WO2006090470A1 - Elevator apparatus - Google Patents

Elevator apparatus Download PDF

Info

Publication number
WO2006090470A1
WO2006090470A1 PCT/JP2005/003132 JP2005003132W WO2006090470A1 WO 2006090470 A1 WO2006090470 A1 WO 2006090470A1 JP 2005003132 W JP2005003132 W JP 2005003132W WO 2006090470 A1 WO2006090470 A1 WO 2006090470A1
Authority
WO
WIPO (PCT)
Prior art keywords
circuit
abnormality
signal
output
elevator
Prior art date
Application number
PCT/JP2005/003132
Other languages
French (fr)
Japanese (ja)
Inventor
Tatsuo Matsuoka
Original Assignee
Mitsubishi Denki Kabushiki Kaisha
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Family has litigation
First worldwide family litigation filed litigation Critical https://patents.darts-ip.com/?family=36927121&utm_source=google_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=WO2006090470(A1) "Global patent litigation dataset” by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
Application filed by Mitsubishi Denki Kabushiki Kaisha filed Critical Mitsubishi Denki Kabushiki Kaisha
Priority to JP2007504602A priority Critical patent/JP4757863B2/en
Priority to CNB2005800349327A priority patent/CN100542927C/en
Priority to PCT/JP2005/003132 priority patent/WO2006090470A1/en
Priority to EP05719533.1A priority patent/EP1852382B1/en
Publication of WO2006090470A1 publication Critical patent/WO2006090470A1/en

Links

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0006—Monitoring devices or performance analysers
    • B66B5/0018—Devices monitoring the operating condition of the elevator system
    • B66B5/0031—Devices monitoring the operating condition of the elevator system for safety reasons
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0087—Devices facilitating maintenance, repair or inspection tasks
    • B66B5/0093—Testing of safety devices
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/02—Applications of checking, fault-correcting, or safety devices in elevators responsive to abnormal operating conditions
    • B66B5/027—Applications of checking, fault-correcting, or safety devices in elevators responsive to abnormal operating conditions to permit passengers to leave an elevator car in case of failure, e.g. moving the car to a reference floor or unlocking the door

