EP2671836A1

EP2671836A1 - Safety control device for elevator

Info

Publication number: EP2671836A1
Application number: EP11857587.7A
Authority: EP
Inventors: Kazunori Washio; Masunori Shibata
Original assignee: Mitsubishi Electric Corp
Current assignee: Mitsubishi Electric Corp
Priority date: 2011-02-02
Filing date: 2011-02-02
Publication date: 2013-12-11
Anticipated expiration: 2031-02-02
Also published as: CN103328366A; JP5784049B2; KR20130129430A; KR101545797B1; WO2012105008A1; EP2671836B1; JPWO2012105008A1; EP2671836A4; CN103328366B

Abstract

In an elevator safety controlling apparatus, a plurality of landing door switches are divided into a plurality of systems. A safety controlling portion can recognize opening of landing doors independently for each of the systems of the landing door switches. The safety controlling portion detects movement of maintenance workers into a hoistway if the landing door switches of any of the systems indicate an open door state when the car gate switch indicates a closed door state, and if the landing door switches in two or more of the systems indicate an open door state when the car gate switch indicates an open door state.

Description

TECHNICAL FIELD

The present invention relates to an elevator safety controlling apparatus that controls elevator operation from a viewpoint of safety.

BACKGROUND ART

In elevators in recent years, machine-roomless types in which hoisting machines and controlling apparatuses are installed inside a hoistway without having a machine room have become mainstream. Because of that, the frequency with which maintenance workers must enter the hoistway to perform maintenance work during elevator equipment maintenance has increased.
If, for example, a hoisting machine or a controlling apparatus is installed in an upper portion inside the hoistway, then the maintenance workers perform maintenance work on the hoisting machine or the controlling apparatus by riding on top of a car. When maintaining landing door apparatuses or various kinds of switches inside the hoistway, the maintenance workers also perform maintenance work by riding on top of the car. In addition, if a hoisting machine or controlling apparatus is installed in a lower portion inside the hoistway, then the maintenance workers enter a hoistway pit to perform maintenance work on the hoisting machine or the controlling apparatus.
In order to ensure refuge spaces for the maintenance workers during maintenance work of this kind, overtravel limiting switches are disposed in an upper portion and a lower portion of the hoistway, and the car is prevented from moving beyond the overtravel limiting switches during maintenance operation. If the maintenance workers enter the pit to perform maintenance work, or if they ride on top of the car to perform the maintenance work, then it is necessary to be careful in case the car moves suddenly.
In addition, in conventional elevators, a car is prevented from moving suddenly for maintenance workers by stopping operation of the car automatically if it is detected that the maintenance workers have operated a landing door unlocking apparatus (see Patent Literature 1, for example).
Furthermore, in other conventional elevators, an elevator is prevented from moving into a danger zone inside a hoistway by installing a special apparatus and switching operation of a car over to a special operating mode if it is detected that maintenance workers have entered the danger zone (see Patent Literature 2, for example).

CITATION LIST

PATENT LITERATURE

[Patent Literature 1]
Japanese Patent Laid-Open No. HEI 8-91730 (Gazette )
[Patent Literature 2]
Japanese Patent Publication No. 2004-5347070 (Gazette )

SUMMARY OF THE INVENTION

PROBLEM TO BE SOLVED BY THE INVENTION

In conventional apparatuses such as those described above, one problem has been that additional equipment is required for detecting movement of the maintenance workers into the hoistway, increasing costs.
The present invention aims to solve the above problems and an object of the present invention is to provide an elevator safety controlling apparatus that can use existing equipment efficiently to detect movement of maintenance workers into a hoistway at reduced cost.

