WO2019171424A1 - Elevator safety control device - Google Patents

Abstract

This elevator safety control device comprises: a storage unit to store each of a plurality of safety control functions and a plurality of non-safety control functions as independent programs and to store safety scheduling information; and a CPU to perform control calculations for an elevator by way of sequentially executing programs, corresponding to each of the plurality of safety control functions and the plurality of non-safety control functions, according to the safety scheduling information. The CPU sequentially executes the safety control functions continuously with no idle time according to the safety scheduling information during each control cycle and executes the plurality of non-safety control functions during idle time in the control cycle after all safety control functions have been executed.

Description

Elevator safety control device

The present invention relates to an elevator safety control device that controls the operation of an elevator having a plurality of safety control functions.

In recent years, various safety control functions have been introduced into elevators. Specific examples of the safety control function include the following.
・ Terminal floor forced deceleration function (SETS)
・ Open door protection function (UCMP)
・ Self-diagnosis function (DIAG)
・ Intersystem communication function (ICOM)

On the other hand, specific examples of the non-safety control function include the following.
・ Data logging function (DLOG)
・ Interface function (CCIF) with elevator operation control device

安全 The safety control function as described above is expected to expand further in the future. When implementing each of these safety control functions, a plurality of boards or devices must be prepared for each safety function. For this reason, the cost of an apparatus and the effort of installation and maintenance of an apparatus will increase.

Therefore, in order to solve this problem, a method of mounting a plurality of safety control functions on one board or one apparatus has been proposed (for example, see Patent Document 1).

When multiple safety control functions are mounted on one board or device, each control function is independent so that applications of safety control functions or non-safety control functions do not affect other safety control functions. It is necessary to ensure sex.

Therefore, there is a conventional technique in which an application related to a safety control function is made independent of an application related to a non-safety control function by task scheduling using time partitioning (see, for example, Patent Document 2). Each time partition has a fixed size for each period, and tasks are scheduled from a group of tasks determined by each partition.

In the example of FIG. 1 in Patent Document 2, the time partition TP1 includes a safety control function task ST1, the time partition TP2 includes a safety control function task ST2, and the time partition TP3 includes a non-safety control function tasks NST1 and NST2. Each is scheduled. The scheduling method in each TP is free. However, in order to ensure independence, it is not possible to mix the task of the application related to the safety control function and the task of the application related to the non-safety control function in the same TP.

Japanese Patent No. 550718 JP 2010-271759 A International Publication No. 2011/158301 JP 2003-104646 A

However, the prior art has the following problems.
In the time partitioning used in Patent Document 2, each period is divided into partitions of a fixed size, and tasks of a predetermined type of application are scheduled in the divided partitions. The time required to complete application processing varies depending on factors such as conditional branching and bus contention. Therefore, the size of the partition needs to be set in consideration of the worst execution time of each application.

Here, the worst execution time indicates the worst case time that takes the longest time to complete the processing. For this reason, in Patent Document 2, each partition is set to be larger in consideration of the worst execution time, and when the task is completed early, a free time occurs in the partition.

However, in order to ensure independence, the task of the application related to the safety control function and the task of the application related to the non-safety control function must be scheduled in different partitions without fail.

Therefore, even if the partition assigned to the safety control function related application is vacant, the task of the non-safety control function related application cannot be assigned to the free time. As a result, the time partitioning used in Patent Document 2 has a problem that the utilization efficiency of the CPU cannot be improved.

The present invention has been made to solve the above-described problems, and achieves efficient task scheduling while ensuring the independence of the safety control function task and the non-safety control function task. The purpose is to obtain an elevator safety control device.

The elevator safety control device according to the present invention stores a plurality of safety control functions and a plurality of non-safety control functions as independent programs, and each control cycle when the plurality of safety control functions are executed in each control cycle. A storage unit that stores safety scheduling information in which scheduling and execution order are defined in advance, and by sequentially executing each program corresponding to a plurality of safety control functions and a plurality of non-safety control functions according to the safety scheduling information, the elevator The CPU performs a control operation of the control, and in each control cycle, the CPU sequentially executes the safety control function without any free time in accordance with the execution order defined as the safety scheduling information, and is assigned within the control cycle. Within the control cycle after executing all safety control functions In came time, and executes a plurality of non-safety control functions.

According to the present invention, the safety control function task is preferentially executed, and the vacant time after the execution of the safety control function is completed is summarized after each control cycle, and the vacant time is used to make the non-safety control function. It has a configuration that can execute. As a result, it is possible to obtain an elevator safety control device that realizes efficient task scheduling while ensuring the independence of the safety control function task and the non-safety control function task.

It is a block diagram of the elevator safety control apparatus in Embodiment 1 of this invention. It is a figure for demonstrating the task processing content performed in the control period of the 1st time based on safe scheduling information and non-safety scheduling information in the logic part and independence guarantee part which concern on Embodiment 1 of this invention. It is a figure for demonstrating the task processing content performed in the control period of the 2nd time based on safe scheduling information and non-safety scheduling information in the logic part and independence guarantee part which concern on Embodiment 1 of this invention. 4 is a flowchart summarizing a series of task processes executed by a logic unit and an independence assurance unit according to Embodiment 1 of the present invention. It is the figure which showed the modification of the safe scheduling information which concerns on Embodiment 1 of this invention, and non-secure scheduling information. In Embodiment 1 of this invention, it is a figure for demonstrating the error process at the time of the interruption process generate | occur | producing during performing the task of a safety control function. It is a figure for demonstrating operation | movement of the modification 5 in Embodiment 1 of this invention. It is a figure for demonstrating operation | movement of the modification 5 in Embodiment 1 of this invention. It is a figure for demonstrating operation | movement of the modification 6 in Embodiment 1 of this invention. It is a figure for demonstrating operation | movement of the modification 6 in Embodiment 1 of this invention. It is a figure for demonstrating operation | movement of the modification 6 in Embodiment 1 of this invention. It is a whole block diagram of the elevator system which applies the elevator safety control apparatus which concerns on Embodiment 2 of this invention. It is the block diagram which showed the internal structure of the elevator safety monitoring apparatus in Embodiment 2 of this invention in detail. It is a block diagram common to the 1st safety monitoring system and the 2nd safety monitoring system in Embodiment 2 of this invention. In Embodiment 2 of this invention, it is an execution time chart equivalent to the execution plan according to safe scheduling information and non-safety scheduling information. It is an execution time chart at the time of performing the task processing by Embodiment 2 of this invention. It is an execution time chart at the time of performing the task processing by a prior art.

