SG180073A1 - Elevator equipped with an electronic safety system - Google Patents

Abstract

OF THE DISCLOSUREAn elevator with a highly reliable, highly functional safety and simplified construction. The elevator has a safety controller (microcomputer-A (50) and microcomputer-B (60)) that checks the input information from sensors (41-43) monitoring the operational state of the elevator car (1) to detect any abnormal condition and, when it detects an anomaly, brings the car to a safe state. When it is determined based on the sensor input information that the elevator car is at rest, the safety controller performs a self-diagnostic to see if it is working normally.FIGURE 3

Description

ELEVATOR EQUIPPED WITH AN ELECTRONIC SAFETY SYSTEM

BACKGROUND OF THE INVENTION

The present invention relates to an elevator safety system suitably applicable particularly to an elevator equipped with an electronic safety system that minimizes the number of mechanical safety devices by replacing them with electronic ones to enhance its functionality.

As mechanical safety switches and safety devices for elevators are replaced with electronic ones, more intelligent, sophisticated functions are becoming available. Among them, there is known to be a function which, to prevent erroneous operations with high accuracy, uses an electronic governor, calculates an elevator car speed with two microcomputers from an encoder output that changes as the elevator car moves up and, when the car speed is determined to have exceeded an abnormal speed, stops the car and which compares the car speeds calculated with the two microcomputers and, when there is a difference greater than a preset value, determines that an abnormal condition has occurred and stops the car. This function is described, for example, in WO2004/076326 (Patent Literature 1) (Fig. 7).

In elevators with an electronic safety controller that, when it detects an abnormal condition, issues a command signal to bring an abnormal elevator car to a safe state, the electronic safety controller is known to include a first and a second microprocessor for further improvement in reliability of the safety system whereby calculation results of the two microprocessors are compared to validate the safety controller’s integrity. This function is described, for example, in WO2006/090470 (Patent Literature 2) (paragraph 0038, Fig. 12).

SUMMARY OF THE INVENTION

In the conventional technology described above, although the reliability is enhanced by duplicating the microcomputer or processing device, there is a possibility of an error or failure going undetected because the only check for elevator anomaly is made by simply comparing final calculation results from the processing devices, i.e., the output signals (car stop signals} represented by a bit of 1 or 0. For example, when a car stop signal from one of the processing devices gets stuck on the side of a car that does not need to be stopped, due to a failure of that processing device (e.g., a failure of the microcomputer itself and a failure of a car stop signal output unit), the failure cannot be detected under a normal operating condition where the car does not have to be stopped.

That is, where a failure in one processing device is latently present, if the other processing device fails, the car cannot be stopped, which means that the reliability of the safety device has degraded.

As for the safety system described in Patent Literature 2, although the likelihood of a failure of a processing unit itself in the processing device being detected increases, the failure of, for example, the car stop signal output unit remains difficult to detect. Further, to deal with differences in the calculated car position and car speed between the two processing devices, caused by differences in processing timing, some provisions need to be made, such as synchronizing the processing timings of the two processing devices and properly setting an error threshold. This in turn makes the design complex and increases a load of software processing.

It is an object of this invention to solve the problems associated with the conventional technology, realize highly reliable, highly functional safety and, by simplifying the construction, facilitate highly reliable design and maintenance regardless of the elevator type and parts used.

To achieve the above objective, in an elevator with an electronic safety controller that checks for an anomaly based on information from a sensor monitoring the state of the elevator in operation and generates a command signal to bring an elevator car to a safe state, when it determines, based on the sensor information, that the car is at rest, the safety controller performs a self-diagnosis to check whether it is operating correctly.

In the elevator of this invention since the safety controller performs a self- diagnosis on itself while the elevator is at rest, any failure occurring in the processing devices from the processing unit to the output unit has come to be able to be detected, realizing safety with improved reliability and sophisticated functions.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1 is a block diagram showing an overall construction of one embodiment of this invention.

Fig. 2 is a signal diagram showing the safety controller in one embodiment.

Fig. 3 1s a block diagram of the safety controller in one embodiment.

Fig. 4 is a block diagram showing an anomaly checking process in one embodiment.

Fig. 5 is a block diagram showing a sensor and a safety controller required in making a stop decision in one embodiment.

Fig. 6 is a diagram showing sensor input information used for the self-diagnostic in one embodiment.

Fig. 7 is a graph explaining a data table used in a terminal floor over-speed error check process in one embodiment.

Fig. 8 is an output time chart for the safety controller in one embodiment.

DESCRIPTION OF THE EMBODIMENTS:

One embodiment of this invention will be described in detail by referring the drawings.