MEANS FOR SOLVING THE PROBLEM

In order to achieve the above object, according to one aspect of the present invention, there is provided an elevator safety controlling apparatus including: a car gate switch that detects opening of a car door; and a plurality of landing door switches that detect opening of a plurality of landing doors; and a safety controlling portion that performs safety control based on information that is output from the car gate switch and the landing door switches, the elevator safety controlling apparatus being characterized in that: the landing door switches are divided into a plurality of systems; and the safety controlling portion can recognize opening of the landing doors independently for each of the systems of the landing door switches, and detects movement of maintenance workers into a hoistway if the landing door switches of any of the systems indicate an open door state when the car gate switch indicates a closed door state, and if the landing door switches in two or more of the systems indicate an open door state when the car gate switch indicates an open door state.

EFFECTS OF THE INVENTION

An elevator safety controlling apparatus according to the present invention can detect movement of maintenance workers into a hoistway more reliably at reduced cost based on whether a car door is closed or open by using an existing car gate switch and landing door switches efficiently.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a configuration diagram that shows a machine-roomless elevator according to Embodiment 1 of the present invention;
Figure 2 is a block diagram that shows an elevator safety controlling apparatus from Figure 1;
Figure 3 is a flowchart that shows a safety controlling process in a safety controlling portion from Figure 1;
Figure 4 is a flowchart that shows an automatic operation resetting process in the safety controlling portion from Figure 1;
Figure 5 is a configuration diagram that shows a machine-roomless elevator according to Embodiment 2 of the present invention; and
Figure 6 is a configuration diagram that shows a machine-roomless elevator according to Embodiment 3 of the present invention.

DESCRIPTION OF EMBODIMENTS

Preferred embodiments of the present invention will now be explained with reference to the drawings.

