JP7003217B2 - Elevator safety control device - Google Patents

Description

The present invention relates to an elevator safety control device that controls the operation of an elevator having a plurality of safety control functions.

In recent years, various safety control functions have been introduced into elevators. Specific examples of the safety control function include the following.
・ End floor forced deceleration function (SETS)
・ Door open running protection function (UCMP)
・ Self-diagnosis function (DIAG)
・ Inter-system communication function (ICOM)

On the other hand, specific examples of the non-safety control function include the following.
-Data logging function (DLOG)
・ Interface function with elevator operation control device (CCIF)

The scope of application of the safety control function as described above is expected to expand further in the future. When implementing each of these safety control functions, a plurality of boards or devices must be prepared for each safety function. Therefore, the cost of the device and the labor of installing and maintaining the device increase.

Therefore, in order to solve this problem, a method of mounting a plurality of safety control functions on one board or one device has been proposed (see, for example, Patent Document 1).

When multiple safety control functions are mounted on one board or one device, each control function is independent so that the application of the safety control function or the application of the non-safety control function does not affect the other safety control functions. It is necessary to ensure sex.

Therefore, there is a prior art technique in which an application related to a safety control function is made independent from an application related to a non-safety control function by task scheduling using time partitioning (see, for example, Patent Document 2). Each time partition has a fixed size every cycle, and tasks are scheduled from the task group determined by each partition.

In the example of FIG. 1 in Patent Document 2, the time partition TP1 has the task ST1 of the safety control function, the time partition TP2 has the task ST2 of the safety control function, and the time partition TP3 has the tasks NST1 and NST2 of the non-safety control function. Each is scheduled. The scheduling method within each TP is free. However, in order to ensure independence, the task of the application related to the safety control function and the task of the application related to the non-safety control function cannot be mixed in the same TP.

Japanese Patent No. 550718 Japanese Unexamined Patent Publication No. 2010-271759 International Publication No. 2011/158301 Japanese Unexamined Patent Publication No. 2003-104646

However, the prior art has the following problems.
In the time partitioning used in Patent Document 2, each cycle is divided into partitions of a fixed size, and the tasks of a fixed type of application are scheduled within the divided partitions. The time required to complete the processing of the application varies depending on factors such as conditional branching and bus conflict. Therefore, the partition size needs to be set in consideration of the worst execution time of each application.

Here, the worst execution time refers to the worst case time that takes the longest time to complete the process. Therefore, in Patent Document 2, each partition is set to be large in consideration of the worst execution time, and when the task is completed early, free time is generated in the partition.

However, in order to ensure independence, the tasks of the application related to the safety control function and the tasks of the application related to the non-safety control function must be scheduled in different partitions.

Therefore, even if the partition assigned to the application related to the safety control function becomes free, the task of the application related to the non-safety control function cannot be assigned to the free time. As a result, the time partitioning used in Patent Document 2 has a problem that the utilization efficiency of the CPU cannot be improved.

The present invention has been made to solve the above-mentioned problems, and realizes efficient task scheduling while ensuring independence between the task of the safety control function and the task of the non-safety control function. The purpose is to obtain an elevator safety control device.

The elevator safety control device according to the present invention stores a plurality of safety control functions and a plurality of non-safety control functions as independent programs, and for each control cycle when the plurality of safety control functions are executed in each control cycle. An elevator that stores safety scheduling information whose scheduling and execution order are predetermined, and sequentially executes each program corresponding to multiple safety control functions and multiple non-safety control functions according to the safety scheduling information. In each control cycle, the CPU continuously executes the safety control functions in the execution order specified as the safety scheduling information without any free time, and is assigned within the control cycle. A plurality of non-safety control functions are executed in the free time within the control cycle after all the safety control functions are executed.

According to the present invention, the task of the safety control function is preferentially executed, the free time after the execution of the safety control function is completed is summarized after each control cycle, and the free time is used for the non-safety control function. Has a configuration that can be executed. As a result, it is possible to obtain an elevator safety control device that realizes efficient task scheduling while ensuring independence between the task of the safety control function and the task of the non-safety control function.

It is a block diagram of the elevator safety control device in Embodiment 1 of this invention. It is a figure for demonstrating the task processing content which is executed in the 1st control cycle based on the safety scheduling information and the non-safety scheduling information in the logic part and the independence guarantee part which concerns on Embodiment 1 of this invention. It is a figure for demonstrating the task processing content which is executed in the 2nd control cycle based on the safety scheduling information and the unsafe scheduling information in the logic part and the independence guarantee part which concerns on Embodiment 1 of this invention. It is a flowchart which summarized a series of task processing executed by the logic part and the independence guarantee part which concerns on Embodiment 1 of this invention. It is a figure which showed the modification of the safety scheduling information and non-safety scheduling information which concerns on Embodiment 1 of this invention. It is a figure for demonstrating the error processing when the interruption processing occurs while executing the task of a safety control function in Embodiment 1 of this invention. It is a figure for demonstrating the operation of the modification 5 in Embodiment 1 of this invention. It is a figure for demonstrating the operation of the modification 5 in Embodiment 1 of this invention. It is a figure for demonstrating the operation of the modification 6 in Embodiment 1 of this invention. It is a figure for demonstrating the operation of the modification 6 in Embodiment 1 of this invention. It is a figure for demonstrating the operation of the modification 6 in Embodiment 1 of this invention. It is an overall block diagram of the elevator system to which the elevator safety control device which concerns on Embodiment 2 of this invention is applied. It is a block diagram which showed the internal structure of the elevator safety monitoring apparatus in Embodiment 2 of this invention in detail. It is a block diagram common to the 1st safety monitoring system and the 2nd safety monitoring system in Embodiment 2 of this invention. In the second embodiment of the present invention, it is an execution time chart corresponding to an execution plan according to the safe scheduling information and the unsafe scheduling information. It is an execution time chart when the task process by Embodiment 2 of this invention is executed. It is an execution time chart when the task processing by the prior art is executed.

Hereinafter, preferred embodiments of the elevator safety control device of the present invention will be described with reference to the drawings.

