KR100894371B1 - Elevator apparatus - Google Patents

Abstract

In the elevator apparatus, the safety device controller detects an abnormality of the elevator based on a detection signal from the sensor, and outputs a command signal for shifting the elevator to a safe state. The electronic safety controller can detect an abnormality of the electronic safety controller itself, and output a command signal for shifting the elevator to a safe state even when an abnormality of the electronic safety controller itself is detected.

Description

Elevator device {ELEVATOR APPARATUS}

The present invention relates to an elevator apparatus using an electronic safety controller that detects an abnormality of an elevator based on a detection signal from a sensor.

In a conventional elevator safety system, a sensor or the like is connected to a bus node installed in a hoistway, a machine room and a car, and information from the sensor is transferred to a safety controller via a bus node and a communication network bus (for example, a patent). See Document 1).

Patent Document 1: Japanese Patent Application Laid-Open No. 2002 ~ 538061

In the conventional elevator apparatus as described above, since information is input from the sensor to the safety controller through a communication network, a communication network having a fairly high reliability is required to secure high reliability as a safety system. Hardware and software are complicated and expensive.

This invention is made | formed in order to solve the above subjects, and an object of this invention is to obtain the elevator apparatus which can improve the reliability of a safety system with a comparatively simple structure.

The elevator apparatus according to the present invention is a sensor for generating a detection signal for detecting an elevator state, and an electronic device for detecting an abnormality of the elevator based on a detection signal from the sensor and outputting a command signal for shifting the elevator to a safe state. A safety controller is provided, and the electronic safety controller can detect an abnormality of the electronic safety controller itself, and output a command signal for shifting the elevator to a safe state even when an abnormality of the electronic safety controller itself is detected.

BRIEF DESCRIPTION OF THE DRAWINGS The block diagram which shows the elevator apparatus by Embodiment 1 of this invention.

FIG. 2 is a graph showing a pattern of overspeed set in the governor and the ETS circuit section of FIG. 1; FIG.

3 is a block diagram showing a connection relationship between an electronic safety controller, an elevator control panel, and various sensors of FIG. 1;

4 is a block diagram showing a device configuration of a main part of the electronic safety controller of FIG.

5 is an explanatory diagram showing a method of executing arithmetic processing by the microprocessor of FIG.

6 is a block diagram showing a main part of the electronic safety controller of FIG.

FIG. 7 is a configuration diagram showing a specific configuration of the clock abnormality detection circuit of FIG. 6. FIG.

FIG. 8 is an explanatory diagram showing area division in RAM of the electronic safety controller of FIG. 1; FIG.

9 is a flowchart showing an initial operation of the electronic safety controller of FIG. 1.

10 is a flowchart showing a first example of the flow of an interrupt operation of the electronic safety controller of FIG.

FIG. 11 is a block diagram showing a main part of the electronic safety controller of FIG. 1. FIG.

It is a block diagram which shows the principal part of the electronic safety controller of FIG.

FIG. 13 is a circuit diagram illustrating an example of a specific configuration of the check function circuit of FIG. 12.

FIG. 14 is an explanatory diagram showing the meaning of data relating to each bit of a data bus when the first and second CPUs read the check function circuit of FIG. 12; FIG.

FIG. 15 is a flowchart showing a power supply voltage monitoring health check method on the first CPU side in FIG. 12; FIG.

FIG. 16 is a flowchart showing an operation when a CPU is reset in the elevator control device of FIG. 12; FIG.

FIG. 17 is an explanatory diagram showing a relationship between a step of an initial setting operation of an ETS circuit part of FIG. 1 and an operation of an operation control part and a safety circuit part; FIG.

FIG. 18 is an explanatory diagram for explaining movement of a car in an initial setting operation mode of the elevator apparatus of FIG. 1. FIG.

19 is a circuit diagram illustrating a contact failure detection unit of the electronic safety controller of FIG. 1.

20 is a flowchart for explaining an operation test method of the safety relay main contact of FIG. 19.

FIG. 21 is a block diagram illustrating a state in which a history information recording unit and a health diagnosis unit are connected to the electronic safety controller of FIG. 1. FIG.

FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit of FIG. 21; FIG.

FIG. 23 is a flowchart for explaining the operation of the electronic safety controller of FIG. 21;

24 is a block diagram showing a main part of the electronic safety controller of FIG.

FIG. 25 is a circuit diagram specifically showing a data comparison circuit for checking data abnormality in FIG. 24; FIG.

FIG. 26 is a circuit diagram specifically showing a designated address detection circuit for checking an address bus error in FIG. 24; FIG.

FIG. 27 is a flowchart showing processing operations by the designated address output software and the designated address detecting circuit in the CPU of FIG. 24; FIG.

FIG. 28 is a flowchart showing processing operations of a data bus abnormality checking software in the CPU of FIG. 24; FIG.

EMBODIMENT OF THE INVENTION Hereinafter, very suitable embodiment of this invention is described with reference to drawings.

[Embodiment 1]

BRIEF DESCRIPTION OF THE DRAWINGS It is a block diagram which shows the elevator apparatus by Embodiment 1 of this invention. In the figure, a pair of car guide rails 2 and counterweight guide rails (not shown) are provided in the hoistway 1. The car 3 is guided to the car guide rail 2 to move up and down the hoistway 1. The counterweight 4 is guided to the counterweight guide rail to move up and down the hoistway 1.

In the lower part of the cage | basket | car 3, the emergency stop device 5 which engages the cage | basket | car guide rail 2 and emergency-stops the cage | basket | car 3 is mounted. The emergency stop device 5 has a pair of braking pieces (wedge members) 6 which are operated by mechanical operation and pressed to the car guide rail 2.

In the upper part of the hoistway 1, the drive device (winder) 7 which raises and lowers the cage | basket | car 3 and the counterweight 4 through the main rope is provided. The drive device 7 includes a drive sheave 8, a motor portion (not shown) for rotating the drive sheave 8, a brake portion 9 for braking the rotation of the drive sheave 8, and a drive sheave 8. It has a motor encoder 10 for generating a detection signal according to the rotation of.

As the brake part 9, the electromagnetic brake apparatus is used, for example. In the electromagnetic brake device, the brake shoe is pressed against the braking surface by the spring force of the brake spring to brake the rotation of the drive sheave 8, and the brake shoe is opened from the braking surface by exciting the electromagnetic magnet. Is released.

The elevator control panel 11 is arranged, for example, in the lower part of the hoistway 1, and the like. The elevator control panel 11 is provided with the operation control part 12 which controls the operation of the drive device 7, and the safety circuit part (relay circuit part) 13 for stopping a car 3 suddenly at the time of an abnormality of an elevator. . The detection signal from the motor encoder 10 is input to the operation control unit 12. The driving control unit 12 controls the drive device 7 by obtaining the position and speed of the car 3 based on the detection signal from the motor encoder 10.

When the relay circuit of the safety circuit unit 13 is in the open state, the energization of the drive unit 7 to the motor unit is cut off, and the energization of the brake unit 9 to the electromagnetic magnet is cut off to drive the sheave ( 8) is braked.

The governor (mechanical governor) 14 is provided in the upper part of the hoistway 1. The governor 14 is provided with a governor sheave 15, an overspeed detection switch 16, a rope catch 17, and a governor encoder 18 as a sensor. The governor rope 19 is wound around the governor sheave 15. Both ends of the governor rope 19 are connected to the operation mechanism of the emergency stop device 5. The lower end of the governor rope 19 is wound around the tension pulley 20 arranged at the lower part of the hoistway 1.

When the car 3 is raised and lowered, the governor rope 19 is circulated, and the governor sheave 15 is rotated at a rotational speed corresponding to the running speed of the car 3. In the governor 14, it is mechanically detected that the traveling speed of the car 3 has reached an overspeed. As the overspeed to be detected, a first overspeed (OS speed) higher than the rated speed and a second overspeed (Trip speed) higher than the first overspeed are set.

When the traveling speed of the car 3 reaches the first overspeed, the overspeed detection switch 16 is operated. When the overspeed detection switch 16 is operated, the relay circuit of the safety circuit unit 13 is opened. When the running speed of the cage | basket | car 3 reaches the 2nd overspeed, the governor rope 19 is gripped by the rope catch 17, and circulation of the governor rope 19 is stopped. When the circulation of the governor rope 19 is stopped, the emergency stop device 5 is braked.

The governor encoder 18 generates a detection signal according to the rotation of the governor sheave 15. As the governor encoder 18, an encoder of dual sense type that simultaneously outputs two types of detection signals, that is, first and second detection signals, is used.

The first and second detection signals from the governor encoder 18 are input to the ETS circuit portion 22 of the terminal layer forced deceleration device (ETS device) provided in the electronic safety controller 21. The ETS circuit unit 22 detects an abnormality of the elevator based on the detection signal from the governor encoder 18 and outputs a command signal for shifting the elevator to a safe state. Specifically, the ETS circuit unit 22 obtains the traveling speed and position of the car 3 independently of the driving control unit 12 by the signal from the governor encoder 18, and obtains the car 3 near the terminal floor. ), The driving speed of the ETS monitoring overspeed is reached.

Moreover, the ETS circuit part 22 converts the signal from the governor encoder 18 into a digital signal, and performs a digital arithmetic process, and determines whether the running speed of the cage | basket | car 3 reached the ETS monitoring overspeed. When it is determined by the ETS circuit section 22 that the traveling speed of the car 3 has reached the ETS monitoring overspeed, the relay circuit of the safety circuit section 13 is opened.

Moreover, the ETS circuit part 22 can detect the abnormality of the ETS circuit part 22 itself, and the abnormality of the governor encoder 18. As shown in FIG. When an abnormality of the ETS circuit section 22 itself or the governor encoder 18 is detected, a near floor stop command signal as a command signal for shifting the elevator to a safe state is output from the ETS circuit section 22 to the operation controller 12. do. In addition, the communication between the ETS circuit unit 22 and the operation control unit 12 can be performed in both directions.

At predetermined positions in the hoistway 1, first to fourth reference sensors 23 to 26 for detecting that the car 3 is located at the reference position in the hoistway 1 are provided. Upper and lower termination layer switches may be used as the reference sensors 23 to 26. The detection signals from the reference sensors 23 to 26 are input to the ETS circuit section 22. The ETS circuit section 22 corrects the positional information of the car 3 obtained in the ETS circuit section 22 based on the detection signals from the reference sensors 23 to 26.

A car shock absorber 27 and a counterweight shock absorber 28 are provided between the bottom surface of the hoistway 1 and the lower surface of the car 3 and the counterweight 4. Here, the car shock absorber 27 and the counterweight shock absorber 28 are provided in the lower part of the hoistway 1. The car shock absorber 27 is disposed directly below the car 3 and alleviates the impact when the car 3 collides with the bottom of the hoistway 1. Counterweight shock absorbers 28 are disposed just below counterweight 4 and alleviate the impact of counterweight 4 colliding with the bottom of hoistway 1. As these shock absorbers 27 and 28, Or spring buffers are used.

FIG. 2 is a graph showing a pattern of overspeed set in the governor 14 and the ETS circuit section 22 of FIG. In the figure, when the car 3 travels at a normal speed (rated speed) from the lower end layer to the upper end layer, the speed pattern of the car 3 becomes the normal speed pattern VO. The governor 14 is set with first and second overspeed patterns V1 and V2 by mechanical position adjustment. The ETS monitoring overspeed pattern VE is set in the ETS circuit section 22.

The ETS monitoring overspeed pattern VE is usually set higher than the speed pattern VO. In addition, the ETS monitoring overspeed pattern VE is usually set to be substantially equally spaced in the whole lifting stroke with respect to the speed pattern VO. That is, the ETS monitoring overspeed pattern VE is changing according to the car position. Specifically, the ETS monitoring overspeed pattern VE is set to be constant near the middle floor, but is set to be continuously and smoothly lowered near the terminal floor as the terminal (top and bottom) of the hoistway 1 approaches. Thus, although the ETS circuit part 22 monitors the traveling speed of the cage | basket | car 3 not only in the vicinity of a terminal floor, but also in the vicinity of an intermediate | middle floor (normal speed driving section in normal speed pattern VO), it always monitors the vicinity of an intermediate | middle floor. You do not have to do.

