WO2011111223A1 - エレベータ安全制御装置 - Google Patents
エレベータ安全制御装置 Download PDFInfo
- Publication number
- WO2011111223A1 WO2011111223A1 PCT/JP2010/054230 JP2010054230W WO2011111223A1 WO 2011111223 A1 WO2011111223 A1 WO 2011111223A1 JP 2010054230 W JP2010054230 W JP 2010054230W WO 2011111223 A1 WO2011111223 A1 WO 2011111223A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- safety control
- control device
- elevator
- car
- independence
- Prior art date
Links
Images
Classifications
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B66—HOISTING; LIFTING; HAULING
- B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
- B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
- B66B5/02—Applications of checking, fault-correcting, or safety devices in elevators responsive to abnormal operating conditions
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B66—HOISTING; LIFTING; HAULING
- B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
- B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
- B66B5/0006—Monitoring devices or performance analysers
- B66B5/0018—Devices monitoring the operating condition of the elevator system
- B66B5/0031—Devices monitoring the operating condition of the elevator system for safety reasons
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B66—HOISTING; LIFTING; HAULING
- B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
- B66B1/00—Control systems of elevators in general
- B66B1/34—Details, e.g. call counting devices, data transmission from car to control system, devices giving information to the control system
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B66—HOISTING; LIFTING; HAULING
- B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
- B66B3/00—Applications of devices for indicating or signalling operating conditions of elevators
Definitions
- This invention relates to an elevator safety control device that controls the operation of an elevator from the viewpoint of safety based on a sensor signal from a sensor.
- a logic unit including a processor (CPU) and a memory is formed on one substrate or one device.
- the technique according to Patent Document 1 includes a monitoring board (monitoring unit) that monitors the position and speed of a car, and a brake control board (brake control unit) that controls the brake device when performing a second braking operation. .
- a monitoring board monitoring unit
- a brake control board brake control unit
- An object is to provide a control device.
- an elevator safety control device that controls stopping of a car, and inputs a signal related to the state of the elevator as an input value.
- a CPU Central Processing Unit
- a CPU Central Processing Unit
- a memory that performs calculations related to the safety control of the elevator and a memory by executing calculations related to a plurality of safety control functions by using independent programs using the input values.
- an independence assurance unit that guarantees the independence of the safety control function that does not affect the safety control function, and the independence assurance unit includes each of the safety control functions.
- the independence of the safety control function by monitoring whether or not the memory other than the permitted area is accessed. Testimony and, according to predetermined said safety control function, access to the memory other than authorized region, when the independent assurance unit detects the elevator safety controller stops the car.
- An elevator safety control device is an elevator safety control device that controls the stop of a car, wherein an input unit inputs a signal related to an elevator state as an input value, and the input
- a logic unit including a CPU (Central Processing Unit) that performs operations related to the safety control of the elevator and the safety control function
- An independence assurance unit that guarantees the independence of the safety control function, which does not affect each other, and the independence assurance unit has a pre-set rule for the processing time of the safety control function.
- the independence of the safety control function is ensured by monitoring whether the time has been exceeded, and the independence assurance unit When said operation processing time is detected that exceeds the predetermined time, the elevator safety controller stops the car.
- the independence assurance unit monitors whether or not the safety control function is accessing a memory other than the area where each safety control function is permitted. Guarantees independence. Then, when the independence assurance unit detects access to a memory other than the permitted area by a predetermined safety control function, the elevator safety control device stops the car.
- the independence assurance unit monitors whether or not the calculation processing time by the safety control function exceeds a preset specified time, Guarantees the independence of safety control functions. Then, when the independence assurance unit detects that the calculation processing time exceeds the specified time, the elevator safety control device stops the car.
- a plurality of safety control functions can be mounted on one elevator safety control device (safety control board) without affecting one safety control function by another safety control function. Therefore, the cost required for safety control of the elevator can be reduced, and installation and maintenance are easily performed.
- FIG. 3 is a diagram illustrating a connection relationship among a CPU 34, an independence assurance unit 36, and a memory 37 in the first embodiment.
- FIG. It is a figure for demonstrating the memory interference monitoring function of the independence guarantee part 36 which concerns on Embodiment 1.
- FIG. 3 It is a figure for demonstrating the execution time monitoring function of the independence guarantee part 36 which concerns on Embodiment 1.
- FIG. 3 is a diagram illustrating an internal configuration of an independence assurance unit 36, an output buffer 35, and an output unit 38 according to the first embodiment, and a connection relationship therebetween.
- FIG. 4 is a flowchart for explaining an operation of the elevator safety control device 25 according to the first embodiment. It is a figure for demonstrating the memory interference monitoring function of the independence assurance part 36 which concerns on Embodiment 2.
- FIG. It is the figure which illustrated the allocation table used with the memory interference monitoring function of the independence guarantee part 36 which concerns on Embodiment 3.
- FIG. It is a block diagram which shows the structure of the elevator safety control apparatus 25A which concerns on Embodiment 4.
- FIG. FIG. 18 is a diagram illustrating a connection relationship among CPUs 34g1 and 34g2, independence assurance units 36g1 and 36g2, and memories 37g1 and 36g2 in the fourth embodiment. It is a flowchart for demonstrating operation
- FIG. 1 is a diagram showing a configuration of an elevator apparatus 100 according to Embodiment 1 of the present invention.
- a car 1 and a counterweight 2 are suspended in a hoistway by suspension means 3.