Embodiment 1.
First of all, as terms used in the description of the present invention, "task", "specified time", "control cycle", "safe scheduling information", "unsafe scheduling information", "task interruption", "task end" Table 1 summarizes the explanation of the meaning and contents of the above.

FIG. 1 is a configuration diagram of an elevator safety control device according to the first embodiment of the present invention. The elevator safety control device according to the first embodiment includes an input unit 10, a logic unit 20, and an independence guarantee unit 30. The CPU 21 in the logic unit 20 acquires a signal related to the elevator status as an input value, and reads the program 40, the safety scheduling information 50, and the unsafe scheduling information 60.

Here, the program 40, the safety scheduling information 50, and the unsafe scheduling information 60 correspond to the data stored in the storage unit, and the CPU 21 in the logic unit 20 refers to these data and is necessary for the elevator control. Processing will be executed.

The program 40 has a plurality of safety control function tasks 41 and a plurality of non-safety control function tasks 42.

The safety scheduling information 50 is scheduling information that defines in which control cycle and in what order the tasks 41 of the plurality of safety control functions should be executed. Specifically, the safety scheduling information 50 is defined with the execution order of each task of the safety control function, the specified time of the task, and the final flag indicating that it is the final safety task to be executed at the end of each control cycle. Information.

In the specific example of the safety scheduling information 50 shown in FIG. 1, the tasks ST1 and ST2 of the safety control function are executed in order in the first control cycle, and the tasks ST1 and ST3 of the safety control function are executed in order in the next control cycle. At the same time, it is defined that each of the tasks ST1, ST2, and ST3 is monitored at the specified time T1, T2, and T3.

The unsafe scheduling information 60 is scheduling information that defines the execution order of the tasks 42 of the plurality of unsafe control functions. Specifically, the unsafe scheduling information 60 is information that does not depend on the control cycle and only defines in what order each task of the unsafe control function should be executed.

In the specific example of the unsafe scheduling information 60 shown in FIG. 1, it is defined that the tasks NST1, NST2, NST3, and NST1 of the unsafe control function should be executed in this order.

Then, the CPU 21 in the logic unit 20 uses the input value to have a plurality of safety control functions whose scheduling is defined by the safety scheduling information 50 and a plurality of unsafe control functions whose scheduling is defined by the unsafe scheduling information 60. Are sequentially executed as independent programs 40, thereby performing the control calculation of the elevator.

Further, the CPU 21 in the logic unit 20 holds the execution state information of each program 40, which is executed independently, in the context block 70, and reads the execution state information as needed. can. Here, the context block 70 corresponds to literate data stored in the storage unit.

The independence guarantee unit 30 controls all the control functions including the task 41 of the plurality of safety control functions and the task 42 of the plurality of non-safety control functions so that one control function does not affect the other control functions. Guarantee independence between functions. The independence guarantee unit 30 is configured to include a specified time timer 31 for monitoring the elapsed status of a specified time, a control cycle timer 32 for monitoring the elapsed status of a control period, and a memory protection function 33.

The present invention is a result of the logic unit 20 and the independence guarantee unit 30 interlocking to sequentially execute each task defined by the safety scheduling information 50 and the unsafe scheduling information 60 as independent programs 40. Therefore, the technical feature is that the free time during which the task 41 of the safety control function is not executed can be summarized after each control cycle.

And, unlike the conventional method, this free time is independent of the safety control function. Therefore, the task 42 of the unsafe control function whose execution order is defined by the unsafe scheduling information 60 can be sequentially assigned to the free time of each control cycle. As a result, the present invention can measure the improvement in the utilization efficiency of the CPU 21 as compared with the conventional method.

Therefore, next, the specific operation of the task processing executed by the logic unit 20 and the independence guarantee unit 30 according to the first embodiment will be described in detail with reference to FIGS. 2A, 2B, and 3. FIG. 2A shows the task processing contents executed in the first control cycle based on the safety scheduling information 50 and the unsafe scheduling information 60 in the logic unit 20 and the independence guarantee unit 30 according to the first embodiment of the present invention. It is a figure for demonstrating. Further, FIG. 2B shows a task process executed in the second control cycle based on the safety scheduling information 50 and the unsafe scheduling information 60 in the logic unit 20 and the independence guarantee unit 30 according to the first embodiment of the present invention. It is a figure for demonstrating the content.

In FIG. 2A, the first control cycle is shown as a period from time t0 to time t3, and in FIG. 2B, the second control cycle is shown as a period from time t3 to time t6. 2A and 2B exemplify the task processing results executed by the logic unit 20 and the independence guarantee unit 30 according to the safety scheduling information 50 and the non-safety scheduling information 60 shown in FIG. There is.

First, in the first control cycle shown in FIG. 2A, the tasks ST1 and ST2 of the safety control function are continuously and sequentially executed without any free time according to the safety scheduling information 50. Further, in the free time after the tasks ST1 and ST2 of the safety control function are executed, the tasks NST1, NST2 and NST3 of the non-safety control function are continuously executed in sequence according to the non-safety scheduling information 60.

More specifically, at time t1, the processing of task ST1 is completed before the predetermined time T1 set for task ST1 elapses. Therefore, the CPU 21 starts the processing of the task ST2 at the time t1 before the interruption by the specified time timer 31 in the independence guarantee unit 30 occurs.

The time t2 corresponds to the time after the specified time T2 has elapsed from the time t1. At time t2, the CPU 21 receives an interruption by the specified time timer 31 in a state where the task ST2 is not completed, and interrupts the processing of the task ST2.

The period from time t2 to time t3 corresponds to the free time after processing the tasks ST1 and ST2 in the first control cycle. Therefore, the CPU 21 sequentially executes the tasks NST1, NST2, and NST3 of the unsafe control function according to the unsafe scheduling information 60. However, at the end time t3 of the first control cycle, an interrupt by the control cycle timer 32 occurs in a state where the processing of the task NST3 is not completed. Therefore, in the task NST3, the processing after the interruption is restarted in the free time of the second control cycle described later.