The first overspeed pattern V1 is set higher than the ETS monitoring overspeed pattern VE. In addition, the second overspeed pattern V2 is set higher than the first overspeed pattern V1. Moreover, all heights in the hoistway 1 are constant in the 1st and 2nd overspeed patterns V1 and V2.

The buffer stroke of the counterweight shock absorber 28 is less than the stroke defined by the collision speed limited to the governor 14, depending on the speed of collision of the counterweight 4 with the counterweight shock absorber 28, which is limited by the ETS circuitry 22. It is set short. The buffer stroke of the car shock absorber 27 is defined according to the collision speed limited by the governor 14.

The buffer strokes of the shock absorbers 27 and 28 depend on the initial speed when the car 3 and the counterweight 4 first contact, and the allowable deceleration until the car 3 and the counterweight 4 stop. It is decided by. Therefore, the buffer stroke side of the counterweight shock absorber 28 is set shorter than the buffer stroke of the car shock absorber 27. In other words, the buffer stroke of the counterweight shock absorber 28 is shorter than the buffer stroke of the car shock absorber 27.

In addition, the counterweight shock absorber 28 is destroyed even when the counterweight 4 collides at a speed greater than the speed prescribed by the ETS monitoring overspeed pattern VE, for example, when the main rope is broken. It is set to a sufficient capacity so that it may be. Thus, as a method of ensuring sufficient capacity | capacitance of the counterweight buffer 28, there exists a method of using the buffer of larger capacity than usual, or the method of using multiple buffers of a normal capacity, etc., for example.

The gap dimension between the upper end of the car 3 and the ceiling of the hoistway 1 when the car 3 stops on the uppermost floor is the counterweight shock absorber of the counterweight 4 limited by the ETS circuit part 22 ( It is set according to the collision speed to 28). That is, even if the counterweight 4 collides with the counterweight shock absorber 28, the clearance gap of the top part of the hoistway 1 is set so that the cage | basket | car 3 may not collide with the ceiling part of the hoistway 1.

3 is a block diagram showing the connection relationship between the electronic safety controller 21, the elevator control panel 11, and various sensors of FIG. In the figure, the electronic safety controller 21 has two systems of detection signals from the governor encoder 18, detection signals from the first to fourth reference sensors 23 to 26, and other sensors (first to first). The signal from N sensor) is input. In addition, the electronic safety controller 21 has a plurality of signal input ports corresponding to each sensor. That is, the signals from each sensor are separately input to the electronic safety controller 21 separately. Thereby, the electronic safety controller 21 can detect the abnormality of each sensor.

If any abnormality (for example, overspeed, sensor failure, abnormality of the electronic safety controller 21 itself, etc.) is detected by the electronic safety controller 21, the fault / error content signal including the failure or abnormality is controlled by the elevator. Input to a control unit (not shown) of the panel 11 is performed, and a stop signal corresponding to a failure or abnormality is input to a drive / braking unit (not shown) of the elevator control panel 11.

4 is a block diagram showing a device configuration of a main part of the electronic safety controller 21 of FIG. 1. The electronic safety controller 21 detects the abnormality of the elevator based on the first microprocessor 31 which performs arithmetic processing for detecting the abnormality of the elevator based on the first safety program, and the second safety program. And a second microprocessor 32 for executing arithmetic processing therefor.

The first safety program is the same program as the second safety program. The first and second microprocessors 31 and 32 are capable of communicating with each other via an interprocessor bus and a two port RAM 33. In addition, the first and second microprocessors 31 and 32 are capable of confirming the health of the first and second microprocessors 31 and 32 themselves by comparing the results of arithmetic processing with each other. In other words, the same processing is executed on the first and second microprocessors 31 and 32, and the result of the communication is compared and communicated through the two port RAM 33 or the like, so that the health of the microprocessors 31 and 32 is confirmed. .

The microprocessors 31 and 32 can also detect abnormalities of the electronic safety controller 21 other than the abnormalities of the microprocessors 31 and 32 by arithmetic processing.

FIG. 5 is an explanatory diagram showing a method of executing arithmetic processing by the microprocessors 31 and 32 of FIG. 4. The microprocessors 31 and 32 repeatedly execute arithmetic processing in accordance with a program stored in R0M at a predetermined arithmetic period (for example, 50 msec) based on a signal from a fixed period timer. The program executed in one cycle includes a safety program for detecting an abnormality in an elevator, and a fault / abnormal check program for detecting a fault or an abnormality of the electronic safety controller 21 itself or various sensors. The fault / abnormal check program may be executed only when a preset condition is satisfied.

In such an elevator device, the electronic safety controller 21 can detect an abnormality of the electronic safety controller 21 itself, and even when an abnormality of the electronic safety controller 21 itself is detected, a command for shifting the elevator to a safe state. Since the signal is output, the reliability of the safety system can be improved with a relatively simple configuration while increasing the speed of detecting the abnormality of the elevator or the speed of processing the abnormality.

In addition, the electronic safety controller 21 can also detect abnormalities of various sensors, and even when a sensor abnormality is detected, a command signal for shifting the elevator to a safe state can be output, thereby further improving the reliability of the safety system. have.

In addition, the electronic safety controller 21 includes first and second microprocessors 31 and 32, and the first and second microprocessors 31 and 32 compare the results of the arithmetic processing with each other to form the first. And the health of the second microprocessors 31 and 32 itself can be confirmed, so that the reliability of the safety system can be further improved.

Hereinafter, the specific example of the structure and operation | movement of the electronic safety controller 21 is demonstrated.

<< clock abnormality detection >>

FIG. 6 is a block diagram showing a main part of the electronic safety controller 21 of FIG. 1. In order to ensure sufficient reliability, the electronic safety controller 21 employs a dual circuit configuration.

In the electronic safety controller 21, first and second CPUs (processing units) 41 and 42 as first and second microprocessors are used. The first CPU 41 outputs a control signal to the operation control unit 12 and the first output interface (output unit) 43. The second CPU 42 outputs a control signal to the operation control unit 12 and the second output interface (output unit) 44.

When the operation control part 12 receives the same control signal from the 1st and 2nd CPUs 41 and 42, it is controlled by the control signal. The first and second output interfaces 43 and 44 output signals for opening the safety circuit 13 to the open state based on the control signals from the first and second CPUs 41 and 42.

The first and second CPUs 41 and 42 are connected to a two-port RAM 45 for carrying data between them. The first watchdog timer 46 is connected to the first CPU 41. The second watchdog timer 47 is connected to the second CPU 42.

Signals of two systems from the governor encoder 18 (FIG. 1) are input to the first CPU 41. In addition, two systems of signals from the governor encoder 18 are also input to the second CPU 42. The signal from the governor encoder 18 is computed by the CPUs 41 and 42, whereby the speed and position of the car 3 (Fig. 1) are obtained. That is, the governor encoder 18 functions as a speed sensor and a position sensor. In addition, signals from the various sensors as shown in FIG. 3 are also input to the CPUs 41 and 42.

The first clock signal from the first clock 48 is input to the first CPU 41. The second CPU 42 receives a second clock signal from the second clock 49. The frequencies of the first and second clock signals are set equal to each other.

The first and second clock signals are also input to the clock abnormality detection circuit 50. The clock abnormality detection circuit 50 counts the number of pulses of the first and second clock signals, and detects the abnormality of the first and second clock signals from the difference in the number of pulses.

The first and second CPUs 41 and 42 transmit the test mode signals 51 and 52 to the clock abnormality detection circuit 50 for checking the integrity of the clock abnormality detection circuit 50. In addition, the first and second CPUs 41 and 42 transmit the detection start command signals 53 and 54 to the clock abnormality detection circuit 50 for starting clock abnormality detection.

When the clock abnormality detection circuit 50 detects a clock abnormality, the clock abnormality detection circuit 50 inputs the error signals 55 and 56 to the first and second CPUs 41 and 42.

FIG. 7 is a configuration diagram illustrating a specific configuration of the clock abnormality detection circuit 50 of FIG. 6. The clock abnormality detection circuit 50 includes a first monitoring counter 57 that counts the pulse edges of the first clock signal and a first monitoring counter 58 that counts the pulse edges of the second clock signal. A second monitoring counter 59 and a second monitored counter 60 are provided.

The first clock signal is input to the first monitored counter 58 through the first selector 61. In the first selector 61, it is possible to switch between a normal circuit and a test circuit. In the normal circuit, the first clock signal is input directly to the first monitored counter 58. In the test circuit, the first clock signal is multiplexed by the first multiplication circuit 62 and then input to the first monitored counter 58. Switching to the test circuit is performed by inputting the test mode signal 51 from the first CPU 41 to the first selector 61.

Similarly, the second clock signal is input to the second monitored counter 60 through the second selector 63. In the second selector 63, switching between a normal circuit and a test circuit is possible. In the normal circuit, the second clock signal is input to the second monitored counter 60 as it is. In the test circuit, the second clock signal is multiplied by the second multiplication circuit 64 and then input to the second monitored counter 60. The switching to the test circuit is performed by inputting the test mode signal 52 from the second CPU 42 to the second selector 63.

Ripple carry output signals from the first and second monitored counters 58, 60, i.e., error signals 55, 56, are latched in the first and second latch sections 65,66. The first and second latch portions 65 and 66 receive the latch release signals 67 and 68 from the first and second CPUs 41 and 42 to release the latch state.

When the error signal from the clock abnormality detection circuit 50 is input to the CPUs 41 and 42, the abnormality detection signal is output from the CPUs 41 and 42 to the output interfaces 43 and 44. Then, the output interface 43 44, an operation signal is output from the safety circuit part 13, and the elevator enters a safe state by the safety circuit part 13.

The electronic safety controller 21 also includes a computer (microcomputer) including the CPUs 41 and 42 and the ROM shown in FIG. 6.

Next, the operation will be described. Two system pulse signals output from the governor encoder 18 are input to the CPUs 41 and 42. Each of the CPUs 41 and 42 computes a pulse signal and calculates the position and speed of the car 3. The obtained position and speed are compared with each other via the two port RAM 45, and then compared with a set value (reference value) for determining an abnormality, for example, an ETS monitoring overspeed.

When an abnormality such as an overspeed or a positional abnormality is detected, a signal is output to the operation control unit 12 or the safety circuit unit 13 in accordance with the above contents, and the elevator enters the safe state. The transition to the safe state is, for example, stopping the car 3 suddenly or stopping the car 3 on the adjacent floor. In addition, after the transition to the safe state, the operation control unit 12 is controlled again as necessary.

If the calculation results of the CPUs 41 and 42 are different from each other, it is determined that either system of the CPUs 41 and 42 has an error, and the elevator is shifted to a safe state.

If there is no abnormality in the obtained position and speed, a control signal for permitting the running of the car 3 is generated and output to the operation control unit 12.

In the CPUs 41 and 42, calculations for the car speed are executed by counting pulse signals input within a predetermined time. And the timer which manages the "constant time" is produced | generated by the clock signal from the clocks 48 and 49. FIG. Therefore, the frequency of the clock signal is very important.

In particular, attention should be paid in monitoring the overspeed of the cage | basket | car 3 about the abnormality which a frequency becomes high. For example, it is considered that the pulse signal is counted every 10 ms. However, if the cycle of the clock signal is halved due to any failure, it is actually counted every 5 ms. In this case, the car speed obtained by the CPUs 41 and 42 is mistaken as half of the actual car speed, and the overspeed is not detected.

On the other hand, in this example, it is monitored whether clock signals from the first and second clocks 48 and 49 are input to the clock abnormality detection circuit 50 and there is no abnormality in the clock signal.