As a safety device in the elevator, a final limit switch is provided, for example, at the upper and lower ends of an elevator shaft. This switch detects that the elevator car position has exceeded the normal operation range and, when turned on, stops the car.

The stopping of the elevator car is effected by the activation of a brake mounted to a motor driving a main rope of the car, an interruption of power supply to a drive motor of a hoist, and an activation of an emergency stopping device upon detection of an over-speed of the car. The emergency stopping device is mounted on the car and, when activated, seizes guiderails to bring the car to an immediate stop.

In halting the car, a combination of mechanical parts = switch-relay and contactor — may be used for the activation of brake or for the power supply interruption. For an emergency stop, a combination of governor and governor rope may be used. In elevators that have replaced these mechanical safety devices with electronic ones, the microcomputers use input information from sensors such as safety switch and encoder to calculate (detect) the position and speed of the car and, when an emergency event is detected, issues a car stop signal.

That is, the safety controller 40, based on the sensor information representing the operation state, calculates the position and speed of the elevator car to detect any abnormal condition of the car and then generates a command signal to bring the car to safe state (to.a halt).

Fig. 1 shows an overall construction of the elevator with an electronic safety system. The elevator car | moves up or down an elevator shaft as a motor 2 drives a main rope 10 connected to a counter weight 11. The motor 2 is supplied electricity from an inverter 5 connected to an AC power supply 7 through a power interruption circuit 6. When the power interruption circuit 6 operates, the power supply to the inverter 5 is stopped and the driving force of the motor 2 is lost. A brake 3 restrains the driving force of the motor 2, producing a braking force on the elevator car 1. The brake 3 is normally activated and, when power is restored, it is deactivated.

A governor rope 12 is pulled by the elevator car 1 as it moves, causing a governor 13 to rotate. The governor 13 has a gripping device 14 and a rotary encoder 21. The gripping device 14, when activated, grips the governor rope 12. At this time, if the car 1 is moving, an emergency stopping device 15 grips a rail 16 bringing the car to a halt. The rotary encoder 21 rotates with the governor 13 to generate a pulse signal. Integrating changes in the pulse signal can determine the position of the car 1 and averaging the time of changes can determine the speed of the car 1-.-

At the lower end of the elevator shaft there is installed a buffer 17 which absorbs an impact of the descending car 1 when the car 1 fails to be completely stopped by the braking force of the brake 3 and the emergency stopping device 15.

Installed near the lower and upper ends of the elevator shaft are final limit switches 22,23. These safety switches are normally ON and, when contacted by the ascending or descending car 1, are turned OFF, thus detecting the overrun of the car 1.

An operation controller 30 and a safety controller 40 are provided in a control panel installed near the elevator shaft or the nearby motor 2. The operation controller 30 controls the inverter 5 to operate the car 1. The safety controller 40, in response to inputs from the rotary encoder 21 and the final limit switches 22, 23, brakes the car by the brake 3, the power interruption circuit 6 and the emergency stopping device 15, which is activated by the gripping device 14. The elevator is provided with a number of safety switches not shown other than the final limit switches, such as those for protecting maintenance workers during maintenance service.

Fig. 2 shows a signal connection diagram for the elevator. The operation controller 30 outputs an inverter control signal 31 to control the inverter 5.

The safety controller 40 has two microcomputers 50 and 60, each of which has

CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory) and peripheral circuits, such as digital input/output, encoder input and communication interface, all interconnected through internal buses (not shown).

The microcomputers 50, 60 take in an encoder signal 41 from the rotary encoder 21 and final limit switch signals 42, 43 from the final limit switches 22, 23.

The microcomputer 50 outputs a stop request signal 51 to an AND circuit 70, a power interruption signal 52 to the contactor of the power interruption circuit 6, a brake activation signal 53 to a brake driving circuit 4 that energizes the brake 3, and an emergency stop activation signal 54 to the gripping device 14. These output signals are also fed simultaneously to the microcomputer 60. Similarly, the microcomputer 60 outputs a stop request signal 61 to the AND circuit 70, a power interruption signal 62 to the contactor of the power interruption circuit 6, a brake activation signal 63 to the brake driving circuit 4, and an emergency stop activation signal 64 to the gripping device 14. These four output signals are also fed to the microcomputer 50. All of the eight output signals activate the stopping means of the elevator car 1.

The stop request signals 51, 61 cause the operation controller 30 to stop the elevator car 1. When the signal level is high (H), these signals are not making any request; and when low (L), they are requesting to stop the car. These signals are also used during an elevator diagnosis. The two signals are output to the operation controller 30 through the AND circuit 70, so that if one of the stop request signals 51, 61 goes low, the operation controller 30 stops the elevator car 1.