Next, in the second control cycle shown in FIG. 2B, the tasks ST1 and ST3 of the safety control function are continuously and sequentially executed without free time according to the safety scheduling information 50. Further, in the free time after the tasks ST1 and ST3 of the safety control function are executed, the tasks of the non-safety control function are continuously and sequentially executed according to the non-safety scheduling information 60. As described above, the task NST3 is interrupted in the first control cycle. Therefore, in the free time in the second control cycle, the process of the task NST3 is restarted, and then the task NST1 is executed according to the unsafe scheduling information 60.

More specifically, the time t4 corresponds to the time when the specified time T1 has elapsed from the time t3. Therefore, at time t4, the CPU 21 is interrupted by the specified time timer 31 in a state where the task ST1 is not completed, and interrupts the processing of the task ST1. Then, the CPU 21 starts the process of the task ST3 at the time t4.

At time t5, the processing of task ST3 is completed before the specified time T3 set for task ST3 elapses. The period from time t5 to time t6 corresponds to the free time after processing the tasks ST1 and ST3 in the second control cycle. Therefore, the CPU 21 restarts the continuation processing of the task NST3 at the time t5 before the interruption by the specified time timer 31 in the independence guarantee unit 30 occurs.

However, at the end time t6 of the second control cycle, an interrupt by the control cycle timer 32 occurs in a state where the processing of the task NST1 is not completed. Therefore, in the free time of the third control cycle, the task NST1 resumes the processing after the interruption.

FIG. 3 is a flowchart summarizing a series of task processes executed by the logic unit 20 and the independence guarantee unit 30 according to the first embodiment of the present invention. In the following description, the flowchart of FIG. 3 will be described based on the specific task scheduling shown in FIGS. 1 and 2.

After making the initial settings in step S301, the logic unit 20 assigns the first task ST1 of the tasks of the safety control function in the first control cycle based on the safety scheduling information 50 in step S302.

Next, in step S303, the logic unit 20 performs the task before the specified time T1 assigned to the task ST1 elapses, that is, before the interrupt occurs by the specified time timer 31 in the independence guarantee unit 30. It is determined whether the end processing of ST1 has been executed. In step S303, the logic unit 20 proceeds to step S305 if it is determined to be Yes, and proceeds to step S304 if it is determined to be No.

When the process proceeds to step S304, the logic unit 20 interrupts the task ST1 due to the interruption by the specified time timer 31, and proceeds to step S305.

When the process proceeds to step S305, the logic unit 20 determines based on the final flag whether or not there are still tasks of the safety control function to be executed in the first control cycle. In step S303, the logic unit 20 proceeds to step S302 if it is determined to be Yes, and proceeds to step S306 if it is determined to be No.

In the example shown in FIGS. 1 and 2, it is necessary to process the task ST2 after the task ST1 of the safety control function in the first control cycle. Therefore, with respect to task ST2, after performing the processes of steps S302 to S305, the process proceeds to step S306.

In the processing after step S306, the logic unit 20 and the independence guarantee unit 30 sequentially execute the tasks of the non-safety control function in the free time after executing the tasks ST1 and ST2 of the safety control function in the first control cycle. Will be done.

In step S306, the logic unit 20 determines whether or not there is a task of the unsafe control function to be executed in the free time in the first control cycle based on the unsafe scheduling information 60. In step S306, the logic unit 20 proceeds to step S307 if it is determined to be Yes, and proceeds to step S310 if it is determined to be No.

If the process proceeds to step S307, the logic unit 20 allocates the first task NST1 among the tasks of the unsafe control function based on the unsafe scheduling information 60.

Next, in step S308, the logic unit 20 executes the end processing of the task NST1 before the control cycle ends, that is, before the interrupt occurs by the control cycle timer 32 in the independence guarantee unit 30. Is determined. In step S308, the logic unit 20 proceeds to step S306 if it is determined to be Yes, and proceeds to step S309 if it is determined to be No.

In the example shown in FIGS. 1 and 2, as the unsafe scheduling information 60, task NST2, task NST3, task NST1, ... Are set after task NST1. Therefore, the logic unit 20 continuously performs the tasks of the unsafe control function set as the unsafe scheduling information 60 by repeating the processes of steps S306 to S308 until the interrupt by the control cycle timer 32 is received. Will be executed sequentially.

When the process proceeds to step S309, the logic unit 20 interrupts the task of the unsafe control function currently being executed due to the interruption by the control cycle timer 32, and performs a series of processing of the first control cycle. After finishing, the process returns to step S302. In the example shown in FIGS. 1 and 2, the task NST3 is interrupted and the first control cycle is completed due to the interruption by the control cycle timer 32 while the task NST3 of the unsafe control function is being executed. It will be.

Further, when the process proceeds from the previous step S306 to step S310, the logic unit 20 waits until the interrupt by the control cycle timer 32 occurs because there is no task of the unsafe control function to be executed. Then, in step S311, the interruption by the control cycle timer 32 is generated, so that the series of processing of the first control cycle is completed and the process returns to step S302.

In the example shown in FIGS. 1 and 2, the safety scheduling information 50 stipulates that the tasks ST1 and ST3 of the safety function should be executed in the second control cycle. Therefore, when the process returns to step S302 after the series of processes in the first control cycle is completed, the task processes in the second control cycle are continuously and sequentially executed.

Next, some modifications for realizing the basic technical idea of arranging the free time in the latter half of the control cycle as described above will be described below.

[Modification 1]
A modification of the safe scheduling information 50 and the unsafe scheduling information 60 will be described. FIG. 4 is a diagram showing a modified example of the safe scheduling information and the non-safe scheduling information according to the first embodiment of the present invention.

The safety scheduling information 50 shown in FIG. 1 above was all composed of tasks of the safety control function. On the other hand, the safety scheduling information 50a shown in FIG. 4 is configured to include one or more tasks of the non-safety control function.

Specifically, the safety scheduling information 50a shown in FIG. 4 is specified to execute the task NST1 of the non-safety control function following the task ST1 of the safety control function in the first control cycle, and the second time. It is stipulated that the task NST2 of the non-safety control function is executed following the task ST1 of the safety control function in the control cycle. On the other hand, the non-safety scheduling information 60a shown in FIG. 4 is configured by the tasks NST3, NST4, and NST5 of other unsafety control mechanisms that are not incorporated in the safety scheduling information 50a, in which the execution order is defined.

