JP6230729B2 - Elevator safety control device and elevator safety control method - Google Patents

Description

  The present invention relates to an elevator safety control device and an elevator safety control method that use a timer to measure the time until the car is stopped when an abnormality is detected, and particularly has a feature in a timer diagnosis function.

  A conventional elevator safety control device, particularly an electronic safety control device, can detect an abnormality of the safety control device itself. And when this abnormality is detected, this conventional apparatus first outputs the nearest floor stop command for stopping the car to the nearest floor to the elevator control section. Furthermore, this conventional apparatus outputs an emergency stop command for emergency stop of the car to the elevator control unit when a preset time has elapsed from the output of the nearest floor stop command (see, for example, Patent Document 1).

WO2006 / 090470

However, the prior art has the following problems.
The conventional device of Patent Document 1 includes a timer circuit that counts the grace time for stopping the nearest floor, and in order to check the soundness of the timer, the timer circuit is operated periodically during service suspension. It is necessary to let As a result, there has been a problem that during the timer diagnosis, the elevator cannot be operated, or the abnormality of the timer cannot be detected until the timer period elapses.

  The present invention has been made to solve the above-described problems, and obtains an elevator safety control device and an elevator safety control method that ensure soundness and availability when performing safety control using a timer. With the goal.

An elevator safety control device according to the present invention executes at least one safety monitoring function based on an input unit that reads a monitoring signal from a switch or sensor that monitors the state of the elevator, and a monitoring signal that is read via the input unit. The two arithmetic processing units and the arithmetic processing unit are provided independently, or a timer provided in the arithmetic processing unit and a signal for shutting off the power supplied to each of the elevator hoist and the brake are output. When an elevator abnormality is detected by executing a safety monitoring function on the basis of a monitoring signal read via the input unit in the arithmetic processing unit, a timer is started at the time limit of the timer. An elevator that stops the car by shutting off the power supplied to the hoisting machine and brake by outputting a signal that shuts off the power from the output section. A safety control device that is provided independently of the arithmetic processing unit or provided inside the arithmetic processing unit, further comprising a timer comparison unit that executes timer count diagnosis processing, and the timer is started as a dual system The timer comparison unit compares the count values of the two activated timers with each other, and the difference between the count values of the two timers exceeds a preset constant difference value. Determines that a count abnormality has occurred in at least one of the two timers, and stops the car to execute a timer count diagnosis process . The arithmetic processing unit controls the operation of the elevator that controls the operation of the elevator. When a diagnosis permission signal is received from the operation control device as a response to the transmission of the diagnosis start signal, two timers are started and -The timer count diagnosis process by the comparison unit is executed, and when the timer comparison unit does not determine that the count abnormality has occurred until the respective timer count values reach the timer time limit, the two timers If it is determined that the count abnormality of the two timers has been completed by the timer comparison unit until the timer count diagnosis process is terminated by determining that the timer is normal and the count values of the two timers reach the timer time limit, When it is judged that at least one of the two timers is abnormal, the car is stopped, and the timer count diagnosis process is being executed, if a service request generation signal is received from the operation control device, a timer count diagnosis by the timer comparison unit The processing is interrupted and the count value up to the present is stored as the counter saved value If the diagnosis permission signal is received again from the operation control device while the timer count diagnosis process is interrupted, the counter stored value is set as the initial value and the two timers are restarted. The diagnosis process is resumed .

