SG180072A1 - Elevator equipped with an electronic safety system - Google Patents

Abstract

An elevator equipped with an electronic safety system includes: a safety controller (40) to issue to plural stopping devices (3, 6, 15) command signals to bring an elevator car (1) to a safe state; wherein the safety controller (40) has plural CPUs (50, 60) each comprising a processing unit (72, 82) to calculate internal stop signals (51'-54', 61'-64'), candidate values for car stop signals (51-54, 61-64) that activate the stopping devices (3, 6, 15) according to the detection signals, and an output adjusting unit (74, 84) determining the car stop signals (51-54, 61-64) based on the internal stop signals (51'-54', 61'-64'); each output adjusting unit (74, 84) arbitrates between the internal stop signals (51'-54', 61'-64') produced in the local CPU and the car stop signals (51-54, 61-64) determined by the other output adjusting unit (74, 84) in the remote CPU and outputs arbitrated car stop signals (51-54, 61-64) to the plural stopping devices (3, 6, 15). FIGURE 3

Description

ELEVATOR EQUIPPED WITH AN ELECTRONIC SAFETY SYSTEM

BACKGROUND OF THE INVENTION

The present invention relates to an elevator safety system suitably applicable particularly to an elevator equipped with an electronic safety system that replaces mechanical safety devices with electronic ones to enhance its functionality.

Safety devices used in an elevator include: final limit switches which detect that an elevator car has exceeded a normal operation range; a power interruption device which, upon detecting an overspeed of the car, cuts off an electric supply to a drive motor of an elevator hoist to bring the car to an emergency stop; a hoist brake; and an emergency stopping device.

Mechanical and electric parts are used in combination for activating these safety devices. For example, in the power interruption device and the hoist brake, a switch-relay and a contactor are used. In the emergency stopping device a governor, a governor rope and a gripping device are employed.

Another safety device used in the elevator is a safety controller that incorporates electronic components instead of mechanical ones and which detects anomalies based on sensor signals and issues a command signal produced by a CPU to a plurality of stopping devices (the power interruption device, the hoist brake and the emergency stopping device) to bring the elevator car to a safe state.

To make the safety controller even more reliable in the detection of anomalies, a variety of reliability improvement measures are known to be employed, which include: duplicating the CPU (processing device) to be able to check calculated results of the two CPUs against each other and thereby confirm the soundness of the safety controller; bringing the elevator car to a safe state whenever the calculated results do not agree; and, depending on the kind of abnormality detected, such as an overspeed or an abnormal position, bringing the car to a safe state, forcing an emergency stop or letting the car land on a nearby floor. These are described in WO2006/033153 (Patent Literature 1) (paragraph 0055, 0056).

Another reliability improvement method has been known which involves constructing the safety controller of two microprocessors (processing devices} and, when a disagreement is found between states calculated by the two microprocessors, transferring the elevator car into a speed reduction mode including a halt depending on the severity of the abnormal condition. This is described in, for example, JP-A-2002/538061 (Patent Literature 2) (paragraph 0033).

SUMMARY OF THE INVENTION

In the conventional technology described above, if something goes wrong with a process including and following the step of handling the comparison result, such as a unit for delivering a stop command from the microprocessors or with relays in the stopping devices (the power interruption device for the drive motor, the hoist brake and the emergency stopping device) that receive the stop command, there is a risk of the stopping devices failing to operate.

Another problem with the conventional technology is that, since one stopping device to be activated in the event of a disagreement between the two microprocessors is predetermined and fixed for all abnormal conditions, it may not be appropriate under some circumstances.

In bringing the elevator car to a safe state or to an emergency stop or letting it land on a nearby floor, the selected stopping device is required to provide a necessary braking force to safely stop the car. That is, the stopping device must best suit the transitional state that needs to be determined according to the abnormal condition. For example, the emergency stopping device, when activated, produces a large braking force, imposing heavy burden on passengers, and may result in passengers being trapped in the car. The emergency stop also leads to increased wear of the rail and an increased number of restoration steps. It follows therefore that the activation of the emergency stopping device should be limited only to necessary and sufficient cases. Conversely, activating only the hoist brake can result in the generated braking force falling short of the necessary level.