In this way, by using the safety scheduling information 50a configured to include one or more tasks of the non-safety control function, it is possible to secure the real-time performance of the tasks NST1 and NST2 of the non-safety control function. ..

[Modification 2]
In the examples of FIGS. 1 and 4, the case where the execution order of the tasks of the unsafe control function is determined in advance by the unsafe scheduling information 60 has been described. However, the task of the non-safety control function does not necessarily have to be determined in advance, and it is possible to dynamically schedule each control cycle.

[Modification 3]
Among the tasks STn of the safety control function, an error processing may be performed when an interruption occurs for a task whose interruption cannot be tolerated. For example, in the example shown in FIGS. 1 and 2, consider the case where the task ST2 of the safety control function is a task that cannot be interrupted. FIG. 5 is a diagram for explaining error processing when an interruption process occurs while executing a task of a safety control function in the first embodiment of the present invention.

As shown in FIG. 5, the CPU 21 can execute error processing after the interruption by the specified time timer 31 occurs at the time t2. In order to handle such an error, it is necessary to identify in advance the tasks of the safety control function that cannot be interrupted. Therefore, in order to perform such identification, information indicating whether or not interruption is possible is associated with the task of each safety control function and stored as safety scheduling information 50, or stored in the context block 70. Can be considered.

[Modification 4]
The CPU 21 can also acquire the control cycle timer value from the control cycle timer 32 in real time and use it for arithmetic processing when each task is executed.

[Modification 5]
Using the concept of the modification 4, the CPU 21 can further measure the elapsed time of the task process over a plurality of control cycles by counting the number of elapsed control cycles. 6A and 6B are diagrams for explaining the operation of the modified example 5 in the first embodiment of the present invention.

At the time shown in [1] of FIG. 6A, the CPU 21 acquires the control cycle timer value ta from the control cycle timer 32 in the control cycle in which the control cycle elapsed number counter is N1. Further, at the time shown in [2] of FIG. 6B, the CPU 21 acquires the control cycle timer value tb from the control cycle timer 32 in the control cycle in which the control cycle elapsed number counter is N2. As a result, the CPU 21 can calculate the elapsed time from the time shown in [1] to the time shown in [2] by the following formula.
Elapsed time = (N2-N1) x T + (tb-ta)

[Modification 6]
Using the ideas of the modified example 4 and the modified example 5, the CPU 21 can avoid the interrupt when there is a task that the user does not want to be interrupted in a specific section. 7A to 7C are diagrams for explaining the operation of the modified example 6 in the first embodiment of the present invention.

In FIGS. 7A to 7C, task ST2 corresponds to a task that is not desired to be interrupted in a specific section. At the time shown in [1] of FIG. 7A, the CPU 21 reads the control cycle timer value ta from the control cycle timer 32 at the start of the task ST2. Then, after starting the execution of the task ST1, the CPU 21 reads the control cycle timer value tb from the control cycle timer 32 at the time indicated by [2] corresponding to the start of a specific section for which interrupts are not desired to be accepted.

Here, a specific section for which interruptions are not to be accepted can be specified in advance as a period ct assuming that the execution time has been the longest, and is set in the memory 22 corresponding to the internal memory. be able to.

Further, assuming that the specified period T2 of the task ST2 is td, the CPU 21 determines whether the condition of the following equation (1) is satisfied at the time shown in [2] of FIG. 7A.
td <tb-ta + tc (1)

If the condition of Eq. (1) is satisfied and the task ST2 is continuously executed after the time shown in [2], an interrupt by the specified cycle timer occurs in a specific section in which the interrupt is not to be accepted. It is expected that it will end up. Therefore, when the CPU 21 determines that the condition of the equation (1) is satisfied, the execution of the task ST2 is interrupted at the time shown in [2], and as shown in FIG. 7B, the task NST1 of the unsafe control function is interrupted. Starts executing.

Then, the CPU 21 executes the task ST1 in the second control cycle shown in FIG. 7C, and then resumes the execution of the suspended task ST2 in the time zone shown in [3]. As a result, it is possible to prevent the occurrence of interruption in a specific section of the task ST2 shown as the braided portion in FIGS. 7A and 7C.

When the CPU 21 executes the process of the specific section of the task ST2, the CPU 21 can take measures when an interrupt occurs in the specific section by performing the following process. The CPU 21 can execute flag processing in which a start flag is set when a specific section is started and an end flag is set when the processing of the specific section is completed.

By executing such flag processing, the CPU 21 sets the start flag and does not set the end flag when the interrupt of the specified time timer occurs after the start of a specific section. If it is determined that, it can be determined that an interruption has occurred in a specific section. Therefore, when the CPU 21 determines that an interrupt has occurred in a specific section, the CPU 21 can take measures such as executing a safe operation of the elevator, for example.

As described above, according to the task scheduling method according to the first embodiment, the free time during which the task of the safety control function is not executed can be summarized after each control cycle. As a result, the utilization efficiency of the CPU is improved, and efficient task scheduling can be realized while ensuring the independence between the task of the safety control function and the task of the non-safety control function.

Embodiment 2.
In the second embodiment, a case where the task scheduling method described in the first embodiment is applied to the specific configuration of the elevator system will be described.

Conventionally, a door-opening running protection device has been devised to ensure a safe state by suddenly stopping the car when the car runs abnormally with the car door or the landing door open (see, for example, Patent Document 3). ).

In addition, when the car runs out of control near the terminal floor, a terminal floor forced deceleration device has been devised that detects the car overspeed and activates the braking device to decelerate to a speed below a safe speed before a buffer collision (for example). See Patent Document 4).

These safety devices are required to have a high degree of reliability, and are implemented as an architecture such as an electronic safety device, for example. In such an architecture, the hardware cost tends to be high due to the duplication of equipment, etc., and it is desirable to implement as many safety functions as possible on the same hardware. As a means for realizing such a form, the above-mentioned Patent Document 2 discloses a mechanism in which a plurality of safety function programs can be reliably executed without interfering with each other.