Definitions

  • the present invention relates to an elevator apparatus using an electronic safety controller that detects an abnormality of an elevator based on a sensor force detection signal.
  • Patent Document 1 Japanese Translation of Special Publication 2002-538061
  • the present invention has been made to solve the above-described problems, and an object thereof is to obtain an elevator apparatus that can improve the reliability of a safety system with a relatively simple configuration.
  • An elevator apparatus includes an elevator control unit that controls operation of a force, and an electronic safety controller that detects an abnormality of the elevator and generates a command signal for shifting the elevator to a safe state.
  • the electronic safety controller can detect an abnormality in the electronic safety controller itself, and if an abnormality is detected in the electronic safety controller itself, it issues an elevator command for stopping the nearest floor to stop the force on the nearest floor. In addition to outputting to the control unit, the output power of the nearest floor stop command When a preset time has elapsed, an emergency stop command for emergency stop of the force is output to the elevator control unit.
  • FIG. 1 A configuration diagram illustrating an elevator apparatus according to Embodiment 1 of the present invention.
  • FIG. 2 is a graph showing an overspeed pattern set in the governor and ETS circuit section of FIG.
  • FIG. 3 is a block diagram showing the connection relationship of the electronic safety controller, elevator control panel and various sensors shown in FIG. 1.
  • FIG. 4 is a block diagram showing a device configuration of a main part of the electronic safety controller of FIG. 1.
  • FIG. 5 is an explanatory diagram showing a method for executing arithmetic processing by the microprocessor of FIG. 4;
  • FIG. 6 is a block diagram showing a main part of the electronic safety controller of FIG.
  • FIG. 7 is a configuration diagram showing a specific configuration of the clock abnormality detection circuit of FIG.
  • FIG. 8 is an explanatory diagram showing an area division in the RAM of the electronic safety controller of FIG.
  • FIG. 9 is a flowchart showing an initial operation of the electronic safety controller of FIG.
  • FIG. 10 is a flowchart showing a first example of an interrupt calculation flow of the electronic safety controller of FIG. 1.
  • FIG. 11 is a block diagram showing a main part of the electronic safety controller of FIG. 1.
  • FIG. 12 is a block diagram showing a main part of the electronic safety controller of FIG.
  • FIG. 13 is a circuit diagram showing an example of a specific configuration of the chip function circuit of FIG.
  • FIG. 14 is an explanatory diagram showing the meaning of data related to each bit of the data bus when the check function circuit of FIG. 12 is subjected to the first and second CPU cards.
  • FIG. 15 is a flowchart showing the power supply voltage monitoring soundness check method on the first CPU side in FIG.
  • FIG. 16 is a flowchart showing an operation when the CPU is reset in the elevator control device of FIG.
  • FIG. 17 is an explanatory diagram showing the relationship between the stage of the initial setting operation of the ETS circuit section of FIG. 1 and the operation of the operation control section and the safety circuit section.
  • FIG. 18 is an explanatory diagram for explaining the movement of the force in the initial setting operation mode of the elevator apparatus of FIG.
  • FIG. 19 is a circuit diagram showing a contact abnormality detection unit of the electronic safety controller of FIG. 20 is a flowchart for explaining an operation test method for the safety relay main contact of FIG.
  • FIG. 21 is a block diagram showing a state where a history information recording unit and a soundness diagnosis unit are connected to the electronic safety controller of FIG.
  • FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit of FIG.
  • FIG. 23 is a flowchart for explaining the operation of the electronic safety controller of FIG. 21.
  • FIG. 24 is a block diagram showing a main part of the electronic safety controller of FIG. 1.
  • FIG. 25 is a circuit diagram specifically showing a data comparison circuit for data abnormality check in FIG. 24.
  • FIG. 26 is a circuit diagram specifically showing a designated address detection circuit for checking an address bus abnormality in FIG. 24.
  • FIG. 27 is a flowchart showing processing operations by designated address output software and a designated address detection circuit in the CPU of FIG.
  • FIG. 28 is a flowchart showing the processing operation of the data bus abnormality check software in the CPU of FIG. 24.
  • FIG. 29 is a flowchart showing the operation of the electronic safety controller and the elevator controller when the nearest floor stop command is generated in FIG.
  • FIG. 30 is a circuit diagram showing the main parts of the electronic safety controller and elevator control unit of FIG. 1.
  • FIG. 1 is a configuration diagram showing an elevator apparatus according to Embodiment 1 of the present invention.
  • a pair of car guide rails 2 and a counterweight guide rail (not shown) are installed in the hoistway 1.
  • the force 3 is guided by the car guide rail 2 and moved up and down in the hoistway 1.
  • the counterweight 4 is raised and lowered in the hoistway 1 by being guided by the counterweight guide rail.
  • an emergency stop device 5 that engages with the force car guide rail 2 and makes the car 3 stop emergency is mounted.
  • the emergency stop device 5 has a pair of braking pieces (wedge members) 6 that are operated by mechanical operation and pressed against the car guide rail 2.
  • a driving device (lifting machine) 7 for raising and lowering the force 3 and the counterweight 4 via a main rope is installed.
  • the drive unit 7 generates a detection signal corresponding to the rotation of the drive sheave 8, the motor unit (not shown) that rotates the drive sheave 8, the brake unit 9 that brakes the rotation of the drive sheave 8, and the drive sheave 8.
  • a motor encoder 10 is provided.
  • an electromagnetic brake device is used as the brake unit 9, for example.
  • the brake shoe is pressed against the braking surface by the spring force of the braking spring to brake the rotation of the drive sheave 8, and the brake magnet is separated from the braking surface force by exciting the electromagnetic magnet. And braking is released.
  • the elevator control panel 11 is disposed, for example, in the lower part of the hoistway 1 or the like.
  • the elevator control panel 11 is provided with an operation control unit 12 for controlling the operation of the drive device 7 and a safety circuit unit (relay circuit unit) 13 for suddenly stopping the car 3 when the elevator is abnormal. Yes.
  • a detection signal from the motor encoder 10 is input to the operation control unit 12.
  • the operation control unit 12 obtains the position and speed of the car 3 based on the detection signal from the motor encoder 10 and controls the driving device 7.
  • a speed governor (mechanical speed governor) 14 is installed in the upper part of the hoistway 1.
  • the governor 14 is provided with a governor sheave 15, an overspeed detection switch 16, a rope catch 17, and a governor encoder 18 as a sensor.
  • a governor rope 19 is wound around the governor sheave 15. Both ends of the governor rope 19 are connected to the operation mechanism of the safety device 5.
  • the lower end portion of the governor rope 19 is wound around a tension wheel 20 disposed at the lower part of the hoistway 1.
  • V 1st overspeed (OS speed), higher than 1st overspeed !, 2nd overspeed (Trip speed) are set.
  • the overspeed detection switch 16 When the traveling speed of the force 3 reaches the first overspeed, the overspeed detection switch 16 is operated. When the overspeed detection switch 16 is operated, the relay circuit of the safety circuit unit 13 is opened. When the traveling speed of the force 3 reaches the second overspeed, the rope catcher 17 grips the governor group 19 and the circulation of the governor rope 19 is stopped. When the circulation of the governor rope 19 is stopped, the emergency stop device 5 is braked.
  • the governor encoder 18 generates a detection signal corresponding to the rotation of the governor sheave 15.
  • the governor encoder 18 is a dual sense type encoder that outputs two detection signals, that is, first and second detection signals simultaneously.
  • the first and second detection signals from the governor encoder 18 are input to the ETS circuit unit 22 of the terminal floor forced reduction device (ETS device) provided in the electronic safety controller 21.
  • the ETS circuit unit 22 detects an abnormality of the elevator based on the detection signal from the governor encoder 18 and outputs a command signal for shifting the elevator to a safe state. Specifically, the ETS circuit unit 22 obtains the traveling speed and position of the car 3 independently of the operation control unit 12 based on a signal from the governor encoder 18, and the traveling of the car 3 near the terminal floor is performed. Monitor whether the speed has reached ETS monitoring overspeed.
  • the ETS circuit unit 22 converts the signal from the governor encoder 18 into a digital signal and performs digital arithmetic processing, so that the traveling speed of the force 3 reaches the ETS monitoring overspeed. Judge whether. When the ETS circuit unit 22 determines that the traveling speed of the car 3 has reached the ETS monitoring overspeed, the relay circuit of the safety circuit unit 13 is opened.
  • the ETS circuit unit 22 can detect an abnormality in the ETS circuit unit 22 itself and an abnormality in the governor encoder 18. When an abnormality is detected in the ETS circuit unit 22 itself or the governor encoder 18, the nearest floor stop command signal as a command signal for shifting the elevator to a safe state is sent from the ETS circuit unit 22 to the operation control unit 12. Are output. Further, bidirectional communication is possible between the ETS circuit unit 22 and the operation control unit 12.
  • First to fourth reference sensors 23-26 are provided for delivery.
  • the detection signal of the reference sensor 23-26 is input to the ETS circuit section 22.
  • the ETS circuit unit 22 corrects the information on the position of the car 3 obtained in the ETS circuit unit 22 based on the detection signal from the reference sensor 23-26.
  • a force buffer 27 and a counterweight buffer 28 are installed between the bottom surface of the hoistway 1 and the lower surfaces of the car 3 and the counterweight 4.
  • the car buffer 27 and the counterweight buffer 28 are installed in the lower part of the hoistway 1.
  • the car shock absorber 27 is disposed directly under the force 3 to reduce the impact when the car 3 collides with the bottom of the hoistway 1.
  • the counterweight buffer 28 is disposed directly below the counterweight 4 and reduces the impact when the counterweight 4 collides with the bottom of the hoistway 1.
  • these shock absorbers 27 and 28 for example, oil-filled or spring-type buffers are used.
  • FIG. 2 is a graph showing an overspeed pattern set in the governor 14 and the ETS circuit unit 22 of FIG.
  • the speed pattern of the car 3 is a normal speed pattern VO.
  • the governor 14 is set with first and second overspeed patterns VI and V2 by mechanical position adjustment.
  • the ETS circuit overspeed pattern VE is set in the ETS circuit section 22.
  • the ETS monitoring overspeed pattern VE is set higher than the normal speed pattern VO.
  • the ETS monitoring overspeed pattern VE is set so as to be approximately equidistant from the normal speed pattern VO in the entire lifting process. That is, the ETS monitoring overspeed pattern VE changes according to your position. More specifically, the ETS monitoring overspeed pattern VE is set to be constant near the intermediate floor, but continuously and smoothly as it approaches the terminal end (upper and lower ends) of the hoistway 1 near the terminal floor. It is set to be low. In this way, the ETS circuit section 22 monitors the traveling speed of the force 3 even in the vicinity of the intermediate floor (a constant speed traveling section in the normal speed pattern VO) that is not only in the vicinity of the terminal floor, but in the vicinity of the intermediate floor. Therefore, it is not always necessary to monitor.
  • the first overspeed pattern VI is set higher than the ETS monitoring overspeed pattern VE.
  • the second overspeed pattern V2 is set higher than the first overspeed pattern VI.
  • the first and second overspeed patterns VI and V2 are constant at all heights in the hoistway 1.
  • the buffer stroke of the counterweight buffer 28 is limited by the governor 14 according to the collision speed of the counterweight 4 to the counterweight buffer 28 limited by the ETS circuit section 22. It is set shorter than the stroke specified according to the impact speed.
  • the buffer stroke of the car shock absorber 27 is specified according to the collision speed limited by the governor 14.
  • the chopper strokes of the shock absorbers 27 and 28 are the initial speed when the force 3 and the counterweight 4 first contact each other, and the allowable deceleration until the force 3 and the counterweight 4 stop. It depends on Accordingly, the buffer stroke of the counterweight buffer 28 is set shorter than the buffer stroke of the car buffer 27. That is, the knot fast stroke of the counterweight shock absorber 28 is shorter than the buffer stroke of the car shock absorber 27.
  • the counterweight buffer 28 is also destroyed when the counterweight 4 collides at a speed larger than the speed specified by the ETS monitoring overspeed pattern VE, for example, when the main rope breaks. It is set to a sufficient capacity so that it does not occur. As described above, as a method for securing a sufficient capacity of the counterweight buffer 28, for example, there is a force using a buffer having a larger capacity than usual, or a method using a plurality of buffers having a normal capacity. .
  • FIG. 3 is a block diagram showing a connection relationship among the electronic safety controller 21, the elevator control panel 11, and various sensors shown in FIG.
  • the electronic safety controller 21 includes two detection signals from the governor encoder 18, detection signals from the first and fourth reference sensors 23 to 26, and other sensors (first and first N The signal from the sensor is input.
  • the electronic safety controller 21 has a plurality of signal input ports corresponding to each sensor. That is, the signals from each sensor are input to the electronic safety controller 21 separately. to this Thus, the electronic safety controller 21 can detect abnormality of each sensor.
  • a failure 'abnormality content signal including the content of the failure or abnormality is generated.
  • a stop signal corresponding to the content of the failure or abnormality is input to a drive / braking unit (not shown) of the elevator control panel 11.
  • FIG. 4 is a block diagram showing a device configuration of a main part of the electronic safety controller 21 of FIG.
  • the electronic safety controller 21 detects the abnormality of the elevator based on the first microprocessor 31 that executes arithmetic processing for detecting the abnormality of the elevator based on the first safety program and the second safety program. Including a second microphone port processor 32 for executing arithmetic processing to perform!
  • the first safety program is a program having the same content as the second safety program.
  • the first and second microprocessors 31 and 32 can communicate with each other via an interprocessor bus and a two-port RAM 33. Further, the first and second microprocessors 31 and 32 can confirm the soundness of the first and second microprocessors 31 and 32 themselves by comparing the calculation processing results of each other. In other words, the soundness of the microprocessors 31 and 32 is confirmed by having the first and second microprocessors 31 and 32 execute the same processing and comparing the processing results via the 2-port RAM 33 and the like. .
  • microprocessors 31 and 32 can detect abnormalities in the electronic safety controller 21 other than those in the microprocessors 31 and 32 themselves by arithmetic processing.
  • FIG. 5 is an explanatory diagram showing a method of executing arithmetic processing by the microprocessors 31 and 32 of FIG.
  • the microprocessors 31 and 32 repeatedly execute the arithmetic processing according to the program stored in the ROM at a predetermined arithmetic cycle (for example, 50 msec) based on the signal from the fixed-cycle timer.
  • Programs executed within one cycle include a safety program for detecting elevator abnormalities and a fault / abnormality check program for detecting faults / abnormalities in the electronic safety controller 21 itself and various sensors. It is.
  • the failure / abnormality check program may be executed only when preset conditions are satisfied.
  • the electronic safety controller 21 is replaced with the electronic safety controller 21. Even if an abnormality of the electronic safety controller 21 itself is detected, a command signal for shifting the elevator to a safe state is output even when an abnormality of the electronic safety controller 21 itself is detected.
  • the reliability of the safety system can be improved with a relatively simple configuration while increasing the processing speed.
  • the electronic safety controller 21 can detect abnormality of various sensors, and even when the abnormality of the sensor is detected, it outputs a command signal for shifting the elevator to a safe state. The reliability can be further improved.
  • the electronic safety controller 21 includes first and second microprocessors 31, 32, and the first and second microprocessors 31, 32 compare the first and second processing results with each other. Since the soundness of the second microprocessor 31, 32 itself can be confirmed, the reliability of the safety system can be further improved.
  • FIG. 6 is a block diagram showing a main part of the electronic safety controller 21 of FIG.
  • the electronic safety controller 21 employs a dual circuit configuration to ensure sufficient reliability.
  • the electronic safety controller 21 uses first and second CPUs (processing units) 41 and 42 as first and second microprocessors.
  • the first CPU 41 outputs a control signal to the operation control unit 12 and the first output interface (output unit) 43.
  • the second CPU 42 outputs a control signal to the operation control unit 12 and the second output interface (output unit) 44.
  • the operation control unit 12 When the operation control unit 12 receives similar control signals from the first and second CPUs 41 and 42, the operation control unit 12 is controlled by the control signals.
  • the first and second output interfaces 43 and 44 output a signal for opening the safety circuit unit 13 based on the control signals from the first and second CPUs 41 and 42.
  • the first and second CPUs 41 and 42 are connected to a two-port RAM 45 for exchanging data between them.
  • a first watchdog timer 46 is connected to the first CPU 41.
  • a second watchdog timer 47 is connected to the second CPU.
  • the first CPU 41 receives two signals from the governor encoder 18 (Fig. 1). .
  • two signals from the governor encoder 18 are also input to the second CPU 42.
  • the signal from the governor encoder 18 is processed by the CPUs 41 and 42, whereby the speed and position of the car 3 (FIG. 1) are obtained. That is, the governor encoder 18 functions as a speed sensor and a position sensor.
  • the CPUs 41 and 42 are also input with various sensor force signals as shown in FIG.
  • the first CPU 41 receives the first clock signal from the first clock 48.
  • the second CPU 42 receives the second clock signal such as the second clock 49.
  • the frequencies of the first and second clock signals are set equal to each other.
  • the first and second clock signals are also input to the clock abnormality detection circuit 50.
  • the clock abnormality detection circuit 50 counts the number of pulses of the first and second clock signals, and detects the abnormality of the first and second clock signals from the difference in the number of pulses.
  • the first and second CPUs 41 and 42 transmit test mode signals 51 and 52 for checking the soundness of the clock abnormality detection circuit 50 to the clock abnormality detection circuit 50.
  • the first and second CPUs 41 and 42 transmit detection start command signals 53 and 54 for starting clock abnormality detection to the clock abnormality detection circuit 50.
  • the clock abnormality detection circuit 50 inputs error signals 55 and 56 to the first and second CPUs 41 and 42 when detecting a clock abnormality.
  • FIG. 7 is a configuration diagram showing a specific configuration of the clock abnormality detection circuit 50 of FIG.
  • the clock anomaly detection circuit 50 includes a first monitoring counter 57 and a first monitored counter 58 that counts the first edge of the first clock signal, and a second clock that counts the pulse edge of the second clock signal.
  • Monitoring counter 59 and a second monitored counter 60 are provided.
  • the first clock signal is input to the first monitored counter 58 via the first selector 61.
  • the first selector 61 switching between the normal circuit and the test circuit is possible.
  • the first clock signal is input to the first monitored counter 58 as it is.
  • the test circuit the first clock signal is multiplied by the first multiplication circuit 62 and then input to the first monitored counter 58. Switching to the test circuit is performed by inputting a test mode signal 51 from the first CPU 41 to the first selector 61.
  • the second clock signal is sent to the second monitored counter 60 via the second selector 63. Is input. In the second selector 63, switching between the normal circuit and the test circuit is possible. In the normal circuit, the second clock signal is input to the second monitored counter 60 as it is. In the test circuit, the second clock signal is multiplied by the second multiplication circuit 64 and then input to the second monitored counter 60. Switching to the test circuit is performed by inputting the test mode signal 52 from the second CPU 42 to the second selector 63.
  • Ripple carry output signals from the first and second monitored counters 58 and 60, that is, error signals 55 and 56 are latched by the first and second latch units 65 and 66.
  • the first and second latch units 65 and 66 receive the latch release signals 67 and 68 of the first and second CPUs 41 and 42 and release the latched state.
  • the electronic safety controller 21 includes a CPU (microcomputer) including the CPUs 41 and 42 and the ROM shown in FIG.
  • the two pulse signals output from governor encoder 18 are input to CPU41 and 42. Then, the pulse signals are calculated from the CPUs 41 and 42, and the position and speed of the force 3 are obtained. The obtained position and speed are compared with each other via the 2-port RAM 45, and then compared with a set value (reference value) for judging abnormality, for example, ETS monitoring overspeed.
  • a signal is output to the operation control unit 12 or the safety circuit unit 13 according to the content of the abnormality, and the elevator is shifted to a safe state.
  • the transition to the safe state is, for example, that the car 3 is stopped suddenly or the car 3 is stopped on the nearest floor.
  • the operation control unit 12 is further controlled as necessary.
  • a control signal is generated and output to the operation control unit 12.
  • CPUs 41 and 42 an arithmetic operation for obtaining a force speed is executed by counting pulse signals input within a predetermined time.
  • the timer that controls the “certain time” is generated by clock signals from the clocks 48 and 49. Therefore, the frequency of the clock signal is very important.
  • the clock signals of the first and second clocks 48 and 49 are input to the clock abnormality detection circuit 50 to monitor whether there is an abnormality in the clock signal. .
  • Detection start command signals 53, 54 become High and the force is the ripple carry output signal from the first monitoring counter 57, 59.
  • the preset data value of each counter 57-60 is loaded to each counter 57-60. And the count-up is started.
  • the preset data value is the count value when counting starts with the counter 57-60.
  • a threshold value for determining a clock abnormality is set in advance.
  • the preset data value of the monitoring counters 57 and 59 is set to a value larger than the preset data value of the monitored counters 58 and 60, in this case, 4.
  • the monitoring counters 57 and 59 repeatedly count the number of pulses in a range shorter than the monitored counters 58 and 60, and reset the monitored counters 57 and 59 every time they carry over.
  • Monitored Counter 58, 60 is also a force that repeatedly counts the number of pulses. Under normal conditions, the monitoring counters 57, 59 carry over and the monitored counters 58, 60 are reset before the monitored counters 58, 60 carry over. .
  • Such preset data values can be arbitrarily set by configuring the clock abnormality detection circuit 50 with, for example, an FPGA (field programmable gate array).
  • FPGA field programmable gate array
  • the monitored counters 58 and 60 carry over and the ripple carry output signal, that is, the counter value four times before the error signals 55 and 56 are output.
  • the error signals 55 and 56 are not output because they are reset by the ripple carry output signal of the monitoring counters 57 and 59.
  • the ripple carry output signal of the second monitoring counter 59 is reset before the first monitored counter 58 is reset.
  • the ripple carry output signal of the first monitored counter 58 that is, the error signal 55 is output, and the error signal 55 is latched by the latch unit 65.
  • the error signal 56 is output from the second monitored counter 60 in the same manner, and the error signal 56 is latched by the latch unit 66.
  • the clocks 48 and 49 used for the dual CPUs 41 and 42 that do not require the use of a dedicated clock for detecting clock anomalies remain as they are. It can be used to detect clock anomalies, enabling efficient use of hardware resources. Therefore, reliability can be improved with a simple circuit configuration.
  • the preset data value of the counter 57-60 can be set arbitrarily, a critical frequency shift can be detected. As a result, the operation delay time until the safety circuit unit 13 is driven and controlled can be shortened, and a design with higher safety can be realized.
  • the soundness check function of the clock abnormality detection circuit 50 will be described.
  • the test mode signal 51 is transmitted from the first CPU 41 to the clock abnormality detection circuit 50
  • the circuit is switched to the test circuit by the selector 61, and the first clock signal is multiplied by the first multiplication circuit 62. Is done. That is, the first clock signal input to the first monitored counter 58 is intentionally made abnormal. Therefore, if the clock abnormality detection circuit 50 is normal, the error signal 55 is output from the first monitored counter 58.
  • the CPU 41 can confirm the soundness of the clock abnormality detection circuit 50 by receiving the error signal 55 in response to the transmission of the test mode signal 51. Similarly, the health of the second clock 49 can also be checked.
  • the electronic safety controller 21 of this example includes the first and second processing units that perform calculations related to the control of the elevator in a double system, the first clock that sends the first clock signal to the first processing unit, A second clock that sends the second clock signal to the second processing unit, and a clock abnormality detection circuit that detects an abnormality in the first and second clock signals are input, and a clock abnormality is detected.
  • the detection circuit counts the number of pulses in the first and second clock signals, and detects an abnormality in the first and second clock signals from the difference in the number of pulses.
  • the clock abnormality detection circuit counts the monitored counter that counts the number of pulses of either the first or second clock signal and the number of pulses of the other of the first or second clock signal.
  • the preset data value which is the force value when starting counting with the monitored counter, is set to be larger than the preset data value, which is the count value when starting counting with the monitoring counter.
  • the monitoring counter includes a first monitoring counter that counts the number of pulses of the first clock signal and a second monitoring counter that counts the number of pulses of the second clock signal, and the monitored counter Includes a first monitored counter that counts the number of pulses of the first clock signal and a second monitored counter that counts the number of pulses of the second clock signal.
  • the preset data value of the monitoring counter can be arbitrarily set.
  • the clock abnormality detection circuit has a multiplication circuit for multiplying the clock signal input to the monitored counter in the test mode.
  • FIG. 8 is an explanatory diagram showing an area division in the RAM of the electronic safety controller 21 of FIG.
  • the RAM includes a stack area that stores information necessary for computation by the CPU.
  • a subroutine call return address, a timer interrupt return address, and a subroutine call argument are stored.
  • the ROM stores a program for monitoring the state of a preset monitoring area in the RAM stack area. That is, the stack area monitoring unit has a CPU and a ROM.
  • the COOOH—FFFFH area is set as the stack area!
  • the DOOOH-D010H area in the stack area is set as the monitoring area.
  • the power used by the stack area is determined by the microcomputer.
  • the stack pointer of the microcomputer is used to accumulate data to the younger address.
  • the initial value of the stack pointer is set to FFFFH, and used as FFFFH ⁇ FFFEH ⁇ FFFDH ⁇ C001H ⁇ COOOH. Therefore, the monitoring area DOOOH—D010H
  • the position of the monitoring area is preferably an area used when 50% or more of the stack area is used. In particular, the area used when 60% or more of the stack area is used is preferable. The monitoring area is used when 90% or less of the stack area is used. A region is preferred. In particular, the area used when 80% or less of the stack area is used is preferable.
  • the stack area is set to 0 in advance, and the stack area monitoring unit monitors whether the entire monitoring area is 0 or not. If the monitoring area contains data other than 0, it is determined that a stackover has occurred.
  • FIG. 9 is a flowchart showing an initial operation of the electronic safety controller 21 of FIG.
  • the electronic safety controller 21 is initialized.
  • all interrupt operations are disabled (step Sl).
  • the microcomputer is initialized (step S2), and the RAM area is set to 0 (step S3).
  • the interrupt operation is enabled (step S4) and the interrupt wait state is entered (step S5).
  • the interrupt calculation is repeatedly executed every calculation cycle time.
  • FIG. 10 is a flowchart showing a first example of the interrupt calculation flow of the electronic safety controller 21 of FIG.
  • the state of the monitoring area is first confirmed (step S31). That is, it is confirmed whether or not the monitoring area DOOOH-D010H has the state power OOOO.
  • the monitoring area is OOOOH! /
  • the value of the monitoring area is other than 0, it is determined that an interrupt operation that does not have enough time for the interrupt operation processing time does not end within the operation cycle time and a stack over occurs.
  • a calculation for suddenly stopping the force 3 is executed (step S32), and an emergency stop command is output to the safety circuit unit 13.
  • an abnormality detection signal is transmitted to the elevator monitoring room.
  • step S33 If there is no abnormality in the monitoring area, an input calculation for inputting a signal necessary for the calculation is performed (step S33), and the current position of the car 3 and the distance from the current position to the terminal floor are calculated.
  • Car position calculation step S34
  • Car 3 travel force Car speed calculation to find the speed of car 3
  • abnormal speed judgment reference value for example, Fig. 2
  • Judgment criterion calculation step S36
  • step S37 safety monitoring for detecting an abnormal force speed from the car speed and the criterion value
  • step S38 a monitor calculation for monitoring and displaying the state of the elevator
  • step S39 an output calculation for outputting a command signal necessary for permitting the travel of the force 3 or for suddenly stopping the force 3 is executed.
  • the status of the monitoring area is monitored by the stack area monitoring unit, and when it is determined that there is an abnormality in the monitoring area, the car 3 is suddenly stopped. Program runaway due to RAM stack over is prevented. This prevents damage to the equipment. That is, the calculation related to the operation control by the computer can be executed more reliably, and the reliability can be improved.
  • stack over stacking
  • Stackover may occur due to an abnormality in the microcomputer or program, but if these are not abnormal, the primary cause of stackover is that the interrupt operation does not end within the operation cycle time (operation time over) It is thought that.
  • the computation time overtime does not normally occur, it occurs when the computation time temporarily increases, for example, when many call buttons are operated and a long time is required for the call scan computation. It is also possible that the computation time will gradually increase as the software is remodeled or improved, resulting in an overtime.
  • the stack area monitoring unit checks the state of the monitoring area at every preset calculation cycle, it is possible to constantly monitor the presence or absence of a stack over and further improve the reliability. it can. [0098] Further, when it is determined that there is an abnormality in the monitoring area, the force 3 is stopped suddenly, so that a larger failure can be prevented.
  • a signal for shifting the elevator to a safe state is output, and the state of the electronic safety controller 21 at that time is recorded as a history (history calculation). May be.
  • the history is recorded in an area other than the RAM stack area, for example.
  • the electronic safety controller 21 in this example has a stack area for storing information necessary for the operation for monitoring the safety of the elevator, the RAM in the stack area, and the stack area in advance.
  • a stack area monitoring unit that monitors the state of the set monitoring area is provided, and the operation of the elevator is controlled according to the state of the monitoring area detected by the stack area monitoring unit.
  • the stack area monitoring unit confirms the state of the monitoring area every predetermined calculation cycle. In addition, confirmation of the status of the monitoring area is performed as part of the interrupt calculation process for monitoring the safety of the elevator.
  • FIG. 11 is a flowchart showing a second example of the flow of interrupt calculation by the electronic safety controller 21 of FIG.
  • step S41 the pattern of the processing information written in the RAM is first confirmed (step S41).
  • a numerical value (identification value) set in advance for each operation processing task (functional unit) is used as the processing information.
  • the processing information is written in a table set in a predetermined area in the RAM.
  • seven identification values are assigned to seven arithmetic processes, and the identification value is written to the corresponding TBL [0] — [6]. It is. TBL [7] — [9] remains 0 because there is no corresponding operation.
  • TBL [0] — [9] and the table storage pointer are initialized to 0 (step S42).
  • input calculation for inputting the signals necessary for the calculation
  • car position calculation for determining the current position of the force and the distance from the current position to the final floor
  • a car speed calculation for determining the speed of the car
  • a determination reference calculation for determining a determination reference value of the abnormal speed (for example, Fig. 2) according to the distance to the terminal floor are executed.
  • a safety monitoring calculation is performed to detect an abnormality in the force speed from the car speed and the judgment reference value (step S47).
  • the monitor calculation for monitoring and displaying the elevator state is executed (step S48).
  • an output calculation for outputting a command signal necessary for permitting the travel of the force or for suddenly stopping the force is executed according to the result of the safety monitoring calculation (step S49).
  • step S50-56 the identification value is written to the corresponding table. That is, calculation processing and identification value writing are executed alternately.
  • the pattern of the identification value written in this way is confirmed at the start of the next interrupt calculation (step S41). In other words, by confirming the pattern of the identification value, it is determined whether or not the execution order of the arithmetic processing is normal.
  • step S57 When an abnormality is detected in the execution order of the arithmetic processing, a sudden stop operation for suddenly stopping the force is executed (step S57). In addition, when an abnormality is detected in the execution order of the arithmetic processing, an abnormality detection signal is transmitted to the elevator monitoring room.
  • the monitor calculation is executed (step S58), the output calculation for outputting the command signal necessary to stop the car suddenly is executed (step S59), and the interrupt calculation processing is completed.
  • the calculation time over time does not normally occur, but occurs when the calculation time temporarily increases, for example, when many call buttons are operated and a long time is required for the call scan calculation. It is also possible that the computation time will gradually increase as the software is remodeled or improved, resulting in an overtime.
  • the electronic safety controller 21 checks the pattern of the processing information every preset calculation cycle, it can always monitor the presence or absence of an abnormality, and can further improve the reliability. it can.
  • the car 3 was suddenly stopped when it was determined that there was an abnormality in the execution order of the arithmetic processing.
  • the nearest floor stop command was output to the operation control unit 12 to It is possible to smoothly drop passengers in the force 3 even if they are stopped to the nearest floor.
  • the electronic safety controller 21 in this example includes the RAM and a program storage unit that stores a program related to safety monitoring, and a processing unit that executes a plurality of arithmetic processes based on the program.
  • the controller main unit writes processing information corresponding to each arithmetic processing to the RAM when the arithmetic processing is executed, and the pattern power of the processing information written in the RAM is normal in the execution order of the arithmetic processing. Monitor whether it is.
  • the processing information is a numerical value preset for each arithmetic processing. Furthermore, the control device itself confirms the pattern of the processing information every predetermined calculation cycle. Furthermore, the writing of processing information and the confirmation of the pattern of processing information are executed as part of an interrupt calculation process for monitoring the safety of the elevator.
  • FIG. 12 is a block diagram showing a main part of the electronic safety controller 21 of FIG.
  • two command signals are output to the elevator control panel 11 in order to improve reliability.
  • a dual circuit configuration is employed, and first and second CPUs (processing units) 41 and 42 are used.
  • the first CPU 41 outputs an instruction signal to the elevator control panel 11 via the first output interface 43.
  • the second CPU 42 outputs a command signal to the elevator control panel 11 via the second output interface 44.
  • the elevator control panel 11 receives a command signal from the first and second output interfaces 43 and 44, it shifts the elevator to a safe state.
  • the first and second CPUs 41 and 42 are connected to a two-port RAM 45 for exchanging data between them.
  • the first CPU 41 receives a signal from the first sensor.
  • a signal from the second sensor is input to the second CPU.
  • the signals of the first and second sensor forces are processed by the CPUs 41 and 42. 3 speeds and positions are required.
  • Examples of the first and second sensors include a governor encoder 18.
  • the result data of the arithmetic processing in the CPUs 41 and 42 is exchanged between the CPUs 41 and 42 via the 2-port RAM 45. Then, the CPUs 41 and 42 compare the result data with each other, and if there is a significant difference in the calculation result or an overspeed (overspeed) is confirmed, the output interfaces 43 and 44 are connected. The command signal is output to the elevator control panel 11 and the elevator is shifted to the safe state.
  • this elevator control device is provided with a + 5V power supply voltage monitoring circuit 71 and a + 3.3V power supply voltage monitoring circuit 72 for monitoring the power supply voltages of the CPUs 41 and 42.
  • the power supply voltage monitoring circuits 71 and 72 are configured by, for example, an IC (integrated circuit).
  • the power supply voltage monitoring circuits 71 and 72 monitor whether or not a stable power supply voltage is supplied to the CPUs 41 and 42. Designed to be fail-safe because the CPU 41, 42 is forcibly reset based on information from the power supply voltage monitoring circuit 71, 72 when a power supply voltage abnormality that deviates from the rated voltage of the CPU 41, 42 occurs. Car 3 is suddenly stopped by safety circuit 13.
  • the + 5V power supply voltage monitoring circuit 71 receives the monitoring voltage from the first monitoring voltage input circuit 73. + 3.
  • the 3V power supply voltage monitoring circuit 72 receives the monitoring voltage from the second monitoring voltage input circuit 74.
  • the power supply voltage monitoring circuits 71 and 72 and the CPUs 41 and 42 have a voltage monitoring soundness check function circuit 75 for monitoring the health of the power supply voltage monitoring circuits 71 and 72 (hereinafter abbreviated as a check function circuit 75). Is connected.
  • the check function circuit 75 includes a programmable gate IC such as an FPGA (field programmable gate array).
  • the check function circuit 75 can also be realized by an ASIC, CPLD, PLD, or gate array.
  • a voltage abnormality detection signal 81, 82 is output from the power supply voltage monitoring circuit 71, 72 to the check function circuit 75, and a reset signal 83, is output from the check function circuit 75 to the CPU 41, 42. 84 is output.
  • control signals 85 and 86 from the CPUs 41 and 42 are input to the check function circuit 75.
  • the check function circuit 75 outputs monitoring input voltage forced change signals 87 and 88 for forcibly changing the voltage input pins of the power supply voltage monitoring circuits 71 and 72 to a low voltage.
  • check function circuit 75 is connected to the first data bus 78 for the first CPU 41 and the second data bus 79 for the second CPU 42.
  • a program for determining the position and speed of the car 3 a program for determining an elevator abnormality, a program for checking the soundness of the power supply voltage monitoring circuits 71 and 72, and the like are CPU41, 42. It is stored in the ROM that is a storage unit connected to the.
  • FIG. 13 is a circuit diagram showing an example of a specific configuration of the check function circuit 75 of FIG.
  • the control signals 85 and 86 include selection signals 89 and 90, output permission signals 91 and 92, and chip select signals 93 and 94.
  • the selection signals 89 and 90 are 2-bit signals for selecting which power supply voltage monitoring circuit 71 or 72 is checked for soundness.
  • the output enable signals 91 and 92 are signals for permitting the output of the monitoring input voltage forced change signals 87 and 88 from the check function circuit 75 and latching the contents selected by the selection signals 89 and 90. . That is, the output permission signals 91 and 92 also serve as a latch trigger signal.
  • voltage abnormality detection signals 81 and 82 are latched by voltage abnormality signal latch circuit 101 in check function circuit 75.
  • the latched state in the voltage abnormality signal latch circuit 101 is released from the fact that the latch release signals 95 and 96 which are part of the control signals 85 and 86 are input.
  • the selection signals 89 and 90 are input to the first and second selectors 102 and 103.
  • the first and second selectors 102 and 103 switch which power supply voltage monitoring circuit 71 or 72 is to be checked based on the selection signals 89 and 90.
  • the contents selected by the selectors 102 and 103 are latched by the first and second selection contents latch circuits 104 and 105.
  • a change signal output buffer 106 is placed in the preceding stage of the output of the monitoring input voltage forced change signals 87 and 88.
  • the check function circuit 75 is provided with a plurality of data bus output buffers 107 of the first CPU 41 and a plurality of data bus output buffers 108 of the second CPU 42.
  • FIG. 14 is an explanatory diagram showing the meaning of data regarding each bit of the data buses 78 and 79 when the first and second CPUs 41 and 42 read the check function circuit 75 of FIG.
  • FIG. 15 is a flowchart showing a power supply voltage monitoring soundness check method on the first CPU 41 side in FIG.
  • the electronic safety controller 21 executes an interrupt calculation including an arithmetic process for monitoring an abnormality of the elevator such as an overspeed of the car 3 every calculation cycle (for example, 5 msec). Then, when the interrupt calculation main routine is executed, it is determined whether or not to perform the soundness check of the power supply voltage monitoring circuits 71 and 72 (step S11).
  • the soundness check is performed at a preset timing.
  • the soundness check is performed when the pre-set time has elapsed for the force 3 stop state. Specifically, it is implemented when there are few passengers or when there is no night operation.
  • the process returns to the main routine.
  • the latch state of the voltage abnormality detection signals 81 and 82 which are error signals in the check function circuit 75, is first released. That is, the check function circuit 75 generates a latch release signal 95 (step S12).
  • the latch release signal 95 is input to the voltage abnormality signal latch circuit 101, and the latch state of the voltage abnormality detection signals 81 and 82 is released.
  • step S13 After confirming that the output enable signal 91 of the first CPU 41 is High (step S13), the output enable signal 92 is also set to High for the second CPU 42. Request through 2-port RAM45 (step S14).
  • the select signal 89 for selecting which of the power supply voltage monitoring circuits 71 and 72 is to be checked for soundness is output to the check function circuit 75 and latched (step S15).
  • the second CPU 42 is requested through the 2-port RAM 45 to set the output permission signal 92 to Low (step S6).
  • the output enable signal 91 is set to low (step S7).
  • the check function circuit 75 the select signal 89 is latched by the selection content latch circuit 104 in synchronization with the fall of the output permission signal 91.
  • a monitoring input voltage forced change signal 87 is output from the check function circuit 75 to the power supply voltage monitoring circuit 71.
  • the power supply voltage monitoring circuit 71 detects a voltage abnormality, and the voltage abnormality detection signal 81 is input to the check function circuit 75.
  • the voltage abnormality detection signal 81 is latched by the voltage abnormality signal latch circuit 101.
  • reset signals 83 and 84 from the check function circuit 75 are input to the CPUs 41 and 42 (step S8), thereby resetting the CPU 41 and 42 force S.
  • FIG. 16 is a flowchart showing the operation when the CPUs 41 and 42 are reset in the elevator control device of FIG.
  • the cause of the resetting of the CPUs 41 and 42 may, of course, be due to an abnormality in the true power supply voltage and other reasons, not just due to the soundness check.
  • the CPUs 41 and 42 first start a software initialization process (step S19). Next, the data of the check function circuit 75 is read during the initialization process (step S20). Then, the state before the latched contents are reset is checked to determine whether there is an abnormality in the power supply voltage or a failure in the power supply voltage monitoring circuits 71 and 72 (step S21). In other words, it is determined whether the reset has occurred due to a soundness check or has occurred due to a true power supply voltage abnormality.
  • step S22 If no abnormality or failure is detected as a result of the data read of the check function circuit 75, the transition to the main routine is permitted (step S22). However, here is the power described only for reset related to the power supply voltage, and it may be possible to reset by other fault detection or soundness check of other circuits. After confirming this, the transition to the main routine is permitted.
  • step S23 If any abnormality or failure is found as a result of the data read of the check function circuit 75, a command signal is output to the elevator control panel 11 (step S23), and the elevator is shifted to a safe state.
  • Such an electronic safety controller 21 can monitor the soundness of a failure of the power supply voltage monitoring circuits 71 and 72 that can detect only the abnormality of the power supply voltage. Therefore, the reliability of the power supply voltage can be monitored. This can be further improved.
  • the electronic safety controller 21 in this example includes a processing unit that performs processing related to elevator safety monitoring, and a power supply voltage monitoring circuit that monitors the power supply voltage supplied to the processing unit.
  • a monitoring input voltage forced change signal for forcibly changing the power supply voltage input to the power supply voltage monitoring circuit is output according to the control signal of the processing unit, and a voltage abnormality detection signal from the power supply voltage monitoring circuit is output.
  • An input voltage monitoring soundness check function circuit is further provided.
  • the voltage monitoring soundness check function circuit holds at least a part of transmission / reception contents of signals with the processing unit and the power supply voltage monitoring circuit, and the processing unit has a voltage monitoring function. Ken
  • the integrity of the power supply voltage monitoring circuit is checked by reading the data held in the integrity check function circuit.
  • the processing unit includes the first and second CPUs, and the first and second CPUs perform health check operations by the first and second CPUs via the two-port RAM. Can be confirmed with each other.
  • a monitoring input voltage forced change circuit is further provided that forcibly lowers the power supply voltage input to the power supply voltage monitoring circuit by the input of the monitoring input voltage forced change signal.
  • the power supply voltage monitoring circuit includes a plurality of power supply voltage monitoring circuits for monitoring the voltages of a plurality of power supplies having different voltages, from the processing unit to the voltage monitoring soundness check function circuit.
  • the control signal includes a selection signal for selecting which of the plurality of power supply voltage monitoring circuits is to be checked for soundness.
  • the processing unit can sequentially perform the soundness check of each power supply voltage monitoring circuit one by one.
  • the voltage monitoring soundness check function circuit consists of a programmable gate IC.
  • the ETS circuit unit 22 detects the position of the force 3 independently of the operation control unit 12. For this reason, for example, when the elevator is started, an initial setting operation (initial setting operation step) of the ETS circuit unit 22 is performed.
  • the initial setting operation of the ETS circuit unit 22 also occurs when there is a deviation between the position information of the car 3 in the operation control unit 12 and the position information of the car 3 in the ETS circuit unit 22 due to some cause. Is done.
  • the operation mode of the operation control unit 12 is switched to the initial setting operation mode.
  • FIG. 17 is an explanatory diagram showing the relationship between the stage of the initial setting operation of the ETS circuit unit 22 of FIG. 1 and the operation of the operation control unit 12 and the safety circuit unit 13.
  • the speed detection initial setting is first performed, and then the position detection initial setting is performed.
  • the safety device 13 causes the drive unit 7 to be in an emergency stop state. It is. That is, the motor power supply of the drive device 7 is cut off, and the brake unit 9 of the drive device 7 is in a braking state. In addition, a command indicating that the operation cannot be performed is output from the ETS circuit unit 22 to the operation control unit 12.
  • the electronic safety controller 21 When the speed detection initial setting is completed, the electronic safety controller 21 outputs a permission signal indicating that low-speed operation is possible to the operation control unit 12. In addition, the emergency stop state of the safety circuit unit 13 is released. In this state, the ETS circuit unit 22 performs a position detection initial setting operation.
  • the force 3 travels from the lower part to the upper part of the hoistway 1 at a speed equal to or less than the permissible collision speed of the shock absorbers 27 and 28.
  • the relationship between the signal from the governor encoder 18 and the position of the force 3 in the hoistway 1 is set.
  • the electronic safety controller 21 When the initial setting operation is completed, the electronic safety controller 21 outputs a permission signal indicating that high-speed (rated speed operation) operation is possible to the operation control unit 12. In addition, the ETS circuit unit 22 enables high-speed monitoring.
  • FIG. 18 is an explanatory view for explaining the movement of the car 3 in the initial setting operation mode of the elevator apparatus of FIG.
  • the car 3 In the initial setting operation mode, the car 3 is moved to the floor writing start position below the hoistway 1 after the speed detection initial setting is completed.
  • the floor writing start position is a position where the car 3 is located below the lowest floor position P and above the force buffer 27.
  • the force 3 is located at the floor writing start position, the force 3 (specifically, the operation plate of the reference sensor 23-26 provided in the car 3) is more than the fourth reference sensor 26. Located below.
  • a plurality of end point switches (not shown) for detecting the position of the lowermost floor or the uppermost floor by the operation control unit 12 are provided.
  • the operation controller 12 controls the movement of the car 3 to the floor writing start position.
  • the temporary current position is updated every calculation cycle (for example, 100 msec).
  • the ETS circuit unit 22 is provided with an up / down counter that counts the encoder pulses of the governor encoder 18. If the movement amount of the up / down counter in the calculation cycle is GC1, the Nth time The temporary current position P in the calculation cycle of
  • the temporary current position and the movement amount within the calculation cycle are obtained as the number of pulses of the encoder pulse.
  • GC2 is the amount of movement of the up / down counter after entering the fourth reference sensor 26.
  • GC3 is the amount of movement of the up / down force counter after escape from the fourth reference sensor 26.
  • the operation control unit 12 includes the lowest floor position P and the highest floor position based on the virtual 0 point.
  • Data for device P is set. And when car 3 is stopped at top floor position P The data of the lowest floor position P and the highest floor position P with reference to virtual 0 point is the operation control unit.
  • the position data force obtained as the temporary current position and written in the table is converted into data based on the virtual 0 point based on the information transmitted from the operation control unit 12. This makes it possible to detect the current position P with reference to virtual 0 point.
  • L is the distance to the top floor position P of the car shock absorber 27, and L is the top
  • the car 3 is driven at a speed lower than the allowable collision speed of the car shock absorber 27 until the initial setting operation is completed. Can be more reliably prevented from colliding with device 27 and improve reliability be able to.
  • the initial setting operation is performed in two stages of the speed detection initial setting and the position detection initial setting is shown.
  • the initial setting operation is performed in three or more stages, and is allowed for each stage. You can also set the car speed.
  • the initial setting operation is not limited to the speed detection initial setting and the position detection initial setting.
  • the elevator apparatus in this example includes an operation control unit that controls the operation of the car and an elevator control that includes a monitoring unit (electronic safety controller 21) that detects abnormalities in the running of the force.
  • a monitoring unit electronic safety controller 21
  • the operation control unit will run the car at a lower speed than normal operation according to the initial setting stage.
  • the monitoring unit outputs a permission signal related to the speed of the force to the operation control unit according to the initial setting stage.
  • the operation control unit selectively controls a plurality of operation modes including a normal operation mode and an initial setting operation mode for performing initial setting of the monitoring unit while running a force to control the operation of the car.
  • the operation control unit causes the power to travel at a lower speed than in the normal operation mode according to the initial setting stage.
  • control method of the elevator apparatus in this example includes an initial setting operation step in which the initial setting of the monitoring unit for detecting abnormality in the travel of the force is performed while the force travels, and an initial setting operation step Then, the car is run at a lower speed than normal operation according to the initial setting stage.
  • FIG. 19 is a circuit diagram showing a contact abnormality detection unit of the electronic safety controller 21 of FIG.
  • the safety circuit unit 13 includes a brake power contactor coil 111 for supplying power to the brake unit 9, a motor power contactor coil 112 for supplying power to the motor unit of the driving device 7, and the contactor coils 111 and 112.
  • a safety relay main contact 113 for turning on / off the voltage application and a bypass relay main contact 114 connected in parallel to the safety relay main contact 113 are provided.
  • Brake power contactor coil 111, motor power contactor coil 112 and safety relay The main contacts 113 are connected to each other in series with the power source.
  • the safety relay main contact 113 is closed during normal operation. Further, when the elevator 3 is abnormal, for example, when the traveling speed of the car 3 exceeds a preset speed, the safety relay main contact 113 is opened.
  • the no-pass relay main contact 114 is open during normal operation.
  • the electronic safety controller 21 is mechanically connected to the controller main body 115, the safety relay coil 116 that operates the safety relay main contact 113, the bypass relay coil 117 that operates the bypass relay main contact 114, and the safety relay main contact 113. It has a safety relay monitor contact 118 that opens and closes in conjunction with the bypass relay and a bypass relay monitor contact 119 that opens and closes mechanically in conjunction with the bypass relay main contact 114.
  • the safety relay coil 116, the bypass relay coil 117, the safety relay monitor contact 118, and the bypass relay monitor contact 119 are connected to the controller main body 115 in parallel with each other.
  • the safety relay main contact 113 and the safety relay monitor contact 118 are mechanically connected by a link mechanism (not shown). Therefore, when either one of the contacts 113 and 118 becomes inoperable due to welding or the like, the other becomes inoperable.
  • the no-pass relay main contact 114 and the bypass relay monitor contact 119 are mechanically connected by a link mechanism (not shown). Therefore, when one of the contacts 114, 119 becomes inoperable due to welding or the like, the other becomes inoperable.
  • the controller body 115 includes a processing unit 120, a storage unit 121, an input / output unit 122, a safety relay motor contact receiver circuit 123, a bypass relay monitor contact receiver circuit 124, a safety relay driver circuit 125, and a bypass relay driver circuit 126. have.
  • processing unit 120 for example, a CPU is used.
  • storage unit 121 for example,
  • the storage unit 121 stores, for example, data for determining an elevator abnormality, a program for performing an operation test of the safety relay main contact 113, and the like.
  • the processing unit 120 transmits / receives signals to / from the operation control unit 12 and various sensors via the input / output unit 122.
  • the safety relay monitor contact receiver circuit 123 is connected in series to the safety relay monitor contact 118. Next, the open / close state of safety relay monitor contact 1 18 is detected.
  • the bypass relay monitor contact receiver circuit 124 is connected in series to the bypass relay monitor contact 119 and detects the open / closed state of the bypass relay monitor contact 119.
  • the safety relay driver circuit 125 is connected in series to the safety relay coil 116, and switches between excitation and non-excitation of the safety relay coil 116.
  • the no-pass relay driver circuit 126 is connected in series to the bypass relay coil 117, and switches excitation / de-energization of the bypass relay coil 117.
  • Switching between excitation and non-excitation of the safety relay coil 116 is performed by outputting a safety relay command signal from the processing unit 120 to the safety relay driver circuit 125. Further, switching between excitation and non-excitation of the no-pass relay coil 117 is performed by outputting a bypass command signal from the processing unit 120 to the bypass relay driver circuit 126.
  • the Resino circuits 123 and 124 and the Dryno circuits 125 and 126 are connected in parallel to each other in a processing unit 120.
  • the controller main body 115 monitors the presence or absence of an abnormality of the elevator based on information from various sensors!
  • the processing unit 120 the driving of the safety relay coil 116 is stopped by the safety relay driver circuit 125.
  • FIG. 20 is a flowchart for explaining an operation test method of the safety relay main contact 113 of FIG.
  • an operation test is performed every time the car 3 stops at the stop floor during normal operation. Therefore, during normal operation, the processing unit 120 monitors whether or not the traveling speed of the car 3 has become 0 based on information from various sensor forces (stop detection step S61).
  • bypass relay coil 117 is excited by the bypass relay driver circuit 126, and then waits for a preset time, here 100 ms (step S62). ). Then, check whether the no-pass relay monitor contact 119 is closed. Is confirmed by the bypass relay monitor contact receiver circuit 124 (step S63).
  • bypass relay monitor contact 119 If the bypass relay monitor contact 119 is not closed, it means that the bypass relay main contact 114 is also not closed. Therefore, the processing unit 120 determines that the bypass relay has failed, and the controller main body 115 determines that the operation control unit 12 An abnormality detection signal is output at (Step S64).
  • Step S67 When it is confirmed that the safety relay monitor contact 118 is normally opened, the safety relay coil 116 is de-energized, and then waits for a preset time, here 100 ms (Ste S67). Then, whether or not the safety relay monitor contact 118 is closed is confirmed by the safety relay monitor contact receiver circuit 123 (step S68).
  • the processing unit 120 determines that a safety relay failure has occurred, and an abnormality detection signal is output from the controller main body 115 to the operation control unit 12 (step S64).
  • bypass relay coil 117 is de-energized, and then waits for a preset time, here 100 ms (step S69). Then, whether the bypass relay monitor contact 119 is opened is confirmed by the bypass relay monitor contact receiver circuit 124 (step S70).
  • step S64 Bypass relay monitor contact 119 Opened! / If not, the processing unit 120 determines that a bypass relay failure has occurred, and an error detection signal is output from the controller body 115 to the operation control unit 12 (step S64). .
  • step S71 When the test of the opening / closing operation of the safety relay main contact 113 and the bypass relay main contact 114 is completed in this way, it waits until the traveling speed of the force 3 exceeds a preset set value (step S71), and then the traveling speed is monitored by the ETS circuit section 22 until the car 3 stops. Then, every time the force 3 stops, the above-described operation test is performed, and the soundness of the safety circuit unit 13 is confirmed.
  • the operation test of the safety relay main contact 113 was performed using the timing when the car stopped during normal operation, so safety that would not hinder normal operation
  • the abnormality of the relay main contact 113 can be detected, and the reliability can be improved.
  • bypass relay main contact 114 was closed when the operation test of the safety relay main contact 113 was performed, the power supply to the safety circuit section 13 was prevented from being interrupted during the operation test.
  • the operation test can be performed while the safety circuit unit 13 is maintained.
  • the timing of the force operation test in which the operation test is performed each time the force 3 stops is not limited to this.
  • a counter that counts the number of stoppages of the car may be provided in the detection circuit main body, and the operation test may be performed every preset number of stoppages.
  • a timer is provided in the detection circuit body, so that a preset time has elapsed.
  • the operation test may be performed when the car stops for the first time.
  • an operation test may be performed only when normal operation of the elevator is started (at startup). Furthermore, it is recommended that the operation test be performed only when the vehicle stops on a preset floor.
  • the electronic safety controller 21 in this example generates a safety relay command signal for operating the safety relay main contact in the direction in which the brake section performs braking operation when the car stops during normal operation. At the same time, it detects whether the safety relay main contact is activated according to the safety relay command signal.
  • the electronic safety controller 21 is provided with a safety relay monitor contact that is mechanically linked to the safety relay main contact, and the electronic safety controller 21 has a safety relay monitor contact state force safety Detects the relay main contact status.
  • the safety relay main contact is closed during normal operation and opened when the elevator malfunctions.
  • the bypass relay is connected in parallel to the safety relay main contact and opened during normal operation.
  • the main contact is provided in the safety circuit, and the electronic safety controller 21 generates a bypass command signal for closing the bypass relay main contact before generating the safety relay command signal.
  • the electronic safety controller 21 is provided with a bypass relay monitor contact that is opened and closed mechanically in conjunction with the main relay contact, and the electronic safety controller 21 is in the state of the no-pass relay monitor contact. The status of the bypass relay main contact is detected. In addition, the electronic safety controller 21 detects whether or not the bino relay main contact has operated in response to the bino command signal.
  • the electronic safety controller 21 detects an abnormality of the safety relay main contact, it outputs an abnormality detection signal to the operation control unit.
  • FIG. 21 is a block diagram showing a state where the history information recording unit and the soundness diagnosis unit are connected to the electronic safety controller 21 of FIG.
  • a history information recording unit 131 in which a history of information (processing process) regarding determination processing in the electronic safety controller 21 is recorded.
  • an elevator control device A nonvolatile memory that retains information even when the power is turned off is used. Examples of such memory include a flash memory and a node disk device.
  • the electronic safety controller 21 and the history information recording unit 131 are connected to a health diagnostic unit 132 that automatically diagnoses the health of the electronic safety controller 21.
  • the soundness diagnosis unit 132 can also diagnose the overall soundness of the entire system including various sensors and the safety circuit unit 13. The diagnosis result by the soundness diagnosis unit 132 is recorded in the history information recording unit 131.
  • FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit 131 in FIG.
  • analysis data such as time, car position, car speed, set value (threshold value) obtained according to car position, judgment result, and internal variables are recorded.
  • the combination power of data such as car position, car speed, set value, judgment result, and analysis data is stored separately for each corresponding time, and the data as shown in FIG. A table is created.
  • FIG. 23 is a flowchart for explaining the operation of the electronic safety controller 21 of FIG.
  • the current time data is output to the history information recording unit 131 (step S81).
  • the position of the car 3 is detected (step S82).
  • the detected car position data is output to the history information recording unit 131 (step S83).
  • the speed of the force 3 is detected (step S84).
  • the detected car speed data is output to the history information recording unit 131 (step S 85).
  • a set value corresponding to the car position is calculated (step S86).
  • the set value data is output to the history information recording unit 131 (step S87).
  • the detection speed V is compared with the set value f (x) (step S88). If the detection speed V is smaller than the set value f (x), the judgment result is “No error” (Good). It is output to the history information recording unit 131 (step S89). If there is no abnormality in the speed of the force, the above operation is repeated every calculation cycle.
  • a stop command signal is output to the safety circuit unit 13 (step S90). Then, the determination result is output to the history information recording unit 131 as “abnormal” (Bad) (step S91). [0229] In the history information recording unit 131, data sent from the electronic safety controller 21 is sequentially recorded.
  • the set value set by the electronic safety controller 21 is set with a margin in consideration of force vibration caused by mischief. It is also possible to adjust the degree of allowance for each elevator.
  • the data of the judgment results recorded in the history information recording unit 131 it is possible to check how much margin is necessary in the actual operation status, and to minimize the margin. it can. As a result, the car speed can be increased and the operation efficiency can be improved.
  • the system health diagnosis result can be confirmed by the history information recording unit 1 31. Therefore, when the car 3 is suddenly stopped due to a failure of an electronic element. In this case, it is possible to efficiently identify the electronic element that is the cause.
  • the inspection items for the periodic inspection can be reduced. The following items can be confirmed during periodic inspections.
  • the diagnostic information recorded in the history information recording unit 131 is checked to check the periodicity. Inspection of the electronic element during inspection can be omitted.
  • the inspection information may be recorded in the history information recording unit 131, which may be recorded in the history information recording unit 131. It is possible to check the contents of regular inspections easily.
  • the inspection history to be recorded includes, for example, inspection implementation timing and inspection items.
  • the history information recording unit 131 and the soundness diagnosis unit 132 are provided outside the electronic safety controller 21, but at least one of them may be provided in the electronic safety controller 21.
  • the history information is recorded for monitoring the abnormal speed, but for example, history information for rope break monitoring for monitoring whether the main rope is damaged or disconnected may be recorded. It is also possible to record historical information for temperature monitoring that monitors the motor temperature of the lifting machine, inverter temperature, control panel temperature, etc.
  • the elevator apparatus in this example determines the presence or absence of an abnormality in the elevator based on information from the sensor, and outputs a signal for stopping the car when an abnormality is detected.
  • An abnormality monitoring unit electronic safety controller 21
  • a history information recording unit for recording a history of information regarding determination processing in the abnormality monitoring unit are provided.
  • FIG. 24 is a block diagram showing a main part of the electronic safety controller 21 of FIG. Electronic
  • the safety controller 21 has a memory data abnormality check circuit 141 for checking memory data abnormality, a CPU 142, and a designated address detection circuit 143 for checking an address bus abnormality.
  • the memory data error check circuit 141 is used to avoid collision between the parallel memory main memory 141a and sub memory 141b (RAM) allocated in the same address space and the output data of the sub memory 14 lb.
  • a data buffer 141c and a data comparison circuit 141d for comparing each data of the main memory 141a and the sub memory 141b to check data abnormality are provided.
  • the memory data abnormality check circuit 141 also has an error correction code check circuit as in the conventional system.
  • the CPU 142 includes a designated address output software 142a for outputting a designated address at the time of data abnormality check, a data bus abnormality check software 142b executed at the time of data bus abnormality check, and a ROM for storing programs (not shown). ).
  • the main memory 141a and the sub memory 141b are connected to the CPU 142 via the address bus BA and the data bus BD, respectively, and the data of the electronic safety controller 21 is written from the CPU 142. , Read out by CPU142.
  • the data bus BD is branched into the main memory data bus BD1 and the sub memory data bus BD2 in the memory data abnormality check circuit 141.
  • the main memory 141a and the sub memory 141b are respectively connected to the main memory data bus BD1
  • the sub-memory data bus BD2 is connected to the data comparison circuit 141d.
  • a data buffer 141c is interposed in the sub memory data bus BD2.
  • the data comparison circuit 141d compares each memory data input via the main memory data bus BD1 and the sub memory data bus BD2 when checking the memory data for an abnormality, and determines that the memory data is abnormal. In this case, the data error signal ED is output.
  • the specified address detection circuit 143 is connected to the CPU 142 via the address bus BA.
  • the address bus BA is checked for abnormality, the specified address is detected, and if it is determined that the address bus BA is abnormal, the address bus Abnormal signal EBA is output.
  • the specified address output software 142a in the CPU 142 checks the error of the address bus BA.
  • the designated address is periodically output to the designated address detection circuit 143 as described later.
  • the data bus abnormality check software 142b in the CPU 142 operates when checking the abnormality of the data bus BD, and outputs a data bus abnormality signal EBD when it is determined that there is an abnormality in the data bus BD.
  • FIG. 25 specifically shows the data comparison circuit 141d for checking data anomaly in FIG. 24.
  • a case in which the circuit 153 is configured is shown.
  • the data comparison circuit 141d includes an exclusive OR gate 151 provided in parallel, an AND gate 152 that performs an AND operation between the output signals of the exclusive OR gate 151, and an AND gate 15
  • a D-type latch circuit 153 that outputs an output signal of 2 as a D terminal input and outputs an H (logic “1”) level signal as a data abnormality signal ED.
  • Each exclusive OR gate 151 uses the data from the main memory data bus BD1 as one input signal and the data from the sub memory data bus BD2 as one input signal. Each outputs an L (logic “0”) level signal.
  • the AND gate 152 takes in the inverted signal of the output signal from each exclusive OR gate 151, and each input signal is all H level (that is, all output signals from the exclusive OR gate 151 are all L level). Output an H (logic “1”) level signal.
  • the D-type latch circuit 153 operates in response to the memory read signal RD, and at the same time the output signal (data abnormal signal ED) level in response to the D pin input (and gate 152 output signal). Is reset to the initial state in response to the reset signal RST.
  • FIG. 26 specifically shows the designated address detection circuit 143 for checking the address bus abnormality in FIG.
  • the designated address detection circuit 143 includes a plurality of exclusive OR gates 161 using the H level signal as one input signal, a plurality of exclusive OR gates 162 using the L level signal as one input signal, A NAND gate 163 that ANDs each output signal of the exclusive OR gate 161 and the address strobe signal STR, a NAND gate 164 that ANDs each output signal of the exclusive OR gate 162 and the address strobe signal STR, and a NAND gate 16 D-type latch circuit 165 using the output signal of 3 as the input signal for the set terminal, D-type latch circuit 166 using the output signal of the NAND gate 164 as the input signal for the set terminal, and outputs of the D-type latch circuits 16 5 and 166 AND gate 167 that takes the logical product of signals, D-type latch circuit 168 that operates in response to reset signal RST1 of specified address detection circuit 143, and D that operates in response to mask signal MSK of specified address detection circuit 143 D A latch circuit 169, and an OR gate 170 that takes the
  • a designated address via the address bus BA is input to each of the other input terminals of the exclusive OR gates 161 and 162 arranged in parallel.
  • Each exclusive OR gate 161 outputs an L level signal when the specified address input to the address bus BA is an H level signal, and outputs an L level signal when the specified address is an L level signal. Outputs an H level signal.
  • each exclusive OR gate 162 receives the address specified by the address bus BA.
  • an H level signal an H level signal is output, and when the specified address is an H level signal, an L level signal is output.
  • each exclusive OR gate 161 is level-inverted and input to the NAND gate 163 together with the address strobe signal STR.
  • the output signal of each exclusive OR gate 162 is inverted in level together with the address strobe signal STR and input to the NAND gate 164.
  • the NAND gates 163 and 164 synchronize with the address storage signal STR and the designated address ("FFFF") periodically input via the address bus BA. ”,“ 0000 ”), the H level signal is output complementarily at regular intervals.
  • the D-type latch circuit 168 is operated by the first reset signal RST1 when the L-level signal is applied to the D input terminal.
  • the output signal of the D-type latch circuit 168 is applied to each reset terminal of the D-type latch circuits 165 and 166.
  • the D-type latch circuit 169 is operated by the mask signal MSK while the 0 bit signal of the data bus BD (“0” when the mask is ON and “1” when the mask is OFF) BTO is applied to the D input terminal.
  • Each D-type latch circuit 168, 169 has a second These are reset by the reset signal RST2.
  • the OR gate 170 outputs the address bus error signal EBA when the output signal of the AND gate 167 or the output signal of the D-type latch circuit 169 indicates the H level.
  • FIG. 24 [0266] Next, the above three types of abnormality check operations will be described more specifically with reference to FIGS. 24 to 28.
  • FIG. 24 [0266]
  • FIG. 27 is a flowchart showing the processing operation by the designated address output software 142a and the designated address detection circuit 143 in the CPU 142 in FIG. 24, and outputs the designated address to the designated address detection circuit 143 when the address bus BA is abnormally checked. The operation procedure is shown.
  • FIG. 28 is a flowchart showing the processing operation of the data bus abnormality check software 142b in the CPU 142 of FIG.
  • FIG. 24 the data abnormality check operation by the memory data abnormality check circuit 141 will be described with reference to FIGS. 24 and 25.
  • the same address space is allocated to the main memory 141a and the sub memory 141b, and the CPU 142 writes data to the main memory 141a and the sub memory 141b. The same data is written to the same address in the main memory 141a and the sub memory 141b.
  • the sub-memory data read out on the sub-memory data bus BD2 is input to the data comparison circuit 141d to compare the data of both.
  • the data comparison circuit 141d checks for a data abnormality, and outputs a data abnormality signal ED if an abnormality (data mismatch) is detected.
  • the CPU 142 uses a designated address for checking (for example, 8 bits) that can be confirmed in both cases of "0" and "1" for each of all the bit signals used in the memory system in the address bus BA.
  • a designated address for checking for example, 8 bits
  • the processing in FIG. 27 is periodically and repeatedly executed.
  • the designated address detection circuit 143 installed on the address bus BA is caused to detect the designated address.
  • the designated address detection circuit 143 determines that there is an abnormality in the address bus BA and outputs an address bus abnormality signal EBA.
  • step S 103 the maximum value address “FFFF” in which all addresses are “1” (or the minimum value address “0000” in which all addresses are “0”) is read (step S 103).
  • FIG. 24 and FIG. 28 the data bus BD abnormality check operation by the data bus abnormality check software 142b in the CPU 142 will be described.
  • the CPU 142 for each of all the bit signals used in the memory system on the data bus BD, can specify both “0” and “1” for checking specified data (for example, in the case of 8 bits, “AA” and “55” or “01”, “02”, “04”, “08”, “10”, “20”, “40” and “80” and other thread values) Then, the read / write check operation by the process of FIG. 28 (steps S 105 to SI 11) is periodically repeated.
  • the CPU 142 determines that there is an abnormality in the data bus BD and outputs a data bus abnormality signal EBD.
  • step S108 If it is determined in step S108 that the designated data after reading does not match the designated data before writing (ie, NO), the CPU 142 does not consider the data bus BD to be abnormal, and the data bus abnormal signal Outputs EBD (step S109) and terminates abnormally.
  • step S108 determines whether the designated data after reading matches the designated data before writing (ie, YES). If it is determined in step S108 that the designated data after reading matches the designated data before writing (ie, YES), variable N is incremented (step S11 0), and variable N Is less than or equal to “8” (step SI 11).
  • step S111 determines whether N> 9 (that is, NO)
  • the above abnormality check is effective in checking the health of the memory system in the elevator electronic safety device.
  • the electronic safety controller 21 in this example includes the CPU having the designated address output software and the data bus abnormality check software, and the main memory and the sub memory connected to the CPU via the address bus and the data bus. And a memory data abnormality check circuit for comparing data in the main memory and the sub memory, and a designated address detection circuit connected to the CPU via the address bus.
  • the CPU executes designated address output software and The address bus is checked periodically using the specified address detection circuit, and the CPU executes the data node check software and periodically checks the data bus using the main memory and sub memory. Do it.
  • the CPU executes the specified address output software, and in the case of both "0" and "1" for all the bit signals used for the main memory and sub memory in the address bus.
  • the specified address for check that can be confirmed is periodically output to the specified address detection circuit, and the specified address detection circuit detects multiple specified addresses that are also output periodically by the CPU power, and detects all of the multiple specified addresses. If not, it is determined that the address bus is abnormal and an address bus error signal is output.
  • the CPU executes the data bus error check software, and in the case of both "0" and "1" for all the bit signals used for the main memory and the sub memory in the data bus.
  • the specified data for checking that can be checked periodically is input / output, and the CPU power periodically reads and compares multiple specified data that are output periodically into the main memory and sub memory, and before writing Multiple specified data and multiple specified data after reading If they do not all match, it is determined that the data bus is abnormal and a data bus error signal is output.
  • FIG. 29 is a flowchart showing operations of the electronic safety controller 21 and the elevator control unit 11 when the nearest floor stop command is generated in FIG.
  • the electronic safety controller 21 detects an abnormality that should stop the force on the nearest floor, for example, a failure of the electronic safety controller 21 itself (step S121)
  • the electronic safety controller 21 operates the elevator controller 11.
  • the nearest floor stop command signal is output to the control unit 12 (step S 122).
  • the operation control part 12 performs the process for stopping a force on the nearest floor (step S123).
  • the electronic safety controller 21 starts the built-in emergency stop timer and starts counting by the emergency stop timer (step S124).
  • the emergency stop timer expires when the preset time (the time sufficient to complete the nearest floor stop) has elapsed.
  • an emergency stop command is output from the electronic safety controller 21 to the safety circuit unit 13 of the elevator control unit 11 (step S125). Thereby, the elevator control unit 11 performs an emergency stop operation (step S126).
  • FIG. 30 is a circuit diagram showing the main parts of the electronic safety controller 21 and the elevator control unit 11 of FIG.
  • the electronic safety controller 21 is provided with an emergency stop timer circuit unit 171 that functions as the emergency stop timer.
  • the emergency stop timer circuit unit 171 is configured by a hardware circuit having an independent software program capability in the electronic safety controller 21.
  • the command from the nearest floor stop output port 172 is simultaneously input to the first transistor 173 and the emergency stop timer circuit unit 171. When the nearest floor stop command is input to the first transistor 173, the first relay unit 174 is turned off, and the nearest floor stop command signal is input to the operation control unit 12.
  • the count starts.
  • the second transistor 176 is turned off and the second relay part 177 is turned off.
  • the emergency stop command is input to the safety circuit unit 13, that is, the safety circuit unit 13 is shut off. As a result, the drive power contactor and the brake power contactor of the drive device 7 are dropped, and the car is emergency stopped.
  • the soundness check of the emergency stop timer circuit section 171 is preferably performed periodically and automatically.
  • the soundness check of the emergency stop timer circuit 171 may be performed once a day, for example, when the car call is not registered and enters the automatic turn-off mode for a predetermined time.
  • a signal notifying the acceptance of the sanity check is input from the elevator control unit 11 to the electronic safety controller 21.
  • the electronic safety controller 21 inputs a signal notifying the start of the check to the elevator control unit 11, and subsequently inputting the nearest floor stop command. Then, a signal notifying the quality of the check result is returned from the elevator control unit 11 to the electronic safety controller 21.
  • the emergency stop timer circuit unit 171 is restored by hardware reset, and the second relay unit 177 is turned on.

