JP2010095342A - Elevator safety system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an elevator safety system capable of ensuring the reliability while reducing wiring. <P>SOLUTION: The elevator safety system includes: at least one input/output node 2 which is connected to at least one sensor 5 or a switch 4 and generates a sign-redundant message 10 from a state of the sensor 5 or the switch 4 using an error detection sign; a single transmission passage 3 which is connected to the input/output node 2 and transmits/receives the message 10; and a safety braking unit 1 which is connected to the transmission passage 3, a hoist 6 and a brake 7, and processes the message 10 transmitted from the input/output node 2, and brakes the hoist 6 and the brake 7 when determining any dangerous state. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an elevator safety system used in an elevator apparatus, and more particularly to an elevator safety system using electronic components.

  Conventional elevator safety systems have been realized by constructing a safety circuit that connects switches and sensors directly. However, since the switches and sensors constituting these safety circuits are individually connected to the control board, the wiring is enormous.

  Patent Document 1 below discloses a technique for reducing wiring by connecting switches and sensors to a bus node and connecting the bus node to a safety controller via a safety bus.

Japanese translation of PCT publication No. 2002-538061 (page 8, lines 12 to 20, FIG. 1)

  However, the elevator safety system described in Patent Document 1 has a problem that the reduction of wiring is insufficient because the safety bus is made redundant. In addition, there are insufficient measures for ensuring the reliability of data transmission methods, bus nodes, and safety controllers via safety buses. As a system for transmitting signals related to safety devices, reliability There was also a problem of lacking.

  Accordingly, the present invention has been made to solve such a problem, and an object of the present invention is to obtain an elevator safety system that ensures reliability while realizing a reduction in wiring.

  The elevator safety system of the present invention is connected to at least one sensor or switch, and uses at least one input / output node to generate a code redundant message from the state of the sensor or switch using an error detection code, and the input / output A single transmission path connected to a node and transmitting the message; and a safety braking unit connected to the transmission path, an elevator hoist and a brake, the input / output node and the safety braking unit comprising: A lower layer communication means for communicating the message via the transmission line, and generating a code-redundant message and transferring it to the lower layer communication means, and a communication error from the message received from the lower layer communication means. An upper layer communication means for detecting the safety braking unit, wherein the safety braking unit is sent from the input / output node. Has been processed the message, it is determined that there is a dangerous condition, for braking the hoisting machine and the brake.

  According to the elevator safety system of the present invention, it is possible to reduce wiring while ensuring reliability by transmitting a code-redundant message through a single transmission line.

<Embodiment 1>
FIG. 1 is a diagram showing a configuration of an elevator safety system according to Embodiment 1 of the present invention. The elevator safety system includes a safety braking unit 1, a plurality of input / output nodes 2, a safety network 3, various sensors 5 related to emergency braking of the elevator, a switch 4 or other input / output device (not shown), a hoisting machine 6. The brake 7 is provided.

  First, the connection relationship of each configuration described above will be described. One of the safety braking units 1 is connected to an input / output node 2 via a safety network 3 (transmission path), and the other is connected to an elevator car hoist 6 and a brake 7. The input / output node 2 is connected to various sensors 5, switches 4 or other input devices related to emergency braking of the elevator via an interface, and the other is connected to the safety braking unit 1 via a safety network 3. The

  For example, the input / output node 2 installed in the elevator car includes an emergency stop switch 4-1, a gate switch 4-2, a door zone sensor 5-1, a relevel (flooring) zone sensor 5-2, an end point switch 4-4. 3 etc. are connected. Further, the final limit switch 4-4 and the like are connected to the input / output node 2 installed at the upper part of the hoistway, and the final limit switch 4-4 and the like are similarly connected to the input / output node 2 installed at the lower part of the hoistway. Is connected. The input / output node 2 installed at the landing is connected to a door switch 4-5, a manual operation switch 4-6 for maintenance, and the like. However, these connection methods can be changed by the elevator system.