  Further, the elevator safety control method according to the present invention executes a safety monitoring function based on an input unit that reads a monitoring signal from a switch or sensor that monitors the state of the elevator, and a monitoring signal read through the input unit. At least one arithmetic processing unit and the arithmetic processing unit are provided independently of each other, or provided in the arithmetic processing unit, and are provided with two independent timers that are activated as a double system, and an elevator hoist and a brake An output unit that outputs a signal for shutting off the power supplied to each of the above and a timer comparison unit that is provided independently of the arithmetic processing unit or that is provided inside the arithmetic processing unit and executes timer count diagnosis processing The elevator safety control method is executed by the elevator safety control device, and the operation processing unit performs overall control of the elevator operation. When the diagnosis permission signal is received from the operation control device as a response to the transmission of the diagnosis start signal to the control device, the first step for starting the two timers and the timer comparison unit perform two steps according to the first step. After starting the timer, the count values of the two timers are compared with each other. If the difference between the count values of the two timers exceeds a preset difference value, at least one of the two timers is counting abnormally In the second step of executing the timer count diagnosis process and the calculation processing unit until the respective count values of the two timers reach the timer time limit, the second time by the timer comparison unit is determined. If it is not determined that the count abnormality has occurred in the step, it is determined that the two timers are normal, In the third step for ending the timer count diagnosis process in two steps, and in the arithmetic processing unit, a count abnormality occurs in the second step by the timer comparison unit until the respective count values of the two timers reach the timer time limit. If it is determined that the service request generation signal is received from the operation control unit in the arithmetic processing unit during execution of the timer count diagnosis process according to the fourth step and the second step for stopping the car, In the arithmetic processing unit, the timer count diagnosis process in the second step is interrupted and the count value up to the present time is stored as a counter stored value, and the timer count diagnosis process in the second step is interrupted. If a diagnostic permission signal is received again from the control unit, And a sixth step of restarting the two timers by setting the data storage value as an initial value and restarting the timer count diagnosis process by the timer comparison unit.

  According to the present invention, the timer used as a counter until the elevator is stopped when the safety monitoring function is executed and the elevator abnormality is detected, the timer is set to the double system and the timer of the double system is set. It has a function of diagnosing the soundness of the timer itself by comparing the count values with each other. When it is determined that the timer itself is abnormal, the car can be stopped. As a result, when performing safety control using a timer, an elevator safety control device that ensures soundness and availability can be obtained.

1 is an overall configuration diagram including an elevator safety control device according to Embodiment 1 of the present invention. It is a flowchart which shows a series of operation | movement of the timer process performed by the safety control apparatus in Embodiment 1 of this invention. It is a flowchart which shows a series of operation | movement of the timer diagnostic process performed by the safety control apparatus in Embodiment 1 of this invention. It is a whole block diagram including the elevator safety control apparatus in Embodiment 2 of this invention.

  Hereinafter, preferred embodiments of an elevator safety control device and an elevator safety control method of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
FIG. 1 is an overall configuration diagram including an elevator safety control device according to Embodiment 1 of the present invention. The safety control device 10 according to the first embodiment includes a duplexed first CPU (Central Processing Unit) 1 and second CPU 2. Although not shown, each of the first CPU 1 and the second CPU 2 has a ROM (Read Only).
Memory), RAM (Random Access Memory), clock, watchdog timer, bus, and the like.

  The first CPU 1 and the second CPU 2 are connected via a communication line, and perform failure diagnosis of the CPU by comparing the calculation results with each other. The safety control device 10 executes a safety control function, a self-diagnosis function, and a timer diagnosis function by software installed in each of the first CPU 1 and the second CPU 2.

  Each of the first CPU 1 and the second CPU 2 receives the signal from the safety-related switch / sensor 11 connected by electric wiring and the signal from the external safety control device 12 connected by the communication line, and monitors the state of the elevator. . The output from the safety control device 10 via the output interfaces 3 and 4 is connected to the power supply (power supply circuit) of the hoisting machine 14 and the brake 15 directly or through the safety circuit 13 of the elevator.

  When it is determined that the elevator is in the normal state, the safety control device 10 outputs a signal for connecting the power sources of the hoisting machine 14 and the brake 15 via the output interfaces 3 and 4. Specifically, the safety control device 10 performs an output for turning on a relay or a switching element, for example, an optical coupler or a MOSFET (metal-oxide-semiconductor field-effect transistor).

