WO2022107305A1

WO2022107305A1 - Safety control device for elevator and safety control system for elevator

Info

Publication number: WO2022107305A1
Application number: PCT/JP2020/043371
Authority: WO
Inventors: 和則鷲尾; 益誠柴田
Original assignee: 三菱電機株式会社
Priority date: 2020-11-20
Filing date: 2020-11-20
Publication date: 2022-05-27
Also published as: JP7396515B2; JPWO2022107305A1; DE112020007784T5; CN116390890A; KR20230083311A

Abstract

Provided are a safety control device and a safety control system that suppress a reduction in the operating rate of an elevator even when an abnormality has occurred. A safety control system (12) comprises a plurality of safety control devices (13), a plurality of nodes, and a network (10) into which operation information is input from each node. One safety control device (13) is provided for each elevator car (5). The safety control device (13) comprises a communication unit (22), an output unit (23), and a processing unit (24). The communication unit (22) connects to a network (10) and acquires operation information. The processing unit (24) uses the operation information of the corresponding elevator car (5) and controls output by the output unit (23) of a stop command for stopping said elevator car (5). When an abnormality has occurred with a safety control device (13) corresponding to another elevator car (5), the processing unit (24) uses the operation information of the other elevator car (5) and acts to control output by the output unit (23) of a stop command for stopping the other elevator car (5).

Description

Elevator safety control device and elevator safety control system

This disclosure relates to an elevator safety control device and an elevator safety control system.

Patent Document 1 discloses an example of a control method for an elevator including a plurality of cars. In the control method, each car detects an abnormality by a check code that communicates with each other. When an anomaly is detected, one of the cars will move to the parking position. The elevator is then operated by one of the multiple cars that has not moved to the parking position.

Japan Special Table 2009-539726 Gazette

However, in the method of Patent Document 1, if an abnormality occurs in the device that controls the safety of the car, the elevator cannot continue to operate. Therefore, the operating rate of the elevator may decrease.

This disclosure relates to the solution of such problems. The present disclosure provides a safety control device and a safety control system in which a decrease in the operating rate is suppressed even if an abnormality occurs in the elevator.

The safety control device for the elevator according to the present disclosure is one of a plurality of safety control devices having a one-to-one correspondence with a plurality of cars moving up and down the hoistway in the elevator, and the first of the plurality of cars. It is a safety control device that supports cars and does not normally support the second car of multiple cars, and operation information is input from multiple nodes, each of which acquires at least one of the operation information of multiple cars. A communication unit that connects to the network and communicates with other safety control devices corresponding to the second car through the network, a first stop command for stopping the first car, and a first stop command for stopping the second car. Using the output unit that outputs the stop command of 2 and the operation information of the first car acquired through the communication unit, the self-safety control of the first car that controls the output of the first stop command by the output unit is performed. , When an abnormality occurs in another safety control device corresponding to the second car, the output of the second stop command by the output unit is controlled by using the operation information of the second car acquired through the communication unit. It is provided with a processing unit that performs proxy safety control of the second car.

The elevator safety control system according to the present disclosure acquires a plurality of safety control devices that correspond one-to-one to a plurality of cars that move up and down the hoistway in the elevator, and operation information of at least one of the plurality of cars. A plurality of nodes and a network in which operation information is input from each of the plurality of nodes are provided, and the plurality of safety control devices are the first safety control device corresponding to the first car among the plurality of cars. A second safety control device corresponding to a second car among a plurality of cars, the second safety control device connects to the network and communicates with the first safety control device through the network. The second communication unit, the second output unit that outputs the second stop command for stopping the second car, and the operation information of the second car acquired through the second communication unit are used. Performs self-safety control of the second car that controls the output of the second stop command by the output unit of, and suspends self-safety control of the second car when an abnormality occurs in the second safety control device. A first communication unit including a second processing unit, the first safety control device is connected to the network, and the first communication unit that communicates with the second safety control device through the network and the first car are stopped. The first stop command by the first output unit using the operation information of the first car acquired through the first output unit that outputs the stop command and the second stop command and the first communication unit. The self-safety control of the first car that controls the output of the first car is performed, and when an abnormality occurs in the second safety control device, the operation information of the second car acquired through the first communication unit is used to perform the second car. It is provided with a first processing unit that performs proxy safety control of a second car that controls the output of a second stop command by the output unit of 1.

With the safety control device or safety control system according to the present disclosure, it is possible to suppress a decrease in the operating rate even if an abnormality occurs in the elevator.

It is a block diagram of the elevator which concerns on Embodiment 1. FIG. It is a block diagram of the safety control system which concerns on Embodiment 1. FIG. It is a sequence diagram which shows the example of the operation of the safety control system which concerns on Embodiment 1. FIG. It is a sequence diagram which shows the example of the operation of the safety control system which concerns on Embodiment 1. FIG. It is a sequence diagram which shows the example of the operation of the safety control system which concerns on Embodiment 1. FIG. It is a figure which shows the example of the allocation of the processing resource in the safety control system which concerns on Embodiment 1. FIG. It is a figure which shows the example of the allocation of the processing resource in the safety control system which concerns on Embodiment 1. FIG. It is a figure which shows the example of setting of the traveling prohibition section in the safety control system which concerns on Embodiment 1. FIG. It is a figure which shows the example of setting of the traveling prohibition section in the safety control system which concerns on Embodiment 1. FIG. It is a flowchart which shows the example of the operation of the safety control system which concerns on Embodiment 1. It is a flowchart which shows the example of the operation of the safety control system which concerns on Embodiment 1. It is a hardware block diagram of the main part of the safety control system which concerns on Embodiment 1. FIG.

The mode for implementing this disclosure will be explained with reference to the attached drawings. In each figure, the same or corresponding parts are designated by the same reference numerals, and duplicate description will be appropriately simplified or omitted.

Embodiment 1.
FIG. 1 is a configuration diagram of an elevator 1 according to the first embodiment.

Elevator 1 is applied to buildings with multiple floors. In the building, the hoistway 2 of the elevator 1 is provided. The hoistway 2 is a vertically long space over a plurality of floors. The hoistway 2 has a pit 3 at the bottom. In the building, a plurality of landings 4 of the elevator 1 are provided. Each landing 4 is provided adjacent to the hoistway 2 on any floor.

The elevator 1 includes a plurality of cars 5, a plurality of landing doors 6, a plurality of open / close detectors 7, a plurality of position detectors 8, a maintenance device 9, a network 10, and a plurality of control panels 11. Be prepared.

Each car 5 is a device that transports the user between a plurality of floors by ascending and descending in the vertical direction in the hoistway 2. Each car 5 moves up and down the hoistway 2 by, for example, a hoist (not shown). In this example, a plurality of cars 5 move up and down the same hoistway 2. A plurality of cars 5 that move up and down the same hoistway 2 are arranged so as to overlap each other in the horizontal projection plane. That is, each of the plurality of cars 5 that move up and down the same hoistway 2 is arranged so that at least a part of them overlap each other when projected onto a horizontal plane that penetrates the hoistway 2. In this example, the elevator 1 is a double car system in which two cars 5 move up and down the same hoistway 2. One of the two cars 5 that move up and down the same hoistway 2 moves up and down above the other car 5 in the hoistway 2.

Each landing door 6 corresponds to any floor. Each landing door 6 is provided at the landing 4 on the corresponding floor. Each landing door 6 separates the landing 4 and the hoistway 2. Each landing door 6 is a device that opens and closes so that a user can get on and off the car 5 when any car 5 is stopped adjacent to the corresponding floor.

Each open / close detector 7 corresponds to any of the landing doors 6. Each open / close detector 7 is provided on the corresponding landing door 6. Each open / close detector 7 is a device such as a door switch that detects the open / close of the corresponding landing door 6.