It is an object of this invention to solve the problems with the conventional technology, improve reliability of the safety system for elevators, produce a necessary braking force that matches the abnormal condition but, at the same time, not produce an unnecessarily large level of stop output (the level of braking force produced increases in an ascending order of the nearby floor stopping procedure, the power interruption device, the hoist brake and the emergency stopping device); i.e., not activate the stopping device that produces an unnecessarily large braking force, thereby minimizing negative effects on the passengers, the facility and the restoration procedure.

To achieve the above objective, this invention provides an elevator equipped with an electronic safety system, comprising: a safety controller to detect an abnormal condition based on detection signals from sensors and to issue to a plurality of stopping devices a command signal to bring an elevator car 1 to a safe state; wherein the safety controller has a plurality of CPUs each CPU comprising a processing unit to calculate internal stop signals, which are candidate values for car stop signals that activate the stopping devices according to the detection signals, and an output adjusting unit to determine the car stop signals based on the internal stop signals; wherein each of the output adjusting units arbitrates between the internal stop signals produced in the local CPU and the car stop signals determined by the other output adjusting unit in the remote CPU and outputs the arbitrated car stop signals to a plurality of the stopping devices.

The safety controller has a plurality.of CPUs and arbitrates between the internal stop signals of one CPU and the car stop signals of the other CPU and outputs to a plurality of stopping devices. This procedure can improve the reliability of the elevator safety system and produce a necessary braking force according to the abnormal condition, minimizing adverse effects on passengers, the facility and the restoration process.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1 is a side view showing an overall construction of one embodiment of this invention.

Fig. 2 is a diagram showing signal connections in one embodiment.

Fig. 3 is a block diagram showing the safety controller in one embodiment.

Fig. 4 is a graph showing upper speed limit curves in a terminal floor forced speed reduction function in one embodiment.

Fig. 5 is a stop level calculation table in one embodiment.

Fig. 6 is a stop level adjustment table in one embodiment.

Fig. 7 is a stop output determination table in one embodiment.

Fig. 8 is a flow chart showing a sequence of steps executed by the safety controller in one embodiment.

DESCRIPTION OF THE EMBODIMENTS

Fig. 1 shows an overall construction of the elevator. The elevator car 1 moves up or down an elevator shaft as a motor 2 drives a main rope 10 connected to a counter weight 11. The motor 2 is supplied electricity from an inverter 5 connected to an AC power supply 7 through an interruption circuit 6. When the power interruption circuit 6 operates, the motor 2 loses its driving force. A hoist brake 3 restrains the driving force of the motor 2, producing a braking force on the elevator car 1. The hoist brake 3 is normally activated and, when power is restored, it is deactivated.

A governor rope 12 is pulled by the elevator car 1 as it moves, causing a governor 13 to rotate. The governor 13 has a gripping device 14 and a rotary encoder 21. The gripping device 14, when activated, grips the governor rope 12. At this time, if the car 1 is moving, an emergency stopping device 15 grips a rail 16 bringing the car to a sudden halt. The rotary encoder 21 rotates with the governor 13 to generate a pulse signal. Integrating changes in the pulse signal determines the position of the car 1 and averaging the time of changes determines the speed of the car 1.

At the lower end of the elevator shaft there 1s installed a buffer 17 which absorbs an impact of the descending car 1 when the car 1 fails to be completely stopped by the braking force of the brake 3 and the emergency stopping device 15.

Installed near the lower and upper ends of the elevator shaft are final limit switches 22, 23. These switches are normally ON and, when the car 1 moves up or down past these switches, are turned OFF, detecting that the position of the car 1 is in excess of the normal operation range.

In a control panel installed near the elevator shaft, an operation controller 30 and a safety controller 40 are provided. The operation controller 30 controls the inverter 5 to operatethe car 1. The safety controller 40, in response to inputs from the rotary encoder 21 and the final limit switches 22, 23, detects events such as an overspeed and a position overrun of the car 1 and brakes the car by the hoist brake 3, the power interruption circuit 6 and the emergency stopping device 15, which is activated by the gripping device 14.