  Next, the operation of each component will be described. The input / output node 2 generates a redundantly encoded message 10 (described later) as shown in FIG. 2 from the state of the input signals of the sensor 5 and the switch 4 and transmits it to the safety braking unit 1 via the safety network 3. When the safety braking unit 1 determines that the elevator is in a specific crisis state based on the received message 10, the safety braking unit 1 cuts off the power supply to the hoisting machine 6 and / or the brake 7, thereby emergency braking the elevator. Let

  For example, the safety braking unit 1 receives the information of the switch 4 and the sensor 5 connected to the conventional safety circuit such as the final limit switch 4-4 from the input / output node 2, and even one of the switches 4 is cut off. If this is the case, it is determined that the vehicle is in a dangerous state, and the power supply to the hoisting machine 6 and / or the brake 7 is immediately cut off to cause emergency braking of the elevator.

  In addition, the safety braking unit 1 receives information on the door zone sensor 5-1, the relevel zone sensor 5-2, the gate switch 4-2, and the door switch 4-5 from the input / output node 2, and the car performs floor-to-floor operation. If it is detected that the vehicle has left the predetermined zone while the door is open, it is determined that the vehicle is in a dangerous state because there is a risk of occupants being caught as it is, and the power supply of the hoisting machine 6 and / or the brake 7 is immediately supplied. Shut off and emergency brake the elevator.

  Next, the message 10 transmitted on the safety network 3 will be described. As shown in FIG. 1, the safety network 3 of the present invention is configured by a single transmission line. In the example of FIG. 1, a case where a network is configured in a bus shape is shown. A message 10 transmitted over the safety network 3 is encoded by an error detection code. In the present embodiment, for example, CRC (Cyclic Redundancy Code) is used as the error detection code.

  FIG. 2 is a diagram showing a configuration example of the message 10 transmitted on the safety network 3. The input / output node 2 converts the state of the input signal of the connected sensor 5 or switch 4 into data in a bit string. A header 16 including the sender address 11 and the receiver address 12 and a running number 14 indicating the update of the message 10 are added to the data 13, and these are encoded with a CRC 15 to create the message 10 and transmitted to the safety braking unit 1. To do.

  FIG. 3 is a flowchart showing processing when the safety braking unit 1 receives the message 10. First, the safety braking unit 1 confirms whether the message 10 has been received from the input / output node 2 (step S1). When the message 10 is received, an error is detected by checking the CRC 15 for the message 10 (step S2). Further, it is confirmed from the header 16 whether the sender address 11 and the recipient address 12 are correct (step S3). Further, it is confirmed by the running number 14 that the message 10 is correctly updated (step S4).

  If it is determined in step S1 to S4 that the valid message 10 has not been received, the message 10 in which an error has been detected is determined to be invalid and discarded (step S8). Further, the reception interval of the message 10 is monitored (step S9), and if the valid message 10 cannot be received within a certain time (steps S1 and S8), it is considered that communication has not been established and the safety state cannot be confirmed. Therefore, the safety braking unit 1 performs emergency braking of the elevator by cutting off the power supply of the hoisting machine 6 and / or the brake 7 (step S10).

  On the other hand, if it is determined in step S1 to S4 that the valid message 10 has been received, the timer for monitoring the reception interval is reset (step S5), and the message 10 is validated and data processing is performed (step S6). Next, the safety braking unit 1 determines whether the elevator is in a dangerous state from the state of various sensors 5 and switches 4 connected to the input / output node 2 (step S7), and the car is in a dangerous state (safety). If the safety braking unit 1 determines that the vehicle is not in a normal state, the safety braking unit 1 performs emergency braking of the elevator by cutting off the power supply of the hoisting machine 6 and / or the brake 7 (step S10). On the other hand, when the safety braking unit 1 determines that the car is not in a dangerous state (a safe state), the process returns to step S1 and the same processing is performed.

