WO2006090470A1 - Ascenseur - Google Patents

Ascenseur Download PDF

Info

Publication number
WO2006090470A1
WO2006090470A1 PCT/JP2005/003132 JP2005003132W WO2006090470A1 WO 2006090470 A1 WO2006090470 A1 WO 2006090470A1 JP 2005003132 W JP2005003132 W JP 2005003132W WO 2006090470 A1 WO2006090470 A1 WO 2006090470A1
Authority
WO
WIPO (PCT)
Prior art keywords
circuit
abnormality
signal
output
elevator
Prior art date
Application number
PCT/JP2005/003132
Other languages
English (en)
Japanese (ja)
Inventor
Tatsuo Matsuoka
Original Assignee
Mitsubishi Denki Kabushiki Kaisha
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Family has litigation
First worldwide family litigation filed litigation Critical https://patents.darts-ip.com/?family=36927121&utm_source=google_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=WO2006090470(A1) "Global patent litigation dataset” by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
Application filed by Mitsubishi Denki Kabushiki Kaisha filed Critical Mitsubishi Denki Kabushiki Kaisha
Priority to JP2007504602A priority Critical patent/JP4757863B2/ja
Priority to CNB2005800349327A priority patent/CN100542927C/zh
Priority to PCT/JP2005/003132 priority patent/WO2006090470A1/fr
Priority to EP05719533.1A priority patent/EP1852382B1/fr
Publication of WO2006090470A1 publication Critical patent/WO2006090470A1/fr

Links

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0006—Monitoring devices or performance analysers
    • B66B5/0018—Devices monitoring the operating condition of the elevator system
    • B66B5/0031—Devices monitoring the operating condition of the elevator system for safety reasons
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0087—Devices facilitating maintenance, repair or inspection tasks
    • B66B5/0093—Testing of safety devices
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/02—Applications of checking, fault-correcting, or safety devices in elevators responsive to abnormal operating conditions
    • B66B5/027—Applications of checking, fault-correcting, or safety devices in elevators responsive to abnormal operating conditions to permit passengers to leave an elevator car in case of failure, e.g. moving the car to a reference floor or unlocking the door