On the other hand, it is desirable that these safety systems also have maintenance functions such as internal data logging and data output in order to improve maintainability. On the other hand, these maintenance functions are non-safety functions and have a lower execution priority than the safety functions. Therefore, in order to improve the throughput of the maintenance function without hindering the execution of the safety function, improve the time efficiency such that the non-safety function is executed by efficiently utilizing the time when the safety function is not executed. A mechanism is needed to make it work.

Therefore, the case where the method described in the first embodiment is applied to the elevator safety control device will be described in detail below.

FIG. 8 is an overall configuration diagram of an elevator system to which the elevator safety control device according to the second embodiment of the present invention is applied. The elevator system 200 shown in FIG. 8 includes an elevator mechanism unit 210, an elevator drive device 220, a brake device 230, an elevator safety circuit 240, an elevator operation control unit 250, and an elevator safety monitoring unit 260.

The elevator mechanism 210 includes a car 211, a weight 212, a sheave 213, a return wheel 214, a rope 215, and a hoistway device 216.

The car 211 and the weight 212 are connected by a rope 215, and the rope 215 is suspended by a sheave 213 and a return wheel 214.

The hoistway equipment 216 includes a landing door switch 216a, a car door switch 216b, a door zone plate 216c, a door zone sensor 216d, an end point switch cam 216e, an upper reference position switch 216f in the hoistway, and a lower reference position switch in the hoistway. It comprises 216 g, a governor sheave 216h, a governor rope 216i, and a governor encoder 216j.

The landing door switch 216a is installed at the landing and detects the door open state of the landing door. Further, the car door switch 216b is installed in the car and detects the door open state of the car door.

The door zone plate 216c is installed near the landing in the hoistway. The door zone sensor 216d installed in the car 211 detects that the car floor surface is within a predetermined distance from the landing floor surface by detecting the door zone plate 216c.

The upper reference position switch 216f is installed in the upper part of the hoistway, and the lower reference position switch 216g is installed in the lower part of the hoistway, and each has a roller connected and fixed to the switch contact. In the upper reference position switch 216f and the lower reference position switch 216g, the switch contacts are in the detection state when the rollers are pushed by the end point switch cam 216e fixed to the car. Therefore, the upper reference position switch 216f and the lower reference position switch 216g can detect that the car is in the specified position in the hoistway.

The governor sheave 216h is rotated by a governor rope 216i connected and fixed to the car 211. The governor encoder 216j detects the rotation of the governor sheave 216h and detects the amount of movement of the car.

The elevator drive device 220 includes a commercial power supply 221 and an inverter 222, a motor 223, and a main contact 224 of the main circuit contactor # MC that cuts off the power supply from the commercial power supply 221 to the inverter 222. The inverter 222 rotates the motor 223 to drive the sheave 213 based on a command from the elevator operation control device (CC) 251 described later.

The brake device 230 includes first and second brake shoes 231 that come into contact with the rope wheel 213 and apply braking torque by friction, first and second brake coils 232 that suck and drop the brake shoes, and an elevator operation control device (CC). It includes first and second brake choppers 233 that control the current of the brake coil by a command from 251 and a main contact 234 of a brake circuit relay (#BK) that cuts off the power supply from the brake power supply to the brake coil 232.

The elevator safety circuit 240 is configured by connecting the main contacts of the safety relays # SF1 and #SF2 and other safety switch contacts in series to the control power supply. By the final output when all the contacts in the elevator safety circuit 240 are turned on, electric power for driving the contactor / relay is supplied to the primary side of the #MC and #BK coils.

The elevator operation control unit 250 inputs commands from the elevator operation control device (CC) 251, #MC, and #BK coils, and the elevator operation control device (CC) 251 to turn on / off the power supply to each coil. The switch semiconductor 252 is provided.

The elevator operation control device (CC) 251 outputs a command to the inverter 222, the first and second brake choppers 233, and the switch semiconductors 252 of #MC and #BK to control the operation of the car 211.

The elevator safety monitoring unit 260 inputs commands from the elevator safety monitoring device (SF) 261 and the first and second safety relay coils, and the elevator safety monitoring device (SF) 261 to supply power to each coil. A switch semiconductor 262 that turns ON / OFF is provided.

The elevator safety monitoring device (SF) 261 inputs the states of the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, the upper reference position switch 216f, the lower reference position switch 216g, and the governor encoder 216j. Then, based on these inputs, the elevator safety monitoring device (SF) 261 detects at least one or more unsafe states including overspeed on the terminal floor, open door running, and failure of the own unit constituent equipment. Executes a safe stop sequence, outputs a stop command to the elevator operation control device (CC) 251 to stop the car 211, shuts off # SF1 and #SF2, and holds the car 211 in a restrained state.

FIG. 9 is a block diagram showing in detail the internal configuration of the elevator safety monitoring device (SF) 261 according to the second embodiment of the present invention. The elevator safety monitoring device (SF) 261 includes a first safety monitoring system 140a and a second safety monitoring system 140b as a dual system composed of the same equipment and functions. Each of the first safety monitoring system 140a and the second safety monitoring system 140b displays the states of the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, each reference position switch 216f, 216g, and the governor encoder 216j. input.

Based on these inputs, the first safety monitoring system 140a outputs a drive command to the switch semiconductor 262 of # SF1 and outputs a stop command to the elevator operation control device (CC) 251. Similarly, the second safety monitoring system 140b outputs a drive command to the switch semiconductor 262 of # SF2 and outputs a stop command to the elevator operation control device (CC) 251 based on these inputs.

Each of the first safety monitoring system 140a and the second safety monitoring system 140b has the following four safety control functions.
・ End floor forced deceleration function (SETS)
・ Door open running protection function (UCMP)
・ Self-diagnosis function (DIAG)
・ Inter-system communication function (ICOM)

Further, each of the first safety monitoring system 140a and the second safety monitoring system 140b has the following two non-safety control functions as maintenance functions.
-Data logging function (DLOG)
・ Interface function with elevator operation control device (CCIF)

The SETS inputs the states of each reference position switch 216f, 216g, and governor encoder 216j, and executes a safe stop sequence when the current speed of the car exceeds the car overspeed monitoring level according to the current position of the car. It is a function.