Landscapes

  • Maintenance And Inspection Apparatuses For Elevators (AREA)
  • Indicating And Signalling Devices For Elevators (AREA)

Abstract

In an elevator apparatus, an electronic safety controller is capable of detecting its own failure. Further, when the electronic safety controller detects its own failure, the controller outputs to an elevator control section a stop command for stopping an elevator car at a nearest floor, and, when a predetermined time has passed after the output of the stop command, the controller outputs to the elevator control section an emergency stop command for an emergency stop of the elevator car.

Description

明 細 書  Specification
エレベータ装置  Elevator equipment
技術分野  Technical field
[0001] この発明は、センサ力 の検出信号に基づいてエレベータの異常を検出する電子 安全コントローラを用いたエレベータ装置に関するものである。 背景技術  The present invention relates to an elevator apparatus using an electronic safety controller that detects an abnormality of an elevator based on a sensor force detection signal. Background art
[0002] 従来のエレベータの安全システムでは、昇降路、機械室及びかごに設けられたバ スノードにセンサ等が接続されており、センサ等力 の情報がバスノード及び通信ネ ットワークバスを介して安全コントローラに送られる（例えば、特許文献 1参照)。  [0002] In a conventional elevator safety system, sensors and the like are connected to bus nodes provided in hoistways, machine rooms, and cars, and information on the sensor force is transmitted to a safety controller via a bus node and a communication network bus. Sent (for example, see Patent Document 1).
[0003] 特許文献 1 :特表 2002— 538061号公報  [0003] Patent Document 1: Japanese Translation of Special Publication 2002-538061
発明の開示  Disclosure of the invention
発明が解決しょうとする課題  Problems to be solved by the invention
[0004] 上記のような従来のエレベータ装置では、センサ力 安全コントローラへの情報の 入力が通信ネットワークを介して行われて 、るので、安全システムとしての高 、信頼 性を確保するためには、力なり高度な信頼性を持つ通信ネットワークが必要となり、そ れを構成するハードウェアやソフトウェアが複雑で高価になってしまう。  [0004] In the conventional elevator apparatus as described above, information input to the sensor force safety controller is performed via a communication network. Therefore, in order to ensure high safety as a safety system, A powerful and highly reliable communication network is required, and the hardware and software that make it up are complex and expensive.
[0005] この発明は、上記のような課題を解決するためになされたものであり、比較的簡単 な構成で安全システムの信頼性を向上させることができるエレベータ装置を得ること を目的とする。  [0005] The present invention has been made to solve the above-described problems, and an object thereof is to obtain an elevator apparatus that can improve the reliability of a safety system with a relatively simple configuration.
課題を解決するための手段  Means for solving the problem
[0006] この発明によるエレベータ装置は、力ごの運転を制御するエレベータ制御部、及び エレベータの異常を検出し、エレベータを安全な状態に移行させるための指令信号 を発生する電子安全コントローラを備え、電子安全コントローラは、電子安全コント口 ーラ自体の異常を検出可能であり、電子安全コントローラ自体の異常を検出した場 合には、力ごを最寄り階に停止させるための最寄り階停止指令をエレベータ制御部 に出力するとともに、最寄り階停止指令の出力力 予め設定された時間が経過すると 、力ごを非常停止させるための非常停止指令をエレベータ制御部に出力する。 図面の簡単な説明 [0006] An elevator apparatus according to the present invention includes an elevator control unit that controls operation of a force, and an electronic safety controller that detects an abnormality of the elevator and generates a command signal for shifting the elevator to a safe state. The electronic safety controller can detect an abnormality in the electronic safety controller itself, and if an abnormality is detected in the electronic safety controller itself, it issues an elevator command for stopping the nearest floor to stop the force on the nearest floor. In addition to outputting to the control unit, the output power of the nearest floor stop command When a preset time has elapsed, an emergency stop command for emergency stop of the force is output to the elevator control unit. Brief Description of Drawings
圆 1]この発明の実施の形態 1によるエレベータ装置を示す構成図である。 圆 1] A configuration diagram illustrating an elevator apparatus according to Embodiment 1 of the present invention.
[図 2]図 1の調速機及び ETS回路部において設定された過速度のパターンを示すグ ラフである。  FIG. 2 is a graph showing an overspeed pattern set in the governor and ETS circuit section of FIG.
[図 3]図 1の電子安全コントローラ、エレベータ制御盤及び各種センサの接続関係を 示すブロック図である。  FIG. 3 is a block diagram showing the connection relationship of the electronic safety controller, elevator control panel and various sensors shown in FIG. 1.
[図 4]図 1の電子安全コントローラの要部の装置構成を示すブロック図である。  4 is a block diagram showing a device configuration of a main part of the electronic safety controller of FIG. 1.
[図 5]図 4のマイクロプロセッサによる演算処理の実行方法を示す説明図である。  FIG. 5 is an explanatory diagram showing a method for executing arithmetic processing by the microprocessor of FIG. 4;
[図 6]図 1の電子安全コントローラの要部を示すブロック図である。  FIG. 6 is a block diagram showing a main part of the electronic safety controller of FIG.
圆 7]図 6のクロック異常検出回路の具体的な構成を示す構成図である。 7] FIG. 7 is a configuration diagram showing a specific configuration of the clock abnormality detection circuit of FIG.
[図 8]図 8は図 1の電子安全コントローラの RAM内の領域区分を示す説明図である。  [FIG. 8] FIG. 8 is an explanatory diagram showing an area division in the RAM of the electronic safety controller of FIG.
[図 9]図 1の電子安全コントローラの初期動作を示すフローチャートである。  FIG. 9 is a flowchart showing an initial operation of the electronic safety controller of FIG.
[図 10]図 1の電子安全コントローラの割り込み演算の流れの第 1例を示すフローチヤ ートである。  FIG. 10 is a flowchart showing a first example of an interrupt calculation flow of the electronic safety controller of FIG. 1.
[図 11]図 1の電子安全コントローラの要部を示すブロック図である。  FIG. 11 is a block diagram showing a main part of the electronic safety controller of FIG. 1.
[図 12]図 1の電子安全コントローラの要部を示すブロック図である。  FIG. 12 is a block diagram showing a main part of the electronic safety controller of FIG.
圆 13]図 12のチ ック機能回路の具体的な構成の一例を示す回路図である。 [13] FIG. 13 is a circuit diagram showing an example of a specific configuration of the chip function circuit of FIG.
[図 14]図 12のチェック機能回路を第 1及び第 2の CPUカ^ードしたときのデータバス の各ビットに関するデータの意味を示す説明図である。  FIG. 14 is an explanatory diagram showing the meaning of data related to each bit of the data bus when the check function circuit of FIG. 12 is subjected to the first and second CPU cards.
[図 15]図 12の第 1の CPU側の電源電圧監視健全性チェック方法を示すフローチヤ ートである。  FIG. 15 is a flowchart showing the power supply voltage monitoring soundness check method on the first CPU side in FIG.
[図 16]図 12のエレベータ制御装置にお 、て CPUがリセットされた場合の動作を示す フローチャートである。  FIG. 16 is a flowchart showing an operation when the CPU is reset in the elevator control device of FIG.
圆 17]図 1の ETS回路部の初期設定動作の段階と運転制御部及び安全回路部の動 作との関係を示す説明図である。 [17] FIG. 17 is an explanatory diagram showing the relationship between the stage of the initial setting operation of the ETS circuit section of FIG. 1 and the operation of the operation control section and the safety circuit section.
圆 18]図 1のエレベータ装置の初期設定運転モードにおける力ごの動きを説明する 説明図である。 [18] FIG. 18 is an explanatory diagram for explaining the movement of the force in the initial setting operation mode of the elevator apparatus of FIG.
圆 19]図 1の電子安全コントローラの接点異常検出部を示す回路図である。 [図 20]図 19の安全リレー主接点の動作試験方法を説明するためのフローチャートで ある。 [19] FIG. 19 is a circuit diagram showing a contact abnormality detection unit of the electronic safety controller of FIG. 20 is a flowchart for explaining an operation test method for the safety relay main contact of FIG.
[図 21]図 1の電子安全コントローラに履歴情報記録部及び健全性診断部を接続した 状態を示すブロック図である。  FIG. 21 is a block diagram showing a state where a history information recording unit and a soundness diagnosis unit are connected to the electronic safety controller of FIG.
[図 22]図 22は図 21の履歴情報記録部に格納された情報の一例を示す説明図であ る。  FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit of FIG.
[図 23]図 21の電子安全コントローラの動作を説明するためのフローチャートである。  FIG. 23 is a flowchart for explaining the operation of the electronic safety controller of FIG. 21.
[図 24]図 1の電子安全コントローラの要部を示すブロック図である。  FIG. 24 is a block diagram showing a main part of the electronic safety controller of FIG. 1.
[図 25]図 24のデータ異常チェック用のデータ比較回路を具体的に示す回路図であ る。  FIG. 25 is a circuit diagram specifically showing a data comparison circuit for data abnormality check in FIG. 24.
[図 26]図 24のアドレスバス異常チェック用の指定アドレス検出回路を具体的に示す 回路図である。  FIG. 26 is a circuit diagram specifically showing a designated address detection circuit for checking an address bus abnormality in FIG. 24.
[図 27]図 24の CPU内の指定アドレス出力ソフトウェアと指定アドレス検出回路による 処理動作を示すフローチャートである。  FIG. 27 is a flowchart showing processing operations by designated address output software and a designated address detection circuit in the CPU of FIG.
[図 28]図 24の CPU内のデータバス異常チェックソフトウェアの処理動作を示すフロ 一チャートである。  FIG. 28 is a flowchart showing the processing operation of the data bus abnormality check software in the CPU of FIG. 24.
[図 29]図 1の最寄り階停止指令発生時の電子安全コントローラ及びエレベータ制御 部の動作を示すフローチャートである。  FIG. 29 is a flowchart showing the operation of the electronic safety controller and the elevator controller when the nearest floor stop command is generated in FIG.
[図 30]図 1の電子安全コントローラ及びエレベータ制御部の要部を示す回路図であ る。  FIG. 30 is a circuit diagram showing the main parts of the electronic safety controller and elevator control unit of FIG. 1.
発明を実施するための最良の形態 BEST MODE FOR CARRYING OUT THE INVENTION
以下、この発明の好適な実施の形態について図面を参照して説明する。  Preferred embodiments of the present invention will be described below with reference to the drawings.
実施の形態 1.  Embodiment 1.
図 1はこの発明の実施の形態 1によるエレベータ装置を示す構成図である。図にお いて、昇降路 1内には、一対のかごガイドレール 2及び釣合おもりガイドレール（図示 せず）が設置されている。力ご 3は、かごガイドレール 2に案内されて昇降路 1内を昇 降される。釣合おもり 4は、釣合おもりガイドレールに案内されて昇降路 1内を昇降さ れる。 [0009] かご 3の下部には、力ごガイドレール 2に係合してかご 3を非常停止させる非常止め 装置 5が搭載されている。非常止め装置 5は、機械的な操作により動作してかごガイ ドレール 2に押し付けられる一対の制動片 (楔部材) 6を有している。 FIG. 1 is a configuration diagram showing an elevator apparatus according to Embodiment 1 of the present invention. In the figure, a pair of car guide rails 2 and a counterweight guide rail (not shown) are installed in the hoistway 1. The force 3 is guided by the car guide rail 2 and moved up and down in the hoistway 1. The counterweight 4 is raised and lowered in the hoistway 1 by being guided by the counterweight guide rail. At the bottom of the car 3, an emergency stop device 5 that engages with the force car guide rail 2 and makes the car 3 stop emergency is mounted. The emergency stop device 5 has a pair of braking pieces (wedge members) 6 that are operated by mechanical operation and pressed against the car guide rail 2.
[0010] 昇降路 1内の上部には、主ロープを介して力ご 3及び釣合おもり 4を昇降させる駆動 装置 (卷上機) 7が設置されている。駆動装置 7は、駆動シーブ 8、駆動シーブ 8を回 転させるモータ部（図示せず）、駆動シーブ 8の回転を制動するブレーキ部 9、及び駆 動シーブ 8の回転に応じた検出信号を発生するモータエンコーダ 10を有している。  [0010] In the upper part of the hoistway 1, a driving device (lifting machine) 7 for raising and lowering the force 3 and the counterweight 4 via a main rope is installed. The drive unit 7 generates a detection signal corresponding to the rotation of the drive sheave 8, the motor unit (not shown) that rotates the drive sheave 8, the brake unit 9 that brakes the rotation of the drive sheave 8, and the drive sheave 8. A motor encoder 10 is provided.
[0011] ブレーキ部 9としては、例えば電磁ブレーキ装置が用いられている。電磁ブレーキ 装置においては、制動ばねのばね力によりブレーキシュ一が制動面に押し付けられ て駆動シーブ 8の回転が制動されるとともに、電磁マグネットを励磁することによりブレ 一キシュ一が制動面力 開離され、制動が解除される。  [0011] As the brake unit 9, for example, an electromagnetic brake device is used. In an electromagnetic brake device, the brake shoe is pressed against the braking surface by the spring force of the braking spring to brake the rotation of the drive sheave 8, and the brake magnet is separated from the braking surface force by exciting the electromagnetic magnet. And braking is released.
[0012] エレベータ制御盤 11は、例えば昇降路 1内の下部等に配置されている。エレべ一 タ制御盤 11には、駆動装置 7の運転を制御する運転制御部 12と、エレベータの異常 時にかご 3を急停止させるための安全回路部（リレー回路部） 13とが設けられている。 運転制御部 12には、モータエンコーダ 10からの検出信号が入力される。運転制御 部 12は、モータエンコーダ 10からの検出信号に基づいて、かご 3の位置及び速度を 求め、駆動装置 7を制御する。  [0012] The elevator control panel 11 is disposed, for example, in the lower part of the hoistway 1 or the like. The elevator control panel 11 is provided with an operation control unit 12 for controlling the operation of the drive device 7 and a safety circuit unit (relay circuit unit) 13 for suddenly stopping the car 3 when the elevator is abnormal. Yes. A detection signal from the motor encoder 10 is input to the operation control unit 12. The operation control unit 12 obtains the position and speed of the car 3 based on the detection signal from the motor encoder 10 and controls the driving device 7.
[0013] 安全回路部 13のリレー回路が開路状態にされると、駆動装置 7のモータ部への通 電が遮断されるとともに、ブレーキ部 9の電磁マグネットへの通電が遮断され、駆動シ ーブ 8が制動される。  [0013] When the relay circuit of the safety circuit unit 13 is opened, the power supply to the motor unit of the drive unit 7 is cut off, and the energization of the electromagnetic magnet of the brake unit 9 is cut off, so that the drive 8 is braked.
[0014] 昇降路 1の上部には、調速機 (機械式調速機） 14が設置されている。調速機 14に は、調速機シーブ 15、過速度検出スィッチ 16、ロープキャッチ 17、及びセンサとして の調速機エンコーダ 18が設けられている。調速機シーブ 15には、調速機ロープ 19 が巻き掛けられている。調速機ロープ 19の両端部は、非常止め装置 5の操作機構に 接続されている。調速機ロープ 19の下端部は、昇降路 1の下部に配置された張り車 20に巻き掛けられている。  A speed governor (mechanical speed governor) 14 is installed in the upper part of the hoistway 1. The governor 14 is provided with a governor sheave 15, an overspeed detection switch 16, a rope catch 17, and a governor encoder 18 as a sensor. A governor rope 19 is wound around the governor sheave 15. Both ends of the governor rope 19 are connected to the operation mechanism of the safety device 5. The lower end portion of the governor rope 19 is wound around a tension wheel 20 disposed at the lower part of the hoistway 1.
[0015] 力ご 3が昇降されると、調速機ロープ 19が循環され、力ご 3の走行速度に応じた回 転速度で調速機シーブ 15が回転される。調速機 14では、力ご 3の走行速度が過速 度に達したことが機械的に検出される。検出する過速度としては、定格速度よりも高When the force 3 is raised and lowered, the speed governor rope 19 is circulated, and the speed governor sheave 15 is rotated at a rotational speed corresponding to the traveling speed of the force 3. With governor 14, the speed of force 3 is too high It is mechanically detected that the degree has been reached. The overspeed to be detected is higher than the rated speed.
V、第 1の過速度 (OS速度）と、第 1の過速度よりも高!、第 2の過速度 (Trip速度）とが 設定されている。 V, 1st overspeed (OS speed), higher than 1st overspeed !, 2nd overspeed (Trip speed) are set.
[0016] 力ご 3の走行速度が第 1の過速度に達すると、過速度検出スィッチ 16が操作される 。過速度検出スィッチ 16が操作されると、安全回路部 13のリレー回路が開路状態と なる。力ご 3の走行速度が第 2の過速度に達すると、ロープキャッチ 17により調速機口 ープ 19が把持され、調速機ロープ 19の循環が停止される。調速機ロープ 19の循環 が停止されると、非常止め装置 5が制動動作する。  [0016] When the traveling speed of the force 3 reaches the first overspeed, the overspeed detection switch 16 is operated. When the overspeed detection switch 16 is operated, the relay circuit of the safety circuit unit 13 is opened. When the traveling speed of the force 3 reaches the second overspeed, the rope catcher 17 grips the governor group 19 and the circulation of the governor rope 19 is stopped. When the circulation of the governor rope 19 is stopped, the emergency stop device 5 is braked.
[0017] 調速機エンコーダ 18は、調速機シーブ 15の回転に応じた検出信号を発生する。ま た、調速機エンコーダ 18としては、 2系統の検出信号、即ち第 1及び第 2の検出信号 を同時に出力するデュアルセンスタイプのエンコーダが用いられている。  The governor encoder 18 generates a detection signal corresponding to the rotation of the governor sheave 15. The governor encoder 18 is a dual sense type encoder that outputs two detection signals, that is, first and second detection signals simultaneously.
[0018] 調速機エンコーダ 18からの第 1及び第 2の検出信号は、電子安全コントローラ 21に 設けられた終端階強制減速装置 (ETS装置)の ETS回路部 22に入力される。 ETS 回路部 22は、調速機エンコーダ 18からの検出信号に基づいてエレベータの異常を 検出し、エレベータを安全な状態に移行させるための指令信号を出力する。具体的 には、 ETS回路部 22は、調速機エンコーダ 18からの信号により、運転制御部 12とは 独立して、かご 3の走行速度及び位置を求め、終端階付近でのかご 3の走行速度が ETS監視過速度に達したかどうかを監視する。  The first and second detection signals from the governor encoder 18 are input to the ETS circuit unit 22 of the terminal floor forced reduction device (ETS device) provided in the electronic safety controller 21. The ETS circuit unit 22 detects an abnormality of the elevator based on the detection signal from the governor encoder 18 and outputs a command signal for shifting the elevator to a safe state. Specifically, the ETS circuit unit 22 obtains the traveling speed and position of the car 3 independently of the operation control unit 12 based on a signal from the governor encoder 18, and the traveling of the car 3 near the terminal floor is performed. Monitor whether the speed has reached ETS monitoring overspeed.
[0019] また、 ETS回路部 22は、調速機エンコーダ 18からの信号をデジタル信号に変換し 、デジタル演算処理を行うことにより、力ご 3の走行速度が ETS監視過速度に達した カゝどうかを判断する。 ETS回路部 22によりかご 3の走行速度が ETS監視過速度に達 したと判断されると、安全回路部 13のリレー回路が開路状態となる。  In addition, the ETS circuit unit 22 converts the signal from the governor encoder 18 into a digital signal and performs digital arithmetic processing, so that the traveling speed of the force 3 reaches the ETS monitoring overspeed. Judge whether. When the ETS circuit unit 22 determines that the traveling speed of the car 3 has reached the ETS monitoring overspeed, the relay circuit of the safety circuit unit 13 is opened.
[0020] また、 ETS回路部 22は、 ETS回路部 22自体の異常、及び調速機エンコーダ 18の 異常を検出可能である。 ETS回路部 22自体又は調速機エンコーダ 18の異常が検 出された場合、エレベータを安全な状態に移行させるための指令信号としての最寄り 階停止指令信号が ETS回路部 22から運転制御部 12に対して出力される。さらに、 E TS回路部 22と運転制御部 12との間は、双方向に通信可能となって 、る。  [0020] Further, the ETS circuit unit 22 can detect an abnormality in the ETS circuit unit 22 itself and an abnormality in the governor encoder 18. When an abnormality is detected in the ETS circuit unit 22 itself or the governor encoder 18, the nearest floor stop command signal as a command signal for shifting the elevator to a safe state is sent from the ETS circuit unit 22 to the operation control unit 12. Are output. Further, bidirectional communication is possible between the ETS circuit unit 22 and the operation control unit 12.
[0021] 昇降路 1内の所定の位置には、力ご 3が昇降路 1内の基準位置に位置することを検 出するための第 1一第 4の基準センサ 23— 26が設けられて 、る。基準センサ 23— 2 6としては、上部及び下部終端階スィッチを用いることができる。基準センサ 23— 26 力もの検出信号は、 ETS回路部 22に入力される。 ETS回路部 22では、基準センサ 23— 26からの検出信号に基づいて、 ETS回路部 22内で求めたかご 3の位置の情 報を修正する。 [0021] At a predetermined position in the hoistway 1, it is confirmed that the force 3 is located at a reference position in the hoistway 1. First to fourth reference sensors 23-26 are provided for delivery. As the reference sensor 23-26, upper and lower terminal floor switches can be used. The detection signal of the reference sensor 23-26 is input to the ETS circuit section 22. The ETS circuit unit 22 corrects the information on the position of the car 3 obtained in the ETS circuit unit 22 based on the detection signal from the reference sensor 23-26.
[0022] 昇降路 1の底面とかご 3及び釣合おもり 4の下面との間には、力ご緩衝器 27及び釣 合おもり緩衝器 28が設置されている。ここでは、かご緩衝器 27及び釣合おもり緩衝 器 28は、昇降路 1内の下部に設置されている。かご緩衝器 27は、力ご 3の真下に配 置され、カゝご 3が昇降路 1の底部に衝突する際の衝撃を緩和する。釣合おもり緩衝器 28は、釣合おもり 4の真下に配置され、釣合おもり 4が昇降路 1の底部に衝突する際 の衝撃を緩和する。これらの緩衝器 27, 28としては、例えば油入式又はばね式バッ ファが用いられている。  Between the bottom surface of the hoistway 1 and the lower surfaces of the car 3 and the counterweight 4, a force buffer 27 and a counterweight buffer 28 are installed. Here, the car buffer 27 and the counterweight buffer 28 are installed in the lower part of the hoistway 1. The car shock absorber 27 is disposed directly under the force 3 to reduce the impact when the car 3 collides with the bottom of the hoistway 1. The counterweight buffer 28 is disposed directly below the counterweight 4 and reduces the impact when the counterweight 4 collides with the bottom of the hoistway 1. As these shock absorbers 27 and 28, for example, oil-filled or spring-type buffers are used.
[0023] 図 2は図 1の調速機 14及び ETS回路部 22において設定された過速度のパターン を示すグラフである。図において、かご 3が下部終端階から上部終端階まで通常速度 (定格速度)で走行する場合、カゝご 3の速度パターンは、通常速度パターン VOとなる 。調速機 14には、機械的な位置調整により第 1及び第 2の過速度パターン VI, V2 が設定されている。 ETS回路部 22には、 ETS監視過速度パターン VEが設定されて いる。  FIG. 2 is a graph showing an overspeed pattern set in the governor 14 and the ETS circuit unit 22 of FIG. In the figure, when the car 3 travels at a normal speed (rated speed) from the lower terminal floor to the upper terminal floor, the speed pattern of the car 3 is a normal speed pattern VO. The governor 14 is set with first and second overspeed patterns VI and V2 by mechanical position adjustment. The ETS circuit overspeed pattern VE is set in the ETS circuit section 22.
[0024] ETS監視過速度パターン VEは、通常速度パターン VOよりも高く設定されている。  [0024] The ETS monitoring overspeed pattern VE is set higher than the normal speed pattern VO.
また、 ETS監視過速度パターン VEは、通常速度パターン VOに対して全昇降行程で ほぼ等間隔をおくように設定されている。即ち、 ETS監視過速度パターン VEは、 ご位置に応じて変化している。さらに具体的には、 ETS監視過速度パターン VEは、 中間階付近で一定となるように設定されているが、終端階付近では昇降路 1の終端（ 上端及び下端)へ近づくに従って連続的かつ滑らかに低くなるように設定されて 、る 。このように、 ETS回路部 22は、終端階付近だけでなぐ中間階付近 (通常速度バタ ーン VOにおける一定速走行区間）でも力ご 3の走行速度を監視しているが、中間階 付近につ ヽては必ずしも監視しなくてもょ ヽ。  In addition, the ETS monitoring overspeed pattern VE is set so as to be approximately equidistant from the normal speed pattern VO in the entire lifting process. That is, the ETS monitoring overspeed pattern VE changes according to your position. More specifically, the ETS monitoring overspeed pattern VE is set to be constant near the intermediate floor, but continuously and smoothly as it approaches the terminal end (upper and lower ends) of the hoistway 1 near the terminal floor. It is set to be low. In this way, the ETS circuit section 22 monitors the traveling speed of the force 3 even in the vicinity of the intermediate floor (a constant speed traveling section in the normal speed pattern VO) that is not only in the vicinity of the terminal floor, but in the vicinity of the intermediate floor. Therefore, it is not always necessary to monitor.
[0025] 第 1の過速度パターン VIは、 ETS監視過速度パターン VEよりも高く設定されてい る。また、第 2の過速度パターン V2は、第 1の過速度パターン VIよりもさらに高く設定 されている。また、第 1及び第 2過速度パターン VI, V2は、昇降路 1内の全ての高さ で一定である。 [0025] The first overspeed pattern VI is set higher than the ETS monitoring overspeed pattern VE. The Also, the second overspeed pattern V2 is set higher than the first overspeed pattern VI. The first and second overspeed patterns VI and V2 are constant at all heights in the hoistway 1.
[0026] 釣合おもり緩衝器 28のバッファストロークは、 ETS回路部 22によって制限される釣 合おもり 4の釣合おもり緩衝器 28への衝突速度に応じて、調速機 14で制限される衝 突速度に応じて規定されるストロークよりも短く設定されて 、る。かご緩衝器 27のバッ ファストロークは、調速機 14で制限される衝突速度に応じて規定されている。  [0026] The buffer stroke of the counterweight buffer 28 is limited by the governor 14 according to the collision speed of the counterweight 4 to the counterweight buffer 28 limited by the ETS circuit section 22. It is set shorter than the stroke specified according to the impact speed. The buffer stroke of the car shock absorber 27 is specified according to the collision speed limited by the governor 14.
[0027] 緩衝器 27, 28のノ ッファストロークは、力ご 3や釣合おもり 4が最初に接触したとき の初速度と、力ご 3や釣合おもり 4が停止するまでの許容減速度とによって決まるもの である。従って、かご緩衝器 27のバッファストロークよりも、釣合おもり緩衝器 28のバ ッファストロークの方が短く設定される。即ち、釣合おもり緩衝器 28のノ ッファストロー クは、かご緩衝器 27のバッファストロークよりも短くなつている。  [0027] The chopper strokes of the shock absorbers 27 and 28 are the initial speed when the force 3 and the counterweight 4 first contact each other, and the allowable deceleration until the force 3 and the counterweight 4 stop. It depends on Accordingly, the buffer stroke of the counterweight buffer 28 is set shorter than the buffer stroke of the car buffer 27. That is, the knot fast stroke of the counterweight shock absorber 28 is shorter than the buffer stroke of the car shock absorber 27.
[0028] また、釣合おもり緩衝器 28は、例えば主ロープが破断した場合など、 ETS監視過 速度パターン VEで規定される速度よりも大きな速度で釣合おもり 4が衝突した場合 にも破壊されることがないように、十分な容量に設定されている。このように、釣合おも り緩衝器 28の十分な容量を確保する方法としては、例えば通常よりも大きな容量の 緩衝器を用いる力、又は通常の容量の緩衝器を複数用いる方法などがある。  [0028] The counterweight buffer 28 is also destroyed when the counterweight 4 collides at a speed larger than the speed specified by the ETS monitoring overspeed pattern VE, for example, when the main rope breaks. It is set to a sufficient capacity so that it does not occur. As described above, as a method for securing a sufficient capacity of the counterweight buffer 28, for example, there is a force using a buffer having a larger capacity than usual, or a method using a plurality of buffers having a normal capacity. .
[0029] 力ご 3が最上階に停止したときのかご 3の上端部と昇降路 1の天井部との間の隙間 寸法は、 ETS回路部 22によって制限される釣合おもり 4の釣合おもり緩衝器 28への 衝突速度に応じて設定されている。即ち、釣合おもり 4が釣合おもり緩衝器 28に衝突 しても、力ご 3が昇降路 1の天井部に衝突しないように、昇降路 1の頂部隙間寸法が 設定されている。  [0029] The gap between the upper end of the car 3 and the ceiling of the hoistway 1 when the force 3 stops on the top floor. The size of the counterweight is limited by the ETS circuit section 22. It is set according to the impact speed to shock absorber 28. That is, the top clearance of the hoistway 1 is set so that the force 3 does not collide with the ceiling of the hoistway 1 even if the counterweight 4 collides with the counterweight buffer 28.
[0030] 図 3は図 1の電子安全コントローラ 21、エレベータ制御盤 11及び各種センサの接 続関係を示すブロック図である。図において、電子安全コントローラ 21には、調速機 エンコーダ 18からの 2系統の検出信号、第 1一第 4基準センサ 23— 26からの検出信 号、及びその他のセンサ (第 1一第 Nのセンサ)からの信号が入力される。また、電子 安全コントローラ 21は、センサ毎に対応した複数の信号入力ポートを有している。即 ち、電子安全コントローラ 21には、各センサからの信号が別々に入力される。これに より、電子安全コントローラ 21は、各センサの異常を検出可能となっている。 FIG. 3 is a block diagram showing a connection relationship among the electronic safety controller 21, the elevator control panel 11, and various sensors shown in FIG. In the figure, the electronic safety controller 21 includes two detection signals from the governor encoder 18, detection signals from the first and fourth reference sensors 23 to 26, and other sensors (first and first N The signal from the sensor is input. The electronic safety controller 21 has a plurality of signal input ports corresponding to each sensor. That is, the signals from each sensor are input to the electronic safety controller 21 separately. to this Thus, the electronic safety controller 21 can detect abnormality of each sensor.
[0031] 電子安全コントローラ 21により何等かの異常 (例えば過速度、センサ故障、電子安 全コントローラ 21自体の異常等)が検出されると、故障や異常の内容を含む故障'異 常内容信号がエレベータ制御盤 11の制御ユニット（図示せず）に入力されるとともに 、故障や異常の内容に応じた停止信号がエレベータ制御盤 11の駆動 ·制動ユニット (図示せず）に入力される。 [0031] If any abnormality (for example, overspeed, sensor failure, abnormality in the electronic safety controller 21 itself, etc.) is detected by the electronic safety controller 21, a failure 'abnormality content signal including the content of the failure or abnormality is generated. In addition to being input to a control unit (not shown) of the elevator control panel 11, a stop signal corresponding to the content of the failure or abnormality is input to a drive / braking unit (not shown) of the elevator control panel 11.
[0032] 図 4は図 1の電子安全コントローラ 21の要部の装置構成を示すブロック図である。  FIG. 4 is a block diagram showing a device configuration of a main part of the electronic safety controller 21 of FIG.
電子安全コントローラ 21は、第 1の安全プログラムに基づいてエレベータの異常を検 出するための演算処理を実行する第 1のマイクロプロセッサ 31と、第 2の安全プロダラ ムに基づいてエレベータの異常を検出するための演算処理を実行する第 2のマイク 口プロセッサ 32とを含んで!/、る。  The electronic safety controller 21 detects the abnormality of the elevator based on the first microprocessor 31 that executes arithmetic processing for detecting the abnormality of the elevator based on the first safety program and the second safety program. Including a second microphone port processor 32 for executing arithmetic processing to perform!
[0033] 第 1の安全プログラムは、第 2の安全プログラムと同じ内容のプログラムである。第 1 及び第 2のマイクロプロセッサ 31, 32は、プロセッサ間バス及び 2ポート RAM33を介 して互いに通信可能になっている。また、第 1及び第 2のマイクロプロセッサ 31, 32は 、互いの演算処理結果を比較することにより第 1及び第 2のマイクロプロセッサ 31, 3 2自体の健全性を確認可能になっている。即ち、第 1及び第 2のマイクロプロセッサ 3 1, 32に同一処理を実行させ、処理結果を 2ポート RAM33等を介して通信比較する こと〖こより、マイクロプロセッサ 31, 32の健全性が確認される。  [0033] The first safety program is a program having the same content as the second safety program. The first and second microprocessors 31 and 32 can communicate with each other via an interprocessor bus and a two-port RAM 33. Further, the first and second microprocessors 31 and 32 can confirm the soundness of the first and second microprocessors 31 and 32 themselves by comparing the calculation processing results of each other. In other words, the soundness of the microprocessors 31 and 32 is confirmed by having the first and second microprocessors 31 and 32 execute the same processing and comparing the processing results via the 2-port RAM 33 and the like. .
[0034] また、マイクロプロセッサ 31, 32は、マイクロプロセッサ 31, 32自体の異常以外の 電子安全コントローラ 21の異常も演算処理により検出可能である。  In addition, the microprocessors 31 and 32 can detect abnormalities in the electronic safety controller 21 other than those in the microprocessors 31 and 32 themselves by arithmetic processing.
[0035] 図 5は図 4のマイクロプロセッサ 31, 32による演算処理の実行方法を示す説明図で ある。マイクロプロセッサ 31, 32は、定周期タイマからの信号に基づく所定の演算周 期（例えば 50msec)で、 ROMに格納されたプログラムに従って、演算処理を繰り返 し実行する。一周期内に実行されるプログラムには、エレベータの異常を検出するた めの安全プログラムと、電子安全コントローラ 21自体や各種センサの故障 ·異常を検 出するための故障 ·異常チェックプログラムとが含まれる。また、故障'異常チェックプ ログラムは、予め設定された条件が満たされたときのみ実行するようにしてもょ 、。  FIG. 5 is an explanatory diagram showing a method of executing arithmetic processing by the microprocessors 31 and 32 of FIG. The microprocessors 31 and 32 repeatedly execute the arithmetic processing according to the program stored in the ROM at a predetermined arithmetic cycle (for example, 50 msec) based on the signal from the fixed-cycle timer. Programs executed within one cycle include a safety program for detecting elevator abnormalities and a fault / abnormality check program for detecting faults / abnormalities in the electronic safety controller 21 itself and various sensors. It is. In addition, the failure / abnormality check program may be executed only when preset conditions are satisfied.
[0036] このようなエレベータ装置では、電子安全コントローラ 21が電子安全コントローラ 21 自体の異常を検出可能であり、電子安全コントローラ 21自体の異常を検出した場合 にも、エレベータを安全な状態に移行させるための指令信号を出力するので、エレ ベータの異常の検出速度や異常に対する処理速度を高めつつ、比較的簡単な構成 で安全システムの信頼性を向上させることができる。 In such an elevator apparatus, the electronic safety controller 21 is replaced with the electronic safety controller 21. Even if an abnormality of the electronic safety controller 21 itself is detected, a command signal for shifting the elevator to a safe state is output even when an abnormality of the electronic safety controller 21 itself is detected. The reliability of the safety system can be improved with a relatively simple configuration while increasing the processing speed.
[0037] また、電子安全コントローラ 21は、各種センサの異常も検出可能であり、センサの 異常を検出した場合にも、エレベータを安全な状態に移行させるための指令信号を 出力するので、安全システムの信頼性をさらに向上させることができる。  [0037] In addition, the electronic safety controller 21 can detect abnormality of various sensors, and even when the abnormality of the sensor is detected, it outputs a command signal for shifting the elevator to a safe state. The reliability can be further improved.
[0038] さらに、電子安全コントローラ 21は第 1及び第 2のマイクロプロセッサ 31, 32を含み 、第 1及び第 2のマイクロプロセッサ 31, 32は、互いの演算処理結果を比較すること により第 1及び第 2のマイクロプロセッサ 31, 32自体の健全性を確認可能になってい るので、安全システムの信頼性をさらに向上させることができる。  [0038] Furthermore, the electronic safety controller 21 includes first and second microprocessors 31, 32, and the first and second microprocessors 31, 32 compare the first and second processing results with each other. Since the soundness of the second microprocessor 31, 32 itself can be confirmed, the reliability of the safety system can be further improved.
[0039] 以下、電子安全コントローラ 21の構成及び動作の具体例を説明する。  Hereinafter, a specific example of the configuration and operation of the electronic safety controller 21 will be described.
《クロック異常検出》  《Clock error detection》
図 6は図 1の電子安全コントローラ 21の要部を示すブロック図である。電子安全コン トローラ 21には、十分な信頼性を確保するため、二重系の回路構成が採用されてい る。  FIG. 6 is a block diagram showing a main part of the electronic safety controller 21 of FIG. The electronic safety controller 21 employs a dual circuit configuration to ensure sufficient reliability.
[0040] 電子安全コントローラ 21では、第 1及び第 2マイクロプロセッサとしての第 1及び第 2 の CPU (処理部） 41, 42が用いられている。第 1の CPU41は、運転制御部 12及び 第 1の出力インタフェース（出力部) 43に制御信号を出力する。第 2の CPU42は、運 転制御部 12及び第 2の出力インタフェース（出力部) 44に制御信号を出力する。  [0040] The electronic safety controller 21 uses first and second CPUs (processing units) 41 and 42 as first and second microprocessors. The first CPU 41 outputs a control signal to the operation control unit 12 and the first output interface (output unit) 43. The second CPU 42 outputs a control signal to the operation control unit 12 and the second output interface (output unit) 44.
[0041] 運転制御部 12は、第 1及び第 2の CPU41, 42から同様の制御信号を受けたときに 、その制御信号により制御される。第 1及び第 2の出力インタフェース 43, 44は、第 1 及び第 2の CPU41, 42からの制御信号に基づいて、安全回路部 13を開路状態とす るための信号を出力する。  When the operation control unit 12 receives similar control signals from the first and second CPUs 41 and 42, the operation control unit 12 is controlled by the control signals. The first and second output interfaces 43 and 44 output a signal for opening the safety circuit unit 13 based on the control signals from the first and second CPUs 41 and 42.
[0042] 第 1及び第 2の CPU41, 42には、両者間のデータ授受を行うための 2ポート RAM 45が接続されている。第 1の CPU41には、第 1ウォッチドッグタイマ 46が接続されて いる。第 2の CPU42には、第 2ウォッチドッグタイマ 47が接続されている。  [0042] The first and second CPUs 41 and 42 are connected to a two-port RAM 45 for exchanging data between them. A first watchdog timer 46 is connected to the first CPU 41. A second watchdog timer 47 is connected to the second CPU.
[0043] 第 1の CPU41には、調速機エンコーダ 18 (図 1)力もの 2系統の信号が入力される 。また、第 2の CPU42にも、調速機エンコーダ 18からの 2系統の信号が入力される。 調速機エンコーダ 18からの信号は、 CPU41, 42で演算処理され、これによりかご 3 ( 図 1)の速度及び位置が求められる。即ち、調速機エンコーダ 18は、速度センサ兼位 置センサとして機能する。また、 CPU41, 42には、図 3で示したような種々のセンサ 力 の信号も入力される。 [0043] The first CPU 41 receives two signals from the governor encoder 18 (Fig. 1). . In addition, two signals from the governor encoder 18 are also input to the second CPU 42. The signal from the governor encoder 18 is processed by the CPUs 41 and 42, whereby the speed and position of the car 3 (FIG. 1) are obtained. That is, the governor encoder 18 functions as a speed sensor and a position sensor. The CPUs 41 and 42 are also input with various sensor force signals as shown in FIG.
[0044] 第 1の CPU41には、第 1のクロック 48からの第 1のクロック信号が入力される。第 2 の CPU42は、第 2のクロック 49力らの第 2のクロック信号が入力される。第 1及び第 2 のクロック信号の周波数は互いに等しく設定されて 、る。 The first CPU 41 receives the first clock signal from the first clock 48. The second CPU 42 receives the second clock signal such as the second clock 49. The frequencies of the first and second clock signals are set equal to each other.
[0045] 第 1及び第 2のクロック信号は、クロック異常検出回路 50にも入力される。クロック異 常検出回路 50は、第 1及び第 2のクロック信号のパルス数をカウントし、パルス数の差 から第 1及び第 2のクロック信号の異常を検出する。  The first and second clock signals are also input to the clock abnormality detection circuit 50. The clock abnormality detection circuit 50 counts the number of pulses of the first and second clock signals, and detects the abnormality of the first and second clock signals from the difference in the number of pulses.
[0046] 第 1及び第 2の CPU41, 42は、クロック異常検出回路 50の健全性をチェックするた めのテストモード信号 51, 52をクロック異常検出回路 50に送信する。また、第 1及び 第 2の CPU41, 42は、クロック異常検出を開始するための検出開始指令信号 53, 5 4をクロック異常検出回路 50に送信する。  The first and second CPUs 41 and 42 transmit test mode signals 51 and 52 for checking the soundness of the clock abnormality detection circuit 50 to the clock abnormality detection circuit 50. The first and second CPUs 41 and 42 transmit detection start command signals 53 and 54 for starting clock abnormality detection to the clock abnormality detection circuit 50.
[0047] また、クロック異常検出回路 50は、クロック異常を検出したときにエラー信号 55, 56 を第 1及び第 2の CPU41, 42に入力する。  The clock abnormality detection circuit 50 inputs error signals 55 and 56 to the first and second CPUs 41 and 42 when detecting a clock abnormality.
[0048] 図 7は図 6のクロック異常検出回路 50の具体的な構成を示す構成図である。クロッ ク異常検出回路 50には、第 1のクロック信号のノ ルスエッジをカウントする第 1の監視 カウンタ 57及び第 1の被監視カウンタ 58と、第 2のクロック信号のパルスエッジをカウ ントする第 2の監視カウンタ 59及び第 2の被監視カウンタ 60とが設けられている。  FIG. 7 is a configuration diagram showing a specific configuration of the clock abnormality detection circuit 50 of FIG. The clock anomaly detection circuit 50 includes a first monitoring counter 57 and a first monitored counter 58 that counts the first edge of the first clock signal, and a second clock that counts the pulse edge of the second clock signal. Monitoring counter 59 and a second monitored counter 60 are provided.