Each position detector 8 is provided in the hoistway 2. Each position detector 8 is a device that detects the position of any of the plurality of baskets 5. Each position detector 8 is, for example, a position switch that operates when any of the cages 5 is in the corresponding position. Each position detector 8 is, for example, a position sensor that detects the position of any of the cars 5 when the car 5 is within the detection range.

The maintenance device 9 is a device operated by maintenance personnel when performing maintenance and inspection work. The maintenance device 9 is, for example, a pit switch provided in the pit 3. A plurality of maintenance devices 9 may be provided in the elevator 1.

The network 10 is a communication network for communicating information in the elevator 1. The network 10 is, for example, a LAN (Local Area Network) or the like. The network 10 is composed of a communication line, a communication device, and the like. The network 10 may be configured by either wired or wireless, or a combination of wired and wireless. The network 10 is not limited to a specific topology. In the network 10, highly reliable communication including error detection is performed.

The plurality of control panels 11 correspond to a plurality of baskets 5 on a one-to-one basis. The control panel 11 is a device that controls the operation of the corresponding car 5. Each control panel 11 is connected to the network 10.

Elevator 1 is equipped with a safety control system 12. The safety control system 12 includes a plurality of safety control devices 13, a plurality of door nodes 14, a plurality of hoistway nodes 15, a plurality of car nodes 16, and a maintenance node 17. The safety control system 12 includes the network 10 of the elevator 1.

The plurality of safety control devices 13 correspond to the plurality of control panels 11 on a one-to-one basis. Each safety control device 13 is mounted on the corresponding control panel 11. Each safety control device 13 corresponds to the same car as the car 5 to which the control panel 11 corresponds. Each safety control device 13 connects to the network 10. Each safety control device 13 is a device that performs safety control and the like of the corresponding car 5.

Each door node 14 corresponds to any open / close detector 7. Each door node 14 connects to the corresponding open / close detector 7. Each door node 14 acquires information on the detection of opening / closing of the landing door 6 by the corresponding opening / closing detector 7. The information on the detection of opening / closing of the landing door 6 is an example of the operation information of each car 5. The operation information of the car 5 is information used for the operation of the car 5 or information that affects the operation of the car 5. Each door node 14 is an example of a node that acquires operation information of at least one of the cages 5. Each door node 14 connects to the network 10.

Each hoistway node 15 corresponds to any position detector 8. Each hoistway node 15 connects to a corresponding position detector 8. Each hoistway node 15 acquires information on the detection of the position of the car 5 by the corresponding position detector 8. The information for detecting the position of the car 5 is an example of the operation information of the car 5. Each hoistway node 15 is an example of a node that acquires operation information of at least one of the cars 5. Each hoistway node 15 connects to the network 10.

Each car node 16 corresponds to any car 5. Each car node 16 is provided in the corresponding car 5. Each car node 16 connects to a detection device provided in the corresponding car 5. The detection device provided in the car 5 is, for example, a position sensor that detects the position of the car 5, a speed sensor that detects the speed of the car 5, an acceleration sensor that detects the acceleration of the car 5, or a load of the car 5. It is a load sensor to detect. The detection device provided in the car 5 may be a distance sensor that detects the distance from another car 5 arranged so as to have overlap with each other in the horizontal projection plane. Further, a gate switch for detecting the opening / closing of the door of the car 5 is connected. Each car node 16 acquires detection information from a detection device provided in the corresponding car 5. The information detected by the detection device provided in the car 5 is an example of the operation information of the car 5. Each car node 16 is an example of a node that acquires operation information of at least one of the car 5. Each car node 16 connects to the network 10.

The maintenance node 17 is connected to the maintenance device 9. The maintenance node 17 acquires information on the operation when the maintenance device 9 is operated. The operation information of the maintenance device 9 is an example of the operation information of each car 5. The maintenance node 17 is an example of a node that acquires operation information of at least one of the cars 5. The maintenance node 17 connects to the network 10. When a plurality of maintenance devices 9 are provided in the elevator 1, a plurality of maintenance nodes 17 corresponding to each maintenance device 9 may be provided.

Each node in the safety control system 12 may play a plurality of roles as a node for acquiring operation information of at least one of the cars 5. For example, any node may also have some or all of the functions of the door node 14, the hoistway node 15, the car node 16, and the maintenance node 17.

FIG. 2 is a configuration diagram of the safety control system 12 according to the first embodiment.

The safety control system 12 includes a plurality of individual safety circuits 18 and an overall safety circuit 19. The plurality of individual safety circuits 18 correspond to a plurality of control panels 11 on a one-to-one basis. Each individual safety circuit 18 is mounted on, for example, the corresponding control panel 11. Each individual safety circuit 18 corresponds to the same car as the car 5 to which the control panel 11 corresponds. When each individual safety circuit 18 is shut off, the power supply of the hoist that raises and lowers the car 5 corresponding to the individual safety circuit 18 and the brake that brakes the hoist is cut off. At this time, the car 5 is urgently stopped. The overall safety circuit 19 is mounted on, for example, at least one of the control panels 11. When the overall safety circuit 19 is cut off, the power of all hoisting machines and brakes is cut off. At this time, all the baskets 5 are stopped in an emergency.

The safety control system 12 includes a plurality of travel control devices 20. The plurality of travel control devices 20 correspond to the plurality of control panels 11 on a one-to-one basis. Each travel control device 20 is mounted on, for example, the corresponding control panel 11. Each travel control device 20 corresponds to the same car as the car 5 to which the control panel 11 corresponds. Each travel control device 20 is a device that controls the travel of the corresponding car 5. Each travel control device 20 stops the corresponding car 5 on any floor when the floor stop command is input. At this time, the car 5 stops at, for example, the nearest floor. Alternatively, when the floor is designated in the floor stop command, the car 5 may stop at the designated floor.

Each safety control device 13 includes an input unit 21, a communication unit 22, a duplicated output unit 23, and a duplicated processing unit 24. Although not shown, the input unit 21 is also duplicated, and the signals input from each input unit 21 are compared by the processing unit 24. The duplicated output units 23 are configured in the same manner as each other. The duplicated output unit 23 is configured so that, for example, when a problem occurs in one of the operating output units 23, the other output unit 23 can control the output unit 23. The duplicated processing units 24 are configured in the same manner as each other. The duplicated processing unit 24 is configured so that, for example, when a problem occurs in one of the processing units 24 that is operating, the other processing unit 24 can control it.

The input unit 21 is a part that receives information from a device connected to the safety control device 13 without going through the network 10. The device for inputting information to the input unit 21 of the safety control device 13 is, for example, an encoder provided in a hoist or a speed governor that raises and lowers the car 5 corresponding to the safety control device 13. The information input to the input unit 21 of the safety control device 13 is an example of the operation information of the car 5 supported by the safety control device 13.

The communication unit 22 is a part that communicates with a device connected to the safety control device 13 via the network 10. The communication unit 22 receives the operation information acquired by each node from the node. The communication unit 22 of the safety control device 13 receives the operation information acquired by the other safety control device 13 through the input unit 21 and the communication unit 22 from the other safety control device 13. The communication unit 22 of the safety control device 13 transmits the operation information acquired by the safety control device 13 through the input unit 21 and the communication unit 22 to the other safety control device 13. The communication unit 22 of each safety control device 13 communicates information indicating the state of the safety control device 13 with the other safety control device 13.

The output unit 23 is a part that outputs a stop command for stopping the car 5 for at least one of the plurality of cars 5. The output unit 23 includes an emergency stop unit 25 and a floor stop unit 26.