The power interruption signals 52, 62 are connected respectively to two contactors in the power interruption circuit 6. When the signals are ON, the contactors are closed; and when OFF, the contactors are open. The two contactors are connected in series, so turning off one of the power interruption signals 52, 62 causes the power interruption circuit 6 to cut off the circuit between the AC power supply 7 and the inverter 5.

The break activation signals 53, 63 are connected respectively to two contactors in the brake driving circuit 4. When these signals are ON, the contactors are closed; and when they are OFF, the contactors are open. Since the two contactors are connected in series, if one of the signals is OFF, the brake driving circuit 4 cuts off power supply to the brake 3.

The emergency stop activation signals 54, 64 are supplied to a solenoid that drives the gripping device 14. When both signals are ON, the gripping device 14 is not energized.

When one of the signals is OFF, the gripping device is energized.

Fig. 3 is a block diagram showing functions of the microcomputers 50, 60. The microcomputer 50 has a processing unit 81A, an input unit 82A, an output unit 83A, a comparison unit 84A, an input selection unit 85A, an elevator-at-rest check unit 86A and a diagnostic input information storage unit 87A. - Similarly the microcomputer 60 has a processing unit 1B, an input unit 82B, an output unit 83B, a comparison unit 4B, an input selection unit 85B, an elevator-at-rest check unit 86B and a diagnostic input information storage unit 87B.

These units are programs that are stored either in the microcomputer or in an external ROM and executed by the CPU of the microcomputer to implement their functions.

These programs may be executed cyclically by the CPU at a period of 10 ms using a timer of the microcomputers 50, 60 or executed by the CPU upon receiving an interrupt generated by the input units 82A, 82B whenever they detect a change in the input signal. Details of safety functions realized by the microcomputers 50, 60 will be described as follows.

The input units 82A, 82B are functions to take in signals from sensors that detect the operation state of the elevator. The signals the input units take in include the encoder signal 41, the final limit switch signals 42, 43 and other safety switch signals (not shown).

The encoder signal 41 is converted into values representing the speed and position ofthe elevator car 1. The position information is reset to a predetermined initial value when the final limit switch signals 42, 43 are detected. The final limit switch signals 42, 43 are converted from ON to High and from OFF to Low. These pieces of input information are transmitted to the input selection units 85A, 85B and to the elevator-at-rest check units 86A, 86B.

The elevator-at-rest check units 86A, 86B check whether the elevator is at rest, based on the input information and notify their decisions to the input selection units 85A, 85B.

The input selection units 85A, 85B send to the processing units 81 A, 81B the input information from the input units 82A, §2B when the elevator is in normal operation and, when they are notified by the elevator-at-rest check units 86A, 86B that the elevator is at rest, send the diagnostic input information to execute the self-diagnosis.

The diagnostic input information is stored in the diagnostic input information storage units 87A, 87B. The output units 83A, 83B output a car stop signal (fow level causes the car to stop), a result of calculation by the processing units 81A, 81B. The comparison units 84A, 84B compare the car stop signal produced by the output units 83A, 83B with another car stop signal produced by the other microcomputer and check whether the both systems (two microcomputers) are operating normally (self-diagnostic). When any disagreement between them is found, the comparison units control the output units 83A, 83B to cause the car stop signal to go low (to stop the car), as shown in Fig. 3.

Fig. 4 shows an example of an anomaly checking process executed by the processing units 81A, 81B. Fig. 4 does not show the input unit and the input selection unit for simplicity. In the figure, a safety chain anomaly checking process 90 and a terminal floor overspeed checking process 91 are incorporated. When any one of the safety switches such as the final limit switches 22, 23 is off, i.e., any one of the final limit switch signals 42, 43, etc. is low, the safety chain anomaly checking process 90 issues a low-level signal causing the power interruption signal 52 and the brake activation signal 53 to go low, outputting an instruction for activating the brake 3 and the power interruption circuit 6.

The terminal floor overspeed checking process 91 has as recorded data tables a first speed upper limit curve 92 and a second speed upper limit curve 93 that are obtained by plotting the position of the elevator car 1 in the elevator shaft on an abscissa and the car speed on an ordinate.

The terminal floor overspeed checking process 91 calculates a first speed upper limit corresponding to the position of the elevator car 1 from the signal of the rotary encoder 21 based on the first speed upper limit curve 92. If the car speed calculated from the signal of the rotary encoder 21 is found to be in excess of the first speed upper limit, this process 91 issues a low-level signal to make tlie power interruption signal 52 and the brake activation signal 53 go low, instructing the activation of the brake 3 and the power interruption circuit 6.