- the suspension means 3 includes a plurality of ropes or belts.
- a hoisting machine 4 for raising and lowering the car 1 and the counterweight 2 is installed in the lower part of the hoistway.
- the hoisting machine 4 includes a driving sheave 5 around which the suspension means 3 is wound, a hoisting machine motor that generates driving torque and rotates the driving sheave 5, and braking that generates braking torque and brakes the rotation of the driving sheave 5.
- a hoisting machine brake 6 as means and a hoisting machine encoder 7 for generating a signal corresponding to the rotation of the drive sheave 5 are provided.
- an electromagnetic brake device is used as the hoisting machine brake 6, for example.
- the brake shoe is pressed against the braking surface by the spring force of the braking spring, the rotation of the drive sheave 5 is braked, and the car 1 is braked. Further, by exciting the electromagnetic magnet, the brake shoe is pulled away from the braking surface, and the braking force is released. Furthermore, the braking force applied by the hoisting machine brake 6 is changed according to the current value that flows through the brake coil of the electromagnetic magnet.
- the car 1 is provided with a pair of car suspension wheels 8a and 8b.
- the counterweight 2 is provided with a counterweight suspension vehicle 9.
- car return wheels 10a and 10b and a counterweight return wheel 11 are provided in the upper part of the hoistway.
- One end of the suspension means 3 is connected to a first rope stop 12a provided at the upper part of the hoistway.
- the other end of the suspension means 3 is connected to a second rope stop 12b provided at the upper part of the hoistway.
- the suspension means 3 is wound around the car suspension cars 8a and 8b, the car return cars 10a and 10b, the drive sheave 5, the counterweight return car 11 and the counterweight suspension car 9 in order from one end side. That is, the car 1 and the counterweight 2 are suspended in the hoistway by the “2: 1 roping method”.
- a governor 14 is installed at the top of the hoistway.
- the governor 14 includes a governor sheave 15 and a governor encoder 16 that generates a signal corresponding to the rotation of the governor sheave 15.
- a governor rope 17 is wound around the governor sheave 15. Both ends of the governor rope 17 are connected to an operation lever of an emergency stop device mounted on the car 1. The lower end portion of the governor rope 17 is wound around a tension wheel 18 disposed at the lower part of the hoistway.
- An upper reference position switch 19a for detecting the position of the car 1 is provided in the upper part of the hoistway.
- a lower reference position switch 19b for detecting the position of the car 1 is provided at the lower part in the hoistway.
- the car 1 is provided with a switch operating member (cam) for operating the reference position switches 19a and 19b.
- a car door switch 20 is provided on the car 1 to detect opening / closing of the car door.
- a landing door switch for detecting opening / closing of a landing door is provided at the landing on each floor.
- the hoistway is provided with a plurality of floor matching plates 21a to 21c for detecting that the car 1 is located at a position (door zone) where the passenger can safely enter and leave the car 1.
- the car 1 is provided with a floor alignment sensor 22 for detecting the floor alignment plates 21a to 21c.
- the hoisting machine encoder 7, the governor encoder 16, the reference position switches 19 a and 19 b, the car door switch 20, the landing door switch and the floor alignment sensor 22 are sensors that generate signals according to the state of the car 1.
- a control panel 23 is installed in the hoistway.
- the elevator safety control device (safety control board) 25 can control the stop of the car 1.
- a plurality of safety control functions are mounted on the safety control board 25 in order to perform each of the monitoring / control. That is, safety control from a plurality of viewpoints of the elevator apparatus is realized by the safety control board 25 executing calculations related to the safety control function with separate independent programs (software).
- the safety control function include a brake control function and an overspeed monitoring function.
- the drive control unit 24 controls the operation of the hoisting machine 4, that is, the operation of the car 1.
- the drive control unit 24 controls the traveling speed of the car 1 based on a signal from the hoisting machine encoder 7. Furthermore, the drive control unit 24 outputs a brake operation command for stopping the car 1 to the landing and a brake release command for permitting the car 1 to travel to the brake control function.
- a brake control function which is one of safety control functions, acquires a brake operation command from the drive control unit 24, and outputs a brake operation signal to the hoisting machine brake 6 according to the operation command. Further, the brake control function can control the braking force (braking torque) generated by the hoisting machine brake 6 by controlling the current flowing through the brake coil of the hoisting machine brake 6. The braking force generated by the hoisting machine brake 6 is reduced by increasing the current value of the brake coil, and becomes zero when the current value exceeds a predetermined value. Further, when the current value of the brake coil is decreased, the braking force is increased, and when the current value is 0, the braking force is maximized.
- the brake control function determines whether or not the car 1 is at the landing position using a signal from the floor alignment sensor 22. Furthermore, the brake control function determines whether the car door and the landing door are opened or closed using signals from the car door switch 20 and the landing door switch. Furthermore, the brake control function determines whether or not the car 1 is running using a signal from the hoisting machine encoder 7.
- the brake control function is in a state where at least one of the car door or the landing door is open and the car 1 is traveling even though the car 1 is not at the landing position. A state where at least one of the car door and the landing door is open is detected, and a brake operation command is output. That is, when the door control state is detected, the brake control function brakes the drive sheave 5 by the hoisting machine brake 6, stops the hoisting machine motor, and forcibly stops the car 1.
- Signals from the governor encoder 16 and the reference position switches 19a and 19b are input to an overspeed monitoring function which is one of safety control functions.