Embodiment 1

Figure 1 is a configuration diagram that shows a machine-roomless elevator according to Embodiment 1 of the present invention. In the figure, a hoisting machine 2 is installed in a lower portion inside a hoistway 1. The hoisting machine 2 has: a driving sheave; a hoisting machine motor that rotates the driving sheave; and a hoisting machine brake that brakes rotation of the driving sheave. A suspending means (not shown) is wound around the driving sheave. A plurality of ropes or a plurality of belts are used as the suspending means.
A car 3 and a counterweight (not shown) are suspended inside the hoistway 1 by the suspending means, and are raised and lowered by the hoisting machine 2. An elevator controlling apparatus (a controlling board) 4 that controls the hoisting machine 2 is installed in a lower portion inside the hoistway 1. The elevator controlling apparatus 4 has: an operation controlling portion 21 that controls operation of the car 3; and a safety controlling portion 22.
Included in operating modes of the car 3 by the operation controlling portion 21 are: an automatic operating mode (a normal operating mode) that responds to calls from landings and from inside the car 3; and a maintenance operating mode (a manual operating mode). The safety controlling portion 22 can indicate the operating mode to the operation controlling portion 21.
Landing doorways on respective floors are opened and closed by landing doors 5. Movement of maintenance workers into a pit 1 a, which is a lowermost portion of the hoistway 1, is enabled by opening the landing door 5 on a lowermost floor. Movement of the maintenance workers onto the car 3 is enabled by opening a landing door 5 other than on the lowermost floor when the car 3 is stopped at a floor below.
Landing door switches 6 that detect an open state of the landing doors 5 are disposed on the landing doors 5 on the respective floors. These landing door switches 6 are normally disposed on conventional elevator apparatuses.
The landing door switches 6 are divided into three systems that include: a lowermost floor landing door switch 6a that detects opening of the landing door 5 on the lowermost floor; a plurality of odd-numbered floor landing door switches 6b that detect opening of the landing doors 5 on odd-numbered floors from which the lowermost floor is excluded; and a plurality of even-numbered floor landing door switches 6c that detect opening of the landing doors 5 on even-numbered floors.
Moreover, the odd-numbered floors and even-numbered floors in this case are floor numbers when the floors on which the landing doors 5 are disposed are counted sequentially from below with the lowermost floor as the first floor, rather than the actual floor numbers in the building. Consequently, the odd-numbered floor landing door switches 6b and the even-numbered floor landing door switches 6c are disposed alternately on every single floor.
The signals from the landing door switches 6 are input into the elevator controlling apparatus 4 independently for each of the above systems. The odd-numbered floor landing door switches 6b and the even-numbered floor landing door switches 6c are connected in series in each system. Consequently, the elevator controlling apparatus 4 can recognize opening of the landing door 5 on the lowermost floor, the landing doors 5 on the odd-numbered floors, and the landing doors 5 on the even-numbered floors independently for each of the systems of landing door switches 6.
Disposed in the pit 1 a, which is the lowermost portion of the hoistway 1, are: an in-pit maintenance operating mode changeover switch (an automatic operation disabling switch) 9 for switching the operating mode to the maintenance operating mode; and an in-pit maintenance operating apparatus 10 for operating the car 3 in the maintenance operating mode. The in-pit maintenance operating mode changeover switch 9 and the in-pit maintenance operating apparatus 10 are disposed in close proximity to each other, and are electrically connected to the elevator controlling apparatus 4.
A first resetting switch 11 for resetting switching of the operating mode to return the operating mode to the automatic operating mode is disposed on the landing on the lowermost floor. A second resetting switch 12 for resetting switching of the operating mode to return the operating mode to the automatic operating mode is disposed on a landing of a predetermined floor other than the lowermost floor (the second floor, for example). The resetting switches 11 and 12 are electrically connected to the elevator controlling apparatus 4.
A car doorway is opened and closed by a car door 13. When the car 3 arrives in a door zone during normal operation, the car door 13 engages the landing door 5 of that floor. The landing door 5 is thereby opened and closed together with the car door 13.
A door operator (a car-top station) 14 that controls opening and closing of the car door 13 is disposed on the car 3. Disposed on the door operator 14 are: a car-top maintenance operating mode changeover switch (an automatic operation disabling switch) 15 for switching the operating mode to the maintenance operating mode; and a car-top maintenance operating apparatus 16 for operating the car 3 in the maintenance operating mode. The car-top maintenance operating mode changeover switch 15 and the car-top maintenance operating apparatus 16 are disposed in close proximity to each other, and are electrically connected to the elevator controlling apparatus 4.
In this manner, the in-pit maintenance operating mode changeover switch 9, the in-pit maintenance operating apparatus 10, the car-top maintenance operating mode changeover switch 15, and the car-top maintenance operating apparatus 16 are all disposed inside the hoistway 1. Because of that, the maintenance workers must open a landing door 5 and enter the hoistway 1 intentionally in order to operate them.
A car gate switch 17 that detects an open state of the car door 13 is disposed on the car door 13. A maintenance operation lower limiting switch 18 that limits descent of the car 3 during maintenance operation is disposed in a lower portion inside the hoistway 1. A maintenance operation upper limiting switch 19 that limits ascent of the car 3 during maintenance operation is disposed in an upper portion inside the hoistway 1. A cam 20 that operates the limiting switches 18 and 19 is disposed on the car 3.
The safety controlling portion 22 detects movement of maintenance workers into the hoistway 1 and disables automatic operation if a landing door switch 6 of any system indicates a door open state when the car gate switch 17 indicates a door closed state, and if the landing door switches 6 of two or more systems indicate door open states when the car gate switch 17 indicates a door open state. When divided into cases in which the car door 13 is closed and cases in which the car door 13 is open, this kind of control by the safety controlling portion 22 follows safety controlling logic 1 and 2 below.

Safety controlling logic 1.

The safety controlling portion 22 monitors the state of the car gate switch 17 and the three systems of landing door switches 6a, 6b, and 6c, and disables automatic operation if it detects that any of the landing door switches 6a, 6b, and 6c are off, i.e., that any of the landing doors 5 is open (no longer fully closed) when the car gate switch 17 is on, i.e., when the car door 13 is in a fully-closed state.