[0049] 第 1のクロック信号は、第 1のセレクタ 61を介して第 1の被監視カウンタ 58に入力さ れる。第 1のセレクタ 61では、通常回路とテスト回路との切換が可能になっている。通 常回路では、第 1のクロック信号がそのまま第 1の被監視カウンタ 58に入力される。テ スト回路では、第 1のクロック信号が第 1の遁倍回路 62で遁倍された後、第 1の被監 視カウンタ 58に入力される。テスト回路への切換は、第 1の CPU41からのテストモー ド信号 51が第 1のセレクタ 61に入力されることにより行われる。  The first clock signal is input to the first monitored counter 58 via the first selector 61. In the first selector 61, switching between the normal circuit and the test circuit is possible. In the normal circuit, the first clock signal is input to the first monitored counter 58 as it is. In the test circuit, the first clock signal is multiplied by the first multiplication circuit 62 and then input to the first monitored counter 58. Switching to the test circuit is performed by inputting a test mode signal 51 from the first CPU 41 to the first selector 61.
[0050] 同様に、第 2のクロック信号は、第 2のセレクタ 63を介して第 2の被監視カウンタ 60 に入力される。第 2のセレクタ 63では、通常回路とテスト回路との切換が可能になつ ている。通常回路では、第 2のクロック信号がそのまま第 2の被監視カウンタ 60に入 力される。テスト回路では、第 2のクロック信号が第 2の遁倍回路 64で遁倍された後、 第 2の被監視カウンタ 60に入力される。テスト回路への切換は、第 2の CPU42からの テストモード信号 52が第 2のセレクタ 63に入力されることにより行われる。 Similarly, the second clock signal is sent to the second monitored counter 60 via the second selector 63. Is input. In the second selector 63, switching between the normal circuit and the test circuit is possible. In the normal circuit, the second clock signal is input to the second monitored counter 60 as it is. In the test circuit, the second clock signal is multiplied by the second multiplication circuit 64 and then input to the second monitored counter 60. Switching to the test circuit is performed by inputting the test mode signal 52 from the second CPU 42 to the second selector 63.
[0051] 第 1及び第 2の被監視カウンタ 58, 60からのリップルキャリーアウトプット信号、即ち エラー信号 55, 56は、第 1及び第 2のラッチ部 65, 66でラッチされる。第 1及び第 2 のラッチ部 65, 66は、第 1及び第 2の CPU41, 42力ものラッチ解除信号 67, 68を受 けてラッチ状態を解除する。  Ripple carry output signals from the first and second monitored counters 58 and 60, that is, error signals 55 and 56 are latched by the first and second latch units 65 and 66. The first and second latch units 65 and 66 receive the latch release signals 67 and 68 of the first and second CPUs 41 and 42 and release the latched state.
[0052] クロック異常検出回路 50からのエラー信号が CPU41, 42に入力されると、 CPU4 1, 42から出力インタフェース 43, 44に異常検出信号が出力される。そして、出カイ ンタフ ース 43, 44から安全回路部 13に作動信号が出力され、安全回路部 13によ りエレベータが安全状態へと移行される。  When an error signal from the clock abnormality detection circuit 50 is input to the CPUs 41 and 42, an abnormality detection signal is output from the CPUs 4 and 42 to the output interfaces 43 and 44. Then, an operation signal is output from the output counter face 43, 44 to the safety circuit unit 13, and the safety circuit unit 13 shifts the elevator to a safe state.
[0053] なお、電子安全コントローラ 21は、図 6に示した CPU41, 42や ROMを含むコンビ ユータ（マイクロコンピュータ）を含んで!/、る。  [0053] The electronic safety controller 21 includes a CPU (microcomputer) including the CPUs 41 and 42 and the ROM shown in FIG.
[0054] 次に、動作について説明する。調速機エンコーダ 18から出力された 2系統のパル ス信号は、 CPU41, 42〖こ入力される。そして、 CPU41, 42のそれぞれ〖こより、パル ス信号は演算処理され、力ご 3の位置及び速度が求められる。求められた位置及び 速度は、 2ポート RAM45を介して互いに比較された上で、異常を判定するための設 定値 (基準値)、例えば ETS監視過速度と比較される。  Next, the operation will be described. The two pulse signals output from governor encoder 18 are input to CPU41 and 42. Then, the pulse signals are calculated from the CPUs 41 and 42, and the position and speed of the force 3 are obtained. The obtained position and speed are compared with each other via the 2-port RAM 45, and then compared with a set value (reference value) for judging abnormality, for example, ETS monitoring overspeed.
[0055] そして、過速度や位置異常などの異常が検出されると、異常の内容に応じて、運転 制御部 12又は安全回路部 13に信号が出力され、エレベータが安全状態へと移行さ れる。安全状態への移行とは、例えばかご 3を急停止させること、又はかご 3を最寄り 階に停止させることである。また、安全状態への移行後、必要に応じて運転制御部 1 2がさらに制御される。  [0055] When an abnormality such as an overspeed or a position abnormality is detected, a signal is output to the operation control unit 12 or the safety circuit unit 13 according to the content of the abnormality, and the elevator is shifted to a safe state. . The transition to the safe state is, for example, that the car 3 is stopped suddenly or the car 3 is stopped on the nearest floor. In addition, after the transition to the safe state, the operation control unit 12 is further controlled as necessary.
[0056] なお、 CPU41, 42の演算結果が互いに異なっていれば、 CPU41, 42のどちら力 の系に異常があると判断され、やはりエレベータが安全状態へと移行される。  [0056] If the calculation results of CPUs 41 and 42 are different from each other, it is determined that either power system of CPUs 41 and 42 is abnormal, and the elevator is also shifted to a safe state.
また、求められた位置及び速度に異常がなければ、力ご 3の走行を許可する旨の 制御信号が生成され、運転制御部 12に出力される。 If there is no abnormality in the required position and speed, A control signal is generated and output to the operation control unit 12.
[0057] CPU41, 42では、一定時間内に入力されるパルス信号をカウントすることにより、 力ご速度を求める演算が実行される。そして、その「一定時間」を司るタイマは、クロッ ク 48, 49からのクロック信号により生成されている。従って、クロック信号の周波数は 非常に重要である。 [0057] In CPUs 41 and 42, an arithmetic operation for obtaining a force speed is executed by counting pulse signals input within a predetermined time. The timer that controls the “certain time” is generated by clock signals from the clocks 48 and 49. Therefore, the frequency of the clock signal is very important.
[0058] 特に、周波数が高くなる異常については、かご 3の過速度を監視する上で注意が必 要である。例えば、 10ms毎にパルス信号をカウントしているつもりが、何等かの故障 によりクロック信号の周期が半分になると、実際には 5ms毎にカウントしていることに なってしまう。この場合、 CPU41, 42で求められたかご速度は、実際のかご速度の 半分として誤認識されてしま ヽ、過速度が検出できな 、状態となる。  [0058] In particular, with regard to an abnormality in which the frequency increases, caution is required in monitoring the overspeed of the car 3. For example, if you intend to count the pulse signal every 10 ms, but if the clock signal period is halved due to some failure, you are actually counting every 5 ms. In this case, the car speed obtained by the CPUs 41 and 42 is misrecognized as half the actual car speed, and the overspeed cannot be detected.
[0059] これに対して、この例では、第 1及び第 2のクロック 48, 49力らのクロック信号がクロ ック異常検出回路 50に入力され、クロック信号に異常がないかが監視されている。  On the other hand, in this example, the clock signals of the first and second clocks 48 and 49 are input to the clock abnormality detection circuit 50 to monitor whether there is an abnormality in the clock signal. .
[0060] 次に、クロック異常監視動作の詳細について説明する。まず、電源リセット時には、 各デバイスが安定し次第、カウンタ 57— 60によりクロックノ ルスのカウントが直ちに開 始される。これにより、エラー信号 55, 56がラッチされるが、 CPU41, 42では、最初 はこのエラー信号 55, 56が無視される。  Next, details of the clock abnormality monitoring operation will be described. First, at the time of power reset, as soon as each device stabilizes, the counter 57-60 starts counting the clock noise immediately. As a result, the error signals 55 and 56 are latched, but the CPUs 41 and 42 initially ignore the error signals 55 and 56.
[0061] この後、検出開始指令信号 53, 54に Highの信号が与えられ、次いでラッチ解除 信号 67, 68が CPU41, 42からクロック異常検出回路 50に送られる。  Thereafter, a high signal is given to the detection start command signals 53 and 54, and then latch release signals 67 and 68 are sent from the CPUs 41 and 42 to the clock abnormality detection circuit 50.
[0062] 検出開始指令信号 53, 54が Highになって力 最初の監視カウンタ 57, 59からの リップルキャリーアウトプット信号で、各カウンタ 57— 60のプリセットデータ値が各カウ ンタ 57— 60にロードされ、カウントアップが開始される。プリセットデータ値は、カウン タ 57— 60でカウントを開始する際のカウント値である。  [0062] Detection start command signals 53, 54 become High and the force is the ripple carry output signal from the first monitoring counter 57, 59. The preset data value of each counter 57-60 is loaded to each counter 57-60. And the count-up is started. The preset data value is the count value when counting starts with the counter 57-60.
[0063] 被監視カウンタ 58, 60のプリセットデータ値としては、例えば 0が予め設定される。  [0063] As preset data values of the monitored counters 58, 60, for example, 0 is set in advance.
また、監視カウンタ 57, 59のプリセットデータ値としては、クロック異常を判定するため の閾値が予め設定される。監視カウンタ 57, 59のプリセットデータ値は、被監視カウ ンタ 58, 60のプリセットデータ値よりも大きい数値、ここでは 4が設定される。  As preset data values of the monitoring counters 57 and 59, a threshold value for determining a clock abnormality is set in advance. The preset data value of the monitoring counters 57 and 59 is set to a value larger than the preset data value of the monitored counters 58 and 60, in this case, 4.
[0064] 監視カウンタ 57, 59は、被監視カウンタ 58, 60よりも短い範囲でパルス数を繰り返 しカウントし、キャリーオーバーする度に被監視カウンタ 57, 59をリセットする。被監視 カウンタ 58, 60もパルス数を繰り返しカウントしょうとする力 正常時には、被監視カウ ンタ 58, 60がキャリーオーバーする前に監視カウンタ 57, 59がキャリーオーバーし て被監視カウンタ 58, 60がリセットされる。 The monitoring counters 57 and 59 repeatedly count the number of pulses in a range shorter than the monitored counters 58 and 60, and reset the monitored counters 57 and 59 every time they carry over. Monitored Counter 58, 60 is also a force that repeatedly counts the number of pulses. Under normal conditions, the monitoring counters 57, 59 carry over and the monitored counters 58, 60 are reset before the monitored counters 58, 60 carry over. .
[0065] このようなプリセットデータ値は、クロック異常検出回路 50を例えば FPGA (field programmable gate array)で構成することにより、任意に設定可能である。  Such preset data values can be arbitrarily set by configuring the clock abnormality detection circuit 50 with, for example, an FPGA (field programmable gate array).
[0066] 2つのクロック 48, 49が正常なときは、被監視カウンタ 58, 60がキャリーオーバーし てリップルキャリーアウトプット信号、即ちエラー信号 55, 56を出力するよりも 4つ手前 のカウンタ値で、監視カウンタ 57, 59のリップルキャリーアウトプット信号によりリセット されるため、エラー信号 55, 56は出力されない。  [0066] When the two clocks 48 and 49 are normal, the monitored counters 58 and 60 carry over and the ripple carry output signal, that is, the counter value four times before the error signals 55 and 56 are output. The error signals 55 and 56 are not output because they are reset by the ripple carry output signal of the monitoring counters 57 and 59.
[0067] これに対して、例えば第 1のクロック 48の周波数が高くなる異常が起きた場合、第 2 の監視カウンタ 59のリップルキャリーアウトプット信号が第 1の被監視カウンタ 58をリ セットする前に、第 1の被監視カウンタ 58のリップルキャリーアウトプット信号、即ちェ ラー信号 55が出力され、ラッチ部 65によりエラー信号 55がラッチされる。  [0067] On the other hand, for example, when an abnormality occurs in which the frequency of the first clock 48 is increased, the ripple carry output signal of the second monitoring counter 59 is reset before the first monitored counter 58 is reset. In addition, the ripple carry output signal of the first monitored counter 58, that is, the error signal 55 is output, and the error signal 55 is latched by the latch unit 65.
[0068] また、第 2のクロック 49の周波数が高くなる異常が起きた場合は、同様にして第 2の 被監視カウンタ 60からエラー信号 56が出力され、ラッチ部 66によりエラー信号 56が ラッチされる。  [0068] When an abnormality occurs in which the frequency of the second clock 49 increases, the error signal 56 is output from the second monitored counter 60 in the same manner, and the error signal 56 is latched by the latch unit 66. The
[0069] さらに、クロック 48, 49が停止した場合には、クロック異常検出回路 50でも検出可 能である力 ウォッチドッグタイマ 46, 47が効き、強制リセットとなるため、危険状態と なることはない。  [0069] Furthermore, when the clocks 48 and 49 are stopped, the force that can be detected by the clock abnormality detection circuit 50 is also activated. .
[0070] このような構成とすることにより、クロック異常を検出するための専用のクロックを用い る必要がなぐ二重系の CPU41 , 42のために使用しているクロック 48, 49をそのま ま利用してクロック異常を検出することができ、効率的なハードウェア資源の利用が 可能になる。従って、簡単な回路構成で信頼性を向上させることができる。  [0070] With this configuration, the clocks 48 and 49 used for the dual CPUs 41 and 42 that do not require the use of a dedicated clock for detecting clock anomalies remain as they are. It can be used to detect clock anomalies, enabling efficient use of hardware resources. Therefore, reliability can be improved with a simple circuit configuration.
[0071] また、カウンタ 57— 60のプリセットデータ値を任意に設定できるため、クリティカルな 周波数のずれも検出することができる。これにより、安全回路部 13を駆動 *制御する までの動作遅れ時間を短縮でき、より安全性の高 、設計を実現できる。  [0071] Further, since the preset data value of the counter 57-60 can be set arbitrarily, a critical frequency shift can be detected. As a result, the operation delay time until the safety circuit unit 13 is driven and controlled can be shortened, and a design with higher safety can be realized.
[0072] さらに、 4つのカウンタ 57— 60とウォッチドッグタイマ 46, 47とを組み合わせて使用 したので、周波数が高くなる異常がクロック 48, 49のどちらに発生したかを容易に特 定できる。 [0072] In addition, since four counters 57-60 and watchdog timers 46 and 47 were used in combination, it was easy to identify which of the clocks 48 and 49 had an abnormal frequency increase. Can be determined.
[0073] 次に、クロック異常検出回路 50の健全性のチェック機能について説明する。例えば 、第 1の CPU41からクロック異常検出回路 50にテストモード信号 51が送信されると、 セレクタ 61により回路がテスト回路に切り換えられ、第 1のクロック信号が第 1遁倍回 路 62で遁倍される。即ち、第 1の被監視カウンタ 58に入力される第 1のクロック信号 が故意に異常状態にされる。このため、クロック異常検出回路 50が正常であれば、第 1の被監視カウンタ 58からエラー信号 55が出力されることになる。  Next, the soundness check function of the clock abnormality detection circuit 50 will be described. For example, when the test mode signal 51 is transmitted from the first CPU 41 to the clock abnormality detection circuit 50, the circuit is switched to the test circuit by the selector 61, and the first clock signal is multiplied by the first multiplication circuit 62. Is done. That is, the first clock signal input to the first monitored counter 58 is intentionally made abnormal. Therefore, if the clock abnormality detection circuit 50 is normal, the error signal 55 is output from the first monitored counter 58.
[0074] 従って、 CPU41では、テストモード信号 51の送信に対してエラー信号 55が受信さ れることにより、クロック異常検出回路 50の健全性を確認することができる。同様に、 第 2のクロック 49側も健全性をチェックすることができる。  Accordingly, the CPU 41 can confirm the soundness of the clock abnormality detection circuit 50 by receiving the error signal 55 in response to the transmission of the test mode signal 51. Similarly, the health of the second clock 49 can also be checked.
[0075] このようなクロック異常検出回路 50の健全性チェック機能を付加することにより、例 えばクロック異常検出回路 50の最終出力ピンが正常側に固着する等の故障を検出 することができ、信頼性をさらに向上させることができる。  [0075] By adding such a soundness check function of the clock abnormality detection circuit 50, for example, a failure such as the final output pin of the clock abnormality detection circuit 50 being fixed to the normal side can be detected. The property can be further improved.
[0076] なお、この例では、 2個の CPUを用いた二重系の回路構成を示したが、 3個以上の CPUを用いた多重系の回路構成とすることも可能である。  In this example, a dual circuit configuration using two CPUs is shown, but a multiple circuit configuration using three or more CPUs may be used.
[0077] このように、この例の電子安全コントローラ 21は、エレベータの制御に関する演算を 二重系で行う第 1及び第 2処理部、第 1処理部に第 1クロック信号を送る第 1クロック、 第 2処理部に第 2クロック信号を送る第 2クロック、及び第 1及び第 2クロック信号が入 力され、第 1及び第 2クロック信号の異常を検出するクロック異常検出回路を備え、ク ロック異常検出回路は、第 1及び第 2クロック信号のノ ルス数をカウントし、パルス数 の差から第 1及び第 2クロック信号の異常を検出する。  [0077] Thus, the electronic safety controller 21 of this example includes the first and second processing units that perform calculations related to the control of the elevator in a double system, the first clock that sends the first clock signal to the first processing unit, A second clock that sends the second clock signal to the second processing unit, and a clock abnormality detection circuit that detects an abnormality in the first and second clock signals are input, and a clock abnormality is detected. The detection circuit counts the number of pulses in the first and second clock signals, and detects an abnormality in the first and second clock signals from the difference in the number of pulses.
[0078] また、クロック異常検出回路は、第 1及び第 2クロック信号のいずれか一方のパルス 数をカウントする被監視カウンタと、第 1及び第 2クロック信号のいずれか他方のパル ス数をカウントする監視カウンタとを有し、被監視カウンタでカウントを開始する際の力 ゥント値であるプリセットデータ値は、監視カウンタでカウントを開始する際のカウント 値であるプリセットデータ値よりも大きく設定されており、監視カウンタがキャリーォー バーすると、被監視カウンタのカウント数がリセットされ、被監視カウンタがキャリーォ 一バーすることにより第 1及び第 2クロック信号の異常が検出される。 [0079] さらに、監視カウンタは、第 1クロック信号のパルス数をカウントする第 1の監視カウ ンタと、第 2クロック信号のパルス数をカウントする第 2の監視カウンタとを含み、被監 視カウンタは、第 1クロック信号のパルス数をカウントする第 1被監視カウンタと、第 2ク ロック信号のパルス数をカウントする第 2被監視カウンタとを含む。 In addition, the clock abnormality detection circuit counts the monitored counter that counts the number of pulses of either the first or second clock signal and the number of pulses of the other of the first or second clock signal. The preset data value, which is the force value when starting counting with the monitored counter, is set to be larger than the preset data value, which is the count value when starting counting with the monitoring counter. When the monitoring counter carries over, the count of the monitored counter is reset, and when the monitored counter carries over, an abnormality in the first and second clock signals is detected. [0079] Further, the monitoring counter includes a first monitoring counter that counts the number of pulses of the first clock signal and a second monitoring counter that counts the number of pulses of the second clock signal, and the monitored counter Includes a first monitored counter that counts the number of pulses of the first clock signal and a second monitored counter that counts the number of pulses of the second clock signal.
[0080] さらにまた、監視カウンタのプリセットデータ値は、任意に設定可能である。また、テ ストモードのときに、被監視カウンタに入力されるクロック信号を故意に異常状態とす ることにより、クロック異常検出回路の健全性を確認することが可能になっている。さら に、クロック異常検出回路は、テストモードのときに被監視カウンタに入力されるクロッ ク信号を遁倍する遁倍回路を有する。  Furthermore, the preset data value of the monitoring counter can be arbitrarily set. In the test mode, it is possible to check the soundness of the clock error detection circuit by intentionally setting the clock signal input to the monitored counter to an abnormal state. In addition, the clock abnormality detection circuit has a multiplication circuit for multiplying the clock signal input to the monitored counter in the test mode.
[0081] 《スタック領域の異常検出〉〉  [0081] << Abnormality detection of stack area >>
次に、電子安全コントローラ 21に用いられる RAM内のスタック領域の異常検出に ついて説明する。図 8は図 1の電子安全コントローラ 21の RAM内の領域区分を示す 説明図である。 RAMは、 CPUによる演算に必要な情報を記憶するスタック領域を含 んでいる。スタック領域には、例えばサブルーチンコールの戻りアドレス、タイマ割り 込みの戻りアドレス、及びサブルーチンコールの引数等が格納される。  Next, abnormality detection of the stack area in the RAM used for the electronic safety controller 21 will be described. FIG. 8 is an explanatory diagram showing an area division in the RAM of the electronic safety controller 21 of FIG. The RAM includes a stack area that stores information necessary for computation by the CPU. In the stack area, for example, a subroutine call return address, a timer interrupt return address, and a subroutine call argument are stored.
[0082] また、 ROMには、 RAMのスタック領域内の予め設定された監視領域の状態を監 視するためのプログラムが格納されている。即ち、スタック領域監視部は、 CPU及び ROMを有している。  In addition, the ROM stores a program for monitoring the state of a preset monitoring area in the RAM stack area. That is, the stack area monitoring unit has a CPU and a ROM.
[0083] この例では、 COOOH— FFFFHの領域がスタック領域に設定されて!、る。また、ス タック領域内の DOOOH— D010Hの領域が監視領域に設定されている。  [0083] In this example, the COOOH—FFFFH area is set as the stack area! In addition, the DOOOH-D010H area in the stack area is set as the monitoring area.
[0084] スタック領域の使用方法はマイコンによって決まる力 一般的にはマイコンが持つス タックポインタにより、アドレスの若い方へデータを積み上げていく使い方をする。図 8 の場合、スタックポインタの初期値を FFFFHとし、 FFFFH→FFFEH→FFFDH→ C001H→COOOHのように使用する。従って、監視領域 DOOOH— D010Hは [0084] The power used by the stack area is determined by the microcomputer. In general, the stack pointer of the microcomputer is used to accumulate data to the younger address. In the case of Figure 8, the initial value of the stack pointer is set to FFFFH, and used as FFFFH → FFFEH → FFFDH → C001H → COOOH. Therefore, the monitoring area DOOOH—D010H
、スタック領域の 75%を使用したときに使用される領域である。 This is the area used when 75% of the stack area is used.
[0085] 監視領域の位置は、スタック領域の 50%以上を使用したときに使用される領域が 好ましい。特に、スタック領域の 60%以上を使用したときに使用される領域が好まし い。また、監視領域の位置は、スタック領域の 90%以下を使用したときに使用される 領域が好ましい。特に、スタック領域の 80%以下を使用したときに使用される領域が 好ましい。 [0085] The position of the monitoring area is preferably an area used when 50% or more of the stack area is used. In particular, the area used when 60% or more of the stack area is used is preferable. The monitoring area is used when 90% or less of the stack area is used. A region is preferred. In particular, the area used when 80% or less of the stack area is used is preferable.
[0086] スタック領域は予め 0に設定されており、スタック領域監視部は、監視領域全体が 0 であるかどうかを監視する。そして、監視領域に 0以外のデータが含まれていると、ス タックオーバーが発生したと判断する。  [0086] The stack area is set to 0 in advance, and the stack area monitoring unit monitors whether the entire monitoring area is 0 or not. If the monitoring area contains data other than 0, it is determined that a stackover has occurred.
[0087] 図 9は図 1の電子安全コントローラ 21の初期動作を示すフローチャートである。エレ ベータ起動時には、電子安全コントローラ 21の初期設定が実施される。初期設定が 開始された時点では、全ての割り込み演算が禁止される (ステップ Sl)。この後、マイ コンの初期設定が行われ (ステップ S 2)、 RAM領域が 0にされる（ステップ S3)。この 後、割り込み演算が可能な状態となり (ステップ S4)、割り込み待ち状態となる (ステツ プ S5)。割り込み演算は、演算周期時間毎に繰り返し実行される。  FIG. 9 is a flowchart showing an initial operation of the electronic safety controller 21 of FIG. When the elevator is started, the electronic safety controller 21 is initialized. At the start of initialization, all interrupt operations are disabled (step Sl). Thereafter, the microcomputer is initialized (step S2), and the RAM area is set to 0 (step S3). After this, the interrupt operation is enabled (step S4) and the interrupt wait state is entered (step S5). The interrupt calculation is repeatedly executed every calculation cycle time.
[0088] 図 10は図 1の電子安全コントローラ 21の割り込み演算の流れの第 1例を示すフロ 一チャートである。割り込み演算が開始されると、まず監視領域の状態が確認される（ ステップ S31)。即ち、監視領域 DOOOH— D010Hの状態力OOOOHであるかどうか が確認される。  FIG. 10 is a flowchart showing a first example of the interrupt calculation flow of the electronic safety controller 21 of FIG. When the interrupt calculation is started, the state of the monitoring area is first confirmed (step S31). That is, it is confirmed whether or not the monitoring area DOOOH-D010H has the state power OOOO.
[0089] ここで、監視領域が OOOOHでな!/、場合、 RAMにスタックオーバーが発生して!/、る 力 又はスタックオーバーに陥る可能性が高いと判断される。即ち、監視領域の値が 0以外であるということは、割り込み演算の処理時間に余裕がなぐ割り込み演算が演 算周期時間内に終わらずにスタックオーバーが発生して 、ると判断される。このように 、スタックオーバーが検出されると、力ご 3を急停止させるための演算が実行され (ス テツプ S32)、非常停止指令が安全回路部 13に出力される。また、スタックオーバー が検出された場合、エレベータ監視室に異常検出信号が送信される。  [0089] Here, if the monitoring area is OOOOH! /, It is determined that there is a high possibility that the RAM will have a stack over! In other words, if the value of the monitoring area is other than 0, it is determined that an interrupt operation that does not have enough time for the interrupt operation processing time does not end within the operation cycle time and a stack over occurs. Thus, when a stack over is detected, a calculation for suddenly stopping the force 3 is executed (step S32), and an emergency stop command is output to the safety circuit unit 13. When a stack over is detected, an abnormality detection signal is transmitted to the elevator monitoring room.
[0090] 監視領域に異常がなければ、演算に必要な信号を入力する入力演算が行われ (ス テツプ S33)、カゝご 3の現在位置と現在位置カゝら終端階までの距離とを求めるかご位 置演算 (ステップ S34)、かご 3の移動量力 かご 3の速度を求めるかご速度演算 (ス テツプ S35)、及び終端階までの距離に応じた異常速度の判断基準値 (例えば図 2) を求める判断基準演算 (ステップ S36)が実行される。  [0090] If there is no abnormality in the monitoring area, an input calculation for inputting a signal necessary for the calculation is performed (step S33), and the current position of the car 3 and the distance from the current position to the terminal floor are calculated. Car position calculation (step S34), Car 3 travel force Car speed calculation to find the speed of car 3 (step S35), and abnormal speed judgment reference value according to the distance to the end floor (for example, Fig. 2) Judgment criterion calculation (step S36) is calculated.
[0091] この後、かご速度と判断基準値とから力ご速度の異常を検出するための安全監視 演算が実行される (ステップ S37)。安全監視演算又は急停止演算が実行されると、 エレベータの状態をモニタ表示するためのモニタ演算が実行される (ステップ S38)。 最後に、力ご 3の走行を許可、又は力ご 3を急停止させるために必要な指令信号を出 力するための出力演算が実行される (ステップ S39)。 [0091] After this, safety monitoring for detecting an abnormal force speed from the car speed and the criterion value The calculation is executed (step S37). When the safety monitoring calculation or the sudden stop calculation is executed, a monitor calculation for monitoring and displaying the state of the elevator is executed (step S38). Finally, an output calculation for outputting a command signal necessary for permitting the travel of the force 3 or for suddenly stopping the force 3 is executed (step S39).
[0092] このような電子安全コントローラ 21では、スタック領域監視部により監視領域の状態 が監視されており、監視領域に異常があると判断されたときに、カゝご 3が急停止される ので、 RAMのスタックオーバーによりプログラム暴走が生じるのが防止される。これに より、機器の破損が未然に防止される。即ち、コンピュータによる運転制御に関する 演算をより確実に実行することができ、信頼性を向上させることができる。  [0092] In such an electronic safety controller 21, the status of the monitoring area is monitored by the stack area monitoring unit, and when it is determined that there is an abnormality in the monitoring area, the car 3 is suddenly stopped. Program runaway due to RAM stack over is prevented. This prevents damage to the equipment. That is, the calculation related to the operation control by the computer can be executed more reliably, and the reliability can be improved.
[0093] ここで、スタックオーバー (スタックの積み上げ）による異常は、原因究明が難しぐ 故障復旧に時間が力かってしまう。スタックオーバーは、マイコンやプログラムの異常 により発生することもあるが、これらに異常がなければ、スタックオーバーの一番の要 因は、割り込み演算が演算周期時間内に終わらないこと (演算時間オーバー)である と考えられる。  [0093] Here, it is difficult to investigate the cause of an abnormality caused by stack over (stack stacking). It takes time to recover from a failure. Stackover may occur due to an abnormality in the microcomputer or program, but if these are not abnormal, the primary cause of stackover is that the interrupt operation does not end within the operation cycle time (operation time over) It is thought that.
[0094] 演算時間オーバーは、通常は発生しないが、例えば呼び釦が多く操作され呼びス キャン演算に長時間を要する場合など、一時的に演算時間が増えることにより発生 する。また、ソフトウェアの改造や改善等を繰り返すうちに演算時間が徐々に増え、 演算時間オーバーが発生することも考えられる。  [0094] Although the computation time overtime does not normally occur, it occurs when the computation time temporarily increases, for example, when many call buttons are operated and a long time is required for the call scan computation. It is also possible that the computation time will gradually increase as the software is remodeled or improved, resulting in an overtime.
[0095] 演算時間オーバーが発生すると、スタックオーバーが発生して、スタック領域が不 正に使用され、タイマ割り込み力もの戻りアドレスが壊れる恐れがある。戻りアドレスが 壊れると、プログラム暴走が生じたり、 RAMデータが破壊されてエレベータの制御が 不能になったりする恐れがある。 When the computation time is over, a stack over occurs, the stack area is used improperly, and there is a possibility that the return address of the timer interrupt power may be destroyed. If the return address is broken, program runaway may occur, RAM data may be destroyed, and elevator control may become impossible.
[0096] これに対して、この例の電子安全コントローラ 21によれば、スタックオーバーをより 早期に検出することができ、プログラム暴走や制御不能の発生を未然に防止すること ができ、信頼性が向上する。 [0096] On the other hand, according to the electronic safety controller 21 of this example, stackover can be detected earlier, program runaway and control failure can be prevented, and reliability can be improved. improves.
[0097] また、スタック領域監視部は、予め設定された演算周期毎に監視領域の状態を確 認するので、スタックオーバーの有無を常時監視することができ、信頼性をさらに向 上させることができる。 [0098] さらに、監視領域に異常があると判断されたときには、力ご 3を急停止させるので、 より大きな故障にながるのを防止することができる。 [0097] Further, since the stack area monitoring unit checks the state of the monitoring area at every preset calculation cycle, it is possible to constantly monitor the presence or absence of a stack over and further improve the reliability. it can. [0098] Further, when it is determined that there is an abnormality in the monitoring area, the force 3 is stopped suddenly, so that a larger failure can be prevented.
[0099] なお、上記の例では、監視領域の異常が検出されるとかご 3を急停止させた力 最 寄り階停止指令を運転制御部 12に出力して力ご 3を最寄り階に停止させてもよぐか ご 3内の乗客をスムーズに乗場に降ろすことができる。  [0099] In the above example, when an abnormality in the monitoring area is detected, a force closest floor stop command that suddenly stops the car 3 is output to the operation control unit 12 to stop the force 3 to the nearest floor. It is possible to smoothly drop passengers in the car 3 to the landing.
[0100] また、監視領域の異常が検出されたとき、エレベータを安全な状態に移行させるた めの信号を出力するとともに、そのときの電子安全コントローラ 21の状態を履歴として 記録 (履歴演算）してもよい。履歴は、例えば RAMのスタック領域以外の領域に記録 される。これにより、スタックオーバーの発生を未然に防止したり、スタックオーバーの 原因究明に役立てたりすることができる。また、故障復旧時間の短縮を図ることができ る。  [0100] When an abnormality in the monitoring area is detected, a signal for shifting the elevator to a safe state is output, and the state of the electronic safety controller 21 at that time is recorded as a history (history calculation). May be. The history is recorded in an area other than the RAM stack area, for example. As a result, it is possible to prevent the occurrence of a stack over, or to investigate the cause of the stack over. In addition, failure recovery time can be shortened.
[0101] このように、この例における電子安全コントローラ 21は、エレベータの安全を監視す るための演算に必要な情報を記憶するスタック領域が設定されて 、る RAM、及びス タック領域内の予め設定された監視領域の状態を監視するスタック領域監視部を備 え、スタック領域監視部により検出された監視領域の状態に応じてエレベータの運転 を制御する。  As described above, the electronic safety controller 21 in this example has a stack area for storing information necessary for the operation for monitoring the safety of the elevator, the RAM in the stack area, and the stack area in advance. A stack area monitoring unit that monitors the state of the set monitoring area is provided, and the operation of the elevator is controlled according to the state of the monitoring area detected by the stack area monitoring unit.
[0102] また、スタック領域監視部は、所定の演算周期毎に監視領域の状態を確認する。さ らに、監視領域の状態の確認は、エレベータの安全を監視するための割り込み演算 処理の一部として実行される。  [0102] Further, the stack area monitoring unit confirms the state of the monitoring area every predetermined calculation cycle. In addition, confirmation of the status of the monitoring area is performed as part of the interrupt calculation process for monitoring the safety of the elevator.
[0103] 《演算処理実行順序の異常検出〉〉  [0103] << Abnormality detection of operation execution order >>
次に、電子安全コントローラ 21における演算処理の実行順序の異常検出方法につ いて説明する。図 11は図 1の電子安全コントローラ 21による割り込み演算の流れの 第 2例を示すフローチャートである。  Next, a method for detecting an abnormality in the execution order of arithmetic processing in the electronic safety controller 21 will be described. FIG. 11 is a flowchart showing a second example of the flow of interrupt calculation by the electronic safety controller 21 of FIG.
[0104] 割り込み演算が開始されると、まず RAMに書き込まれた処理情報のパターンが確 認される (ステップ S41)。ここでは、処理情報として、演算処理のタスク (機能単位)毎 に予め設定された数値 (識別値）が用いられる。処理情報は、 RAM内の予め決めら れた領域に設定されたテーブルに書き込まれる。この例では、 7つの演算処理に対し て 1一 7の識別値が割り振られており、対応する TBL[0]— [6]に識別値が書き込ま れている。 TBL[7]— [9]は、対応する演算処理が存在しないため、 0のままである。 [0104] When the interrupt calculation is started, the pattern of the processing information written in the RAM is first confirmed (step S41). Here, a numerical value (identification value) set in advance for each operation processing task (functional unit) is used as the processing information. The processing information is written in a table set in a predetermined area in the RAM. In this example, seven identification values are assigned to seven arithmetic processes, and the identification value is written to the corresponding TBL [0] — [6]. It is. TBL [7] — [9] remains 0 because there is no corresponding operation.
[0105] 処理情報のパターンが正常であれば、 TBL[0]— [9]及びテーブルの格納ポイン タが 0に初期化される (ステップ S42)。この後、演算に必要な信号を入力する入力演 算 (ステップ S43)、力ごの現在位置と現在位置から終端階までの距離とを求めるか ご位置演算 (ステップ S44)、力ごの移動量力もかごの速度を求めるかご速度演算 (ス テツプ S45)、及び終端階までの距離に応じた異常速度の判断基準値 (例えば図 2) を求める判断基準演算 (ステップ S46)が実行される。 [0105] If the pattern of the processing information is normal, TBL [0] — [9] and the table storage pointer are initialized to 0 (step S42). After this, input calculation (Step S43) for inputting the signals necessary for the calculation, car position calculation (Step S44) for determining the current position of the force and the distance from the current position to the final floor, A car speed calculation (step S45) for determining the speed of the car and a determination reference calculation (step S46) for determining a determination reference value of the abnormal speed (for example, Fig. 2) according to the distance to the terminal floor are executed.
[0106] この後、かご速度と判断基準値とから力ご速度の異常を検出するための安全監視 演算が実行される (ステップ S47)。安全監視演算又は急停止演算が実行されると、 エレベータの状態をモニタ表示するためのモニタ演算が実行される (ステップ S48)。 最後に、安全監視演算の結果に応じて、力ごの走行を許可、又は力ごを急停止させ るために必要な指令信号を出力するための出力演算が実行される (ステップ S49)。 [0106] Thereafter, a safety monitoring calculation is performed to detect an abnormality in the force speed from the car speed and the judgment reference value (step S47). When the safety monitoring calculation or the sudden stop calculation is executed, the monitor calculation for monitoring and displaying the elevator state is executed (step S48). Finally, an output calculation for outputting a command signal necessary for permitting the travel of the force or for suddenly stopping the force is executed according to the result of the safety monitoring calculation (step S49).
[0107] また、それぞれの演算が実行された直後には、対応するテーブルへの識別値の書 き込みが実行される (ステップ S50— 56)。即ち、演算処理と識別値の書き込みとは 交互に実行される。 [0107] Immediately after each operation is performed, the identification value is written to the corresponding table (steps S50-56). That is, calculation processing and identification value writing are executed alternately.
[0108] 具体的には、最初の演算である入力演算が実行された直後には、 TBL[P]に 1が 書き込まれ、格納ポインタ Pに 1がプラスされる (ステップ S 15)。次に、かご位置演算 が実行された直後には、 TBL[P]に 2が書き込まれ、格納ポインタ Pに 1がプラスされ る (ステップ S16)。このような処理が順次実行され、最後の演算である出力演算が実 行された直後には、 TBL[6]に 7が書き込まれる。  [0108] Specifically, immediately after the first input operation is executed, 1 is written to TBL [P], and 1 is added to the storage pointer P (step S15). Next, immediately after the car position calculation is executed, 2 is written to TBL [P], and 1 is added to the storage pointer P (step S16). These processes are executed sequentially, and immediately after the last output operation is executed, 7 is written to TBL [6].
[0109] このように書き込まれた識別値のパターンは、次の割り込み演算の開始時に確認さ れる (ステップ S41)。即ち、識別値のパターンを確認することにより、演算処理の実 行順序が正常であるかどうかが判断される。  The pattern of the identification value written in this way is confirmed at the start of the next interrupt calculation (step S41). In other words, by confirming the pattern of the identification value, it is determined whether or not the execution order of the arithmetic processing is normal.
[0110] 演算処理の実行順序に異常が検出されると、力ごを急停止させるための急停止演 算が実行される (ステップ S57)。また、演算処理の実行順序に異常が検出された場 合、エレベータ監視室に異常検出信号が送信される。急停止演算が実行されると、 モニタ演算が実行され (ステップ S58)、かごを急停止させるために必要な指令信号 を出力するための出力演算が実行され (ステップ S59)、割り込み演算処理が終了す る。 [0110] When an abnormality is detected in the execution order of the arithmetic processing, a sudden stop operation for suddenly stopping the force is executed (step S57). In addition, when an abnormality is detected in the execution order of the arithmetic processing, an abnormality detection signal is transmitted to the elevator monitoring room. When the sudden stop calculation is executed, the monitor calculation is executed (step S58), the output calculation for outputting the command signal necessary to stop the car suddenly is executed (step S59), and the interrupt calculation processing is completed. You The
[0111] このような電子安全コントローラ 21では、演算処理の実行順序の異常を速やかに検 出することができ、これによりコンピュータによる運転制御に関する演算をより確実に 実行することができ、信頼性を向上させることができる。また、プログラム異常で自己 ループしているような異常も検出することができる。即ち、この発明は、運転制御装置 にも安全装置にも適用できる。  [0111] With such an electronic safety controller 21, it is possible to quickly detect an abnormality in the execution order of arithmetic processing, thereby making it possible to more reliably execute arithmetic operations related to operation control by a computer, and to improve reliability. Can be improved. It can also detect abnormalities such as program loops that are self-looping. That is, the present invention can be applied to an operation control device and a safety device.
[0112] ここで、演算処理の実行順序の異常は、原因究明が難しぐ故障復旧に時間がか 力つてしまう。演算処理の実行順序の異常は、マイコンやプログラムの異常により発 生することもあるが、これらに異常がなければ、一番の要因は割り込み演算が演算周 期時間内に終わらな 、こと (演算時間オーバー)であると考えられる。  [0112] Here, if the execution order of the arithmetic processing is abnormal, it takes time to recover from a fault that is difficult to find out. An abnormality in the execution order of arithmetic processing may occur due to an abnormality in the microcomputer or program, but if there is no abnormality in these, the primary cause is that the interrupt operation does not end within the operation period time (calculation Overtime).