The emergency stop unit 25 is a part that outputs an emergency stop command, which is a stop command for urgently stopping any of the cars 5. The emergency stop 25 is connected to each individual safety circuit 18 and an overall safety circuit 19. The emergency stop unit 25 outputs an emergency stop command to shut off, for example, the individual safety circuit 18 or the overall safety circuit 19 by a relay. Alternatively, the emergency stop command output by the emergency stop unit 25 is, for example, an STO (Safe Torque Off) and an SBC (Safe) that shut off the power of the hoist that raises and lowers one of the cars 5 and the brake that brakes the hoist. It may be a signal such as Brake Control).

The floor stop unit 26 is a part that outputs a floor stop command, which is a stop command for stopping the car 5 on any floor. The floor stop unit 26 is connected to each travel control device 20. The floor stop unit 26 stops the car 5 on any floor by outputting a floor stop command to the traveling control unit corresponding to the car 5 to be stopped.

The processing unit 24 is a part that performs information processing in the safety control device 13. The information processing performed in the processing unit 24 includes communication processing, safety control processing, board diagnosis processing, and delay tolerance processing. The communication process is a process for communication with an external device of the safety control device 13. The safety control process is a process related to safety control such as control of the output of a stop command by the stop unit. The board diagnosis process is a process for diagnosing the state of the board including the processing unit 24. The board diagnosis process is, for example, a process such as a memory check or a CPU core diagnosis (CPU: Central Processing Unit). The delay tolerance process is another process such as communication process, safety control process, and board diagnosis process, and is a process in which delay is allowed. The delay tolerance process is, for example, a process such as logging.

The processing unit 24 of the safety control device 13 is equipped with the self-diagnosis function of the safety control device 13. The self-diagnosis of the safety control device 13 includes the detection of an abnormality that has occurred in the safety control device 13. The self-diagnosis of the safety control device 13 may include detection of a communication abnormality for the safety control device 13. When the processing unit 24 of the safety control device 13 detects an abnormality by self-diagnosis, the processing unit 24 transmits error information as information on the state of the safety control device 13 to another safety control device 13 through the communication unit 22. When the error information is transmitted from the other safety control device 13 as state information, the processing unit 24 determines that an abnormality has occurred in the other safety control device 13. Alternatively, when the processing unit 24 of the safety control device 13 detects an abnormality by self-diagnosis, the communication unit 22 may stop the transmission of the status information of the safety control device 13 to the other safety control device 13. good. At this time, the processing unit 24 determines that an abnormality has occurred in the other safety control device 13 when the status information is not transmitted from the other safety control device 13. As a result, the processing unit 24 can determine the occurrence of an abnormality in the other safety control device 13 even when the other safety control device 13 abnormally stops without self-diagnosis.

In the safety control system 12, each node has a part corresponding to a part or all of the input unit 21, the communication unit 22, and the processing unit 24, like the safety control device 13. Each node may perform a self-diagnosis in the same manner as the safety control device 13. The processing unit 24 of each safety control device 13 detects an abnormality in each node based on an error signal or the like output as a result of self-diagnosis. Alternatively, the processing unit 24 of each safety control device 13 detects an abnormality of each node based on the fact that information such as operation information is not transmitted. In addition to the abnormality that occurred in the node itself, the abnormality of each node may include the abnormality of the device that acquires the operation information connected to the node.

Here, each safety control device 13 is, for example, information on the occurrence of an abnormality determined by the safety control device 13, information on a device connected to the safety control device 13, and each node collected by the safety control device 13. Part or all of the information of each connected device may be communicated with each other together with the state information of the safety control device 13.

Subsequently, an example of the operation of the safety control system 12 in a normal time will be described with reference to FIG.
FIG. 3 is a sequence diagram showing an example of the operation of the safety control system 12 according to the first embodiment.

In this example, the plurality of baskets 5 include the baskets 5a and 5b. The plurality of control panels 11 include a control panel 11a and a control panel 11b. The control panel 11a corresponds to the car 5a. The control panel 11b corresponds to the car 5b. The plurality of safety control devices 13 include a safety control device 13a and a safety control device 13b. The safety control device 13a is mounted on the control panel 11a. The safety control device 13b is mounted on the control panel 11b. The plurality of car nodes 16 include a car node 16a and a car node 16b. The car node 16a is provided in the car 5a. The car node 16b is provided in the car 5b.

In this example, the safety control system 12 has a multi-master configuration including a plurality of masters. Here, the master is a device that acquires operation information from at least one node through the network 10. In this example, each safety control device 13 is the master. It should be noted that there may be primary and secondary roles among a plurality of masters. In this example, the safety control device 13a is the main main master. The safety control device 13b is a sub-master.

The communication unit 22 of the safety control device 13a transmits the information indicating the state of the safety control device 13a and the operation information acquired through the input unit 21 or the like to the safety control device 13b. The safety control device 13a determines that no abnormality has occurred in the safety control device 13b based on the received information. At this time, the safety control device 13a continues the normal operation.

The communication unit 22 of the safety control device 13b transmits the information indicating the state of the safety control device 13b and the operation information acquired through the input unit 21 or the like to the safety control device 13a. The safety control device 13b determines that no abnormality has occurred in the safety control device 13a based on the received information. At this time, the safety control device 13b continues the normal operation.

The car node 16a transmits the acquired operation information of the car 5a to the communication unit 22 of the safety control device 13a. The car node 16b transmits the acquired operation information of the car 5b to the communication unit 22 of the safety control device 13b. Each door node 14 transmits the acquired operation information to the communication unit 22 of the safety control device 13a, which is the main master. Each hoistway node 15 transmits the acquired operation information to the communication unit 22 of the safety control device 13a, which is the main master. The maintenance node 17 transmits the acquired operation information to the communication unit 22 of the safety control device 13a, which is the main master. The communication unit 22 of the safety control device 13a transmits information including the operation information of the car 5b collected from each node to the communication unit 22 of the safety control device 13b.

The processing unit 24 of the safety control device 13a performs self-safety control of the car 5a as a safety control process by using the operation information of the car 5a acquired through the input unit 21 and the communication unit 22. Here, the self-safety control in the safety control device 13a is the safety control of the car 5a to which the safety control device 13a itself corresponds. The safety control of the car 5a includes the control of the output of the stop signal for stopping the car 5a by the output unit 23. In the safety control of the car 5a, for example, when the car 5a is close to another car 5, the car 5a is in an overspeed state, or the car 5a runs with the door of the car 5a or the landing door 6 open. The stop signal of the car 5a is output. Further, the safety control of the car 5a may include the setting of the traveling prohibited section of the car 5a. The traveling prohibited section of the car 5a is a section in which the car 5a is not driven on the hoistway 2. Alternatively, when the maintenance device 9 is operated, the safety control device 13a outputs a signal to stop all the cars 5 by the output unit 23, prohibits the automatic running of the entire section, and then the maintenance personnel. Only the manual operation of the car 5 is permitted to operate the corresponding car 5.

The processing unit 24 of the safety control device 13b performs self-safety control of the car 5b as a safety control process by using the operation information of the car 5b acquired through the input unit 21 and the communication unit 22. Here, the self-safety control in the safety control device 13b is the safety control of the car 5b to which the safety control device 13b itself corresponds. The safety control of the car 5b includes the control of the output of the stop signal for stopping the car 5b by the output unit 23. In the safety control of the car 5b, for example, when the car 5b is close to another car 5, the car 5b is in an overspeed state, or the car 5b runs with the door of the car 5b or the landing door 6 open. The stop signal of the car 5b is output. Further, the safety control of the car 5b may include the setting of the traveling prohibited section of the car 5b. The traveling prohibited section of the car 5b is a section in which the car 5b is not driven on the hoistway 2. Alternatively, when the maintenance device 9 is operated, the safety control device 13b outputs a signal to stop all the cars 5 by the output unit 23, prohibits the automatic running of the entire section, and then the maintenance personnel. Only the manual operation of the car 5 is permitted to operate the corresponding car 5.