  For example, if the final limit switch 4-4 installed at the upper part or the lower part of the hoistway is cut off, the car has exceeded the specified length of the hoistway, and the safety braking unit 1 makes the elevator dangerous. It is determined that the vehicle is in a state (step S7), and the elevator is emergency braked by cutting off the power supply of the hoisting machine 6 and / or the brake 7 (step S10).

  As described above, according to the elevator safety system of the first embodiment of the present invention, the code redundant message 10 is transmitted through the single safety network 3, thereby realizing a reduction in wiring while ensuring reliability. be able to.

  In addition to the effects described above, there are effects such as reduction of energy consumption and reduction of environmental load at each stage in the product life cycle. In addition, the reduction of the wiring has effects such as collection at the time of disposal, ease of transportation, product decomposition, and ease of separation.

  Next, the configuration of the safety braking unit 1 and the input / output node 2 will be described. FIG. 4 is a diagram showing the configuration of the safety braking unit 1. The configuration of the input / output node 2 can be realized by the same configuration as the safety braking unit 1. The safety braking unit 1 and the input / output node 2 are configured by multiplexing main arithmetic circuits such as a CPU 32, a ROM 33, and a RAM 34 (duplexed in FIG. 4). Furthermore, communication between the CPUs 32 is performed via the DPRAM 35, and the calculation results are collated. Further, it has a diagnostic function (diagnostic means) such as inspection of the memory (ROM 33 and RAM 34, DPRAM 35) and the internal communication line 38.

  The safety braking unit 1 and the input / output node 2 diagnose input / output and the soundness of their own circuits using the above-described diagnosis function. For example, an extremely short OFF pulse is intentionally inserted via the output circuit 37 for an input whose input signal is in an ON state for a certain period of time. When this OFF pulse cannot be detected, it is detected that the input is fixed to ON. As for the output signal, the output signal is input to itself via the input circuit 36 (readback), and it is confirmed that the value matches the output command. If they do not match, an output fault is detected.

  As mentioned above, according to the elevator safety system in Embodiment 1 of this invention, since it has a diagnostic function and can test | inspect its own soundness, in addition to the effect mentioned above, it can ensure further reliability. it can.

  Next, communication functions of the safety braking unit 1 and the input / output node 2 will be described. FIG. 5 is a diagram showing a hierarchy of communication functions of the safety braking unit 1 and the input / output node 2. The safety braking unit 1 and the input / output node 2 generate a redundantly encoded message 10 from the state of the sensor 5 or the switch 4 by an upper layer of communication functions (upper layer communication means, hereinafter referred to as a safety layer 21), The message 10 is passed to the lower layer 22 of the communication function. The safety braking unit 1 and the input / output node 2 transmit and receive the message 10 by the lower layer 22 (lower layer communication means). The safety braking unit 1 and the input / output node 2 perform detection of a code error from the message 10, inspection of a sender / receiver, and monitoring of a reception time by the safety layer 21 as shown in the above-described processing at the time of reception. As described above, all processes related to high reliability of communication are performed by the safety layer 21, and all errors caused by communication are inspected by the safety layer 21, so the lower layer 22 needs to perform communication error detection processing. There is no. The safety layer 21 is executed on hardware having the above-described diagnostic function, and the lower layer 22 can be realized by any communication means.

  As mentioned above, according to the elevator safety system in Embodiment 1 of this invention, since all the errors resulting from communication are test | inspected by the safety layer 21, in addition to the effect mentioned above, reliability can be ensured further. In addition, the burden on the safety layer 21 and the lower layer 22 can be distributed, and at the same time, the general-purpose communication chip 31 can be used to realize the lower layer 22. Therefore, the communication chip 31 corresponds to a transmission line medium. By doing so, highly reliable communication is possible in any transmission path (safety network 3) including radio.

