JP5624845B2 - Electronic safety elevator - Google Patents

Description

  The present invention relates to an elevator safety system, and is particularly suitable for an electronic system in which mechanical safety devices are reduced to make them more electronic.

  As elevator mechanical safety switches, safety devices, etc. are digitized, more sophisticated and intelligent functions can be realized. For example, to prevent malfunctions with high accuracy, use an electronic speed governor, calculate the speed with two microcomputers from the output of the encoder that changes as the car moves up and down, and determine that the abnormal speed level has been exceeded. In addition to stopping the car and comparing the detection speed obtained by calculation with two microcomputers, it is known to stop as an abnormality when there is a predetermined deviation, which is described in Patent Document 1, for example .

  Further, in an elevator having an electronic safety controller that detects an abnormality of the elevator and generates a command signal for shifting the elevator to a safe state, the electronic safety controller includes It is known to include the second microprocessor and confirm the soundness of the first and second microprocessors themselves by comparing the results of the arithmetic processing with each other.

International Publication No. 2004/076326 Pamphlet (Figure 7) International Publication No. 2006/090470 (paragraph 0038, FIG. 12)

  In the above prior art, a microcomputer (hereinafter referred to as a microcomputer), which is an arithmetic device, is duplicated to improve reliability. However, a final arithmetic result of the arithmetic device, that is, a car that is 1/0 bit information is used. Since only the output signal (car stop signal) for stopping is compared, there is a possibility of overlooking a failure. For example, if the car stop signal of one of the arithmetic units is stuck on the side where the car does not stop due to a fault in the arithmetic unit (for example, a fault in the microcomputer itself or a fault in the car stop signal output unit), the car stops during normal operation. Under unnecessary conditions, stuck faults cannot be found.

  In other words, when one of the arithmetic devices is in a state of failure, if the other arithmetic device fails, the car cannot be stopped, and the reliability of the safety device is reduced.

  Moreover, although the possibility described in Patent Document 2 increases the possibility of detecting a failure in the arithmetic unit itself of the arithmetic device, it is difficult to detect a fault in the car stop signal output unit, for example. Furthermore, in order to deal with differences in the car position and car speed calculation results due to the processing timing shift of each arithmetic device, it is necessary to devise methods such as synchronizing the processing timing of both arithmetic devices and setting the error threshold appropriately. In addition, the design becomes complicated and the software processing load increases.

  The object of the present invention is to solve the above-mentioned problems of the prior art, realize higher reliability and higher-performance safety, simplify the configuration, and facilitate high-reliability design and maintenance regardless of the elevator model and parts used Is to make it.

In order to achieve the above object, the present invention determines an abnormality using a sensor for detecting an operation state of an elevator as input information, and generates a command signal for shifting the car to a safe state . In the electronic safety elevator having the safety controller having the above-described arithmetic device, the first and second arithmetic devices are a stop determination unit that determines the stop of the elevator based on the input information, and a diagnosis that stops the elevator The diagnostic input information storage unit that records and stores the input information, and outputs the input information by the sensor during normal operation of the elevator, and the diagnostic input information when the stop determination unit determines that the stop An input switching unit that outputs, an arithmetic unit that determines abnormality of the elevator based on an output of the input switching unit and outputs a stop signal, an output of the first arithmetic unit, A comparator for comparing the output of the second arithmetic unit with each other, and when the pause determination unit determines that the pause is made, each of the arithmetic units outputs the stop signal according to the diagnostic input information If the outputs of the first and second arithmetic units do not match as stop signals in the comparison unit, the car is stopped. If the outputs match, the safety controller determines that the safety controller is operating normally. Diagnose .

  According to the elevator of the present invention, the self-diagnosis of the safety controller is performed in the elevator resting state, so that it is possible to detect a failure from the arithmetic unit to the output unit, thereby realizing higher reliability and higher function safety. it can.

The block diagram which shows the whole structure in one embodiment by this invention. The signal connection figure which shows the safety controller in one embodiment. The block diagram of the safety controller in one embodiment. The block diagram which shows the abnormality determination process in one Embodiment. The block diagram which shows the sensor and safety controller which are required for stop determination in one Embodiment. The figure which shows the input information for diagnosis in one Embodiment. The graph explaining the data table used by the terminal floor overspeed abnormality determination process in one embodiment. The output time chart of the safety controller in one embodiment.

Hereinafter, an embodiment will be described in detail with reference to the drawings.
Some elevator safety devices stop the car by turning on a safety switch. For example, a final limit is provided at the upper and lower ends of the hoistway to detect when the car position exceeds the normal operating range. The switch is one of the safety switches.