Subsequently, an example of the operation of the safety control system 12 when an abnormality occurs will be described with reference to FIGS. 4 and 5.
4 and 5 are sequence diagrams showing an example of the operation of the safety control system 12 according to the first embodiment.

FIG. 4 shows an example when an abnormality occurs in the safety control device 13b which is a submaster.

The processing unit 24 of the safety control device 13a determines that an abnormality has occurred in the safety control device 13b based on the state information transmitted from the safety control device 13b and the like. At this time, the processing unit 24 of the safety control device 13a determines whether the safety control of the car 5b can be performed on behalf of the processing unit 24. The processing unit 24 of the safety control device 13a determines, for example, that the safety control of the car 5b cannot be substituted when the stop signal for stopping the car 5b cannot be output from the output unit 23 of the safety control device 13a. The processing unit 24 of the safety control device 13a determines, for example, that the safety control of the car 5b cannot be substituted when sufficient processing resources cannot be secured. The processing unit 24 of the safety control device 13a determines that the safety control of the car 5b cannot be performed on behalf of the vehicle 5b when the operation information such as the position and speed of the car 5b cannot be acquired.

When the safety control of the car 5b can be performed on behalf of the car 5, the processing unit 24 of the safety control device 13a performs the safety control of the car 5b on behalf of the car 5b as a safety control process. Here, the substitute safety control of the car 5b in the safety control device 13a is the safety control of the car 5b that the safety control device 13a does not normally correspond to.

In this example, the safety control device 13a acting for safety control is an example of the first safety control device 13. The car 5 to which the first safety control device 13 corresponds is the first car 5. The stop command for stopping the first car 5 is the first stop command. The input unit 21 of the first safety control device 13 is the first input unit 21. The communication unit 22 of the first safety control device 13 is the first communication unit 22. The output unit 23 of the first safety control device 13 is the first output unit 23. The processing unit 24 of the first safety control device 13 is the first processing unit 24. Further, the safety control device 13b on which the safety control is performed is an example of the second safety control device 13. The car 5 to which the second safety control device 13 corresponds is the second car 5. The stop command for stopping the second car 5 is the second stop command. The input unit 21 of the second safety control device 13 is the second input unit 21. The communication unit 22 of the second safety control device 13 is the second communication unit 22. The output unit 23 of the second safety control device 13 is the second output unit 23. The processing unit 24 of the second safety control device 13 is the second processing unit 24.

The communication unit 22 of the safety control device 13a transmits a proxy notification to the communication unit 22 of the safety control device 13b when the proxy safety control of the car 5b is started. The communication unit 22 of the safety control device 13a transmits a command to change the output destination of the operation information to the communication unit 22 of the safety control device 13a to the car node 16b of the car 5b supported by the safety control device 13b. Upon receiving the command to change the output destination, the car node 16b transmits the operation information of the car 5b to the communication unit 22 of the safety control device 13a.

The processing unit 24 of the safety control device 13a performs both self-safety control of the car 5a and proxy safety control of the car 5b by using the operation information of the car 5a and the operation information of the car 5b acquired through the communication unit 22 and the like. Here, the operation information such as the position and speed of the car 5b is acquired through, for example, the position detector 8 provided in the hoistway 2, the position sensor and the speed sensor provided in the car 5b, and the like. The position of the car 5b is based on the distance acquired through a distance sensor that detects the distance to the car 5b provided in another car 5 arranged so as to overlap each other in the horizontal projection plane. It may be estimated.

When the processing unit 24 of the safety control device 13b detects an abnormality by self-diagnosis or the like, the self-safety control of the car 5b is stopped and restarted. The restart of the safety control device 13b is performed, for example, after the proxy safety control of the car 5b by the safety control device 13a is started. Alternatively, the safety control device 13b may be restarted without waiting for the start of the substitute safety control of the car 5b by the safety control device 13a after the abnormality is detected.

The processing unit 24 of the safety control device 13b performs a self-diagnosis after restarting. When no abnormality is detected in the self-diagnosis, the communication unit 22 of the safety control device 13b transmits the result of the self-diagnosis to the communication unit 22 of the safety control device 13a, for example, as state information.

Upon receiving the result of the self-diagnosis, the communication unit 22 of the safety control device 13a transmits a proxy end notification to the communication unit 22 of the safety control device 13b. After that, the safety control device 13a ends the proxy safety control of the car 5b.

Upon receiving the proxy end notification, the communication unit 22 of the safety control device 13b issues a command to the car node 16b of the car 5b supported by the safety control device 13b to change the output destination of the operation information to the communication unit 22 of the safety control device 13b. Send. Upon receiving the command to change the output destination, the car node 16b transmits the operation information of the car 5b to the communication unit 22 of the safety control device 13b. The processing unit 24 of the safety control device 13b restarts the self-safety control of the car 5b. After that, the safety control system 12 is restored to the normal operation.

FIG. 5 shows an example when an abnormality occurs in the safety control device 13a, which is the main master.

The processing unit 24 of the safety control device 13b determines that an abnormality has occurred in the safety control device 13a based on the state information transmitted from the safety control device 13a and the like. At this time, the processing unit 24 of the safety control device 13b determines whether the safety control of the car 5a can be performed on behalf of the processing unit 24.

When the safety control of the car 5a can be performed on behalf of the car 5, the processing unit 24 of the safety control device 13b performs the safety control of the car 5a on behalf of the car 5a as a safety control process. Here, the substitute safety control of the car 5a in the safety control device 13b is the safety control of the car 5a that the safety control device 13b does not normally correspond to.

In this example, the safety control device 13b acting for safety control is an example of the first safety control device 13. Further, the safety control device 13a on which the safety control is performed is an example of the second safety control device 13.

The communication unit 22 of the safety control device 13b transmits a proxy notification to the communication unit 22 of the safety control device 13a when the proxy safety control of the car 5a is started. The communication unit 22 of the safety control device 13b transmits a command to change the output destination of the operation information to the communication unit 22 of the safety control device 13b to the car node 16a of the car 5a supported by the safety control device 13a. Upon receiving the command to change the output destination, the car node 16a transmits the operation information of the car 5a to the communication unit 22 of the safety control device 13b. Further, the communication unit 22 of the safety control device 13b gives a command to each node such as the door node 14, the hoistway node 15, and the maintenance node 17 to change the output destination of the operation information to the communication unit 22 of the safety control device 13b. Send. Each node that receives the command to change the output destination transmits the acquired operation information to the communication unit 22 of the safety control device 13b.

The processing unit 24 of the safety control device 13b performs both self-safety control of the car 5b and proxy safety control of the car 5a by using the operation information of the car 5a and the operation information of the car 5b acquired through the communication unit 22 and the like.

When the processing unit 24 of the safety control device 13a detects an abnormality by self-diagnosis or the like, the self-safety control of the car 5a is stopped and restarted. The restart of the safety control device 13a is performed, for example, after the proxy safety control of the car 5a by the safety control device 13b is started. Alternatively, the safety control device 13a may be restarted without waiting for the start of the substitute safety control of the car 5a by the safety control device 13b after the abnormality is detected.

The processing unit 24 of the safety control device 13a performs a self-diagnosis after restarting. When no abnormality is detected in the self-diagnosis, the communication unit 22 of the safety control device 13a transmits the result of the self-diagnosis to the communication unit 22 of the safety control device 13b, for example, as state information.

Upon receiving the result of the self-diagnosis, the communication unit 22 of the safety control device 13b transmits a proxy end notification to the communication unit 22 of the safety control device 13a. After that, the safety control device 13b ends the proxy safety control of the car 5a.