The terminal floor overspeed checking process 91 also calculates a second speed upper limit corresponding to the car position based on the second speed upper limit curve 93. If the car speed is found to be in excess of the second speed upper limit, this process 91 issues a low-level signal to have the emergency stop activation signal 54 go low, activating the emergency stopping device 15 through the gripping device 14.

When the elevator-at-rest check units 86 A, 86B decide that the elevator is at rest, the diagnosis is performed on the microcomputers 50, 60. In Fig. 5, of the sensor input information representing the operational state of the elevator, information from a car door switch 25, a car interior monitoring camera 26 and a car weight sensor 27, all mounted on the elevator car, are fed to the safety controller 40 in which the elevator-at-rest check units 86A, 86B use these sensor inputs to check whether the elevator is at rest.

For example, if an elevator state in which the car speed is zero or in which the car door switch 25 is ON (car door is closed) and car speed is zero persists for more a predetermined time, it is decided that the elevator is at rest.

The elevator is also determined to be at rest when a predetermined time passes after it has been decided based on the car interior monitoring camera 26 and the car weight sensor 27 that there are no passengers in the elevator car. Further, two operation modes — normal mode and maintenance mode — may be provided in the microcomputers 50, 60 and made externally changeable through a communication line or switch. In that case, when the elevator is in the maintenance mode, the elevator may be decided to be at rest.

Fig. 6 shows an example of diagnostic input information stored in the diagnostic input information storage units §7A, 87B. There are four kinds of diagnostic input information, each represented by a combination of final limit switches (upper end and lower end), car position and car speed. As forthe car position-and car speed, in a data table of Fig. 7 used in the terminal floor overspeed checking process 91, data at three points A, B, C, one in each of three regions — a normal region, a region between the first speed upper limit curve 92 and the second speed upper limit curve 93 and a region beyond the second speed upper limit curve 93 — are stored.

In diagnostic patterns 1 and 2, the final limit switches 22, 23 are turned off to generate abnormal state. For the car position and car speed, point A in the normal region is used. In diagnostic patterns 3 and 4, the final limit switches are turned on (normal) and the car position and car speed are picked up from points B and C, respectively, to simulate an abnormal condition.

A time chart of Fig. 8 show output signals 51-54, 61-64 produced when the processing units 81A, 81B perform the diagnostic test by using the above diagnostic input information.

When the microcomputers are working normally, they output a car stop signal (Low) for the input values of all diagnostic patterns. When the elevator-at-rest check units 86A, 86B decide that the elevator is at rest, they send this information to the input selection units 85A, 85B, which in turn supply the diagnostic input information of diagnostic patterns 1-4 successively to the processing units 81A, 81B.

In diagnostic patterns 1, 2, 3, the stop request signals 51, 61, the power interruption signals 52, 62 and the break activation signals 53, 63 all go low, whereas the emergency stop activation signals 54, 64 remain high. The diagnostic pattern 4 produces low emergency stop activation signals 54, 64. It is noted, however, that once the emergency stop is activated, it cannot automatically be canceled but requires a recovery work. So, the emergency stop activation signals 54, 64 are output for only a time duration that will not result in the gripping device 14 being operated. In the diagnostic pattern 4, the stop request signals 51, 61 and the power interruption signals 52, 62 are low, whereas the break activation signals 53, 63 are kept high to prevent the activation of the brake 3 because simultaneous activation of both the brake 3 and the emergency stopping device 15 can produce too strong a braking force.

The comparison units 84A, 84B compare the car stop signals from the two microcomputers and, if they disagree, outputs a low-level car stop signal through the output units 83A, 83B, bringing the car to a halt. This procedure enables an anomaly to be detected not only when the levels of car stop signals are different due to a failure of the arithmetic unit or the output unit in one microcomputer but also when the diagnostic timings in the two microcomputers are not synchronous due to a failure of the input unit, the elevator-at-rest check unit or the input selection unit.

As to the timing for comparison, the condition for comparison timing is loosely set such that the car stop signal from one microcomputer needs only to change within a few hundred milliseconds of an earlier change in the car stop signal from the other microcomputer.

-g.-

This renders it unnecessary to strictly synchronize the two microcomputers in calculation, as is required when comparing interim calculation results about the car position and car speed.