  The stop of the car is an emergency stop that activates the brake that is installed in the motor that drives the main rope of the car, cuts off the power to the drive motor of the hoist, etc., and detects the overspeed of the car. Done. The emergency stop is attached to the car and, when activated, grips the guide rail and suddenly stops the car.

  As a stop operation of the car, a combination of mechanical parts such as a switch and a relay / contactor is used for brake operation and energization interruption, and a governor and a governor rope are used for emergency stop. In elevators that have computerized these mechanical safety devices, microcomputers etc. calculate (detect) the position and speed of the car using the input information of sensors such as safety switches and encoders. Outputs a signal to stop the car. That is, the safety controller 40 detects the position and speed of the car based on the sensor that detects the operation state, detects an abnormality of the elevator, and commands to shift (stop) the car to a safe state. Generate a signal.

FIG. 1 shows an overall configuration of an electronic safety elevator. A car 1 moves in a hoistway by driving a main rope 10 to which a motor 2 is connected with a counterweight 11. The motor 2 is driven by an inverter 5 connected to an AC power source 7 through an energization cutoff circuit 6.
When the power cut-off circuit 6 is activated, power is not supplied to the inverter 5 and the driving force of the motor 2 is lost. The brake 3 suppresses driving of the motor 2 and generates a braking force for the car 1. The brake 3 is always operated, and the operation is released when energized.

  The governor rope 12 is pulled with the movement of the car 1 and rotates the governor 13. The governor 13 is provided with a gripping device 14 and a rotary encoder 21. When the gripping device 14 is operated, the governor rope 12 is gripped. Stop the car. The rotary encoder 21 rotates with the governor 13 to generate a pulse signal. The position of the car 1 can be obtained by integrating the amount of change of the pulse signal, and the speed of the car 1 can be obtained by calculating the time average of the amount of change.

  A buffer 17 is installed at the lower end of the hoistway, and the buffer 17 receives the car 1 and absorbs an impact when the car 1 cannot be completely stopped by the braking force of the brake 3 or the emergency stop device 15.

  Near the lower end and near the upper end of the hoistway, final limit switches 22 and 23 are provided, and these safety switches are always in an on state. Detecting overshoot of the car 1

  The controller 30 and the safety controller 40 are provided in a control panel installed on the hoistway or in the vicinity of the motor 2, and the controller 30 controls the inverter 5 to operate the car 1. Further, the safety controller 40 receives the rotary encoder 21 and the final limit switches 22 and 23 as inputs, and brakes the car by the emergency stop device 15 via the brake 3, the current cut-off circuit 6, and the gripping device 14. Although not shown in the figure, the elevator is provided with a number of safety switches such as a switch used to protect maintenance personnel during maintenance in addition to the final limit switch.

  FIG. 2 is a signal connection diagram of the elevator, and the controller 30 outputs an inverter control signal 31 to control the inverter 5.

  The safety controller 40 includes two microcomputers, a microcomputer 50 and a microcomputer 60. The microcomputers 50 and 60 are peripherals such as ROM (Read Only Memory), RAM (Random Access Memory), digital input / output, encoder input, and communication interface. Each circuit is connected to a CPU (Central Processing Unit) via an internal bus (not shown).

  The microcomputers 50 and 60 receive the encoder signal 41 from the rotary encoder 21 and the final limit switch signals 42 and 43 from the final limit switches 22 and 23, respectively.

  The microcomputer 50 outputs an emergency stop operation signal 54 to the AND circuit 70, the stop signal 52 to the contactor of the disconnect circuit 6, and the brake drive circuit 4 to apply the brake operation signal 53 to the brake 3. Is output to the gripping device 14. These four output signals are simultaneously input to the microcomputer 60. Similarly, as the output of the microcomputer 60, the stop request signal 61 is grasped by the AND circuit 70, the energization cut-off signal 62 is grasped by the contactor of the energization cut-off circuit 6, the brake operation signal 63 is grasped by the brake drive circuit 4, and the emergency stop operation signal 64 is grasped. It is connected to the device 14. These four output signals are also input to the microcomputer 50. The above eight output signals are stop outputs for operating the stopping means of the car 1.

  The stop request signals 51 and 61 are signals for stopping the car 1 by the controller 30. For example, the signal level H (High) is not requested and the signal level L (Low) is requested. It is also used to suppress the operation of the car 1 during elevator diagnosis. Since the two signals are output to the controller 30 via the AND circuit 70, the controller 30 stops the car 1 when one of the stop request signals 51 and 61 becomes Low.