Next, the details of the clock abnormality monitoring operation will be described. First, at the time of power reset, the counters 57 to 60 immediately start counting clock pulses as soon as each device is stabilized. As a result, the error signals 55 and 56 are latched, but the error signals 55 and 56 are initially ignored in the CPUs 41 and 42.

Thereafter, a high signal is applied to the detection start command signals 53 and 54, and the latch release signals 67 and 68 are then transferred from the CPUs 41 and 42 to the clock abnormality detection circuit 50. .

The ripple carry output signal from the first monitoring counters 57 and 59 after the detection start command signals 53 and 54 become high, and the preset data value of each counter 57 to 60 is set to each counter 57 to 60. ) And count up starts. The preset data value is a count value at the start of counting in the counters 57 to 60.

As preset data values of the monitored counters 58 and 60, for example, 0 is set in advance. In addition, as a preset data value of the monitoring counters 57 and 59, the threshold value for determining a clock abnormality is preset. The preset data value of the monitoring counters 57 and 59 is set to a value larger than the preset data value of the monitored counters 58 and 60, here 4.

The monitoring counters 57 and 59 repeatedly count the number of pulses in a range shorter than the monitored counters 58 and 60, and reset the monitored counters 57 and 59 each time they carry over. The monitored counters 58 and 60 also try to count the number of pulses repeatedly, but in normal operation, the monitored counters 57 and 59 carry over before the monitored counters 58 and 60 carry over, and the monitored counter 58 , 60) is reset.

Such preset data values can be arbitrarily set by configuring the clock abnormality detection circuit 50 with, for example, a field programmable gate array (FPGA).

When the two clocks 48 and 49 are normal, the supervised counters 58 and 60 carry over to the counter value immediately preceding four than outputting the ripple carry output signal, that is, the error signals 55 and 56. Since the reset counter is reset by the ripple carry output signals of the monitoring counters 57 and 59, the error signals 55 and 56 are not output.

On the other hand, for example, when an abnormality in which the frequency of the first clock 48 becomes high occurs, before the ripple carry output signal of the second monitoring counter 59 resets the first monitored counter 58. The ripple carry output signal of the first monitored counter 58, that is, the error signal 55 is output, and the error signal 55 is latched by the latch unit 65.

When an abnormality occurs in which the frequency of the second clock 49 increases, the error signal 56 is output from the second monitored counter 60 in the same manner, and the latch unit 66 outputs the error signal ( 56 is latched.

In addition, when the clocks 48 and 49 are stopped, the clock abnormality detection circuit 50 can also detect it. However, since the watchdog timers 46 and 47 are effective and forced to be reset, they do not become a dangerous state. .

With such a configuration, it is not necessary to use a dedicated clock for detecting a clock abnormality, and the clock abnormality can be detected using the clocks 48 and 49 used for the dual CPUs 41 and 42 as they are. And efficient use of hardware resources becomes possible. Therefore, reliability can be improved by a simple circuit structure.

In addition, since the preset data values of the counters 57 to 60 can be set arbitrarily, the deviation of the critical frequency can also be detected. Thereby, the operation delay time until driving and controlling the safety circuit part 13 can be shortened, and a higher safety design can be realized.

In addition, since four counters 57 to 60 and watchdog timers 46 and 47 are used in combination, it is possible to easily specify which of the clocks 48 and 49 has an abnormal frequency increase.

Next, the health check function of the clock abnormality detection circuit 50 is demonstrated. For example, when the test mode signal 51 is transmitted from the first CPU 41 to the clock abnormality detection circuit 50, the circuit is converted into the test circuit by the selector 61, and the first clock signal is It is multiplexed in the first multiplication circuit 62. That is, the first clock signal input to the first monitored counter 58 is intentionally brought into an abnormal state. For this reason, if the clock abnormality detection circuit 50 is normal, the error signal 55 will be output from the 1st monitored counter 58. As shown in FIG.

Therefore, in the CPU 41, the error signal 55 is received with respect to the transmission of the test mode signal 51, so that the integrity of the clock abnormality detection circuit 50 can be confirmed. Similarly, the second clock 49 side can also check the health.

By adding the health check function of the clock abnormality detection circuit 50 as described above, it is possible to detect a failure such as that the final output pin of the clock abnormality detection circuit 50 is stuck to the normal side and to further improve the reliability. Can be.

In this example, a circuit configuration of a dual system using two CPUs is shown, but a circuit configuration of a multiple system using three or more CPUs can also be used.

In this way, the electronic safety controller 21 of this example includes the first and second processing units which perform the operation related to the control of the elevator in a dual system, the first clock to send the first clock signal to the first processing unit, and the second processing unit to the second processing unit. A second clock for sending a clock signal, and a clock abnormality detection circuit for inputting first and second clock signals and detecting abnormalities of the first and second clock signals, wherein the clock abnormality detection circuit includes first and second signals; The number of pulses of the clock signal is counted, and abnormality of the first and second clock signals is detected from the difference in the number of pulses.

The clock abnormality detection circuit has a monitored counter for counting the number of pulses of one of the first and second clock signals, and a monitoring counter for counting the number of pulses of the other of the first and second clock signals, The preset data value, which is the count value at the start of counting with the monitored counter, is set larger than the preset data value, which is the count value at the start of counting with the monitoring counter. The number is reset and an abnormality in the first and second clock signals is detected by carrying over the monitored counter.

The monitoring counter includes a first monitoring counter that counts the number of pulses of the first clock signal, and a second monitoring counter that counts the number of pulses of the second clock signal. The monitored counter includes a first clock signal of the first clock signal. And a second monitored counter for counting the number of pulses and a second monitored counter for counting the number of pulses of the second clock signal.

In addition, the preset data value of the monitoring counter can be arbitrarily set. In addition, in the test mode, the clock signal input to the monitored counter is intentionally brought into an abnormal state, whereby the health of the clock abnormality detection circuit can be confirmed. It is. The clock abnormality detection circuit also has a multiplication circuit that multiplies the clock signal input to the monitored counter in the test mode.

<< Detecting abnormality in the stack area >>

Next, the abnormality detection of the stack area in RAM used for the electronic safety controller 21 is demonstrated. FIG. 8 is an explanatory diagram showing the area division in the RAM of the electronic safety controller 21 of FIG. 1. The RAM includes a stack area for storing information necessary for calculation by the CPU. In the stack area, for example, the return address of the subroutine call, the return address of the timer interrupt, and the argument of the subroutine call are stored.

The ROM also stores a program for monitoring the state of a preset monitoring area in the stack area of the RAM. In other words, the stack area monitoring unit has a CPU and a ROM.

In this example, the areas COOOH to FFFFH are set in the stack area. Moreover, the area | region of DOOOH-D010H in a stack area | region is set to the monitoring area | region.

The usage of the stack area is determined by the microcomputer, but generally, the stack pointer of the microcomputer is used to stack data on the younger side of the address. In the case of Fig. 8, the initial value of the stack pointer is set to FFFFH and used as FFFFH → FFFEH → FFFDH → ... C001H → COOOH. Therefore, the monitoring areas DOOOH to D010H are areas used when 75% of the stack area is used.

The position of the monitoring area is preferably an area used when 50% or more of the stack area is used. In particular, the area used when 60% or more of the stack area is used is preferable. In addition, the location of the monitoring area is preferably an area used when 90% or less of the stack area is used. In particular, the region used when 80% or less of the stack region is used is preferable.

The stack area is set to 0 in advance, and the stack area monitoring unit monitors whether or not the entire monitoring area is zero. If data other than 0 is included in the monitoring area, it is determined that a stackover has occurred.

FIG. 9 is a flowchart showing an initial operation of the electronic safety controller 21 of FIG. 1. Initial setting of the electronic safety controller 21 is performed at the time of elevator start-up. At the time when the initial setting is started, all interrupt operations are prohibited (step S1). After that, the initial setting of the microcomputer is performed (step S2), and the RAM area becomes O (step S3). After that, the interrupt operation becomes possible (step S4), and the interrupt wait state (step S5). The interrupt operation is repeatedly executed at each operation cycle time.

FIG. 10 is a flowchart showing a first example of the flow of an interrupt operation of the electronic safety controller 21 of FIG. 1. When the interrupt operation is started, the state of the monitoring area is first checked (step S31). That is, it is confirmed whether or not the state of the monitoring areas DOOOH to D010H is 000OH.

Here, when the monitoring area is not 000OH, it is determined that a stack over occurs in the RAM or a possibility of falling out due to the stack over is high. In other words, if the value of the monitoring area is other than 0, it is determined that there is no room in the interrupt operation processing time, and the stack operation occurs without the interrupt operation ending in the operation cycle time. In this way, when the stack over is detected, an operation for suddenly stopping the car 3 is executed (step S32), and an emergency stop command is output to the safety circuit unit 13. Moreover, when a stack over is detected, the abnormality detection signal is transmitted to an elevator monitoring room.

If there is no abnormality in the monitoring area, an input operation for inputting a signal for calculation is performed (step S33), and the car position calculation for calculating the current position of the car 3 and the distance from the current position to the terminal floor (step S34). , A speed calculation (step S35) for obtaining the speed of the car 3 from the movement amount of the car 3, and a judgment reference calculation for determining a judgment reference value (for example, FIG. 2) of the abnormal speed according to the distance to the terminal floor. (Step S36) is executed.

Thereafter, a safety monitoring operation for detecting an abnormality in the car speed from the car speed and the determination reference value is executed (step S37). When the safety monitoring operation or the sudden stop operation is executed, a monitor operation for monitoring display of the elevator state is executed (step S38). Finally, an output operation is executed to permit the running of the car 3 or to output a command signal necessary to suddenly stop the car 3 (step S39).

In such an electronic safety controller 21, when the state of the monitoring area is monitored by the stack area monitoring unit and it is determined that there is an abnormality in the monitoring area, the car 3 is suddenly stopped. Runaway is prevented. This prevents damage to the device in advance. In other words, it is possible to more reliably execute calculations related to operation control by the computer, and improve reliability.

Here, the abnormality due to the stack over (stack accumulation) is difficult to identify the cause, and it takes time to recover the failure. Stackover may occur due to microcomputer or program abnormality, but if there is no abnormality, the first factor of stackover is that interrupt operation does not end within the operation cycle time (operation timeout). do.

An operation time over does not normally occur, but arises by temporarily increasing an operation time, for example, when many call buttons are operated and it takes a long time for a call scan operation. It is also conceivable that the computation time increases gradually while the software is remodeled or improved, and the computation time is over.

If an operation timeout occurs, a stackover occurs, the stack area is used illegally, and there is a fear that the return address from the timer interrupt is broken. If the return address is broken, program congestion may occur or RAM data may be destroyed and elevator control may be impossible.

On the other hand, according to the electronic safety controller 21 of this example, the stackover can be detected earlier, the occurrence of program runaway or uncontrollability can be prevented in advance, and the reliability is improved.

In addition, since the stack area monitoring unit checks the monitoring area state at each preset operation period, the stack area monitoring unit can always monitor the presence or absence of stack over and further improve the reliability.

In addition, when it is judged that there is an abnormality in the monitoring area, the car 3 is suddenly stopped, so that it can be prevented from being connected to a larger failure.

In the above example, the car 3 is suddenly stopped when an abnormality in the monitoring area is detected, but the car 3 may be stopped on the last floor by outputting the latest floor stop command to the operation control unit 12. The passenger in the car 3 can be smoothly lowered to the platform.

When an abnormality in the monitoring area is detected, a signal for shifting the elevator to a safe state may be output, and the state of the electronic safety controller 21 at that time may be recorded as a history (history calculation). The history is recorded in an area other than the stack area of the RAM, for example. This can prevent stackovers from occurring or help identify the cause of the stackovers. In addition, the failure recovery time can be shortened.