Hereinafter, preferred embodiments of the elevator safety control device of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
First, the terms used in the description of the present invention include “task”, “specified time”, “control cycle”, “safe scheduling information”, “non-safe scheduling information”, “task suspension”, and “task termination”. Table 1 summarizes the meanings of the meaning contents.

FIG. 1 is a configuration diagram of an elevator safety control device according to Embodiment 1 of the present invention. The elevator safety control device according to the first embodiment includes an input unit 10, a logic unit 20, and an independence assurance unit 30. The CPU 21 in the logic unit 20 acquires a signal related to the state of the elevator as an input value, and reads the program 40, the safety scheduling information 50, and the non-safety scheduling information 60.

Here, the program 40, the safety scheduling information 50, and the non-safety scheduling information 60 correspond to data stored in the storage unit, and the CPU 21 in the logic unit 20 refers to these data and is necessary for elevator control. Will be executed.

The program 40 has a plurality of safety control function tasks 41 and a plurality of non-safety control function tasks 42.

The safety scheduling information 50 is scheduling information that defines in what control cycle the tasks 41 of a plurality of safety control functions should be executed in what order. Specifically, the safety scheduling information 50 is defined with an execution order of each task of the safety control function, a prescribed time of the task, and a final flag indicating that it is a final safety task executed at the end of each control cycle. Information.

In the specific example of the safety scheduling information 50 shown in FIG. 1, the safety control function tasks ST1 and ST2 are sequentially executed in the first control cycle, and the safety control function tasks ST1 and ST3 are sequentially executed in the next control cycle. In addition, it is defined that each of the tasks ST1, ST2, and ST3 is monitored at specified times T1, T2, and T3.

Non-safety scheduling information 60 is scheduling information that defines the execution order of tasks 42 of a plurality of non-safety control functions. Specifically, the non-safety scheduling information 60 is information that defines only in what order the tasks of the non-safety control function should be executed without depending on the control cycle.

In the specific example of the non-safety scheduling information 60 shown in FIG. 1, it is defined that the non-safety control function tasks NST1, NST2, NST3, and NST1 should be executed sequentially.

Then, the CPU 21 in the logic unit 20 uses the input value, and a plurality of safety control functions whose scheduling is defined by the safety scheduling information 50 and a plurality of non-safety control functions whose scheduling is defined by the non-safety scheduling information 60 Are sequentially executed as independent programs 40 to perform elevator control calculation.

In addition, the CPU 21 in the logic unit 20 can cause the context block 70 to store information on the execution state of each program 40 that is independently executed, and read out the information on the execution state as necessary. it can. Here, the context block 70 corresponds to readable / writable data stored in the storage unit.

The independence assurance unit 30 controls all the control functions including a plurality of safety control function tasks 41 and a plurality of non-safety control function tasks 42 so that a certain control function does not affect other control functions. Ensures independence between functions. The independence assurance unit 30 includes a specified time timer 31 that monitors the progress of a specified time, a control cycle timer 32 that monitors the progress of a control period, and a memory protection function 33.

In the present invention, the logic unit 20 and the independence assurance unit 30 work together to execute each task specified by the safety scheduling information 50 and the non-safety scheduling information 60 sequentially as an independent program 40. In particular, the technical feature is that the idle time during which the task 41 of the safety control function is not executed can be collected after each control cycle.

And this idle time is independent of the safety control function, unlike the conventional method. For this reason, it becomes possible to sequentially assign the tasks 42 of the non-safety control function whose execution order is defined by the non-safety scheduling information 60 to the idle time of each control cycle. As a result, the present invention can measure the improvement in the utilization efficiency of the CPU 21 as compared with the conventional method.

Therefore, specific operations of the task processing executed by the logic unit 20 and the independence assurance unit 30 according to the first embodiment will be described in detail with reference to FIGS. 2A, 2B, and 3. FIG. 2A shows the task processing contents executed in the first control cycle based on the safety scheduling information 50 and the non-safety scheduling information 60 in the logic unit 20 and the independence assurance unit 30 according to Embodiment 1 of the present invention. It is a figure for demonstrating. 2B shows task processing executed in the second control cycle based on the safety scheduling information 50 and the non-safety scheduling information 60 in the logic unit 20 and the independence assurance unit 30 according to Embodiment 1 of the present invention. It is a figure for demonstrating the content.

2A, the first control cycle is shown as a period from time t0 to time t3, and in FIG. 2B, the second control cycle is shown as a period from time t3 to time t6. 2A and 2B illustrate examples of task processing results executed by the logic unit 20 and the independence assurance unit 30 in accordance with the safety scheduling information 50 and the non-safety scheduling information 60 shown in FIG. Yes.

First, in the first control cycle shown in FIG. 2A, according to the safety scheduling information 50, the tasks ST1 and ST2 of the safety control function are sequentially executed without any free time. Further, in the idle time after the safety control function tasks ST1 and ST2 are executed, the non-safety control function tasks NST1, NST2, and NST3 are successively executed in sequence according to the non-safety scheduling information 60.

More specifically, at time t1, the processing of task ST1 is completed before the specified time T1 set for task ST1 elapses. Therefore, the CPU 21 starts processing of the task ST2 at time t1 before the interruption by the specified time timer 31 in the independence assurance unit 30 occurs.

Time t2 corresponds to the time after the specified time T2 has elapsed from time t1. At time t2, the CPU 21 receives an interrupt from the specified time timer 31 in a state where the task ST2 is not completed, and interrupts the processing of the task ST2.