- the overspeed monitoring function obtains the position and speed of the car 1 independently from the drive control unit 24 using signals from the governor encoder 16 and the reference position switches 19a and 19b, and the speed of the car 1 is predetermined. Monitor whether the overspeed level is reached.
- the overspeed level is set as an overspeed monitoring pattern that changes according to the position of the car 1.
- the overspeed monitoring function transmits a forced stop signal to the brake control function.
- the brake control function brakes the drive sheave 5 by the hoisting machine brake 6, stops the hoisting machine motor, and forcibly stops the car 1.
- the drive control unit 24 and the elevator safety control device 25 each have an independent microcomputer.
- the function in the drive control part 24 and the function in the elevator safety control apparatus 25 are implement
- the calculation of each safety control function (brake control function, overspeed monitoring function, etc.) implemented in the safety control device 25 is executed by an independent program (software).
- elevator safety control device 25 different names are used for the elevator safety control device 25, such as “elevator safety control device” and “safety control board”, but the same elevator safety control device 25 is shown.
- a plurality of various safety control functions are mounted on one elevator safety control device (safety control board) 25.
- safety control board 25 when a plurality of safety control functions are simply mounted on one substrate (device) 25, when one safety control function fails, the other safety control function is impaired, and the safety control of the elevator is performed. (That is, the independence of each safety control function cannot be guaranteed). Therefore, it is necessary to guarantee the independence of each safety control function so that each safety control function does not affect other safety control functions.
- the present embodiment includes an elevator safety control device (safety control board) 25 having the configuration shown in FIG.
- FIG. 2 is a block diagram showing a configuration of the elevator safety control device (safety control board) 25 shown in FIG.
- the elevator safety control device 25 shown in FIG. 2 includes an independence assurance unit 36 that ensures independence of a plurality of safety control functions.
- the elevator safety control device 25 includes an input unit 32, an input buffer 33, a CPU (Central Processing Unit) 34, an output buffer 35, an independence assurance unit 36, a memory 37, and an output unit 38.
- an input unit 32, an input buffer 33, a CPU (Central Processing Unit) 34, an output buffer 35, an independence assurance unit 36, a memory 37, and an output unit 38 are mounted on one safety control board 25, on one safety control board 25, an input unit 32, an input buffer 33, a CPU (Central Processing Unit) 34, an output buffer 35, an independence assurance unit 36, a memory 37, and an output unit 38 are mounted. ing.
- a CPU Central Processing Unit
- the input unit 32 is connected to the input buffer 33, and the input buffer 33 is connected to the CPU 34.
- the CPU 34 is connected to the output buffer 35 and the independence assurance unit 36, respectively.
- the independence assurance unit 36 is connected to the output buffer 35, the memory 37, and the output unit 38, respectively.
- the input unit 32 is connected to the external components 30 and 31 of the safety control board 25, and the output unit 38 is connected to the external components 4 and 6 of the safety control board 25.
- a signal relating to the state of the entire elevator system including the car 1 (hereinafter referred to as the state of the elevator) is input to the input unit 32 as an input value.
- the state of the elevator there are various switches 19a, 19b, various sensors 16 and the like in order to monitor and detect the state of the elevator.
- various switches are collectively shown as a switch 30, and various sensors are collectively shown as a sensor 31.
- the input unit 32 inputs an output signal from the switch 30 and an output signal from the sensor 31 (signal related to the state of the elevator) as input values.
- the input unit 32 counts and digitizes pulse signals such as encoder signals. Further, the input unit 32 compares the duplicated input values and compares the input value with a signal from a reference sensor (not shown). If a mismatch is detected as a result of comparison at the input unit 32, a message to that effect is sent to the CPU 34 constituting the logic unit. The input value input to the input unit 32 is taken into the input buffer 33.
- CPU 34 reads input values of sensor 31 and switch 30 from input buffer 33. And CPU34 performs a calculation required for the some safety control regarding an elevator. In other words, the CPU 34 uses the input values to execute calculations related to a plurality of safety control functions with independent programs (software). Thereby, the safety control of an elevator is implement
- the independence assurance unit 36 provides a guarantee function that guarantees the independence of a plurality of safety control functions.
- One of the guarantee functions is a memory interference monitoring function.
- Each safety control function can access only a predetermined area in the memory 37 constituting the logic unit.
- the memory interference monitoring function is a function for monitoring whether or not the memory 37 is accessed outside the area accessible by each safety control function. A specific description of the memory interference monitoring function will be described later with reference to FIG.
- FIG. 3 is a block diagram showing a connection relationship between the CPU 34, the memory 37, and the independence assurance unit 36.
- the CPU 34 and the memory 37 are connected by a bus 39, and an independence assurance unit 36 is interposed in the bus 39.
- the CPU 34 and the independence assurance unit 36 are connected by a communication line 39a.
- the CPU 34 notifies the independence assurance unit 36 of the process ID of the safety control function currently being executed by the CPU 34 via the communication line 39a.
- the process ID is information for identifying the safety control function.
- the independence assurance unit 36 transmits the determination results (for example, memory interference monitoring results and execution time monitoring results) of the independence assurance unit 36 and various commands (for example, reset processing commands) via the signal line 39a.
- CPU 34 is notified.