Fig. 2 shows a signal connection diagram for the elevator of Fig. 1. The operation controller 30 outputs an inverter control signal 31 to control the inverter 5. The safety controller 40 has CPU 50 and CPU 60. The CPUs 50, 60 are microcomputers each having a central processor, ROM, RAM and peripheral circuits, such as digital input/output, encoder input and communication interface, all interconnected through internal buses.

The CPUs 50, 60 receive an encoder signal 41 from the rotary encoder 21 and switch signals 42, 43 from the final limit switches 22, 23. The CPU 50 sends a nearby floor stop signal 51 to an AND circuit 70, a power interruption signal 52 to the power interruption circuit 6, a brake activation signal 53 to the brake driving circuit 4 that energizes the hoist brake 3 and an emergency stop activation signal 54 to the gripping device 14. These signals are also supplied to the CPU 60.

Similarly, the CPU 60 sends a nearby floor stop signal 61 to the AND circuit 70, a power interruption signal 62 to the contactor of the power interruption circuit 6, a brake activation signal 63 to the brake driving circuit 4 and an emergency stop activation signal 64 to the gripping device 14. These four output signals are also supplied to the CPU 50. All of the eight output signals activate the stopping devices of the elevator car 1.

The nearby floor stop signals 51, 61 indicate the presence or absence of a request for the operation controller 30 to stop the elevator car 1 at a floor nearest the present car position.

For example, when it is ON, there is no such request; and when OFF, there is a request. So, when one of the nearby floor stop signals 51, 61 is turned OFF, the operation controller 30 stops the elevator car 1 at the nearest floor.

The power interruption signals 52, 62 are connected respectively to two contactors in the power interruption circuit 6. When the signals are ON, the contactors are closed; and when OFF, the contactors are open. The two contactors are connected in series, so turning off one of the power interruption signals 52, 62 causes the power interruption circuit 6 to cut off the circuit between the AC power supply 7 and the inverter 5. Similarly, the break activation signals 53, 63 are connected respectively to two contactors in the brake driving circuit 4. When these signals are ON, the contactors are closed; and when OFF, the contactors are open. Since the two contactors are connected in series, if one of the break activation signals 53, 63 is OFF, the brake driving circuit 4 cuts off power supply to the hoist brake 3.

The emergency stop activation signals 54, 64 are connected to a solenoid that drives the gripping device 14. When both signals are ON, the gripping device 14 is not energized. When one of the signals is OFF, the emergency stopping device 15 is activated.

The CPUs 50, 60 communicate with each other exchanging their input values, interim calculated values and presence signals. The input values are values of the final limit switch signals 42, 43 and the interim calculated values are the position and speed of the car 1 calculated based on the encoder signal 41. The presence signals use, for example, one-byte integers incrementing by one for every transmission from 0 to 255 and returning to 0.

Possible causes for a disagreement between calculated results of the two CPUs 50, 60 include: a path, used to send signals from sensors (rotary encoder 21 and final limit switches 22, 23) to each CPU, getting stuck; calculated values changing due to software errors in each CPU; a stop signal from each CPU getting stuck; a break in a cable for transmitting the stop signal; a supply fault; and a ground fault. Where the sensors are duplicated and connected one set to each CPU, the possible causes are a failure of one of the two sets of sensors, a break in signal paths from the sensors to the CPUs, a supply fault and a ground fault.

Fig. 3 shows a block diagram of functions in the CPUs 50, 60. The CPU 50 has an input unit 71, a processing unit 72, an output adjusting unit 74 and a diagnostic unit 73. The

CPU 60 has an input unit 81, a processing unit 82, a diagnostic unit 83 and an output adjusting unit 84. A program to implement these functions is stored in the ROM. When executed by the CPU, the program realizes a variety of safety functions, such as terminal floor forced speed reduction function.

The input units 71, 81 take in signals 41-43 from the sensors to produce an

ON/OFF signal to request the activation of the car stopping devices. The encoder signal 41 is converted into an integer representing the speed and position of the car 1. The final limit switch signals 42, 43 are converted to 1 when they are ON and to 0 when they are OFF. The car position calculated from the encoder signal 41 is reset to a predetermined initial value when the final limit switch signals 42, 43 are detected.