The period from time t2 to time t3 corresponds to the idle time after processing the tasks ST1 and ST2 in the first control cycle. Therefore, the CPU 21 sequentially executes the non-safety control function tasks NST1, NST2, and NST3 in accordance with the non-safety scheduling information 60. However, at the end time t3 of the first control cycle, an interrupt is generated by the control cycle timer 32 in a state where the processing of the task NST3 is not completed. Therefore, the task NST3 resumes the processing after being interrupted in the idle time of the second control cycle described later.

Next, in the second control cycle shown in FIG. 2B, according to the safety scheduling information 50, the tasks ST1 and ST3 of the safety control function are sequentially executed without any free time. Further, in the idle time after the safety control function tasks ST1 and ST3 are executed, the non-safety control function tasks are successively and sequentially executed according to the non-safety scheduling information 60. As described above, the task NST3 is suspended in the first control cycle. Therefore, in the idle time in the second control cycle, the process starts from the point where the processing of the task NST3 is resumed, and then the task NST1 is executed according to the non-safety scheduling information 60.

More specifically, time t4 corresponds to the time when the specified time T1 has elapsed from time t3. Accordingly, at time t4, the CPU 21 receives an interrupt from the specified time timer 31 in a state where the task ST1 is not completed, and interrupts the processing of the task ST1. Then, the CPU 21 starts processing of the task ST3 at time t4.

At time t5, the processing of task ST3 is completed before the specified time T3 set for task ST3 has elapsed. The period from time t5 to time t6 corresponds to the idle time after processing the tasks ST1 and ST3 in the second control cycle. Accordingly, the CPU 21 resumes the continuation processing of the task NST3 at time t5 before the interruption by the specified time timer 31 in the independence assurance unit 30 occurs.

However, at the end time t6 of the second control cycle, an interrupt is generated by the control cycle timer 32 in a state where the processing of the task NST1 is not completed. Accordingly, the task NST1 resumes the processing after being interrupted in the free time of the third control cycle.

FIG. 3 is a flowchart summarizing a series of task processes executed by the logic unit 20 and the independence assurance unit 30 according to the first embodiment of the present invention. In the following description, the flowchart of FIG. 3 will be described based on the specific task scheduling shown in FIGS. 1 and 2.

The logic unit 20 performs initial setting in step S301, and then assigns the first task ST1 among the tasks of the safety control function in the first control cycle based on the safety scheduling information 50 in step S302.

Next, in step S303, the logic unit 20 executes the task before the specified time T1 assigned to the task ST1 elapses, that is, before the interrupt is generated by the specified time timer 31 in the independence assurance unit 30. It is determined whether the termination process of ST1 has been executed. The logic unit 20 proceeds to step S305 if it determines Yes in step S303, and proceeds to step S304 if it determines No.

When the process proceeds to step S304, the logic unit 20 interrupts the task ST1 due to an interrupt generated by the specified time timer 31, and proceeds to step S305.

When the process proceeds to step S305, the logic unit 20 determines based on the final flag whether there are still safety control function tasks to be executed in the first control cycle. In step S303, the logic unit 20 proceeds to step S302 if it determines Yes, and proceeds to step S306 if it determines No.

In the example shown in FIGS. 1 and 2, it is necessary to process task ST2 after task ST1 of the safety control function in the first control cycle. Therefore, after the processing of step S302 to step S305 is performed for task ST2, the process proceeds to step S306.

In the processing after step S306, the logic unit 20 and the independence assurance unit 30 sequentially execute the non-safety control function tasks in the idle time after executing the safety control function tasks ST1 and ST2 in the first control cycle. Will be.

In step S306, the logic unit 20 determines whether there is a non-safety control function task to be executed in the idle time in the first control cycle based on the non-safety scheduling information 60. The logic unit 20 proceeds to step S307 if it determines Yes in step S306, and proceeds to step S310 if it determines No.

When the processing proceeds to step S307, the logic unit 20 assigns the first task NST1 among the tasks of the non-safety control function based on the non-safety scheduling information 60.

Next, in step S308, the logic unit 20 executes the end process of the task NST1 before the control cycle ends, that is, before an interrupt is generated by the control cycle timer 32 in the independence assurance unit 30. Determine whether. The logic unit 20 proceeds to step S306 if it is determined Yes in step S308, and proceeds to step S309 if it is determined No.

In the example shown in FIGS. 1 and 2, as the non-safe scheduling information 60, task NST2, task NST3, task NST1,... Are set after task NST1. Accordingly, the logic unit 20 repeats the processes of Steps S306 to S308 until the interrupt of the control cycle timer 32 is received, thereby continuing the tasks of the non-safety control function set as the non-safety scheduling information 60. Will be executed sequentially.

When the processing proceeds to step S309, the logic unit 20 interrupts the task of the non-safety control function currently being executed and generates a series of processing for the first control cycle when an interrupt is generated by the control cycle timer 32. When finished, the process returns to step S302. In the example shown in FIG. 1 and FIG. 2, the task NST3 is interrupted and the first control cycle is completed when an interrupt is generated by the control cycle timer 32 while the task NST3 of the non-safety control function is being executed. It will be.

If the process proceeds from step S306 to step S310, the logic unit 20 waits until an interrupt is generated by the control cycle timer 32 because there is no non-safety control function task to be executed. In step S311, the interruption by the control cycle timer 32 is generated, so that the series of processes for the first control cycle is completed, and the process returns to step S302.

In the example shown in FIGS. 1 and 2, the safety scheduling information 50 stipulates that the tasks ST1 and ST3 of the safety control function should be executed in the second control cycle. Accordingly, when the process returns to step S302 after completing the series of processes in the first control cycle, the respective task processes in the second control cycle are successively executed.

Next, some modifications for realizing the basic technical idea of arranging the idle time in the latter half of the control cycle as described above will be described below.

[Modification 1]
A modified example of the safe scheduling information 50 and the non-secure scheduling information 60 will be described. FIG. 4 is a diagram showing a modified example of the safe scheduling information and the non-safe scheduling information according to Embodiment 1 of the present invention.

The safety scheduling information 50 shown in FIG. 1 is composed of safety control function tasks. On the other hand, the safety scheduling information 50a shown in FIG. 4 includes one or more non-safety control function tasks.