Definitions

  • the present invention relates to an elevator apparatus using an electronic safety controller that detects an abnormality of an elevator based on a sensor force detection signal.
  • Patent Document 1 Japanese Translation of Special Publication 2002-538061
  • the present invention has been made to solve the above-described problems, and an object thereof is to obtain an elevator apparatus that can improve the reliability of a safety system with a relatively simple configuration.
  • An elevator apparatus includes an elevator control unit that controls operation of a force, and an electronic safety controller that detects an abnormality of the elevator and generates a command signal for shifting the elevator to a safe state.
  • the electronic safety controller can detect an abnormality in the electronic safety controller itself, and if an abnormality is detected in the electronic safety controller itself, it issues an elevator command for stopping the nearest floor to stop the force on the nearest floor. In addition to outputting to the control unit, the output power of the nearest floor stop command When a preset time has elapsed, an emergency stop command for emergency stop of the force is output to the elevator control unit.
  • FIG. 1 A configuration diagram illustrating an elevator apparatus according to Embodiment 1 of the present invention.
  • FIG. 2 is a graph showing an overspeed pattern set in the governor and ETS circuit section of FIG.
  • FIG. 3 is a block diagram showing the connection relationship of the electronic safety controller, elevator control panel and various sensors shown in FIG. 1.
  • FIG. 4 is a block diagram showing a device configuration of a main part of the electronic safety controller of FIG. 1.
  • FIG. 5 is an explanatory diagram showing a method for executing arithmetic processing by the microprocessor of FIG. 4;
  • FIG. 6 is a block diagram showing a main part of the electronic safety controller of FIG.
  • FIG. 7 is a configuration diagram showing a specific configuration of the clock abnormality detection circuit of FIG.
  • FIG. 8 is an explanatory diagram showing an area division in the RAM of the electronic safety controller of FIG.
  • FIG. 9 is a flowchart showing an initial operation of the electronic safety controller of FIG.
  • FIG. 10 is a flowchart showing a first example of an interrupt calculation flow of the electronic safety controller of FIG. 1.
  • FIG. 11 is a block diagram showing a main part of the electronic safety controller of FIG. 1.
  • FIG. 12 is a block diagram showing a main part of the electronic safety controller of FIG.
  • FIG. 13 is a circuit diagram showing an example of a specific configuration of the chip function circuit of FIG.
  • FIG. 14 is an explanatory diagram showing the meaning of data related to each bit of the data bus when the check function circuit of FIG. 12 is subjected to the first and second CPU cards.
  • FIG. 15 is a flowchart showing the power supply voltage monitoring soundness check method on the first CPU side in FIG.
  • FIG. 16 is a flowchart showing an operation when the CPU is reset in the elevator control device of FIG.
  • FIG. 17 is an explanatory diagram showing the relationship between the stage of the initial setting operation of the ETS circuit section of FIG. 1 and the operation of the operation control section and the safety circuit section.
  • FIG. 18 is an explanatory diagram for explaining the movement of the force in the initial setting operation mode of the elevator apparatus of FIG.
  • FIG. 19 is a circuit diagram showing a contact abnormality detection unit of the electronic safety controller of FIG. 20 is a flowchart for explaining an operation test method for the safety relay main contact of FIG.
  • FIG. 21 is a block diagram showing a state where a history information recording unit and a soundness diagnosis unit are connected to the electronic safety controller of FIG.
  • FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit of FIG.
  • FIG. 23 is a flowchart for explaining the operation of the electronic safety controller of FIG. 21.
  • FIG. 24 is a block diagram showing a main part of the electronic safety controller of FIG. 1.
  • FIG. 25 is a circuit diagram specifically showing a data comparison circuit for data abnormality check in FIG. 24.
  • FIG. 26 is a circuit diagram specifically showing a designated address detection circuit for checking an address bus abnormality in FIG. 24.
  • FIG. 27 is a flowchart showing processing operations by designated address output software and a designated address detection circuit in the CPU of FIG.
  • FIG. 28 is a flowchart showing the processing operation of the data bus abnormality check software in the CPU of FIG. 24.
  • FIG. 29 is a flowchart showing the operation of the electronic safety controller and the elevator controller when the nearest floor stop command is generated in FIG.
  • FIG. 30 is a circuit diagram showing the main parts of the electronic safety controller and elevator control unit of FIG. 1.
  • FIG. 1 is a configuration diagram showing an elevator apparatus according to Embodiment 1 of the present invention.
  • a pair of car guide rails 2 and a counterweight guide rail (not shown) are installed in the hoistway 1.
  • the force 3 is guided by the car guide rail 2 and moved up and down in the hoistway 1.
  • the counterweight 4 is raised and lowered in the hoistway 1 by being guided by the counterweight guide rail.
  • an emergency stop device 5 that engages with the force car guide rail 2 and makes the car 3 stop emergency is mounted.
  • the emergency stop device 5 has a pair of braking pieces (wedge members) 6 that are operated by mechanical operation and pressed against the car guide rail 2.
  • a driving device (lifting machine) 7 for raising and lowering the force 3 and the counterweight 4 via a main rope is installed.
  • the drive unit 7 generates a detection signal corresponding to the rotation of the drive sheave 8, the motor unit (not shown) that rotates the drive sheave 8, the brake unit 9 that brakes the rotation of the drive sheave 8, and the drive sheave 8.
  • a motor encoder 10 is provided.
  • an electromagnetic brake device is used as the brake unit 9, for example.
  • the brake shoe is pressed against the braking surface by the spring force of the braking spring to brake the rotation of the drive sheave 8, and the brake magnet is separated from the braking surface force by exciting the electromagnetic magnet. And braking is released.
  • the elevator control panel 11 is disposed, for example, in the lower part of the hoistway 1 or the like.
  • the elevator control panel 11 is provided with an operation control unit 12 for controlling the operation of the drive device 7 and a safety circuit unit (relay circuit unit) 13 for suddenly stopping the car 3 when the elevator is abnormal. Yes.
  • a detection signal from the motor encoder 10 is input to the operation control unit 12.
  • the operation control unit 12 obtains the position and speed of the car 3 based on the detection signal from the motor encoder 10 and controls the driving device 7.
  • a speed governor (mechanical speed governor) 14 is installed in the upper part of the hoistway 1.
  • the governor 14 is provided with a governor sheave 15, an overspeed detection switch 16, a rope catch 17, and a governor encoder 18 as a sensor.
  • a governor rope 19 is wound around the governor sheave 15. Both ends of the governor rope 19 are connected to the operation mechanism of the safety device 5.
  • the lower end portion of the governor rope 19 is wound around a tension wheel 20 disposed at the lower part of the hoistway 1.
  • V 1st overspeed (OS speed), higher than 1st overspeed !, 2nd overspeed (Trip speed) are set.
  • the overspeed detection switch 16 When the traveling speed of the force 3 reaches the first overspeed, the overspeed detection switch 16 is operated. When the overspeed detection switch 16 is operated, the relay circuit of the safety circuit unit 13 is opened. When the traveling speed of the force 3 reaches the second overspeed, the rope catcher 17 grips the governor group 19 and the circulation of the governor rope 19 is stopped. When the circulation of the governor rope 19 is stopped, the emergency stop device 5 is braked.
  • the governor encoder 18 generates a detection signal corresponding to the rotation of the governor sheave 15.
  • the governor encoder 18 is a dual sense type encoder that outputs two detection signals, that is, first and second detection signals simultaneously.
  • the first and second detection signals from the governor encoder 18 are input to the ETS circuit unit 22 of the terminal floor forced reduction device (ETS device) provided in the electronic safety controller 21.
  • the ETS circuit unit 22 detects an abnormality of the elevator based on the detection signal from the governor encoder 18 and outputs a command signal for shifting the elevator to a safe state. Specifically, the ETS circuit unit 22 obtains the traveling speed and position of the car 3 independently of the operation control unit 12 based on a signal from the governor encoder 18, and the traveling of the car 3 near the terminal floor is performed. Monitor whether the speed has reached ETS monitoring overspeed.
  • the ETS circuit unit 22 converts the signal from the governor encoder 18 into a digital signal and performs digital arithmetic processing, so that the traveling speed of the force 3 reaches the ETS monitoring overspeed. Judge whether. When the ETS circuit unit 22 determines that the traveling speed of the car 3 has reached the ETS monitoring overspeed, the relay circuit of the safety circuit unit 13 is opened.
  • the ETS circuit unit 22 can detect an abnormality in the ETS circuit unit 22 itself and an abnormality in the governor encoder 18. When an abnormality is detected in the ETS circuit unit 22 itself or the governor encoder 18, the nearest floor stop command signal as a command signal for shifting the elevator to a safe state is sent from the ETS circuit unit 22 to the operation control unit 12. Are output. Further, bidirectional communication is possible between the ETS circuit unit 22 and the operation control unit 12.
  • First to fourth reference sensors 23-26 are provided for delivery.
  • the detection signal of the reference sensor 23-26 is input to the ETS circuit section 22.
  • the ETS circuit unit 22 corrects the information on the position of the car 3 obtained in the ETS circuit unit 22 based on the detection signal from the reference sensor 23-26.
  • a force buffer 27 and a counterweight buffer 28 are installed between the bottom surface of the hoistway 1 and the lower surfaces of the car 3 and the counterweight 4.
  • the car buffer 27 and the counterweight buffer 28 are installed in the lower part of the hoistway 1.
  • the car shock absorber 27 is disposed directly under the force 3 to reduce the impact when the car 3 collides with the bottom of the hoistway 1.
  • the counterweight buffer 28 is disposed directly below the counterweight 4 and reduces the impact when the counterweight 4 collides with the bottom of the hoistway 1.
  • these shock absorbers 27 and 28 for example, oil-filled or spring-type buffers are used.
  • FIG. 2 is a graph showing an overspeed pattern set in the governor 14 and the ETS circuit unit 22 of FIG.
  • the speed pattern of the car 3 is a normal speed pattern VO.
  • the governor 14 is set with first and second overspeed patterns VI and V2 by mechanical position adjustment.
  • the ETS circuit overspeed pattern VE is set in the ETS circuit section 22.
  • the ETS monitoring overspeed pattern VE is set higher than the normal speed pattern VO.
  • the ETS monitoring overspeed pattern VE is set so as to be approximately equidistant from the normal speed pattern VO in the entire lifting process. That is, the ETS monitoring overspeed pattern VE changes according to your position. More specifically, the ETS monitoring overspeed pattern VE is set to be constant near the intermediate floor, but continuously and smoothly as it approaches the terminal end (upper and lower ends) of the hoistway 1 near the terminal floor. It is set to be low. In this way, the ETS circuit section 22 monitors the traveling speed of the force 3 even in the vicinity of the intermediate floor (a constant speed traveling section in the normal speed pattern VO) that is not only in the vicinity of the terminal floor, but in the vicinity of the intermediate floor. Therefore, it is not always necessary to monitor.
  • the first overspeed pattern VI is set higher than the ETS monitoring overspeed pattern VE.
  • the second overspeed pattern V2 is set higher than the first overspeed pattern VI.
  • the first and second overspeed patterns VI and V2 are constant at all heights in the hoistway 1.
  • the buffer stroke of the counterweight buffer 28 is limited by the governor 14 according to the collision speed of the counterweight 4 to the counterweight buffer 28 limited by the ETS circuit section 22. It is set shorter than the stroke specified according to the impact speed.
  • the buffer stroke of the car shock absorber 27 is specified according to the collision speed limited by the governor 14.
  • the chopper strokes of the shock absorbers 27 and 28 are the initial speed when the force 3 and the counterweight 4 first contact each other, and the allowable deceleration until the force 3 and the counterweight 4 stop. It depends on Accordingly, the buffer stroke of the counterweight buffer 28 is set shorter than the buffer stroke of the car buffer 27. That is, the knot fast stroke of the counterweight shock absorber 28 is shorter than the buffer stroke of the car shock absorber 27.
  • the counterweight buffer 28 is also destroyed when the counterweight 4 collides at a speed larger than the speed specified by the ETS monitoring overspeed pattern VE, for example, when the main rope breaks. It is set to a sufficient capacity so that it does not occur. As described above, as a method for securing a sufficient capacity of the counterweight buffer 28, for example, there is a force using a buffer having a larger capacity than usual, or a method using a plurality of buffers having a normal capacity. .
  • FIG. 3 is a block diagram showing a connection relationship among the electronic safety controller 21, the elevator control panel 11, and various sensors shown in FIG.
  • the electronic safety controller 21 includes two detection signals from the governor encoder 18, detection signals from the first and fourth reference sensors 23 to 26, and other sensors (first and first N The signal from the sensor is input.
  • the electronic safety controller 21 has a plurality of signal input ports corresponding to each sensor. That is, the signals from each sensor are input to the electronic safety controller 21 separately. to this Thus, the electronic safety controller 21 can detect abnormality of each sensor.
  • a failure 'abnormality content signal including the content of the failure or abnormality is generated.
  • a stop signal corresponding to the content of the failure or abnormality is input to a drive / braking unit (not shown) of the elevator control panel 11.
  • FIG. 4 is a block diagram showing a device configuration of a main part of the electronic safety controller 21 of FIG.
  • the electronic safety controller 21 detects the abnormality of the elevator based on the first microprocessor 31 that executes arithmetic processing for detecting the abnormality of the elevator based on the first safety program and the second safety program. Including a second microphone port processor 32 for executing arithmetic processing to perform!
  • the first safety program is a program having the same content as the second safety program.
  • the first and second microprocessors 31 and 32 can communicate with each other via an interprocessor bus and a two-port RAM 33. Further, the first and second microprocessors 31 and 32 can confirm the soundness of the first and second microprocessors 31 and 32 themselves by comparing the calculation processing results of each other. In other words, the soundness of the microprocessors 31 and 32 is confirmed by having the first and second microprocessors 31 and 32 execute the same processing and comparing the processing results via the 2-port RAM 33 and the like. .
  • microprocessors 31 and 32 can detect abnormalities in the electronic safety controller 21 other than those in the microprocessors 31 and 32 themselves by arithmetic processing.
  • FIG. 5 is an explanatory diagram showing a method of executing arithmetic processing by the microprocessors 31 and 32 of FIG.
  • the microprocessors 31 and 32 repeatedly execute the arithmetic processing according to the program stored in the ROM at a predetermined arithmetic cycle (for example, 50 msec) based on the signal from the fixed-cycle timer.
  • Programs executed within one cycle include a safety program for detecting elevator abnormalities and a fault / abnormality check program for detecting faults / abnormalities in the electronic safety controller 21 itself and various sensors. It is.
  • the failure / abnormality check program may be executed only when preset conditions are satisfied.
  • the electronic safety controller 21 is replaced with the electronic safety controller 21. Even if an abnormality of the electronic safety controller 21 itself is detected, a command signal for shifting the elevator to a safe state is output even when an abnormality of the electronic safety controller 21 itself is detected.
  • the reliability of the safety system can be improved with a relatively simple configuration while increasing the processing speed.
  • the electronic safety controller 21 can detect abnormality of various sensors, and even when the abnormality of the sensor is detected, it outputs a command signal for shifting the elevator to a safe state. The reliability can be further improved.
  • the electronic safety controller 21 includes first and second microprocessors 31, 32, and the first and second microprocessors 31, 32 compare the first and second processing results with each other. Since the soundness of the second microprocessor 31, 32 itself can be confirmed, the reliability of the safety system can be further improved.