  On the other hand, when it is determined that it is not in a safe state, the safety control device 10 outputs a signal for shutting off the power supply of the hoisting machine 14 and the brake 15 via the output interfaces 3 and 4. Specifically, the safety control device 10 performs an output for turning off the relay or the switching element.

  The operation control device 16 controls the hoisting machine power source (inverter) connected to the hoisting machine 14, thereby rotating the hoisting machine and moving the car. Although not shown, the brake power supply control device controls the brake power supply (DC-DC converter) to cause a current to flow through the brake coil and lift the electromagnetic brake to release the brake. The operation control device 16 and the safety control device 10 are connected via a communication line.

  The safety control device 10 normally drives an insulating element (for example, an optical coupler) between the operation control device 16 and the hoisting machine power supply and an insulating element between the brake power supply control device and the brake power supply. The switching element connected to the power source is turned on via the output interfaces 3 and 4 so that the hoisting machine 14 and the brake 15 can be operated.

  The safety control device 10 receives a signal from an external safety-related switch / sensor 11 or an external safety control device 12. When the safety control device 10 detects that the elevator is not in a safe state based on these received signals, the safety control device 10 turns off the switching element. By turning off the switching element in this way, the safety control device 10 shuts off the power supply of the insulating element and shuts off the command of the operation control device 16 and the brake power supply device from reaching the hoisting machine power supply and the brake power supply. To do. As a result, the hoisting machine stops rotating, the brake current is prevented from being generated, the brake is applied, and the car is stopped.

  FIG. 2 is a flowchart showing a series of timer processing operations executed by safety control device 10 according to the first embodiment of the present invention. More specifically, the series of processes shown in FIG. 2 is performed independently for each timer by the first CPU 1 and the second CPU 2 in the safety control device 10.

  When the safety control device 10 detects an abnormality, the safety control device 10 outputs a nearest floor stop command for stopping the car to the nearest floor to the operation control device 16 (step S201). The safety control device 10 initializes the timer counter to 0 simultaneously with the output of the nearest floor stop command (step S202), and updates the timer counter by a CPU timer interrupt sufficiently shorter than the periodic processing or the timer time limit. (Step S203).

  When the timer counter exceeds a preset time limit determination value (for example, 5 minutes) (step S204), the safety control device 10 turns off the output via the output interfaces 3 and 4 so as to wind up. The power supply to the machine 14 and the brake 15 is cut off, and the car is emergency stopped (step S205). Furthermore, the safety control device 10 instructs the operation control device 16 to stop the service (step S206), and ends the series of processes.

  Next, FIG. 3 is a flowchart showing a series of operations of timer diagnosis processing executed by safety control device 10 in Embodiment 1 of the present invention. More specifically, the series of processes shown in FIG. 3 is performed independently for each timer while the first CPU 1 and the second CPU 2 in the safety control device 10 compare the processing results of the other and their own processing results. To be implemented.

  The safety control device 10 receives a timer diagnosis permission signal (floor) that is a signal that allows a certain time (for example, one day) to elapse from the previous timer diagnosis or that the operation control device 16 can perform a timer diagnosis while the floor is stopped. When receiving the floor stop signal), a timer diagnosis start signal is transmitted to inform the operation control device 16 that the timer diagnosis is started (step S300). After receiving the timer diagnosis start signal, the operation control device 16 returns a timer diagnosis permission signal to the safety control device 10 when the elevator is not operating (no call is made).

  The safety control device 10 proceeds to step S302 by receiving a timer diagnosis permission signal from the operation control device 16 (step S301). When the safety control device 10 cannot receive the timer diagnosis permission signal for a specified time, the safety control device 10 outputs an operation stop command to the operation control device 16 and performs the following diagnosis.

  When a certain time (for example, one day) has elapsed since the previous timer diagnosis, the safety control device 10 starts a timer diagnosis process (step S302).