Specifically, the safety scheduling information 50a shown in FIG. 4 stipulates that the task NST1 of the non-safety control function is executed following the task ST1 of the safety control function in the first control cycle. It is defined that the non-safety control function task NST2 is executed following the safety control function task ST1 in the control cycle. On the other hand, the non-safety scheduling information 60a shown in FIG. 4 is configured such that tasks NST3, NST4, and NST5 of other non-safety control mechanisms that are not incorporated in the safe scheduling information 50a are defined in order of execution.

As described above, by using the safety scheduling information 50a configured to include one or more non-safety control function tasks, it is possible to ensure the real-time property of the non-safety control function tasks NST1 and NST2. .

[Modification 2]
In the example of FIGS. 1 and 4, the case where the execution order of the tasks of the non-safety control function is determined in advance by the non-safety scheduling information 60 has been described. However, the task of the non-safety control function does not necessarily have to be determined in advance, and can be configured to dynamically schedule in each control cycle.

[Modification 3]
Of the tasks STn of the safety control function, a task that cannot be interrupted may be subjected to error processing when the interruption occurs. For example, let us consider a case where the task ST2 of the safety control function is a task that cannot be interrupted in the examples shown in FIGS. FIG. 5 is a diagram for explaining error processing when interruption processing occurs during execution of a safety control function task in the first embodiment of the present invention.

As shown in FIG. 5, the CPU 21 can execute an error process after the interruption by the specified time timer 31 at time t2. In order to perform such error processing, it is necessary to specify in advance a task that cannot be interrupted among the tasks of the safety control function. Therefore, in order to perform such identification, information indicating whether or not to interrupt can be associated with each safety control function task and stored as safety scheduling information 50 or stored in the context block 70. Can be considered.

[Modification 4]
The CPU 21 can also acquire the control cycle timer value from the control cycle timer 32 in real time during execution of each task and use it for arithmetic processing.

[Modification 5]
Using the idea of the modification 4, the CPU 21 can further measure the elapsed time of task processing over a plurality of control cycles by counting the number of times the control cycle has elapsed. 6A and 6B are diagrams for explaining the operation of the fifth modification example in the first embodiment of the present invention.

At the time indicated by [1] in FIG. 6A, the CPU 21 acquires the control cycle timer value ta from the control cycle timer 32 in the control cycle in which the control cycle elapsed number counter is N1. Furthermore, at the time indicated by [2] in FIG. 6B, the CPU 21 acquires the control cycle timer value tb from the control cycle timer 32 in the control cycle in which the control cycle elapsed number counter is N2. As a result, the CPU 21 can calculate the elapsed time from the time indicated by [1] to the time indicated by [2] by the following equation.
Elapsed time = (N2−N1) × T + (tb−ta)

[Modification 6]
Using the ideas of the modification examples 4 and 5, the CPU 21 can also avoid an interrupt when there is a task that is not desired to be interrupted in a specific section. 7A to 7C are diagrams for explaining the operation of the modification 6 according to the first embodiment of the present invention.

7A to 7C, task ST2 corresponds to a task that is not desired to be interrupted in a specific section. At the time indicated by [1] in FIG. 7A, the CPU 21 reads the control cycle timer value ta from the control cycle timer 32 at the start of the task ST2. Then, after starting the execution of the task ST1, the CPU 21 reads the control cycle timer value tb from the control cycle timer 32 at the time indicated by [2] corresponding to the start of a specific section in which interrupt is not accepted.

Here, the specific section in which the interrupt is not accepted can be defined in advance as a period tc that assumes the longest execution time, and is set in the memory 22 corresponding to the internal memory. be able to.

Also, assuming that the prescribed period T2 of the task ST2 is td, the CPU 21 determines whether the condition of the following expression (1) is satisfied at the time indicated by [2] in FIG. 7A.
td <tb−ta + tc (1)

If the condition of Expression (1) is satisfied, if the task ST2 is continuously executed after the time indicated by [2], an interruption by the specified period timer occurs in a specific section where the interruption is not accepted. It is assumed that Therefore, when it is determined that the condition of Expression (1) is satisfied, the CPU 21 interrupts the execution of the task ST2 at the time indicated by [2], and as illustrated in FIG. 7B, the task NST1 of the non-safety control function. Start running.

Then, after executing the task ST1 in the second control cycle shown in FIG. 7C, the CPU 21 resumes the execution of the suspended task ST2 in the time period indicated by [3]. As a result, it is possible to prevent the occurrence of an interrupt in a specific section of the task ST2 shown as the knitting portion in FIGS. 7A and 7C.

In addition, when executing the process of the specific section of the task ST2, the CPU 21 can take a countermeasure when an interrupt occurs in the specific section by performing the following process. The CPU 21 can execute a flag process that sets a start flag when a specific section is started and sets an end flag when the process of the specific section is completed.

By executing such flag processing, the CPU 21 sets a start flag and does not set an end flag when a specified time timer interrupt occurs after a specific section starts. It can be determined that an interrupt has occurred in a specific section. Therefore, when the CPU 21 determines that an interrupt has occurred in a specific section, the CPU 21 can take measures such as executing a safe operation of the elevator, for example.

As described above, according to the task scheduling method according to the first embodiment, the idle time during which the safety control function task is not executed can be collected after each control cycle. As a result, the utilization efficiency of the CPU is improved, and efficient task scheduling can be realized while ensuring the independence of the safety control function task and the non-safety control function task.

Embodiment 2. FIG.
In the second embodiment, a case where the task scheduling method described in the first embodiment is applied to a specific configuration of the elevator system will be described.

2. Description of the Related Art Conventionally, a door-opening travel protection device has been devised that secures a safe state by suddenly stopping a car when the car or the car is abnormally run with the landing door open (see, for example, Patent Document 3). ).

In addition, when the car runs out of the vicinity of the terminal floor, a terminal floor forced reduction device has been devised that detects the car overspeed and activates the braking device to decelerate to a safe speed or less before the buffer collision (for example, (See Patent Document 4).