Safety controlling logic 2.

The safety controlling portion 22 disables automatic operation if it detects that two or more systems among the landing door switches 6a, 6b, and 6c are off, i.e., that the landing doors 5 in two or more systems are open when the car gate switch 17 is off, i.e., when the car door 13 is open.
Normally, when entering the pit 1 a for maintenance work, maintenance workers open the landing door 5 on the lowermost floor and enter the pit 1 a. When boarding the top of the car 3, the maintenance workers open the landing door 5 of the floor directly above the floor at which the car 3 is stopped (or after stopping the car 3 immediately under the floor from which it will be boarded) and board the top of the car 3. At this point, normally only the landing door 5 is in an open state. Consequently, most cases of movement of maintenance workers into the pit 1a and onto the car 3 can be detected by performing control using the above safety controlling logic 1.
However, in rare cases, maintenance workers may move into the pit 1 a or onto the car 3 in a state in which the car 3 is stopped at a given floor while operating automatically, and both the car door 13 and a landing door 5 are open. To handle such cases, movement of maintenance workers can be detected by control using the above safety controlling logic 2 even if both the car door 13 and the landing door 5 are in an open state at a given floor, by detecting that a landing door 5 that leads to the pit 1 a on the lowermost floor or a landing door 5 that leads to the top of the car 3 on the floor directly above the floor at which the car 3 is stopped is open, i.e., by detecting opening of the landing doors 5 in two or more systems.
Once automatic operation has been disabled, the safety controlling portion 22 continues the disabling of automatic operation until a resetting signal is received due to the first resetting switch 11 or the second resetting switch 12, which are outside the hoistway 1, being operated by the maintenance workers, and until fully-closed states of all of the landing doors 5 and the car door 13 are also confirmed. If the electric power supply was reset by a power outage, etc., automatic operation is disabled for safety.
If automatic operation of the elevator is disabled by the safety controlling portion 22, then the maintenance workers can switch the operating mode to the maintenance operating mode using the in-pit maintenance operating mode changeover switch 9 or the car-top maintenance operating mode changeover switch 15, and manually operate the car 3 (maintenance operation or inspection operation) using the in-pit maintenance operating apparatus 10 or the car-top maintenance operating apparatus 16. During manual operation, the range of movement of the car 3 is limited by the maintenance operation lower limiting switch 18 and the maintenance operation upper limiting switch 19.
Figure 2 is a block diagram that shows an elevator safety controlling apparatus from Figure 1. In order to ensure sufficient reliability of safety control, the safety controlling portion 22 is redundant (in this case, duplicated), having first and second logic circuits 23a and 23b that perform identical processing. Signals from the above switches 6a, 6b, 6c, 11, 12, and 17 are each input to both the first logic circuit 23a and the second logic circuit 23b. Here, the input signals from the landing door switches 6a, 6b, and 6c and the car gate switch 17 are also duplicated, and are compared with each other by the first logic circuit 23a and the second logic circuit 23b.
The logical product of the input from the three systems of landing door switches 6a, 6b, and 6c is found by the logic circuits 23a and 23b (being connected in series), and a signal that is equivalent to the input of conventional landing door switches 6 is thereby obtained. Control that is similar or identical to that of conventional elevators (control such as preventing the elevator from moving with the door open, for example) is possible by outputting this signal as signal output or relay output to other apparatuses such as the operation controlling portion 21.
The first and second logic circuits 23a and 23b perform safety control, and find the logical product of the output results thereof (enabling/disabling of automatic operation) and then output it to first and second relays 24a and 24b. The first and second relays 24a and 24b are connected in series, and input to the operation controlling portion 21 so as to enable automatic operation only when both contacts are closed (switched on). In other words, automatic operation of the car 3 is disabled if a command that disables automatic operation is output by either one of the first and second logic circuits 23a and 23b.
The output results are input back into the first and second logic circuits 23a and 23b to diagnose whether or not the results have been output correctly. In addition, the first and second logic circuits 23a and 23b have self-diagnostic functions for checking their own soundness. If an abnormality is detected by the logic circuits 23a and 23b, then output that disables automatic operation of the car 3 is performed.