  • FIG. 6 is a block diagram showing a main part of the electronic safety controller 21 of FIG.
  • the electronic safety controller 21 employs a dual circuit configuration to ensure sufficient reliability.
  • the electronic safety controller 21 uses first and second CPUs (processing units) 41 and 42 as first and second microprocessors.
  • the first CPU 41 outputs a control signal to the operation control unit 12 and the first output interface (output unit) 43.
  • the second CPU 42 outputs a control signal to the operation control unit 12 and the second output interface (output unit) 44.
  • the operation control unit 12 When the operation control unit 12 receives similar control signals from the first and second CPUs 41 and 42, the operation control unit 12 is controlled by the control signals.
  • the first and second output interfaces 43 and 44 output a signal for opening the safety circuit unit 13 based on the control signals from the first and second CPUs 41 and 42.
  • the first and second CPUs 41 and 42 are connected to a two-port RAM 45 for exchanging data between them.
  • a first watchdog timer 46 is connected to the first CPU 41.
  • a second watchdog timer 47 is connected to the second CPU.
  • the first CPU 41 receives two signals from the governor encoder 18 (Fig. 1). .
  • two signals from the governor encoder 18 are also input to the second CPU 42.
  • the signal from the governor encoder 18 is processed by the CPUs 41 and 42, whereby the speed and position of the car 3 (FIG. 1) are obtained. That is, the governor encoder 18 functions as a speed sensor and a position sensor.
  • the CPUs 41 and 42 are also input with various sensor force signals as shown in FIG.
  • the first CPU 41 receives the first clock signal from the first clock 48.
  • the second CPU 42 receives the second clock signal such as the second clock 49.
  • the frequencies of the first and second clock signals are set equal to each other.
  • the first and second clock signals are also input to the clock abnormality detection circuit 50.
  • the clock abnormality detection circuit 50 counts the number of pulses of the first and second clock signals, and detects the abnormality of the first and second clock signals from the difference in the number of pulses.
  • the first and second CPUs 41 and 42 transmit test mode signals 51 and 52 for checking the soundness of the clock abnormality detection circuit 50 to the clock abnormality detection circuit 50.
  • the first and second CPUs 41 and 42 transmit detection start command signals 53 and 54 for starting clock abnormality detection to the clock abnormality detection circuit 50.
  • the clock abnormality detection circuit 50 inputs error signals 55 and 56 to the first and second CPUs 41 and 42 when detecting a clock abnormality.
  • FIG. 7 is a configuration diagram showing a specific configuration of the clock abnormality detection circuit 50 of FIG.
  • the clock anomaly detection circuit 50 includes a first monitoring counter 57 and a first monitored counter 58 that counts the first edge of the first clock signal, and a second clock that counts the pulse edge of the second clock signal.
  • Monitoring counter 59 and a second monitored counter 60 are provided.
  • the first clock signal is input to the first monitored counter 58 via the first selector 61.
  • the first selector 61 switching between the normal circuit and the test circuit is possible.
  • the first clock signal is input to the first monitored counter 58 as it is.
  • the test circuit the first clock signal is multiplied by the first multiplication circuit 62 and then input to the first monitored counter 58. Switching to the test circuit is performed by inputting a test mode signal 51 from the first CPU 41 to the first selector 61.
  • the second clock signal is sent to the second monitored counter 60 via the second selector 63. Is input. In the second selector 63, switching between the normal circuit and the test circuit is possible. In the normal circuit, the second clock signal is input to the second monitored counter 60 as it is. In the test circuit, the second clock signal is multiplied by the second multiplication circuit 64 and then input to the second monitored counter 60. Switching to the test circuit is performed by inputting the test mode signal 52 from the second CPU 42 to the second selector 63.
  • Ripple carry output signals from the first and second monitored counters 58 and 60, that is, error signals 55 and 56 are latched by the first and second latch units 65 and 66.
  • the first and second latch units 65 and 66 receive the latch release signals 67 and 68 of the first and second CPUs 41 and 42 and release the latched state.
  • the electronic safety controller 21 includes a CPU (microcomputer) including the CPUs 41 and 42 and the ROM shown in FIG.
  • the two pulse signals output from governor encoder 18 are input to CPU41 and 42. Then, the pulse signals are calculated from the CPUs 41 and 42, and the position and speed of the force 3 are obtained. The obtained position and speed are compared with each other via the 2-port RAM 45, and then compared with a set value (reference value) for judging abnormality, for example, ETS monitoring overspeed.
  • a signal is output to the operation control unit 12 or the safety circuit unit 13 according to the content of the abnormality, and the elevator is shifted to a safe state.
  • the transition to the safe state is, for example, that the car 3 is stopped suddenly or the car 3 is stopped on the nearest floor.
  • the operation control unit 12 is further controlled as necessary.
  • a control signal is generated and output to the operation control unit 12.
  • CPUs 41 and 42 an arithmetic operation for obtaining a force speed is executed by counting pulse signals input within a predetermined time.
  • the timer that controls the “certain time” is generated by clock signals from the clocks 48 and 49. Therefore, the frequency of the clock signal is very important.
  • the clock signals of the first and second clocks 48 and 49 are input to the clock abnormality detection circuit 50 to monitor whether there is an abnormality in the clock signal. .
  • Detection start command signals 53, 54 become High and the force is the ripple carry output signal from the first monitoring counter 57, 59.
  • the preset data value of each counter 57-60 is loaded to each counter 57-60. And the count-up is started.
  • the preset data value is the count value when counting starts with the counter 57-60.
  • a threshold value for determining a clock abnormality is set in advance.
  • the preset data value of the monitoring counters 57 and 59 is set to a value larger than the preset data value of the monitored counters 58 and 60, in this case, 4.
  • the monitoring counters 57 and 59 repeatedly count the number of pulses in a range shorter than the monitored counters 58 and 60, and reset the monitored counters 57 and 59 every time they carry over.
  • Monitored Counter 58, 60 is also a force that repeatedly counts the number of pulses. Under normal conditions, the monitoring counters 57, 59 carry over and the monitored counters 58, 60 are reset before the monitored counters 58, 60 carry over. .
  • Such preset data values can be arbitrarily set by configuring the clock abnormality detection circuit 50 with, for example, an FPGA (field programmable gate array).
  • FPGA field programmable gate array
  • the monitored counters 58 and 60 carry over and the ripple carry output signal, that is, the counter value four times before the error signals 55 and 56 are output.
  • the error signals 55 and 56 are not output because they are reset by the ripple carry output signal of the monitoring counters 57 and 59.
  • the ripple carry output signal of the second monitoring counter 59 is reset before the first monitored counter 58 is reset.
  • the ripple carry output signal of the first monitored counter 58 that is, the error signal 55 is output, and the error signal 55 is latched by the latch unit 65.
  • the error signal 56 is output from the second monitored counter 60 in the same manner, and the error signal 56 is latched by the latch unit 66.
  • the clocks 48 and 49 used for the dual CPUs 41 and 42 that do not require the use of a dedicated clock for detecting clock anomalies remain as they are. It can be used to detect clock anomalies, enabling efficient use of hardware resources. Therefore, reliability can be improved with a simple circuit configuration.
  • the preset data value of the counter 57-60 can be set arbitrarily, a critical frequency shift can be detected. As a result, the operation delay time until the safety circuit unit 13 is driven and controlled can be shortened, and a design with higher safety can be realized.
  • the soundness check function of the clock abnormality detection circuit 50 will be described.
  • the test mode signal 51 is transmitted from the first CPU 41 to the clock abnormality detection circuit 50
  • the circuit is switched to the test circuit by the selector 61, and the first clock signal is multiplied by the first multiplication circuit 62. Is done. That is, the first clock signal input to the first monitored counter 58 is intentionally made abnormal. Therefore, if the clock abnormality detection circuit 50 is normal, the error signal 55 is output from the first monitored counter 58.
  • the CPU 41 can confirm the soundness of the clock abnormality detection circuit 50 by receiving the error signal 55 in response to the transmission of the test mode signal 51. Similarly, the health of the second clock 49 can also be checked.
  • the electronic safety controller 21 of this example includes the first and second processing units that perform calculations related to the control of the elevator in a double system, the first clock that sends the first clock signal to the first processing unit, A second clock that sends the second clock signal to the second processing unit, and a clock abnormality detection circuit that detects an abnormality in the first and second clock signals are input, and a clock abnormality is detected.
  • the detection circuit counts the number of pulses in the first and second clock signals, and detects an abnormality in the first and second clock signals from the difference in the number of pulses.
  • the clock abnormality detection circuit counts the monitored counter that counts the number of pulses of either the first or second clock signal and the number of pulses of the other of the first or second clock signal.
  • the preset data value which is the force value when starting counting with the monitored counter, is set to be larger than the preset data value, which is the count value when starting counting with the monitoring counter.
  • the monitoring counter includes a first monitoring counter that counts the number of pulses of the first clock signal and a second monitoring counter that counts the number of pulses of the second clock signal, and the monitored counter Includes a first monitored counter that counts the number of pulses of the first clock signal and a second monitored counter that counts the number of pulses of the second clock signal.
  • the preset data value of the monitoring counter can be arbitrarily set.
  • the clock abnormality detection circuit has a multiplication circuit for multiplying the clock signal input to the monitored counter in the test mode.
  • FIG. 8 is an explanatory diagram showing an area division in the RAM of the electronic safety controller 21 of FIG.
  • the RAM includes a stack area that stores information necessary for computation by the CPU.
  • a subroutine call return address, a timer interrupt return address, and a subroutine call argument are stored.
  • the ROM stores a program for monitoring the state of a preset monitoring area in the RAM stack area. That is, the stack area monitoring unit has a CPU and a ROM.
  • the COOOH—FFFFH area is set as the stack area!
  • the DOOOH-D010H area in the stack area is set as the monitoring area.
  • the power used by the stack area is determined by the microcomputer.
  • the stack pointer of the microcomputer is used to accumulate data to the younger address.
  • the initial value of the stack pointer is set to FFFFH, and used as FFFFH ⁇ FFFEH ⁇ FFFDH ⁇ C001H ⁇ COOOH. Therefore, the monitoring area DOOOH—D010H
  • the position of the monitoring area is preferably an area used when 50% or more of the stack area is used. In particular, the area used when 60% or more of the stack area is used is preferable. The monitoring area is used when 90% or less of the stack area is used. A region is preferred. In particular, the area used when 80% or less of the stack area is used is preferable.
  • the stack area is set to 0 in advance, and the stack area monitoring unit monitors whether the entire monitoring area is 0 or not. If the monitoring area contains data other than 0, it is determined that a stackover has occurred.
  • FIG. 9 is a flowchart showing an initial operation of the electronic safety controller 21 of FIG.
  • the electronic safety controller 21 is initialized.
  • all interrupt operations are disabled (step Sl).
  • the microcomputer is initialized (step S2), and the RAM area is set to 0 (step S3).
  • the interrupt operation is enabled (step S4) and the interrupt wait state is entered (step S5).
  • the interrupt calculation is repeatedly executed every calculation cycle time.
  • FIG. 10 is a flowchart showing a first example of the interrupt calculation flow of the electronic safety controller 21 of FIG.
  • the state of the monitoring area is first confirmed (step S31). That is, it is confirmed whether or not the monitoring area DOOOH-D010H has the state power OOOO.
  • the monitoring area is OOOOH! /
  • the value of the monitoring area is other than 0, it is determined that an interrupt operation that does not have enough time for the interrupt operation processing time does not end within the operation cycle time and a stack over occurs.
  • a calculation for suddenly stopping the force 3 is executed (step S32), and an emergency stop command is output to the safety circuit unit 13.
  • an abnormality detection signal is transmitted to the elevator monitoring room.
  • step S33 If there is no abnormality in the monitoring area, an input calculation for inputting a signal necessary for the calculation is performed (step S33), and the current position of the car 3 and the distance from the current position to the terminal floor are calculated.
  • Car position calculation step S34
  • Car 3 travel force Car speed calculation to find the speed of car 3
  • abnormal speed judgment reference value for example, Fig. 2
  • Judgment criterion calculation step S36
  • step S37 safety monitoring for detecting an abnormal force speed from the car speed and the criterion value
  • step S38 a monitor calculation for monitoring and displaying the state of the elevator
  • step S39 an output calculation for outputting a command signal necessary for permitting the travel of the force 3 or for suddenly stopping the force 3 is executed.
  • the status of the monitoring area is monitored by the stack area monitoring unit, and when it is determined that there is an abnormality in the monitoring area, the car 3 is suddenly stopped. Program runaway due to RAM stack over is prevented. This prevents damage to the equipment. That is, the calculation related to the operation control by the computer can be executed more reliably, and the reliability can be improved.
  • stack over stacking
  • Stackover may occur due to an abnormality in the microcomputer or program, but if these are not abnormal, the primary cause of stackover is that the interrupt operation does not end within the operation cycle time (operation time over) It is thought that.
  • the computation time overtime does not normally occur, it occurs when the computation time temporarily increases, for example, when many call buttons are operated and a long time is required for the call scan computation. It is also possible that the computation time will gradually increase as the software is remodeled or improved, resulting in an overtime.
  • the stack area monitoring unit checks the state of the monitoring area at every preset calculation cycle, it is possible to constantly monitor the presence or absence of a stack over and further improve the reliability. it can. [0098] Further, when it is determined that there is an abnormality in the monitoring area, the force 3 is stopped suddenly, so that a larger failure can be prevented.
  • a signal for shifting the elevator to a safe state is output, and the state of the electronic safety controller 21 at that time is recorded as a history (history calculation). May be.
  • the history is recorded in an area other than the RAM stack area, for example.
  • the electronic safety controller 21 in this example has a stack area for storing information necessary for the operation for monitoring the safety of the elevator, the RAM in the stack area, and the stack area in advance.
  • a stack area monitoring unit that monitors the state of the set monitoring area is provided, and the operation of the elevator is controlled according to the state of the monitoring area detected by the stack area monitoring unit.
  • the stack area monitoring unit confirms the state of the monitoring area every predetermined calculation cycle. In addition, confirmation of the status of the monitoring area is performed as part of the interrupt calculation process for monitoring the safety of the elevator.
  • FIG. 11 is a flowchart showing a second example of the flow of interrupt calculation by the electronic safety controller 21 of FIG.
  • step S41 the pattern of the processing information written in the RAM is first confirmed (step S41).
  • a numerical value (identification value) set in advance for each operation processing task (functional unit) is used as the processing information.
  • the processing information is written in a table set in a predetermined area in the RAM.
  • seven identification values are assigned to seven arithmetic processes, and the identification value is written to the corresponding TBL [0] — [6]. It is. TBL [7] — [9] remains 0 because there is no corresponding operation.
  • TBL [0] — [9] and the table storage pointer are initialized to 0 (step S42).