[0113] 演算時間オーバーは、通常は発生しないが、例えば呼び釦が多く操作され呼びス キャン演算に長時間を要する場合など、一時的に演算時間が増えることにより発生 する。また、ソフトウェアの改造や改善等を繰り返すうちに演算時間が徐々に増え、 演算時間オーバーが発生することも考えられる。  [0113] The calculation time over time does not normally occur, but occurs when the calculation time temporarily increases, for example, when many call buttons are operated and a long time is required for the call scan calculation. It is also possible that the computation time will gradually increase as the software is remodeled or improved, resulting in an overtime.
[0114] これに対して、この電子安全コントローラ 21によれば、演算処理の実行順序の異常 をより早期に検出することができ、二次的な故障の発生を未然に防止することができ 、信頼性が向上する。  [0114] On the other hand, according to this electronic safety controller 21, an abnormality in the execution order of the arithmetic processing can be detected earlier, and the occurrence of a secondary failure can be prevented in advance. Reliability is improved.
[0115] また、電子安全コントローラ 21は、予め設定された演算周期毎に処理情報のバタ ーンを確認するので、異常の有無を常時監視することができ、信頼性をさらに向上さ せることができる。  [0115] In addition, since the electronic safety controller 21 checks the pattern of the processing information every preset calculation cycle, it can always monitor the presence or absence of an abnormality, and can further improve the reliability. it can.
[0116] さらに、演算処理の実行順序に異常があると判断されたときには、かごを急停止さ せるので、より大きな故障にながるのを防止することができる。  [0116] Further, when it is determined that there is an abnormality in the execution order of the arithmetic processing, the car is suddenly stopped, so that a larger failure can be prevented.
[0117] なお、上記の例では、演算処理の実行順序に異常があると判断されたときにかご 3 を急停止させたが、最寄り階停止指令を運転制御部 12に出力して力ご 3を最寄り階 に停止させてもよぐ力ご 3内の乗客をスムーズに乗場に降ろすことができる。 [0117] In the above example, the car 3 was suddenly stopped when it was determined that there was an abnormality in the execution order of the arithmetic processing. However, the nearest floor stop command was output to the operation control unit 12 to It is possible to smoothly drop passengers in the force 3 even if they are stopped to the nearest floor.
[0118] また、演算処理の実行順序に異常が検出されたとき、エレベータを安全な状態に 移行させるための信号を出力するとともに、そのときの電子安全コントローラ 21の状 態を履歴として記録 (履歴演算）してもょ 、。 [0119] さらに、上記の例では、全ての演算処理に処理情報を割り当てた力 必ずしも全て でなくてもよい。即ち、実行順序を監視したい演算処理のみに処理情報を付与しても よい。 [0118] Further, when an abnormality is detected in the execution order of the arithmetic processing, a signal for shifting the elevator to a safe state is output, and the state of the electronic safety controller 21 at that time is recorded as a history (history (Calculation) [0119] Furthermore, in the above example, not all of the forces assigned processing information to all the arithmetic processes are necessarily required. That is, processing information may be assigned only to the arithmetic processing whose execution order is to be monitored.
[0120] このように、この例における電子安全コントローラ 21は、 RAM、及び安全監視に関 するプログラムが格納されたプログラム記憶部と、プログラムに基づ 、て複数の演算 処理を実行する処理部とを有するコントローラ本体を備え、コントローラ本体は、演算 処理を実行したときにそれぞれの演算処理に対応した処理情報を RAMに書き込む とともに、 RAMに書き込まれた処理情報のパターン力も演算処理の実行順序が正常 であるかどうかを監視する。  [0120] As described above, the electronic safety controller 21 in this example includes the RAM and a program storage unit that stores a program related to safety monitoring, and a processing unit that executes a plurality of arithmetic processes based on the program. The controller main unit writes processing information corresponding to each arithmetic processing to the RAM when the arithmetic processing is executed, and the pattern power of the processing information written in the RAM is normal in the execution order of the arithmetic processing. Monitor whether it is.
[0121] また、処理情報は、演算処理毎に予め設定された数値である。さらに、制御装置本 体は、所定の演算周期毎に処理情報のパターンを確認する。さらにまた、処理情報 の書き込み、及び処理情報のパターンの確認は、エレベータの安全を監視するため の割り込み演算処理の一部として実行される。  [0121] Further, the processing information is a numerical value preset for each arithmetic processing. Furthermore, the control device itself confirms the pattern of the processing information every predetermined calculation cycle. Furthermore, the writing of processing information and the confirmation of the pattern of processing information are executed as part of an interrupt calculation process for monitoring the safety of the elevator.
[0122] 《電源電圧の異常検出》  [0122] <Power supply voltage error detection>
次に、電子安全コントローラ 21における電源電圧の異常検出方法について説明す る。図 12は図 1の電子安全コントローラ 21の要部を示すブロック図である。この例で は、信頼性を向上させるため 2系統の指令信号がエレベータ制御盤 11に出力される 。このため、二重系の回路構成が採用されており、第 1及び第 2の CPU (処理部) 41 , 42が用いられている。  Next, a method for detecting a power supply voltage abnormality in the electronic safety controller 21 will be described. FIG. 12 is a block diagram showing a main part of the electronic safety controller 21 of FIG. In this example, two command signals are output to the elevator control panel 11 in order to improve reliability. For this reason, a dual circuit configuration is employed, and first and second CPUs (processing units) 41 and 42 are used.
[0123] 第 1の CPU41は、第 1の出力インタフェース 43を介してエレベータ制御盤 11に指 令信号を出力する。第 2の CPU42は、第 2の出力インタフェース 44を介してエレべ ータ制御盤 11に指令信号を出力する。エレベータ制御盤 11は、第 1及び第 2の出力 インタフェース 43, 44から指令信号を受けると、エレベータを安全状態へと移行させ る。  The first CPU 41 outputs an instruction signal to the elevator control panel 11 via the first output interface 43. The second CPU 42 outputs a command signal to the elevator control panel 11 via the second output interface 44. When the elevator control panel 11 receives a command signal from the first and second output interfaces 43 and 44, it shifts the elevator to a safe state.
[0124] 第 1及び第 2の CPU41, 42には、両者間のデータ授受を行うための 2ポート RAM 45が接続されている。第 1の CPU41には、第 1センサからの信号が入力される。第 2 の CPU42には、第 2センサからの信号が入力される。  [0124] The first and second CPUs 41 and 42 are connected to a two-port RAM 45 for exchanging data between them. The first CPU 41 receives a signal from the first sensor. A signal from the second sensor is input to the second CPU.
[0125] 第 1及び第 2のセンサ力 の信号は、 CPU41, 42で演算処理され、これによりかご 3の速度及び位置が求められる。第 1及び第 2のセンサとしては、例えば調速機ェン コーダ 18が挙げられる。 [0125] The signals of the first and second sensor forces are processed by the CPUs 41 and 42. 3 speeds and positions are required. Examples of the first and second sensors include a governor encoder 18.
[0126] CPU41, 42での演算処理の結果データは、 2ポート RAM45を介して CPU41, 4 2により互いに授受される。そして、 CPU41, 42では、互いの結果データとの比較が 行われ、演算結果に有意差が見られたり、過速度 (速度超過）が確認されたりした場 合には、出力インタフェース 43, 44を介してエレベータ制御盤 11に指令信号が出力 され、エレベータが安全状態へと移行される。  The result data of the arithmetic processing in the CPUs 41 and 42 is exchanged between the CPUs 41 and 42 via the 2-port RAM 45. Then, the CPUs 41 and 42 compare the result data with each other, and if there is a significant difference in the calculation result or an overspeed (overspeed) is confirmed, the output interfaces 43 and 44 are connected. The command signal is output to the elevator control panel 11 and the elevator is shifted to the safe state.
[0127] また、このエレベータ制御装置には、 CPU41, 42の電源電圧を監視する + 5V電 源電圧監視回路 71及び + 3. 3V電源電圧監視回路 72が設けられている。電源電 圧監視回路 71, 72は、例えば IC (集積回路）により構成されている。  In addition, this elevator control device is provided with a + 5V power supply voltage monitoring circuit 71 and a + 3.3V power supply voltage monitoring circuit 72 for monitoring the power supply voltages of the CPUs 41 and 42. The power supply voltage monitoring circuits 71 and 72 are configured by, for example, an IC (integrated circuit).
[0128] 電源電圧監視回路 71, 72は、安定した電源電圧が CPU41, 42に供給されている 力どうかを監視する。 CPU41, 42の定格電圧を外れるような電源電圧異常が発生し た場合、電源電圧監視回路 71, 72からの情報に基づいて CPU41, 42に強制リセッ トがかけられ、フェールセーフ勝手に設計された安全回路部 13によりかご 3が急停止 される。  [0128] The power supply voltage monitoring circuits 71 and 72 monitor whether or not a stable power supply voltage is supplied to the CPUs 41 and 42. Designed to be fail-safe because the CPU 41, 42 is forcibly reset based on information from the power supply voltage monitoring circuit 71, 72 when a power supply voltage abnormality that deviates from the rated voltage of the CPU 41, 42 occurs. Car 3 is suddenly stopped by safety circuit 13.
[0129] + 5V電源電圧監視回路 71には、第 1の監視用電圧入力回路 73から監視用電圧 が入力される。 + 3. 3V電源電圧監視回路 72には、第 2の監視用電圧入力回路 74 カゝら監視用電圧が入力される。  [0129] The + 5V power supply voltage monitoring circuit 71 receives the monitoring voltage from the first monitoring voltage input circuit 73. + 3. The 3V power supply voltage monitoring circuit 72 receives the monitoring voltage from the second monitoring voltage input circuit 74.
[0130] 電源電圧監視回路 71, 72及び CPU41, 42には、電源電圧監視回路 71, 72の健 全性を監視する電圧監視健全性チェック機能回路 75 (以下、チェック機能回路 75と 略称する）が接続されている。チェック機能回路 75は、例えば FPGA (field programmable gate array)等のプログラマブルなゲート ICで構成されている。また、チ エック機能回路 75は、 ASIC、 CPLD、 PLD又はゲートアレイ等でも実現可能である  [0130] The power supply voltage monitoring circuits 71 and 72 and the CPUs 41 and 42 have a voltage monitoring soundness check function circuit 75 for monitoring the health of the power supply voltage monitoring circuits 71 and 72 (hereinafter abbreviated as a check function circuit 75). Is connected. The check function circuit 75 includes a programmable gate IC such as an FPGA (field programmable gate array). The check function circuit 75 can also be realized by an ASIC, CPLD, PLD, or gate array.
[0131] 電源電圧の異常が検出されると、電源電圧監視回路 71, 72からチェック機能回路 75に電圧異常検出信号 81, 82が出力され、チェック機能回路 75から CPU41, 42 にリセット信号 83, 84が出力される。 [0131] When an abnormality in the power supply voltage is detected, a voltage abnormality detection signal 81, 82 is output from the power supply voltage monitoring circuit 71, 72 to the check function circuit 75, and a reset signal 83, is output from the check function circuit 75 to the CPU 41, 42. 84 is output.
[0132] また、チェック機能回路 75には、 CPU41, 42からの制御信号 85, 86が入力される 。チェック機能回路 75からは、電源電圧監視回路 71, 72の電圧入力ピンを低電圧 に強制的に変更させるための監視用入力電圧強制変更信号 87, 88が出力される。 [0132] In addition, control signals 85 and 86 from the CPUs 41 and 42 are input to the check function circuit 75. . The check function circuit 75 outputs monitoring input voltage forced change signals 87 and 88 for forcibly changing the voltage input pins of the power supply voltage monitoring circuits 71 and 72 to a low voltage.
[0133] 監視用入力電圧強制変更信号 87, 88が出力されると、監視用入力電圧強制変更 回路 76, 77により、電源電圧監視回路 71, 72の電圧入力ピンが低電圧に強制的に 落とされる。 [0133] When the monitoring input voltage forced change signals 87 and 88 are output, the voltage input pins of the power supply voltage monitoring circuits 71 and 72 are forcibly dropped to a low voltage by the monitoring input voltage forced change circuits 76 and 77. It is.
[0134] また、チェック機能回路 75は、第 1の CPU41用の第 1データバス 78と、第 2の CPU 42用の第 2データバス 79とに接続されている。  In addition, the check function circuit 75 is connected to the first data bus 78 for the first CPU 41 and the second data bus 79 for the second CPU 42.
[0135] なお、かご 3の位置及び速度を求めるためのプログラム、エレベータの異常を判定 するためのプログラム、及び電源電圧監視回路 71, 72の健全性を確認するための プログラム等は、 CPU41, 42に接続された記憶部である ROMに格納されている。  [0135] A program for determining the position and speed of the car 3, a program for determining an elevator abnormality, a program for checking the soundness of the power supply voltage monitoring circuits 71 and 72, and the like are CPU41, 42. It is stored in the ROM that is a storage unit connected to the.
[0136] 図 13は図 12のチェック機能回路 75の具体的な構成の一例を示す回路図である。  FIG. 13 is a circuit diagram showing an example of a specific configuration of the check function circuit 75 of FIG.
制御信号 85, 86には、選択信号 89, 90、出力許信号 91, 92、及びチップセレクト 信号 93, 94が含まれている。  The control signals 85 and 86 include selection signals 89 and 90, output permission signals 91 and 92, and chip select signals 93 and 94.
[0137] 選択信号 89, 90は、どちらの電源電圧監視回路 71, 72の健全性をチェックするか を選択するための 2ビットの信号である。出力許可信号 91, 92は、チェック機能回路 75からの監視用入力電圧強制変更信号 87, 88の出力を許可するとともに、選択信 号 89, 90で選択された内容をラッチするための信号である。即ち、出力許可信号 91 , 92は、ラッチトリガ信号を兼ねている。  [0137] The selection signals 89 and 90 are 2-bit signals for selecting which power supply voltage monitoring circuit 71 or 72 is checked for soundness. The output enable signals 91 and 92 are signals for permitting the output of the monitoring input voltage forced change signals 87 and 88 from the check function circuit 75 and latching the contents selected by the selection signals 89 and 90. . That is, the output permission signals 91 and 92 also serve as a latch trigger signal.
[0138] 電源電圧の異常が検出されると、チェック機能回路 75内の電圧異常信号ラッチ回 路 101により電圧異常検出信号 81, 82がラッチされる。電圧異常信号ラッチ回路 10 1でのラッチ状態は、制御信号 85, 86の一部であるラッチ解除信号 95, 96が入力さ れること〖こより解除される。  When a power supply voltage abnormality is detected, voltage abnormality detection signals 81 and 82 are latched by voltage abnormality signal latch circuit 101 in check function circuit 75. The latched state in the voltage abnormality signal latch circuit 101 is released from the fact that the latch release signals 95 and 96 which are part of the control signals 85 and 86 are input.
[0139] 選択信号 89, 90は、第 1及び第 2のセレクタ 102, 103に入力される。第 1及び第 2 のセレクタ 102, 103は、選択信号 89, 90に基づいて、どちらの電源電圧監視回路 7 1, 72の健全性をチェックするかを切り換える。セレクタ 102, 103で選択された内容 は、第 1及び第 2の選択内容ラッチ回路 104, 105によりラッチされる。  The selection signals 89 and 90 are input to the first and second selectors 102 and 103. The first and second selectors 102 and 103 switch which power supply voltage monitoring circuit 71 or 72 is to be checked based on the selection signals 89 and 90. The contents selected by the selectors 102 and 103 are latched by the first and second selection contents latch circuits 104 and 105.
[0140] 監視用入力電圧強制変更信号 87, 88の出力の前段には、変更信号出力バッファ 106が入れられている。 [0141] また、チェック機能回路 75には、第 1の CPU41の複数のデータバス出力バッファ 1 07と、第 2の CPU42の複数のデータバス出力バッファ 108とが設けられている。 A change signal output buffer 106 is placed in the preceding stage of the output of the monitoring input voltage forced change signals 87 and 88. [0141] Further, the check function circuit 75 is provided with a plurality of data bus output buffers 107 of the first CPU 41 and a plurality of data bus output buffers 108 of the second CPU 42.
[0142] ここで、図 14は図 12のチェック機能回路 75を第 1及び第 2の CPU41, 42がリード したときのデータバス 78, 79の各ビットに関するデータの意味を示す説明図である。  Here, FIG. 14 is an explanatory diagram showing the meaning of data regarding each bit of the data buses 78 and 79 when the first and second CPUs 41 and 42 read the check function circuit 75 of FIG.
[0143] 次に、図 15は図 12の第 1の CPU41側の電源電圧監視健全性チェック方法を示す フローチャートである。電子安全コントローラ 21は、かご 3の過速度等のエレベータの 異常監視のための演算処理を含む割り込み演算を演算周期 (例えば 5msec)毎に 実行する。そして、割り込み演算のメインルーチンを実行した際、電源電圧監視回路 71, 72の健全性チェックを実施するかどうかを判断する (ステップ S 11)。  Next, FIG. 15 is a flowchart showing a power supply voltage monitoring soundness check method on the first CPU 41 side in FIG. The electronic safety controller 21 executes an interrupt calculation including an arithmetic process for monitoring an abnormality of the elevator such as an overspeed of the car 3 every calculation cycle (for example, 5 msec). Then, when the interrupt calculation main routine is executed, it is determined whether or not to perform the soundness check of the power supply voltage monitoring circuits 71 and 72 (step S11).
[0144] 健全性チェックは、予め設定されたタイミングで実施される。即ち、健全性チェック は、力ご 3の停止状態が予め設定された時間経過したときに実施される。具体的には 、利用客の少ない閑散時や夜間運転休止時等に実施される。  [0144] The soundness check is performed at a preset timing. In other words, the soundness check is performed when the pre-set time has elapsed for the force 3 stop state. Specifically, it is implemented when there are few passengers or when there is no night operation.
[0145] 健全性チェックを実施しなければ、メインルーチンに戻る。健全性チェックを実施す る場合、まずチェック機能回路 75内のエラー信号である電圧異常検出信号 81, 82 のラッチ状態を解除する。即ち、チェック機能回路 75ヘラツチ解除信号 95を出力す る (ステップ S12)。ラッチ解除信号 95は、電圧異常信号ラッチ回路 101に入力され、 電圧異常検出信号 81, 82のラッチ状態が解除される。  [0145] If the sanity check is not performed, the process returns to the main routine. When performing a soundness check, the latch state of the voltage abnormality detection signals 81 and 82, which are error signals in the check function circuit 75, is first released. That is, the check function circuit 75 generates a latch release signal 95 (step S12). The latch release signal 95 is input to the voltage abnormality signal latch circuit 101, and the latch state of the voltage abnormality detection signals 81 and 82 is released.
[0146] 次に、第 1の CPU41の出力許可信号 91が Highになっていることを確認の上 (ステ ップ S13)、第 2の CPU42に対しても出力許可信号 92を Highにするように 2ポート R AM45を介して要求する（ステップ S 14)。  [0146] Next, after confirming that the output enable signal 91 of the first CPU 41 is High (step S13), the output enable signal 92 is also set to High for the second CPU 42. Request through 2-port RAM45 (step S14).
[0147] この後、どちらの電源電圧監視回路 71, 72の健全性チェックを行うかを選択するセ レクト信号 89をチヱック機能回路 75へ出力しラッチする (ステップ S15)。  Thereafter, the select signal 89 for selecting which of the power supply voltage monitoring circuits 71 and 72 is to be checked for soundness is output to the check function circuit 75 and latched (step S15).
[0148] 続いて、第 2の CPU42に対して出力許可信号 92を Lowにするように 2ポート RAM 45を介して要求する (ステップ S6)。出力許可信号 92が Lowになったことが確認され たら、出力許可信号 91を Lowにする (ステップ S7)。これにより、チェック機能回路 75 内では、出力許可信号 91の立ち下がりに同期して、セレクト信号 89が選択内容ラッ チ回路 104によりラッチされる。そして、チェック機能回路 75から電源電圧監視回路 7 1へ監視用入力電圧強制変更信号 87が出力される。 [0149] この結果、電源電圧監視回路 71では電圧異常が検出され、電圧異常検出信号 81 がチェック機能回路 75に入力されることになる。そして、チェック機能回路 75内では 、電圧異常信号ラッチ回路 101により電圧異常検出信号 81がラッチされる。これとと もに、 CPU41, 42には、チェック機能回路 75からのリセット信号 83, 84が入力され（ ステップ S8)、これにより CPU41, 42力 Sリセットする。 [0148] Subsequently, the second CPU 42 is requested through the 2-port RAM 45 to set the output permission signal 92 to Low (step S6). When it is confirmed that the output enable signal 92 has become low, the output enable signal 91 is set to low (step S7). As a result, in the check function circuit 75, the select signal 89 is latched by the selection content latch circuit 104 in synchronization with the fall of the output permission signal 91. Then, a monitoring input voltage forced change signal 87 is output from the check function circuit 75 to the power supply voltage monitoring circuit 71. As a result, the power supply voltage monitoring circuit 71 detects a voltage abnormality, and the voltage abnormality detection signal 81 is input to the check function circuit 75. In the check function circuit 75, the voltage abnormality detection signal 81 is latched by the voltage abnormality signal latch circuit 101. At the same time, reset signals 83 and 84 from the check function circuit 75 are input to the CPUs 41 and 42 (step S8), thereby resetting the CPU 41 and 42 force S.
[0150] このとき、 1回の健全性チェック動作でチェックする電源電圧監視回路は必ず 1つだ けである。引き続き他の電源電圧監視回路の健全性チェックを実施する場合には、 1 つの電源電圧監視回路のチェックが終了してから、他の電源電圧監視回路の健全 性チェックを実施する。 1つの CPUに複数の電圧の異なる複数の電源が供給され、 それに伴 、複数の電源電圧監視回路が設けられて!/、る場合も、各電源電圧監視回 路の健全性チェックをシーケンシャルに 1つずつ実施する。このように、複数の電源 電圧監視回路の健全性チェックをシーケンシャルに実施することは、プログラム (ソフ トウエア）上に予め設定しておくことができる。  [0150] At this time, only one power supply voltage monitoring circuit is checked in one sanity check operation. When the soundness check of another power supply voltage monitoring circuit is continued, the soundness check of another power supply voltage monitoring circuit is performed after the check of one power supply voltage monitoring circuit is completed. Even when multiple power supplies with different voltages are supplied to a single CPU, and multiple power supply voltage monitoring circuits are provided along with it, the health check of each power supply voltage monitoring circuit is performed sequentially. Carry out one by one. In this way, it is possible to set in advance on a program (software) that the soundness check of a plurality of power supply voltage monitoring circuits is sequentially performed.
[0151] 図 16は図 12のエレベータ制御装置において CPU41, 42がリセットされた場合の 動作を示すフローチャートである。 CPU41, 42のリセットの原因は、勿論、健全性チ エックによるものだけではなぐ真の電源電圧の異常やその他の理由による可能性も ある。  FIG. 16 is a flowchart showing the operation when the CPUs 41 and 42 are reset in the elevator control device of FIG. The cause of the resetting of the CPUs 41 and 42 may, of course, be due to an abnormality in the true power supply voltage and other reasons, not just due to the soundness check.
[0152] リセット力 、けられると、 CPU41, 42は、まずソフトウェアのイニシャライズ処理を開 始する (ステップ S19)。次に、イニシャライズ処理の中で、チェック機能回路 75のデ ータをリードする (ステップ S20)。そして、ラッチされている内容力もリセットされる前の 状況を確認し、電源電圧の異常や電源電圧監視回路 71, 72の故障があるかどうか を判断する (ステップ S21)。即ち、そのリセットが健全性チェックのために起きたもの なのか、真の電源電圧異常により起きたものなのかを判断する。  [0152] When the reset force is released, the CPUs 41 and 42 first start a software initialization process (step S19). Next, the data of the check function circuit 75 is read during the initialization process (step S20). Then, the state before the latched contents are reset is checked to determine whether there is an abnormality in the power supply voltage or a failure in the power supply voltage monitoring circuits 71 and 72 (step S21). In other words, it is determined whether the reset has occurred due to a soundness check or has occurred due to a true power supply voltage abnormality.
[0153] 例えば、出力許可信号 91, 92の出力を Lowにしていないのに、電圧異常が示され ていれば、真の電源電圧異常が発生したと判断される。また、出力許可信号 91, 92 の出力を Lowにしたにも拘わらず、チェック機能回路 75のデータでは電圧異常が示 されていない場合、電源電圧監視回路 71, 72又はチェック機能回路 75自体の故障 であると判断される。この状態で、監視用入力電圧強制変更信号 87, 88が出力され ていれば、電源電圧監視回路 71, 72の故障であると判断され、監視用入力電圧強 制変更信号 87, 88が出力されていなければ、チェック機能回路 75自体の故障であ ると判断される。 [0153] For example, if a voltage abnormality is indicated even though the output permission signals 91 and 92 are not set to Low, it is determined that a true power supply voltage abnormality has occurred. If the voltage of the check function circuit 75 does not indicate a voltage abnormality even though the output of the output enable signals 91 and 92 is set to Low, the power supply voltage monitoring circuits 71 and 72 or the check function circuit 75 itself is faulty. It is judged that. In this state, monitoring input voltage forced change signals 87 and 88 are output. If it is determined that the power supply voltage monitoring circuits 71 and 72 are faulty, and if the monitoring input voltage forcing change signals 87 and 88 are not output, it is determined that the check function circuit 75 itself is faulty. The
[0154] チェック機能回路 75のデータリードの結果、異常や故障が検出されなければ、メイ ンルーチンへの移行を許可する (ステップ S22)。但し、ここでは電源電圧に関するリ セットについてのみ述べている力、他の故障検出や他の回路の健全性チェックにより リセットをかけるようにしてもよぐその場合には、全ての異常'故障がないことを確認し た上でメインルーチンへの移行が許可されることになる。  [0154] If no abnormality or failure is detected as a result of the data read of the check function circuit 75, the transition to the main routine is permitted (step S22). However, here is the power described only for reset related to the power supply voltage, and it may be possible to reset by other fault detection or soundness check of other circuits. After confirming this, the transition to the main routine is permitted.
[0155] また、チェック機能回路 75のデータリードの結果、何等かの異常や故障が見つか れば、エレベータ制御盤 11に指令信号を出力し (ステップ S23)、エレベータを安全 状態へと移行させる。  [0155] If any abnormality or failure is found as a result of the data read of the check function circuit 75, a command signal is output to the elevator control panel 11 (step S23), and the elevator is shifted to a safe state.
[0156] このような電子安全コントローラ 21では、電源電圧の異常だけなぐ電源電圧監視 回路 71, 72の故障についても健全性を監視することができるので、電源電圧の監視 につ 、て信頼性をより一層向上させることができる。  [0156] Such an electronic safety controller 21 can monitor the soundness of a failure of the power supply voltage monitoring circuits 71 and 72 that can detect only the abnormality of the power supply voltage. Therefore, the reliability of the power supply voltage can be monitored. This can be further improved.
[0157] また、従来はフェールセーフや安全性の確保のために、各電源電圧監視回路にも 二重系を用いることがあった力 上記の電子安全コントローラ 21ではその必要がない ため、構成が簡単であり、コストの増カロも抑えることができる。し力も、信頼性は、各電 源電圧監視回路を二重系とした場合と同等である。  [0157] In addition, in the past, the power used to use a dual system for each power supply voltage monitoring circuit to ensure fail-safety and safety. It is simple and can suppress the increase in cost. However, the reliability is equivalent to the case where each power supply voltage monitoring circuit is a dual system.
[0158] さらに、 2つの CPU41, 42を用いた二重系の回路構成とし、 2ポート RAM45を介 して、それぞれの CPU41, 42による健全性チェック動作を互いに確認し合えるように したので、チェック機能回路 75やソフトウェアの故障も検出することができる。  [0158] In addition, a dual circuit configuration using two CPUs 41 and 42 is used, and the health check operation by each CPU 41 and 42 can be mutually confirmed via the 2-port RAM 45. Functional circuit 75 and software failures can also be detected.
[0159] このように、この例における電子安全コントローラ 21は、エレベータの安全監視に関 する処理を行う処理部と、処理部に供給される電源電圧を監視する電源電圧監視回 路とを備え、電源電圧監視回路に入力される電源電圧を強制的に変更するための 監視用入力電圧強制変更信号を処理部力 の制御信号に応じて出力するとともに、 電源電圧監視回路からの電圧異常検出信号が入力される電圧監視健全性チェック 機能回路をさらに備え、電圧監視健全性チェック機能回路は、処理部及び電源電圧 監視回路との信号の送受信内容の少なくとも一部を保持し、処理部は、電圧監視健 全性チェック機能回路に保持されたデータをリードすることにより電源電圧監視回路 の健全性チェックを行う。 As described above, the electronic safety controller 21 in this example includes a processing unit that performs processing related to elevator safety monitoring, and a power supply voltage monitoring circuit that monitors the power supply voltage supplied to the processing unit. A monitoring input voltage forced change signal for forcibly changing the power supply voltage input to the power supply voltage monitoring circuit is output according to the control signal of the processing unit, and a voltage abnormality detection signal from the power supply voltage monitoring circuit is output. An input voltage monitoring soundness check function circuit is further provided. The voltage monitoring soundness check function circuit holds at least a part of transmission / reception contents of signals with the processing unit and the power supply voltage monitoring circuit, and the processing unit has a voltage monitoring function. Ken The integrity of the power supply voltage monitoring circuit is checked by reading the data held in the integrity check function circuit.
[0160] また、処理部は、第 1及び第 2の CPUを含んでおり、第 1及び第 2の CPUは、 2ポー ト RAMを介して、第 1及び第 2の CPUによる健全性チェック動作を互いに確認し合 えるようになっている。  [0160] The processing unit includes the first and second CPUs, and the first and second CPUs perform health check operations by the first and second CPUs via the two-port RAM. Can be confirmed with each other.
[0161] さらに、監視用入力電圧強制変更信号の入力により、電源電圧監視回路に入力さ れる電源電圧を強制的に低下させる監視用入力電圧強制変更回路をさらに備えて いる。  [0161] Furthermore, a monitoring input voltage forced change circuit is further provided that forcibly lowers the power supply voltage input to the power supply voltage monitoring circuit by the input of the monitoring input voltage forced change signal.
[0162] さらにまた、電源電圧監視回路には、電圧の異なる複数の電源の電圧を監視する ための複数の電源電圧監視回路が含まれており、処理部から電圧監視健全性チエツ ク機能回路への制御信号には、複数の電源電圧監視回路のうちのどの回路の健全 性チェックを行うかを選択するための選択信号が含まれている。  [0162] Furthermore, the power supply voltage monitoring circuit includes a plurality of power supply voltage monitoring circuits for monitoring the voltages of a plurality of power supplies having different voltages, from the processing unit to the voltage monitoring soundness check function circuit. The control signal includes a selection signal for selecting which of the plurality of power supply voltage monitoring circuits is to be checked for soundness.
[0163] また、処理部は、各電源電圧監視回路の健全性チェックをシーケンシャルに 1つず つ実施可能である。  [0163] In addition, the processing unit can sequentially perform the soundness check of each power supply voltage monitoring circuit one by one.
さらに、電圧監視健全性チェック機能回路は、プログラマブルなゲート ICにより構成 されている。  In addition, the voltage monitoring soundness check function circuit consists of a programmable gate IC.
[0164] 《ETS初期設定》  [0164] <ETS Initial Settings>
次に、 ETS回路部 22の初期設定動作について説明する。上述したように、 ETS回 路部 22では、運転制御部 12とは独立して、力ご 3の位置を検出している。このため、 例えばエレベータの起動時には、 ETS回路部 22の初期設定動作 (初期設定運転ス テツプ）が行われる。また、何等かの原因により運転制御部 12におけるかご 3の位置 情報と ETS回路部 22におけるかご 3の位置情報との間にずれが生じてしまった場合 にも、 ETS回路部 22の初期設定動作が行われる。このような初期設定動作を行う際 には、運転制御部 12の運転モードは、初期設定運転モードに切り換えられる。  Next, the initial setting operation of the ETS circuit unit 22 will be described. As described above, the ETS circuit unit 22 detects the position of the force 3 independently of the operation control unit 12. For this reason, for example, when the elevator is started, an initial setting operation (initial setting operation step) of the ETS circuit unit 22 is performed. The initial setting operation of the ETS circuit unit 22 also occurs when there is a deviation between the position information of the car 3 in the operation control unit 12 and the position information of the car 3 in the ETS circuit unit 22 due to some cause. Is done. When such an initial setting operation is performed, the operation mode of the operation control unit 12 is switched to the initial setting operation mode.
[0165] 図 17は図 1の ETS回路部 22の初期設定動作の段階と運転制御部 12及び安全回 路部 13の動作との関係を示す説明図である。初期設定動作では、まず速度検出初 期設定が行われ、次に位置検出初期設定が行われる。  FIG. 17 is an explanatory diagram showing the relationship between the stage of the initial setting operation of the ETS circuit unit 22 of FIG. 1 and the operation of the operation control unit 12 and the safety circuit unit 13. In the initial setting operation, the speed detection initial setting is first performed, and then the position detection initial setting is performed.
[0166] 初期設定動作開始時には、安全回路部 13により駆動装置 7が非常停止状態にさ れている。即ち、駆動装置 7のモータ電源が遮断され、駆動装置 7のブレーキ部 9が 制動状態にされている。また、 ETS回路部 22から運転制御部 12に運転不可の指令 が出力されている。 [0166] At the start of the initial setting operation, the safety device 13 causes the drive unit 7 to be in an emergency stop state. It is. That is, the motor power supply of the drive device 7 is cut off, and the brake unit 9 of the drive device 7 is in a braking state. In addition, a command indicating that the operation cannot be performed is output from the ETS circuit unit 22 to the operation control unit 12.
[0167] 速度検出初期設定が終了するまでは、安全回路部 13は非常停止状態であり、運 転制御部 12も運転不可のままである。従って、 ETS回路部 22による監視は不能で ある。  [0167] Until the speed detection initial setting is completed, the safety circuit unit 13 is in an emergency stop state, and the operation control unit 12 remains inoperable. Therefore, monitoring by the ETS circuit unit 22 is impossible.
[0168] 速度検出初期設定が終了すると、電子安全コントローラ 21から運転制御部 12に低 速運転可能の許可信号が出力される。また、安全回路部 13の非常停止状態が解除 される。この状態で、 ETS回路部 22は、位置検出初期設定動作を行う。  [0168] When the speed detection initial setting is completed, the electronic safety controller 21 outputs a permission signal indicating that low-speed operation is possible to the operation control unit 12. In addition, the emergency stop state of the safety circuit unit 13 is released. In this state, the ETS circuit unit 22 performs a position detection initial setting operation.
[0169] 位置検出初期設定動作では、力ご 3は、緩衝器 27, 28の衝突許容速度以下の速 度で、昇降路 1の下部から上部まで走行される。そして、 ETS回路部 22では、調速 機エンコーダ 18からの信号と昇降路 1内での力ご 3の位置との関係が設定される。  In the position detection initial setting operation, the force 3 travels from the lower part to the upper part of the hoistway 1 at a speed equal to or less than the permissible collision speed of the shock absorbers 27 and 28. In the ETS circuit section 22, the relationship between the signal from the governor encoder 18 and the position of the force 3 in the hoistway 1 is set.
[0170] 初期設定動作が終了すると、電子安全コントローラ 21から運転制御部 12に高速（ 定格速運転)運転可能の許可信号が出力される。また、 ETS回路部 22では、高速監 視が可能となる。  [0170] When the initial setting operation is completed, the electronic safety controller 21 outputs a permission signal indicating that high-speed (rated speed operation) operation is possible to the operation control unit 12. In addition, the ETS circuit unit 22 enables high-speed monitoring.
[0171] 次に、図 18は図 1のエレベータ装置の初期設定運転モードにおけるかご 3の動きを 説明する説明図である。初期設定運転モードでは、速度検出初期設定が終了した後 、カゝご 3が昇降路 1の下部の階床書込開始位置まで移動される。階床書込開始位置 は、かご 3が最下階位置 P よりも下方で力ご緩衝器 27よりも上方に位置する位置で  Next, FIG. 18 is an explanatory view for explaining the movement of the car 3 in the initial setting operation mode of the elevator apparatus of FIG. In the initial setting operation mode, the car 3 is moved to the floor writing start position below the hoistway 1 after the speed detection initial setting is completed. The floor writing start position is a position where the car 3 is located below the lowest floor position P and above the force buffer 27.
BOT  BOT
ある。また、力ご 3が階床書込開始位置に位置するとき、力ご 3 (具体的には、かご 3に 設けられた基準センサ 23— 26の操作プレート）は第 4の基準センサ 26よりも下方に 位置している。  is there. When the force 3 is located at the floor writing start position, the force 3 (specifically, the operation plate of the reference sensor 23-26 provided in the car 3) is more than the fourth reference sensor 26. Located below.
[0172] 昇降路 1内には、運転制御部 12により最下階や最上階の位置を検出するための複 数の終点スィッチ（図示せず）が設けられている。そして、階床書込開始位置へのか ご 3の移動は、運転制御部 12によって制御される。  [0172] In the hoistway 1, a plurality of end point switches (not shown) for detecting the position of the lowermost floor or the uppermost floor by the operation control unit 12 are provided. The operation controller 12 controls the movement of the car 3 to the floor writing start position.
[0173] この後、階床書込開始位置からかご 3を上昇させながら、調速機エンコーダ 18から の信号に対応したかご 3の仮現在位置 P が求められる。具体的には、階床書 current tmp  [0173] Thereafter, while raising the car 3 from the floor writing start position, the temporary current position P of the car 3 corresponding to the signal from the governor encoder 18 is obtained. Specifically, the floor book current tmp
込開始位置を 0とする。 P —0 Set the start position to 0. P —0
current tmp  current tmp
そして、以降は、演算周期（例えば 100msec)毎に仮現在位置が更新される。  Thereafter, the temporary current position is updated every calculation cycle (for example, 100 msec).
[0174] ここで、 ETS回路部 22には、調速機エンコーダ 18のエンコーダパルスをカウントす るアップダウンカウンタが設けられており、アップダウンカウンタの演算周期内移動量 を GC1とすると、 N回目の演算周期における仮現在位置 P は、 [0174] Here, the ETS circuit unit 22 is provided with an up / down counter that counts the encoder pulses of the governor encoder 18. If the movement amount of the up / down counter in the calculation cycle is GC1, the Nth time The temporary current position P in the calculation cycle of
current tmp  current tmp
P P +GC1  P P + GC1
current tmp N current tmp N - 1  current tmp N current tmp N-1
で求められる。具体的には、仮現在位置や演算周期内移動量は、エンコーダパル スのパルス数として求められる。  Is required. Specifically, the temporary current position and the movement amount within the calculation cycle are obtained as the number of pulses of the encoder pulse.
[0175] このように、力ご 3の上昇に伴い仮現在位置が更新されていくが、操作プレートが基 準センサ 23— 26に進入した位置と、操作プレートが基準センサ 23— 26から脱出し た位置とは、 ETS回路部 22に設けられた記憶部 (メモリ）のテーブルに書き込まれる [0175] In this way, the temporary current position is updated as the force 3 increases, but the position where the operation plate enters the reference sensor 23-26 and the operation plate escapes from the reference sensor 23-26. Is written in the table of the storage unit (memory) provided in the ETS circuit unit 22
[0176] 例えば、 N回目の演算周期で第 4の基準センサ 26への進入が検出されたとすると、 進入位置 P は、 [0176] For example, if an entry to the fourth reference sensor 26 is detected in the Nth calculation cycle, the entry position P is
tmp ETSD  tmp ETSD
P P +GC1-GC2  P P + GC1-GC2
tmp ETSD current tmp N - 1  tmp ETSD current tmp N-1
で求められる。但し、 GC2は、第 4の基準センサ 26への進入後のアップダウンカウ ンタの移動量である。  Is required. However, GC2 is the amount of movement of the up / down counter after entering the fourth reference sensor 26.
他の基準センサ 23, 24, 25への進入位置も同様にテーブルに書き込まれる。  The approach positions to the other reference sensors 23, 24 and 25 are similarly written in the table.
[0177] また、 N回目の演算周期で基準センサ 26からの脱出が検出されたとすると、脱出位 tmp ETSUは、 [0177] If escape from the reference sensor 26 is detected in the Nth computation cycle, the escape position tmp ETSU is
P P +GC1-GC3  P P + GC1-GC3
tmp ETSU current tmp N - 1  tmp ETSU current tmp N-1
で求められる。但し、 GC3は、第 4の基準センサ 26から脱出した後のアップダウン力 ゥンタの移動量である。  Is required. However, GC3 is the amount of movement of the up / down force counter after escape from the fourth reference sensor 26.
他の基準センサ 23, 24, 25からの脱出位置も同様にテーブルに書き込まれる。  The escape positions from the other reference sensors 23, 24, 25 are similarly written in the table.
[0178] このように、全ての進入位置及び脱出位置の書き込みが終わったら、力ご 3は最上 階位置 P に停止される。  [0178] Thus, after all the entry positions and exit positions have been written, the force 3 is stopped at the top floor position P.