The processing units 72, 82, based on the input signals 41-43 taken in by the input units 71, 81, calculate internal stop signals 52'-54', 62'-64', candidates for stop signals 52-54, 62- 64 to be sent to a plurality of the car stopping devices. The internal stop signals 52'-54', 62'-64' are ON by default (no stop signal is produced and the stopping devices are not activated). Two example cases will be described as follows. [Case 1]

The processing units 72, 82, when any one of the final limit switch signals 42, 43 is OFF, turn off the internal stop signals 52'-53', 62'-63' (a stop signal is produced and the stopping devices are activated). That is, the processing units 72, 82 demand the activation of the hoist brake 3 and the power interruption circuit 6 as the car stopping devices. [Case 2]

This represents an example of calculation performed by the terminal floor forced speed reduction function. Fig. 4 is a graph with the abscissa representing the car position in the elevator shaft and the ordinate representing the car speed. A first speed upper limit curve 91 and a second speed upper limit curve 92 are tabled and stored in the processing units 72, 82.

The processing units 72, 82 determines a first speed upper limit corresponding to the car position from the first speed upper limit curve 91. If the car speed is found to be in excess of the first speed upper limit, the processing units 72, 82 each turn off the internal stop signals 52'-53', 62'- 63', i.e., request the activation of the hoist brake 3 and the power interruption circuit 6 as the car stopping devices. Further, the processing units 72, 82 determine a second speed upper limit corresponding to the car position from the second speed upper limit curve 92. If the car speed is in excess of the second speed upper limit, the processing units 72, 82 each turn off the internal stop signals 54°, 64°, i.e., request the activation of the emergency stopping device 15 as the car stopping device through the gripping device 14.

Diagnostic units 73, 83 perform a self-diagnostic test. The self-diagnostic test is done based on the data in the input unit 71 and the processing unit 72 and on the data in the input unit 81 and the processing unit 82. For example, when the interim calculation results (speed and position) are within the predetermined range, the CPU is diagnosed as being normal. When they are outside the predetermined range, the CPU is diagnosed as abnormal. Alternatively, a check sum is calculated for predetermined areas in the ROM and if it matches a preset check sum stored in a separate area, the CPU is diagnosed as normal. If they do not agree, the CPU is diagnosed as abnormal.

Based on the input values, interim calculation values (speed and position) and survival signals exchanged between the diagnostic units 73, 83, the CPUs 50, 60 diagnose each other, with the diagnostic unit 73 diagnosing the CPU 60 and the diagnostic unit 83 the CPU 50, by comparing the input value and interim value received from the other CPU with the local values. Ifthey agree, the CPUs are determined to be normal; and if they disagree, one of the

CPUs is determined to be abnormal. Further, one CPU compares an integer value, the survival signal, from the other CPU with the previously received signal. Ifit is found updated, the second CPU is determined to be normal. If not, the second CPU is determined abnormal.

Based on the results of the self diagnostic and the mutual diagnostic, the diagnostic units 73, 83 calculate the internal stop signals 51°, 61°, the candidate values for the nearby floor stop signals 51, 61. Should there be an anomaly with even one of these diagnostics, the diagnostic units 73, 83 turn off the internal stop signals 517, 61'. That is, a nearby floor stop procedure is requested. The internal stop signals 51', 61' are ON by default.

The output adjusting unit 74 determines the values of the car stop signals 51-54 based on the internal stop signals 51°-54° from the processing unit 72 and the diagnostic unit 73 and on the car stop signals 61-64 from the output adjusting unit 84. Similarly, the output adjusting unit 84 determines the values of the car stop signals 61-64 based on the internal stop signals 61’-64’ from the processing unit 82 and the diagnostic unit 83 and on the car stop signals 51-54 from the output adjusting unit 74.

The decision making process in the output adjusting units 74, 84 will be explained by referring to Fig. 5 to Fig. 7.

For the car stop signals 51-54, 61-64 and the internal stop signals 51'-54', 61°-64°, numerical stop levels are set according to the kind of anomaly. Fig. 5 is a stop level calculation table showing the stop levels of the signals. The stop levels are numerical representation in order of magnitudes of the braking force or levels of emergency (seriousness of abnormal condition). The emergency stopping device is assigned the highest stop level, followed by the hoist brake and the power interruption device in that order.