  • input calculation for inputting the signals necessary for the calculation
  • car position calculation for determining the current position of the force and the distance from the current position to the final floor
  • a car speed calculation for determining the speed of the car
  • a determination reference calculation for determining a determination reference value of the abnormal speed (for example, Fig. 2) according to the distance to the terminal floor are executed.
  • a safety monitoring calculation is performed to detect an abnormality in the force speed from the car speed and the judgment reference value (step S47).
  • the monitor calculation for monitoring and displaying the elevator state is executed (step S48).
  • an output calculation for outputting a command signal necessary for permitting the travel of the force or for suddenly stopping the force is executed according to the result of the safety monitoring calculation (step S49).
  • step S50-56 the identification value is written to the corresponding table. That is, calculation processing and identification value writing are executed alternately.
  • the pattern of the identification value written in this way is confirmed at the start of the next interrupt calculation (step S41). In other words, by confirming the pattern of the identification value, it is determined whether or not the execution order of the arithmetic processing is normal.
  • step S57 When an abnormality is detected in the execution order of the arithmetic processing, a sudden stop operation for suddenly stopping the force is executed (step S57). In addition, when an abnormality is detected in the execution order of the arithmetic processing, an abnormality detection signal is transmitted to the elevator monitoring room.
  • the monitor calculation is executed (step S58), the output calculation for outputting the command signal necessary to stop the car suddenly is executed (step S59), and the interrupt calculation processing is completed.
  • the calculation time over time does not normally occur, but occurs when the calculation time temporarily increases, for example, when many call buttons are operated and a long time is required for the call scan calculation. It is also possible that the computation time will gradually increase as the software is remodeled or improved, resulting in an overtime.
  • the electronic safety controller 21 checks the pattern of the processing information every preset calculation cycle, it can always monitor the presence or absence of an abnormality, and can further improve the reliability. it can.
  • the car 3 was suddenly stopped when it was determined that there was an abnormality in the execution order of the arithmetic processing.
  • the nearest floor stop command was output to the operation control unit 12 to It is possible to smoothly drop passengers in the force 3 even if they are stopped to the nearest floor.
  • the electronic safety controller 21 in this example includes the RAM and a program storage unit that stores a program related to safety monitoring, and a processing unit that executes a plurality of arithmetic processes based on the program.
  • the controller main unit writes processing information corresponding to each arithmetic processing to the RAM when the arithmetic processing is executed, and the pattern power of the processing information written in the RAM is normal in the execution order of the arithmetic processing. Monitor whether it is.
  • the processing information is a numerical value preset for each arithmetic processing. Furthermore, the control device itself confirms the pattern of the processing information every predetermined calculation cycle. Furthermore, the writing of processing information and the confirmation of the pattern of processing information are executed as part of an interrupt calculation process for monitoring the safety of the elevator.
  • FIG. 12 is a block diagram showing a main part of the electronic safety controller 21 of FIG.
  • two command signals are output to the elevator control panel 11 in order to improve reliability.
  • a dual circuit configuration is employed, and first and second CPUs (processing units) 41 and 42 are used.
  • the first CPU 41 outputs an instruction signal to the elevator control panel 11 via the first output interface 43.
  • the second CPU 42 outputs a command signal to the elevator control panel 11 via the second output interface 44.
  • the elevator control panel 11 receives a command signal from the first and second output interfaces 43 and 44, it shifts the elevator to a safe state.
  • the first and second CPUs 41 and 42 are connected to a two-port RAM 45 for exchanging data between them.
  • the first CPU 41 receives a signal from the first sensor.
  • a signal from the second sensor is input to the second CPU.
  • the signals of the first and second sensor forces are processed by the CPUs 41 and 42. 3 speeds and positions are required.
  • Examples of the first and second sensors include a governor encoder 18.
  • the result data of the arithmetic processing in the CPUs 41 and 42 is exchanged between the CPUs 41 and 42 via the 2-port RAM 45. Then, the CPUs 41 and 42 compare the result data with each other, and if there is a significant difference in the calculation result or an overspeed (overspeed) is confirmed, the output interfaces 43 and 44 are connected. The command signal is output to the elevator control panel 11 and the elevator is shifted to the safe state.
  • this elevator control device is provided with a + 5V power supply voltage monitoring circuit 71 and a + 3.3V power supply voltage monitoring circuit 72 for monitoring the power supply voltages of the CPUs 41 and 42.
  • the power supply voltage monitoring circuits 71 and 72 are configured by, for example, an IC (integrated circuit).
  • the power supply voltage monitoring circuits 71 and 72 monitor whether or not a stable power supply voltage is supplied to the CPUs 41 and 42. Designed to be fail-safe because the CPU 41, 42 is forcibly reset based on information from the power supply voltage monitoring circuit 71, 72 when a power supply voltage abnormality that deviates from the rated voltage of the CPU 41, 42 occurs. Car 3 is suddenly stopped by safety circuit 13.
  • the + 5V power supply voltage monitoring circuit 71 receives the monitoring voltage from the first monitoring voltage input circuit 73. + 3.
  • the 3V power supply voltage monitoring circuit 72 receives the monitoring voltage from the second monitoring voltage input circuit 74.
  • the power supply voltage monitoring circuits 71 and 72 and the CPUs 41 and 42 have a voltage monitoring soundness check function circuit 75 for monitoring the health of the power supply voltage monitoring circuits 71 and 72 (hereinafter abbreviated as a check function circuit 75). Is connected.
  • the check function circuit 75 includes a programmable gate IC such as an FPGA (field programmable gate array).
  • the check function circuit 75 can also be realized by an ASIC, CPLD, PLD, or gate array.
  • a voltage abnormality detection signal 81, 82 is output from the power supply voltage monitoring circuit 71, 72 to the check function circuit 75, and a reset signal 83, is output from the check function circuit 75 to the CPU 41, 42. 84 is output.
  • control signals 85 and 86 from the CPUs 41 and 42 are input to the check function circuit 75.
  • the check function circuit 75 outputs monitoring input voltage forced change signals 87 and 88 for forcibly changing the voltage input pins of the power supply voltage monitoring circuits 71 and 72 to a low voltage.
  • check function circuit 75 is connected to the first data bus 78 for the first CPU 41 and the second data bus 79 for the second CPU 42.
  • a program for determining the position and speed of the car 3 a program for determining an elevator abnormality, a program for checking the soundness of the power supply voltage monitoring circuits 71 and 72, and the like are CPU41, 42. It is stored in the ROM that is a storage unit connected to the.
  • FIG. 13 is a circuit diagram showing an example of a specific configuration of the check function circuit 75 of FIG.
  • the control signals 85 and 86 include selection signals 89 and 90, output permission signals 91 and 92, and chip select signals 93 and 94.
  • the selection signals 89 and 90 are 2-bit signals for selecting which power supply voltage monitoring circuit 71 or 72 is checked for soundness.
  • the output enable signals 91 and 92 are signals for permitting the output of the monitoring input voltage forced change signals 87 and 88 from the check function circuit 75 and latching the contents selected by the selection signals 89 and 90. . That is, the output permission signals 91 and 92 also serve as a latch trigger signal.
  • voltage abnormality detection signals 81 and 82 are latched by voltage abnormality signal latch circuit 101 in check function circuit 75.
  • the latched state in the voltage abnormality signal latch circuit 101 is released from the fact that the latch release signals 95 and 96 which are part of the control signals 85 and 86 are input.
  • the selection signals 89 and 90 are input to the first and second selectors 102 and 103.
  • the first and second selectors 102 and 103 switch which power supply voltage monitoring circuit 71 or 72 is to be checked based on the selection signals 89 and 90.
  • the contents selected by the selectors 102 and 103 are latched by the first and second selection contents latch circuits 104 and 105.
  • a change signal output buffer 106 is placed in the preceding stage of the output of the monitoring input voltage forced change signals 87 and 88.
  • the check function circuit 75 is provided with a plurality of data bus output buffers 107 of the first CPU 41 and a plurality of data bus output buffers 108 of the second CPU 42.
  • FIG. 14 is an explanatory diagram showing the meaning of data regarding each bit of the data buses 78 and 79 when the first and second CPUs 41 and 42 read the check function circuit 75 of FIG.
  • FIG. 15 is a flowchart showing a power supply voltage monitoring soundness check method on the first CPU 41 side in FIG.
  • the electronic safety controller 21 executes an interrupt calculation including an arithmetic process for monitoring an abnormality of the elevator such as an overspeed of the car 3 every calculation cycle (for example, 5 msec). Then, when the interrupt calculation main routine is executed, it is determined whether or not to perform the soundness check of the power supply voltage monitoring circuits 71 and 72 (step S11).
  • the soundness check is performed at a preset timing.
  • the soundness check is performed when the pre-set time has elapsed for the force 3 stop state. Specifically, it is implemented when there are few passengers or when there is no night operation.
  • the process returns to the main routine.
  • the latch state of the voltage abnormality detection signals 81 and 82 which are error signals in the check function circuit 75, is first released. That is, the check function circuit 75 generates a latch release signal 95 (step S12).
  • the latch release signal 95 is input to the voltage abnormality signal latch circuit 101, and the latch state of the voltage abnormality detection signals 81 and 82 is released.
  • step S13 After confirming that the output enable signal 91 of the first CPU 41 is High (step S13), the output enable signal 92 is also set to High for the second CPU 42. Request through 2-port RAM45 (step S14).
  • the select signal 89 for selecting which of the power supply voltage monitoring circuits 71 and 72 is to be checked for soundness is output to the check function circuit 75 and latched (step S15).
  • the second CPU 42 is requested through the 2-port RAM 45 to set the output permission signal 92 to Low (step S6).
  • the output enable signal 91 is set to low (step S7).
  • the check function circuit 75 the select signal 89 is latched by the selection content latch circuit 104 in synchronization with the fall of the output permission signal 91.
  • a monitoring input voltage forced change signal 87 is output from the check function circuit 75 to the power supply voltage monitoring circuit 71.
  • the power supply voltage monitoring circuit 71 detects a voltage abnormality, and the voltage abnormality detection signal 81 is input to the check function circuit 75.
  • the voltage abnormality detection signal 81 is latched by the voltage abnormality signal latch circuit 101.
  • reset signals 83 and 84 from the check function circuit 75 are input to the CPUs 41 and 42 (step S8), thereby resetting the CPU 41 and 42 force S.
  • FIG. 16 is a flowchart showing the operation when the CPUs 41 and 42 are reset in the elevator control device of FIG.
  • the cause of the resetting of the CPUs 41 and 42 may, of course, be due to an abnormality in the true power supply voltage and other reasons, not just due to the soundness check.
  • the CPUs 41 and 42 first start a software initialization process (step S19). Next, the data of the check function circuit 75 is read during the initialization process (step S20). Then, the state before the latched contents are reset is checked to determine whether there is an abnormality in the power supply voltage or a failure in the power supply voltage monitoring circuits 71 and 72 (step S21). In other words, it is determined whether the reset has occurred due to a soundness check or has occurred due to a true power supply voltage abnormality.
  • step S22 If no abnormality or failure is detected as a result of the data read of the check function circuit 75, the transition to the main routine is permitted (step S22). However, here is the power described only for reset related to the power supply voltage, and it may be possible to reset by other fault detection or soundness check of other circuits. After confirming this, the transition to the main routine is permitted.
  • step S23 If any abnormality or failure is found as a result of the data read of the check function circuit 75, a command signal is output to the elevator control panel 11 (step S23), and the elevator is shifted to a safe state.
  • Such an electronic safety controller 21 can monitor the soundness of a failure of the power supply voltage monitoring circuits 71 and 72 that can detect only the abnormality of the power supply voltage. Therefore, the reliability of the power supply voltage can be monitored. This can be further improved.
  • the electronic safety controller 21 in this example includes a processing unit that performs processing related to elevator safety monitoring, and a power supply voltage monitoring circuit that monitors the power supply voltage supplied to the processing unit.
  • a monitoring input voltage forced change signal for forcibly changing the power supply voltage input to the power supply voltage monitoring circuit is output according to the control signal of the processing unit, and a voltage abnormality detection signal from the power supply voltage monitoring circuit is output.
  • An input voltage monitoring soundness check function circuit is further provided.
  • the voltage monitoring soundness check function circuit holds at least a part of transmission / reception contents of signals with the processing unit and the power supply voltage monitoring circuit, and the processing unit has a voltage monitoring function. Ken
  • the integrity of the power supply voltage monitoring circuit is checked by reading the data held in the integrity check function circuit.
  • the processing unit includes the first and second CPUs, and the first and second CPUs perform health check operations by the first and second CPUs via the two-port RAM. Can be confirmed with each other.
  • a monitoring input voltage forced change circuit is further provided that forcibly lowers the power supply voltage input to the power supply voltage monitoring circuit by the input of the monitoring input voltage forced change signal.
  • the power supply voltage monitoring circuit includes a plurality of power supply voltage monitoring circuits for monitoring the voltages of a plurality of power supplies having different voltages, from the processing unit to the voltage monitoring soundness check function circuit.
  • the control signal includes a selection signal for selecting which of the plurality of power supply voltage monitoring circuits is to be checked for soundness.
  • the processing unit can sequentially perform the soundness check of each power supply voltage monitoring circuit one by one.
  • the voltage monitoring soundness check function circuit consists of a programmable gate IC.
  • the ETS circuit unit 22 detects the position of the force 3 independently of the operation control unit 12. For this reason, for example, when the elevator is started, an initial setting operation (initial setting operation step) of the ETS circuit unit 22 is performed.
  • the initial setting operation of the ETS circuit unit 22 also occurs when there is a deviation between the position information of the car 3 in the operation control unit 12 and the position information of the car 3 in the ETS circuit unit 22 due to some cause. Is done.
  • the operation mode of the operation control unit 12 is switched to the initial setting operation mode.
  • FIG. 17 is an explanatory diagram showing the relationship between the stage of the initial setting operation of the ETS circuit unit 22 of FIG. 1 and the operation of the operation control unit 12 and the safety circuit unit 13.
  • the speed detection initial setting is first performed, and then the position detection initial setting is performed.
  • the safety device 13 causes the drive unit 7 to be in an emergency stop state. It is. That is, the motor power supply of the drive device 7 is cut off, and the brake unit 9 of the drive device 7 is in a braking state. In addition, a command indicating that the operation cannot be performed is output from the ETS circuit unit 22 to the operation control unit 12.
  • the electronic safety controller 21 When the speed detection initial setting is completed, the electronic safety controller 21 outputs a permission signal indicating that low-speed operation is possible to the operation control unit 12. In addition, the emergency stop state of the safety circuit unit 13 is released. In this state, the ETS circuit unit 22 performs a position detection initial setting operation.