- the CPU 34 accesses a predetermined address in the memory 37 at the time of calculation processing of the safety control function. Therefore, the independence assurance unit 36 obtains information (that is, address information) regarding the area of the memory 37 that the safety control function is trying to access via the bus 39.
- the memory interference monitoring function in the independence assurance unit 36 it is checked whether or not the obtained address information is within a pre-allocated range in the memory 37.
- an assignment table as shown in FIG. 4 is preset in the independence assurance unit 36.
- the allocation table is composed of a process ID and an addressable area of the memory 37 to which the safety control function is permitted to access in the arithmetic processing of the safety control function of the process ID.
- the independence assurance unit 36 having a memory interference monitoring function uses the information (process ID and address information) acquired from the CPU 34 and the allocation table to access the memory 37 other than the area where the safety control function is permitted. Monitor whether or not That is, the independence assurance unit 36 ensures the independence of the safety control function through the monitoring.
- the independence assurance unit 36 compares each piece of information acquired from the CPU 34 with the allocation table to monitor whether or not the memory 37 other than the area where each safety control function is permitted is accessed. ing.
- the independence assurance unit 36 detects that the CPU 34 is accessing the memory 37 other than the address permitted to access the safety control function in the safety control function currently being executed. (That is, when the presence of memory interference is detected, in other words, when the independence of the safety control function cannot be ensured). In this case, the independence assurance unit 36 notifies the CPU 34 of the detection of the memory interference via the communication line 39a. Then, the elevator safety control device 25 resets itself (that is, the power source of the elevator safety control device 25 is reset).
- the independence assurance unit 36 has an execution time monitoring function in addition to the memory interference monitoring function.
- the execution time monitoring function is a function for monitoring the individual calculation processing time in which each safety control function is executed and / or the total calculation processing time in which all safety control functions are executed.
- the independence assurance unit 36 may have only one of the memory interference monitoring function and the execution time monitoring function. However, in the following description, the independence assurance unit 36 executes the memory interference monitoring function and the execution function. It has both a time monitoring function. Further, in the execution time monitoring function described below, both the individual calculation processing time and the total calculation processing time are monitored.
- the independence assurance unit 36 ensures the independence of the safety control function by monitoring whether or not the calculation processing time by the safety control function exceeds a preset specified time.
- the elevator safety control device 25 stops the car 1 when the independence assurance unit 36 detects that the calculation processing time of the safety control function has exceeded the specified time (when the independence of the safety control function cannot be ensured).
- the independence assurance unit 36 includes a plurality of watchdog timers WDT1, WDT2,..., WDTn, WDTtotal.
- Each of the watchdog timers WDT1, WDT2,..., WDTn, WDTtotal has a predetermined time (time period) set in advance independently.
- watchdog timers WDT1, WDT2,..., WDTn are prepared for each safety control function (in this description, there are n safety control functions, so there are n watchdog timers). ). Therefore, each specified time is determined corresponding to each safety control function.
- the independence assurance unit 36 starts the watchdog timers WDT1, WDT2,..., WDTn corresponding to each safety control function simultaneously with the start of calculation of each safety control function. Further, the independence assurance unit 36 activates the watchdog timer WDTtotal at the start of the computation in the safety control function that has been the earliest computation process in the plurality of safety control functions.
- the independence assurance unit 36 stops the watchdog timers WDT1, WDT2,..., WDTn corresponding to each safety control function at the end of calculation of each safety control function.
- the independence assurance unit 36 performs watchdog timer WDTtotal after completion of calculation of all safety control functions (in this description, after completion of n safety control functions), that is, after completion of calculation of the last safety control function. To stop.
- each watchdog timer WDT1, WDT2,..., WDTn, WDTtotal is set with a specified time.
- the independence assurance unit 36 exceeds the specified time for the processing time of the safety control function. Detect that. By this detection, the independence assurance unit 36 notifies the CPU 34 of the detection, and the elevator safety control device 25 resets itself (that is, the car 1 is stopped).
- the independence assurance unit 36 has exceeded the specified time set in the watchdog timers WDT1, WDT2,..., WDTn corresponding to the safety control function. It is monitored whether or not.
- the individual calculation processing time is a calculation required time for each safety control function.
- the independence assurance unit 36 detects that the individual computation processing time exceeds the specified time in any one of the safety control functions (that is, any one watchdog timer WDT1, WDT2,.
- the elevator safety control device 25 stops the car 1.
- the independence assurance unit 36 monitors whether or not the total calculation processing time of all safety control functions has exceeded a specified time set in the watchdog timer WDTtotal.
- the independence assurance unit 36 detects that the total computation processing time has exceeded the specified time (that is, when the watchdog timer WDTtotal has not been stopped within the specified time)
- the elevator safety control device 25 Stops the car 1.
- the independence assurance unit 36 monitors whether or not a failure of a certain safety control function affects other safety control functions by using the memory interference monitoring function and the execution time monitoring function.
- the safety control device 25 is surely stopped (that is, the car 1 is stopped).
- FIG. 6 is a diagram showing the relationship among the output buffer 36, the independent guarantee unit 36, and the output unit 38.
- the operation results of n safety control functions are captured in the output buffer 35.
- the independence assurance unit 36 there are as many control systems as the number of control targets in which a plurality of switches are connected in series.
- the hoisting machine 4 and the brake 6. Therefore, two such systems are provided in the independence assurance unit 36.
- switches SW11, SW12,..., SW1n are connected in series to one system. Further, switches SW21, SW22,..., SW2n are connected in series to the other system.