In this way, the electronic safety controller 21 in this example is a RAM in which a stack area for storing information necessary for calculation for monitoring the safety of an elevator is set, and a stack for monitoring the state of a preset monitoring area in the stack area. An area monitoring unit is provided, and the operation of the elevator is controlled in accordance with the monitoring area state detected by the stack area monitoring unit.

In addition, the stack area monitoring unit checks the monitoring area state every predetermined operation period. In addition, the confirmation of the monitoring area state is executed as part of an interrupt calculation process for monitoring the safety of the elevator.

<< Abnormal detection of calculation processing execution order >>

Next, the abnormality detection method of the execution procedure of the arithmetic processing in the electronic safety controller 21 is demonstrated. FIG. 11 is a flowchart showing a second example of the flow of interrupt calculation by the electronic safety controller 21 of FIG. 1.

When the interrupt operation is started, the pattern of processing information written into the RAM is first checked (step S41). Here, the numerical value (identification value) set in advance for each task (functional unit) of the calculation processing is used as the processing information. The processing information is written to a table set in a predetermined area in the RAM. In this example, identification values 1 to 7 are assigned to seven arithmetic operations, and identification values are written in the corresponding TBL [0] to [6]. TBL [7] to [9] remain zero because there is no corresponding operation processing.

If the pattern of the process information is normal, the TBL [0] to [9] and the storage pointer of the table are initialized to 0 (step S42). Subsequently, an input operation (step S43) for inputting a signal required for the calculation, a position calculation (step S44) for calculating the current position of the car and the distance from the current position to the terminal floor, and a speed for obtaining the speed from the moving amount of the car The calculation (step S45) and the decision reference calculation (step S46) for determining the judgment reference value (for example, FIG. 2) of the abnormal speed according to the distance to the terminal layer are performed.

After that, a safety monitoring operation for detecting an abnormality of the car speed from the car speed and the determination reference value is executed (step S47). When the safety monitoring operation or the sudden stop operation is executed, a monitor operation for monitoring the elevator state is executed (step S48). Finally, in accordance with the result of the safety monitoring operation, an output operation is executed to permit the running of the car or to output a command signal necessary to suddenly stop the car (step S49).

Immediately after each operation is executed, the identification value is written into the corresponding table (steps S50 to 56). In other words, the arithmetic processing and writing of the identification value are alternately executed.

Specifically, immediately after the input operation, which is the first operation, is executed, 1 is written to TBL [P], and 1 is added to the storage pointer P (step S15). Next, immediately after the car position calculation is performed, 2 is written to TBL [P], and 1 is added to the storage pointer P (step S16). This process is executed in sequence, and 7 is written into TBL [6] immediately after the output operation, which is the last operation, is executed.

The pattern of the identification value written in this way is confirmed at the start of the next interrupt operation (step S41). That is, by checking the pattern of the identification value, it is determined whether the execution order of the calculation processing is normal.

If an abnormality is detected in the execution order of the arithmetic processing, a sudden stop calculation for sudden stop of the car is executed (step S57). Moreover, when an abnormality is detected in the execution order of arithmetic processing, an abnormality detection signal is transmitted to an elevator monitoring room. When the sudden stop operation is executed, the monitor operation is executed (step S58), an output operation for outputting a command signal necessary for sudden stop of the car is executed (step S59), and the interrupt operation processing ends.

Such an electronic safety controller 21 can quickly detect an abnormality in the execution order of the calculation processing, thereby making it possible to more reliably execute the calculation relating to the operation control by the computer and to improve the reliability. In addition, it is also possible to detect an abnormality that is magnetically looped due to a program error. That is, the present invention can be applied to a driving control device and a safety device.

Here, the abnormality in the execution order of the calculation processing is difficult to identify the cause, and takes time to repair the failure. The abnormality in the execution order of the operation processing may be caused by an abnormality of a microcomputer or a program. However, if there is no abnormality in these, the first factor is considered that the interrupt operation does not end within the operation cycle time (operation time over).

An operation time over usually does not occur, but occurs when the operation time is temporarily increased, for example, when a call button is operated a lot and a long time is required for the call scan operation. It is also conceivable that the computation time increases gradually while the software modification or improvement is repeated, resulting in computation time over.

On the other hand, according to this electronic safety controller 21, abnormality in the execution order of arithmetic processing can be detected earlier, the occurrence of secondary failure can be prevented beforehand, and reliability improves.

In addition, since the electronic safety controller 21 checks the pattern of the processing information for each preset calculation cycle, the electronic safety controller 21 can always monitor the presence or absence of abnormality and further improve the reliability.

Further, when it is determined that there is an abnormality in the execution order of the arithmetic processing, the car is stopped suddenly, so that it is possible to prevent the car from being connected to a larger failure.

In addition, in the above example, when it is determined that there is an abnormality in the execution order of the arithmetic processing, the car 3 is suddenly stopped, but the nearest floor stop command is output to the operation control unit 12 so that the car 3 is moved to the last floor. The passengers in the car 3 can be smoothly lowered to the platform.

In addition, when an abnormality is detected in the execution order of the calculation processing, a signal for shifting the elevator to a safe state may be output, and the state of the electronic safety controller 21 at that time may be recorded as a history (history calculation).

Further, in the above example, the processing information is assigned to all calculation processes, but may not necessarily be all. In other words, the processing information may be given only to the calculation processing for which the execution order is to be monitored.

Thus, the electronic safety controller 21 in this example is provided with the controller main body which has the program storage part which stored the RAM and the program concerning safety monitoring, and the processing part which performs a some calculation process based on a program, When the controller main body executes arithmetic processing, it writes process information corresponding to each arithmetic processing into the RAM and monitors whether or not the execution order of arithmetic processing is normal from the pattern of process information written in the RAM.

The processing information is a numerical value set in advance for each calculation processing. In addition, the control apparatus main body confirms the pattern of the processing information every predetermined calculation cycle. Further, writing of the processing information and confirming the pattern of the processing information are executed as part of an interrupt calculation process for monitoring the safety of the elevator.

<< detection of power supply voltage error >>

 Next, the abnormality detection method of the power supply voltage in the electronic safety controller 21 is demonstrated. 12 is a block diagram showing a main part of the electronic safety controller 21 of FIG. 1. In this example, command signals of two systems are output to the elevator control panel 11 to improve the reliability. For this reason, a dual circuit configuration is employed, and the first and second CPUs (processing units) 41 and 42 are used.

The first CPU 41 outputs a command signal to the elevator control panel 11 via the first output interface 43. The second CPU 42 outputs a command signal to the elevator control panel 11 via the second output interface 44. When the elevator control panel 11 receives a command signal from the first and second output interfaces 43 and 44, the elevator control panel 11 transfers the elevator to a safe state.

Two port RAMs 45 are connected to the first and second CPUs 41 and 42 for carrying data between them. The signal from the first sensor is input to the first CPU 41. The signal from the second sensor is input to the second CPU 42.

The signals from the first and second sensors are computed by the CPUs 41 and 42, whereby the speed and position of the car 3 are obtained. As a 1st and 2nd sensor, the governor encoder 18 is mentioned, for example.

The result data of the arithmetic processing in the CPUs 41 and 42 is received by the CPUs 41 and 42 from each other via the two port RAM 45. Then, the CPUs 41 and 42 compare with the result data of each other, and if the significant difference is seen in the calculation result or if the overspeed (over speed) is confirmed, the output interface 43 or 44 is used. The command signal is output to the elevator control panel 11, and the elevator enters the safe state.

In addition, the elevator control apparatus is provided with a + 5V power supply voltage monitoring circuit 71 and a + 3.3V power supply voltage monitoring circuit 72 for monitoring the power supply voltages of the CPUs 41 and 42. The power supply voltage monitoring circuits 71 and 72 are configured by, for example, an integrated circuit (IC).

The power supply voltage monitoring circuits 71 and 72 monitor whether or not a stable power supply voltage is supplied to the CPUs 41 and 42. When a power supply voltage abnormality such as out of the rated voltages of the CPUs 4L and 42 occurs, a forced reset is applied to the CPUs 41 and 42 based on information from the power supply voltage monitoring circuits 71 and 72, and fail safe. The car 3 is suddenly stopped by the safety circuit part 13 designed at will.

The monitoring voltage is input into the + 5V power supply voltage monitoring circuit 71 from the first monitoring voltage input circuit 73. The monitoring voltage is input to the + 3.3V power supply voltage monitoring circuit 72 from the second monitoring voltage input circuit 74.

The power supply voltage monitoring circuits 71 and 72 and the CPUs 41 and 42 are provided as voltage monitoring health check function circuits 75 (hereinafter referred to as check function circuits 75) that monitor the health of the power supply voltage monitoring circuits 71 and 72. Abbreviated) is connected. The check function circuit 75 is composed of a programmable gate IC such as a field programmable gate array (FPGA), for example. In addition, the check function circuit 75 can be realized even in an ASIC, CPLD, PLD, gate array, or the like.

When an abnormality in the power supply voltage is detected, voltage abnormality detection signals 81 and 82 are output from the power supply voltage monitoring circuits 71 and 72 to the check function circuit 75, and the CPUs 41 and 42 from the check function circuit 75. ), Reset signals 83 and 84 are output.

In addition, control signals 85 and 86 from the CPUs 41 and 42 are input to the check function circuit 75. The voltage input pins of the power supply voltage monitoring circuits 71 and 72 are supplied from the check function circuit 75. Monitoring input voltage forced change signals 87 and 88 for forcibly changing to low voltage are output.

When the supervisory input voltage forced change signals 87 and 88 are outputted, the voltage input pins of the power supply voltage supervisory circuits 71 and 72 are forcibly dropped to low voltage by the supervisory input voltage forced change circuits 76 and 77. Lose.

 The check function circuit 75 is connected to the first data path 78 for the first CPU 41 and the second data path 79 for the second CPU 42.

The programs for determining the position and speed of the car 3, the program for determining the abnormality of the elevator, the program for confirming the soundness of the power supply voltage monitoring circuits 71 and 72, and the like are described in the CPU 41 and 42. It is stored in R0M, which is a storage unit connected to.

FIG. 13 is a circuit diagram illustrating an example of a specific configuration of the check function circuit 75 of FIG. 12. The control signals 85 and 86 include selection signals 89 and 90, output signals 91 and 92, and chip select signals 93 and 94.

The selection signals 89 and 90 are two-bit signals for selecting which power supply voltage monitoring circuits 71 and 72 are checked for health. The output permission signals 91 and 92 permit the output of the monitoring input voltage forced change signals 87 and 88 from the check function circuit 75 and latch the contents selected by the selection signals 89 and 90. It is a signal. In other words, the output permission signals 91 and 92 also serve as latch trigger signals.

When an abnormality in the power supply voltage is detected, the voltage abnormality detection signals 81 and 82 are latched by the voltage abnormality signal latch circuit 101 in the check function circuit 75. The latch state in the voltage abnormal signal latch circuit 101 is released by inputting the latch release signals 95 and 96 which are part of the control signals 85 and 86.

The selection signals 89 and 90 are input to the first and second selectors 102 and 103. The first and second selectors 102 and 103 switch whether to check the health of one of the power supply voltage monitoring circuits 71 and 72 based on the selection signals 89 and 90. The content selected by the selectors 102 and 103 is latched by the first and second selection content latch circuits 104 and 105.

The change signal output buffer 106 is entered in front of the output of the monitoring input voltage forced change signals 87 and 88.

The check function circuit 75 is provided with a plurality of data bus output buffers 107 of the first CPU 41 and a plurality of data bus output buffers 108 of the second CPU 42.

Here, FIG. 14 is a description showing the meaning of data regarding each bit of the data buses 78 and 79 when the first and second CPUs 41 and 42 read the check function circuit 75 of FIG. It is also.