TOP  TOP
ここで、運転制御部 12には、仮想 0点を基準とした最下階位置 P 及び最上階位  Here, the operation control unit 12 includes the lowest floor position P and the highest floor position based on the virtual 0 point.
BOT  BOT
置 P のデータが設定されている。そして、かご 3が最上階位置 P に停止されたら 、仮想 0点を基準とした最下階位置 P 及び最上階位置 P のデータが運転制御部 Data for device P is set. And when car 3 is stopped at top floor position P The data of the lowest floor position P and the highest floor position P with reference to virtual 0 point is the operation control unit.
BOT TOP  BOT TOP
12から電子安全コントローラ 21に伝送される。電子安全コントローラ 21では、仮現在 位置として求められテーブルに書き込まれている位置データ力 運転制御部 12から 伝送された情報に基づいて、仮想 0点を基準としたデータに変換される。これにより、 仮想 0点を基準とした現在位置 P の検出が可能となる。  12 to the electronic safety controller 21. In the electronic safety controller 21, the position data force obtained as the temporary current position and written in the table is converted into data based on the virtual 0 point based on the information transmitted from the operation control unit 12. This makes it possible to detect the current position P with reference to virtual 0 point.
current  current
[0179] 現在位置への修正量 δは、  [0179] The correction amount δ to the current position is
δ =Ρ — Ρ  δ = Ρ — Ρ
TOP current tmp N  TOP current tmp N
で求められる。従って、テーブルに書き込まれた位置データに修正量 δを加えれば 、仮想 0点基準の位置データが求められる。修正後の位置データは、電子安全コント ローラ 21の E2PROMに書き込まれ、以降はこのデータが使用される。 Is required. Therefore, if the correction amount δ is added to the position data written in the table, the position data based on the virtual 0 point is obtained. The corrected position data is written to the E 2 PROM of the electronic safety controller 21, and this data is used thereafter.
[0180] また、最上階停止中には、以下の処理が行われ、位置管理が仮現在位置から現在 位置に変更される。 [0180] Further, while the top floor is stopped, the following processing is performed, and the position management is changed from the temporary current position to the current position.
P — P  P — P
current 0 TOP  current 0 TOP
P P +GC1  P P + GC1
current N current N— 1  current N current N— 1
[0181] この修正が完了し、位置管理が現在位置管理に移行されたら、電子安全コントロー ラ 21から運転制御部 12に高速運転可の指令が出力され、高速自動運転、即ち通常 運転モードの実施が許可される。また、 ETS回路部 22では、通常監視動作が実施さ れる。通常監視動作では、力ご緩衝器 27の上面からの力ご 3の距離 L1と釣合おもり 緩衝器 28の上面力もの釣合おもり 4の距離 L2とが、次の式により演算周期毎に求め られる。  [0181] When this correction is completed and the position management is shifted to the current position management, a command to enable high-speed operation is output from the electronic safety controller 21 to the operation control unit 12, and the high-speed automatic operation, that is, the normal operation mode is executed. Is allowed. In the ETS circuit unit 22, a normal monitoring operation is performed. In normal monitoring operation, the distance L1 of the force 3 from the upper surface of the force buffer 27 and the distance L2 of the counterweight 4 of the upper force of the shock absorber 28 are obtained at each calculation cycle by the following formula. It is done.
L1 = P 一（P — L )  L1 = P one (P — L)
current N BOT KRB  current N BOT KRB
L2= (P — L )-P  L2 = (P — L) -P
TOP C B current N  TOP C B current N
[0182] 但し、 L は、かご緩衝器 27の上面力も最下階位置 P までの距離、 L は、最上  [0182] However, L is the distance to the top floor position P of the car shock absorber 27, and L is the top
KRB BOT CRB  KRB BOT CRB
階位置 P から、釣合おもり 4が釣合おもり緩衝器 28に衝突するときの力ご 3の位置（ The position of the force 3 when the counterweight 4 collides with the counterweight buffer 28 from the floor position P (
TOP TOP
図 18の CWT衝突位置）までの距離である。  This is the distance to the CWT collision position in Fig. 18.
[0183] このようなエレベータ装置では、初期設定動作が完了するまでは、かご緩衝器 27の 衝突許容速度以下でかご 3を走行させるので、衝突許容速度を超えた速度でかご 3 力 Sかご緩衝器 27に衝突するのをより確実に防止することができ、信頼性を向上させる ことができる。 [0183] In such an elevator system, the car 3 is driven at a speed lower than the allowable collision speed of the car shock absorber 27 until the initial setting operation is completed. Can be more reliably prevented from colliding with device 27 and improve reliability be able to.
[0184] なお、上記の例では、速度検出初期設定及び位置検出初期設定の 2段階で初期 設定動作を行う場合を示したが、 3段階以上で初期設定動作を行い、段階毎に許容 されるかごの走行速度を設定してもよ 、。  [0184] In the above example, the case where the initial setting operation is performed in two stages of the speed detection initial setting and the position detection initial setting is shown. However, the initial setting operation is performed in three or more stages, and is allowed for each stage. You can also set the car speed.
また、初期設定動作は、速度検出初期設定及び位置検出初期設定に限定されるも のではない。  The initial setting operation is not limited to the speed detection initial setting and the position detection initial setting.
[0185] このように、この例におけるエレベータ装置は、かごの運転を制御する運転制御部 と、力ごの走行の異常を検出する監視部 (電子安全コントローラ 21)とを有するエレべ ータ制御装置を備え、監視部の初期設定を行う際、運転制御部は、初期設定の段階 に応じて通常運転時よりも低速でかごを走行させるようになって!/、る。  [0185] Thus, the elevator apparatus in this example includes an operation control unit that controls the operation of the car and an elevator control that includes a monitoring unit (electronic safety controller 21) that detects abnormalities in the running of the force. When the equipment is equipped and the initial setting of the monitoring unit is performed, the operation control unit will run the car at a lower speed than normal operation according to the initial setting stage.
[0186] また、監視部は、初期設定の段階に応じて、力ごの速度に関する許可信号を運転 制御部に出力する。  [0186] Further, the monitoring unit outputs a permission signal related to the speed of the force to the operation control unit according to the initial setting stage.
さらに、運転制御部は、通常運転モードと、力ごを走行させながら監視部の初期設 定を行うための初期設定運転モードとを含む複数の運転モードを選択的に切り換え てかごの運転を制御するようになっており、運転制御部は、初期設定運転モードでは 、初期設定の段階に応じて通常運転モードよりも低速で力ごを走行させる。  In addition, the operation control unit selectively controls a plurality of operation modes including a normal operation mode and an initial setting operation mode for performing initial setting of the monitoring unit while running a force to control the operation of the car. In the initial setting operation mode, the operation control unit causes the power to travel at a lower speed than in the normal operation mode according to the initial setting stage.
[0187] また、この例におけるエレベータ装置の制御方法は、力ごの走行の異常を検出する 監視部の初期設定を、力ごを走行させながら行う初期設定運転ステップを含み、初 期設定運転ステップでは、初期設定の段階に応じて通常運転よりも低速でかごを走 行させる。  [0187] In addition, the control method of the elevator apparatus in this example includes an initial setting operation step in which the initial setting of the monitoring unit for detecting abnormality in the travel of the force is performed while the force travels, and an initial setting operation step Then, the car is run at a lower speed than normal operation according to the initial setting stage.
[0188] 《リレー接点の異常検出〉〉  [0188] <Relay contact error detection>
次に、図 19は図 1の電子安全コントローラ 21の接点異常検出部を示す回路図であ る。安全回路部 13は、ブレーキ部 9に電力を供給するためのブレーキ電源コンタクタ コイル 111と、駆動装置 7のモータ部に電力を供給するためのモータ電源コンタクタ コイル 112と、コンタクタコイル 111, 112への電圧の印加を入切するための安全リレ 一主接点 113と、安全リレー主接点 113に対して並列に接続されたバイパスリレー主 接点 114とを有している。  Next, FIG. 19 is a circuit diagram showing a contact abnormality detection unit of the electronic safety controller 21 of FIG. The safety circuit unit 13 includes a brake power contactor coil 111 for supplying power to the brake unit 9, a motor power contactor coil 112 for supplying power to the motor unit of the driving device 7, and the contactor coils 111 and 112. A safety relay main contact 113 for turning on / off the voltage application and a bypass relay main contact 114 connected in parallel to the safety relay main contact 113 are provided.
[0189] ブレーキ電源コンタクタコイル 111、モータ電源コンタクタコイル 112及び安全リレー 主接点 113は、電源に対して互いに直列に接続されている。安全リレー主接点 113 は、通常運転時には閉じられている。また、例えばかご 3の走行速度が予め設定され た速度を超えた場合など、エレベータの異常時には、安全リレー主接点 113が開か れる。ノ ィパスリレー主接点 114は、通常運転時には開かれている。 [0189] Brake power contactor coil 111, motor power contactor coil 112 and safety relay The main contacts 113 are connected to each other in series with the power source. The safety relay main contact 113 is closed during normal operation. Further, when the elevator 3 is abnormal, for example, when the traveling speed of the car 3 exceeds a preset speed, the safety relay main contact 113 is opened. The no-pass relay main contact 114 is open during normal operation.
[0190] 電子安全コントローラ 21は、コントローラ本体 115と、安全リレー主接点 113を動作 させる安全リレーコイル 116と、バイパスリレー主接点 114を動作させるバイパスリレ 一コイル 117と、安全リレー主接点 113に機械的に連動して開閉される安全リレーモ ユタ接点 118と、バイパスリレー主接点 114に機械的に連動して開閉されるバイパス リレーモニタ接点 119とを有して 、る。  [0190] The electronic safety controller 21 is mechanically connected to the controller main body 115, the safety relay coil 116 that operates the safety relay main contact 113, the bypass relay coil 117 that operates the bypass relay main contact 114, and the safety relay main contact 113. It has a safety relay monitor contact 118 that opens and closes in conjunction with the bypass relay and a bypass relay monitor contact 119 that opens and closes mechanically in conjunction with the bypass relay main contact 114.
[0191] 安全リレーコイル 116、バイパスリレーコイル 117、安全リレーモニタ接点 118及び バイパスリレーモニタ接点 119は、コントローラ本体 115に対して互!ヽに並列に接続 されている。  [0191] The safety relay coil 116, the bypass relay coil 117, the safety relay monitor contact 118, and the bypass relay monitor contact 119 are connected to the controller main body 115 in parallel with each other.
[0192] 安全リレー主接点 113と安全リレーモニタ接点 118とは、リンク機構（図示せず）によ り機械的に連結されている。従って、接点 113, 118のいずれか一方が溶着等により 動作不能となった場合には、他方も動作不能となる。  [0192] The safety relay main contact 113 and the safety relay monitor contact 118 are mechanically connected by a link mechanism (not shown). Therefore, when either one of the contacts 113 and 118 becomes inoperable due to welding or the like, the other becomes inoperable.
[0193] ノ ィパスリレー主接点 114とバイパスリレーモニタ接点 119とは、リンク機構（図示せ ず）により機械的に連結されている。従って、接点 114, 119のいずれか一方が溶着 等により動作不能となった場合には、他方も動作不能となる。 [0193] The no-pass relay main contact 114 and the bypass relay monitor contact 119 are mechanically connected by a link mechanism (not shown). Therefore, when one of the contacts 114, 119 becomes inoperable due to welding or the like, the other becomes inoperable.
[0194] コントローラ本体 115は、処理部 120、記憶部 121、入出力部 122、安全リレーモ- タ接点レシーバ回路 123、バイパスリレーモニタ接点レシーバ回路 124、安全リレー ドライバ回路 125、及びバイパスリレードライバ回路 126を有している。 [0194] The controller body 115 includes a processing unit 120, a storage unit 121, an input / output unit 122, a safety relay motor contact receiver circuit 123, a bypass relay monitor contact receiver circuit 124, a safety relay driver circuit 125, and a bypass relay driver circuit 126. have.
処理部 120としては、例えば CPUが用いられている。記憶部 121としては、例えば As the processing unit 120, for example, a CPU is used. As the storage unit 121, for example,
RAM, ROM及びノヽードディスク装置等が用いられている。記憶部 121には、例え ばエレベータの異常を判断するためのデータや、安全リレー主接点 113の動作試験 を行うためのプログラム等が格納されている。 RAM, ROM, node disk devices, etc. are used. The storage unit 121 stores, for example, data for determining an elevator abnormality, a program for performing an operation test of the safety relay main contact 113, and the like.
[0195] 処理部 120は、入出力部 122を介して、運転制御部 12及び各種センサと信号の送 受信を行う。 The processing unit 120 transmits / receives signals to / from the operation control unit 12 and various sensors via the input / output unit 122.
[0196] 安全リレーモニタ接点レシーバ回路 123は、安全リレーモニタ接点 118に直列に接 続され、安全リレーモニタ接点 1 18の開閉状態を検出する。バイパスリレーモニタ接 点レシーバ回路 124は、バイパスリレーモニタ接点 119に直列に接続され、バイパス リレーモニタ接点 119の開閉状態を検出する。 [0196] The safety relay monitor contact receiver circuit 123 is connected in series to the safety relay monitor contact 118. Next, the open / close state of safety relay monitor contact 1 18 is detected. The bypass relay monitor contact receiver circuit 124 is connected in series to the bypass relay monitor contact 119 and detects the open / closed state of the bypass relay monitor contact 119.
[0197] 安全リレードライバ回路 125は、安全リレーコイル 1 16に直列に接続され、安全リレ 一コイル 116の励磁'非励磁を切り換える。ノ ィパスリレードライバ回路 126は、バイ バスリレーコイル 117に直列に接続され、バイパスリレーコイル 117の励磁 ·非励磁を 切り換える。 [0197] The safety relay driver circuit 125 is connected in series to the safety relay coil 116, and switches between excitation and non-excitation of the safety relay coil 116. The no-pass relay driver circuit 126 is connected in series to the bypass relay coil 117, and switches excitation / de-energization of the bypass relay coil 117.
[0198] 安全リレーコイル 116の励磁.非励磁の切換は、処理部 120から安全リレードライバ 回路 125に安全リレー指令信号を出力することにより行われる。また、ノ ィパスリレー コイル 117の励磁 ·非励磁の切換は、処理部 120からバイパスリレードライバ回路 12 6にバイパス指令信号を出力することにより行われる。  [0198] Switching between excitation and non-excitation of the safety relay coil 116 is performed by outputting a safety relay command signal from the processing unit 120 to the safety relay driver circuit 125. Further, switching between excitation and non-excitation of the no-pass relay coil 117 is performed by outputting a bypass command signal from the processing unit 120 to the bypass relay driver circuit 126.
[0199] レシーノ 回路 123, 124及びドライノ 回路 125, 126 ίま、処理咅 120【こ対して互!ヽ に並列に接続されている。  [0199] The Resino circuits 123 and 124 and the Dryno circuits 125 and 126 are connected in parallel to each other in a processing unit 120.
[0200] 次に、動作について説明する。エレベータの運転中には、各種センサからの情報 に基づ 、て、コントローラ本体 115によりエレベータの異常の有無が監視されて!、る。 処理部 120によりエレベータの異常が検出されると、安全リレードライバ回路 125によ り安全リレーコイル 116のドライブが止められる。  Next, the operation will be described. During operation of the elevator, the controller main body 115 monitors the presence or absence of an abnormality of the elevator based on information from various sensors! When the abnormality of the elevator is detected by the processing unit 120, the driving of the safety relay coil 116 is stopped by the safety relay driver circuit 125.
[0201] これにより、安全リレー主接点 113が開かれ、コンタクタコイル 111 , 112への通電 が遮断される。この結果、ブレーキ部 9により駆動シーブ 8の回転が制動されるととも に、モータ部への通電が遮断され、かご 3が急停止される。  [0201] As a result, the safety relay main contact 113 is opened and the energization of the contactor coils 111, 112 is interrupted. As a result, the rotation of the drive sheave 8 is braked by the brake unit 9, the energization to the motor unit is cut off, and the car 3 is suddenly stopped.
[0202] 次に、安全リレー主接点 113の動作試験方法について説明する。図 20は図 19の 安全リレー主接点 113の動作試験方法を説明するためのフローチャートである。この 実施の形態では、通常運転時にかご 3が停止階に停止する度に動作試験が実施さ れる。従って、通常運転時には、処理部 120は、各種センサ力もの情報によりかご 3 の走行速度が 0になつたがどうかを監視して 、る（停止検出ステップ S61 )。  Next, an operation test method for the safety relay main contact 113 will be described. FIG. 20 is a flowchart for explaining an operation test method of the safety relay main contact 113 of FIG. In this embodiment, an operation test is performed every time the car 3 stops at the stop floor during normal operation. Therefore, during normal operation, the processing unit 120 monitors whether or not the traveling speed of the car 3 has become 0 based on information from various sensor forces (stop detection step S61).
[0203] 力ご 3の速度が 0になり安全状態になったら、バイパスリレードライバ回路 126により バイパスリレーコイル 117が励磁され、この後、予め設定された時間、ここでは 100m s待機する (ステップ S62)。そして、ノ ィパスリレーモニタ接点 119が閉じられたかどう かがバイパスリレーモニタ接点レシーバ回路 124により確認される（ステップ S63)。 [0203] When the speed of the force 3 becomes 0 and the safety state is reached, the bypass relay coil 117 is excited by the bypass relay driver circuit 126, and then waits for a preset time, here 100 ms (step S62). ). Then, check whether the no-pass relay monitor contact 119 is closed. Is confirmed by the bypass relay monitor contact receiver circuit 124 (step S63).
[0204] バイパスリレーモニタ接点 119が閉じられていなければ、バイパスリレー主接点 114 も閉じられていないことを意味するため、処理部 120によりバイパスリレー故障と判断 され、コントローラ本体 115から運転制御部 12に異常検出信号が出力される (ステツ プ S64)。 [0204] If the bypass relay monitor contact 119 is not closed, it means that the bypass relay main contact 114 is also not closed. Therefore, the processing unit 120 determines that the bypass relay has failed, and the controller main body 115 determines that the operation control unit 12 An abnormality detection signal is output at (Step S64).
[0205] ノ ィパスリレーモニタ接点 119が正常に閉じられていることが確認されたら、安全リ レードライバ回路 125により安全リレーコイル 116が励磁され、この後、予め設定され た時間、ここでは 100ms待機する（試験指令ステップ S65)。そして、安全リレーモ- タ接点 118が開かれたどうかが安全リレーモニタ接点レシーバ回路 123により確認さ れる (異常検出ステップ S66)。  [0205] When it is confirmed that the no-pass relay monitor contact 119 is normally closed, the safety relay coil 116 is energized by the safety relay driver circuit 125, and thereafter, a preset time, here 100 ms. Wait (test command step S65). Then, whether or not the safety relay motor contact 118 is opened is confirmed by the safety relay monitor contact receiver circuit 123 (abnormality detection step S66).
[0206] 安全リレーモニタ接点 118が開かれていなければ、溶着等の原因により安全リレー 主接点 113も開かれて 、な 、ことを意味するため、処理部 120により安全リレー故障 と判断され、コントローラ本体 115から運転制御部 12に異常検出信号が出力される（ ステップ S64)。  [0206] If the safety relay monitor contact 118 is not opened, it means that the safety relay main contact 113 is also opened due to a cause such as welding. An abnormality detection signal is output from the main body 115 to the operation control unit 12 (step S64).
[0207] 安全リレーモニタ接点 118が正常に開かれたことが確認されたら、今度は安全リレ 一コイル 116が非励磁状態にされ、この後、予め設定された時間、ここでは 100ms待 機する (ステップ S67)。そして、安全リレーモニタ接点 118が閉じられたかどうかが安 全リレーモニタ接点レシーバ回路 123により確認される (ステップ S68)。  [0207] When it is confirmed that the safety relay monitor contact 118 is normally opened, the safety relay coil 116 is de-energized, and then waits for a preset time, here 100 ms ( Step S67). Then, whether or not the safety relay monitor contact 118 is closed is confirmed by the safety relay monitor contact receiver circuit 123 (step S68).
[0208] 安全リレーモニタ接点 118が閉じられていなければ、処理部 120により安全リレー 故障と判断され、コントローラ本体 115から運転制御部 12に異常検出信号が出力さ れる（ステップ S 64)。  [0208] If the safety relay monitor contact 118 is not closed, the processing unit 120 determines that a safety relay failure has occurred, and an abnormality detection signal is output from the controller main body 115 to the operation control unit 12 (step S64).
[0209] 安全リレーモニタ接点 118が正常に閉じられたことが確認されたら、バイパスリレー コイル 117が非励磁状態にされ、この後、予め設定された時間、ここでは 100ms待機 する（ステップ S69)。そして、バイパスリレーモニタ接点 119が開かれたかどうかがバ ィバスリレーモニタ接点レシーバ回路 124により確認される (ステップ S 70)。  [0209] When it is confirmed that the safety relay monitor contact 118 is normally closed, the bypass relay coil 117 is de-energized, and then waits for a preset time, here 100 ms (step S69). Then, whether the bypass relay monitor contact 119 is opened is confirmed by the bypass relay monitor contact receiver circuit 124 (step S70).
[0210] バイパスリレーモニタ接点 119力開かれて!/、なければ、処理部 120によりバイパスリ レー故障と判断され、コントローラ本体 115から運転制御部 12に異常検出信号が出 力される (ステップ S64)。 [0211] このようにして、安全リレー主接点 113及びバイパスリレー主接点 114の開閉動作 の試験が終了したら、力ご 3の走行速度が予め設定された設定値以上になるまで待 機し (ステップ S71)、次にかご 3が停止するまで ETS回路部 22により走行速度が監 視される。そして、力ご 3が停止する度に、上記の動作試験が実施され、安全回路部 13の健全性が確認される。 [0210] Bypass relay monitor contact 119 Opened! / If not, the processing unit 120 determines that a bypass relay failure has occurred, and an error detection signal is output from the controller body 115 to the operation control unit 12 (step S64). . [0211] When the test of the opening / closing operation of the safety relay main contact 113 and the bypass relay main contact 114 is completed in this way, it waits until the traveling speed of the force 3 exceeds a preset set value (step S71), and then the traveling speed is monitored by the ETS circuit section 22 until the car 3 stops. Then, every time the force 3 stops, the above-described operation test is performed, and the soundness of the safety circuit unit 13 is confirmed.
[0212] このようなエレベータ安全装置では、通常運転時にかごが停止したタイミングを利 用して、安全リレー主接点 113の動作試験を行うようにしたので、通常運転に支障を 来すことなぐ安全リレー主接点 113の異常を検出することができ、信頼性を向上さ せることができる。  [0212] In such an elevator safety device, the operation test of the safety relay main contact 113 was performed using the timing when the car stopped during normal operation, so safety that would not hinder normal operation The abnormality of the relay main contact 113 can be detected, and the reliability can be improved.
[0213] また、動作試験は、力ごが停止する度に行うようにしたので、十分な頻度で安全リレ 一主接点 113の動作を確認することができ、信頼性をさらに向上させることができる。  [0213] Since the operation test is performed every time the force stops, the operation of the safety relay main contact 113 can be confirmed with sufficient frequency, and the reliability can be further improved. .
[0214] さらに、安全リレー主接点 113の動作試験を行う際には、バイパスリレー主接点 114 を閉じるようにしたので、動作試験中に安全回路部 13への通電が遮断されるのを防 止することができ、安全回路部 13を維持したまま、動作試験を実施することができる。  [0214] Furthermore, since the bypass relay main contact 114 was closed when the operation test of the safety relay main contact 113 was performed, the power supply to the safety circuit section 13 was prevented from being interrupted during the operation test. The operation test can be performed while the safety circuit unit 13 is maintained.
[0215] さらにまた、安全リレー主接点 113及びバイパスリレー主接点 114が正常に元に戻 された力どうかも確認するようにしたので、信頼性をさらに向上させることができる。  [0215] Furthermore, since the safety relay main contact 113 and the bypass relay main contact 114 are also checked for whether or not the force has been normally restored, the reliability can be further improved.
[0216] なお、上記の例では、安全リレー主接点 113が開いたときにブレーキ部 9が制動動 作する場合を示したが、逆に、安全リレー主接点が閉じたときにブレーキ部が制動動 作することも可能であり、この場合も安全リレー主接点の動作試験を実施することが できる。  [0216] In the above example, the case where the brake unit 9 performs braking operation when the safety relay main contact 113 is opened is shown. Conversely, the brake unit brakes when the safety relay main contact is closed. It is also possible to operate, and in this case, the operation test of the safety relay main contact can be performed.
[0217] また、上記の例では、駆動装置 7に設けられたブレーキ部 9を動作させるための安 全リレー主接点について示した力 例えば主ロープを把持してかごを制動するロープ ブレーキや、力ご又は釣合おもりに搭載された非常止め装置を動作させるための安 全リレー主接点に対しても適用できる。  [0217] Also, in the above example, the force shown for the safety relay main contact for operating the brake unit 9 provided in the driving device 7, for example, a rope brake that grips the main rope and brakes the car, It can also be applied to a safety relay main contact for operating an emergency stop device mounted on a cage or counterweight.
[0218] さらに、上記の例では、力ご 3が停止する度に動作試験を行うようにした力 動作試 験のタイミングはこれに限定されない。例えば、かごの停止回数をカウントするカウン タを検出回路本体に設け、予め設定された停止回数毎に動作試験を実施するように してもよい。また、検出回路本体にタイマを設け、予め設定された時間が経過してか ら最初にかごが停止したときに動作試験を実施するようにしてもよい。さらに、エレべ ータの通常運転を開始したとき（起動時)のみ、動作試験を実施するようにしてもょ ヽ 。さらにまた、予め設定された階に停止したときのみ、動作試験を実施するようにして ちょい。 [0218] Furthermore, in the above example, the timing of the force operation test in which the operation test is performed each time the force 3 stops is not limited to this. For example, a counter that counts the number of stoppages of the car may be provided in the detection circuit main body, and the operation test may be performed every preset number of stoppages. In addition, a timer is provided in the detection circuit body, so that a preset time has elapsed. The operation test may be performed when the car stops for the first time. In addition, an operation test may be performed only when normal operation of the elevator is started (at startup). Furthermore, it is recommended that the operation test be performed only when the vehicle stops on a preset floor.
[0219] このように、この例における電子安全コントローラ 21は、通常運転時にかごが停止し たとき、ブレーキ部が制動動作する方向へ安全リレー主接点を動作させるための安 全リレー指令信号を発生するとともに、安全リレー指令信号に応じて安全リレー主接 点が動作したかどうかを検出する。  [0219] As described above, the electronic safety controller 21 in this example generates a safety relay command signal for operating the safety relay main contact in the direction in which the brake section performs braking operation when the car stops during normal operation. At the same time, it detects whether the safety relay main contact is activated according to the safety relay command signal.
[0220] また、電子安全コントローラ 21には、安全リレー主接点に機械的に連動して開閉さ れる安全リレーモニタ接点が設けられており、電子安全コントローラ 21は、安全リレー モニタ接点の状態力 安全リレー主接点の状態を検出する。  [0220] In addition, the electronic safety controller 21 is provided with a safety relay monitor contact that is mechanically linked to the safety relay main contact, and the electronic safety controller 21 has a safety relay monitor contact state force safety Detects the relay main contact status.
さらに、安全リレー主接点は、通常運転時には閉じられており、かつエレベータの 異常時には開かれるようになっており、安全リレー主接点に対して並列に接続され、 通常運転時には開かれているバイパスリレー主接点が安全回路に設けられており、 電子安全コントローラ 21は、安全リレー指令信号を発生する場合、その前にバイパス リレー主接点を閉じるためのバイパス指令信号を発生する。  In addition, the safety relay main contact is closed during normal operation and opened when the elevator malfunctions. The bypass relay is connected in parallel to the safety relay main contact and opened during normal operation. The main contact is provided in the safety circuit, and the electronic safety controller 21 generates a bypass command signal for closing the bypass relay main contact before generating the safety relay command signal.
[0221] さらにまた、電子安全コントローラ 21には、バイノ スリレー主接点に機械的に連動し て開閉されるバイパスリレーモニタ接点が設けられており、電子安全コントローラ 21は 、 ノィパスリレーモニタ接点の状態からバイパスリレー主接点の状態を検出する。 また、電子安全コントローラ 21は、バイノ ス指令信号に応じてバイノ スリレー主接点 が動作したかどうかを検出する。 [0221] Furthermore, the electronic safety controller 21 is provided with a bypass relay monitor contact that is opened and closed mechanically in conjunction with the main relay contact, and the electronic safety controller 21 is in the state of the no-pass relay monitor contact. The status of the bypass relay main contact is detected. In addition, the electronic safety controller 21 detects whether or not the bino relay main contact has operated in response to the bino command signal.
さらに、電子安全コントローラ 21は、安全リレー主接点の異常を検出したとき、運転 制御部に異常検出信号を出力する。  Furthermore, when the electronic safety controller 21 detects an abnormality of the safety relay main contact, it outputs an abnormality detection signal to the operation control unit.
[0222] 《動作履歴の記録〉〉 [0222] <Recording operation history >>
図 21は図 1の電子安全コントローラ 21に履歴情報記録部及び健全性診断部を接 続した状態を示すブロック図である。電子安全コントローラ 21には、電子安全コント口 ーラ 21における判定処理に関する情報の履歴 (処理過程）が記録される履歴情報記 録部 131が接続されている。履歴情報記録部 131としては、エレベータ制御装置の 電源が切断されても情報を保持し続ける不揮発性のメモリが用いられる。このようなメ モリとしては、例えばフラッシュメモリゃノヽードディスク装置等が挙げられる。 FIG. 21 is a block diagram showing a state where the history information recording unit and the soundness diagnosis unit are connected to the electronic safety controller 21 of FIG. Connected to the electronic safety controller 21 is a history information recording unit 131 in which a history of information (processing process) regarding determination processing in the electronic safety controller 21 is recorded. As the history information recording unit 131, an elevator control device A nonvolatile memory that retains information even when the power is turned off is used. Examples of such memory include a flash memory and a node disk device.
[0223] また、電子安全コントローラ 21及び履歴情報記録部 131には、電子安全コントロー ラ 21の健全性を自動的に診断する健全性診断部 132が接続されて ヽる。健全性診 断部 132は、各種センサ及び安全回路部 13等のシステム全体につ 、ての健全性も 診断可能である。健全性診断部 132による診断結果は、履歴情報記録部 131に記 録される。  [0223] Further, the electronic safety controller 21 and the history information recording unit 131 are connected to a health diagnostic unit 132 that automatically diagnoses the health of the electronic safety controller 21. The soundness diagnosis unit 132 can also diagnose the overall soundness of the entire system including various sensors and the safety circuit unit 13. The diagnosis result by the soundness diagnosis unit 132 is recorded in the history information recording unit 131.
[0224] 図 22は図 21の履歴情報記録部 131に格納された情報の一例を示す説明図である 。履歴情報としては、時刻、かご位置、かご速度、かご位置に応じて求められた設定 値 (閾値)、判定結果、及び内部変数等の解析データが記録される。  FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit 131 in FIG. As history information, analysis data such as time, car position, car speed, set value (threshold value) obtained according to car position, judgment result, and internal variables are recorded.
[0225] 履歴情報記録部 131には、かご位置、かご速度、設定値、判定結果及び解析デー タ等のデータの組み合わせ力 対応する時刻毎に分けて蓄積され、図 22に示すよう なデータのテーブルが作成される。  [0225] In the history information recording unit 131, the combination power of data such as car position, car speed, set value, judgment result, and analysis data is stored separately for each corresponding time, and the data as shown in FIG. A table is created.
[0226] 図 23は図 21の電子安全コントローラ 21の動作を説明するためのフローチャートで ある。まず、現在時刻のデータが履歴情報記録部 131に出力される (ステップ S81)。 次に、かご 3の位置が検出される (ステップ S82)。検出されたかご位置のデータは、 履歴情報記録部 131に出力される (ステップ S83)。この後、力ご 3の速度が検出され る (ステップ S84)。検出されたかご速度のデータは、履歴情報記録部 131に出力さ れる（ステップ S 85)。 FIG. 23 is a flowchart for explaining the operation of the electronic safety controller 21 of FIG. First, the current time data is output to the history information recording unit 131 (step S81). Next, the position of the car 3 is detected (step S82). The detected car position data is output to the history information recording unit 131 (step S83). Thereafter, the speed of the force 3 is detected (step S84). The detected car speed data is output to the history information recording unit 131 (step S 85).
[0227] 次に、かご位置に対応した設定値が算出される (ステップ S86)。設定された設定値 のデータは、履歴情報記録部 131に出力される (ステップ S87)。この後、検出速度 V と設定値 f (x)とが比較され (ステップ S88)、検出速度 Vが設定値 f (x)よりも小さけれ ば、その判定結果は、「異常なし」（Good)として履歴情報記録部 131に出力される（ ステップ S89)。力ごの速度に異常がなければ、上記の動作が演算周期毎に繰り返さ れる。  Next, a set value corresponding to the car position is calculated (step S86). The set value data is output to the history information recording unit 131 (step S87). After that, the detection speed V is compared with the set value f (x) (step S88). If the detection speed V is smaller than the set value f (x), the judgment result is “No error” (Good). It is output to the history information recording unit 131 (step S89). If there is no abnormality in the speed of the force, the above operation is repeated every calculation cycle.
[0228] 比較判定の結果、検出速度 Vが設定値 f (X)以上であれば、安全回路部 13に停止 指令信号が出力される (ステップ S90)。そして、その判定結果は、「異常あり」 (Bad) として履歴情報記録部 131に出力される (ステップ S91)。 [0229] 履歴情報記録部 131では、電子安全コントローラ 21から送られたデータが順次記 録される。 [0228] If the detection speed V is equal to or higher than the set value f (X) as a result of the comparison determination, a stop command signal is output to the safety circuit unit 13 (step S90). Then, the determination result is output to the history information recording unit 131 as “abnormal” (Bad) (step S91). [0229] In the history information recording unit 131, data sent from the electronic safety controller 21 is sequentially recorded.
[0230] このようなエレベータ装置によれば、電子安全コントローラ 21からの指令によりかご 3が急停止されたとき、履歴情報記録部 131に記録された履歴を確認することにより 、電子安全コントローラ 21の健全性を確認することができる。例えば、判定結果が「異 常なし」であったにも拘わらず、カゝご 3が急停止された場合、エレベータ制御盤 11側 に故障があることが判断できる。  [0230] According to such an elevator apparatus, when the car 3 is suddenly stopped by a command from the electronic safety controller 21, the history recorded in the history information recording unit 131 is confirmed, so that the electronic safety controller 21 Soundness can be confirmed. For example, when the car 3 is suddenly stopped even though the judgment result is “no abnormality”, it can be judged that the elevator control panel 11 has a failure.
[0231] 従って、力ご 3が急停止された場合の原因を効率的に判断することができる。これに より、復旧作業の効率ィ匕を図ることができる。  [0231] Therefore, the cause when the force 3 is suddenly stopped can be determined efficiently. This makes it possible to improve the efficiency of recovery work.
また、定期点検作業において、あらゆる条件の検査信号を実際に入力して設定値 の演算結果や判定結果が正 、かどうかを確認するのに代えて、履歴情報を確認す ることにより一部の検査結果を得たとすることができ、点検作業の簡素化を図ることが できる。履歴情報記録部 131に記録された設定値の計算結果と比較判定結果とを確 認するだけで、一部の定期点検を検査済みとすることができ、検査項目を軽減するこ とがでさる。  In addition, in periodic inspection work, instead of checking whether the calculation results and judgment results of set values are correct by actually inputting inspection signals under all conditions, it is possible to check some history information. It can be said that the inspection result is obtained, and the inspection work can be simplified. By only checking the calculation result of the set value and the comparison judgment result recorded in the history information recording unit 131, some periodic inspections can be inspected and inspection items can be reduced. .
[0232] さらに、電子安全コントローラ 21で設定される設定値は、いたずらによる力ご振動等 を考慮して余裕を持たせて設定される。どの程度の余裕を持たせるかは、エレベータ 毎に調整することも可能である。履歴情報記録部 131に記録された判定結果のデー タを解析することにより、実際の運行状況において、どの程度の余裕が必要であるか を確認することができ、余裕を最小限とすることができる。これにより、かご速度を高速 化し、運行効率を向上させることが可能である。また、余裕の調整作業を容易にする ことができる。即ち、通常時の履歴情報を解析することにより、調整作業の作業項目 を軽減することができる。  [0232] Furthermore, the set value set by the electronic safety controller 21 is set with a margin in consideration of force vibration caused by mischief. It is also possible to adjust the degree of allowance for each elevator. By analyzing the data of the judgment results recorded in the history information recording unit 131, it is possible to check how much margin is necessary in the actual operation status, and to minimize the margin. it can. As a result, the car speed can be increased and the operation efficiency can be improved. In addition, it is possible to easily adjust the margin. In other words, the work items of the adjustment work can be reduced by analyzing the normal history information.
[0233] 次に、健全性診断部 132による診断内容の具体例は、以下の通りである。 [0233] Next, specific examples of the contents of diagnosis by the soundness diagnosis unit 132 are as follows.
1.センサの故障診断  1. Sensor failure diagnosis
•時間に対する位置の挙動のチェック (連続性、変化量、ノイズ等の有無） •時間に対する速度の挙動のチェック (連続性、変化量、ノイズ等の有無） 'センサの故障チェック 2.速度監視部の動作の診断 • Check position behavior against time (continuity, change, noise, etc.) • Check speed behavior (continuity, change, noise, etc.) 'Sensor failure check 2. Diagnosis of operation of speed monitor
•動作タイミング (動作間隔）のチェック（時刻 tl、 t2から）  • Check operation timing (operation interval) (from time tl, t2)
•かご位置に対する設定値の演算結果のチェック  • Check the calculation result of the set value for the car position
•検出速度と設定値との比較判定結果のチェック  • Checking the comparison judgment result between the detection speed and the set value
•CPU, ROM, RAM等の電子素子の故障診断  • Failure diagnosis of electronic elements such as CPU, ROM, RAM, etc.
3.速度監視部の出力値の診断  3. Diagnosis of output value of speed monitor
•出力値の挙動のチェック (ノイズ等の有無）  • Check the output value behavior (presence of noise, etc.)
•判定結果に対応する安全回路への出力のチェック  • Check the output to the safety circuit corresponding to the judgment result
4.非常止め装置の自己診断機能の動作チェック  4. Operation check of self-diagnosis function of emergency stop device
•自己診断の動作チェック (タイミング、診断項目）  • Operation check for self-diagnosis (timing, diagnostic items)
•異常検出の履歴チェック  • Anomaly detection history check
5.かご急停止動作の有無及び動作時の状態診断  5. Car presence / absence and state diagnosis during operation
•自己診断による非常止め装置の故障検知のチェック  • Self-diagnosis check of emergency stop device failure detection
(故障検出箇所、故障要因のチェック）  (Fault detection location and failure factor check)
•誤出力のチェック（出力と論理演算との整合性チェック）  • Check for erroneous output (check consistency between output and logical operation)
•動作直前の位置や速度の挙動チェック  • Check the behavior of position and speed just before operation
(異常速度に至った挙動のチェック、 V、たずら等の有無のチェック）  (Check the behavior that led to abnormal speed, check for V, tampering, etc.)
[0234] また、上記のような診断結果の履歴情報を集計する処理を追加し、履歴情報記録 部 131に集計処理結果を記録することにより、履歴情報の確認作業を軽減することも 可能である。記録する集計処理結果の具体例は、以下の通りである。 [0234] It is also possible to reduce the work of confirming history information by adding a process for counting history information of diagnostic results as described above and recording the result of aggregation processing in the history information recording unit 131. . A specific example of the total processing result to be recorded is as follows.
•動作タイミングの良否  • Operation timing
•センサ入力の履歴による入力機能の健全性の良否  • Soundness of input function based on sensor input history
•論理演算の健全性の良否  • Soundness of logical operations
，出力機能の良否  , Output function quality
•自己診断動作と結果の良否  • Self-diagnosis operation and results
，装置異常の有無  , Device abnormality
[0235] このようなエレベータ装置では、システムの健全性の診断結果を履歴情報記録部 1 31で確認することができるので、電子素子の故障が原因でかご 3が急停止された場 合、原因となった電子素子の特定を効率良く行うことができる。 [0235] In such an elevator apparatus, the system health diagnosis result can be confirmed by the history information recording unit 1 31. Therefore, when the car 3 is suddenly stopped due to a failure of an electronic element. In this case, it is possible to efficiently identify the electronic element that is the cause.