Upon receiving the proxy end notification, the communication unit 22 of the safety control device 13a issues a command to the car node 16a of the car 5a supported by the safety control device 13a to change the output destination of the operation information to the communication unit 22 of the safety control device 13a. Send. Upon receiving the command to change the output destination, the car node 16a transmits the operation information of the car 5a to the communication unit 22 of the safety control device 13a. Further, the communication unit 22 of the safety control device 13a gives a command to each node such as the door node 14, the hoistway node 15, and the maintenance node 17 to change the output destination of the operation information to the communication unit 22 of the safety control device 13a. Send. Each node that receives the command to change the output destination transmits the acquired operation information to the communication unit 22 of the safety control device 13a. The processing unit 24 of the safety control device 13a restarts the self-safety control of the car 5a. After that, the safety control system 12 is restored to the normal operation.

Subsequently, with reference to FIGS. 6A and 6B, an example of securing processing resources in the processing unit 24 of the safety control device 13 when the safety control is performed will be described.
6A and 6B are diagrams showing an example of allocation of processing resources in the safety control system 12 according to the first embodiment.

The processing unit 24 calculates the margin of the processing resource of the processing unit 24, for example, when determining whether or not the safety control can be substituted. The processing unit 24 calculates, for example, the ratio of the processing time including the processing time and the free time of the delay tolerance processing to the processing resources as the margin of the processing resources. The processing unit 24 compares the calculated margin of processing resources with a preset threshold value. Here, the threshold value is set based on, for example, the amount of processing required for proxy safety control. Further, the threshold value for the substitute of the safety control device 13 as the submaster and the threshold value for the substitute of the safety control device 13 as the main master may be different values from each other.

FIG. 6A shows an example in which the processing resource margin in the processing unit 24 is larger than the threshold value.

The processing unit 24 allocates, for example, a part or all of the free time to the processing of the proxy safety control. When the processing resources required for the proxy safety control are insufficient, the processing unit 24 suspends a part or all of the delay tolerance processing. The processing unit 24 allocates the processing resource generated by suspending the delay tolerance processing to the processing of the proxy safety control.

On the other hand, FIG. 6B shows an example in which the processing resource margin in the processing unit 24 is less than the threshold value.

The processing unit 24 allocates the free time to the processing of the proxy safety control. When the processing resources required for the proxy safety control are insufficient, the processing unit 24 suspends all of the delay tolerance processing. The processing unit 24 allocates the processing resource generated by suspending the delay tolerance processing to the processing of the proxy safety control. When the processing resources required for the proxy safety control are still insufficient, the processing unit 24 reduces at least a part of the board diagnostic processing. For example, the processing unit 24 reduces the ratio of the substrate diagnostic processing to the processing resources by subdividing the processing for the items that can be time-divisioned in the substrate diagnostic processing and reducing the diagnostic items per cycle of the substrate diagnostic processing. Let me. The processing unit 24 allocates the processing resources generated by reducing the board diagnosis processing to the processing of the proxy safety control.

If the processing time including the processing time of the delay tolerance processing and the board diagnosis processing and the free time is not sufficient for the processing resources required for the proxy safety control, the processing unit 24 may determine that the safety control cannot be substituted. good.

Subsequently, another example of the operation of the safety control system 12 when an abnormality occurs will be described with reference to FIGS. 7A and 7B.
7A and 7B are diagrams showing an example of setting a traveling prohibition section in the safety control system 12 according to the first embodiment.

Here, an example is shown in which an abnormality occurs in the car node 16 of the car 5 that moves up and down among the two cars 5 that move up and down the same hoistway 2. When an abnormality occurs in the car node 16 of the upper car 5, the processing unit 24 of the safety control device 13 corresponding to the upper car 5 stops the upper car 5 by outputting a stop command to the output unit 23. Let me.

FIG. 7A shows an example in which the upper car 5 stops at a position where the position can be detected by any of the position detectors 8.

Based on information from the upper car 5 car node 16 or the safety control device 13 corresponding to the upper car 5, the processing unit 24 of the safety control device 13 corresponding to the lower car 5 is the car node 16. It is determined that an abnormality has occurred in. The communication unit 22 of the safety control device 13 corresponding to the lower car 5 acquires the stop position of the upper car 5 through the hoistway node 15. The processing unit 24 of the safety control device 13 corresponding to the lower car 5 sets the section including the stop position of the upper car 5 as the travel prohibited section of the lower car 5. When the upper car 5 is stopped at the stop position of any floor, the traveling prohibited section of the lower car 5 is set to, for example, a section including only the floor.

In the elevator 1, when there is a car 5 traveling on a hoistway 2 different from the stopped upper car 5, the processing unit 24 of the safety control device 13 corresponding to the car 5 is a travel prohibited section of the car 5. Does not have to be set.

Further, in the safety control system 12, when an abnormality occurs in any of the safety control devices 13, the traveling prohibition section may be set in the same manner. For example, when an abnormality occurs in the safety control device 13 corresponding to the upper car 5, the processing unit 24 of the safety control device 13 may stop the upper car 5. In this case, the processing unit 24 of the safety control device 13 corresponding to the lower car 5 determines that an abnormality has occurred in the safety control device 13 corresponding to the upper car 5. The communication unit 22 of the safety control device 13 corresponding to the lower car 5 acquires the stop position of the upper car 5 through the hoistway node 15. The processing unit 24 of the safety control device 13 corresponding to the lower car 5 sets the section including the stop position of the upper car 5 as the travel prohibited section of the lower car 5.

Further, when the car 5 is stopped by the stop command, the safety control device 13 may be stopped by designating the floor. The floor designated here is, for example, a floor whose position can be detected by any of the position detectors 8.

On the other hand, FIG. 7B shows an example in which the upper car 5 stops at a position where the position cannot be detected by the position detector 8.

In this case, the processing unit 24 of the safety control device 13 corresponding to the lower car 5 is based on the operation information such as the position and speed of the car 5 acquired immediately before the abnormality occurs, and the upper car 5 is used. Estimate the stop position of. The processing unit 24 of the safety control device 13 corresponding to the lower car 5 sets the section including the estimated stop position of the upper car 5 as the travel prohibited section of the lower car 5. The traveling prohibited section set at this time is set wider than the traveling prohibited section set when the upper car 5 stops at a position where the position can be detected by the position detector 8. The traveling prohibited section set at this time may be a section covering a plurality of floors.

Subsequently, an example of the operation of the safety control system 12 will be described with reference to FIGS. 8 and 9.
8 and 9 are flowcharts showing an example of the operation of the safety control system 12 according to the first embodiment.

In step S01 of FIG. 8, the processing unit 24 of each safety control device 13 determines whether or not an abnormality has occurred. When the occurrence of an abnormality is determined in any of the safety control devices 13 based on the information from the node, the operation of the safety control system 12 proceeds to step S02. When the occurrence of an abnormality in the other safety control device 13 is determined in any of the safety control devices 13, the operation of the safety control system 12 proceeds to step S12 in FIG. If the occurrence of an abnormality is not determined, the operation of the safety control system 12 proceeds to step S01 again.

In step S02, the processing unit 24 of the safety control device 13 that has determined the occurrence of an abnormality based on the information from the node determines in which node the event occurred. When the event for which the occurrence is determined is an abnormality of the door node 14, the operation of the safety control system 12 proceeds to step S03. When the event for which the occurrence is determined is an abnormality of the hoistway node 15, the operation of the safety control system 12 proceeds to step S04. When the event for which the occurrence is determined is an abnormality of the car node 16, the operation of the safety control system 12 proceeds to step S05. When the event for which the occurrence is determined is an abnormality of the maintenance node 17, the operation of the safety control system 12 proceeds to step S07.