Next, FIG. 15 is a flowchart showing the power supply voltage monitoring health check method on the first CPU 41 side in FIG. The electronic safety controller 21 executes an interrupt operation including calculation processing for abnormality monitoring of the elevator, such as overspeed of the car 3, every calculation cycle (for example, 5 msec). When the interrupt routine main routine is executed, it is determined whether or not the health check of the power supply voltage monitoring circuits 71 and 72 is to be performed (step S11).

The health check is performed at a preset timing. In other words, the health check is performed when the stationary state of the car 3 has elapsed in advance. Specifically, it is carried out when there are few passengers or when driving at night.

If you do not perform the health check, you return to the main routine. When performing the health check, first, the latch states of the voltage abnormality detection signals 81 and 82, which are error signals in the check function circuit 75, are released. That is, the latch release signal 95 is output to the check function circuit 75 (step S12). The latch release signal 95 is input to the voltage abnormality signal latch circuit 101 to release the latch states of the voltage abnormality detection signals 81 and 82.

Next, after confirming that the output permission signal 91 of the first CPU 41 is high (step S13), the output permission signal 92 is set to high for the second CPU 42 as well. Obtained via the port RAM 45 (step S14).

Thereafter, the select signal 89 for selecting which of the power supply voltage monitoring circuits 71 and 72 is to be checked for health is output to the check function circuit 75 and latched (step S15).

Subsequently, it obtains via the two-port RAM 45 so as to lower the output permission signal 92 for the second CPU 42 (step S6). When it is confirmed that the output permission signal 92 is low, the output permission signal 91 is set low (step S7). As a result, in the check function circuit 75, the select signal 89 is latched by the selection latch circuit 104 in synchronization with the falling of the output permission signal 91. Then, the monitoring input voltage forced change signal 87 is output from the check function circuit 75 to the power supply voltage monitoring circuit 71.

As a result, voltage abnormality is detected in the power supply voltage monitoring circuit 71, and the voltage abnormality detection signal 81 is input to the check function circuit 75. In the check function circuit 75, the voltage abnormality detection signal 81 is latched by the voltage abnormality signal latch circuit 101. At the same time, the reset signals 83 and 84 from the check function circuit 75 are input to the CPUs 41 and 42 (step S8), whereby the CPUs 41 and 42 reset.

At this time, only one power supply voltage monitoring circuit is checked in one health check operation. Subsequently, when the health check of the other power supply voltage monitoring circuit is performed, the check of one power supply voltage monitoring circuit is finished and then the health check of the other power supply voltage monitoring circuit is performed. Even when a plurality of power sources having different voltages are supplied to one CPU and a plurality of power supply voltage monitoring circuits are set accordingly, the health check of each power supply voltage monitoring circuit is sequentially performed one by one. In this way, the health check of the plurality of power supply voltage monitoring circuits can be set in advance on a program (software).

FIG. 16 is a flowchart showing the operation when the CPUs 41 and 42 are reset in the elevator control device of FIG. The cause of the reset of the CPUs 41 and 42 is, of course, not only by the health check but also by the abnormal power supply voltage or other reasons.

When the reset is applied, the CPUs 41 and 42 first start the software initialization process (step S19). Next, in the initialization process, the data of the check function circuit 75 is read (step S20). Then, the state before the reset is confirmed from the latched contents, and the abnormality of the power supply voltage and the failure of the power supply voltage monitoring circuits 71 and 72 are determined (step S21). That is, it is determined whether the reset is caused by a health check or a genuine power supply voltage abnormality.

For example, if the output of the output permission signals 91 and 92 is not made low, but a voltage abnormality is shown, it is determined that a true power supply voltage abnormality has occurred. In addition, when the output of the output permission signals 91 and 92 is set low, and no voltage abnormality appears in the data of the check function circuit 75, the power supply voltage monitoring circuits 71 and 72 or the check function circuit 75 ) It is considered to be a failure of itself. In this state, if the monitoring input voltage forced change signals 87 and 88 are outputted, it is determined that the power supply voltage monitoring circuits 71 and 72 are broken and the monitoring input voltage forced change signals 87 and 88 are outputted. If not, it is determined that the check function circuit 75 itself is broken.

If no abnormality or failure is detected as a result of the data read of the check function circuit 75, the transition to the main routine is permitted (step S22). However, although the reset regarding the power supply voltage is described here, the reset may be performed by detecting other faults or by checking the health of other circuits. Will be granted.

If any abnormality or failure is found as a result of the data read of the check function circuit 75, the command signal is output to the elevator control panel 11 (step S23), and the elevator is moved to the safe state.

The electronic safety controller 21 can monitor not only the abnormality of the power supply voltage but also the failure of the power supply voltage monitoring circuits 71 and 72, so that the reliability of the power supply voltage can be further improved.

In addition, in the past, a dual system may be used for each power supply voltage monitoring circuit for fail safe and safety. However, since the electronic safety controller 21 does not need the above, the configuration is simple and the cost is increased. It can also be suppressed. In addition, reliability is equivalent to the case where each power supply voltage monitoring circuit is a dual system.

In addition, a dual-circuit circuit configuration using two CPUs 41 and 42, and the health check operation by each of the CPUs 41 and 42 can be mutually confirmed through the two-port RAM 45, thus providing a check function. Failure of the circuit 75 or software can also be detected.

Thus, the electronic safety controller 21 in this example is provided with the processing part which performs the process regarding safety monitoring of an elevator, and the power supply voltage monitoring circuit which monitors the power supply voltage supplied to a processing part, and inputs it to a power supply voltage monitoring circuit. A voltage monitoring integrity check function circuit for outputting a forced input voltage change monitoring signal for forcibly changing a power supply voltage according to a control signal from the processing unit and inputting a voltage abnormality detection signal from the power supply voltage monitoring circuit is further included. And the voltage monitoring health check function circuit maintains at least a part of the contents of transmission and reception of signals to and from the processing unit and the power supply voltage monitoring circuit, and the processing unit reads the data held in the voltage monitoring health check function circuit. Check.

In addition, the processing unit includes first and second CPUs, and the first and second CPUs can check the health check operation by the first and second CPUs through the two-port RAM.

Further, a monitoring input voltage forced change circuit for forcibly lowering the power supply voltage input to the power supply voltage monitoring circuit by the input of the monitoring input voltage forced change signal is further provided.

The power supply voltage monitoring circuit includes a plurality of power supply voltage monitoring circuits for monitoring voltages of a plurality of power sources having different voltages, and a plurality of power supply voltage monitoring circuits are included in the control signal from the processing unit to the voltage monitoring health check function circuit. A selection signal for selecting which circuit is to be checked for health is included.

In addition, the processing unit can sequentially perform the health check of each power supply voltage monitoring circuit one by one.

The voltage monitoring health check function circuit is constituted by a programmable gate IC.

<< ETS initial setting >>

Next, the initial setting operation of the ETS circuit section 22 will be described. As described above, the ETS circuit unit 22 detects the position of the car 3 independently of the operation control unit 12. For this reason, the initial setting operation (initial setting operation step) of the ETS circuit part 22 is performed, for example at the time of starting of an elevator. Moreover, even if a deviation arises between the positional information of the cage | basket | car 3 in the operation control part 12, and the positional information of the cage | basket | car 3 in the ETS circuit part 22 for some reason. The initial setting operation of the ETS circuit section 22 is performed. When the initial setting operation is performed as described above, the operation mode of the driving control unit 12 is switched to the initial setting operation mode.

FIG. 17 is an explanatory diagram showing a relationship between the steps of the initial setting operation of the ETS circuit unit 22 of FIG. 1 and the operation of the operation control unit 12 and the safety circuit unit 13. In the initial setting operation, speed detection initial setting is performed first, and then position detection initial setting is performed.

At the start of the initial setting operation, the drive device 7 is in an emergency stop state by the safety circuit unit 13. That is, the motor power supply of the drive device 7 is cut off, and the brake unit 9 of the drive device 7 is in a braking state. In addition, a command incapable of driving is output from the ETS circuit unit 22 to the driving control unit 12.

Until the speed detection initial setting is completed, the safety circuit unit 13 is in an emergency stop state, and the operation control unit 12 remains inoperable. Therefore, monitoring by the ETS circuit part 22 is impossible.

When the speed detection initial setting is completed, the permission signal for low speed operation is output from the electronic safety controller 21 to the operation control unit 12. In addition, the emergency stop state of the safety circuit unit 13 is released. In this state, the ETS circuit section 22 performs the position detection initial setting operation.

In the position detection initial setting operation, the car 3 travels from the lower part of the hoistway 1 to the upper part at a speed below the collision allowable speed of the shock absorbers 27 and 28. In the ETS circuit section 22, the relationship between the signal from the governor encoder 18 and the position of the car 3 in the hoistway 1 is set.

When the initial setting operation ends, a permission signal for enabling high speed (rated speed operation) operation is output from the electronic safety controller 21 to the operation control unit 12. In the ETS circuit section 22, high-speed monitoring is enabled.

Next, FIG. 18 is explanatory drawing explaining the movement of the cage | basket | car 3 in the initial setting operation mode of the elevator apparatus of FIG. In the initial setting operation mode, after completion of the speed detection initial setting, the car 3 moves to the entry start position of the bottom floor of the hoistway 1. The floor bottom entry start position is a position where the car 3 is located above the car buffer 27 at a lower level than the lowest floor position P _BOT . Moreover, when the cage | basket | car 3 is located in the floor bottom entry start position, the cage | basket | car 3 (specifically, the operation plates of the reference sensors 23-26 installed in the cage | basket | car 3) is a 4th reference | standard. It is located below the sensor 26.

The hoistway 1 is provided with a plurality of end point switches (not shown) for detecting the position of the lowermost floor or the uppermost floor by the driving control unit 12. And the movement of the cage | basket | car 3 to the floor bottom entry start position is controlled by the operation control part 12. FIG.

Subsequently, while raising the car 3 from the floor-floor starting position, the virtual current position P _current of the car 3 corresponding to the signal from the governor encoder 18. _tmp is obtained. Specifically, the layer bottom writing start position is zero.

P _{current tmp} ← O

After that, the virtual current position is updated every calculation cycle (for example, 100 msec).

Here, the up-down counter which counts the encoder pulse of the governor encoder 18 is set in the ETS circuit part 22, and the movement amount in the calculation cycle of an up-down counter is set.

Is GC1, the virtual current position P _{current in the} Nth operation cycle. _tmp is

P _{current tmp N} ← P _{current tmp N-1} + GC1

Obtained by Specifically, the virtual current position or the amount of movement in the calculation cycle is obtained as the number of pulses of the encoder pulse.

As described above, the virtual current position is updated as the car 3 rises, and the position where the operation plate enters the reference sensors 23 to 26 and the position where the operation plate escapes from the reference sensors 23 to 26. Is written in the table of the storage unit (memory) set in the ETS circuit unit 22.

For example, if it is detected that the entry into the fourth reference sensor 26 in the N-th operation cycle,

Entry position P _{tmp ETSD} Is

P _{tmP ETSD} ← P _{current tmp N-1} + GC1-GC2

Obtained by However, GC2 is an amount of movement of the up-down counter after entering the fourth reference sensor 26.

The entry positions to the other reference sensors 23, 24 and 25 are likewise written in the table. If the escape from the reference sensor 26 is detected in the Nth operation cycle, the escape position _{PtmP ETSU is}

P _{temp ETSU} ← P _{current tmp N-1} + GC1-GC3

Obtained by However, GC3 is an amount of movement of the up-down counter after escaping from the fourth reference sensor 26.

The escape positions from the other reference sensors 23, 24 and 25 are likewise written in the table.

In this way, when the entry of all the entry positions and exit positions is completed, the cage | basket | car 3 is located in the uppermost position P _TOP . Is stopped.

Here, the operation control unit 12 is set with data of the lowest floor position P _BOT and the highest floor position P _TOP based on the virtual zero point. And when the cage | basket | car 3 stops at the uppermost floor position P _TOP , the lowermost floor position P _BOT on the basis of a virtual 0 point. And data of the uppermost floor position P _TOP is transmitted from the driving control unit 12 to the electronic safety controller 21. The electronic safety controller 21 converts the position data written in the table determined as the virtual current position into data based on the virtual zero point based on the information transmitted from the driving control unit 12. This enables the detection of the current position P _current on the basis of the virtual zero point.