The output adjusting unit 74 stores a stop level calculation table 101 for the internal stop signals 51'-54' and a stop level calculation table 111 for the car stop signals 61-64.

Likewise, the output adjusting unit 84 stores a stop level calculation table 102 for the internal stop signals 61'-64' and a stop level calculation table 112 for the internal stop signals 61'-64".

The output adjusting unit 74 refers to the stop level calculation table 101 to acquire stop levels for those of the internal stop signals 51'-54' that are OFF and determines the largest of these values as a stop level that the CPU 50 requests. The output adjusting unit 74 also searches through the stop level calculation table 111 to find those of the car stop signals 61- 64 that are OFF and determines the largest value as the stop level that the CPU 60 requests.

Similarly, the output adjusting unit 84 references the stop level calculation tables 102, 112 and determines the stop levels requested by the CPU 50 and CPU 60, respectively.

For example, when the car stop signals 51-53 are OFF and the car stop signal 54 is ON, the stop level requested by the CPU 50 is 2. If the internal stop signal 61° is OFF and the internal stop signals 62°-64’ are ON, the stop level required by the CPU 60 is 1.

The output adjusting units 74, 84 take in the stop signals from each other’s CPU, they coordinate (adjust) the calculated stop levels.

Fig. 6 shows a stop level adjustment table 120 that further adjusts the stop level already coordinated by the output adjusting units 74, 84. Based on the stop levels required by the two CPUs 50, 60 (local CPU (1) and remote CPU (2)), the output adjusting unit (in one of the two CPUs) references the stop level adjustment table 120 and takes the larger of the two stop levels as the stop level it has to output. For example, If the stop level required by the CPU 50 (local CPU (1)) is 2 and the stop level required by the CPU 60 (remote CPU (2)) is 1, the output adjusting unit 74 takes the stop level 2 as the one it has to output. Similarly, the output adjusting unit 84, in the same situation where the stop level of CPU 60 (local CPU (1)) is 1 and that of CPU 50 (remote CPU (2)) 1s 2, determines the stop level 2 to be the one it has to output.

The output adjusting unit 74 determines the values of the car stop signals 51-54 from the stop levels that it has to output and the output adjusting unit 84 determines the values of the car stop signals 61-64 from the stop levels that it has to output.

Fig. 7 shows a car stop signal decision table used to determine a car stop signal from the stop levels adjusted by the output adjusting units 74, 84. The output adjusting unit 74 stores a car stop signal decision table 131 for the car stop signals 51-54 and the output adjusting unit 84 stores a car stop signal decision table 132 for the car stop signals 61-64. For example, if the stop level that the output adjusting units have to output is 2, they turn off the car stop signals 51-53, 61-63 and turn on the car stop signals 54, 64.

In the above example, the CPU 60 raises its stop level from 1 to 2, changing the car stop signals 62, 63 from ON to OFF. At this timing, the CPU logs its level change. That is, the output adjusting units 74, 84 keep a log of changes they make in the value of the car stop signals. This log allows maintenance staffs to track down the cause and process of activating the stopping devices. An example of the log may be one set of values, such as values before and after the changes in the car stop signals, values of internal stop signals for the car stop signals (e.g., internal stop signal 51° for the car stop signal 51), the highest level of the internal stop signals that are produced in the local CPU, dnd the “final stop level that the output adjusting unit has to output”. The log is produced as an electronic file which can be acquired from outside each CPU via communication.

Fig. 8 shows a flow of processing executed by the functional blocks of Fig. 3.

At step S11 the input units 71, 81 take in signals from the sensors to calculate interim results of car speed and position. At step S12 the processing units 72, 82 each calculate the values of the internal stop signals 52'-54, 62'-64'. At step S13 the output adjusting units 74, 84 each calculate the values of the car stop signals 51-54, 61-64 and updates these signal values.