As described above, when the elevator-at-rest check units 86A, 86B in the microcomputers 50, 60 of the safety controller 40 determines that the elevator is at rest, the arithmetic units 81A, 81B perform simulation calculations using diagnostic input information that causes the output signals 51-54, 61-64 to change to a car-stopping level and then the comparison units 84A, 84B compare cach other’s calculated results. This is equivalent to the safety controller performing a self-diagnostic, allowing for the detection of any failure ranging from the arithmetic unit to the output unit to be detected.

Further, since the need to compare interim calculation results of, for example, the car position and car speed produced by the two microcomputers is eliminated, complex processing to synchronize the process timings of the microcomputers is no longer required, facilitating a highly reliable design of the safety devices and reducing software processing load.

In the above embodiment although the safety controller has its microcomputer duplicated, the reliability is raised even further by triplicating or making it more redundant. It is desirable from the standpoint of safety to use as a processing device a microcontroller with integrated circuits or a muiticore microcontroller (having a plurality of CPUs in one semiconductor chip).

The reliability can be further improved by duplicating the rotary encoder 21 and feeding the duplicated signals one to each microcomputer. This configuration enables a failure of the rotary encoder to be detected by the aforementioned diagnostic method. More specifically, if a rotary encoder connected to one microcomputer should fail, e.g., an encoder value gets stuck, this microcomputer decides that the car speed is zero and initiates the self diagnostic, with the result that the car stop signals from the two microcomputers fail to match.

This ensures that any failure occurring not just in the processing unit and the output unit of the safety controller but in a wider range including the rotary encoder and its signal input unit can be detected.

Further, one of the two car stop signals to be compared may be taken not from the microcomputer output but from a signal that is output to the outside of the safety controller.

This arrangement is equivalent to checking the one car stop signal against the output, contributing to a more comprehensive failure detection.

Claims (9)

CLAIMS:

1. An elevator equipped with an electronic safety system, comprising: a safety controller (40) to check for an abnormal condition based on input information from sensors monitoring an operation state of an elevator car (1) and to produce a command signal to bring the elevator car to a safe state; wherein when it is decided based on the sensor input information that the elevator car (1) is at rest, the safety controller (40) performs a self-diagnostic to see if it is working normally.

2. An elevator equipped with an electronic safety system according to claim 1, wherein the safety controller (40) uses diagnostic input information to perform the self- diagnostic.

3. An elevator equipped with an electronic safety system according to claim 1, wherein the safety controller includes: a plurality of elevator-at-rest check units (86A, 86B) to decide if the elevator car (1) is at rest; a plurality of input selection units (85A, 85B) to output the sensor input information when the elevator car is operating normally and, when the elevator-at-rest check units (86A, 86B) decide that the elevator car is at rest, output the diagnostic input information; and a plurality of processing units (81A, 81B) to check an anomaly of the elevator car based on the output information from the input selection units (85A, 85B).

4. An elevator equipped with an electronic safety system according to claim 3, further comprising: comparison units to compare an output from one of the processing units (§1A, 81B) with an output from the other processing unit; wherein the diagnostic input information is information to stop the elevator car.

5. An elevator equipped with an electronic safety system according to claim 3, wherein the diagnostic input information is information to stop the elevator car; wherein if the output of one of the processing units 81A, 81B and the output of the other processing unit, when compared, disagree, the elevator car is stopped.

6. An elevator equipped with an electronic safety system according to claim 3, wherein the diagnostic input information is information to stop the elevator car; wherein when the elevator-at-rest check units (86A, 86B) decide that the elevator car is at rest and if an output from one of the processing units (81A, 81B) and an output from the other processing unit agree as a stop signal, it is diagnosed that the safety controller (40) is working normally.

7. An elevator equipped with an electronic safety system according to claim 3, wherein the sensors include an encoder (21) for detecting a speed and a position of the elevator car (1) and an elevator car door switch (25) mounted on the elevator car (1) for detecting an open/close state of the door; wherein, when a state in which the elevator car door (1) is closed and the speed of the elevator car (1) is zero persists for a predetermined time, it is decided that the elevator car is at rest.

8. An elevator equipped with an electronic safety system according to claim 3, wherein the sensors are a car interior monitoring camera (26) for checking the presence or absence of passengers inside the car or a car weight sensor (27); wherein, when a state in which there are no passengers in the elevator car (1) persists for a predetermined time, it is decided that the elevator car is at rest.

9. An elevator equipped with an electronic safety system according to claim 3, wherein the safety controller (40) comprises two microcomputers (50, 60) each having the elevator-at-rest check unit (86A, 86B), the input selection unit (85A, 85B) and the processing unit (81A, 81B).