatic operation.
When a communication error is detected, the elevator control portion 12 outputs an abnormality detection signal to an elevator administrative room or the like. In other words, when a communication error is detected, the elevator control portion 12 generates a signal for informing an elevator administrator of abnormality.
In the elevator apparatus constructed as described above, the elevator control portion 12 can communicate with the electronic safety controller 21, and can confirm a state of communication with the electronic safety controller 21 at predetermined timings. As a result, it is possible to detect a substantially absent state of the electronic safety controller 21 and thus achieve enhancement of reliability.
When abnormality is detected in a state of communication with the electronic safety controller 21, the elevator control portion 12 renders normal automatic operation of the car 3 impossible. Therefore, the car 3 can be prevented from being operated with a passenger being present therein while the electronic safety controller 21 is substantially absent.
Moreover, even when normal automatic operation is rendered impossible, at least one of manual operation and low-speed automatic operation is permitted. Therefore, the car 3 does not become completely immovable in, for example, replacing the substrate for the reason of maintenance.
Although a communication state confirmation signal is repeatedly output from the elevator control portion 12, it is appropriate to judge that a communication error has occurred once a normal response is not returned from the electronic safety controller 21. Alternatively, with a view to preventing erroneous detection of a communication error, it may also be appropriate to judge that a communication error has occurred when a normal response is not consecutively returned from the electronic safety controller 21 a preset number of times.
Information such as the speed of the car which has been calculated by the elevator control portion 12 may be included in the communication state confirmation signal. In this case, the electronic safety controller 21 compares the information calculated by itself with information calculated by the elevator control portion 12. When the information calculated by the electronic safety controller 21 does not match the information calculated by the elevator control portion 12, the electronic safety controller 21 may refrain from making a response (refrain from permitting normal operation). Thus, the car 3 can be prevented from being operated with the wrong electronic safety controller 21 installed.
Furthermore, at least one of the elevator control portion 12 and the electronic safety controller 21 may monitor movements of the car 3 based on information that has been obtained after actuation of a brake, every time the car is stopped. In other words, at least one of the elevator control portion 12 and the electronic safety controller 21 may have a function of confirming whether or not the car 3 has been suitably held static after actuation of the brake. Thus, it is possible to confirm whether or not the brake portion 10 ensures a required slowdown torque.
A timing for performing an operation of confirming the slowdown torque as described above should not be limited to a timing corresponding to each stoppage of the car. This operation may also be performed, for example, when the car 3 is stopped at a floor designated in advance, when the car 3 is stopped a preset number of times, or when the car 3 is first stopped within a preset cycle time (e.g., one day, one hour, or 10 minutes).
Still further, it may also be appropriate to provide a detection switch that is mechanically operated when the substrate of the electronic safety controller 21 is removed, so that the elevator control portion 12 confirms an open/closed state of the detection switch on a regular basis to check whether or not the electronic safety controller 21 is substantially absent.
The elevator control portion 12 and the electronic safety controller 21 may communicate with each other either through cable communication using a communication cable or through radio communication using a local area wireless network or the like.

Claims

An elevator apparatus, comprising:
an elevator control portion (12) for controlling operation of a car (3); and

an electronic safety controller (21) for detecting abnormality of an elevator based on a detection signal from a sensor (15, 23, 24) for detecting a state of the elevator and outputting a command signal for shifting the elevator to a safe state,

the electronic safety controller (21) calculates, independently from the elevator control portion (12), the speed of the car (3), characterized in that the elevator control portion (12) calculates a speed of the car(3), and

the elevator control portion (12) is capable of communicating with the electronic safety controller (21) and is capable of confirming a state of communication with the electronic safety controller (21) at predetermined timings.
The elevator apparatus according to Claim 1, wherein the elevator control portion (12) renders normal automatic operation of the car (3) impossible when abnormality is detected in the state of communication with the electronic safety controller (21).
The elevator apparatus according to Claim 1, wherein the elevator control portion (12) permits manual operation of the car (3) while rendering normal automatic operation of the car impossible when abnormality is detected in the state of communication with the electronic safety controller (21).
The elevator apparatus according to Claim 1, wherein the elevator control portion (12) permits low-speed operation of the car (3) while rendering normal automatic operation of the car (3) impossible when abnormality is detected in the state of communication with the electronic safety controller (21).
The elevator apparatus according to Claim 1, wherein the elevator control portion (12) stops the car (3) when abnormality is detected in the state of communication with the electronic safety controller (21) while the car (3) is running.
The elevator apparatus according to Claim 1, wherein the elevator control portion (12) generates a signal for informing an elevator administrator of abnormality when the abnormality is detected in the state of communication with the electronic safety controller (21).
The elevator apparatus according to Claim 1, wherein the elevator control portion (12) outputs to the electronic safety controller (21) a signal for confirming the state of communication therewith on a predetermined cycle, and determines presence/absence of abnormality in the state of communication depending on whether or not a normal response is returned from the electronic safety controller (21).
The elevator apparatus according to Claim 7, wherein the elevator control portion (12) determines that the state of communication is abnormal when a preset number of abnormal responses are returned consecutively from the electronic safety controller (21).