[0236] また、履歴情報記録部 131に記録された診断結果及びその集計処理結果を確認 することで、定期点検の検査項目を削減することができる。定期点検時に確認する事 項としては、次のものが挙げられる。  [0236] Further, by checking the diagnosis results and the results of the aggregation processing recorded in the history information recording unit 131, the inspection items for the periodic inspection can be reduced. The following items can be confirmed during periodic inspections.
•記録されたかご位置や力ご速度から、動作の健全性の確認済み領域 (x、 Vに関す る検査済み範囲）のチェック  • Check the operation health confirmed area (examined range for x and V) from the recorded car position and force speed
•自己診断によって確認済みの点検項目のチェック  • Check of inspection items confirmed by self-diagnosis
•検出速度と設定値との間の余裕をチェック  • Check the margin between detection speed and set value
[0237] このように、例えば CPU、 ROM及び RAM等の電子素子についての健全性の診 断が行われて ヽる場合、履歴情報記録部 131に記録された診断結果を確認すること により、定期点検時の電子素子の点検を省略することができる。 [0237] As described above, for example, when the diagnosis of the soundness of electronic elements such as CPU, ROM, and RAM is performed, the diagnostic information recorded in the history information recording unit 131 is checked to check the periodicity. Inspection of the electronic element during inspection can be omitted.
[0238] なお、履歴情報の記録や健全性診断結果の記録に加え、定期点検の実施確認事 項を履歴情報記録部 131に記録可能としてもよぐ点検履歴を履歴情報記録部 131 に保持することができ、定期点検の実施内容を容易に確認することができる。記録す る点検履歴としては、例えば点検実施時期及び点検項目等が挙げられる。 [0238] In addition to recording history information and soundness diagnosis results, the inspection information may be recorded in the history information recording unit 131, which may be recorded in the history information recording unit 131. It is possible to check the contents of regular inspections easily. The inspection history to be recorded includes, for example, inspection implementation timing and inspection items.
[0239] また、上記の例では、履歴情報記録部 131及び健全性診断部 132を電子安全コン トローラ 21の外部に設けたが、少なくともいずれか一方を電子安全コントローラ 21内 に設けてもよい。 [0239] In the above example, the history information recording unit 131 and the soundness diagnosis unit 132 are provided outside the electronic safety controller 21, but at least one of them may be provided in the electronic safety controller 21.
[0240] さらに、上記の例では異常速度の監視について履歴情報を記録したが、例えば主 ロープの損傷や切断の有無を監視するロープ切れ監視についての履歴情報を記録 してもよい。また、卷上機のモータ温度、インバータの温度又は制御盤の温度等を監 視する温度監視につ!、ての履歴情報を記録してもよ 、。  [0240] Furthermore, in the above example, the history information is recorded for monitoring the abnormal speed, but for example, history information for rope break monitoring for monitoring whether the main rope is damaged or disconnected may be recorded. It is also possible to record historical information for temperature monitoring that monitors the motor temperature of the lifting machine, inverter temperature, control panel temperature, etc.
[0241] このように、この例におけるエレベータ装置は、センサからの情報に基づいてエレべ ータの異常の有無を判定し、異常が検出されたときにかごを停止させるための信号を 出力する異常監視部 (電子安全コントローラ 21)、及び異常監視部における判定処 理に関する情報の履歴が記録される履歴情報記録部を備えている。  [0241] Thus, the elevator apparatus in this example determines the presence or absence of an abnormality in the elevator based on information from the sensor, and outputs a signal for stopping the car when an abnormality is detected. An abnormality monitoring unit (electronic safety controller 21) and a history information recording unit for recording a history of information regarding determination processing in the abnormality monitoring unit are provided.
[0242] 《データバスの異常検出》  [0242] Data bus error detection
次に、図 24は図 1の電子安全コントローラ 21の要部を示すブロック図である。電子 安全コントローラ 21は、メモリデータの異常をチェックするメモリデータ異常チェック回 路 141と、 CPU142と、アドレスバスの異常をチェックする指定アドレス検出回路 143 とを有している。 Next, FIG. 24 is a block diagram showing a main part of the electronic safety controller 21 of FIG. Electronic The safety controller 21 has a memory data abnormality check circuit 141 for checking memory data abnormality, a CPU 142, and a designated address detection circuit 143 for checking an address bus abnormality.
[0243] メモリデータ異常チェック回路 141は、同一アドレス空間に重ねて割り付けられた並 列構成の主メモリ 141a及び副メモリ 141b (RAM)と、副メモリ 14 lbの出力データの 衝突を回避するためのデータバッファ 141cと、主メモリ 141a及び副メモリ 141bの各 データを比較してデータ異常をチヱックするデータ比較回路 141dとを有している。  [0243] The memory data error check circuit 141 is used to avoid collision between the parallel memory main memory 141a and sub memory 141b (RAM) allocated in the same address space and the output data of the sub memory 14 lb. A data buffer 141c and a data comparison circuit 141d for comparing each data of the main memory 141a and the sub memory 141b to check data abnormality are provided.
[0244] また、ここでは図示を省略するが、メモリデータ異常チヱック回路 141は、従来シス テムと同様に、誤り訂正符号チェック回路も有している。  [0244] Although not shown here, the memory data abnormality check circuit 141 also has an error correction code check circuit as in the conventional system.
[0245] CPU142は、データ異常チェック時に指定アドレスを出力するための指定アドレス 出力ソフトウェア 142aと、データバス異常チェック時に実行されるデータバス異常チ エックソフトウェア 142bと、プログラム格納用の ROM (図示せず）とを有している。  [0245] The CPU 142 includes a designated address output software 142a for outputting a designated address at the time of data abnormality check, a data bus abnormality check software 142b executed at the time of data bus abnormality check, and a ROM for storing programs (not shown). ).
[0246] メモリデータ異常チェック回路 141において、主メモリ 141a及び副メモリ 141bは、 それぞれ、アドレスバス BA及びデータバス BDを介して CPU 142に接続され、電子 安全コントローラ 21のデータが CPU142から書き込まれるとともに、 CPU142に読み 出されるようになつている。  [0246] In the memory data abnormality check circuit 141, the main memory 141a and the sub memory 141b are connected to the CPU 142 via the address bus BA and the data bus BD, respectively, and the data of the electronic safety controller 21 is written from the CPU 142. , Read out by CPU142.
[0247] データバス BDは、メモリデータ異常チェック回路 141内で主メモリデータバス BD1 及び副メモリデータバス BD2に分岐されており、主メモリ 141a及び副メモリ 141bは、 それぞれ、主メモリデータバス BD1及び副メモリデータバス BD2を介して、データ比 較回路 141dに接続されている。副メモリデータバス BD2には、データバッファ 141c が介在されている。  The data bus BD is branched into the main memory data bus BD1 and the sub memory data bus BD2 in the memory data abnormality check circuit 141. The main memory 141a and the sub memory 141b are respectively connected to the main memory data bus BD1 The sub-memory data bus BD2 is connected to the data comparison circuit 141d. A data buffer 141c is interposed in the sub memory data bus BD2.
[0248] データ比較回路 141dは、メモリデータの異常チェック時に、主メモリデータバス BD 1及び副メモリデータバス BD2を介して入力される各メモリデータを比較し、メモリデ ータに異常有りと判定した場合にはデータ異常信号 EDを出力する。  [0248] The data comparison circuit 141d compares each memory data input via the main memory data bus BD1 and the sub memory data bus BD2 when checking the memory data for an abnormality, and determines that the memory data is abnormal. In this case, the data error signal ED is output.
[0249] 指定アドレス検出回路 143は、アドレスバス BAを介して CPU142に接続されており 、アドレスバス BAの異常チェック時に指定アドレスを検出し、アドレスバス BAに異常 有りと判定した場合にはアドレスバス異常信号 EBAを出力する。  [0249] The specified address detection circuit 143 is connected to the CPU 142 via the address bus BA. When the address bus BA is checked for abnormality, the specified address is detected, and if it is determined that the address bus BA is abnormal, the address bus Abnormal signal EBA is output.
[0250] CPU142内の指定アドレス出力ソフトウェア 142aは、アドレスバス BAの異常チェッ ク時に動作し、後述するように、指定アドレス検出回路 143に対して周期的に指定ァ ドレスを出力する。 CPU142内のデータバス異常チェックソフトウェア 142bは、デー タバス BDの異常チェック時に動作し、データバス BDに異常有りと判定した場合には データバス異常信号 EBDを出力する。 [0250] The specified address output software 142a in the CPU 142 checks the error of the address bus BA. The designated address is periodically output to the designated address detection circuit 143 as described later. The data bus abnormality check software 142b in the CPU 142 operates when checking the abnormality of the data bus BD, and outputs a data bus abnormality signal EBD when it is determined that there is an abnormality in the data bus BD.
[0251] 図 25は図 24内のデータ異常チェック用のデータ比較回路 141dを具体的に示して おり、複数の排他的オアゲート 151と、アンドゲート 152と、メモリリード信号 RDを用い た D型ラッチ回路 153とにより構成した場合を示している。 [0251] FIG. 25 specifically shows the data comparison circuit 141d for checking data anomaly in FIG. 24. A D-type latch using a plurality of exclusive OR gates 151, AND gates 152, and a memory read signal RD. A case in which the circuit 153 is configured is shown.
[0252] 図 25において、データ比較回路 141dは、並設された排他的オアゲート 151と、排 他的オアゲート 151の各出力信号の論理積をとるアンドゲート 152と、アンドゲート 15In FIG. 25, the data comparison circuit 141d includes an exclusive OR gate 151 provided in parallel, an AND gate 152 that performs an AND operation between the output signals of the exclusive OR gate 151, and an AND gate 15
2の出力信号を D端子入力として H (論理「 1」）レベル信号をデータ異常信号 EDとし て出力する D型ラッチ回路 153とを有している。 A D-type latch circuit 153 that outputs an output signal of 2 as a D terminal input and outputs an H (logic “1”) level signal as a data abnormality signal ED.
[0253] 各排他的オアゲート 151は、主メモリデータバス BD1からのデータを各一方の入力 信号とし、副メモリデータバス BD2からのデータを各一方の入力信号とし、両者が一 致する場合に、それぞれ L (論理「0」）レベル信号を出力し、両者が不一致の場合に[0253] Each exclusive OR gate 151 uses the data from the main memory data bus BD1 as one input signal and the data from the sub memory data bus BD2 as one input signal. Each outputs an L (logic “0”) level signal.
、それぞれ H (論理「1」）レベル信号を出力する。 , Each output H (logic “1”) level signal.
[0254] アンドゲート 152は、各排他的オアゲート 151からの出力信号の反転信号を取り込 み、各入力信号が全て Hレベル (即ち、排他的オアゲート 151の各出力信号が全て L レベル)の場合に、 H (論理「1」）レベル信号を出力する。 [0254] The AND gate 152 takes in the inverted signal of the output signal from each exclusive OR gate 151, and each input signal is all H level (that is, all output signals from the exclusive OR gate 151 are all L level). Output an H (logic “1”) level signal.
[0255] D型ラッチ回路 153は、メモリリード信号 RDに応答して動作するとともに、 D端子入 力（アンドゲート 152の出力信号）に応答して出力信号 (データ異常信号 ED)のレべ ルを変更し、リセット信号 RSTに応答して初期状態にリセットされる。 [0255] The D-type latch circuit 153 operates in response to the memory read signal RD, and at the same time the output signal (data abnormal signal ED) level in response to the D pin input (and gate 152 output signal). Is reset to the initial state in response to the reset signal RST.
[0256] 図 26は図 24内のアドレスバス異常チェック用の指定アドレス検出回路 143を具体 的に示している。 FIG. 26 specifically shows the designated address detection circuit 143 for checking the address bus abnormality in FIG.
[0257] 図 26において、指定アドレス検出回路 143は、 Hレベル信号を一方の入力信号と する複数の排他的オアゲート 161と、 Lレベル信号を一方の入力信号とする複数の 排他的オアゲート 162と、排他的オアゲート 161の各出力信号及びアドレスストロー ブ信号 STRの論理積をとるナンドゲート 163と、排他的オアゲート 162の各出力信号 及びアドレスストローブ信号 STRの論理積をとるナンドゲート 164と、ナンドゲート 16 3の出力信号をセット端子の入力信号とする D型ラッチ回路 165と、ナンドゲート 164 の出力信号をセット端子の入力信号とする D型ラッチ回路 166と、 D型ラッチ回路 16 5, 166の各出力信号の論理積をとるアンドゲート 167と、指定アドレス検出回路 143 のリセット信号 RST1に応答して動作する D型ラッチ回路 168と、指定アドレス検出回 路 143のマスク信号 MSKに応答して動作する D型ラッチ回路 169と、アンドゲート 16 7の出力信号と D型ラッチ回路 169の出力信号との論理和をとるオアゲート 170とを 有している。 In FIG. 26, the designated address detection circuit 143 includes a plurality of exclusive OR gates 161 using the H level signal as one input signal, a plurality of exclusive OR gates 162 using the L level signal as one input signal, A NAND gate 163 that ANDs each output signal of the exclusive OR gate 161 and the address strobe signal STR, a NAND gate 164 that ANDs each output signal of the exclusive OR gate 162 and the address strobe signal STR, and a NAND gate 16 D-type latch circuit 165 using the output signal of 3 as the input signal for the set terminal, D-type latch circuit 166 using the output signal of the NAND gate 164 as the input signal for the set terminal, and outputs of the D-type latch circuits 16 5 and 166 AND gate 167 that takes the logical product of signals, D-type latch circuit 168 that operates in response to reset signal RST1 of specified address detection circuit 143, and D that operates in response to mask signal MSK of specified address detection circuit 143 D A latch circuit 169, and an OR gate 170 that takes the logical sum of the output signal of the AND gate 167 and the output signal of the D-type latch circuit 169.
[0258] 並設された排他的オアゲート 161, 162の各他方の入力端子には、それぞれ、アド レスバス BAを介した指定アドレスが入力されて!、る。  [0258] A designated address via the address bus BA is input to each of the other input terminals of the exclusive OR gates 161 and 162 arranged in parallel.
[0259] 各排他的オアゲート 161は、アドレスバス BA力 入力される指定アドレスが Hレべ ル信号の場合には、それぞれ Lレベル信号を出力し、指定アドレスが Lレベル信号の 場合には、それぞれ Hレベル信号を出力する。 [0259] Each exclusive OR gate 161 outputs an L level signal when the specified address input to the address bus BA is an H level signal, and outputs an L level signal when the specified address is an L level signal. Outputs an H level signal.
[0260] 逆に、各排他的オアゲート 162は、アドレスバス BA力 入力される指定アドレスが[0260] Conversely, each exclusive OR gate 162 receives the address specified by the address bus BA.
Hレベル信号の場合には、それぞれ Hレベル信号を出力し、指定アドレスが Hレベル 信号の場合には、それぞれ Lレベル信号を出力する。 In the case of an H level signal, an H level signal is output, and when the specified address is an H level signal, an L level signal is output.
[0261] 各排他的オアゲート 161の出力信号は、アドレスストローブ信号 STRとともに、レべ ル反転されてナンドゲート 163に入力される。同様に、各排他的オアゲート 162の出 力信号は、アドレスストローブ信号 STRとともに、レベル反転されてナンドゲート 164 に入力される。 [0261] The output signal of each exclusive OR gate 161 is level-inverted and input to the NAND gate 163 together with the address strobe signal STR. Similarly, the output signal of each exclusive OR gate 162 is inverted in level together with the address strobe signal STR and input to the NAND gate 164.
[0262] 従って、アドレスバス BAが健全であれば、ナンドゲート 163, 164は、アドレススト口 ーブ信号 STRに同期して、アドレスバス BAを介して周期的に入力される指定アドレ ス（「FFFF」、 「0000」）により、一定周期毎に、かつ相補的に Hレベル信号を出力す ることになる。  [0262] Therefore, if the address bus BA is healthy, the NAND gates 163 and 164 synchronize with the address storage signal STR and the designated address ("FFFF") periodically input via the address bus BA. ”,“ 0000 ”), the H level signal is output complementarily at regular intervals.
[0263] D型ラッチ回路 168は、 D入力端子に Lレベル信号が印加され、第 1のリセット信号 RST1により動作する。 D型ラッチ回路 168の出力信号は、 D型ラッチ回路 165, 16 6の各リセット端子に印加されている。 D型ラッチ回路 169は、 D入力端子にデータバ ス BDの 0ビット信号（マスク ON時に「0」、マスク OFF時に「1」となる） BTOが印加さ れるとともに、マスク信号 MSKにより動作する。各 D型ラッチ回路 168, 169は、第 2 のリセット信号 RST2により、それぞれリセットされる。 [0263] The D-type latch circuit 168 is operated by the first reset signal RST1 when the L-level signal is applied to the D input terminal. The output signal of the D-type latch circuit 168 is applied to each reset terminal of the D-type latch circuits 165 and 166. The D-type latch circuit 169 is operated by the mask signal MSK while the 0 bit signal of the data bus BD (“0” when the mask is ON and “1” when the mask is OFF) BTO is applied to the D input terminal. Each D-type latch circuit 168, 169 has a second These are reset by the reset signal RST2.
[0264] オアゲート 170は、アンドゲート 167の出力信号又は D型ラッチ回路 169の出力信 号が Hレベルを示す場合に、アドレスバス異常信号 EBAを出力する。  [0264] The OR gate 170 outputs the address bus error signal EBA when the output signal of the AND gate 167 or the output signal of the D-type latch circuit 169 indicates the H level.
[0265] 上記のように構成された電子安全コントローラ 21にお 、ては、メモリデータ異常チェ ック回路 141によるデータ異常チェックのみならず、指定アドレス出力ソフトウェア 14 2a及び指定アドレス検出回路 143によるアドレスノ ス BAの異常チェックと、データバ ス異常チェックソフトウェア 142bによるデータバス BDの異常チェックとが実行される  [0265] In the electronic safety controller 21 configured as described above, not only the data abnormality check by the memory data abnormality check circuit 141 but also the address by the designated address output software 142a and the designated address detection circuit 143 is performed. Abnormality check of nos BA and data bus BD abnormality check by data bus abnormality check software 142b are executed
[0266] 次に、図 24—図 28を参照しながら、上記の 3通りの異常チェック動作について、さ らに具体的に説明する。 [0266] Next, the above three types of abnormality check operations will be described more specifically with reference to FIGS. 24 to 28. FIG.
図 27は図 24の CPU142内の指定アドレス出力ソフトウェア 142aと指定アドレス検 出回路 143とによる処理動作を示すフローチャートであり、アドレスバス BAの異常チ エック時に指定アドレス検出回路 143に指定アドレスを出力するときの動作手順を示 している。  FIG. 27 is a flowchart showing the processing operation by the designated address output software 142a and the designated address detection circuit 143 in the CPU 142 in FIG. 24, and outputs the designated address to the designated address detection circuit 143 when the address bus BA is abnormally checked. The operation procedure is shown.
図 28は図 24の CPU142内のデータバス異常チェックソフトウェア 142bの処理動 作を示すフローチャートである。  FIG. 28 is a flowchart showing the processing operation of the data bus abnormality check software 142b in the CPU 142 of FIG.
[0267] まず、図 24及び図 25を参照しながら、メモリデータ異常チェック回路 141によるデ ータ異常チェック動作にっ 、て説明する。  First, the data abnormality check operation by the memory data abnormality check circuit 141 will be described with reference to FIGS. 24 and 25. FIG.
メモリデータ異常チェック回路 141にお 、て、主メモリ 141a及び副メモリ 141bには 、同一のアドレス空間が重ねて割り付けられており、 CPU142が主メモリ 141a及び副 メモリ 141bにデータを書き込んだ場合には、主メモリ 141a及び副メモリ 141bの同じ アドレスに同じデータがそれぞれ書き込まれる。  In the memory data abnormality check circuit 141, the same address space is allocated to the main memory 141a and the sub memory 141b, and the CPU 142 writes data to the main memory 141a and the sub memory 141b. The same data is written to the same address in the main memory 141a and the sub memory 141b.
[0268] 一方、 CPU142が主メモリ 141a及び副メモリ 141bからデータを読み出した場合に は、主メモリ 141aのデータは、主メモリデータバス BD1上に読み出され、データバス BDを介して CPU142に渡される力 gijメモリ 141bのデータは、 gijメモリデータバス B D2上に読み出されるものの、データバッファ 141cにブロックされるので、データバス BDに送出されない。  [0268] On the other hand, when the CPU 142 reads data from the main memory 141a and the sub memory 141b, the data in the main memory 141a is read onto the main memory data bus BD1 and passed to the CPU 142 via the data bus BD. Forced data The data in the gij memory 141b is read out on the gij memory data bus BD2, but is blocked by the data buffer 141c and is not transmitted to the data bus BD.
[0269] 従って、主メモリ 141a及び副メモリ 141bからの 2つのメモリ出力が衝突することはな ぐ主メモリ 141aのデータのみが CPU142に渡され、正常に書き込みと読み出しとが 実行される。 [0269] Therefore, the two memory outputs from the main memory 141a and the sub memory 141b will not collide. Only the data in the main memory 141a is transferred to the CPU 142, and writing and reading are executed normally.
[0270] この動作と同時に、主メモリデータバス BD1上に読み出された主メモリデータ、及び [0270] Simultaneously with this operation, the main memory data read on the main memory data bus BD1, and
、副メモリデータバス BD2上に読み出された副メモリデータは、データ比較回路 141 dに入力されて両者のデータ比較が行われる。 The sub-memory data read out on the sub-memory data bus BD2 is input to the data comparison circuit 141d to compare the data of both.
[0271] データ比較回路 141dは、データ異常をチ ックし、異常 (データの不一致）が検出 されれば、データ異常信号 EDを出力する。 [0271] The data comparison circuit 141d checks for a data abnormality, and outputs a data abnormality signal ED if an abnormality (data mismatch) is detected.
[0272] 次に、図 24、図 26及び図 27を参照しながら、 CPU142内の指定アドレス出力ソフ トウエア 142aと指定アドレス検出回路 143とによるアドレスバス BAの異常チェック動 作について説明する。 Next, referring to FIGS. 24, 26 and 27, the operation of checking the abnormality of the address bus BA by the designated address output software 142a and the designated address detection circuit 143 in the CPU 142 will be described.
[0273] CPU142は、アドレスバス BAのうち、メモリシステムに使用される全ビット信号の各 々について、「0」、「1」の両方の場合が確認できるチェック用の指定アドレス（例えば 、 8ビットの場合、「FF」と「00」）を用い、指定アドレス出力ソフトウェア 142aを実行す ることにより、図 27の処理 (ステップ S101— S104)を周期的に繰り返し実行する。ま た、これと同時に、アドレスバス BA上に設置された指定アドレス検出回路 143に指定 アドレスを検出させる。指定アドレス検出回路 143は、全ての指定アドレスを検出する ことができない場合に、アドレスバス BAに異常有りと判定し、アドレスバス異常信号 E BAを出力する。  [0273] The CPU 142 uses a designated address for checking (for example, 8 bits) that can be confirmed in both cases of "0" and "1" for each of all the bit signals used in the memory system in the address bus BA. In this case, by using “FF” and “00”) and executing the designated address output software 142a, the processing in FIG. 27 (steps S101 to S104) is periodically and repeatedly executed. At the same time, the designated address detection circuit 143 installed on the address bus BA is caused to detect the designated address. When the designated address detection circuit 143 cannot detect all the designated addresses, the designated address detection circuit 143 determines that there is an abnormality in the address bus BA and outputs an address bus abnormality signal EBA.
[0274] 図 27において、まず、 CPU142は、指定アドレス検出回路 143のマスクを ONして（ ステップ S101)、指定アドレス検出回路 143内の D型ラッチ回路 169を動作させると ともに、 0ビット信号 BTO ( = 0)を D入力端子に印加する。続いて、第 1のリセット信号 RST1により指定アドレス検出回路 143をリセットし (ステップ S102)、D型ラッチ回路 168を動作させる。  In FIG. 27, first, the CPU 142 turns on the mask of the designated address detection circuit 143 (step S101), operates the D-type latch circuit 169 in the designated address detection circuit 143, and operates the 0-bit signal BTO. Apply (= 0) to the D input terminal. Subsequently, the designated address detection circuit 143 is reset by the first reset signal RST1 (step S102), and the D-type latch circuit 168 is operated.
[0275] 次に、アドレスが全て「1」となる最大値のアドレス「FFFF」（又は、アドレスが全て「0 」となる最小値のアドレス「0000」）を読む (ステップ S 103)。最後に、指定アドレス検 出回路 143のマスクを OFFにして（ステップ S104)、 D型ラッチ回路 169の D入力端 子に 0ビット信号 BTO (= 1)を印加し、 D型ラッチ回路 169の動作状態を反転させて 、図 27の処理ルーチンを抜け出る。 [0276] 次に、図 24及び図 28を参照しながら、 CPU142内のデータバス異常チェックソフト ウェア 142bによるデータノ ス BDの異常チェック動作について説明する。 Next, the maximum value address “FFFF” in which all addresses are “1” (or the minimum value address “0000” in which all addresses are “0”) is read (step S 103). Finally, the mask of the specified address detection circuit 143 is turned OFF (step S104), the 0-bit signal BTO (= 1) is applied to the D input terminal of the D type latch circuit 169, and the operation of the D type latch circuit 169 is performed. The state is reversed and the processing routine of FIG. 27 is exited. Next, with reference to FIG. 24 and FIG. 28, the data bus BD abnormality check operation by the data bus abnormality check software 142b in the CPU 142 will be described.
CPU142は、データバス BDのうち、メモリシステムに使用される全ビット信号の各 々について、 「0」、「1」の両方の場合が確認できるチェック用の指定データ (例えば、 8ビットの場合、「AA」及び「55」、又は、「01」、「02」、「04」、「08」、「10」、「20」、「 40」及び「80」などの糸且の値）を用い、図 28の処理 (ステップ S 105— SI 11)によるリ 一ドライトチェック動作を周期的に繰り返し実行する。  The CPU 142, for each of all the bit signals used in the memory system on the data bus BD, can specify both “0” and “1” for checking specified data (for example, in the case of 8 bits, “AA” and “55” or “01”, “02”, “04”, “08”, “10”, “20”, “40” and “80” and other thread values) Then, the read / write check operation by the process of FIG. 28 (steps S 105 to SI 11) is periodically repeated.
[0277] CPU142は、データバス異常チェックソフトウェア 142bによる判定処理において、 全ての指定データが一致しなければ、データバス BDに異常有りと判定し、データバ ス異常信号 EBDを出力する。  [0277] In the determination processing by the data bus abnormality check software 142b, if all the specified data do not match, the CPU 142 determines that there is an abnormality in the data bus BD and outputs a data bus abnormality signal EBD.
[0278] 図 28において、 CPU142は、まず、指定データを特定する変数 Nを「1」に初期設 定し (ステップ S 105)、 N ( = 1)番目の指定データ（ =「01」）を RAM (主メモリ 141a 及び畐 liメモリ 141b)内のテストアドレスに書き込む（ステップ S 106)。続いて、ステップ S12で書き込んだ指定データをテストアドレス力も読み出し (ステップ S107)、書き込 み前の指定データと一致するか否かを判定する (ステップ S 108)。  In FIG. 28, first, the CPU 142 initially sets a variable N for specifying the specified data to “1” (step S 105), and sets the N (= 1) th specified data (= “01”). Write to the test address in RAM (main memory 141a and remote memory 141b) (step S106). Subsequently, the specified data written in step S12 is also read out by the test address (step S107), and it is determined whether or not it matches the specified data before writing (step S108).
[0279] ステップ S108において、読み出し後の指定データが書き込み前の指定データと一 致しない（即ち、 NO)と判定されれば、 CPU142は、データバス BDに異常有りと見 なし、データバス異常信号 EBDを出力して (ステップ S109)、異常終了する。  [0279] If it is determined in step S108 that the designated data after reading does not match the designated data before writing (ie, NO), the CPU 142 does not consider the data bus BD to be abnormal, and the data bus abnormal signal Outputs EBD (step S109) and terminates abnormally.
[0280] 一方、ステップ S108において、読み出し後の指定データが書き込み前の指定デー タと一致する（即ち、 YES)と判定されれば、変数 Nをインクリメントして (ステップ S 11 0)、変数 Nが「8」以下であるか否かを判定する（ステップ SI 11)。  [0280] On the other hand, if it is determined in step S108 that the designated data after reading matches the designated data before writing (ie, YES), variable N is incremented (step S11 0), and variable N Is less than or equal to “8” (step SI 11).
[0281] ステップ S111において、 N≤8 (即ち、 YES)と判定されれば、指定データの書き込 み処理 (ステップ S 106)に戻り、上記処理ステップ S 107— S 110を繰り返し実行する 。即ち、 2番目の指定データ（ =「02」）、 3番目の指定データ（=「02」）、 · · ·、 8番目 の指定データ（=「80」）が、順次 RAM内のテストアドレスに書き込まれ (ステップ S1 06)、それぞれの読み出し後に (ステップ S 107)、一致又は不一致が判定される (ス テツプ S 108)。  If it is determined in step S111 that N≤8 (that is, YES), the process returns to the designated data writing process (step S106), and the above processing steps S107 to S110 are repeatedly executed. That is, the second specified data (= “02”), the third specified data (= “02”),..., The eighth specified data (= “80”) are sequentially assigned to the test addresses in the RAM. Written (step S106) and after each read (step S107), a match or mismatch is determined (step S108).
[0282] 一方、ステップ S111において、 N> 9 (即ち、 NO)と判定されれば、全ての指定デ ータ（N= l— 8)についてデータバス異常チェックが実行され、かつ全ての指定デー タが書き込み前後で一致したものと見なし、 CPU142は、図 28の処理ルーチンを正 常終了する。 On the other hand, if it is determined in step S111 that N> 9 (that is, NO), all the specified data are The data bus error check is executed for the data (N = l-8), and it is considered that all the specified data match before and after the write, and the CPU 142 ends the processing routine of FIG. 28 normally.
[0283] このように、従来システムと同様のメモリデータ異常チェック回路 141による処理に カロえて、メモリ書き込み時及び読み出し時に使用するアドレスバス BA及びデータバ ス BDの周期的な異常チェック処理を実行することにより、異常チェックの信頼性を向 上させることができる。  [0283] In this way, in addition to the processing by the memory data abnormality check circuit 141 similar to the conventional system, the periodic abnormality check processing of the address bus BA and the data bus BD used at the time of memory writing and reading is executed. As a result, the reliability of the abnormality check can be improved.
[0284] 特に、上記異常チェックは、エレベータ電子安全装置におけるメモリシステムの健 全性をチェックする際に有効である。  [0284] In particular, the above abnormality check is effective in checking the health of the memory system in the elevator electronic safety device.
[0285] このように、この例における電子安全コントローラ 21は、指定アドレス出力ソフトゥェ ァ及びデータバス異常チェックソフトウェアを有する CPUと、アドレスバス及びデータ バスを介して CPUに接続された主メモリ及び副メモリと、主メモリ及び副メモリのデー タを比較するメモリデータ異常チェック回路、及びアドレスバスを介して CPUに接続さ れた指定アドレス検出回路とを備え、 CPUは、指定アドレス出力ソフトウェアを実行 するとともに、指定アドレス検出回路を用いて、アドレスバスの異常チェックを周期的 に行い、 CPUは、データノ ス異常チェックソフトウェアを実行するとともに、主メモリ及 び副メモリを用いて、データバスの異常チェックを周期的に行う。  As described above, the electronic safety controller 21 in this example includes the CPU having the designated address output software and the data bus abnormality check software, and the main memory and the sub memory connected to the CPU via the address bus and the data bus. And a memory data abnormality check circuit for comparing data in the main memory and the sub memory, and a designated address detection circuit connected to the CPU via the address bus. The CPU executes designated address output software and The address bus is checked periodically using the specified address detection circuit, and the CPU executes the data node check software and periodically checks the data bus using the main memory and sub memory. Do it.
[0286] また、 CPUは、指定アドレス出力ソフトウェアを実行して、アドレスバスのうち、主メ モリ及び副メモリに使用される全ビット信号の各々について、「0」、 「1」の両方の場合 が確認できるチェック用の指定アドレスを指定アドレス検出回路に周期的に出力し、 指定アドレス検出回路は、 CPU力も周期的に出力される複数の指定アドレスを検出 し、複数の指定アドレスの全てを検出できない場合には、アドレスバスの異常と判定 してアドレスバス異常信号を出力する。  [0286] In addition, the CPU executes the specified address output software, and in the case of both "0" and "1" for all the bit signals used for the main memory and sub memory in the address bus. The specified address for check that can be confirmed is periodically output to the specified address detection circuit, and the specified address detection circuit detects multiple specified addresses that are also output periodically by the CPU power, and detects all of the multiple specified addresses. If not, it is determined that the address bus is abnormal and an address bus error signal is output.
[0287] さらに、 CPUは、データバス異常チェックソフトウェアを実行して、データバスのうち 、主メモリ及び副メモリに使用される全ビット信号の各々について、「0」、 「1」の両方 の場合が確認できるチェック用の指定データを周期的に入出力し、 CPU力 周期的 に出力される複数の指定データを、主メモリ及び副メモリにー且書き込んだ後に読み 出して比較し、書き込み前の複数の指定データと読み出し後の複数の指定データと が全て一致しな 、場合には、データバスの異常と判定してデータバス異常信号を出 力する。 [0287] Further, the CPU executes the data bus error check software, and in the case of both "0" and "1" for all the bit signals used for the main memory and the sub memory in the data bus. The specified data for checking that can be checked periodically is input / output, and the CPU power periodically reads and compares multiple specified data that are output periodically into the main memory and sub memory, and before writing Multiple specified data and multiple specified data after reading If they do not all match, it is determined that the data bus is abnormal and a data bus error signal is output.
[0288] «最寄り階停止動作の監視 »  [0288] «Monitoring the nearest floor stop operation»
次に、図 29は図 1の最寄り階停止指令発生時の電子安全コントローラ 21及びエレ ベータ制御部 11の動作を示すフローチャートである。まず、例えば電子安全コント口 ーラ 21自体の故障など、力ごを最寄り階停止させるべき異常が電子安全コントローラ 21により検出されると (ステップ S121)、電子安全コントローラ 21からエレベータ制御 部 11の運転制御部 12に対して最寄り階停止指令信号が出力される (ステップ S 122 )。これにより、運転制御部 12は、力ごを最寄り階に停止するための処理を実行する（ ステップ S 123)。  Next, FIG. 29 is a flowchart showing operations of the electronic safety controller 21 and the elevator control unit 11 when the nearest floor stop command is generated in FIG. First, when the electronic safety controller 21 detects an abnormality that should stop the force on the nearest floor, for example, a failure of the electronic safety controller 21 itself (step S121), the electronic safety controller 21 operates the elevator controller 11. The nearest floor stop command signal is output to the control unit 12 (step S 122). Thereby, the operation control part 12 performs the process for stopping a force on the nearest floor (step S123).
[0289] また、電子安全コントローラ 21では、最寄り階停止指令信号の出力と同時に、内蔵 の非常停止タイマを起動し、非常停止タイマによるカウントを開始する (ステップ S12 4)。非常停止タイマは、予め設定された時間 (最寄り階停止を完了するのに十分な 時間）が経過するとタイムアップする。非常停止タイマがタイムアップすると、電子安 全コントローラ 21からエレベータ制御部 11の安全回路部 13に対して非常停止指令 が出力される (ステップ S125)。これにより、エレベータ制御部 11は、非常停止動作 を行う（ステップ S 126)。  [0289] At the same time as the nearest floor stop command signal is output, the electronic safety controller 21 starts the built-in emergency stop timer and starts counting by the emergency stop timer (step S124). The emergency stop timer expires when the preset time (the time sufficient to complete the nearest floor stop) has elapsed. When the emergency stop timer expires, an emergency stop command is output from the electronic safety controller 21 to the safety circuit unit 13 of the elevator control unit 11 (step S125). Thereby, the elevator control unit 11 performs an emergency stop operation (step S126).
[0290] 電子安全コントローラ 21からの最寄り階停止指令によりかごが最寄り階に正常に停 止された場合、非常停止タイマのタイムアップ時には、かごは停止しており、駆動装 置 7のブレーキ部 9は制動状態である。従って、非常停止指令が出力されても、実質 的な変化は生じない。これに対して、万一、エレベータ制御部 11側の異常により、電 子安全コントローラ 21からの最寄り階停止指令によりかごが最寄り階に停止されない 場合、非常停止タイマのタイムアップ時にかごは非常停止されることになる。  [0290] If the car is normally stopped at the nearest floor by the nearest floor stop command from the electronic safety controller 21, the car is stopped when the emergency stop timer expires, and the brake unit 9 of the drive unit 7 Is a braking state. Therefore, even if an emergency stop command is output, no substantial change occurs. On the other hand, if the car is not stopped at the nearest floor due to a stop command from the electronic safety controller 21 due to an abnormality on the elevator control unit 11, the car will be emergency stopped when the emergency stop timer expires. Will be.
[0291] 図 30は図 1の電子安全コントローラ 21及びエレベータ制御部 11の要部を示す回 路図である。電子安全コントローラ 21には、上記の非常停止タイマとして機能する非 常停止タイマ回路部 171が設けられている。非常停止タイマ回路部 171は、電子安 全コントローラ 21内のソフトウェアプログラム力も独立したハードウェア回路により構 成されている。 [0292] 最寄り階停止出力ポート 172からの指令は、第 1のトランジスタ 173と、非常停止タ イマ回路部 171とに同時に入力される。第 1のトランジスタ 173に最寄り階停止指令 が入力されると、第 1のリレー部 174がオフにされ、運転制御部 12に最寄り階停止指 令信号が入力される。 FIG. 30 is a circuit diagram showing the main parts of the electronic safety controller 21 and the elevator control unit 11 of FIG. The electronic safety controller 21 is provided with an emergency stop timer circuit unit 171 that functions as the emergency stop timer. The emergency stop timer circuit unit 171 is configured by a hardware circuit having an independent software program capability in the electronic safety controller 21. [0292] The command from the nearest floor stop output port 172 is simultaneously input to the first transistor 173 and the emergency stop timer circuit unit 171. When the nearest floor stop command is input to the first transistor 173, the first relay unit 174 is turned off, and the nearest floor stop command signal is input to the operation control unit 12.
[0293] 非常停止タイマ回路部 171に最寄り階停止指令が入力されると、カウントが開始さ れる。非常停止タイマ回路部 171のカウントがタイムアップした場合、又は非常停止 出力ポート 175から非常停止指令が出力された場合、第 2のトランジスタ 176がオフ にされ、第 2のリレー部 177がオフにされ、非常停止指令が安全回路部 13に入力、 即ち安全回路部 13が遮断される。これにより、駆動装置 7の駆動電源コンタクタとブ レーキ電源コンタクタとが落ち、かごが非常停止される。  [0293] When the nearest floor stop command is input to the emergency stop timer circuit 171, the count starts. When the count of the emergency stop timer circuit part 171 is up or when an emergency stop command is output from the emergency stop output port 175, the second transistor 176 is turned off and the second relay part 177 is turned off. The emergency stop command is input to the safety circuit unit 13, that is, the safety circuit unit 13 is shut off. As a result, the drive power contactor and the brake power contactor of the drive device 7 are dropped, and the car is emergency stopped.
[0294] このようなエレベータ装置によれば、エレベータ制御部 11による最寄り階停止が万 一正常に実行できない場合にも、電子安全コントローラ 21により異常が検出されたま まかごが運転され続けるのを防止することができる。また、電子安全コントローラ 21の 故障検出時に、直ちに非常停止が実行されるわけではなぐエレベータ制御部 11が 正常であれば最寄り階停止が実行されるため、電子安全コントローラ 21の故障で乗 客がかごに閉じこめられることがない。  [0294] According to such an elevator apparatus, even if the nearest floor stop by the elevator control unit 11 cannot be normally executed, it is possible to prevent the electric car from being continuously operated even if the abnormality is detected by the electronic safety controller 21. can do. In addition, when the electronic safety controller 21 detects a failure, emergency stop is not immediately executed.If the elevator control unit 11 is normal, the nearest floor stop is executed. It is not confined to.
[0295] なお、非常停止タイマ回路部 171の健全性のチェックは、周期的かつ自動的に実 施されるのが好適である。非常停止タイマ回路部 171の健全性のチェックは、例えば 1日 1回、所定時間かご呼びが登録されずに自動消灯モードに入ったときに行えばよ い。  [0295] It should be noted that the soundness check of the emergency stop timer circuit section 171 is preferably performed periodically and automatically. The soundness check of the emergency stop timer circuit 171 may be performed once a day, for example, when the car call is not registered and enters the automatic turn-off mode for a predetermined time.
健全性チェックの流れとしては、まず、エレベータ制御部 11から健全性チェックの 受け入れ許可を知らせる信号が電子安全コントローラ 21に入力される。この許可信 号を受けて、電子安全コントローラ 21からエレベータ制御部 11に、チェック開始を知 らせる信号が入力され、続いて最寄り階停止指令が入力される。そして、エレベータ 制御部 11から電子安全コントローラ 21に対して、チェック結果の良否を知らせる信号 が戻される。  As a flow of the sanity check, first, a signal notifying the acceptance of the sanity check is input from the elevator control unit 11 to the electronic safety controller 21. In response to this permission signal, the electronic safety controller 21 inputs a signal notifying the start of the check to the elevator control unit 11, and subsequently inputting the nearest floor stop command. Then, a signal notifying the quality of the check result is returned from the elevator control unit 11 to the electronic safety controller 21.
チェック終了後には、非常停止タイマ回路部 171がハードウェアリセットにより復帰 され、第 2のリレー部 177がオンにされる。  After the check is completed, the emergency stop timer circuit unit 171 is restored by hardware reset, and the second relay unit 177 is turned on.