  The energization cut-off signals 52 and 62 are connected to the two contactors in the energization cut-off circuit 6, respectively. When the contactor is on, the contactor is connected, and when it is off, the contactor is disconnected. Since the two contactors are connected in series, the energization interruption circuit 6 interrupts the energization between the AC power supply 7 and the inverter 5 when either of the energization interruption signals 52 and 62 is turned off.

  The brake operation signals 53 and 63 are connected to two contactors in the brake drive circuit 4, respectively. When the contactor is on, the contactor is connected, and when it is off, the contactor is disconnected. Since the two contactors are connected in series, the brake drive circuit 4 cuts off the power supply to the brake 3 when either signal is turned off.

  The emergency stop actuating signals 54 and 64 are input to a solenoid that activates the gripping device 14, and when both signals are on, the gripping device 14 is inactive, and when either signal is off, it operates.

  FIG. 3 shows a block diagram of functions provided in the microcomputers 50 and 60 of FIG. The microcomputer 50 includes an operation unit 81A, an input unit 82A, an output unit 83A, a comparison unit 84A, an input switching unit 85A, a pause determination unit 86A, and a diagnostic input information storage unit 87A. Similarly, the microcomputer 60 includes an operation unit 81B, It has an input unit 82B, an output unit 83B, a comparison unit 84B, an input switching unit 85B, a pause determination unit 86B, and a diagnostic input information storage unit 87B.

  Each unit is a program that is stored in a ROM inside or outside the microcomputer, and that each function is executed and realized by the CPU of the microcomputer. Even if this program is periodically executed at intervals of 10 ms using the timers of the microcomputers 50 and 60, when the input units 82A and 82B detect a change in the input signal, an interrupt is generated and executed. Also good. Details of the safety function realized by the microcomputers 50 and 60 will be described below.

  The input units 82A and 82B have a function of taking in a signal from a sensor for detecting the operation state of the elevator, and are a sensor. The encoder signal 41, final limit switch signals 42 and 43, and other safety switch signals (not shown) Is entered as

  The encoder signal 41 is converted into a value indicating the speed and position of the car 1, and the position information is reset to an initial value set in advance when the final limit switch signals 42 and 43 are detected. In the final limit switch signals 42 and 43, ON is replaced with HIGH and OFF is replaced with LOW. The input information is transmitted to the input switching units 85A and 85B and the pause determination units 86A and 86B.

  The suspension determination units 86A and 86B determine the suspension of the elevator based on the input information and notify the input switching units 85A and 85B. The input switching units 85A and 85B are used for diagnosis in order to carry out self-diagnosis when there is notification of elevator suspension from the suspension determination units 86A and 86B when the elevator is in normal operation. The input information is output to the calculation units 81A and 81B.

  The diagnostic input information is recorded and stored in the diagnostic input information storage units 87A and 87B. The output units 83A and 83B output a car stop signal (stopped at Low) which is the calculation result of the calculation units 81A and 81B. The comparison units 84A and 84B compare the car stop signal output from the output units 83A and 83B with the car stop signal output from the other microcomputer, and determine whether both systems (both microcomputers) are operating normally. If self-diagnosis is detected, the output units 83A and 83B are controlled so that the car stop signal becomes Low (car stop side) as shown in FIG.

FIG. 4 shows an example of the abnormality determination process performed by the calculation units 81A and 81B. In FIG. 4, the input unit and the input switching unit are omitted.
In the figure, a safety chain abnormality determination process 90 and a terminal floor overspeed abnormality determination process 91 are implemented. The safety chain abnormality determination processing 90 outputs Low when any one of the safety switches such as the final limit switches 22 and 23 is OFF, that is, when any one of the final limit switch signals 42, 43,. By setting the energization cutoff signal 52 and the brake operation signal 53 to Low, the operation commands for the brake 3 and the energization cutoff circuit 6 are output.

  In the terminal floor overspeed abnormality determination process 91, a first speed upper limit curve 92 and a second speed upper limit curve 93 are recorded as data tables with the position of the car 1 in the hoistway as the horizontal axis and the speed as the vertical axis. Yes.

  The terminal floor overspeed abnormality determination process 91 obtains a first speed upper limit corresponding to the position of the car 1 from the signal of the rotary encoder 21 from the first speed upper limit curve 92, and the car 1 calculated from the signal of the rotary encoder 21. When the speed exceeds the first speed upper limit, Low is output, and the operation of the brake 3 and the power cut-off circuit 6 is commanded by setting the power cut-off signal 52 and the brake operation signal 53 to Low.