[Diagnosis of output unit] (corresponding to the processing of step S301 to step S309)
First, when the timer counter reaches the time limit determination value, the safety control device 10 switches to the off state when the output interfaces 3 and 4 (referred to as output units in the following description) operate normally. Diagnose whether or not. Specifically, when the safety control device 10 determines that a certain time has elapsed since the previous diagnosis, the safety counter 10 subtracts the diagnosis time (for example, 1 second) from the preset time limit determination value. The value is set (step S303), and the timer operation is started (step S304).

  After the start of the timer operation, the safety control device 10 determines whether or not the diagnosis time has elapsed by determining whether or not the timer counter has reached the time limit determination value (step S305). If it is determined that the diagnosis time has elapsed, the safety control device 10 confirms whether or not the output unit has been switched off by reading the state of the output interfaces 3 and 4 (step S306). .

  As a result of the determination in step S306, if the output unit is not in the off state, the safety control device 10 determines that the output unit is not operating normally and has detected a failure (step S307), and the hoisting machine 14 And the signal which turns on the power supply of the brake 15 is set to an output-off state (step S308), an elevator service stop instruction is output to the operation control device 16 (step S309), and the series of processes ends.

  By such processing, the safety control device 10 can diagnose whether or not the operation of the output unit is normal in a short diagnosis time (1 second in the above example), and further the operation of the output unit. Is diagnosed as abnormal, the output interfaces 3 and 4 are turned off again in order to shut off the power to the hoisting machine 14 and the brake 15, and an elevator service stop instruction is sent to the operation control device 16. Can be output.

  In the previous step S302, when a certain time (for example, one day) has not elapsed since the previous timer diagnosis, the diagnosis of the output unit in steps S303 to S306 is omitted, and the steps after step S310 to be described next are omitted. You may transfer to the diagnosis of the timer count unit.

  In addition, as a result of the determination in the previous step S306, even when the output unit is in an off state and the operation of the output interface is normal, the process proceeds to the diagnosis of the timer count unit in step S310 and subsequent steps described below. Become.

[Diagnosis of timer count unit] (corresponding to processing after step S310)
Next, the safety control device 10 diagnoses the timer count unit. Specifically, the safety control device 10 performs diagnosis of the timer counter unit by comparing the count values of the first CPU 1 and the second CPU 2.

  First, both the first CPU 1 and the second CPU 2 in the safety control device 10 set the timer counter to the counter stored value (initially 0) (step S310) and start the respective timer operations constituting the dual system. (Step S311). And 1st CPU1 and 2nd CPU2 update a timer counter for every period, and compare the timer count value of own CPU with the timer counter value of the other CPU (step S312).

  As a result of the comparison in step S312, if the difference between the timer counter values is equal to or greater than a certain value, the first CPU 1 and the second CPU 2 determine that a timer failure due to the count abnormality has been detected, stop the timer, and explain earlier. Steps S307 to S309 are executed, and the series of processes ends.

  On the other hand, if the difference between the timer counter values is less than a certain value as a result of the comparison in step S312, the first CPU 1 and the second CPU 2 proceed to step 313 and determine whether the timer counter value is less than the time limit determination value. . Thereafter, the processes in steps S312 and S313 are repeated until the timer counter value reaches the time limit determination value. When the difference between the timer counter values continues to be less than a constant value and the timer counter value becomes the time limit determination value, the safety control device 10 determines that the timer counter operation is normal, The timer is stopped (step S314), the counter stored value is set to 0 (step S315), and the process proceeds to step S319 described later.

  On the other hand, if a call (service request) enters the elevator before the timer counter value reaches the time limit determination value, the operation control device 16 transmits a timer diagnosis stop request signal to the safety control device 10. Then, the safety control device 10 receives the timer diagnosis stop request signal, thereby determining that there is a service request before the timer counter value reaches the time limit determination value (step S316), and proceeds to the processing after step S317.

  Then, the safety control device 10 stops the timer (step S317), stores the timer counter value at that time in the counter storage value (step S318), and proceeds to the process of step S319.