In step S03, the processing unit 24 of each safety control device 13 sets a travel prohibited section of the corresponding car 5 for the landing door 6 provided with the open / close detector 7 corresponding to the door node 14 in which the occurrence of an abnormality is detected. do. The traveling prohibited section set at this time includes a position where the landing door 6 passes through the hoistway 2 side. Here, the safety control device 13 corresponding to the car 5 that may pass through the set traveling prohibition section stops the car 5 by outputting a stop command. The processing unit 24 of the safety control device 13 in which the corresponding car 5 does not pass through the hoistway 2 side of the landing door 6 does not have to set the traveling prohibited section of the car 5. After that, the operation of the safety control system 12 proceeds to step S09.

In step S04, the processing unit 24 of each safety control device 13 sets a travel prohibited section of the corresponding car 5 for the position detector 8 corresponding to the hoistway node 15 in which the occurrence of an abnormality is detected. The traveling prohibition section set at this time includes a position where the position detector 8 is provided. Here, the safety control device 13 corresponding to the car 5 that may pass through the set traveling prohibition section stops the car 5 by outputting a stop command. The processing unit 24 of the safety control device 13 in which the corresponding car 5 does not pass through the position of the position detector 8 does not have to set the traveling prohibition section of the car 5. After that, the operation of the safety control system 12 proceeds to step S09.

In step S05, the safety control device 13 corresponding to the car 5 provided with the car node 16 in which the occurrence of an abnormality is detected stops the car 5 by outputting a stop command. After that, the operation of the safety control system 12 proceeds to step S06.

In step S06, the processing unit 24 of the safety control device 13 corresponding to the other car 5 of the car 5 provided with the car node 16 in which the occurrence of the abnormality is detected sets the traveling prohibited section of the corresponding car 5. The traveling prohibition section set at this time includes the stop position of the car 5 stopped by the stop signal. The processing unit 24 of the safety control device 13 corresponding to the other car 5 that does not overlap with the stopped car 5 in the horizontal projection plane does not have to set the travel prohibited section of the other car 5. After that, the operation of the safety control system 12 proceeds to step S09.

In step S07, at least one of the safety control devices 13 stops all the cars 5 by outputting a stop command. The stop command output here may be, for example, an emergency stop command to the overall safety circuit 19. After that, the operation of the safety control system 12 proceeds to step S08.

In step S08, the processing unit 24 of each safety control device 13 sets the traveling prohibition section of the corresponding car 5. The traveling prohibited section set at this time is the entire section on the hoistway 2. The traveling prohibited section of the car 5 set here is a section in which the automatic traveling of the car 5 is prohibited on the hoistway 2. After that, the operation of the safety control system 12 proceeds to step S09.

In step S09, the node where the occurrence of the abnormality is detected is restarted and self-diagnosed. After that, the operation of the safety control system 12 proceeds to step S10.

In step S10, the node that has performed the self-diagnosis determines whether or not an abnormality is detected in the self-diagnosis. If no abnormality is detected, the operation of the safety control system 12 proceeds to step S11. When an abnormality is detected, the operation of the safety control system 12 ends after notifying, for example, the maintenance company of the elevator 1.

In step S11, the processing unit 24 of each safety control device 13 cancels the set travel prohibition section. The processing unit 24 of each safety control device 13 is restored to the normal operation. After that, the operation of the safety control system 12 proceeds to step S01.

In step S12 of FIG. 9, it is determined whether or not there is another safety control device 13 capable of outputting the stop command of the car 5 corresponding to the safety control device 13 in which the abnormality has occurred on behalf of the output unit 23. The determination is performed, for example, by each of the safety control devices 13 that have determined the abnormality of the other safety control device 13 determines whether or not the output of the stop command can be substituted for the safety control device 13 itself. When there is a safety control device 13 capable of substituting the output of the stop command, the operation of the safety control system 12 proceeds to step S13. When there is no safety control device 13 capable of substituting the output of the stop command, the operation of the safety control system 12 proceeds to step S22.

In step S13, the safety control device 13 capable of substituting the output of the stop command to the car 5 corresponding to the safety control device 13 in which the abnormality has occurred operates as a substitute for safety control such as the position and speed of the car 5. Determine if information can be obtained. When the necessary operation information can be acquired, the operation of the safety control system 12 proceeds to step S14. If the required operation information cannot be obtained, the operation of the safety control system 12 proceeds to step S18.

In step S14, the safety control device 13 capable of acquiring necessary operation information takes over the safety control of the car 5 to which the safety control device 13 in which the abnormality has occurred corresponds. As a result, the elevator 1 continues to operate. After that, the operation of the safety control system 12 proceeds to step S15.

In step S15, the safety control device 13 in which the abnormality has occurred restarts and self-diagnoses. After that, the operation of the safety control system 12 proceeds to step S16.

In step S16, the safety control device 13 that has performed the self-diagnosis determines whether or not an abnormality is detected in the self-diagnosis. If no abnormality is detected, the operation of the safety control system 12 proceeds to step S17. When an abnormality is detected, the safety control system 12 notifies, for example, the maintenance company of the elevator 1. After that, the operation of the safety control system 12 proceeds to step S01 in FIG. 8 while continuing the proxy safety control of the safety control device 13 performing the proxy safety control. At this time, since the elevator 1 is performing degenerate operation under the condition that one of the safety control devices 13 is not operating, it is desirable that early maintenance work such as equipment replacement is performed in the elevator 1. ..

In step S17, the safety control device 13 performing the proxy safety control ends the proxy safety control. The safety control device 13 in which the abnormality has occurred resumes the safety control of the corresponding car 5. After that, the operation of the safety control system 12 proceeds to step S01 in FIG.

In step S18, the safety control device 13 capable of substituting the output of the stop command of the corresponding car 5 by the safety control device 13 in which the abnormality has occurred is on the floor where the position detector 8 can detect the position of the car 5. Stop the car 5. After that, the operation of the safety control system 12 proceeds to step S19.

In step S19, the safety control device 13 in which the abnormality has occurred restarts and self-diagnoses. After that, the operation of the safety control system 12 proceeds to step S20.

In step S20, the safety control device 13 that has performed the self-diagnosis determines whether or not an abnormality is detected in the self-diagnosis. If no abnormality is detected, the operation of the safety control system 12 proceeds to step S21. When the abnormality is detected, the operation of the safety control system 12 proceeds to step S23.

In step S21, the safety control device 13 acting on behalf of the output of the stop command ends the substitution of the output of the stop command. The safety control device 13 in which the abnormality has occurred resumes the safety control of the corresponding car 5. After that, the operation of the safety control system 12 proceeds to step S01 in FIG.

In step S22, the safety control device 13 in which the occurrence of an abnormality is detected stops the car 5 by outputting a stop command. After that, the operation of the safety control system 12 proceeds to step S23.

In step S23, the processing unit 24 of the other safety control device 13 in which the occurrence of the abnormality is detected sets the traveling prohibition section of the corresponding car 5. The traveling prohibition section set at this time includes the stop position of the car 5 stopped by the stop signal. The processing unit 24 of the safety control device 13 corresponding to the other car 5 that does not overlap with the stopped car 5 in the horizontal projection plane does not have to set the travel prohibited section of the other car 5. After that, the operation of the safety control system 12 ends after notifying, for example, the maintenance company of the elevator 1.

The safety control system 12 may have a single master configuration including a single master. At this time, the operation information from each node is distributed to the other safety control device 13 via the master safety control device 13. Further, the safety control device 13 serving as a master in the single master configuration may be switchable. When an abnormality occurs in the safety control device 13 that becomes the master, another safety control device 13 may be switched to become the master. The other safety control device 13 acts on behalf of the safety control of the master safety control device 13 and the collection and distribution of operation information.