<Embodiment 2>
The elevator safety system according to the present embodiment has a configuration further including a position sensor and / or a speed sensor connected to input / output node 2 in the configuration shown in the first embodiment. By providing the position sensor and / or speed sensor, the safety braking unit 1 can obtain the current position and speed of the elevator car. When the safety braking unit 1 determines that the car is in an overspeed state based on the current position and speed of the car, the safety braking unit 1 cuts off the power supply to the hoisting machine 6 and / or the brake 7 to emergency brake the elevator. Let

  As described above, according to the elevator safety system of the present embodiment, the car can be prevented from falling into an overspeed state, and the car can be prevented from colliding with the hoistway end. Can alleviate the impact.

<Embodiment 3>
The elevator safety system in the present embodiment has a configuration further including a position sensor and / or a speed sensor connected to the input / output node 2 as in the second embodiment. By providing the position sensor and / or speed sensor, the safety braking unit 1 can obtain the current position and speed of the elevator car. When the safety braking unit 1 determines that the car is in an excessively decelerated state based on the current position and speed of the car, the safety braking unit 1 operates the power supply of the hoisting machine 6 and / or the brake 7 to thereby control the elevator. Mitigates sudden stops due to emergency braking.

  As described above, according to the elevator safety system of the present embodiment, the car can be prevented from falling into an excessively decelerated state, and the shock to the elevator passengers and maintenance personnel can be reduced.

<Embodiment 4>
The elevator safety system according to the present embodiment includes a transmission means (not shown) that can transmit a message 10 to each input / output node 2 in the safety braking unit 1, and receives the message 10 at the input / output node 2. It is the structure provided with the receiving means (not shown) which can be. The safety braking unit 1 can instruct output to the switch 4 connected to the input / output node 2 by transmitting the message 10 to the input / output node 2. Other configurations are the same as those in any one of the first to third embodiments, and thus description thereof is omitted.

  The method for transmitting and receiving the message 10 is the same as the flow of the message 10 from the input / output node 2 to the safety braking unit 1 described above. The safety braking unit 1 generates a message 10 including output data in which information for operating the sensor 5 and the switch 4 is made code redundant, and transmits the message 10 to the input / output node 2. The input / output node 2 obtains output data to each switch 4 from the message 10 received from the safety braking unit 1, and controls the sensor 5 and the switch 4 based on the output data. For example, a door opening / closing permission signal is received, and the door switch 4-5 connected to the input / output node 2 is operated to unlock the door only when the door opening is permitted.

  As described above, according to the present embodiment, the safety control can be output via the network so that the safety state can be ensured, and the safety braking unit 1 can operate the switch 4 related to the elevator safety system.

<Embodiment 5>
The transmission means (not shown) of the safety braking unit 1 and the input / output node 2 in the present embodiment is configured to transmit the same message 10 a plurality of times. In addition, the receiving means (not shown) of the safety braking unit 1 and the input / output node 2 in the present embodiment receives the same number of messages 10 as the number of times of transmission and all receive the same message 10 The message 10 is determined to be valid. Other configurations are the same as those in any one of the first to fourth embodiments, and thus description thereof is omitted.

  The sender of the message 10 transmits the same message 10 multiple times instead of increasing the strength of the CRC 15 according to the type of signal. The receiver receives the message 10 as many times as the number of transmissions, and considers that the message 10 has been received only when all the messages 10 are the same. For example, the message 10 including the data 13 of the switch 4 that does not require urgency is transmitted twice with the CRC 15 having a small number of bits added.

  As mentioned above, according to the elevator safety system in this Embodiment, the processing load required for the inspection of CRC15 can be reduced.

<Embodiment 6>
The safety braking unit 1 or the input / output node 2 in the present embodiment executes the diagnostic function as shown in the first embodiment, and when an abnormality is detected as a result, the content of the abnormality (abnormal information) is displayed. Transmit as message 10. The abnormality information thus transmitted is centrally managed by the safety braking unit 1 or the input / output node 2. Other configurations are the same as those in any one of the first to fifth embodiments, and thus description thereof is omitted.

  As described above, according to the elevator safety system in the present embodiment, when the elevator safety network system is abnormal, it is possible to collect and browse the abnormality information, and the elevator can be quickly restored.