The amount of correction δ at the current position

δ = P _TOP- P _{current tmp N}

Obtained by Therefore, when the correction amount δ is added to the position data written in the table, the position data on the basis of the virtual zero point is obtained. The position data after the correction is written into the E ² PROM of the electronic safety controller 21, and this data is then used.

During the top floor stop, the following processing is performed and the position management is changed from the virtual current position to the current position.

P _{current 0} ← P _TOP

P _{current N} ← P _{current N-1} + GC1

When this correction is completed and the position management is shifted to the current position management, a command of high speed operation is output from the electronic safety controller 21 to the operation control unit 12, and high speed automatic operation, that is, execution of the normal operation mode is permitted. . In the ETS circuit section 22, a normal monitoring operation is performed. In the normal monitoring operation, the distance L1 of the elevator car 3 from the upper surface of the car shock absorber 27 and the distance L2 of the counterweight 4 from the upper surface of the counterweight buffer 28 are given by the following equation. It is calculated for each operation cycle.

L1 = P _{current N-} (P _{BOT ~} L _KRB )

L2 = (P _TOP - L _CRB )-P _{current N}

However, L _KRB The distance from the upper surface of the car shock absorber 27 to the lowest floor position P _BOT , L _{CRB is the} position of the car 3 when the counterweight 4 collides with the counterweight shock absorber 28 from the uppermost floor position P _TOP . CWT collision location).

In such an elevator apparatus, the car 3 runs below the collision allowable speed of the car shock absorber 27 until the initial setting operation is completed. The collision with (27) can be prevented more surely, and the reliability can be improved.

In the above example, the initial setting operation is performed in two stages of the initial speed detection and initial position detection, but the initial setting operation is performed in three or more steps, and the traveling speed of the car to be allowed in each step is set. You may also

The initial setting operation is not limited to the speed detection initial setting and the position detection initial setting.

Thus, the elevator apparatus in this example is provided with the elevator control apparatus which has the operation control part which controls the operation of a car, and the monitoring part (electronic safety controller 21) which detects the abnormality of the running of a car, In performing the initial setting, the driving control unit is configured to drive the car at a lower speed than in normal operation according to the stage of the initial setting.

In addition, the monitoring unit outputs a permission signal relating to the speed of the car to the operation control unit in accordance with the initial setting step.

Further, the driving control unit is configured to selectively control a plurality of driving modes including an initial setting driving mode for initial setting of the monitoring unit while driving the normal driving mode and the car, thereby controlling the driving of the car. In the initial setting operation mode, the car is driven at a lower speed than the normal operation mode according to the stage of the initial setting.

Moreover, the control method of the elevator apparatus in this example includes the initial setting operation step which performs the initial setting of the monitoring part which detects the abnormality of the running of a car while driving a car, and the initial setting operation step of the initial setting operation step. According to the steps, the car is driven at a lower speed than normal operation.

<< Detection of relay contact

Next, FIG. 19 is a circuit diagram which shows the contact abnormality detection part of the electronic safety controller 21 of FIG. The safety circuit unit 13 includes a brake power contactor coil 111 for supplying electric power to the brake unit 9, a motor power contactor coil 112 for supplying electric power to the motor unit of the driving device 7, and a contactor. It has a safety relay main contact 113 and a bypass relay main contact 114 connected in parallel with the safety relay main contact 113 for interrupting the application of the voltage to the coils 111 and 112. have.

The brake power contactor coil 111, the motor power contactor coil 112 and the safety relay main contact 113 are connected in series with each other with respect to the power supply. The safety relay main contact 113 is closed during normal operation. In addition, the safety relay main contact 113 is opened at the time of an abnormality of an elevator, for example, when the traveling speed of the cage | basket | car 3 exceeds the preset speed. The bypass relay main contact 114 is open during normal operation.

The electronic safety controller 21 includes a safety relay coil 116 for operating the controller main body 115 and a safety relay main contact 113, a bypass relay coil 117 for operating the bypass relay main contact 114, and , The safety relay monitor contact 118 is mechanically linked to the safety relay main contact 113, and the bypass relay monitor contact 119 is opened and closed by mechanically interlocking the bypass relay main contact 114. .

The safety relay coil 116, the bypass relay coil 117, the safety relay monitor contact 118, and the bypass relay monitor contact 119 are connected to each other in parallel with the controller main body 115.

The safety relay main contact 113 and the safety relay monitor contact 118 are mechanically connected by a link mechanism (not shown). Therefore, when either one of the contacts 113 and 118 becomes inoperable by welding etc., the other becomes inoperable.

The bypass relay main contact 114 and the bypass relay monitor contact 119 are mechanically connected by a link mechanism (not shown). Therefore, when either of the contacts 114 and 119 becomes inoperable by welding or the like, the other becomes inoperable.

The controller main body 115 includes a processor 120, a memory 121, an input / output unit 122, a safety relay monitor contact receiver circuit 123, a bypass relay monitor contact receiver circuit 124, and a safety relay driver circuit 125. ) And bypass relay driver circuit 126.

As the processing unit 120, for example, a CPU is used. As the storage unit 121, for example, a RAM, a ROM, a hard disk device, and the like are used. The storage unit 121 stores, for example, data for determining an abnormality of the elevator, a program for performing an operation test of the safety relay main contact 113, and the like.

The processor 120 transmits and receives signals with the operation controller 12 and various sensors through the input / output unit 122.

The safety relay monitor contact receiver circuit 123 is connected in series with the safety relay monitor contact 118 and detects the open / closed state of the safety relay monitor contact 118. The bypass relay monitor contact receiver circuit 124 is connected in series with the bypass relay monitor contact 119 and detects an open / closed state of the bypass relay monitor contact 119.

The safety relay driver circuit 125 is connected in series with the safety relay coil 116 to switch the excitation and non-excitation of the safety relay coil 116. The bypass relay driver circuit 126 is connected in series with the bypass relay coil 117 to switch the excitation and non-excitation of the bypass relay coil 117.

The switching of the excitation and non-excitation of the safety relay coil 116 is performed by outputting a safety relay command signal from the processing unit 120 to the safety relay driver circuit 125. The switching of the excitation and non-excitation of the bypass relay coil 117 is performed by outputting a bypass command signal from the processing unit 120 to the bypass relay driver circuit 126.

The receiver circuits 123 and 124 and the driver circuits 125 and 126 are connected to each other in parallel with the processing unit 120.

Next, the operation will be described. During operation of the elevator, the controller main body 115 monitors the abnormality of the elevator based on information from various sensors. When an abnormality of the elevator is detected by the processing unit 120, the drive of the safety relay coil 116 is restrained by the safety relay driver circuit 125.

As a result, the safety relay main contact 113 is opened to block the energization of the contactor coils 111 and 112. As a result, the rotation of the drive sheave 8 is braked by the brake part 9, the energization to the motor part is interrupted | blocked, and the cage | basket | car 3 is stopped quickly.

Next, the operation test method of the safety relay main contact 113 is demonstrated. 20 is a flowchart for explaining an operation test method of the safety relay main contact 113 of FIG. 19. In this embodiment, every time the cage | basket | car 3 stops at a stationary floor at the time of normal operation, an operation test is implemented. Therefore, during normal operation, the processing unit 120 monitors whether or not the running speed of the car 3 has become zero by information from various sensors (stop detection step S61).

When the speed of the car 3 becomes 0 and becomes a safe state, the bypass relay coil 117 is excited by the bypass relay driver circuit 126, and then waits for a preset time, here 100 ms (step S62). ). Then, it is confirmed by the bypass relay monitor contact receiver circuit 124 whether the bypass relay monitor contact 119 is closed (step S63).

If the bypass relay monitor contact 119 is not closed, it means that the bypass relay main contact 114 is not closed. Therefore, it is determined by the processing unit 120 that the bypass relay has failed, and the controller main body 115 The abnormality detection signal is output to the operation control part 12 (step S64).

When it is confirmed that the bypass relay monitor contact 119 is normally closed, the safety relay coil 116 is excited by the safety relay driver circuit 125, and then waits for a preset time, here 100 ms (test command step S65). ). Then, whether or not the safety relay monitor contact 118 is opened is confirmed by the safety relay monitor contact receiver circuit 123 (abnormal detection step S66).

If the safety relay monitor contact 118 is not open, it means that the safety relay main contact 113 is not open due to welding or the like. Therefore, it is determined by the processing unit 120 that the safety relay has failed and the controller body ( The abnormality detection signal is output from the 115 to the operation control part 12 (step S64).

When it is confirmed that the safety relay monitor contact 118 is normally opened, this time the safety relay coil 116 is in an unexcited state, and then waits a preset time, here 100 ms (step S67). Then, whether or not the safety relay monitor contact 118 is closed is confirmed by the safety relay monitor contact receiver circuit 123 (step S68).

If the safety relay monitor contact 118 is not closed, it is determined by the processing unit 120 as a safety relay failure, and an abnormality detection signal is output from the controller main body 115 to the operation control unit 12 (step S64).

When it is confirmed that the safety relay monitor contact 118 is normally closed, the bypass relay coil 117 becomes non-excited, and then waits for a preset time, here 100 ms (step S69). Then, it is confirmed by the bypass relay monitor contact receiver receiver circuit 124 whether the bypass relay monitor contact 119 is opened (step S70).

If the bypass relay monitor contact 119 is not open, it is determined by the processing unit 120 that the bypass relay has failed, and an abnormality detection signal is output from the controller main body 115 to the operation control unit 12 (step S64).

In this way, when the test of the opening / closing operation | movement of the safety relay main contact point 113 and the bypass relay main contact point 114 is complete | finished, it waits until the traveling speed of the cage | basket | car 3 becomes more than preset value (step) S71), and the running speed is monitored by the ETS circuit part 22 until the car 3 stops next. And every time the cage | basket | car 3 stops, said operation test is implemented and the soundness of the safety circuit part 13 is confirmed.

In such an elevator safety device, since the operation test of the safety relay main contact point 113 is performed using the timing at which the car stopped during normal operation, the safety relay main contact point 113 does not cause a problem in normal operation. Abnormality can be detected, and reliability can be improved.

In addition, since the operation test was performed every time the car stopped, the operation of the safety relay main contact 113 can be confirmed at a sufficient frequency, and the reliability can be further improved.

In addition, since the bypass relay main contact 114 is closed during the operation test of the safety relay main contact point 113, it is possible to prevent the energization of the safety circuit unit 13 from being interrupted during the operation test. The operation test can be carried out while maintaining (13).

Also, since the safety relay main contact 113 and the bypass relay main contact 114 are normally returned to their original state, the reliability can be further improved.

In the above example, the brake unit 9 brakes when the safety relay main contact 113 is opened. However, the brake unit may also brake when the safety relay main contact is closed. Operational tests of the safety relay main contacts may be carried out.

Moreover, in the above example, although the safety relay main contact point for operating the brake part 9 provided in the drive apparatus 7 was shown, for example, the rope brake which grasps a main rope, and brakes a cage | basket | car, a cage | basket | car, Alternatively, it can be applied to the safety relay main contact for operating the emergency stop mounted on the counterweight.

In the above example, the operation test is performed every time the car 3 stops, but the timing of the operation test is not limited to this. For example, a counter for counting the number of stops of a car may be provided in the detection circuit main body, and an operation test may be performed for each preset number of stops. The operation test may then be performed when the car first stops. In addition, an operation test may be performed only when the normal operation of the elevator is started (at startup). Moreover, you may make it perform an operation test only when it stops in a preset floor.