- a power supply Pw is connected to one end of one system and one end of the other system.
- the calculation result of the first safety control function is input from the output buffer 35 to the switches SW11 and SW21.
- the calculation result of the second safety control function is input from the output buffer 35 to the switches SW12 and SW22.
- the calculation result of the nth safety control function is input from the output buffer 35 to the switches SW1n and SW2n. Note that the output of one system is connected to the hoisting machine 4 via the output unit 38, and the output of the other system is connected to the brake 6 via the output unit 38.
- the calculation result of the safety control function is determined to be normal in the operation of the elevator (when it indicates the safety of the elevator)
- the calculation result is the switch SW11,..., SW1n. , SW21,..., SW2n, the switches SW11,..., SW1n, SW21,.
- the calculation result of the safety control function when it does not indicate the safety of the elevator, the calculation result indicates each switch SW11,..., SW1n, SW21. ,..., SW2n, the switches SW11,..., SW1n, SW21,.
- a calculation result determined to be abnormal in the operation of the elevator is referred to as an “error” calculation result.
- the elevator safety control device 25 Stops the car 1.
- switches SW11,..., SW1n, SW21,..., SW2n semiconductor switches such as transistors or MOS-FETs may be employed, or may be realized by an AND circuit (IC). It may be realized by software.
- supply / cut-off of the power supply P to the hoisting machine 4 and the brake 6 in the output part 38 is implement
- the elevator The safety control device 25 immediately stops the car 1. Specifically, the safety control device 25 notifies the drive control unit 24 of an immediate stop instruction, and the car 1 is immediately stopped by the control by the drive control unit 24. Note that the configuration in FIG. 6 is a configuration suitable for the immediate stop mode.
- the elevator safety control device 25 moves the car 1 from the position of the car 1 at the time of detection to the nearest floor, and stops the car 1 at the nearest floor. Specifically, the safety control device 25 notifies the drive control unit 24 of a nearest floor stop instruction for stopping the car 1 at the nearest floor, and the car 1 is moved to the nearest floor by the control by the drive control unit 24. Stop on the floor.
- the elevator safety control device 25 determines whether the car 1 has arrived at the nearest floor within a predetermined time after instructing the stop of the car 1 to the nearest floor (the nearest floor stop instruction). Determine whether.
- the elevator safety control device 25 detects that the car 1 does not arrive at the nearest floor within a predetermined time
- the elevator safety control device 25 immediately stops the car 1 after the predetermined time has elapsed. That is, the elevator safety control device 25 makes an emergency stop of the car 1 without arriving at the nearest floor.
- the safety control device 25 notifies the drive control unit 24 of an immediate stop instruction immediately after the predetermined time has elapsed, and the car 1 is immediately stopped by the control by the drive control unit 24.
- the elevator safety control device 25 includes a watchdog timer (not shown) that can set the predetermined time (time period). Various values can be set in the timer as the predetermined time.
- the elevator safety control device 25 estimates a predetermined time when the car 1 arrives at the nearest floor, and sets the estimated predetermined time with the watchdog timer.
- the elevator safety control device 25 starts the watchdog timer simultaneously with the nearest floor stop instruction. Then, it is assumed that a notification that the car 1 has stopped at the nearest floor is not notified to the watchdog timer within a predetermined time after the timer is started. In this case, the watchdog timer activates the function as the watchdog timer immediately after a predetermined time elapses, and the elevator safety control device 25 causes the car 1 to emergency stop by the operation.
- the CPU 34 calculates one predetermined safety control function (step S1).
- the independence assurance unit 36 monitors whether or not independence is ensured by the memory interference monitoring function (step S2).
- the CPU 34 is executing the predetermined safety control function, and whether or not the CPU 34 is accessing the memory 37 to an address other than the address for which the predetermined safety control function is permitted (that is, the memory
- the independence assurance unit 36 monitors the presence or absence of interference (step S2).
- step S2 the independence assurance unit 36 detects that there is memory interference (“Yes” in step S2).
- the elevator safety control device 25 stops the car 1 in any of the above-described modes (step S8).
- the independence assurance unit 36 determines that there is no memory interference (“No” in step S2). In this case, the independence assurance unit 36 makes a determination based on the operation of the execution time monitoring function (step S3).
- step S3 the independence assurance unit 36 determines whether or not the individual calculation processing time that is the calculation processing time of the predetermined safety control function has exceeded a specified time.
- the specified time is set in the watchdog timer WDTi corresponding to the predetermined safety control function.
- the independence assurance unit 36 detects that the calculation of the predetermined safety control function has not been completed within the specified time (“Yes” in step S3). In this case, the elevator safety control device 25 stops the car 1 in any of the above-described modes (step S8).
- step S3 the independence assurance unit 36 detects that the calculation of the predetermined safety control function has been completed within the specified time (“No” in step S3). In this case, the independence assurance unit 36 executes step S4.
- Step S2 and Step S3 When the independence of the predetermined safety control function is ensured in Step S2 and Step S3 (“No” in Step S2 and “No” in Step S3), the calculation result of the predetermined safety control function is output from the CPU 34 to the output buffer. Is output to 35.
- the power supply P is supplied to the hoisting machine 4 and the brake 6. That is, each switch SW11,..., SW1n, SW21,..., SW2n of the independence assurance unit 36 is in an ON state. In this situation, the independence assurance unit 36 monitors whether or not the calculation result of the predetermined safety control function taken into the output buffer 35 is a normal value (step S4).