These safety devices are required to have a high degree of reliability, and are implemented as, for example, an architecture such as an electronic safety device. Such an architecture tends to increase the hardware cost due to, for example, a duplex configuration of devices, and a form in which as many safety functions as possible are mounted on the same hardware is desirable. As a means for realizing such a form, the above-described Patent Document 2 discloses a mechanism that allows a plurality of safety function programs to be reliably executed without interfering with each other.

On the other hand, it is desirable that these safety systems also have maintenance functions such as internal data logging and data output in order to improve maintainability. On the other hand, these maintenance functions are non-safety functions and have lower execution priority than the safety functions. For this reason, in order to improve the throughput of maintenance functions without hindering the execution of safety functions, improve the time efficiency by using the time when safety functions are not executed efficiently and executing non-safety functions. A mechanism to make it necessary.

Therefore, the case where the technique described in the first embodiment is applied to an elevator safety control device will be described in detail below.

FIG. 8 is an overall configuration diagram of an elevator system to which the elevator safety control device according to Embodiment 2 of the present invention is applied. The elevator system 200 shown in FIG. 8 includes an elevator mechanism unit 210, an elevator driving device 220, a brake device 230, an elevator safety circuit 240, an elevator operation control unit 250, and an elevator safety monitoring unit 260.

The elevator mechanism unit 210 includes a car 211, a weight 212, a sheave 213, a return wheel 214, a rope 215, and a device 216 in the hoistway.

The car 211 and the weight 212 are connected by a rope 215, and the rope 215 is suspended from a sheave 213 and a return wheel 214.

The hoistway device 216 includes a landing door switch 216a, a car door switch 216b, a door zone plate 216c, a door zone sensor 216d, an end point switch cam 216e, an upper reference position switch 216f in the hoistway, and a lower reference position switch in the hoistway. 216g, a governor sheave 216h, a governor rope 216i, and a governor encoder 216j.

The landing door switch 216a is installed at the landing and detects the open state of the landing door. The car door switch 216b is installed in the car and detects the open state of the car door.

The door zone plate 216c is installed near the landing in the hoistway. The door zone sensor 216d installed in the car 211 detects that the car floor is within a predetermined distance from the landing floor by detecting the door zone plate 216c.

The upper reference position switch 216f is installed in the upper part of the hoistway, and the lower reference position switch 216g is installed in the lower part of the hoistway, and each has a roller connected and fixed to the switch contact. In the upper reference position switch 216f and the lower reference position switch 216g, the roller contacts are pressed by the end point switch cam 216e fixed to the car, so that the switch contact is in the detection state. Therefore, the upper reference position switch 216f and the lower reference position switch 216g can detect that the car is at a specified position in the hoistway.

The governor sheave 216h is rotated by a governor rope 216i connected and fixed to the car 211. The governor encoder 216j detects the amount of movement of the car by detecting the rotation of the governor sheave 216h.

The elevator driving device 220 includes a commercial power source 221, an inverter 222, a motor 223, and a main contact 224 of the main circuit contactor #MC that cuts off power supply from the commercial power source 221 to the inverter 222. The inverter 222 rotates the motor 223 and drives the sheave 213 based on a command from an elevator operation control device (CC) 251 described later.

The brake device 230 is a first and second brake shoe 231 that contacts the sheave 213 and applies a braking torque by friction, a first and second brake coil 232 that sucks and drops the brake shoe, and an elevator operation control device (CC). First and second brake choppers 233 for controlling the current of the brake coil according to a command from 251, and a main contact 234 for a brake circuit relay (#BK) for cutting off the power supply from the brake power source to the brake coil 232.

The elevator safety circuit 240 is configured by connecting the main contacts of safety relays # SF1 and # SF2 and other safety switch contacts in series to a control power source. By the final output when all the contacts in the elevator safety circuit 240 are turned on, the contactor / relay driving power is supplied to the primary side of the #MC and #BK coils.

The elevator operation control unit 250 inputs commands from the elevator operation control device (CC) 251, #MC, #BK, and the elevator operation control device (CC) 251, and turns on / off the power supply to each coil. The switch semiconductor 252 is provided.

The elevator operation control device (CC) 251 outputs commands to the inverter 222, the first and second brake choppers 233, and the #MC and #BK switch semiconductors 252 to control the operation of the car 211.

The elevator safety monitoring unit 260 inputs commands from the elevator safety monitoring device (SF) 261, the first and second safety relays, and the elevator safety monitoring device (SF) 261 to supply power to each coil. A switch semiconductor 262 that is turned ON / OFF is provided.

The elevator safety monitoring device (SF) 261 inputs the states of the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, the upper reference position switch 216f, the lower reference position switch 216g, and the governor encoder 216j. When the elevator safety monitoring device (SF) 261 detects at least one or more non-safety states including the terminal floor overspeed, the door open running, and the failure of the own unit component device based on these inputs. Executes a safety stop sequence, outputs a stop command to the elevator operation control device (CC) 251 to stop the car 211, shuts down # SF1 and # SF2, and stops and holds the car 211.

FIG. 9 is a block diagram showing in detail the internal configuration of the elevator safety monitoring device (SF) 261 according to Embodiment 2 of the present invention. The elevator safety monitoring device (SF) 261 includes a first safety monitoring system 140a and a second safety monitoring system 140b as a dual system composed of the same devices and functions. Each of the first safety monitoring system 140a and the second safety monitoring system 140b has the states of the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, the reference position switches 216f and 216g, and the governor encoder 216j. input.

Based on these inputs, the first safety monitoring system 140a outputs a drive command to the switch semiconductor 262 of # SF1 and outputs a stop command to the elevator operation control device (CC) 251. Similarly, based on these inputs, the second safety monitoring system 140b outputs a drive command to the switch semiconductor 262 of # SF2 and outputs a stop command to the elevator operation control device (CC) 251.