  Finally, the safety control apparatus 10 ends the timer diagnosis after the process of the previous step S315, interrupts the timer diagnosis after the process of the previous step S318, and performs a timer diagnosis for the operation control apparatus 16. An end signal is transmitted (step S319), and the series of processes ends. When the operation control device 16 receives the timer diagnosis completion signal, the operation control device 16 resumes the elevator service.

  After that, when a timer diagnosis permission signal is received from the operation control device 16, each of the first CPU 1 and the second CPU 2 performs [diagnosis of the output unit] if a predetermined time has elapsed since the previous timer diagnosis, Thereafter, the counter stored value is set as the timer counter value, and [diagnosis of the timer count unit] is restarted.

  After that, when a timer diagnosis permission signal is received from the operation control device 16, each of the first CPU 1 and the second CPU 2 performs [diagnosis of the output unit] if a predetermined time has not elapsed since the previous timer diagnosis. Without setting, the counter stored value is set in the timer counter value, and [diagnosis of the timer count unit] is restarted.

  By performing such processing, the [diagnosis of the output unit] can be performed in a short time at regular intervals, and the [diagnosis of the timer count unit] can be performed in a timer diagnosis by utilizing the stored count value. For each state in which the permission signal is being received, it is possible to resume from the previous diagnosis and continue the diagnosis.

If an abnormality is detected in either the first CPU 1 or the second CPU 2 as a result of the timer diagnosis including the [diagnosis of the output unit] and [diagnosis of the timer count unit], the first CPU 1 and the second CPU 2 Each of the 2CPUs 2 performs the following processing.
Notify the other CPU of abnormality detection.
-Turn off the output of at least one system (CPU), shut off the hoisting machine power and brake power, and stop the car.
A service stop request (abnormality detection signal) is transmitted to the operation control device 16.

  The operation control device 16 stops the service when receiving the service stop request (abnormality detection signal). If the service is already stopped, the service stop is continued.

  As a safety monitoring function provided in the safety control device 10, in addition to the timer diagnosis function, there are the following.

[Open door running prevention function]
Each door switch that detects the opening and closing of the car door and the landing door, and the signal of the landing sensor that detects that the car is in the landing zone, are used as inputs to indicate that the car has been removed from the landing zone while the door is open. A function to detect and emergency stop.

[Maintenance personnel protection function]
A function that inputs the signal of each door switch that detects the opening and closing of the car door and the landing door, and instructs the operation control device to invalidate the automatic operation when the opening of the door is detected by the maintenance staff.

[Emergency electric operation function]
A function that disables signals from some switches during operation such as rescue of passengers when confinement occurs, using signals from switches that monitor the movement of the car and signals from operation signals by maintenance personnel as input.

[Door switch bypass operation function]
A function that disables the signal from the door switch when inspecting the door switch, with each door switch that detects the opening and closing of the car door and the landing door as well as each signal from the operation signal from the maintenance staff.

[Terminal floor forced deceleration function]
A function that makes an emergency stop when an overspeed of the car is detected by inputting each signal from the switch installed in the hoistway that detects the movement of the car, the encoder attached to the speed governor or the hoisting machine.

  As another function, it is possible to include a function of monitoring the state of the elevator and performing an emergency stop when it is determined that the elevator is not in a safe state. When the safety control device detects an abnormal state of the elevator by these safety monitoring functions other than the timer diagnosis function, the safety control device executes the series of processes shown in FIG.

  Further, the safety control device executes diagnosis related to the timer used in the series of processes shown in FIG. 2 by the series of processes shown in FIG.

  Note that any of the functions described above may be implemented in either the safety control device or the external safety control device.

  As described above, according to the first embodiment, the reliability of the timer function at the time of abnormality detection of the elevator safety control device is ensured by providing the timer diagnosis function including the diagnosis of the output unit and the diagnosis of the timer count unit. be able to.