- step S4 the independence assurance unit 36 detects that the calculation result is an error (result determined to be abnormal from the viewpoint of elevator safety) ("Yes” in step S4). This means that the switch of the independence assurance unit 36 corresponding to the output of the calculation result is turned off. In this case, the elevator safety control device 25 stops the car 1 in any of the above-described modes (step S8).
- the independence assurance unit 36 detects that the calculation result is normal (result determined to be normal from the viewpoint of elevator safety) (“No” in step S4).
- the elevator safety control device 25 determines whether or not the calculation execution of all installed safety control functions has been completed (step S5).
- step S5 If calculation of all safety control functions has not been completed (“No” in step S5), the elevator safety control device 25 selects one safety control function that has not been calculated, and the selected safety control function. For the control function, the operations after step S1 are repeatedly executed.
- step S5 when the calculation of all safety control functions is completed (“Yes” in step S5), the independence assurance unit 36 has exceeded the specified time for the total calculation processing time of all safety control functions. Is determined (step S6).
- the specified time is set in the watchdog timer WDTtotal.
- step S6 the independence assurance unit 36 detects that the calculation of all safety control functions has not been completed within the specified time (“Yes” in step S6). In this case, the elevator safety control device 25 stops the car 1 in any of the above-described modes (step S8).
- step S6 the independence assurance unit 36 detects that all the safety control function calculations have been completed within a specified time (“NO” in step S6). In this case, the normal operation of the elevator by the control drive unit 24 is continued (step S7).
- the independence assurance unit 36 individually determines whether or not the calculation result indicates an error (step S ⁇ b> 2). S4). However, the independence assurance unit 36 may determine whether or not any of the calculation results indicates an error after the calculation of all safety control functions.
- the elevator safety control device 25 is provided with the independence assurance unit 36 that ensures the independence of the safety control functions such as the memory interference monitoring function and the execution time monitoring function.
- the electronic elevator safety control device 25 provides a necessary safety control function. Therefore, a new safety control function can be additionally installed in the elevator safety control device 25 simply by adding the safety control function software, the sensor 31 and the switch 30.
- the independence assurance unit 36 performs the identification information indicating the type of the safety control function and the execution of the safety control function when executing the safety control function. Address information indicating an area of the memory 37 to be accessed is acquired from the CPU 34. Then, the independence assurance unit 36 compares the acquired information with the allocation table shown in FIG. 4 and monitors whether or not the memory 37 other than the area where each safety control function is permitted is accessed.
- the elevator safety control device 25 can easily realize the memory interference monitoring function by the independence assurance unit 36.
- the independence assurance unit 36 monitors whether or not the individual calculation processing time has exceeded the specified time. Further, the independence assurance unit 36 monitors whether or not the total calculation processing time exceeds a specified time.
- the elevator safety control device 25 can easily realize the execution time monitoring function by the independence assurance unit 36.
- the elevator safety control device 25 when the independence assurance unit 36 detects that the calculation result is an error in any one of the safety control functions, the elevator safety control device 25 Car 1 is stopped.
- the elevator safety control device 25 can ensure independence for the same output of a plurality of programs.
- the elevator safety control device 25 when it is detected that the calculation result of any safety control function indicates an error, or independence between the safety control functions is ensured. When it is detected that the vehicle cannot be operated, the elevator safety control device 25 immediately stops the car 1.
- the elevator safety control device 25 can immediately shift the elevator to a safe state.
- the elevator safety control device 25 when it is detected that the calculation result of any safety control function indicates an error, or independence between the safety control functions is ensured. When it detects that it is not possible, the elevator safety control device 25 stops the car 1 at the nearest floor.
- the elevator safety control device 25 can blame passengers from the nearest floor when the elevator is abnormal.
- the car 1 when the car 1 does not arrive at the nearest floor within a predetermined time, the car 1 can be stopped in an emergency state without arriving at the nearest floor. .
- the elevator safety control device 25 can ensure the safety of the car 1 toward the nearest floor.
- Embodiment 2 In this embodiment, another aspect of the memory interference monitoring function described in Embodiment 1 will be described. Therefore, configurations and operations other than the memory interference monitoring function (configurations and operations of the elevator apparatus 100 and the elevator safety control apparatus 25) are the same in the first embodiment and the second embodiment.
- FIG. 8 is a diagram for explaining the memory interference monitoring function of the independence assurance unit 36 according to the present embodiment.
- the memory 37 is divided for each address area in which access of each safety control function is permitted.
- the address area where the first safety control function is permitted to access is the first safety control function use permission area 37a.
- the address area where the second safety control function is permitted to access is the second safety control function use permission area 37b.
- the address area to which the nth safety control function is permitted to access is the nth safety control function use permission area 37n.
- the independence assurance unit 36 first calculates in advance error detection codes CRC1, CRC2,..., CRCn for each safety control function use permission area 37a, 37b,. . That is, the independence assurance unit 36 calculates the error detection codes CRC1, CRC2,..., CRCn before the execution of each safety control function.
- the error detection code calculated before execution of the calculation is referred to as a first error detection code.
- CRC Cyclic Redundancy Code
- the independence assurance unit 36 again returns the error detection codes CRC1 ′, CRC2 ′, and the like for each of the safety control function use permission areas 37a, 37b,. ... CRCn 'is calculated.