As described above, the electronic safety controller 21 in this example generates a safety relay command signal for operating the safety relay main contact in the direction in which the brake unit brakes when the car stops during normal operation. Detects whether or not the safety relay main contact is operated in accordance with the safety relay command signal.

In addition, the electronic safety controller 21 is provided with a safety relay monitor contact which is opened and closed by mechanically interlocking with the safety relay main contact, and the electronic safety controller 21 detects the safety relay main contact state from the safety relay monitor contact state. .

In addition, the safety relay main contact is closed in normal operation, and is opened in case of an abnormality in an elevator, is connected in parallel with the safety relay main contact, and the bypass relay main contact which is opened in normal operation is installed in the safety circuit. When the safety relay command signal is generated, the electronic safety controller 21 generates a bypass command signal for closing the bypass relay main contact point before that.

The electronic safety controller 21 has a bypass relay monitor contact which is opened and closed by mechanically interlocking with the bypass relay main contact, and the electronic safety controller 21 bypasses the bypass relay from the bypass relay monitor contact state. The state of main contact is detected.

In addition, the electronic safety controller 21 detects whether or not the bypass relay main contact has operated in accordance with the bypass command signal.

When the electronic safety controller 21 detects an abnormality of the safety relay main contact point, the electronic safety controller 21 outputs an abnormality detection signal to the operation control unit.

<< record of the movement history >>

FIG. 21 is a block diagram showing a state where the history information recording unit and the health diagnosis unit are connected to the electronic safety controller 21 of FIG. 1. The electronic safety controller 21 is connected to a history information recording unit 131 in which a history (process) of information relating to the determination processing in the electronic safety controller 21 is recorded. As the history information recording unit 131, a nonvolatile memory that retains information even when the power supply of the elevator control device is cut off is used. As such a memory, a flash memory, a hard disk device, etc. are mentioned, for example.

The electronic safety controller 21 and the history information recording unit 131 are connected to a health diagnosis unit 132 for automatically diagnosing the health of the electronic safety controller 21. The health diagnosis unit 132 can also diagnose the health of the whole system such as various sensors and the safety circuit unit 13. The diagnosis result by the health diagnosis unit 132 is recorded in the history information recording unit 131.

FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit 131 of FIG. 21. As the history information, analysis data such as a time, a car position, a car speed, a set value (threshold) calculated according to the car position, a determination result, and an internal variable is recorded.

In the history information recording unit 131, a combination of data such as a car position, a car speed, a set value, a determination result, and analysis data is accumulated for each corresponding time, and a table of data as shown in FIG. 22 is created.

FIG. 23 is a flowchart for explaining the operation of the electronic safety controller 21 of FIG. First, data of the current time is output to the history information recording unit 131 (step S81). Next, the position of the cage | basket | car 3 is detected (step S82). The detected car position data is output to the history information recording unit 131 (step S83). Thereafter, the speed of the car 3 is detected (step S84). The detected car speed data is output to the history information recording unit 131 (step S85).

Next, a set value corresponding to the car position is calculated (step S86). Data of the set values is set to the history information recording unit 131 (step S87). Thereafter, the detection speed V and the set value f (x) are compared (step S88), and if the detection speed v is smaller than the set value f (x), the determination result is &quot; no abnormality &quot; (Good). ) Is output (step S89). If there is no abnormality in the speed of the car, the above operation is repeated for each calculation cycle.

As a result of the comparison determination, if the detection speed v is equal to or higher than the set value f (x), the stop command signal is output to the safety circuit unit 13 (step S90). The determination result is output to the history information recording unit 131 as "There is an abnormality" (Bad) (step S91).

In the history information recording unit 131, data sent from the electronic safety controller 21 is sequentially recorded.

According to such an elevator apparatus, when the cage | basket | car 3 is abruptly stopped by the instruction | command from the electronic safety controller 21, by confirming the history recorded in the history information recording part 131, Health can be confirmed. For example, even when the determination result is "no abnormality", when the cage | basket | car 3 is suddenly stopped, it can be judged that the elevator control panel 11 side has a failure.

Therefore, the cause when the cage | basket | car 3 is suddenly stopped can be judged efficiently. As a result, the recovery work can be made more efficient.

In addition, in the periodic inspection work, instead of actually inputting the inspection signals of all conditions to confirm whether the calculation result or the determination result of the set value is correct, it can be said that some inspection results were obtained by checking the history information. The inspection work can be simplified. By only confirming the calculation result and the comparison determination result of the set values recorded in the history information recording unit 131, some periodic inspections can be inspected and the inspection items can be reduced.

In addition, the set value set by the electronic safety controller 21 is set to allow a margin in consideration of vibrations caused by mischief. It is also possible to adjust how much room to allow for each elevator. By analyzing the data of the determination result recorded in the history information recording sound unit 131, it is possible to confirm how much margin is required in the actual driving situation, and the margin can be minimized. Thereby, it is possible to speed up a car speed and to improve running efficiency. Moreover, the adjustment operation of a margin can be made easy. That is, the work item of the adjustment work can be reduced by analyzing the history information in normal time.

Next, specific examples of the diagnosis contents by the health diagnosis unit 132 are as follows.

1. Fault diagnosis of sensor

ㆍ Checking the behavior of the position with respect to time (continuity, change, noise, etc.)

ㆍ Check speed behavior against time (continuity, amount of change, noise, etc.)

. Sensor failure check

2. Diagnosis of the operation of the speed monitor

ㆍ Check operation timing (operation interval) (from time t1 and t2)

• Check the calculation result of the set value for the elevator car position

• Check of the comparison judgment result between the detection speed and the set value

ㆍ Fault diagnosis of electronic devices such as CPU, ROM, RAM

3. Diagnosis of output value of speed monitor

ㆍ Check the behavior of the output value (no noise, etc.)

ㆍ Check output to safety circuit corresponding to judgment result

4. Operation check of self-diagnosis function of emergency stop device

ㆍ Check the operation of self-diagnosis (timing, diagnosis item)

ㆍ Check the history of abnormal detection

5. Diagnosis of car emergency stop operation and status at operation

ㆍ Check the failure detection of the emergency stop device by self-diagnosis

(Failure detection point, check of trouble factor)

ㆍ Incorrect output check (conformity check between output and logical operation)

ㆍ Check the behavior of position or speed just before the operation

(Check for behavior such as abnormal speed, or check for mischief)

In addition, by adding a process of counting the history information of the above-described diagnostic result, and recording the result of the aggregation process in the history information recording unit 131, it is possible to reduce the work of confirming the history information. The specific example of the aggregation process result to record is as follows.

ㆍ Operation timing

ㆍ Negativeness of soundness of input function by history of sensor input

ㆍ Confirming the soundness of logical operation

ㆍ Whether the output function

Self-diagnosis operation and result

ㆍ Absence of device

In such an elevator device, the diagnosis result of the system health can be confirmed by the history information recording unit 131. Therefore, when the car 3 is suddenly stopped due to a failure of the electronic device, the cause of the electronic device can be efficiently identified. I can do it.

In addition, by checking the diagnosis result recorded in the history information recording unit 131 and the result of the aggregation process, the inspection item for the periodic inspection can be reduced. The following items can be confirmed at the time of periodical inspection.

ㆍ Checking the soundness of the operation (checked range for x and v) from the recorded car position or car speed

ㆍ Check the items checked by self-diagnosis

ㆍ Check the margin between detection speed and set value

 In this way, for example, when the health of the electronic devices such as the CPU, the ROM, and the RAM is diagnosed, the inspection of the electronic devices during the periodical inspection is omitted by checking the diagnosis result recorded in the history information recording unit 131. can do.

In addition to the recording of the history information and the recording of the soundness diagnosis result, the confirmation of the execution of the periodic inspection may be recorded in the history information recording unit 131, and the inspection history may be maintained in the history information recording unit 131. The contents of the inspection can be easily confirmed. Examples of the inspection history to be recorded include inspection execution time and inspection items.

In the above example, the history information recording unit 131 and the health diagnosis unit 132 are set outside the electronic safety controller 21, but at least one of them may be set in the electronic safety controller 21.

Further, in the above example, the history information is recorded for the monitoring of the abnormal speed, but for example, the history information for the rope cutting monitoring for monitoring the presence or absence of damage or cutting of the main rope may be recorded. Moreover, you may record the history information about temperature monitoring which monitors the motor temperature of a hoist, the temperature of an inverter, the temperature of a control panel, etc.

Thus, the elevator apparatus in this example determines the presence or absence of an abnormality of the elevator based on the information from the sensor, and outputs a signal for stopping the car when the abnormality is detected (electronic safety controller 21 ) And a history information recording section for recording a history of information on the determination processing in the abnormality monitoring section.

`` Detection of data bus ''

Next, FIG. 24 is a block diagram which shows the principal part of the electronic safety controller 21 of FIG. The electronic safety controller 21 has a memory data error check circuit 141 for checking an abnormality of memory data and a designated address detection circuit 143 for checking an abnormality of the CPU 142 and an address bus.

The memory data abnormality checking circuit 141 is for avoiding a collision between the main memory 141a and the sub memory 141b (RAM) and the output data of the sub memory 141b which are allocated in the same address space repeatedly. The data buffer 141c has a data comparison circuit 141d for comparing data of the main memory 141a and the sub memory 141b to check data abnormality.

Although not shown here, the memory data abnormality check circuit 141 also has an error correction code check circuit as in the conventional system.

The CPU 142 includes designated address output software 142a for outputting a designated address at the time of data abnormality check, data bus abnormality check software 142b to be executed at the time of data bus abnormality check, and ROM for program storage (not shown). Not).

In the memory data abnormality check circuit 141, the main memory 141a and the sub memory 141b are connected to the CPU 142 via the address bus BA and the data bus BD, respectively, and the data of the electronic safety controller 21 are stored. Is written from the CPU 142 and read by the CPU 142.

The data bus BD is branched into the main memory data bus BD1 and the sub memory data bus BD2 in the memory data abnormality check circuit 141, and the main memory 141a and the sub memory 141b are each the main memory data bus BD1. And a data comparison circuit 141d via the sub memory data bus BD2. The data buffer 141c is interposed in the sub memory data bus BD2.

The data comparison circuit 141d compares each memory data input via the main memory data bus BD1 and the sub memory data bus BD2 at the time of abnormality check of the memory data, and determines that the memory data is abnormal in the data abnormality signal. Output ED.

The designated address detecting circuit 143 is connected to the CPU 142 via the address bus BA, detects the designated address at the time of checking the abnormality of the address bus BA, and determines that the address bus BA is abnormal. Output the signal EBA.

The designated address output software 142a in the CPU 142 operates at the time of abnormality check of the address bus BA, and outputs the designated address periodically to the designated address detection circuit 143 as described later. The data bus abnormality check software 142b in the CPU 142 operates at the time of abnormality check of the data bus BD, and outputs a data bus abnormal signal EBD when it is determined that the data bus BD is abnormal.

FIG. 25 specifically shows a data comparison circuit 141d for checking data abnormality in FIG. 24, and is a D type using a plurality of exclusive OR gates 151, an AND gate 152, and a memory read signal RD. The case comprised by the latch circuit 153 is shown.

In FIG. 25, the data comparison circuit 141d includes an AND gate 152 that takes a logic of the output signals of the exclusive OR gate 151 and the exclusive OR gate 151 in parallel, and an output signal of the AND gate 152. Has a D-type latch circuit 153 which outputs the H (logical "1") level signal as the data abnormal signal ED by using the D terminal input.

Each exclusive OR gate 151 uses the data from the main memory data bus BD1 as one input signal, and the data from the sub memory data bus BD2 as one input signal, respectively, when L coincides with each other. Outputs a (logical "O") level signal, and outputs an H (logical "1") level signal when both are inconsistent.

The AND gate 152 receives the inverted signal of the output signal from each exclusive OR gate 151, and each input signal is of H level (that is, each output signal of the exclusive OR gate 151 is all L level). In this case, an H (logical "1") level signal is output.