Further, the elevator 1 may be a multi-car system in which three or more cars 5 move up and down the same hoistway 2. Further, the elevator 1 may be an elevator 1 arranged so that none of the plurality of cars 5 overlap each other in the horizontal projection plane. At this time, the elevator 1 may be provided with a group management device or the like that manages call assignments and the like. Further, when a plurality of double car or multi-car elevators 1 are provided in a building, the safety control system 12 may be individually applied to each double car or multi-car elevator 1.

As described above, the safety control system 12 according to the first embodiment includes a plurality of safety control devices 13, a plurality of nodes, and a network 10. The plurality of safety control devices 13 correspond to a plurality of cars 5 on a one-to-one basis. Each node acquires the operation information of at least one of the cages 5. Operation information is input to the network 10 from each node. The plurality of safety control devices 13 include a first safety control device 13 and a second safety control device 13. The first safety control device 13 corresponds to the first car 5 out of the plurality of cars 5. The second safety control device 13 corresponds to the second car 5 out of the plurality of car 5. The second safety control device 13 includes a second communication unit 22, a second output unit 23, and a second processing unit 24. The second communication unit 22 connects to the network 10. The second communication unit 22 communicates with the first safety control device 13 through the network 10. The second output unit 23 outputs the second stop command. The second stop command is a command to stop the second car 5. The second processing unit 24 performs self-safety control of the second car 5 by using the operation information of the second car 5 acquired through the second communication unit 22. The self-safety control of the second car 5 includes the control of the output of the second stop command by the second output unit 23. The second processing unit 24 suspends the self-safety control of the second car 5 when an abnormality occurs in the second safety control device 13. The first safety control device 13 includes a first communication unit 22, a first output unit 23, and a first processing unit 24. The first communication unit 22 connects to the network 10. The first communication unit 22 communicates with the second safety control device 13 through the network 10. The first output unit 23 outputs the first stop command and the second stop command. The first stop command is a command to stop the first car 5. The first processing unit 24 performs self-safety control of the first car 5 by using the operation information of the first car 5 acquired through the first communication unit 22. The self-safety control of the first car 5 includes the control of the output of the first stop command by the first output unit 23. The first processing unit 24 uses the operation information of the second car 5 acquired through the first communication unit 22 when an abnormality occurs in the second safety control device 13, and uses the operation information of the second car 5. Perform agency safety control. The proxy safety control of the second car 5 includes the control of the output of the second stop command by the second output unit 23.
Further, the first car 5 and the second car 5 are arranged so as to have overlap with each other in the horizontal projection plane.

With such a configuration, even if an abnormality occurs in the second safety control device 13 corresponding to the second car 5, the safety control of the second car 5 is performed on behalf of the first safety control device 13. .. Therefore, the elevator 1 can be continuously operated. As a result, the operating rate of the elevator 1 is less likely to decrease. In particular, when the first car 5 and the second car 5 move up and down the same hoistway 2, the stoppage of the second car 5 also affects the operation of the first car 5. Since the occurrence of the influence on the chained operation is suppressed in this way, the decrease in the operating rate of the elevator 1 can be suppressed more effectively. Further, the plurality of safety control devices 13 acquire operation information of each car 5 through the network 10. Therefore, it is not necessary to provide a separate communication line for each combination of the safety control device 13 and the node. As a result, the number of wirings in the elevator 1 can be suppressed.

Further, the first processing unit 24 suspends at least a part of the delay tolerance processing in which the delay is allowed when the proxy safety control of the second car 5 is performed.
Further, when the proxy safety control of the second car 5 is performed, the first processing unit 24 has a preset threshold value in which the ratio of the processing time of the delay allowable processing and the processing time including the free time to the processing resources is set in advance. Determine if it is less. When it is determined that the number is less than the threshold value, the first processing unit 24 reduces at least a part of the substrate diagnostic processing for diagnosing the state of the substrate including the first processing unit 24.

With such a configuration, the processing resources required for the processing on behalf of the safety control are preferentially secured. As a result, it is possible to suppress the occurrence of a situation in which safety control cannot be performed on behalf of the user due to a shortage of processing resources. Therefore, there are many cases where the elevator 1 can be continuously operated. As a result, the operating rate of the elevator 1 is less likely to decrease.

Further, the second processing unit 24 performs a self-diagnosis after an abnormality occurs in the second safety control device 13. The second processing unit 24 restarts the self-safety control of the second car 5 when no abnormality is detected in the second safety control device 13 in the self-diagnosis. The first processing unit 24 ends the proxy safety control of the second car 5 when no abnormality is detected in the second safety control device 13 in the self-diagnosis.

With such a configuration, the safety control system 12 is automatically restored. As a result, the elevator 1 can continue to operate more stably.

Further, the plurality of nodes include the door node 14. The door anode 14 is connected to the open / close detector 7. The open / close detector 7 detects the open / close of the landing door 6 on any floor. When an abnormality occurs in the door node 14, each safety control device 13 prohibits the traveling of the car 5 corresponding to the section including the position through the landing door 6 provided with the open / close detector 7 to which the door node 14 is connected. It is a section.
Further, the plurality of nodes include the hoistway node 15. The hoistway node 15 connects to the position detector 8. The position detector 8 detects the position of at least one of the cars 5 in the hoistway 2. When an abnormality occurs in the hoistway node 15, each safety control device 13 includes a section including a position where the position detector 8 to which the hoistway node 15 is connected is provided as a travel prohibited section of the corresponding car 5. do.
Further, the plurality of nodes include the car node 16. The car node 16 is provided in any of the cars 5. The car node 16 acquires the operation information of the car 5. The safety control device 13 corresponding to the car 5 stops the corresponding car 5 when an abnormality occurs in the car node 16.
Further, in the safety control device 13 corresponding to the car 5 and the other car 5 arranged so as to overlap each other in the horizontal projection plane, when an abnormality occurs in the car node 16, the car node 16 causes the car node 16. The section including the stop position of the provided car 5 is regarded as the traveling prohibited section of the corresponding car 5.
Further, when an abnormality occurs in any of the safety control devices 13, the safety control device 13 in which the abnormality occurs stops the corresponding car 5. While the car 5 is stopped, the safety control device 13 corresponding to the other car 5 arranged so as to overlap each other in the horizontal projection plane with the car 5 is the safety control device 13 in which the abnormality has occurred. The section including the stop position of the corresponding car 5 is regarded as the travel prohibited section of the corresponding car 5.

With such a configuration, even if an abnormality occurs in each node and each safety control device 13, the operation of the elevator 1 is continued within the range in which the car 5 can be operated. As a result, the convenience of the user is less likely to decrease.

Further, the plurality of nodes include the maintenance node 17. The maintenance node 17 is connected to the maintenance device 9. The maintenance device 9 is operated when performing maintenance and inspection work. When the maintenance device 9 is operated, each safety control device 13 sets the entire section of the hoistway 2 as an automatically prohibited section of the corresponding car 5.

With such a configuration, the operation of the car 5 is stopped when maintenance and inspection are performed. As a result, the safety of work on the hoistway 2 and the like of maintenance personnel who perform maintenance and inspection is enhanced.

Subsequently, an example of the hardware configuration of the safety control system 12 will be described with reference to FIG.
FIG. 10 is a hardware configuration diagram of a main part of the safety control system 12 according to the first embodiment.

Each function of the safety control system 12 can be realized by a processing circuit. The processing circuit includes at least one processor 100a and at least one memory 100b. The processing circuit may include at least one dedicated hardware 200 with or as a substitute for the processor 100a and the memory 100b.