- the error detection code calculated after execution of the calculation is referred to as a second error detection code.
- the independence assurance unit 36 corresponds to the safety control function use permission areas 37a, 37b,..., 37n, and the first error detection codes CRC1, CRC2,. Error detection codes CRC1 ′, CRC2 ′,..., CRCn ′.
- the independence assurance unit 36 compares ', ..., CRCn' with each other. That is, the independence assurance unit 36 compares the first error detection code CRC1 and the second error detection code CRC1 ′, compares the second error detection code CRC2 and the second error detection code CRC2 ′, The first error detection code CRCn is compared with the second error detection code CRCn ′.
- the safety control function use permission areas 37a, 37b,..., 37n where the predetermined safety control function is not permitted.
- the error detection codes of the safety control function use permission areas 37a, 37b,..., 37n other than the permitted area change before and after the calculation of the safety control function.
- the independence assurance unit 36 performs second error detection codes CRC1 ′, CRC2 ′,... Different from the first error detection codes CRC1, CRC2,.
- the independence assurance unit 36 determines that there is memory interference.
- the elevator safety control device 25 stops the car 1 in any of the above-described manners (“Yes” in step S2 of FIG. 7). And step S8).
- the above operation is performed every time before and after the calculation of each safety control function.
- the completion of execution of the predetermined safety control function is detected by the independence assurance unit 36 that the process ID notified from the CPU 34 has been changed, or the watchdog timers WDT1, WDT2 corresponding to the respective safety control functions. ,..., WDTn measurement stop signal is detected by the independence assurance unit 36.
- the independence assurance unit 36 includes the first error detection code for each safety control function use permission area 37a, 37b,. CRCn, CRC2,..., CRCn and second error detection codes CRC1 ′, CRC2 ′,. That is, the independence assurance unit 36 according to the present embodiment monitors whether or not the memory 37 other than the area where each safety control function is permitted is accessed through the comparison process (memory interference monitoring function). ).
- the elevator safety control device 25 can easily realize the memory interference monitoring function by the independence assurance unit 36.
- CRC is used for the error detection code, but it goes without saying that the same effect can be obtained by using other error detection codes.
- each safety control function only monitors whether or not the address of the memory 37 other than the address for which access is permitted is accessed. That is, the memory interference monitoring function of the first embodiment is executed using the allocation table shown in FIG. 4, the process ID, and the address information.
- the memory interference monitoring function is executed using an allocation table to which access right information is added and “process ID, address information, access mode information”.
- the configuration and operation other than the memory interference monitoring function (configuration and operation of the elevator device 100 and the elevator safety control device 25) are the same in the first embodiment and the third embodiment.
- FIG. 9 is a diagram for explaining the memory interference monitoring function of the independence assurance unit 36 according to the present embodiment.
- FIG. 9 is a diagram illustrating an example of an allocation table according to the present embodiment.
- FIG. 9 The conversion between the real address and the logical address for the memory 37 is illustrated in FIG. That is, in the example of FIG. 9, a logical address when the CPU 34 accesses is described in association with each real address of the memory 37.
- the real addresses R1, R2, R3 are permitted to access the safety control function with the process ID “1”
- the real addresses R4, R5 , R6, R7 (logical addresses L4, L5, L6, L7) are permitted to access the safety control function whose process ID is “2”
- the real addresses R8, R9 (logical addresses L8, L9) are Access to the safety control function with the process ID “3” is permitted
- the real address Rmm (logical address Lmm) indicates that access to the safety control function with the process ID “n” is permitted.
- the real address R10 (logical address L10) indicates that access to any safety control function is prohibited.
- access right information is also added to the assignment table according to the present embodiment.
- access to the real address R1 (logical address L1) with the process ID “1” means that only the “read” access mode is permitted.
- the “write (write)” access mode to the real address R1 (logical address L1) having the process ID “1” is prohibited.
- access to the real address R4 (logical address L4) having the process ID “2” means that only the access mode “write” is permitted.
- the example of FIG. 9 means that the “read” access mode to the real address R4 (logical address L4) with the process ID “2” is prohibited.
- access to the real address Rmm (logical address Lmm) whose process ID is “n” means that both “rea” and “write” access modes are permitted. .
- the elevator safety control device 25 holds the assignment table shown in FIG. Then, the CPU 34 that is executing the predetermined safety control function accesses the memory 37 via the independence assurance unit 36 with a predetermined address and a predetermined access mode. As a result, the independence assurance unit 36 can acquire not only the “process ID and address information” described in the first embodiment but also the “access mode information” of the CUP 34 to the memory 37.
- the independence assurance unit 36 executes the memory interference monitoring function using the allocation table illustrated in FIG. 9 and the “process ID, address information, and address mode information” acquired from the CPU 34. . Specifically, the independence assurance unit 36 not only monitors whether or not the memory 37 outside the area where each safety control function is permitted, but also permits the safety control function. Whether the memory 37 is accessed in an access mode other than the access right is monitored.
- the independence assurance unit 36 detects access in an access mode different from the permitted access right information when accessing the address of the memory 37 for which a predetermined safety control function is permitted. In this case, the independence assurance unit 36 detects that there is memory interference. In this case, the elevator safety control device 25 stops the car 1 in any of the above-described modes (see “Yes” in step S2 and step S8 in FIG. 7).