  • the force 3 travels from the lower part to the upper part of the hoistway 1 at a speed equal to or less than the permissible collision speed of the shock absorbers 27 and 28.
  • the relationship between the signal from the governor encoder 18 and the position of the force 3 in the hoistway 1 is set.
  • the electronic safety controller 21 When the initial setting operation is completed, the electronic safety controller 21 outputs a permission signal indicating that high-speed (rated speed operation) operation is possible to the operation control unit 12. In addition, the ETS circuit unit 22 enables high-speed monitoring.
  • FIG. 18 is an explanatory view for explaining the movement of the car 3 in the initial setting operation mode of the elevator apparatus of FIG.
  • the car 3 In the initial setting operation mode, the car 3 is moved to the floor writing start position below the hoistway 1 after the speed detection initial setting is completed.
  • the floor writing start position is a position where the car 3 is located below the lowest floor position P and above the force buffer 27.
  • the force 3 is located at the floor writing start position, the force 3 (specifically, the operation plate of the reference sensor 23-26 provided in the car 3) is more than the fourth reference sensor 26. Located below.
  • a plurality of end point switches (not shown) for detecting the position of the lowermost floor or the uppermost floor by the operation control unit 12 are provided.
  • the operation controller 12 controls the movement of the car 3 to the floor writing start position.
  • the temporary current position is updated every calculation cycle (for example, 100 msec).
  • the ETS circuit unit 22 is provided with an up / down counter that counts the encoder pulses of the governor encoder 18. If the movement amount of the up / down counter in the calculation cycle is GC1, the Nth time The temporary current position P in the calculation cycle of
  • the temporary current position and the movement amount within the calculation cycle are obtained as the number of pulses of the encoder pulse.
  • GC2 is the amount of movement of the up / down counter after entering the fourth reference sensor 26.
  • GC3 is the amount of movement of the up / down force counter after escape from the fourth reference sensor 26.
  • the operation control unit 12 includes the lowest floor position P and the highest floor position based on the virtual 0 point.
  • Data for device P is set. And when car 3 is stopped at top floor position P The data of the lowest floor position P and the highest floor position P with reference to virtual 0 point is the operation control unit.
  • the position data force obtained as the temporary current position and written in the table is converted into data based on the virtual 0 point based on the information transmitted from the operation control unit 12. This makes it possible to detect the current position P with reference to virtual 0 point.
  • L is the distance to the top floor position P of the car shock absorber 27, and L is the top
  • the car 3 is driven at a speed lower than the allowable collision speed of the car shock absorber 27 until the initial setting operation is completed. Can be more reliably prevented from colliding with device 27 and improve reliability be able to.
  • the initial setting operation is performed in two stages of the speed detection initial setting and the position detection initial setting is shown.
  • the initial setting operation is performed in three or more stages, and is allowed for each stage. You can also set the car speed.
  • the initial setting operation is not limited to the speed detection initial setting and the position detection initial setting.
  • the elevator apparatus in this example includes an operation control unit that controls the operation of the car and an elevator control that includes a monitoring unit (electronic safety controller 21) that detects abnormalities in the running of the force.
  • a monitoring unit electronic safety controller 21
  • the operation control unit will run the car at a lower speed than normal operation according to the initial setting stage.
  • the monitoring unit outputs a permission signal related to the speed of the force to the operation control unit according to the initial setting stage.
  • the operation control unit selectively controls a plurality of operation modes including a normal operation mode and an initial setting operation mode for performing initial setting of the monitoring unit while running a force to control the operation of the car.
  • the operation control unit causes the power to travel at a lower speed than in the normal operation mode according to the initial setting stage.
  • control method of the elevator apparatus in this example includes an initial setting operation step in which the initial setting of the monitoring unit for detecting abnormality in the travel of the force is performed while the force travels, and an initial setting operation step Then, the car is run at a lower speed than normal operation according to the initial setting stage.
  • FIG. 19 is a circuit diagram showing a contact abnormality detection unit of the electronic safety controller 21 of FIG.
  • the safety circuit unit 13 includes a brake power contactor coil 111 for supplying power to the brake unit 9, a motor power contactor coil 112 for supplying power to the motor unit of the driving device 7, and the contactor coils 111 and 112.
  • a safety relay main contact 113 for turning on / off the voltage application and a bypass relay main contact 114 connected in parallel to the safety relay main contact 113 are provided.
  • Brake power contactor coil 111, motor power contactor coil 112 and safety relay The main contacts 113 are connected to each other in series with the power source.
  • the safety relay main contact 113 is closed during normal operation. Further, when the elevator 3 is abnormal, for example, when the traveling speed of the car 3 exceeds a preset speed, the safety relay main contact 113 is opened.
  • the no-pass relay main contact 114 is open during normal operation.
  • the electronic safety controller 21 is mechanically connected to the controller main body 115, the safety relay coil 116 that operates the safety relay main contact 113, the bypass relay coil 117 that operates the bypass relay main contact 114, and the safety relay main contact 113. It has a safety relay monitor contact 118 that opens and closes in conjunction with the bypass relay and a bypass relay monitor contact 119 that opens and closes mechanically in conjunction with the bypass relay main contact 114.
  • the safety relay coil 116, the bypass relay coil 117, the safety relay monitor contact 118, and the bypass relay monitor contact 119 are connected to the controller main body 115 in parallel with each other.
  • the safety relay main contact 113 and the safety relay monitor contact 118 are mechanically connected by a link mechanism (not shown). Therefore, when either one of the contacts 113 and 118 becomes inoperable due to welding or the like, the other becomes inoperable.
  • the no-pass relay main contact 114 and the bypass relay monitor contact 119 are mechanically connected by a link mechanism (not shown). Therefore, when one of the contacts 114, 119 becomes inoperable due to welding or the like, the other becomes inoperable.
  • the controller body 115 includes a processing unit 120, a storage unit 121, an input / output unit 122, a safety relay motor contact receiver circuit 123, a bypass relay monitor contact receiver circuit 124, a safety relay driver circuit 125, and a bypass relay driver circuit 126. have.
  • processing unit 120 for example, a CPU is used.
  • storage unit 121 for example,
  • the storage unit 121 stores, for example, data for determining an elevator abnormality, a program for performing an operation test of the safety relay main contact 113, and the like.
  • the processing unit 120 transmits / receives signals to / from the operation control unit 12 and various sensors via the input / output unit 122.
  • the safety relay monitor contact receiver circuit 123 is connected in series to the safety relay monitor contact 118. Next, the open / close state of safety relay monitor contact 1 18 is detected.
  • the bypass relay monitor contact receiver circuit 124 is connected in series to the bypass relay monitor contact 119 and detects the open / closed state of the bypass relay monitor contact 119.
  • the safety relay driver circuit 125 is connected in series to the safety relay coil 116, and switches between excitation and non-excitation of the safety relay coil 116.
  • the no-pass relay driver circuit 126 is connected in series to the bypass relay coil 117, and switches excitation / de-energization of the bypass relay coil 117.
  • Switching between excitation and non-excitation of the safety relay coil 116 is performed by outputting a safety relay command signal from the processing unit 120 to the safety relay driver circuit 125. Further, switching between excitation and non-excitation of the no-pass relay coil 117 is performed by outputting a bypass command signal from the processing unit 120 to the bypass relay driver circuit 126.
  • the Resino circuits 123 and 124 and the Dryno circuits 125 and 126 are connected in parallel to each other in a processing unit 120.
  • the controller main body 115 monitors the presence or absence of an abnormality of the elevator based on information from various sensors!
  • the processing unit 120 the driving of the safety relay coil 116 is stopped by the safety relay driver circuit 125.
  • FIG. 20 is a flowchart for explaining an operation test method of the safety relay main contact 113 of FIG.
  • an operation test is performed every time the car 3 stops at the stop floor during normal operation. Therefore, during normal operation, the processing unit 120 monitors whether or not the traveling speed of the car 3 has become 0 based on information from various sensor forces (stop detection step S61).
  • bypass relay coil 117 is excited by the bypass relay driver circuit 126, and then waits for a preset time, here 100 ms (step S62). ). Then, check whether the no-pass relay monitor contact 119 is closed. Is confirmed by the bypass relay monitor contact receiver circuit 124 (step S63).
  • bypass relay monitor contact 119 If the bypass relay monitor contact 119 is not closed, it means that the bypass relay main contact 114 is also not closed. Therefore, the processing unit 120 determines that the bypass relay has failed, and the controller main body 115 determines that the operation control unit 12 An abnormality detection signal is output at (Step S64).
  • Step S67 When it is confirmed that the safety relay monitor contact 118 is normally opened, the safety relay coil 116 is de-energized, and then waits for a preset time, here 100 ms (Ste S67). Then, whether or not the safety relay monitor contact 118 is closed is confirmed by the safety relay monitor contact receiver circuit 123 (step S68).
  • the processing unit 120 determines that a safety relay failure has occurred, and an abnormality detection signal is output from the controller main body 115 to the operation control unit 12 (step S64).
  • bypass relay coil 117 is de-energized, and then waits for a preset time, here 100 ms (step S69). Then, whether the bypass relay monitor contact 119 is opened is confirmed by the bypass relay monitor contact receiver circuit 124 (step S70).
  • step S64 Bypass relay monitor contact 119 Opened! / If not, the processing unit 120 determines that a bypass relay failure has occurred, and an error detection signal is output from the controller body 115 to the operation control unit 12 (step S64). .
  • step S71 When the test of the opening / closing operation of the safety relay main contact 113 and the bypass relay main contact 114 is completed in this way, it waits until the traveling speed of the force 3 exceeds a preset set value (step S71), and then the traveling speed is monitored by the ETS circuit section 22 until the car 3 stops. Then, every time the force 3 stops, the above-described operation test is performed, and the soundness of the safety circuit unit 13 is confirmed.
  • the operation test of the safety relay main contact 113 was performed using the timing when the car stopped during normal operation, so safety that would not hinder normal operation
  • the abnormality of the relay main contact 113 can be detected, and the reliability can be improved.
  • bypass relay main contact 114 was closed when the operation test of the safety relay main contact 113 was performed, the power supply to the safety circuit section 13 was prevented from being interrupted during the operation test.
  • the operation test can be performed while the safety circuit unit 13 is maintained.
  • the timing of the force operation test in which the operation test is performed each time the force 3 stops is not limited to this.
  • a counter that counts the number of stoppages of the car may be provided in the detection circuit main body, and the operation test may be performed every preset number of stoppages.
  • a timer is provided in the detection circuit body, so that a preset time has elapsed.
  • the operation test may be performed when the car stops for the first time.
  • an operation test may be performed only when normal operation of the elevator is started (at startup). Furthermore, it is recommended that the operation test be performed only when the vehicle stops on a preset floor.
  • the electronic safety controller 21 in this example generates a safety relay command signal for operating the safety relay main contact in the direction in which the brake section performs braking operation when the car stops during normal operation. At the same time, it detects whether the safety relay main contact is activated according to the safety relay command signal.
  • the electronic safety controller 21 is provided with a safety relay monitor contact that is mechanically linked to the safety relay main contact, and the electronic safety controller 21 has a safety relay monitor contact state force safety Detects the relay main contact status.
  • the safety relay main contact is closed during normal operation and opened when the elevator malfunctions.
  • the bypass relay is connected in parallel to the safety relay main contact and opened during normal operation.
  • the main contact is provided in the safety circuit, and the electronic safety controller 21 generates a bypass command signal for closing the bypass relay main contact before generating the safety relay command signal.
  • the electronic safety controller 21 is provided with a bypass relay monitor contact that is opened and closed mechanically in conjunction with the main relay contact, and the electronic safety controller 21 is in the state of the no-pass relay monitor contact. The status of the bypass relay main contact is detected. In addition, the electronic safety controller 21 detects whether or not the bino relay main contact has operated in response to the bino command signal.
  • the electronic safety controller 21 detects an abnormality of the safety relay main contact, it outputs an abnormality detection signal to the operation control unit.
  • FIG. 21 is a block diagram showing a state where the history information recording unit and the soundness diagnosis unit are connected to the electronic safety controller 21 of FIG.
  • a history information recording unit 131 in which a history of information (processing process) regarding determination processing in the electronic safety controller 21 is recorded.
  • an elevator control device A nonvolatile memory that retains information even when the power is turned off is used. Examples of such memory include a flash memory and a node disk device.
  • the electronic safety controller 21 and the history information recording unit 131 are connected to a health diagnostic unit 132 that automatically diagnoses the health of the electronic safety controller 21.
  • the soundness diagnosis unit 132 can also diagnose the overall soundness of the entire system including various sensors and the safety circuit unit 13. The diagnosis result by the soundness diagnosis unit 132 is recorded in the history information recording unit 131.
  • FIG. 22 is an explanatory diagram showing an example of information stored in the history information recording unit 131 in FIG.
  • analysis data such as time, car position, car speed, set value (threshold value) obtained according to car position, judgment result, and internal variables are recorded.
  • the combination power of data such as car position, car speed, set value, judgment result, and analysis data is stored separately for each corresponding time, and the data as shown in FIG. A table is created.
  • FIG. 23 is a flowchart for explaining the operation of the electronic safety controller 21 of FIG.
  • the current time data is output to the history information recording unit 131 (step S81).
  • the position of the car 3 is detected (step S82).
  • the detected car position data is output to the history information recording unit 131 (step S83).
  • the speed of the force 3 is detected (step S84).
  • the detected car speed data is output to the history information recording unit 131 (step S 85).
  • a set value corresponding to the car position is calculated (step S86).
  • the set value data is output to the history information recording unit 131 (step S87).
  • the detection speed V is compared with the set value f (x) (step S88). If the detection speed V is smaller than the set value f (x), the judgment result is “No error” (Good). It is output to the history information recording unit 131 (step S89). If there is no abnormality in the speed of the force, the above operation is repeated every calculation cycle.
  • a stop command signal is output to the safety circuit unit 13 (step S90). Then, the determination result is output to the history information recording unit 131 as “abnormal” (Bad) (step S91). [0229] In the history information recording unit 131, data sent from the electronic safety controller 21 is sequentially recorded.