<Embodiment 7>
In any of the embodiments described above, the same effect can be obtained even if a code other than CRC15, for example, a parity bit, a BCH code, a Reed-Solomon code, an error correction code, or the like is used as an error detection code added to the message 10. Can do.

<Eighth embodiment>
As the configuration of the safety network 3, in addition to the bus shape described in the first embodiment, the same effect can be obtained by using a star type or daisy chain type wiring method.

It is the figure which showed the structure of the elevator safety system in Embodiment 1 of this invention. It is the figure which showed the structure of the message transmitted / received on the safety network of the elevator safety system in Embodiment 1 of this invention. It is the flowchart which showed the process of the safe braking unit of the elevator safety system in Embodiment 1 of this invention. It is the figure which showed the structure of the safety braking unit of the elevator safety system in Embodiment 1 of this invention. It is the figure which showed the hierarchy of the communication function of the safety braking unit and input / output node of the elevator safety system in Embodiment 1 of this invention.

Explanation of symbols

  1 Safety braking unit, 2 Input / output node, 3 Safety network, 4 Switch, 5 Sensor, 6 Hoisting machine, 7 Brake, 10 Message, 11 Sender address, 12 Receiver address, 13 Data, 14 Running number, 15 CRC 16 header, 21 safety layer, 22 lower layer, 31 communication chip, 32 CPU, 33 ROM, 34 RAM, 35 DPRAM, 36 input circuit, 37 output circuit, 38 internal communication line.

Claims (9)

At least one input / output node connected to at least one sensor or switch and generating a code-redundant message from the state of the sensor or switch using an error detection code;
A single transmission line connected to the input / output node and transmitting the message;
A safety braking unit connected to the transmission path, an elevator hoist and a brake,
The input / output node and the safety braking unit are:
Lower layer communication means for communicating the message via the transmission path;
An upper layer communication unit that generates the code-redundant message, transfers the generated message to the lower layer communication unit, and detects a communication error from the message received from the lower layer communication unit;
The elevator safety system according to claim 1, wherein the safety braking unit processes the message transmitted from the input / output node and brakes the hoist and the brake when determining that there is a dangerous state.   The elevator safety system according to claim 1, wherein the upper layer communication means has a multiplexed arithmetic circuit.   The elevator safety system according to claim 1 or 2, wherein the input / output node and the safety braking unit have diagnostic means for checking the soundness of the input / output and its own circuit.   The elevator safety system according to claim 3, wherein the diagnosis means includes a multiplexed arithmetic circuit. The input / output node is
A transmission means for transmitting the same message multiple times;
The safety braking unit is
5. The receiving device according to claim 1, further comprising: a receiving unit configured to determine that the message is valid when receiving the same number of messages as the number of transmissions transmitted by the input / output node and receiving all the same messages. The elevator safety system described in Crab. A position sensor and a speed sensor connected to the input / output node;
The safety braking unit brakes the hoisting machine and the brake so as to cut off the power when detecting that the elevator car is in an overspeed state based on the information of the position sensor and the speed sensor. The elevator safety system according to any one of claims 1 to 5.   When the safety braking unit detects that the elevator car is in an excessively decelerated state based on the information of the position sensor and the speed sensor, the safety brake unit and the hoisting machine reduce the sudden stop due to emergency braking. 7. The elevator safety system according to claim 6, which brakes a brake. The safety braking unit includes a transmission unit that generates a code redundant code of information for operating the sensor and the switch using an error detection code, and transmits the message.
The elevator safety according to any one of claims 1 to 7, wherein the input / output node includes receiving means for receiving the message transmitted from the safety braking unit, and controls the sensor and the switch based on the message. system. The transmission means of the safety braking unit transmits the same message multiple times;
The receiving means of the input / output node receives the same number of messages as the number of transmissions transmitted by the safety braking unit, and determines that the message is valid when all the same messages are received. Item 9. The elevator safety system according to Item 8.

Images