Next at step S14, the diagnostic units 73, 83 each perform the self diagnostic and the mutual diagnostic to calculate the internal stop signals 51°, 61". At step S15, upon receiving the diagnostic results from the diagnostic units 73, 83, the output adjusting units 74, 84 each re- calculate the car stop signals 51-54, 61-64 and update these car stop signals.

The timing at which to execute a sequence of steps shown in Fig. 8 may be at cyclic intervals (e.g., every 10 ms) using the timers in the CPUs 50, 60, which will enhance the reliability. Or the sequence of steps may be triggered by an interrupt that is produced whenever the input units 71, 81 detect a change in the input signal, which will raise the processing efficiency.

With the above procedure, even when a disagreement occurs in calculated result between the CPU 50 and CPU 60, each of the CPUs compares the car stop signals 51-54, 61-64 with those of the other CPU and changes from the signal absent state to the signal present state those car stop signals whose stop levels are equal to or lower than those of the other CPU that has been decided to be output. This takes advantage of the redundant configuration in which the car stop signals are duplicated by the CPU 50 and CPU 60, enhancing reliability.

Further, since an appropriate and necessary car braking force to secure the safety ofthe elevator car can be produced according to the abnormal condition and since no car stop signals with an unnecessarily high stop level or too large a braking force are produced, undesired circumstances that would otherwise result can be prevented, such as an undue burden on passengers at times of emergency stop, wear of the rail, passengers being trapped in the car, and an increased number of steps in restoring the normal operation following the emergency stop.

Another advantage is that, since which stopping procedure should be taken in the event of a disagreement in calculated result between CPU 50 and CPU 60 and which of the stopping devices should be activated can be determined flexibly, rather than executing only one fixed procedure for all abnormal conditions, a more appropriate response to a particular abnormal condition can be taken, minimizing adverse effects of abnormal or unexpected car stop.

Further, two operation modes — normal mode and maintenance mode — may be provided to the CPUs 50, 60 so that their operation modes can be changed from outside via communication or switch and that, during the maintenance mode, the output adjusting units 74, 84 are made not to arbitrate the stop levels, i.e., to use the internal stop signals 51'-54', 61°-64°, as is, as the car stop signals 51-54, 61-64. This arrangement allows the maintenance staff to check the CPUs 50, 60 individually to see if they as single components produce correct outputs in response to supplied inputs.

It is also possible to make an arrangement in which, when simultaneous activation of the hoist brake 3 and the emergency stopping device 15 can produce too strong a braking force, only the emergency stopping device 15 is activated, leaving the hoist brake 3 deactivated.

For example, when in the car stop signal decision tables 131, 132 the stop level is 3, the car stop signals 53, 63 are set to ON. This is equivalent to nullifying the operation of the stopping device (hoist brake 3) whose stop level is lower than that determined by the arbitration of the output adjusting units 74, 84. It is therefore possible to flexibly set the activation or deactivation of the stopping devices in the car stop signal decision table according to the required : - braking force when there is a disagreement between the two CPUs.

Although the diagnostic units 73, 83 have been described to each output only one internal stop signal 51', 61', they may issue a plurality of internal stop signals with different stop levels to be able to provide a more flexible response. For example, it may be arranged to issue alevel-1 internal stop signal when the survival signal from the remote CPU cannot be confirmed during the mutual diagnostic, and to issue a level-2 internal stop signal when there is a disagreement in the interim calculation results (position and speed), with the levels of these internal stop signals preferably set in the stop level calculation tables 101, 102.

While two CPUs 50, 60 have been described to be used, three or more CPUs may also be employed, in which case higher reliability is assured. Further, the CPUs are desirably formed of an integrated circuit for enhanced processing speed or of a multicore microcomputer (with a plurality of CPUs in one semiconductor chip) for a smaller size.