Each of the logic circuits 23a and 23b may also be achieved using a computer that contains software (a computer that is separate from a computer for the operation controlling portion 21). Each of the computers has a central processing unit (CPU), a read-only memory (ROM), a random-access memory (RAM), and a watch dog timer (WDT), etc. Testing that relates to reading from and writing to the ROM and the RAM and time supervision by the WDT are performed.
Each of the logic circuits 23a and 23b may also be achieved using a simple (electronic) circuit (a logic circuit) that uses an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a complex programmable logic device (CPLD), a transistor, etc., or a relay circuit, etc.
The in-pit maintenance operating mode changeover switch 9, the in-pit maintenance operating apparatus 10, the car-top maintenance operating mode changeover switch 15, and the car-top maintenance operating apparatus 16 are included in a maintenance work apparatus 25.
Figure 3 is a flowchart that shows a safety controlling process in the safety controlling portion 22 from Figure 1. The safety controlling portion 22 executes the processing in Figure 3 repeatedly while automatic operation is not disabled (is enabled).
In the safety controlling process, diagnosis of the input signals is first performed (Step S1), and automatic operation is disabled if there is an abnormality (Step S2). If there is no abnormality, a determination is made concerning the car gate switch 17 (Step S3). If the car door 13 is in a fully-closed state, determinations are made concerning the landing door switches 6a, 6b, and 6c (Step S4). Then, if a landing door 5 of any system is in an open state, automatic operation is disabled (Step S2).
If the car door 13 is in a door open state, then determinations are made concerning the landing door switches 6a, 6b, and 6c (Step S5), and if the landing doors 5 of two or more systems are in an open state, automatic operation is disabled (Step S2).
In any case other than the above, that is, if all of the landing doors 5 and the car door 13 are in a closed state, or if the car door 13 is in an open state and only a landing door 5 of one system is in an open state, then the computational results of the redundant logic circuits 23a and 23b are collated (Step S6). Then, if the computational results do not match, automatic operation is disabled (Step S2). If the computational results match, then diagnosis of the output signals is performed (Step S7). If there is an abnormality in the diagnostic result of the output signals, automatic operation is disabled (Step S2). If the computational results match, and there is no abnormality in the signal, processing is terminated.
Figure 4 is a flowchart that shows an automatic operation resetting process in the safety controlling portion 22 from Figure 1. The safety controlling portion 22 executes the processing in Figure 4 repeatedly if disabling of automatic operation is maintained.
In the resetting process, diagnosis of the input signals is first performed (Step S11), and automatic operation disabling is maintained if there is an abnormality (Step S12). If there is no abnormality, a determination is made concerning the resetting signal input (Step S13), and if a resetting signal has not been input, automatic operation disabling is maintained (Step S12).
If a resetting signal has been input, a determination is made concerning the car gate switch 17 (Step S14). Then, if the car door 13 is in an open state, automatic operation disabling is maintained (Step S12). If the car door 13 is in a fully-closed state, determinations are made concerning the landing door switches 6a, 6b, and 6c (Step S15). Then, if a landing door 5 is in an open state even at one position, automatic operation disabling is maintained (Step S12).
If all of the landing doors 5 are in a fully-closed state, then the computational results of the redundant logic circuits 23a and 23b are collated (Step S16). Then, if the computational results do not match, automatic operation disabling is maintained (Step S12). If the computational results match, then diagnosis of the output signals is performed (Step S17). If there is an abnormality in the diagnostic result of the output signals, automatic operation disabling is maintained (Step S12). If the computational results match, and there is no abnormality in the signal, automatic operation disabling is released (automatic operation is enabled) (Step S18), switching over to the safety controlling process that is shown in Figure 3.
In an elevator safety controlling apparatus of this kind, by detecting that maintenance workers have opened a landing door 5 that leads to the top of the car 3 or to the pit 1 a in order to perform maintenance work while the car 3 is running or while it is stopped at a given floor in a closed door state or an open door state, for example, and automatically disabling automatic operation, the car 3 can be reliably prevented from moving unexpectedly for the maintenance workers even if the maintenance workers forget an automatic operation disabling operation, enabling the safety of the maintenance workers to be ensured. Moreover, by using existing equipment efficiently, movement of maintenance workers into the hoistway 1 can be detected at reduced cost.