  • the set value set by the electronic safety controller 21 is set with a margin in consideration of force vibration caused by mischief. It is also possible to adjust the degree of allowance for each elevator.
  • the data of the judgment results recorded in the history information recording unit 131 it is possible to check how much margin is necessary in the actual operation status, and to minimize the margin. it can. As a result, the car speed can be increased and the operation efficiency can be improved.
  • the system health diagnosis result can be confirmed by the history information recording unit 1 31. Therefore, when the car 3 is suddenly stopped due to a failure of an electronic element. In this case, it is possible to efficiently identify the electronic element that is the cause.
  • the inspection items for the periodic inspection can be reduced. The following items can be confirmed during periodic inspections.
  • the diagnostic information recorded in the history information recording unit 131 is checked to check the periodicity. Inspection of the electronic element during inspection can be omitted.
  • the inspection information may be recorded in the history information recording unit 131, which may be recorded in the history information recording unit 131. It is possible to check the contents of regular inspections easily.
  • the inspection history to be recorded includes, for example, inspection implementation timing and inspection items.
  • the history information recording unit 131 and the soundness diagnosis unit 132 are provided outside the electronic safety controller 21, but at least one of them may be provided in the electronic safety controller 21.
  • the history information is recorded for monitoring the abnormal speed, but for example, history information for rope break monitoring for monitoring whether the main rope is damaged or disconnected may be recorded. It is also possible to record historical information for temperature monitoring that monitors the motor temperature of the lifting machine, inverter temperature, control panel temperature, etc.
  • the elevator apparatus in this example determines the presence or absence of an abnormality in the elevator based on information from the sensor, and outputs a signal for stopping the car when an abnormality is detected.
  • An abnormality monitoring unit electronic safety controller 21
  • a history information recording unit for recording a history of information regarding determination processing in the abnormality monitoring unit are provided.
  • FIG. 24 is a block diagram showing a main part of the electronic safety controller 21 of FIG. Electronic
  • the safety controller 21 has a memory data abnormality check circuit 141 for checking memory data abnormality, a CPU 142, and a designated address detection circuit 143 for checking an address bus abnormality.
  • the memory data error check circuit 141 is used to avoid collision between the parallel memory main memory 141a and sub memory 141b (RAM) allocated in the same address space and the output data of the sub memory 14 lb.
  • a data buffer 141c and a data comparison circuit 141d for comparing each data of the main memory 141a and the sub memory 141b to check data abnormality are provided.
  • the memory data abnormality check circuit 141 also has an error correction code check circuit as in the conventional system.
  • the CPU 142 includes a designated address output software 142a for outputting a designated address at the time of data abnormality check, a data bus abnormality check software 142b executed at the time of data bus abnormality check, and a ROM for storing programs (not shown). ).
  • the main memory 141a and the sub memory 141b are connected to the CPU 142 via the address bus BA and the data bus BD, respectively, and the data of the electronic safety controller 21 is written from the CPU 142. , Read out by CPU142.
  • the data bus BD is branched into the main memory data bus BD1 and the sub memory data bus BD2 in the memory data abnormality check circuit 141.
  • the main memory 141a and the sub memory 141b are respectively connected to the main memory data bus BD1
  • the sub-memory data bus BD2 is connected to the data comparison circuit 141d.
  • a data buffer 141c is interposed in the sub memory data bus BD2.
  • the data comparison circuit 141d compares each memory data input via the main memory data bus BD1 and the sub memory data bus BD2 when checking the memory data for an abnormality, and determines that the memory data is abnormal. In this case, the data error signal ED is output.
  • the specified address detection circuit 143 is connected to the CPU 142 via the address bus BA.
  • the address bus BA is checked for abnormality, the specified address is detected, and if it is determined that the address bus BA is abnormal, the address bus Abnormal signal EBA is output.
  • the specified address output software 142a in the CPU 142 checks the error of the address bus BA.
  • the designated address is periodically output to the designated address detection circuit 143 as described later.
  • the data bus abnormality check software 142b in the CPU 142 operates when checking the abnormality of the data bus BD, and outputs a data bus abnormality signal EBD when it is determined that there is an abnormality in the data bus BD.
  • FIG. 25 specifically shows the data comparison circuit 141d for checking data anomaly in FIG. 24.
  • a case in which the circuit 153 is configured is shown.
  • the data comparison circuit 141d includes an exclusive OR gate 151 provided in parallel, an AND gate 152 that performs an AND operation between the output signals of the exclusive OR gate 151, and an AND gate 15
  • a D-type latch circuit 153 that outputs an output signal of 2 as a D terminal input and outputs an H (logic “1”) level signal as a data abnormality signal ED.
  • Each exclusive OR gate 151 uses the data from the main memory data bus BD1 as one input signal and the data from the sub memory data bus BD2 as one input signal. Each outputs an L (logic “0”) level signal.
  • the AND gate 152 takes in the inverted signal of the output signal from each exclusive OR gate 151, and each input signal is all H level (that is, all output signals from the exclusive OR gate 151 are all L level). Output an H (logic “1”) level signal.
  • the D-type latch circuit 153 operates in response to the memory read signal RD, and at the same time the output signal (data abnormal signal ED) level in response to the D pin input (and gate 152 output signal). Is reset to the initial state in response to the reset signal RST.
  • FIG. 26 specifically shows the designated address detection circuit 143 for checking the address bus abnormality in FIG.
  • the designated address detection circuit 143 includes a plurality of exclusive OR gates 161 using the H level signal as one input signal, a plurality of exclusive OR gates 162 using the L level signal as one input signal, A NAND gate 163 that ANDs each output signal of the exclusive OR gate 161 and the address strobe signal STR, a NAND gate 164 that ANDs each output signal of the exclusive OR gate 162 and the address strobe signal STR, and a NAND gate 16 D-type latch circuit 165 using the output signal of 3 as the input signal for the set terminal, D-type latch circuit 166 using the output signal of the NAND gate 164 as the input signal for the set terminal, and outputs of the D-type latch circuits 16 5 and 166 AND gate 167 that takes the logical product of signals, D-type latch circuit 168 that operates in response to reset signal RST1 of specified address detection circuit 143, and D that operates in response to mask signal MSK of specified address detection circuit 143 D A latch circuit 169, and an OR gate 170 that takes the
  • a designated address via the address bus BA is input to each of the other input terminals of the exclusive OR gates 161 and 162 arranged in parallel.
  • Each exclusive OR gate 161 outputs an L level signal when the specified address input to the address bus BA is an H level signal, and outputs an L level signal when the specified address is an L level signal. Outputs an H level signal.
  • each exclusive OR gate 162 receives the address specified by the address bus BA.
  • an H level signal an H level signal is output, and when the specified address is an H level signal, an L level signal is output.
  • each exclusive OR gate 161 is level-inverted and input to the NAND gate 163 together with the address strobe signal STR.
  • the output signal of each exclusive OR gate 162 is inverted in level together with the address strobe signal STR and input to the NAND gate 164.
  • the NAND gates 163 and 164 synchronize with the address storage signal STR and the designated address ("FFFF") periodically input via the address bus BA. ”,“ 0000 ”), the H level signal is output complementarily at regular intervals.
  • the D-type latch circuit 168 is operated by the first reset signal RST1 when the L-level signal is applied to the D input terminal.
  • the output signal of the D-type latch circuit 168 is applied to each reset terminal of the D-type latch circuits 165 and 166.
  • the D-type latch circuit 169 is operated by the mask signal MSK while the 0 bit signal of the data bus BD (“0” when the mask is ON and “1” when the mask is OFF) BTO is applied to the D input terminal.
  • Each D-type latch circuit 168, 169 has a second These are reset by the reset signal RST2.
  • the OR gate 170 outputs the address bus error signal EBA when the output signal of the AND gate 167 or the output signal of the D-type latch circuit 169 indicates the H level.
  • FIG. 24 [0266] Next, the above three types of abnormality check operations will be described more specifically with reference to FIGS. 24 to 28.
  • FIG. 24 [0266]
  • FIG. 27 is a flowchart showing the processing operation by the designated address output software 142a and the designated address detection circuit 143 in the CPU 142 in FIG. 24, and outputs the designated address to the designated address detection circuit 143 when the address bus BA is abnormally checked. The operation procedure is shown.
  • FIG. 28 is a flowchart showing the processing operation of the data bus abnormality check software 142b in the CPU 142 of FIG.
  • FIG. 24 the data abnormality check operation by the memory data abnormality check circuit 141 will be described with reference to FIGS. 24 and 25.
  • the same address space is allocated to the main memory 141a and the sub memory 141b, and the CPU 142 writes data to the main memory 141a and the sub memory 141b. The same data is written to the same address in the main memory 141a and the sub memory 141b.
  • the sub-memory data read out on the sub-memory data bus BD2 is input to the data comparison circuit 141d to compare the data of both.
  • the data comparison circuit 141d checks for a data abnormality, and outputs a data abnormality signal ED if an abnormality (data mismatch) is detected.
  • the CPU 142 uses a designated address for checking (for example, 8 bits) that can be confirmed in both cases of "0" and "1" for each of all the bit signals used in the memory system in the address bus BA.
  • a designated address for checking for example, 8 bits
  • the processing in FIG. 27 is periodically and repeatedly executed.
  • the designated address detection circuit 143 installed on the address bus BA is caused to detect the designated address.
  • the designated address detection circuit 143 determines that there is an abnormality in the address bus BA and outputs an address bus abnormality signal EBA.
  • step S 103 the maximum value address “FFFF” in which all addresses are “1” (or the minimum value address “0000” in which all addresses are “0”) is read (step S 103).
  • FIG. 24 and FIG. 28 the data bus BD abnormality check operation by the data bus abnormality check software 142b in the CPU 142 will be described.
  • the CPU 142 for each of all the bit signals used in the memory system on the data bus BD, can specify both “0” and “1” for checking specified data (for example, in the case of 8 bits, “AA” and “55” or “01”, “02”, “04”, “08”, “10”, “20”, “40” and “80” and other thread values) Then, the read / write check operation by the process of FIG. 28 (steps S 105 to SI 11) is periodically repeated.
  • the CPU 142 determines that there is an abnormality in the data bus BD and outputs a data bus abnormality signal EBD.
  • step S108 If it is determined in step S108 that the designated data after reading does not match the designated data before writing (ie, NO), the CPU 142 does not consider the data bus BD to be abnormal, and the data bus abnormal signal Outputs EBD (step S109) and terminates abnormally.
  • step S108 determines whether the designated data after reading matches the designated data before writing (ie, YES). If it is determined in step S108 that the designated data after reading matches the designated data before writing (ie, YES), variable N is incremented (step S11 0), and variable N Is less than or equal to “8” (step SI 11).
  • step S111 determines whether N> 9 (that is, NO)
  • the above abnormality check is effective in checking the health of the memory system in the elevator electronic safety device.
  • the electronic safety controller 21 in this example includes the CPU having the designated address output software and the data bus abnormality check software, and the main memory and the sub memory connected to the CPU via the address bus and the data bus. And a memory data abnormality check circuit for comparing data in the main memory and the sub memory, and a designated address detection circuit connected to the CPU via the address bus.
  • the CPU executes designated address output software and The address bus is checked periodically using the specified address detection circuit, and the CPU executes the data node check software and periodically checks the data bus using the main memory and sub memory. Do it.
  • the CPU executes the specified address output software, and in the case of both "0" and "1" for all the bit signals used for the main memory and sub memory in the address bus.
  • the specified address for check that can be confirmed is periodically output to the specified address detection circuit, and the specified address detection circuit detects multiple specified addresses that are also output periodically by the CPU power, and detects all of the multiple specified addresses. If not, it is determined that the address bus is abnormal and an address bus error signal is output.
  • the CPU executes the data bus error check software, and in the case of both "0" and "1" for all the bit signals used for the main memory and the sub memory in the data bus.
  • the specified data for checking that can be checked periodically is input / output, and the CPU power periodically reads and compares multiple specified data that are output periodically into the main memory and sub memory, and before writing Multiple specified data and multiple specified data after reading If they do not all match, it is determined that the data bus is abnormal and a data bus error signal is output.
  • FIG. 29 is a flowchart showing operations of the electronic safety controller 21 and the elevator control unit 11 when the nearest floor stop command is generated in FIG.
  • the electronic safety controller 21 detects an abnormality that should stop the force on the nearest floor, for example, a failure of the electronic safety controller 21 itself (step S121)
  • the electronic safety controller 21 operates the elevator controller 11.
  • the nearest floor stop command signal is output to the control unit 12 (step S 122).
  • the operation control part 12 performs the process for stopping a force on the nearest floor (step S123).
  • the electronic safety controller 21 starts the built-in emergency stop timer and starts counting by the emergency stop timer (step S124).
  • the emergency stop timer expires when the preset time (the time sufficient to complete the nearest floor stop) has elapsed.
  • an emergency stop command is output from the electronic safety controller 21 to the safety circuit unit 13 of the elevator control unit 11 (step S125). Thereby, the elevator control unit 11 performs an emergency stop operation (step S126).
  • FIG. 30 is a circuit diagram showing the main parts of the electronic safety controller 21 and the elevator control unit 11 of FIG.
  • the electronic safety controller 21 is provided with an emergency stop timer circuit unit 171 that functions as the emergency stop timer.
  • the emergency stop timer circuit unit 171 is configured by a hardware circuit having an independent software program capability in the electronic safety controller 21.
  • the command from the nearest floor stop output port 172 is simultaneously input to the first transistor 173 and the emergency stop timer circuit unit 171. When the nearest floor stop command is input to the first transistor 173, the first relay unit 174 is turned off, and the nearest floor stop command signal is input to the operation control unit 12.
  • the count starts.
  • the second transistor 176 is turned off and the second relay part 177 is turned off.
  • the emergency stop command is input to the safety circuit unit 13, that is, the safety circuit unit 13 is shut off. As a result, the drive power contactor and the brake power contactor of the drive device 7 are dropped, and the car is emergency stopped.
  • the soundness check of the emergency stop timer circuit section 171 is preferably performed periodically and automatically.
  • the soundness check of the emergency stop timer circuit 171 may be performed once a day, for example, when the car call is not registered and enters the automatic turn-off mode for a predetermined time.
  • a signal notifying the acceptance of the sanity check is input from the elevator control unit 11 to the electronic safety controller 21.
  • the electronic safety controller 21 inputs a signal notifying the start of the check to the elevator control unit 11, and subsequently inputting the nearest floor stop command. Then, a signal notifying the quality of the check result is returned from the elevator control unit 11 to the electronic safety controller 21.
  • the emergency stop timer circuit unit 171 is restored by hardware reset, and the second relay unit 177 is turned on.