  Furthermore, the diagnosis of the output unit can be performed in a short time at regular intervals, and the diagnosis of the timer count unit can be continuously performed over a plurality of time zones in which the timer diagnosis can be performed. As a result, diagnosis can be performed reliably without impairing serviceability, the soundness and availability of the elevator safety control device can be ensured, and abnormality of the timer necessary for safety control can be detected quickly. it can.

Embodiment 2. FIG.
FIG. 4 is an overall configuration diagram including an elevator safety control device according to Embodiment 2 of the present invention. Compared with the configuration of FIG. 1 in the first embodiment, the safety control device 10 in the second embodiment is provided with a timer 5, a timer 6, and a timer comparison unit 7 outside the first CPU 1 and the second CPU 2. The point is different. Therefore, the following description will be focused on such a difference in configuration.

  As shown in FIG. 4, in the safety control device 10 according to the second embodiment, two timers 5 and 6 and a clock (not shown) are installed outside the first CPU 1 and the second CPU 2. The timers 5 and 6 are composed of a logic circuit having a counter and a comparator, and perform a counting operation by counting clock pulses.

  The timer 5 starts / stops the counting operation according to a command from the first CPU 1, the timer counter value is set, and when the timer expires, the output unit is turned off to supply power to the hoisting machine 14 and the brake 15. The supply can be shut off.

  Similarly, the timer 6 starts / stops the counting operation according to a command from the second CPU 2, the timer counter value is set, and when the timer expires, the output unit is turned off, so that the winding machine 14 and the brake 15 can be turned off. The power supply can be cut off.

  The timer 5 and the timer 6 can be realized by, for example, CPLD (Complex Programmable Logic Device) or FPGA (Field-programmable gate array).

  A timer comparison unit 7 is provided between the two timers 5 and 6 and compares the timer counter values of the two timers 5 and 6. When the difference between the timer count values of the two timers 5 and 6 is greater than a certain value and an abnormality is detected, the timer comparison unit 7 detects the abnormality with respect to the first CPU 1 and the second CPU 2 or the output interfaces 3 and 4. Thus, by outputting an abnormality detection signal and turning off the output unit, the power supply to the hoisting machine 14 and the brake 15 is cut off, and the car is stopped.

  Other configurations and processes are the same as those in the first embodiment, and a description thereof will be omitted.

  As described above, according to the second embodiment, the soundness and availability of the elevator safety control device can be ensured also by the configuration as shown in FIG. 4 as in the first embodiment. Furthermore, it is possible to quickly detect an abnormality in a timer necessary for safety control.

  In the above-described first and second embodiments, the configuration in which two CPUs are provided and individual timers corresponding to the respective CPUs are described. However, the subject matter of the present invention is to diagnose a plurality of timer operations, and the number of CPUs may be one.

  In the above-described first and second embodiments, the configuration for diagnosing two duplicated timers has been described. However, the diagnostic method of the present invention is also applied when the number of timers is three or more. It is possible.

Claims (4)