Embodiment 2

Next, Figure 5 is a configuration diagram that shows a machine-roomless elevator according to Embodiment 2 of the present invention. In Embodiment 2, a case in which a floor for maintenance workers to board the top of a car 3 is specified (when an unlocking apparatus for opening a landing door 5 from a landing is disposed only on a specified floor, for example) will be explained. In such cases, landing door switches 6 can be divided into three systems that include: a lowermost floor landing door switch 6a; a specified floor landing door switch 6d; and unspecified floor landing door switches 6e that are disposed on other floors.

Safety controlling logic 1.

The safety controlling portion 22 monitors the state of the car gate switch 17 and the three systems of landing door switches 6a, 6d, and 6e, and disables automatic operation if it detects that any of the landing door switches 6a, 6d, and 6e are off, i.e., that any of the landing doors 5 is open when the car gate switch 17 is on, i.e., when the car door 13 is in a fully-closed state.

Safety controlling logic 2.

The safety controlling portion 22 disables automatic operation if it detects that two or more systems among the landing door switches 6a, 6d, and 6e are off, i.e., that the landing doors 5 in two or more systems are open when the car gate switch 17 is off, i.e., when the car door 13 is open. The rest of the configuration is similar or identical to that of Embodiment 1.
According to a configuration of this kind, by using existing equipment efficiently, movement of maintenance workers into the hoistway 1 can also be detected at reduced cost.
Moreover, in Embodiments 1 and 2, the lowermost floor landing door switch 6a is a single independent system, but in cases in which maintenance workers do not open the landing door 5 on the lowermost floor to enter the pit 1a, etc., a landing door switch 6 on the lowermost floor does not need to be a single independent system.
In Embodiments 1 and 2, the landing door switches 6 are divided into three systems, but may also be divided into four or more systems.

Embodiment 3

Next, Figure 6 is a configuration diagram that shows a machine-roomless elevator according to Embodiment 3 of the present invention. In this example, landing door switches 6 are divided into systems that are equal in number to the number of floors such that open and closed states of landing doors 5 on all floors individually. In other words, signals from all of the landing door switches 6 are respectively input into the elevator controlling apparatus 4 as independent systems.

Safety controlling logic 1.

The safety controlling portion 22 monitors the state of the car gate switch 17 and all of the systems of landing door switches 6, and disables automatic operation if it detects that any of the landing door switches 6 are off, i.e., that any of the landing doors 5 is open when the car gate switch 17 is on, i.e., when the car door 13 is in a fully-closed state.

Safety controlling logic 2.