Each of the first safety monitoring system 140a and the second safety monitoring system 140b has the following four safety control functions.
・ Terminal floor forced deceleration function (SETS)
・ Open door protection function (UCMP)
・ Self-diagnosis function (DIAG)
・ Intersystem communication function (ICOM)

Each of the first safety monitoring system 140a and the second safety monitoring system 140b has the following two non-safety control functions as maintenance functions.
・ Data logging function (DLOG)
・ Interface function (CCIF) with elevator operation control device

The SETS inputs each state of each reference position switch 216f, 216g, and governor encoder 216j, and executes a safety stop sequence when the current speed of the car exceeds the car overspeed monitoring level according to the current position of the car. It is a function.

UCMP inputs each state of the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, and the governor encoder 216j, and the car is set in advance from the landing floor in a state where the landing door or the car door is opened. This function executes a safety stop sequence when the vehicle moves more than the distance or when the current speed of the car exceeds a specified value.

DIAG is a function that performs an operation check on unit configuration devices including at least a power supply, a clock, a WDT, a CPU, a memory, a bus, a program, and a safety relay, and executes a safety stop sequence when a failure is detected.

The ICOM transmits data such as an input / output state and an operation state between the first safety monitoring system 140a and the second safety monitoring system 140b to each other, and when any mismatch is detected, In this function, it is determined that there has been a calculation failure and the safety stop sequence is executed in both systems.

The maintenance function includes a data logging function (DLOG) and a CC interface function (CCIF) as a non-safety control function, and is executed at the timing of the idle time when the safety control function is not executed. Specifically, the ILOG records the I / O status, calculation status, and event history log to store the data, and the CCIF stores the data in response to a request from the elevator operation control device (CC) 251. Is transmitted.

FIG. 10 is a configuration diagram common to the first safety monitoring system 140a and the second safety monitoring system 140b in Embodiment 2 of the present invention. FIG. 10 corresponds to the configuration diagram of FIG. 1 in the first embodiment. That is, the configuration common to the first safety monitoring system 140a and the second safety monitoring system 140b in FIG. 10 is equivalent to the configuration of the elevator safety control device according to the present invention described in FIG. Therefore, in order to make the explanation easy to understand, the reference numerals obtained by adding 100 to the reference numerals in FIG.

The first safety monitoring system 140a (second safety monitoring system 140b) according to the second embodiment includes an external device I / F 110, a logic unit 120, and an independence assurance unit 130. The CPU 121 in the logic unit 120 acquires a signal related to the state of the elevator as an input value via the external device I / F 110, a safety control function task 141, a non-safety control function task 142, safety scheduling information 150, and The non-safe scheduling information 160 is read.

Here, the safety control function task 141, the non-safety control function task 142, the safe scheduling information 150, and the non-safety scheduling information 160 correspond to data stored in the storage unit, and the CPU 121 in the logic unit 120 With reference to these data, processing necessary for elevator control is executed.

The safety control function task 141 is composed of safety programs of a SETS task, a UCMP task, a DIAG task, and an ICOM task. Hereinafter, these tasks may be referred to as “safety tasks”.

The task 142 of the non-safety control function is composed of the non-safety logos of the DLOG task and the CCIF task. Hereinafter, these tasks may be referred to as “non-safety tasks”. )

The safety scheduling information 150 is information in which an execution order of each safety task, a specified execution time, a final flag indicating the final safety task in each control cycle, and an interruption flag indicating whether or not each safety task can be interrupted are defined. .

The non-safety scheduling information 160 is information in which only the execution order of each non-safety task is defined.

The context block 170 stores a SETS execution state, a UCMP execution state, a DIAG execution state, and an ICOM execution state. Here, the context block 170 corresponds to readable / writable data stored in the storage unit.

The external device I / F 110 inputs signals from the landing door switch 216a, the car door switch 216b, the door zone sensor 216d, the reference position switches 216f and 216g, and the governor encoder 216j, or safety relays # SF1 and S #. This is an interface for outputting a drive command to SF2.

The logic unit 120 includes a CPU 121 and a memory 122. In the memory 122, a SETS area, a UCMP area, a DIAG area, and an ICOM area are allocated as individual areas as areas used when executing various safety tasks.

The independence assurance unit 130 includes a specified time timer 131, a control cycle timer 132, and a memory protection function 133.

When the safety task and the non-safety task are executed, the memory protection function 133 protects the data in the same area and accesses the CPU 121 to detect that an abnormal access has been detected. Send and execute the safety stop sequence. For example, the case where the SETS task accesses the UCMP area corresponds to an abnormal access.

The CPU 121 refers to the safety scheduling information 150 after the activation of the first safety monitoring system 140a (second safety monitoring system 140b), and calls a safety task according to a predetermined execution order. At the same time, the independence assurance unit 130 starts task execution time measurement by the specified time timer 131. Further, when starting the execution of the first task in each control cycle, the independence assurance unit 130 resets the control cycle timer 132 and starts timer counting.

The CPU 121 terminates or interrupts the running task when the execution time of the safety task reaches the specified time set in the safety scheduling information, or the task being executed declares task termination by itself. Refer to

When the final flag is FALSE, the CPU 121 calls the next safety task, and at the same time, the independence assurance unit 130 resets the specified time timer 131 and starts measuring the execution time of the next task.

On the other hand, when the final flag is TRUE, the CPU 121 refers to the non-safety scheduling information and calls the non-safety task according to a predetermined execution order.

When the control cycle timer 132 reaches the specified control cycle, the CPU 121 interrupts the non-safety task being executed and shifts to the processing of the next control cycle. Then, the CPU 121 refers to the safety scheduling information and calls the first safety task in the next control cycle. At the same time, the independence assurance unit 130 resets the specified time timer 131 and the control cycle timer 132, respectively, and starts each timer count.

When the CPU 121 finishes executing the final safety task in the safety scheduling information execution order, the CPU 121 returns to the top of the safety scheduling information execution order at the next safety task execution timing.

Next, the effect of task processing according to the second embodiment will be described using an execution time chart of each task for each control cycle. FIG. 11A is an execution time chart corresponding to an execution plan according to the safe scheduling information 150 and the non-safe scheduling information 160 in Embodiment 2 of the present invention.

On the other hand, FIG. 11B is an execution time chart when the task processing according to the second embodiment of the present invention is executed. FIG. 11C is an execution time chart when the task processing according to the prior art is executed.