Abstract

La présente invention concerne un ascenseur, dans lequel un contrôleur de sécurité électronique est capable de détecter ses propres pannes. De plus, lorsque le contrôleur de sécurité électronique détecte sa propre panne, il produit, pour une section de contrôle de l'ascenseur, une commande d'arrêt afin d'arrêter la cabine de l'ascenseur à l'étage le plus proche et, lorsqu'un temps prédéterminé s'est écoulé après l'émission de la commande d'arrêt, le contrôleur produit, pour la section de contrôle de l'ascenseur, une commande d'arrêt d'urgence pour arrêter la cabine de l'ascenseur en urgence.
PCT/JP2005/003132 2005-02-25 2005-02-25 Ascenseur WO2006090470A1 (fr)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2007504602A JP4757863B2 (ja) 2005-02-25 2005-02-25 エレベータ装置
CNB2005800349327A CN100542927C (zh) 2005-02-25 2005-02-25 电梯装置
PCT/JP2005/003132 WO2006090470A1 (fr) 2005-02-25 2005-02-25 Ascenseur
EP05719533.1A EP1852382B1 (fr) 2005-02-25 2005-02-25 Ascenseur

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2005/003132 WO2006090470A1 (fr) 2005-02-25 2005-02-25 Ascenseur

Publications (1)

Publication Number Publication Date
WO2006090470A1 true WO2006090470A1 (fr) 2006-08-31

Family

ID=36927121

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2005/003132 WO2006090470A1 (fr) 2005-02-25 2005-02-25 Ascenseur

Country Status (4)

Country Link
EP (1) EP1852382B1 (fr)
JP (1) JP4757863B2 (fr)
CN (1) CN100542927C (fr)
WO (1) WO2006090470A1 (fr)

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009157085A1 (fr) * 2008-06-27 2009-12-30 三菱電機株式会社 Appareil d'ascenseur et procédé de fonctionnement de celui-ci
JP2011121726A (ja) * 2009-12-11 2011-06-23 Hitachi Ltd 電子安全エレベータ
JP2012082059A (ja) * 2010-10-14 2012-04-26 Hitachi Ltd 電子安全エレベータ
US8272482B2 (en) 2007-06-14 2012-09-25 Mitsubishi Electric Corporation Elevator apparatus for braking control of car according to detected content of failure
JP5404787B2 (ja) * 2009-06-29 2014-02-05 三菱電機株式会社 エレベータ装置
JP2014504243A (ja) * 2010-12-14 2014-02-20 コネ コーポレイション インターフェイスユニットと搬送システムおよび方法
JP2014118290A (ja) * 2012-12-19 2014-06-30 Hitachi Ltd 電子安全エレベータ
US9108823B2 (en) 2010-03-12 2015-08-18 Mitsubishi Electric Corporation Elevator safety control device
WO2016113895A1 (fr) * 2015-01-16 2016-07-21 三菱電機株式会社 Dispositif de commande de sécurité d'ascenseur et procédé de commande de sécurité d'ascenseur
JP2018011444A (ja) * 2016-07-14 2018-01-18 日立オートモティブシステムズ株式会社 電動モータの制御診断システム及び制御診断方法
WO2018020662A1 (fr) * 2016-07-29 2018-02-01 三菱電機株式会社 Dispositif de commande d'ascenseur
US10071881B2 (en) 2013-12-12 2018-09-11 Otis Elevator Company Safety system for use in a drive system
CN112299175A (zh) * 2019-07-26 2021-02-02 富士达株式会社 电梯的编码器诊断系统及诊断方法
WO2021176547A1 (fr) * 2020-03-03 2021-09-10 株式会社日立製作所 Système de commande de sécurité d'ascenseur et ascenseur l'utilisant
JP7063410B1 (ja) 2021-08-30 2022-05-09 フジテック株式会社 昇降装置
JP7279836B1 (ja) 2022-06-03 2023-05-23 フジテック株式会社 制御装置、制御方法、および乗客搬送制御装置