The UCMP inputs the states of the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, and the governor encoder 216j, and the car is preset from the landing floor with the landing door or the car door open. This function executes a safe stop sequence when the vehicle has moved more than a distance or when the current speed of the car exceeds the specified value.

DIAG is a function that performs an operation check on unit components including at least a power supply, a clock, a WDT, a CPU, a memory, a bus, a program, and a safety relay, and executes a safety stop sequence when a failure is detected.

ICOM mutually transmits data such as input / output status and calculation status between the first safety monitoring system 140a and the second safety monitoring system 140b, and if inconsistency is detected, either system is used. It is a function to determine that there was a calculation error in and execute a safe stop sequence in both systems.

The maintenance function includes a data logging function (DLOG) and a CC interface function (CCIF) as non-safety control functions, and is executed at the timing of free time when the safety control function is not executed. Specifically, the data is stored by recording the input / output state, the calculation state, and the event history log by DLOG, and the stored data by CCIF in response to the request from the elevator operation control device (CC) 251. To transmit.

FIG. 10 is a configuration diagram common to the first safety monitoring system 140a and the second safety monitoring system 140b in the second embodiment of the present invention. FIG. 10 corresponds to the configuration diagram of FIG. 1 in the first embodiment. That is, the configuration common to the first safety monitoring system 140a and the second safety monitoring system 140b in FIG. 10 is equivalent to the configuration of the elevator safety control device according to the present invention described with reference to FIG. Therefore, in order to make the explanation easy to understand, each configuration in FIG. 10 corresponding to FIG. 1 is designated by adding 100 to the reference numeral of FIG.

The first safety monitoring system 140a (second safety monitoring system 140b) according to the second embodiment includes an external device I / F 110, a logic unit 120, and an independence guarantee unit 130. The CPU 121 in the logic unit 120 acquires a signal related to the elevator status as an input value via the external device I / F 110, and also has a safety control function task 141, a non-safety control function task 142, a safety scheduling information 150, and a safety scheduling information 150. Read the unsafe scheduling information 160.

Here, the task 141 of the safety control function, the task 142 of the non-safety control function, the safety scheduling information 150, and the non-safety scheduling information 160 correspond to the data stored in the storage unit, and the CPU 121 in the logical unit 120 has the CPU 121. With reference to these data, the processing required for elevator control will be executed.

The task 141 of the safety control function is composed of a safety program of a SETS task, a UCMP task, a DIAG task, and an ICOM task. Hereinafter, these tasks may be referred to as "safety tasks".

The task 142 of the unsafe control function is composed of each unsafe logoram of the DLOG task and the CCIF task. Hereinafter, these tasks may be referred to as "unsafe tasks". )

The safety scheduling information 150 is information in which an execution order of each safety task, an execution specified time, a final flag indicating that the safety task is the final safety task in each control cycle, and a suspension flag indicating whether or not each safety task can be interrupted are defined. ..

The unsafe scheduling information 160 is information in which only the execution order of each unsafe task is defined.

The context block 170 stores the SETS execution state, the UCMP execution state, the DIAG execution state, and the ICOM execution state. Here, the context block 170 corresponds to literate data stored in the storage unit.

The external device I / F110 is used when inputting signals of the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, the reference position switch 216f, 216g, and the governor encoder 216j, or when inputting the safety relays # SF1, S #. This is an interface for outputting a drive command to SF2.

The logic unit 120 includes a CPU 121 and a memory 122. Then, in the memory 122, a SETS area, a UCMP area, a DIAG area, and an ICOM area are allocated as individual areas as areas used when executing various safety tasks.

The independence guarantee unit 130 includes a specified time timer 131, a control cycle timer 132, and a memory protection function 133.

When the memory protection function 133 accesses the memory area of another safe task when the safe task and the unsafe task are executed, the memory protection function 133 protects the data in the same area and informs the CPU 121 that an abnormal access is detected. Send and have the safe stop sequence executed. For example, when the SETS task accesses the UCMP area, it corresponds to an abnormal access.

After starting the first safety monitoring system 140a (second safety monitoring system 140b), the CPU 121 refers to the safety scheduling information 150 and calls the safety task according to a predetermined execution order. At the same time, the independence guarantee unit 130 starts the task execution time measurement by the specified time timer 131. Further, when starting the execution of the first task of each control cycle, the independence guarantee unit 130 resets the control cycle timer 132 and then starts the timer count.

The CPU 121 terminates or interrupts the running task by either the execution time of the safety task reaches the specified time set in the safety scheduling information or the running task declares the end of the task by itself, and the final flag is set. Refer to.

When the final flag is FALSE, the CPU 121 calls the next safety task, and the independence guarantee unit 130 resets the specified time timer 131 and starts measuring the execution time of the next task.

On the other hand, when the final flag is TRUE, the CPU 121 refers to the unsafe scheduling information and calls the unsafe task according to the default execution order.

When the control cycle timer 132 reaches the specified control cycle, the CPU 121 interrupts the unsafe task being executed and shifts to the processing of the next control cycle. Then, the CPU 121 refers to the safety scheduling information and calls the first safety task in the next control cycle. At the same time, the independence guarantee unit 130 resets the specified time timer 131 and the control cycle timer 132, respectively, and starts each timer count.

When the CPU 121 finishes the execution of the final safety task in the execution order of the safety scheduling information, the CPU 121 returns to the beginning of the execution order of the safety scheduling information at the timing of the next safety task execution.

Next, the effect of the task processing according to the second embodiment will be described using the execution time chart of each task for each control cycle. FIG. 11A is an execution time chart corresponding to an execution plan according to the safety scheduling information 150 and the unsafe scheduling information 160 in the second embodiment of the present invention.

On the other hand, FIG. 11B is an execution time chart when the task processing according to the second embodiment of the present invention is executed. Further, FIG. 11C is an execution time chart when the task process according to the prior art is executed.