Claims

請求の範囲 The scope of the claims
[1] 力ごの運転を制御するエレベータ制御部、及び  [1] An elevator control unit for controlling the operation of the force, and
エレベータの異常を検出し、エレベータを安全な状態に移行させるための指令信 号を発生する電子安全コントローラ  Electronic safety controller that detects elevator abnormalities and generates command signals to shift the elevator to a safe state
を備え、  With
上記電子安全コントローラは、上記電子安全コントローラ自体の異常を検出可能で あり、上記電子安全コントローラ自体の異常を検出した場合には、上記かごを最寄り 階に停止させるための最寄り階停止指令を上記エレベータ制御部に出力するととも に、上記最寄り階停止指令の出力から予め設定された時間が経過すると、上記かご を非常停止させるための非常停止指令を上記エレベータ制御部に出力するエレべ ータ装置。  The electronic safety controller can detect an abnormality in the electronic safety controller itself, and if an abnormality is detected in the electronic safety controller itself, a command for stopping the nearest floor to stop the car on the nearest floor is sent to the elevator. An elevator device that outputs an emergency stop command for emergency stop of the car to the elevator control unit when a preset time has elapsed from the output of the nearest floor stop command as well as outputting to the control unit.
[2] 最寄り階停止指令の出力力も非常停止指令の出力までの時間は、上記力ごの最 寄り階への停止が完了するのに十分な時間に設定されている請求項 1記載のエレべ ータ装置。  [2] The elevator according to claim 1, wherein the output time of the nearest floor stop command and the time until the emergency stop command is output are set to a time sufficient to complete the stop of the force to the nearest floor. Data device.
[3] 上記電子安全コントローラは、最寄り階停止指令の出力から非常停止指令の出力 までの時間をカウントするための非常停止タイマを有し、上記非常停止タイマは、ノヽ 一ドウエア回路により構成されている請求項 1記載のエレベータ装置。  [3] The electronic safety controller has an emergency stop timer for counting the time from the output of the nearest floor stop command to the output of the emergency stop command, and the emergency stop timer is configured by a noise circuit. The elevator apparatus according to claim 1.
[4] 上記電子安全コントローラ及び上記エレベータ制御部は、上記非常停止タイマの 健全性チェックを周期的かつ自動的に実施可能である請求項 3記載のエレベータ装 置。  [4] The elevator apparatus according to claim 3, wherein the electronic safety controller and the elevator control unit can periodically and automatically check the soundness of the emergency stop timer.
PCT/JP2005/003132 2005-02-25 2005-02-25 Elevator apparatus WO2006090470A1 (en)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2007504602A JP4757863B2 (en) 2005-02-25 2005-02-25 Elevator equipment
CNB2005800349327A CN100542927C (en) 2005-02-25 2005-02-25 Lift appliance
PCT/JP2005/003132 WO2006090470A1 (en) 2005-02-25 2005-02-25 Elevator apparatus
EP05719533.1A EP1852382B1 (en) 2005-02-25 2005-02-25 Elevator apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2005/003132 WO2006090470A1 (en) 2005-02-25 2005-02-25 Elevator apparatus

Publications (1)

Publication Number Publication Date
WO2006090470A1 true WO2006090470A1 (en) 2006-08-31

Family

ID=36927121

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2005/003132 WO2006090470A1 (en) 2005-02-25 2005-02-25 Elevator apparatus

Country Status (4)

Country Link
EP (1) EP1852382B1 (en)
JP (1) JP4757863B2 (en)
CN (1) CN100542927C (en)
WO (1) WO2006090470A1 (en)

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009157085A1 (en) * 2008-06-27 2009-12-30 三菱電機株式会社 Elevator apparatus and operating method thereof
JP2011121726A (en) * 2009-12-11 2011-06-23 Hitachi Ltd Electronic safety elevator
JP2012082059A (en) * 2010-10-14 2012-04-26 Hitachi Ltd Electronic safety elevator
US8272482B2 (en) 2007-06-14 2012-09-25 Mitsubishi Electric Corporation Elevator apparatus for braking control of car according to detected content of failure
JP5404787B2 (en) * 2009-06-29 2014-02-05 三菱電機株式会社 Elevator equipment
JP2014504243A (en) * 2010-12-14 2014-02-20 コネ コーポレイション Interface unit and transfer system and method
JP2014118290A (en) * 2012-12-19 2014-06-30 Hitachi Ltd Electronic safety elevator
US9108823B2 (en) 2010-03-12 2015-08-18 Mitsubishi Electric Corporation Elevator safety control device
WO2016113895A1 (en) * 2015-01-16 2016-07-21 三菱電機株式会社 Elevator safety control device and elevator safety control method
JP2018011444A (en) * 2016-07-14 2018-01-18 日立オートモティブシステムズ株式会社 Control diagnosis system and control diagnosis method for electric motor
WO2018020662A1 (en) * 2016-07-29 2018-02-01 三菱電機株式会社 Elevator control device
US10071881B2 (en) 2013-12-12 2018-09-11 Otis Elevator Company Safety system for use in a drive system
CN112299175A (en) * 2019-07-26 2021-02-02 富士达株式会社 Elevator encoder diagnosis system and diagnosis method
WO2021176547A1 (en) * 2020-03-03 2021-09-10 株式会社日立製作所 Elevator safety control system and elevator using same
JP7063410B1 (en) 2021-08-30 2022-05-09 フジテック株式会社 lift device
JP7279836B1 (en) 2022-06-03 2023-05-23 フジテック株式会社 CONTROL DEVICE, CONTROL METHOD, AND PASSENGER TRANSPORT CONTROL DEVICE

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2765107B1 (en) 2006-03-17 2015-03-11 Mitsubishi Electric Corporation Elevator apparatus
KR101338843B1 (en) * 2009-12-15 2013-12-06 미쓰비시덴키 가부시키가이샤 Elevator device
EP2336073A1 (en) * 2009-12-18 2011-06-22 Inventio AG Switching device for a conveyor system
JP5422488B2 (en) * 2010-05-31 2014-02-19 株式会社日立製作所 Safety elevator
FI122474B (en) 2010-12-01 2012-02-15 Kone Corp LIFT SAFETY CONNECTION AND METHOD FOR DETERMINING THE FUNCTIONAL FAILURE OF A LIFT SAFETY CONNECTION
US8794389B2 (en) * 2011-06-30 2014-08-05 Tyco Fire & Security Gmbh Interface between fire panel and elevator controller
JP5773893B2 (en) * 2012-01-10 2015-09-02 東芝エレベータ株式会社 Passenger conveyor safety device and safety system
JP2013241225A (en) * 2012-05-17 2013-12-05 Mitsubishi Electric Corp Apparatus and method for controlling passenger conveyor
CN104583017B (en) 2012-08-24 2016-11-16 三菱电机株式会社 Vehicular communication system and vehicle-mounted communication method
JP5393932B1 (en) * 2013-03-01 2014-01-22 三菱電機株式会社 Data processing apparatus and communication system
JP6317077B2 (en) * 2013-07-05 2018-04-25 株式会社日立製作所 Elevator safety system
TWI530954B (en) * 2013-11-22 2016-04-21 新唐科技股份有限公司 Apparatuses for securing software code stored in a non-volatile memory
ES2538418B1 (en) * 2013-12-19 2016-04-14 Orona, S. Coop. Security control system of an elevator, escalator or mobile platform
EP3178768A1 (en) 2015-12-07 2017-06-14 Kone Corporation Drive device
PL3519338T3 (en) 2016-09-29 2021-07-05 Inventio Ag Elevator safety supervising entity with two units having an option for e.g. autonomous passenger evacuation
EP3539913B1 (en) 2018-03-16 2021-04-28 Otis Elevator Company Automatic rescue operation in an elevator system
CN108750844B (en) * 2018-05-21 2020-06-26 日立楼宇技术（广州）有限公司 Calling elevator type identification method and system, identification device and readable storage medium
EP3656718A1 (en) * 2018-11-23 2020-05-27 Otis Elevator Company Elevator safety system with self-diagnostic functionality
EP4121383B1 (en) * 2020-03-19 2023-10-04 Elgo Batscale AG Control unit for a lift system
TW202229150A (en) * 2021-01-25 2022-08-01 永大機電工業股份有限公司 Elevator control module for automatic rescue
CN115535812A (en) * 2021-06-30 2022-12-30 奥的斯电梯公司 Elevator safety system, elevator system and elevator safety control method

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS5450769A (en) * 1977-09-30 1979-04-20 Hitachi Ltd Trouble diagnosing memory system
JPS5943780A (en) * 1982-09-07 1984-03-10 株式会社東芝 Method of controlling explosion preventive elevator
JPS61162473A (en) * 1985-01-14 1986-07-23 三菱電機株式会社 Controller for elevator
JPH05132256A (en) * 1991-11-05 1993-05-28 Hitachi Ltd Elevator controller and remote supervisory system thereof
JP2002538061A (en) * 1999-03-04 2002-11-12 オーチス エレベータ カンパニー Elevator safety system

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3587785A (en) * 1969-03-04 1971-06-28 Otis Elevator Co Elevator control system safety arrangement
JPS58177864A (en) 1982-04-07 1983-10-18 株式会社日立製作所 Controller for alternating current elevator
JPH0729746B2 (en) 1984-01-11 1995-04-05 株式会社日立製作所 Elevator emergency stop control device
JPH01247382A (en) 1988-03-30 1989-10-03 Hitachi Ltd System for controlling elevator
US4898263A (en) * 1988-09-12 1990-02-06 Montgomery Elevator Company Elevator self-diagnostic control system
US5407028A (en) 1993-04-28 1995-04-18 Otis Elevator Company Tested and redundant elevator emergency terminal stopping capability
DE19513851C2 (en) 1995-04-12 1997-02-27 Joerg Ammann Safety device for a circulation elevator for the transportation of people
DE60218043T2 (en) 2001-07-02 2007-09-13 Hitachi Ltd. SUGAR CHAIN SYNTHESIS DEVICE

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS5450769A (en) * 1977-09-30 1979-04-20 Hitachi Ltd Trouble diagnosing memory system
JPS5943780A (en) * 1982-09-07 1984-03-10 株式会社東芝 Method of controlling explosion preventive elevator
JPS61162473A (en) * 1985-01-14 1986-07-23 三菱電機株式会社 Controller for elevator
JPH05132256A (en) * 1991-11-05 1993-05-28 Hitachi Ltd Elevator controller and remote supervisory system thereof
JP2002538061A (en) * 1999-03-04 2002-11-12 オーチス エレベータ カンパニー Elevator safety system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1852382A4 *

Cited By (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8272482B2 (en) 2007-06-14 2012-09-25 Mitsubishi Electric Corporation Elevator apparatus for braking control of car according to detected content of failure
WO2009157085A1 (en) * 2008-06-27 2009-12-30 三菱電機株式会社 Elevator apparatus and operating method thereof
KR101218022B1 (en) * 2008-06-27 2013-01-02 미쓰비시덴키 가부시키가이샤 Elevator apparatus and operating method thereof
US8430212B2 (en) 2008-06-27 2013-04-30 Mitsubishi Electric Corporation Safety control device for an elevator apparatus and operating method thereof
JP5197745B2 (en) * 2008-06-27 2013-05-15 三菱電機株式会社 Elevator apparatus and operation method thereof
US8887873B2 (en) 2009-06-29 2014-11-18 Mitsubishi Electric Corporation Elevator device
JP5404787B2 (en) * 2009-06-29 2014-02-05 三菱電機株式会社 Elevator equipment
JP2011121726A (en) * 2009-12-11 2011-06-23 Hitachi Ltd Electronic safety elevator
US9108823B2 (en) 2010-03-12 2015-08-18 Mitsubishi Electric Corporation Elevator safety control device
CN102452595A (en) * 2010-10-14 2012-05-16 株式会社日立制作所 Electronic safe elevator
JP2012082059A (en) * 2010-10-14 2012-04-26 Hitachi Ltd Electronic safety elevator
JP2014504243A (en) * 2010-12-14 2014-02-20 コネ コーポレイション Interface unit and transfer system and method
JP2016041631A (en) * 2010-12-14 2016-03-31 コネ コーポレイションＫｏｎｅ Ｃｏｒｐｏｒａｔｉｏｎ Interface unit, conveying system, and method
JP2014118290A (en) * 2012-12-19 2014-06-30 Hitachi Ltd Electronic safety elevator
US10071881B2 (en) 2013-12-12 2018-09-11 Otis Elevator Company Safety system for use in a drive system
WO2016113895A1 (en) * 2015-01-16 2016-07-21 三菱電機株式会社 Elevator safety control device and elevator safety control method
JPWO2016113895A1 (en) * 2015-01-16 2017-04-27 三菱電機株式会社 Elevator safety control device and elevator safety control method
DE112015005972B4 (en) 2015-01-16 2021-12-02 Mitsubishi Electric Corporation ELEVATOR SAFETY CONTROL DEVICE AND ELEVATOR SAFETY SAFETY CONTROL PROCEDURES
JP2018011444A (en) * 2016-07-14 2018-01-18 日立オートモティブシステムズ株式会社 Control diagnosis system and control diagnosis method for electric motor
WO2018020662A1 (en) * 2016-07-29 2018-02-01 三菱電機株式会社 Elevator control device
JPWO2018020662A1 (en) * 2016-07-29 2018-11-08 三菱電機株式会社 Elevator control device
CN112299175A (en) * 2019-07-26 2021-02-02 富士达株式会社 Elevator encoder diagnosis system and diagnosis method
JP2021020763A (en) * 2019-07-26 2021-02-18 フジテック株式会社 Encoder diagnostic system of elevator and diagnostic method
WO2021176547A1 (en) * 2020-03-03 2021-09-10 株式会社日立製作所 Elevator safety control system and elevator using same
JP7063410B1 (en) 2021-08-30 2022-05-09 フジテック株式会社 lift device
JP2023034211A (en) * 2021-08-30 2023-03-13 フジテック株式会社 Lifting device
JP7279836B1 (en) 2022-06-03 2023-05-23 フジテック株式会社 CONTROL DEVICE, CONTROL METHOD, AND PASSENGER TRANSPORT CONTROL DEVICE
JP2023178072A (en) * 2022-06-03 2023-12-14 フジテック株式会社 Control device, control method, and passenger transport control device

Also Published As

Publication number Publication date
JPWO2006090470A1 (en) 2008-07-24
EP1852382B1 (en) 2015-12-30
CN101039864A (en) 2007-09-19
EP1852382A1 (en) 2007-11-07
EP1852382A4 (en) 2013-01-30
CN100542927C (en) 2009-09-23
JP4757863B2 (en) 2011-08-24

Similar Documents

Publication Publication Date Title
JP4757863B2 (en) Elevator equipment
JP5350590B2 (en) Elevator equipment
JP6263552B2 (en) Elevator safety system
CN105829232B (en) Security system for lift facility
EP2671836B1 (en) Safety control device for elevator
JP5624845B2 (en) Electronic safety elevator
US20190300337A1 (en) Elevator with safety chain overlay control unit with a safety plc separately monitoring various safety switches for increasing a safety integrity level
JP5404787B2 (en) Elevator equipment
JP6743172B2 (en) Elevator control device, control method, and elevator
JP7181416B2 (en) Discharge control circuit and power converter
JP6132976B2 (en) Elevator control device
JP7285070B2 (en) Platform door condition diagnosis system, platform door condition diagnosis method, mobile device condition diagnosis method
KR100894371B1 (en) Elevator apparatus
KR20070012457A (en) Elevator apparatus
CN111295350B (en) Safety monitoring device for monitoring safety-critical states in a people conveyor and method for operating such a safety monitoring device
JPS6223712B2 (en)
JP5388801B2 (en) Elevator earthquake recovery diagnosis operation device
JPH05132256A (en) Elevator controller and remote supervisory system thereof
JP6230729B2 (en) Elevator safety control device and elevator safety control method
JP2005343602A (en) Elevator controller
KR0167209B1 (en) Helping out operation control method and equipment for elevator
JPH06114600A (en) Abnormality supervising device of press machine
CN114488991A (en) Robot safety monitoring system and method for diagnosing abnormity thereof
JPH0321472B2 (en)

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2007504602

Country of ref document: JP

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2005719533

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 1020067023266

Country of ref document: KR

WWP Wipo information: published in national office

Ref document number: 1020067023266

Country of ref document: KR

WWE Wipo information: entry into national phase

Ref document number: 200580034932.7

Country of ref document: CN

NENP Non-entry into the national phase

Ref country code: DE

WWP Wipo information: published in national office

Ref document number: 2005719533

Country of ref document: EP