In the specific examples shown in FIGS. 11A to 11C, the control cycle T = 1 [ms] is one execution step, and the safety task and the non-safety task for one cycle are executed in three steps.

As shown in FIG. 11A, in the execution plan based on the safe scheduling information 150 and the non-safe scheduling information 160, step 1 (step counter N = 1), step 2 (step counter N = 2), step 3 (step counter N = 3). ), The following task assignment is performed.
<Step 1 (Step Counter N = 1)>
・ ICOM task at time t = 0 to 0.1 [ms] ・ DIAG task at time t = 0.1 to 0.4 [ms] (1/3)
・ SETS task at time t = 0.4 to 0.7 [ms] ・ Non-safety task <step 2 (step counter N = 2)> at time t = 0.7 to 1.0 [ms]
・ ICOM task at time t = 0 to 0.1 [ms] ・ DIAG task at time t = 0.1 to 0.6 [ms] (2/3)
・ UCMP task at time t = 0.6 to 0.8 [ms] ・ Non-safety task at time t = 0.8 to 1.0 [ms] <Step 3 (step counter N = 3)>
・ ICOM task at time t = 0 to 0.1 [ms] ・ DIAG task at time t = 0.1 to 0.8 [ms] (3/3)
・ Non-safety task at time t = 0.8 to 1.0 [ms]

As defined by the interruption flag in the safety scheduling information 150 in FIG. 10, the ICOM task, the SETS task, and the UCMP task cannot be interrupted, and the DIAG task cannot be interrupted only for 3/3. If a task that cannot be interrupted does not end within the specified time, the CPU 121 detects a program abnormality and executes a safe stop sequence.

The specified time allocated to execute each task in the safety scheduling information is determined based on the execution path that maximizes the processing amount among the combination of conditional branches of task processing. In the case of a safety task, only the abnormality monitoring process is executed in the normal state, so the actual execution time is shorter than the specified time, but in the abnormal state, the additional safe operation process is also executed. Time approaches the specified time.

¡Non-safety task execution time is not defined by non-safety scheduling information, and is not monitored by a specified time timer. However, in FIGS. 11B and 11C, the processing time of the DLOG task is 0.1 [ms], and the processing time of the CCIF task is 1.0 [ms].

Next, a case where task processing according to the second embodiment is actually executed will be described with reference to FIG. 11B. In step 1, the ICOM task is executed at t = 0 to 0.1 [ms], and then the DIAG task (1/3) is executed from t = 0.1 [ms]. Here, since the specified execution time of the DIAG task (1/3) is 0.3 [ms], it can be executed up to t = 0.4 [ms], but no abnormality is detected, and t = 0.3 [ms] Suppose that

Therefore, the CPU 121 starts executing the SETS task, which is the next safety task, at time t = 0.3 [ms]. It is assumed that the SETS task can be executed at t = 0.3 to 0.6 [ms], but this is also detected without abnormality and terminated at t = 0.5 [ms].

Since the final flag of the SETS task is TRUE from the safety scheduling information 150, the CPU 121 can determine that the execution of the safety task at this step has ended. Therefore, the CPU 121 executes the DLOG task according to the non-safety scheduling information 160 from t = 0.5 [ms]. The DLOG task is completed in 0.1 [ms], and the CCIF task is executed from t = 0.6 [ms].

The CCIF task takes 1.0 [ms] to complete, but at t = 1.0 [ms], the control cycle timer 132 becomes control T = 1 [ms] and an interrupt occurs. For this reason, the CCIF task is interrupted when 0.4 [ms] is executed.

In the next step 2, the ICOM task is executed at t = 0 to 0.1 [ms], and then the DIAG task (2/3) can be executed at t = 0.1 to 0.6 [ms]. It is assumed that the process ends at t = 0.45 [ms]. As a result, the UCMP task can be executed next at t = 0.45 to 0.65 [ms], but it is assumed that the UCMP task actually ends at t = 0.6 [ms].

Since the final flag of UMCP is TRUE, the non-safety task is executed next, and the CCIF task suspended in the previous step 1 is resumed from t = 0.6 [ms]. When the CCIF task is further executed for 0.4 [ms], the control cycle timer becomes control T = 1 [ms], and the execution of the CCIF task is interrupted again.

In the next step 3, the ICOM task is executed at t = 0 to 0.1 [ms], and then the DIAG task (3/3) can be executed at t = 0.1 to 0.8 [ms]. Suppose that the process ends at t = 0.6 [ms]. Since the final flag of DIAG (3/3) is TRUE, the non-safety task is executed next, and the CCIF task suspended in the previous step 2 is resumed from t = 0.6 [ms].

Since the CCIF task has already been executed in steps 1 and 2 for a total of 0.8 [ms], the remaining 0.2 [ms] processing is performed in step 3 t = 0.6 to 0.8 [ms]. Is executed.

After the execution of the CCIF task is completed, there is no next non-safety task. Therefore, after t = 0.8 [ms], there is a free time during which no processing is executed until the end of step 3.

In the SETS task and the UCMP task, the current car speed must be calculated. Therefore, by using the governor encoder value x_gov ′ and the control cycle timer value t_gov ′ acquired at the previous task execution, the respective current values x_gov and t_gov, the control cycle T, and the speed normalization coefficient K, the CPU 121 The car speed can be calculated according to the following formula.
Car speed = K × (x_gov−x_gov ′)
/ (3 × N + t_gov−t_gov ′)

As shown in FIG. 11B, in the task processing according to the present invention, the idle time when the safety task is completed before the specified time is efficiently used, and more time is allocated to the non-safety task. It is possible. As a result, the utilization efficiency of the CPU 121 is improved, and the time efficiency of task processing can be improved.

On the other hand, when a safety task and a non-safety task similar to this time are executed by adopting a method for fixing the task allocation time according to the conventional technology, an execution time chart shown in FIG. 11C is obtained. That is, since the process of the safety task is not executed in the free time, the step of completing the CCIF task whose processing time is 1.0 [ms] is Step 5. That is, according to the conventional technique, it is necessary to perform divided execution over more steps, and it is assumed that the processing time increases as compared with the case where the task processing according to the present invention is executed.