In the specific examples shown in FIGS. 11A to 11C, it is assumed that the control cycle T = 1 [ms] is set as one execution step, and the safety task and the non-safety task for one cycle are executed by three steps.

As shown in FIG. 11A, in the execution plan based on the safety scheduling information 150 and the unsafe scheduling information 160, step 1 (step counter N = 1), step 2 (step counter N = 2), and step 3 (step counter N = 3). ), The following task assignments are made.
<Step 1 (step counter N = 1)>
・ ICOM task at time t = 0 to 0.1 [ms] ・ DIAG task (1/3) at time t = 0.1 to 0.4 [ms]
-Sets task at time t = 0.4 to 0.7 [ms] -Unsafe task at time t = 0.7 to 1.0 [ms] <Step 2 (step counter N = 2)>
・ ICOM task at time t = 0 to 0.1 [ms] ・ DIAG task (2/3) at time t = 0.1 to 0.6 [ms]
-UCMP task at time t = 0.6 to 0.8 [ms] -Unsafe task at time t = 0.8 to 1.0 [ms] <Step 3 (step counter N = 3)>
・ ICOM task at time t = 0 to 0.1 [ms] ・ DIAG task (3/3) at time t = 0.1 to 0.8 [ms]
・ Unsafe task at time t = 0.8 to 1.0 [ms]

As specified by the interruption flag in the safety scheduling information 150 in FIG. 10, the ICOM task, the SETS task, and the UCMP task cannot be interrupted, and the DIAG task cannot be interrupted only on 3/3. Then, if the uninterruptable task is not completed within the specified time, the CPU 121 shall detect the program abnormality and execute the safe stop sequence.

The specified time allocated to execute each task in the safety scheduling information is determined based on the execution path that maximizes the processing amount in the combination of conditional branches of task processing. In the case of a safety task, in the normal state, only the abnormality monitoring process is executed, so the actual execution time is shorter than the specified time. The time approaches the specified time.

The execution time of the unsafe task is not defined in the unsafe scheduling information, and monitoring by the specified time timer is not performed. However, in FIGS. 11B and 11C, the processing time of the DLOG task is 0.1 [ms], and the processing time of the CCIF task is 1.0 [ms].

Next, a case where the task processing according to the second embodiment is actually executed will be described with reference to FIG. 11B. In step 1, the ICOM task is executed at t = 0 to 0.1 [ms], and then the DIAG task (1/3) is executed from t = 0.1 [ms]. Here, since the execution specified time of the DIAG task (1/3) is 0.3 [ms], it can be executed up to t = 0.4 [ms], but no abnormality is detected and t = 0.3 [ms]. It is assumed that it ends with.

Therefore, the CPU 121 starts executing the next safety task, the SETS task, at the time of t = 0.3 [ms]. It is assumed that the SETS task can be executed at t = 0.3 to 0.6 [ms], but it is also completed at t = 0.5 [ms] without detecting any abnormality.

Since the final flag of the SETS task is TRUE from the safety scheduling information 150, the CPU 121 can determine that the execution of the safety task in this step has been completed. Therefore, from t = 0.5 [ms], the CPU 121 executes the DLOG task according to the unsafe scheduling information 160. The DLOG task is completed at 0.1 [ms], and the CCIF task is executed from t = 0.6 [ms].

The CCIF task takes 1.0 [ms] to complete, but at t = 1.0 [ms], the control cycle timer 132 becomes control T = 1 [ms] and an interrupt occurs. Therefore, the CCIF task is interrupted after executing 0.4 [ms].

In the next step 2, the ICOM task can be executed at t = 0 to 0.1 [ms], and then the DIAG task (2/3) can be executed at t = 0.1 to 0.6 [ms]. However, it is assumed that it ends at t = 0.45 [ms]. As a result, next, it is assumed that the UCMP task can be executed at t = 0.45 to 0.65 [ms], but the UCMP task actually ends at t = 0.6 [ms].

Since the final flag of UMCP is TRUE, the unsafe task is executed next, and the CCIF task interrupted in the previous step 1 is restarted from t = 0.6 [ms]. When the CCIF task is further executed 0.4 [ms], the control cycle timer becomes control T = 1 [ms], and the execution of the CCIF task is interrupted again.

In the next step 3, the ICOM task can be executed at t = 0 to 0.1 [ms], and then the DIAG task (3/3) can be executed at t = 0.1 to 0.8 [ms]. However, it is assumed that it ends at t = 0.6 [ms]. Since the final flag of DIAG (3/3) is TRUE, the unsafe task is then executed, and from t = 0.6 [ms], the CCIF task interrupted in step 2 above is restarted.

Since the CCIF task has already executed 0.8 [ms] in total in steps 1 and 2, the remaining 0.2 [ms] processing is t = 0.6 to 0.8 [ms] in step 3. Is executed by.

After the execution of the CCIF task is completed, since there is no next unsafe task, there is a free time from t = 0.8 [ms] until the end of step 3 in which no processing is executed.

In the SETS task and the UCMP task, it is necessary to calculate the current car speed. Therefore, by using the governor encoder value x_gov'and the control cycle timer value t_gov' acquired at the time of the previous task execution, the respective current values x_gov and t_gov, the control cycle T, and the speed normalization coefficient K, the CPU 121 can be used. , The car speed can be calculated according to the following formula.
Basket speed = K × (x_gov-x_gov')
/ (3 × N + t_gov-t_gov')

As shown in FIG. 11B, in the task processing according to the present invention, the free time when the safe task is completed before the specified time is efficiently used, and more time is allocated to the unsafe task. It is possible. As a result, the utilization efficiency of the CPU 121 is improved, and the time efficiency of task processing can be improved.

On the other hand, when the same safe task and non-safety task as this time are executed by adopting the method of fixing the task allocation time by the prior art, the execution time chart shown in FIG. 11C is obtained. That is, since the processing of the safety task is not executed in the free time, the step of completing the CCIF task having the processing time of 1.0 [ms] is the step 5. That is, in the prior art, divisional execution over more steps is required, and it is assumed that the processing time will increase as compared with the case where the task processing according to the present invention is executed.