  Further, the terminal floor overspeed abnormality determination processing 91 obtains the second speed upper limit corresponding to the position of the car 1 from the second speed upper limit curve 93, and the speed of the car 1 exceeds the second speed upper limit. , Low, and the emergency stop operation signal 54 is set to Low to operate the emergency stop device 15 via the gripping device 14.

  The suspension determination units 86A and 86B determine that the elevator is in a suspended state, and during this time, the microcomputers 50 and 60 are diagnosed. That is, in FIG. 5, signals from the car door switch 25, the car monitoring camera 26, the car weight sensor 27, etc. that detect the opening / closing of the door provided in the car among the input information are sensors that detect the operation state of the elevator. Is input to the safety controller 40, and the stop determination units 86A and 86B perform the stop determination of the elevator based on these pieces of information.

  For example, if the elevator is in a resting state when the elevator is stopped, that is, the car speed is zero, or the car door switch 25 is on, the car door is closed, and the car speed is zero for a predetermined time. Determined.

  Further, the presence / absence of passengers in the car is detected by the car monitoring camera 26 and the car weight sensor 27, and it is determined that the elevator is in a resting state after a predetermined time has passed since the passengers disappeared. Further, the microcomputers 50 and 60 may be provided with two operation modes, a normal mode and a maintenance mode, which can be changed from the outside by communication or a switch, and may be determined to be in an elevator resting state in the maintenance mode.

  FIG. 6 shows an example of diagnostic input information stored and stored in the diagnostic input information storage units 87A and 87B. The diagnostic input information is four types of diagnostic patterns that combine final limit switches (upper and lower ends), car position, and car speed. As for the car position and car speed, as shown in FIG. 7, in the data table used in the terminal floor overspeed abnormality determination process, the normal area, the area between the first speed upper limit 92 and the second speed upper limit 93, the second speed upper limit. Data of points A, B, and C in an area exceeding 93 is stored.

  In the diagnostic patterns 1 and 2, the final limit switches 22 and 23 are turned off to create an abnormal state. The point A in the normal area is used for the car position and car speed. In diagnosis patterns 3 and 4, the final limit switches are both turned on (normal), and the car position and car speed are set to point B and point C, respectively, to simulate an abnormal state.

  FIG. 8 shows a time chart of the output signals 51 to 54 and 61 to 64 when the calculation units 81A and 81B perform calculations using the diagnostic input information as described above.

  If the microcomputer is operating normally, a signal (Low) for stopping the car 1 is output at any input value of any diagnostic pattern. When the suspension determination units 86A and 86B determine the elevator suspension state, this signal is output to the input switching units 85A and 85B, and the input switching unit sequentially inputs the diagnostic input information of the diagnostic patterns 1 to 4 to the calculation units 81A and 81B. Supply.

  In the diagnosis patterns 1, 2, and 3, the stop request signals 51 and 61, the energization cutoff signals 52 and 62, and the brake operation signals 53 and 63 are all Low, but the emergency stop operation signals 54 and 64 are not operated because the emergency stop is not operated. Remains High. On the other hand, in the diagnostic pattern 4, the emergency stop operation signals 54 and 64 output Low. However, once the emergency stop is activated, it cannot be automatically released and a recovery operation is required. Therefore, a pulse output with a time width in which the gripping device 14 is not activated is used. In the diagnosis pattern 4, the stop request signals 51 and 61 and the energization cut-off signals 52 and 62 are Low. However, when the brake 3 and the emergency stop device 15 are operated simultaneously, the braking force is increased for the brake operation signals 53 and 63. Since it may be too strong, it remains high and the brake 3 is not applied.

  The comparison units 84A and 84B compare the car stop outputs of both microcomputers. If they do not match, a low level car stop signal is output via the output units 83A and 83B to stop the car. As a result, not only when the value of the car stop signal is different due to a failure of the calculation unit or output unit of one microcomputer, but also the diagnosis timing is shifted due to a failure of the input unit, the pause determination unit, or the input switching unit. Even in such a case, the abnormality can be detected.

  With respect to the comparison timing, the comparison timing condition is set loosely so that the other car stop output only needs to change within, for example, several 100 ms after the car stop output of one microcomputer changes. As a result, it is not necessary to synchronize the operations of both microcomputers exactly as in the case of comparing intermediate calculation results such as the car position and car speed.