An input for reading a monitoring signal from a switch or sensor for monitoring the state of the elevator;
At least one arithmetic processing unit that executes a safety monitoring function based on the monitoring signal read through the input unit;
A timer provided independently of the arithmetic processing unit or provided inside the arithmetic processing unit;
An output unit that outputs a signal that shuts off power supplied to each of the elevator hoist and the brake, and the arithmetic processing unit is configured to output the safety signal based on the monitoring signal read through the input unit. When the abnormality of the elevator is detected by executing a monitoring function, the timer is started, and the signal for shutting off the power source is output from the output unit at the time limit of the timer, and the hoisting machine and An elevator safety control device that stops the car by shutting off the power supplied to the brake,
A timer comparison unit that is provided independently of the arithmetic processing unit or provided in the arithmetic processing unit and that executes a timer count diagnosis process;
The timer is composed of two independent timers activated as a double system,
The timer comparison unit compares the count values of the two timers that have been started, and when the difference between the count values of the two timers is equal to or greater than a predetermined difference value set in advance, It is determined that at least one count abnormality has occurred, and the timer is diagnosed by stopping the car ,
The arithmetic processing unit
When the diagnosis permission signal is received from the operation control device as a response to the diagnosis control signal transmitted to the operation control device that performs overall control of the elevator operation, the two timers are started and the timer comparison unit The timer count diagnosis process is executed,
If the timer comparison unit does not determine that the count abnormality has occurred until the respective timer count values reach the timer time limit, the two timers are determined to be normal; Terminate the timer count diagnosis process,
If the timer comparison unit determines that the count abnormality has occurred before the respective timer count values reach the timer time limit, at least one of the two timers is abnormal. And stop the car,
When a service request generation signal is received from the operation control device during execution of the timer count diagnosis process, the timer count diagnosis process by the timer comparison unit is interrupted and the count value up to the present time is stored as a counter stored value. Remember as
If the diagnosis permission signal is received again from the operation control device while the timer count diagnosis process is interrupted, the counter stored value is set as an initial value, the two timers are restarted, and the timer comparison is performed. An elevator safety control device for resuming the timer count diagnosis process by the unit. The arithmetic processing unit includes:
When the diagnosis permission signal is received from the operation control device, the two timers are started by setting the latest value of the time limit as an initial value, and the signal of the output unit is read after the time limit has passed, The elevator safety control device according to claim 1 , wherein the elevator safety control device confirms that the power supplied to the hoisting machine and the brake can be cut off. The arithmetic processing unit sets a time required for stopping the car to the destination floor or the nearest floor as a time limit of the timer, and executes the safety monitoring function based on the signal read through the input unit The elevator according to claim 1 or 2 , wherein when an abnormality of the elevator is detected, a stop command is output to the operation control device in order to stop the car at the destination floor or the nearest floor. Safety control device. An input for reading a monitoring signal from a switch or sensor for monitoring the state of the elevator;
At least one arithmetic processing unit that executes a safety monitoring function based on the monitoring signal read through the input unit;
Two independent timers that are provided independently of the arithmetic processing unit, or are provided inside the arithmetic processing unit and are activated as a dual system;
An output unit for outputting a signal for shutting off the power supplied to each of the elevator hoist and the brake;
An elevator safety control method executed by an elevator safety control device provided independently of the arithmetic processing unit or provided inside the arithmetic processing unit and including a timer comparison unit that executes a timer count diagnosis process. And
In the arithmetic processing unit, when a diagnosis permission signal is received from the operation control device as a response to a diagnosis start signal transmitted to the operation control device that performs overall control of the elevator operation, the two timers are started. A first step of
In the timer comparison unit, after the two timers are started in the first step, the count values of the two timers are compared with each other, and the difference between the count values of the two timers is equal to or greater than a predetermined difference value set in advance. If it becomes, a second step of executing the timer count diagnosis process by determining that a count abnormality has occurred in at least one of the two timers;
In the arithmetic processing unit, when it is not determined that the count abnormality has occurred by the second step by the timer comparison unit until the respective count values of the two timers reach the timer time limit, A third step of determining that the two timers are normal and ending the timer count diagnosis process in the second step;
In the arithmetic processing unit, when it is determined that the count abnormality has occurred in the second step by the timer comparison unit until the respective count values of the two timers reach the timer time limit, A fourth step of stopping the car;
During the execution of the timer count diagnosis process according to the second step, when the service processor receives a service request generation signal from the operation control device, the timer count diagnosis process according to the second step is interrupted. And a fifth step of storing the count value up to the present time as a counter storage value;
During the interruption of the timer count diagnosis process in the second step, when the diagnosis processing permission signal is received again from the operation control unit in the arithmetic processing unit, the counter stored value is set as an initial value and the An elevator safety control method comprising: a sixth step of restarting two timers and restarting the timer count diagnosis process by the timer comparison unit.

Images