As described above, according to the task scheduling method according to the second embodiment, the free time during which the task of the safety control function is not executed can be summarized after each control cycle. As a result, the utilization efficiency of the CPU is improved, and efficient task scheduling can be realized while ensuring the independence between the task of the safety control function and the task of the non-safety control function.

21 CPU, 30 Independence Guarantee, 31 Specified Time Timer, 32 Control Cycle Timer, 33 Memory Protection Function, 40 Program, 41 Safety Control Function Task, 42 Non-Safety Control Function Task, 50, 50a Safety Scheduling Information, 60 , 60a unsafe scheduling information, 70 context block, 121 CPU, 130 independence guarantee unit, 131 specified time timer, 132 control cycle timer, 133 memory protection function, 140a, 140b safety monitoring system, 141 safety control function task, 142 Unsafe control function tasks, 150 safety scheduling information, 160 unsafe scheduling information, 170 context blocks.

Claims (9)

A plurality of safety control functions and a plurality of non-safety control functions are stored as independent programs, and the scheduling and execution order for each control cycle when the plurality of safety control functions are executed in each control cycle are defined in advance. A storage unit that stores safety scheduling information and
A CPU that performs elevator control operations by sequentially executing programs corresponding to the plurality of safety control functions and the plurality of non-safety control functions according to the safety scheduling information is provided.
In each control cycle, the CPU continuously executes the safety control functions in sequence according to the execution order defined as the safety scheduling information, and executes all the safety control functions assigned in the control cycle. An elevator safety control device that executes the plurality of non-safety control functions in the free time within the control cycle after the operation. An input unit that acquires signals related to the elevator status as input values,
An independence guarantee unit that guarantees the independence between control functions so that one control function does not affect other control functions for all the control functions including the plurality of safety control functions and the plurality of non-safety control functions. And have more,
The safety scheduling information is a specified time that defines the execution order of the plurality of safety control functions and the time during which the arithmetic processing of the safety control function can be executed by the CPU corresponding to each of the plurality of safety control functions. And the final flag indicating whether or not it is the safety control function to be executed at the end of each control cycle are associated with each other.
The storage unit further stores unsafe scheduling information in which the execution order of the unsafe control functions is defined.
The independence guarantee unit has a specified time timer for monitoring whether or not the arithmetic processing time by each safety control function exceeds the specified time, and a control cycle timer for monitoring each control cycle.
The CPU is used in each control cycle.
First, the arithmetic processing of the safety control function is started according to the execution order specified in the safety scheduling information, and the arithmetic processing of the safety control function in which the final flag is valid is executed.
When the arithmetic processing of the safety control function ends before the specified time associated with the safety control function during the arithmetic processing, or when the specified time is reached and the interruption by the specified time timer occurs, the following By starting the calculation processing of the safety control function in the execution order, the calculation processing of the safety control function to be executed during the control cycle is continuously executed without any free time.
After the calculation processing of the safety control function to be executed during the control cycle is completed, the calculation processing of the non-safety control function is executed according to the execution order specified in the non-safety scheduling information in the free time until the end of the control cycle. ,
The elevator safety control device according to claim 1, wherein when the control cycle elapses and an interrupt by the control cycle timer occurs, the unsafe control function being executed is interrupted and the arithmetic processing of one control cycle is terminated. .. It also has a context block that holds information about the execution status of each program that runs independently.
The CPU
When the interrupt of the specified time timer or the control cycle timer occurs, the control function during arithmetic processing is interrupted, and the information on the execution state of the program related to the interrupted control function is stored in the context block.
The elevator according to claim 2, wherein when the interrupted control function is executed next time, the arithmetic processing of the interrupted control function can be restarted by using the information of the execution state of the program stored in the context block. Safety control device. The CPU has an internal memory in which an area used for executing each of the plurality of safety control functions is individually allocated.
The independence guarantee unit is in an area other than the area where the control function during the arithmetic processing is permitted while the arithmetic processing of any of the control functions including the plurality of safety control functions and the plurality of non-safety control functions is being executed. It has a memory protection function that monitors the presence or absence of an abnormal access state that has accessed the area of the internal memory, and outputs a command to the CPU to execute a safe operation of the elevator when the abnormal access state is detected. The elevator safety control device according to claim 2 or 3. The safety scheduling information is further associated with a suspendable flag indicating whether or not the safety control function can be interrupted during arithmetic processing.
One of claims 2 to 4, wherein the CPU executes a safe operation of the elevator when an interrupt of the specified time timer occurs during the calculation process of the safety control function in which the suspendable flag is invalid. The elevator safety control device according to item 1. The value of the control cycle timer can be set uniquely corresponding to each of the independent programs.
The elevator safety control device according to any one of claims 2 to 5, wherein the CPU can use the value of the control cycle timer set in a program corresponding to a control function for executing arithmetic processing. The CPU
It has a counter that holds the elapsed number of times of the control cycle timer.
The elapsed time from the previous time to the current time is measured using the value and the number of elapsed time of the control cycle timer when the previous control cycle timer was acquired and the value and the number of elapsed times of the control cycle timer when the current control cycle timer was acquired. The elevator safety control device according to claim 6. Regarding the task of the safety control function that wants to prohibit interruption by the specified time timer only in a specific section
The CPU
At the start of the task, the value ta of the control cycle timer is acquired, and the value ta is obtained.
The value tb of the control cycle timer is acquired at the start of the specific section, and the value tb is acquired.
At the start of the specific section, from the time width ct of the specific section and the set value td of the specified time timer of the task.
td <tb-ta + tc
If the relationship is established, the arithmetic processing of the task is interrupted at the start of the specific section, and the processing is shifted to the next execution order, and the task is executed. 6 or 7 for prohibiting interruption by the specified time timer in the specific section by restarting the execution of the task from the initial state of the specific section when the next execution order is reached. Elevator safety control device described in. The CPU
In the next execution order, the start flag is set when the specific section starts, and the end flag is set when the specific section ends.
When the interrupt of the specified time timer occurs after the specific section starts, if the start flag is set and the end flag is not set, the elevator is safely operated. Item 8 is the elevator safety control device.

Images