The safety controlling portion 22 disables automatic operation if it detects that two or more systems among the landing door switches 6 are off, i.e., that the landing doors 5 at two or more positions are open when the car gate switch 17 is off, i.e., when the car door 13 is open. The rest of the configuration is similar or identical to that of Embodiment 1.
According to a configuration of this kind, by using existing equipment efficiently, movement of maintenance workers into the hoistway 1 can also be detected at reduced cost.
Moreover, in Embodiments 1 through 3, when movement of maintenance workers into the hoistway 1 is detected, automatic operation of the car 3 is disabled, but the operating mode of the operation controlling portion 21 may also be switched to a manual operating mode. An elevator safety circuit (not shown) may also be interrupted when movement of the maintenance workers into the hoistway 1 is detected. In that case, because passage of electric current to the hoisting machine motor and the hoisting machine brake is interrupted, the car 3 can be stopped without going through the operation controlling portion 21.
In Embodiments 1 through 3, connection from various kinds of switches to the safety controlling portion 22 was performed using wires, but may also be performed wirelessly.
In addition, in Embodiments 1 through 3, the resetting switches 11 and 12 are disposed outside the hoistway 1, but may also be disposed inside the hoistway 1.
Furthermore, in Embodiments 1 through 3, the hoisting machine 2 and the elevator controlling apparatus 4 are disposed in a lower portion inside the hoistway 1, but are not limited to this layout, and the present invention can also be applied to an elevator in which these are disposed in an upper portion inside the hoistway 1, for example.
In Embodiments 1 through 3, a machine-roomless elevator is shown, but the present invention can be applied to any type of elevator provided that it is an elevator in which maintenance work is performed inside a hoistway. For example, the present elevator can also be applied to elevators with a machine room, double-deck elevators, rope-less elevators, linear motor elevators, hydraulic elevators, etc.

Claims

An elevator safety controlling apparatus comprising:
a car gate switch that detects opening of a car door;

a plurality of landing door switches that detect opening of a plurality of landing doors; and

a safety controlling portion that performs safety control based on information that is output from the car gate switch and the landing door switches,

the elevator safety controlling apparatus being characterized in that:
the landing door switches are divided into a plurality of systems; and

the safety controlling portion can recognize opening of the landing doors independently for each of the systems of the landing door switches, and detects movement of maintenance workers into a hoistway if the landing door switches of any of the systems indicate an open door state when the car gate switch indicates a closed door state, and if the landing door switches in two or more of the systems indicate an open door state when the car gate switch indicates an open door state.
An elevator safety controlling apparatus according to Claim 1, wherein the systems of the landing door switches include two systems that detect opening of the landing doors alternately on every single floor.
An elevator safety controlling apparatus according to Claim 1, wherein the systems of the landing door switches include three systems that comprise:
a system that detects opening of the landing door on a lowermost floor; and

two systems that detect opening of the landing doors alternately on every single floor except for the lowermost floor.
An elevator safety controlling apparatus according to Claim 1, wherein the systems of the landing door switches include:
a system that detects opening of the landing door on a specified floor that is opened when maintenance workers enter the hoistway; and

a system that detects opening of the landing door on another floor floor.
An elevator safety controlling apparatus according to any one of Claims 1 through 4, wherein the landing door switches are connected in series in each of the systems.
An elevator safety controlling apparatus according to Claim 1, wherein the systems of the landing door switches are divided into systems that are equal in number to a number of floors so as to detect opening of the landing doors on all floors individually.
An elevator safety controlling apparatus according to any one of Claims 1 through 6, wherein the safety controlling portion disables automatic operation of a car when the movement of maintenance workers into the hoistway is detected.
An elevator safety controlling apparatus according to Claim 7, wherein the safety controlling portion continues disabling of automatic operation until a resetting switch is operated and fully-closed states of all of the landing doors and the car door are confirmed when the automatic operation of the car is disabled.
An elevator safety controlling apparatus according to any one of Claims 1 through 6, wherein the safety controlling portion switches an operating mode of a car to a manual operating mode when the movement of maintenance workers into the hoistway is detected.
An elevator safety controlling apparatus according to any one of Claims 1 through 6, wherein the safety controlling portion interrupts passage of electric current to a hoisting machine that raises and lowers a car and/or a brake by interrupting a safety circuit when the movement of maintenance workers into the hoistway is detected.
An elevator safety controlling apparatus according to any one of Claims 1 through 10, wherein the safety controlling portion has a plurality of redundant logic circuits that perform identical processing.