When the processing circuit includes the processor 100a and the memory 100b, each function of the safety control system 12 is realized by software, firmware, or a combination of software and firmware. At least one of the software and firmware is written as a program. The program is stored in the memory 100b. The processor 100a realizes each function of the safety control system 12 by reading and executing the program stored in the memory 100b.

The processor 100a is also referred to as a CPU, a processing device, an arithmetic unit, a microprocessor, a microcomputer, and a DSP. The memory 100b is composed of, for example, a non-volatile or volatile semiconductor memory such as a RAM, a ROM, a flash memory, an EPROM, or an EEPROM.

When the processing circuit includes the dedicated hardware 200, the processing circuit is realized by, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

Each function of the safety control system 12 can be realized by a processing circuit. Alternatively, each function of the safety control system 12 can be collectively realized by a processing circuit. For each function of the safety control system 12, a part may be realized by the dedicated hardware 200, and the other part may be realized by software or firmware. In this way, the processing circuit realizes each function of the safety control system 12 with the dedicated hardware 200, software, firmware, or a combination thereof.

The safety control system according to this disclosure can be applied to elevators. The safety control device according to the present disclosure can be applied to the safety control system.

1 elevator, 2 hoistway, 3 pits, 4 landings, 5, 5a, 5b baskets, 6 landing doors, 7 open / close detectors, 8 position detectors, 9 maintenance equipment, 10 networks, 11, 11a, 11b control panels, 12 Safety control system, 13, 13a, 13b safety control device, 14 door node, 15 hoistway node, 16, 16a, 16b car node, 17 maintenance node, 18 individual safety circuit, 19 overall safety circuit, 20 driving control device, 21 input Department, 22 communication unit, 23 output unit, 24 processing unit, 25 emergency stop unit, 26 floor stop unit, 100a processor, 100b memory, 200 dedicated hardware

Claims

It is one of a plurality of safety control devices that correspond one-to-one to a plurality of cars that move up and down the hoistway in an elevator, and corresponds to the first car of the plurality of cars, and usually the plurality of cars. It is a safety control device that does not correspond to the second car of the car.
Connect to a network in which operation information is input from a plurality of nodes, each of which acquires at least one of the operation information of the plurality of cars, and communicates with another safety control device corresponding to the second car through the network. Communication department and
An output unit that outputs a first stop command for stopping the first car and a second stop command for stopping the second car.
Using the operation information of the first car acquired through the communication unit, the self-safety control of the first car that controls the output of the first stop command by the output unit is performed, and the second car is controlled. When an abnormality occurs in another safety control device corresponding to the above, the output of the second stop command by the output unit is controlled by using the operation information of the second car acquired through the communication unit. A processing unit that performs proxy safety control for the second car,
Elevator safety control device equipped with.
The safety control device for an elevator according to claim 1, wherein the processing unit suspends at least a part of the delay tolerance processing in which the delay is allowed when the proxy safety control of the second car is performed.
When the processing unit performs the proxy safety control of the second car, the ratio of the processing time of the delay allowable processing and the processing time including the free time to the processing resources is less than a preset threshold value. The elevator safety control device according to claim 2, wherein at least a part of the substrate diagnostic processing for diagnosing the state of the substrate including the processing unit is reduced.
The safety control device for an elevator according to any one of claims 1 to 3, wherein the first car and the second car are arranged so as to overlap each other in a horizontal projection plane.
Multiple safety control devices that correspond one-to-one to multiple cars that go up and down the hoistway in the elevator,
A plurality of nodes, each of which acquires at least one of the operation information of the plurality of cars, and
A network in which operation information is input from each of the plurality of nodes,
Equipped with
The plurality of safety control devices are
A first safety control device corresponding to the first car among the plurality of cars,
A second safety control device corresponding to the second car among the plurality of cars, and
Including
The second safety control device is
A second communication unit that connects to the network and communicates with the first safety control device through the network.
A second output unit that outputs a second stop command for stopping the second car, and a second output unit.
Using the information on the operation of the second car acquired through the second communication unit, the self-safety control of the second car that controls the output of the second stop command by the second output unit is performed. A second processing unit that suspends self-safety control of the second car when an abnormality occurs in the second safety control device.
Equipped with
The first safety control device is
A first communication unit that connects to the network and communicates with the second safety control device through the network.
A first stop command for stopping the first car, a first output unit for outputting the second stop command, and a first output unit.
Using the operation information of the first car acquired through the first communication unit, self-safety control of the first car for controlling the output of the first stop command by the first output unit is performed. , The second stop command by the first output unit using the operation information of the second car acquired through the first communication unit when an abnormality occurs in the second safety control device. The first processing unit that performs the proxy safety control of the second car that controls the output of
Elevator safety control system.
The safety control system for an elevator according to claim 5, wherein the first processing unit suspends at least a part of the delay tolerance processing in which the delay is allowed when the proxy safety control of the second car is performed.
In the first processing unit, when performing the proxy safety control of the second car, the ratio of the processing time of the delay allowable processing and the processing time including the free time to the processing resources is set from a preset threshold value. The safety control system for an elevator according to claim 6, which reduces at least a part of the substrate diagnostic processing for diagnosing the state of the substrate including the first processing unit when the number is small.
The second processing unit performs a self-diagnosis after an abnormality occurs in the second safety control device, and when an abnormality is not detected in the second safety control device in the self-diagnosis, the second car Resume self-safety control,
Any one of claims 5 to 7, wherein the first processing unit terminates the proxy safety control of the second car when an abnormality is not detected in the second safety control device in the self-diagnosis. Elevator safety control system as described in.
The plurality of nodes
Includes a door node that connects to an open / close detector that detects the open / close of the landing door on any floor.
Each of the plurality of safety control devices claims that when an abnormality occurs in the door node, the section including the position passing through the landing door is set as the automatic traveling prohibition section of the corresponding car among the plurality of cars. The elevator safety control system according to any one of claims 5 to 8.
The plurality of nodes
Includes a hoistway node connected to a position detector that detects the position of at least one of the plurality of cars in the hoistway.
Each of the plurality of safety control devices claims that when an abnormality occurs in the hoistway node, the section including the position where the position detector is provided is set as the travel prohibited section of the corresponding car among the plurality of cars. The elevator safety control system according to any one of claims 5 to 9.
The plurality of nodes
Includes maintenance nodes that connect to maintenance equipment that is operated during maintenance work.
One of claims 5 to 10, wherein each of the plurality of safety control devices sets the entire section as a travel prohibited section of the corresponding car among the plurality of cars when the maintenance device is operated. Elevator safety control system described in.
The elevator safety control system according to any one of claims 5 to 11, wherein at least one of the plurality of cars is arranged so as to have overlap with each other in the horizontal projection plane.
The plurality of nodes
Includes a car node that is installed in any of the above-mentioned multiple cars and acquires operation information of the car.
When an abnormality occurs in the car node, the safety control device corresponding to the car among the plurality of safety control devices stops the car.
Among the plurality of safety control devices, the safety control device corresponding to the other car arranged so as to overlap each other in the car and the horizontal projection plane is the car node when an abnormality occurs in the car node. The safety control system for an elevator according to claim 12, wherein the section including the stop position of the car provided with the car is a prohibited section for traveling of the other car.
When an abnormality occurs in any of the plurality of safety control devices, the safety control device in which the abnormality occurs among the plurality of safety control devices stops the corresponding car.
While the car was stopped, the abnormality occurred in the safety control device corresponding to the other car arranged so as to overlap each other in the horizontal projection plane among the plurality of safety control devices. The safety control system for an elevator according to claim 12 or 13, wherein the section including the stop position of the car corresponding to the safety control device is a travel prohibited section of the other car.