  As described above, in the microcomputers 50 and 60 of the safety controller 40, the suspension determination units 86A and 86B determine the suspension state of the elevator. The calculation is performed using the diagnostic input information such that 61 to 64 are on the car stop side, and the calculation results are compared with each other by the comparison units 84A and 84B. Therefore, the safety controller has performed a self-diagnosis, and a failure from the calculation unit to the output unit can be detected. And it becomes possible to improve the failure detection rate and reliability of a safety controller, and to provide a highly safe elevator.

  In addition, since it is not necessary to compare the calculation results such as the car position and the car speed between the microcomputers, complicated processing such as synchronizing the processing timings of both microcomputers becomes unnecessary. This facilitates a highly reliable design of the safety device and reduces the software processing load.

  In the above-described embodiment, the safety controller is configured by duplicating the microcomputer, but the reliability is improved more than triple. Further, it is desirable from the viewpoint of safety to use a logic circuit IC (Integrated Circuit) or a multi-core (one semiconductor chip having a plurality of CPUs) microcontroller as the arithmetic unit.

  Further, if the rotary encoder 21 is doubled and each signal is input to each microcomputer, the reliability can be further improved. According to this, a failure of the rotary encoder can also be detected by the above diagnostic method. Specifically, when a failure occurs in the rotary encoder connected to one microcomputer, for example, a fixed failure of the encoder value, this microcomputer determines that the car speed is zero and starts diagnosis. The car stop output does not match. Therefore, in this case, it is possible to detect a failure including not only the calculation unit and output unit of the safety controller but also the rotary encoder and its signal input unit.

  Furthermore, if the car stop signal, which is one of the comparisons, is not a microcomputer output but a signal output to the outside of the safety controller, the output will be confirmed and a more comprehensive failure detection will be performed. It becomes.

DESCRIPTION OF SYMBOLS 1 Car 2 Motor 3 Brake 10 Main rope 12 Governor rope 14 Gripping device 15 Emergency stop device 21 Rotary encoder 22, 23 Final limit switch 25 Car door switch 26 Car monitoring camera 27 Car weight sensor 40 Safety controller 41 Encoder signal 42, 43 Final limit switch signal 50 Microcomputer (A)
60 Microcomputer (B)
51, 61 Stop request signal 52, 62 Energization cutoff signal 53, 63 Brake operation signal 54, 64 Emergency stop operation signal 81A, 81B Calculation unit 82A, 82B Input unit 83A, 83B Output unit 84A, 84B Comparison unit 85A, 85B Input switching 86A, 86B Rest determination unit 87A, 87B Diagnosis input information storage unit

Claims (4)

An electronic device having a safety controller having first and second arithmetic units that determines abnormality by using a sensor that detects an elevator operation state as input information, generates a command signal for shifting the car to a safe state In safety elevators,
The first and second arithmetic units are:
A stop determination unit that determines stop of the elevator based on the input information;
A diagnostic input information storage unit for recording and storing diagnostic input information for stopping the elevator;
An input switching unit that outputs input information by the sensor during normal operation of the elevator, and outputs the diagnostic input information when the suspension determination unit determines that the operation is stopped.
An arithmetic unit that determines abnormality of the elevator based on the output of the input switching unit and outputs a stop signal;
A comparator for comparing the output of the first arithmetic unit and the output of the second arithmetic unit;
Each of the arithmetic devices outputs the stop signal according to the diagnostic input information, and the comparator outputs the first and second arithmetic devices. An electronic safety elevator characterized in that if the vehicle does not match as a stop signal, the car is stopped, and if it does match, the safety controller performs self-diagnosis that it is operating normally . 2. The electronic safety elevator according to claim 1 , wherein a sensor for detecting an operating state of the elevator includes an encoder for detecting a speed and a position of the car, and a car door switch for detecting opening / closing of a car door provided in the car. An electronic safety elevator characterized in that when the car door is closed and the state where the speed of the car is zero continues for a predetermined time, it is determined that the elevator is stopped. The electronic safety elevator according to claim 1 , wherein the sensor for detecting the operation state of the elevator is a car monitoring camera or a car weight sensor 27 for detecting the presence or absence of a passenger in the car, and a state in which no passenger is present is predetermined. An electronic safety elevator characterized by determining that the elevator is stopped when the time continues. 2. The electronic safety elevator according to claim 1 , wherein the safety controller is configured by a multi-core having a plurality of the arithmetic devices in one semiconductor chip . 3.

Images