The D-type latch circuit 153 operates in response to the memory read signal RD, and changes the level of the output signal (data abnormal signal ED) in response to the D terminal input (output signal of the end gate 152). The initial state is reset in response to the reset signal RST.

FIG. 26 specifically shows the designated address detection circuit 143 for checking the address bus error in FIG.

In FIG. 26, the designated address detection circuit 143 includes a plurality of exclusive OR gates 161 which use the H level signal as one input signal, and a plurality of exclusive OR gates 162 which use the L level signal as one input signal. ), A NAND gate 163 that takes the logical product of the output signal and the address strobe signal STR of the exclusive OR gate 161, and a NAND gate that takes the logical product of the output signal and address strobe signal STR of the exclusive OR gate 162. A D-type latch circuit 165 that uses the output signal of the NAND gate 163 as an input signal of the set terminal, and a D-type latch circuit that uses the output signal of the NAND gate 164 as an input signal of the set terminal. 166, AND gate 167 which takes the logical product of the output signals of D-type latch circuits 165 and 166, and D-type latch that operates in response to reset signal RST1 of designated address detection circuit 143. Circuit 168 and Designated Address Detection Time OR gate that takes a logical sum of the D-type latch circuit 169 operating in response to the mask signal MSK of the furnace 143 and the output signal of the AND gate 167 and the output signal of the D-type latch circuit 169. Has 170.

Designated addresses via the address bus BA are respectively input to the other input terminals of the exclusive OR gates 161 and 162 provided in parallel.

Each exclusive OR gate 161 outputs an L level signal when the designated address input from the address bus BA is an H level signal, and outputs an H level signal when the designated address is an L level signal.

In contrast, each exclusive OR gate 162 outputs an H level signal when the designated address input from the address bus BA is an H level signal, and outputs an L level signal when the designated address is an H level signal.

The output signal of each exclusive OR gate 161 is level-inverted together with the address strobe signal STR and input to the NAND gate 163. Similarly, the output signal of each exclusive OR gate 162, together with the address strobe signal STR, is level inverted and input to the NAND gate 164.

Therefore, if the address bus BA is sound, the NAND gates 163 and 164 are synchronized with the address strobe signal STR, and are given a fixed period by a designated address ("FFFF", "0000") periodically input via the address bus BA. Each time, the H level signal is output complementarily.

The D-type latch circuit 168 applies an L level signal to the D input terminal, and operates by the first reset signal RST1. The output signal of the D-type latch circuit 168 is applied to each reset terminal of the D-type latch circuits 165 and 166. The D-type latch circuit 169 applies an O bit signal ("O" when the mask is ON and "1" when the mask is ON) of the data bus BD to the D input terminal, and to the mask signal MSK. It works by Each of the D-type latch circuits 168 and 169 is reset by the second reset signal RST2.

The OR gate 170 outputs an address bus error signal EBA when the output signal of the AND gate 167 or the output signal of the D-type latch circuit 169 indicates an H level.

In the electronic safety controller 21 configured as described above, not only the data abnormality check by the memory data abnormality check circuit 141 but also the abnormality of the address bus BA by the designated address output software 142a and the designated address detection circuit 143. The check and the abnormal check of the data bus BD by the data ver.TM abnormality checking software 142b are executed.

Next, the above three abnormality checking operations will be described in more detail with reference to FIGS. 24 to 28.

FIG. 27 is a flowchart showing processing operations by the designated address output software 142a and the designated address detection circuit 143 in the CPU 142 of FIG. 24, and the designated address detection circuit 143 at the time of abnormality check of the address bus BA. The operation procedure when outputting a designated address is shown in Fig. 2).

FIG. 28 is a flowchart showing the processing operation of the data bus abnormality checking software 142b in the CPU 142 of FIG.

First, the data abnormality checking operation by the memory data abnormality checking circuit 141 will be described with reference to FIGS. 24 and 25.

In the memory data abnormality check circuit 141, the same address space is overlapped and allocated to the main memory 141a and the sub memory 141b, and the CPU 142 stores data in the main memory 141a and the sub memory 141b. Is written, the same data is written to the same addresses of the main memory 141a and the sub memory 141b, respectively.

On the other hand, when the CPU 142 reads data from the unattended memory 141a and the sub memory 141b, the data of the main memory 141a is read on the main memory data bus BD1 and the CPU (through the data bus BD). Although passed to 142, the data in the sub memory 141b is read on the sub memory data bus BD2, but is blocked in the data buffer 141c, and therefore is not sent out to the data bus BD1.

Therefore, two memory outputs from the main memory 141a and the sub memory 141b do not collide with each other, and only the data of the main memory 141a is passed to the CPU 142, and writing and reading are normally executed.

Simultaneously with this operation, the main memory data read on the main memory data bus BD1 and the sub memory data read on the sub memory data bus BD2 are inputted to the data comparison circuit 141d to perform a data comparison of both.

The data comparison circuit 141d checks for data abnormality and outputs a data abnormal signal ED when an abnormality (data mismatch) is detected.

Next, referring to Figs. 24, 26 and 27, the abnormal check operation of the address bus BA by the designated address output software 142a and the designated address detection circuit 143 in the CPU 142 will be described.

The CPU 142 checks a designated address (e.g., 8-bit) that can check both "O" and "1" for each of all bit signals used in the memory system in the address bus BA. In this case, by executing the designated address output software 142a using "FF" and "OO", the process of Fig. 27 (steps S101 to S104) is repeatedly executed periodically. At the same time, the designated address is detected by the designated address detecting circuit 143 provided on the address bus BA.

If all of the designated addresses cannot be detected, the designated address detecting circuit 143 determines that there is an error in the address bus BA, and outputs an address bus abnormal signal EBA.

In Fig. 27, the CPU 142 first turns on the mask of the designated address detection circuit 143 (step S101), operates the D-type latch circuit 169 in the designated address detection circuit 143, and simultaneously zero bits. The signal BTO (= 0) is applied to the D input terminal. Subsequently, the designated address detection circuit 143 is reset by the first reset signal RST1 (step S102), and the D-type latch circuit 168 is operated.

Next, the address "FFFF" of the maximum value whose addresses are all "1" (or the address "0000" of the minimum value whose addresses are all "O") is read (step S103). Finally, the mask of the designated address detection circuit 143 is turned off (step S104), the 0 bit signal BTO (= 1) is applied to the D input terminal of the D-type latch circuit 169, and the D-type latch circuit ( The operation state of 169) is reversed to exit the processing routine of FIG.

Next, with reference to Figs. 24 and 28, the abnormal check operation of the data bus BD by the data bus abnormal check software 142b in the CPU 142 will be described.

The CPU 142 checks designated data (e.g., 8 bits) that can confirm the case of both "O" and "1" for each of all bit signals used in the memory system in the data bus BD. In the case of "AA" and "55" or "01", "02", "04", "08", "10", "20," 40 "and" 80 "and the value of a pair), The read / write check operation in the processing of Fig. 28 (steps S105 to S111) is repeatedly executed periodically.

In the determination processing by the data bus abnormality checking software 142b, if all the specified data do not match, the CPU 142 determines that there is an abnormality in the data bus BD and outputs a data bus abnormal signal EBD.

In Fig. 28, the CPU 142 initially sets the variable N specifying the specified data to &quot; 1 &quot; (step S105), and sets the N (= 1) th designated data (= &quot; 01 &quot;) to RAM (main The test addresses in the memory 141a and the sub memory 141b are written (step S106). Subsequently, the designated data written in step S12 is read out from the test address (step S107), and it is determined whether or not it matches the designated data before writing (step S108).

In step S108, if it is determined that the designated data after reading does not match the designated data before writing (i.e., no), the CPU 142 considers the abnormality in the data bus BD, and outputs the data bus abnormal signal EBD. (Step S109), abnormality ends.

On the other hand, if it is determined in step S108 that the designated data after reading coincides with the designated data before writing (i.e., yes), the variable N is incremented (step S110), and the variable N is equal to or less than "8". It is determined whether or not it is (step S111).

If it is determined in step S111 that N? 8 (i.e., YES), the process returns to the write processing of the specified data (step S106), and the processing steps S107 to S110 are repeatedly executed. That is, the 2nd designation data (= "02"), the 3rd designation data (= "02") ..., the 8th designation data (= "80") are sequentially written to the test address in RAM. (Step S106), after each read (step S107), a match or a mismatch is determined (step S108).

On the other hand, if it is determined in step S111 that N> 9 (i.e., NO), a data bus abnormality check is performed for all the designated data (N = 1 to 8), and all the specified data have been matched before and after writing. The CPU 142 normally terminates the processing routine of FIG.

In this manner, in addition to the processing by the memory data abnormality checking circuit 141 as in the conventional system, the periodical abnormality checking processing of the address bus BA and the data bus BD to be used at the time of memory writing and reading is executed. Reliability can be improved.

In particular, the abnormality check is effective when checking the health of the memory system in the elevator electronic safety device.

Thus, the electronic safety controller 21 in this example includes a CPU having a designated address output software and a data bus abnormality check software, a main memory and a sub memory connected to the CPU via an address bus and a data bus, and a main memory. And a memory data abnormality check circuit for comparing the data in the sub memory and a designated address detection circuit connected to the CPU via an address bus, wherein the CPU executes the designated address output software and simultaneously uses the address bus using the designated address detection circuit. The CPU periodically executes the data bus error check software and periodically checks the data bus using the main memory and the sub memory.

In addition, the CPU executes the designated address output software, and checks designated addresses for checking both cases of &quot; O &quot; and &quot; 1 &quot; Is periodically output to the designated address detecting circuit, and the designated address detecting circuit detects a plurality of designated addresses periodically output from the CPU, and if all of the plurality of designated addresses cannot be detected, it is determined that the address bus is abnormal. Outputs the address bus error signal.

In addition, the CPU executes the data path error check software, and designates a check that can confirm both the cases of "O" and "1" for each of all bit signals used in the main memory and the sub memory of the data bus. Data is periodically inputted and outputted, and a plurality of specified data periodically outputted from the CPU are read and compared in the main memory and the sub memory, and the plurality of designated data before writing and the plurality of designated data after reading do not coincide. In this case, it is determined that the data bus is abnormal and outputs a data bus error signal.

According to this invention, the elevator apparatus using the electronic safety controller which detects the abnormality of an elevator based on the detection signal from a sensor can be provided.

Claims (5)

A sensor for generating a detection signal for detecting an elevator state, and An electronic safety controller that detects an abnormality of the elevator based on a detection signal from the sensor and outputs a command signal for shifting the elevator to a safe state; The electronic safety controller receives a detection signal from a sensor different from the elevator control unit, and performs the safety monitoring independently, The electronic safety controller is capable of detecting an abnormality of the electronic safety controller itself, and outputs a command signal for shifting the elevator to a safe state even when an abnormality of the electronic safety controller itself is detected. The method of claim 1, The electronic safety controller is capable of detecting an abnormality of the sensor, and outputs a command signal for shifting the elevator to a safe state even when an abnormality of the sensor is detected. The method of claim 1, The electronic safety controller includes a microprocessor that executes arithmetic processing for detecting an abnormality in the elevator, And the microprocessor periodically executes arithmetic processing for detecting an abnormality of the electronic safety controller itself. The method of claim 1, The electronic safety controller includes a microprocessor that executes arithmetic processing for detecting an abnormality in the elevator, And the microprocessor executes arithmetic processing for detecting an abnormality of the electronic safety controller itself when a preset condition is satisfied. The method of claim 1, The electronic safety controller includes a first microprocessor that executes arithmetic processing for detecting an abnormality of an elevator based on a first safety program, and a second microprocessor that performs arithmetic processing for detecting an abnormality of an elevator based on a second safety program. Includes 2 microprocessors, The first and second microprocessors are communicable with each other via a bus between processors, and the elevator apparatus is capable of confirming the health of the first and second microprocessors themselves by comparing operation results with each other.

Images