Claims (8)

CLAIMS:

1. An elevator equipped with an electronic safety system, comprising: a safety controller (40) to detect an abnormal condition based on detection signals from sensors and to issue to a plurality of stopping devices a command signal to bring an elevator car (1) to a safe state; wherein the safety controller (40) has a plurality of CPUs (50, 60), each CPU comprising a processing unit (72, 82) to calculate internal stop signals (51°-54°, 61°-64"), which are candidate values for car stop signals (51-54, 61-64) that activate the stopping devices (3, 6, 15) according to the detection signals, and an output adjusting unit (74, 84} to determine the car stop signals based on the internal stop signals (51°-54°, 61-647); wherein each of the output adjusting units (74, 84) arbitrates between the internal stop signals (517-54, 61°-64") produced in the local CPU and the car stop signals (51-54, 61-64) determined by the other output adjusting unit (74, 84) in the remote CPU and outputs the arbitrated car stop signals (51-54, 61-64) to a plurality of the stopping devices (3, 6, 15).

2. An elevator equipped with an electronic safety system according to claim 1, wherein, for each of the internal stop signals (51°-54°, 61°-64’) and the car stop signals (51-54, 61-64), a numerical stop level is set according to the content of the abnormal condition; wherein each of the output adjusting units (74, 84) performs the arbitration to use largest stop levels as the stop levels to be output from the local CPU and outputs the car stop signals (51-54, 61-64) corresponding to the arbitrated largest stop levels to the plurality of the stopping devices (3, 6, 15).

3. An elevator equipped with an electronic safety system according to claim 1, wherein, for each of the internal stop signals (51-54, 61°-64’) and the car stop signals (51-54, 61-64), a numerical stop level is set according to the magnitude of a braking force; wherein each of the output adjusting units (74, 84) performs the arbitration to use fargest stop levels as the stop levels to be output from the local CPU and outputs the car stop signals (51-54, 61-64) corresponding to the arbitrated largest stop levels to the plurality of the stopping devices (3, 6, 15).

4. An elevator equipped with an electronic safety system according to claim 1, wherein, for each of the internal stop signals (51°-54°, 61°-64°) and the car stop signals (51-54, 61-64), a numerical stop level is-set according te the content of the abnormal condition; wherein each of the output adjusting units (74, 84) has a stop level adjustment table (120) to perform a further arbitration on the stop levels already arbitrated by each of the local CPUs;

wherein each of the output adjusting units (74, 84) references the stop level adjustment table (120), adjusts the stop levels of the local CPU and the remote CPU to select the stop levels of the local CPU and determines from the selected stop levels the car stop signal (51- 54, 61-64) to be output from the local CPU.

5. An elevator equipped with an electronic safety system according to claim 1, wherein, for each of the internal stop signals (51°-54°, 61-64") and the car stop signals (51-54, 61-64), a numerical stop level is set according to the content of the abnormal condition; wherein each of the output adjusting units (74, 84) has a stop level adjustment table (120) to perform a further arbitration on the stop levels already arbitrated by each of the local CPUs and a car stop signal decision table (131, 132) to determine the car stop signals (51- 54, 61-64) from the stop levels; wherein each of the output adjusting units (74, 84) references the stop level adjustment tables (120), adjusts the stop levels of the local CPU and the remote CPU to select the stop levels of the local CPU and then references the car stop signal decision table (131, 132) to determine from the selected stop levels the car stop signals (51-54, 61-64) to be output from the local CPU.

6. An elevator equipped with an electronic safety system according to claim 1, wherein each of the CPUs has a diagnostic unit (73, 83) to check for an abnormality based on the data from the processing unit; wherein the diagnostic units (73, 83) exchange input values, interim calculation values and survival signals with each other to perform a mutual diagnostic on each other’s CPU.

7. An elevator equipped with an electronic safety system according to claim 1, wherein, for each of the internal stop signals (51°-54°, 61°-64") and the car stop signals (51-54, 61-64), a numerical stop level is set according to the content of the abnormal condition; wherein each of the output adjusting units (74, 84) has a car stop signal decision table (131, 132) to determine the car stop signals (51-54, 61-64) from the stop levels; wherein the car stop signal decision table (131, 132} allows the car stop signals (51-54, 61-64) arbitrated by the output adjusting units (74, 84) to be nullified.

8. An elevator equipped with an electronic safety system according to any one of claim 1 to claim 7, wherein the output adjusting units (74, 84) has a maintenance mode in which they do not perform the arbitration on the car stop signals (51-54, 61-64) but use the internal stop signals (51°-54°, 61°-64") as the car stop signals (51-54, 61-64).