As described above, according to the task scheduling method according to the second embodiment, the idle time during which the safety control function task is not executed can be collected after each control cycle. As a result, the utilization efficiency of the CPU is improved, and efficient task scheduling can be realized while ensuring the independence of the safety control function task and the non-safety control function task.

21 CPU, 30 Independence assurance unit, 31 Specified time timer, 32 Control cycle timer, 33 Memory protection function, 40 program, 41 Safety control function task, 42 Non-safety control function task, 50, 50a Safe scheduling information, 60 , 60a non-safety scheduling information, 70 context blocks, 121 CPU, 130 independence guarantee unit, 131 specified time timer, 132 control cycle timer, 133 memory protection function, 140a, 140b safety monitoring system, 141 safety control function task, 142 Non-safety control function tasks, 150 safe scheduling information, 160 non-safety scheduling information, 170 context blocks.

Claims (9)

1. A plurality of safety control functions and a plurality of non-safety control functions are stored as independent programs, and scheduling and execution order for each control cycle when the plurality of safety control functions are executed in each control cycle are defined in advance. A storage unit for storing safety scheduling information;
   A CPU for performing an elevator control calculation by sequentially executing the respective programs corresponding to the plurality of safety control functions and the plurality of non-safety control functions according to the safety scheduling information, and
   In each control cycle, the CPU sequentially executes the safety control functions sequentially without empty time in accordance with the execution order defined as the safety scheduling information, and executes all safety control functions assigned within the control cycle. An elevator safety control device that executes the plurality of non-safety control functions in a free time within a control cycle after being performed.
2. An input unit for acquiring signals relating to the state of the elevator as input values;
   An independence assurance unit that guarantees independence between control functions for all control functions including the plurality of safety control functions and the plurality of non-safety control functions so that a certain control function does not affect other control functions. And
   The safety scheduling information includes a predetermined time that defines an order of execution of the plurality of safety control functions and a time during which the CPU can execute a calculation process of the safety control function corresponding to each of the plurality of safety control functions. And a final flag indicating whether or not the safety control function is executed at the end of each control cycle.
   The storage unit further stores non-safety scheduling information in which an execution order of the non-safety control functions is defined,
   The independence assurance unit has a specified time timer that monitors whether the calculation processing time by each safety control function exceeds the specified time, and a control cycle timer that monitors each control cycle,
   In each control cycle, the CPU
   First, start the arithmetic processing of the safety control function according to the execution order defined in the safety scheduling information, and execute until the arithmetic processing of the safety control function in which the final flag is valid,
   When the calculation process of the safety control function ends before the specified time associated with the safety control function being calculated, or when the specified time is reached and an interrupt is generated by the specified time timer, By starting the calculation process of the safety control function in the execution order, the calculation process of the safety control function to be executed during the control cycle is continuously executed without any free time,
   After the calculation process of the safety control function to be executed during the control cycle is completed, the calculation process of the non-safety control function is executed according to the execution order defined in the non-safety scheduling information in the idle time until the end of the control cycle. ,
   The elevator safety control device according to claim 1, wherein when the control cycle elapses and an interrupt is generated by the control cycle timer, the non-safety control function being executed is interrupted and the calculation process of one control cycle is terminated. .
3. A context block for holding information on the execution state of each program executed independently;
   The CPU
   When an interruption of the specified time timer or the control cycle timer occurs, the control function being processed is interrupted, and information on the execution state of the program related to the interrupted control function is stored in the context block,
   The elevator according to claim 2, wherein when the suspended control function is executed next time, the computation processing of the suspended control function can be resumed using information on the execution state of the program stored in the context block. Safety control device.
4. The CPU has an internal memory to which an area to be used for executing each of the plurality of safety control functions is individually assigned,
   The independence assurance unit is executing an arithmetic process of any of the control functions including the plurality of safety control functions and the plurality of non-safety control functions, and the area other than the area where the control function during the arithmetic process is permitted. It has a memory protection function for monitoring the presence or absence of an abnormal access state accessing the area of the internal memory, and outputting a command to execute a safe operation of the elevator to the CPU when the abnormal access state is detected The elevator safety control device according to claim 2 or 3.
5. The safety scheduling information is further associated with an interruptible flag indicating whether or not the safety control function can be interrupted during the arithmetic processing,
   5. The elevator performs a safety operation of an elevator when an interruption of the specified time timer occurs during a calculation process of a safety control function in which the interruptible flag is invalid. 5. The elevator safety control device according to item 1.
6. The value of the control cycle timer can be uniquely set corresponding to each independent program,
   The elevator safety control device according to any one of claims 2 to 5, wherein the CPU can use a value of the control cycle timer set in a program corresponding to a control function that executes arithmetic processing.
7. The CPU
   A counter that holds the number of elapsed times of the control cycle timer;
   Measure the elapsed time from the previous time to the current time using the value and elapsed time of the control cycle timer when the previous control cycle timer was acquired and the value and elapsed time of the control cycle timer when the current control cycle timer was acquired The elevator safety control device according to claim 6.
8. For the task of the safety control function that wants to prohibit interruption by the specified time timer only in a specific section,
   The CPU
   Obtain the value ta of the control cycle timer at the start of the task,
   Obtaining the value tb of the control cycle timer at the start of the specific section;
   At the start of the specific section, from the time width tc of the specific section and the set value td of the specified time timer of the task,
   td <tb-ta + tc
   If the relationship is established, the task calculation processing is interrupted at the start of the specific section, and the process proceeds to the next execution order. The interrupt by the specified time timer in the specific section is prohibited by resuming the execution of the task from the initial state of the specific section when the next execution order is reached. The elevator safety control device described in 1.
9. The CPU
   In the next execution order, a start flag is set when the specific section starts, an end flag is set when the specific section ends,
   If the start flag is set and the end flag is not set when an interruption of a specified time timer occurs after the specific section starts, an elevator safety operation is executed. Item 9. The elevator safety control device according to Item 8.

Images