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101128379B (zh) 2006-03-17 2011-09-14 三菱电机株式会社 电梯装置
KR101338843B1 (ko) * 2009-12-15 2013-12-06 미쓰비시덴키 가부시키가이샤 엘리베이터 장치
EP2336073A1 (fr) * 2009-12-18 2011-06-22 Inventio AG Dispositif de commutation pour installations de transport
JP5422488B2 (ja) * 2010-05-31 2014-02-19 株式会社日立製作所 安全エレベータ
FI122474B (fi) * 2010-12-01 2012-02-15 Kone Corp Hissin turvakytkentä sekä menetelmä hissin turvakytkennän toiminnallisen poikkeaman tunnistamiseksi
US8794389B2 (en) * 2011-06-30 2014-08-05 Tyco Fire & Security Gmbh Interface between fire panel and elevator controller
JP5773893B2 (ja) * 2012-01-10 2015-09-02 東芝エレベータ株式会社 乗客コンベアの安全装置及び安全システム
JP2013241225A (ja) * 2012-05-17 2013-12-05 Mitsubishi Electric Corp 乗客コンベアの制御装置および乗客コンベアの制御方法
WO2014030247A1 (fr) 2012-08-24 2014-02-27 三菱電機株式会社 Système de communication monté dans un véhicule et procédé de communication à montage dans un véhicule
DE112013006757B4 (de) * 2013-03-01 2022-03-24 Mitsubishi Electric Corporation Datenverarbeitungsvorrichtung und Kommunikationssystem
JP6317077B2 (ja) * 2013-07-05 2018-04-25 株式会社日立製作所 エレベーターの安全システム
TWI530954B (zh) * 2013-11-22 2016-04-21 新唐科技股份有限公司 保護非揮發性記憶體中儲存之程式碼的裝置
ES2538418B1 (es) * 2013-12-19 2016-04-14 Orona, S. Coop. Sistema de control de seguridad de un ascensor, escalera mecánica o ánden móvil
EP3178768A1 (fr) * 2015-12-07 2017-06-14 Kone Corporation Dispositif de conduite
CN109789993B (zh) * 2016-09-29 2020-10-09 因温特奥股份公司 带有具有例如乘客自主撤离的选择的两个单元的电梯安全监督实体
ES2882042T3 (es) 2018-03-16 2021-12-01 Otis Elevator Co Operación de rescate automático en un sistema de ascensor
CN108750844B (zh) * 2018-05-21 2020-06-26 日立楼宇技术（广州）有限公司 召梯类型识别方法和系统、识别设备、可读存储介质
EP3656718A1 (fr) * 2018-11-23 2020-05-27 Otis Elevator Company Système de sécurité d'ascenseur à fonctionnalité auto-diagnostique
EP4121383B1 (fr) * 2020-03-19 2023-10-04 Elgo Batscale AG Unité de commande pour système de levage
TW202229150A (zh) * 2021-01-25 2022-08-01 永大機電工業股份有限公司 具自動救出功能的電梯控制模組
CN115535812A (zh) * 2021-06-30 2022-12-30 奥的斯电梯公司 电梯安全系统、电梯系统以及电梯安全控制方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS5450769A (en) * 1977-09-30 1979-04-20 Hitachi Ltd Trouble diagnosing memory system
JPS5943780A (ja) * 1982-09-07 1984-03-10 株式会社東芝 防爆エレベ−タの制御方法
JPS61162473A (ja) * 1985-01-14 1986-07-23 三菱電機株式会社 エレベ−タ制御装置
JPH05132256A (ja) * 1991-11-05 1993-05-28 Hitachi Ltd エレベーター制御装置とその遠隔監視システム
JP2002538061A (ja) * 1999-03-04 2002-11-12 オーチス エレベータ カンパニー エレベータ安全システム

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3587785A (en) * 1969-03-04 1971-06-28 Otis Elevator Co Elevator control system safety arrangement
JPS58177864A (ja) 1982-04-07 1983-10-18 株式会社日立製作所 交流エレベ−タ−の制御装置
JPH0729746B2 (ja) 1984-01-11 1995-04-05 株式会社日立製作所 エレベ−タ−の非常停止制御装置
JPH01247382A (ja) 1988-03-30 1989-10-03 Hitachi Ltd エレベーター制御システム
US4898263A (en) * 1988-09-12 1990-02-06 Montgomery Elevator Company Elevator self-diagnostic control system
US5407028A (en) * 1993-04-28 1995-04-18 Otis Elevator Company Tested and redundant elevator emergency terminal stopping capability
DE19513851C2 (de) 1995-04-12 1997-02-27 Joerg Ammann Sicherheitseinrichtung für einen Umlaufaufzug zur Personenbeförderung
WO2003004597A1 (fr) 2001-07-02 2003-01-16 Hitachi, Ltd. Dispositif de synthese de chaines glucidiques

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS5450769A (en) * 1977-09-30 1979-04-20 Hitachi Ltd Trouble diagnosing memory system
JPS5943780A (ja) * 1982-09-07 1984-03-10 株式会社東芝 防爆エレベ−タの制御方法
JPS61162473A (ja) * 1985-01-14 1986-07-23 三菱電機株式会社 エレベ−タ制御装置
JPH05132256A (ja) * 1991-11-05 1993-05-28 Hitachi Ltd エレベーター制御装置とその遠隔監視システム
JP2002538061A (ja) * 1999-03-04 2002-11-12 オーチス エレベータ カンパニー エレベータ安全システム

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1852382A4 *

Cited By (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8272482B2 (en) 2007-06-14 2012-09-25 Mitsubishi Electric Corporation Elevator apparatus for braking control of car according to detected content of failure
WO2009157085A1 (fr) * 2008-06-27 2009-12-30 三菱電機株式会社 Appareil d'ascenseur et procédé de fonctionnement de celui-ci
KR101218022B1 (ko) * 2008-06-27 2013-01-02 미쓰비시덴키 가부시키가이샤 엘리베이터 장치 및 그 운전 방법
US8430212B2 (en) 2008-06-27 2013-04-30 Mitsubishi Electric Corporation Safety control device for an elevator apparatus and operating method thereof
JP5197745B2 (ja) * 2008-06-27 2013-05-15 三菱電機株式会社 エレベータ装置及びその運転方法
JP5404787B2 (ja) * 2009-06-29 2014-02-05 三菱電機株式会社 エレベータ装置
US8887873B2 (en) 2009-06-29 2014-11-18 Mitsubishi Electric Corporation Elevator device
JP2011121726A (ja) * 2009-12-11 2011-06-23 Hitachi Ltd 電子安全エレベータ
US9108823B2 (en) 2010-03-12 2015-08-18 Mitsubishi Electric Corporation Elevator safety control device
CN102452595A (zh) * 2010-10-14 2012-05-16 株式会社日立制作所 电子安全电梯
JP2012082059A (ja) * 2010-10-14 2012-04-26 Hitachi Ltd 電子安全エレベータ
JP2016041631A (ja) * 2010-12-14 2016-03-31 コネ コーポレイションＫｏｎｅ Ｃｏｒｐｏｒａｔｉｏｎ インタフェースユニットと搬送システムおよび方法
JP2014504243A (ja) * 2010-12-14 2014-02-20 コネ コーポレイション インターフェイスユニットと搬送システムおよび方法
JP2014118290A (ja) * 2012-12-19 2014-06-30 Hitachi Ltd 電子安全エレベータ
US10071881B2 (en) 2013-12-12 2018-09-11 Otis Elevator Company Safety system for use in a drive system
DE112015005972B4 (de) 2015-01-16 2021-12-02 Mitsubishi Electric Corporation Aufzugsicherheits-steuervorrichtung und aufzugsicherheits-sicherheits-steuerverfahren
WO2016113895A1 (fr) * 2015-01-16 2016-07-21 三菱電機株式会社 Dispositif de commande de sécurité d'ascenseur et procédé de commande de sécurité d'ascenseur
JPWO2016113895A1 (ja) * 2015-01-16 2017-04-27 三菱電機株式会社 エレベータ安全制御装置およびエレベータ安全制御方法
JP2018011444A (ja) * 2016-07-14 2018-01-18 日立オートモティブシステムズ株式会社 電動モータの制御診断システム及び制御診断方法
WO2018020662A1 (fr) * 2016-07-29 2018-02-01 三菱電機株式会社 Dispositif de commande d'ascenseur
JPWO2018020662A1 (ja) * 2016-07-29 2018-11-08 三菱電機株式会社 エレベータの制御装置
CN112299175A (zh) * 2019-07-26 2021-02-02 富士达株式会社 电梯的编码器诊断系统及诊断方法
JP2021020763A (ja) * 2019-07-26 2021-02-18 フジテック株式会社 エレベーターのエンコーダー診断システム及び診断方法
WO2021176547A1 (fr) * 2020-03-03 2021-09-10 株式会社日立製作所 Système de commande de sécurité d'ascenseur et ascenseur l'utilisant
JP7063410B1 (ja) 2021-08-30 2022-05-09 フジテック株式会社 昇降装置
JP2023034211A (ja) * 2021-08-30 2023-03-13 フジテック株式会社 昇降装置
JP7279836B1 (ja) 2022-06-03 2023-05-23 フジテック株式会社 制御装置、制御方法、および乗客搬送制御装置

Also Published As

Publication number Publication date
EP1852382A4 (fr) 2013-01-30
JPWO2006090470A1 (ja) 2008-07-24
EP1852382A1 (fr) 2007-11-07
CN101039864A (zh) 2007-09-19
CN100542927C (zh) 2009-09-23
JP4757863B2 (ja) 2011-08-24
EP1852382B1 (fr) 2015-12-30

Similar Documents

Publication Publication Date Title
JP4757863B2 (ja) エレベータ装置
JP5350590B2 (ja) エレベータ装置
JP6263552B2 (ja) エレベータの安全システム
EP2671836B1 (fr) Dispositif de contrôle de sécurité pour ascenseur
JP5624845B2 (ja) 電子安全エレベータ
JP5404787B2 (ja) エレベータ装置
JP6743172B2 (ja) エレベーター制御装置、制御方法及びエレベーター
JP7181416B2 (ja) 放電制御回路および電力変換装置
JP6132976B2 (ja) エレベータの制御装置
KR100894371B1 (ko) 엘리베이터 장치
CN111295350B (zh) 用于监控人员运送设备中的对于安全关键的状态的安全监控装置以及用于运行这种安全监控装置的方法
JPS6223712B2 (fr)
KR20070012457A (ko) 엘리베이터 장치
JP5388801B2 (ja) エレベータの地震復旧診断運転装置
JPH05132256A (ja) エレベーター制御装置とその遠隔監視システム
JP7285070B2 (ja) ホームドアの状態診断システム、ホームドアの状態診断方法、可動装置の状態診断方法
WO2021213880A1 (fr) Procédé et système de commande pour la maintenance du mécanisme de porte d'un système d'ascenseur
WO2016113895A1 (fr) Dispositif de commande de sécurité d'ascenseur et procédé de commande de sécurité d'ascenseur
JP2005343602A (ja) エレベータ制御装置
KR0167209B1 (ko) 엘리베이터의 구출운전 제어 방법 및 장치
JPH06114600A (ja) プレス機械の異常監視装置
CN114488991A (zh) 机器人安全监控系统及其诊断异常的方法
JPH0321472B2 (fr)

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2007504602

Country of ref document: JP

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2005719533

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 1020067023266

Country of ref document: KR

WWP Wipo information: published in national office

Ref document number: 1020067023266

Country of ref document: KR

WWE Wipo information: entry into national phase

Ref document number: 200580034932.7

Country of ref document: CN

NENP Non-entry into the national phase

Ref country code: DE

WWP Wipo information: published in national office

Ref document number: 2005719533

Country of ref document: EP