- the independence assurance unit 36 detects an access to an address in the memory 37 other than the permitted address
- the predetermined safety control function is as described in the first embodiment.
- the independence assurance unit 36 detects an access mode to the memory 37 different from the access right information when executing a predetermined safety control function. Even at times, the elevator safety control device 25 stops the car 1.
- the elevator safety control device 25 according to the present embodiment can provide a memory interference monitoring function with higher accuracy than the elevator safety control device 25 according to the first embodiment.
- the elevator safety control device (safety control board) according to the present embodiment is different from the elevator safety control device 25 according to the first embodiment.
- the configuration of the entire elevator apparatus 100 is the same between the first embodiment and the fourth embodiment (see FIG. 1).
- the safety control board 25 is provided with one CPU 34, one independence assurance unit 36, and one memory 37.
- the safety control board is provided with two constituent groups including a CPU, an independence assurance unit, and a memory. That is, the configuration group is duplicated on the safety control board.
- FIG. 10 is a block diagram showing a configuration of the safety control device 25A according to the present embodiment.
- the elevator safety control device (safety control board) 25A includes a first configuration group (referred to as a first system) including a CPU 34g1, an independence assurance unit 36g1, and a memory 37g1, and a CPU 34g2.
- a second component group (referred to as a second system) composed of the independence assurance unit 36g2 and the memory 37g2 is provided.
- the operations of the CPUs 34g1 and 34g2, the independence assurance units 36g1 and 36g2, and the memories 37g1 and 37g2 are the same as those of the CPU 34, the independence assurance unit 36, and the memory 37 described in the first to third embodiments.
- the independence assurance units 36g1 and 36g2 also relate to the CPUs 34g1 and 34g2 and the memories 37g1 and 37g2, and the memory interference monitoring function and the execution time monitoring function described in the first to third embodiments, as well as the calculation results. An error detection operation or the like is executed.
- the independence assurance units 36g1 and 36g2 determine whether or not the programs executed between the two systems will be described later (executed program monitoring function).
- the independence assurance units 36g1 and 36g2 notify the CPUs 34g1 and 34g2 of the result of the execution program monitoring function.
- an intercomparison unit 40 is disposed on the safety control board 25A according to the present embodiment.
- the mutual comparison unit 40 compares the calculation result of the CPU 34g1 with the calculation result of the CPU 34g2.
- the input unit 32 is connected to the input buffer 33, and the input buffer 33 is connected to each of the CPUs 34g1 and 34g2.
- a mutual comparison unit 40 is disposed between the CPU 34g1 and the CPU 34g2. Both the CPUs 34g1 and 34g2 are connected to the output buffer 35.
- the CPU 34g1 is connected to the independence assurance unit 36g1, and the CPU 34g2 is connected to the independence assurance unit 36g2.
- Independence assurance unit 36g1 is connected to output buffer 35, memory 37g1, and output unit 38, respectively.
- the independence assurance unit 36g2 is connected to the output buffer 35, the memory 37g2, and the output unit 38, respectively.
- the input unit 32 is connected to external components (the switch 30 and the sensor 31) of the safety control board 25A, and the output unit 38 is connected to external components (the hoisting machine 4 and the brake 6) of the safety control board 25A. Each is connected.
- FIG. 11 is a block diagram showing a connection relationship between the independence assurance units 36g1 and 36g2, the CPUs 34g1 and 34g2, and the memories 37g1 and 37g2.
- the CPU 34g1 and the memory 37g1 are connected by a bus 39g1, and the independence assurance unit 36g1 and the independence assurance unit 36g2 are interposed in the bus 39g1.
- the CPU 34g2 and the memory 37g2 are connected by a bus 39g2, and the independence assurance unit 36g1 and the independence assurance unit 36g2 are interposed in the bus 39g2.
- the independence assurance unit 36g1, the CPU 34g1, and the CPU 34g2 are interconnected by a communication line 39gm. Further, the independence assurance unit 36g2, the CPU 34g1, and the CPU 34g2 are interconnected by a communication line 39gn.
- data such as various signals and information can be shared between the first system and the second system by providing buses 39g1 and 39g2 and signal lines 39gm and 39gn. That is, the CPU 34g1 and the independence assurance unit 36g1 in the first system can acquire not only data transmitted / received in the first system but also data transmitted / received in the second system. Similarly, the CPU 34g2 and the independence assurance unit 36g2 in the second system can acquire not only data transmitted / received in the second system but also data transmitted / received in the first system.
- the CPU 34g1 notifies the independence assurance unit 36g1 and the CPU 34g2 of the process ID of the safety control function currently being executed by the CPU 34g1 via the communication line 39gm.
- the CPU 34g2 notifies the independence assurance unit 36g2 and the CPU 34g1 of the process ID of the safety control function currently being executed in the CPU 34g2 via the communication line 39gn.
- the independence assurance unit 36g1 receives the determination result (for example, memory interference monitoring result / execution time monitoring result / execution program monitoring result) of the independence assurance unit 36g1 and various instructions (for example, reset processing instruction) on the signal line.
- the CPU 34g1 and 34g2 are notified through 39gm.
- the independence assurance unit 36g2 receives the determination result (for example, memory interference monitoring result / execution time monitoring result / execution program monitoring result) of the independence assurance unit 36g2 and various instructions (for example, reset processing instruction) on the signal line.
- the CPU 34g1 and 34g2 are notified through 39gn.
- the CPU 34g1 accesses a predetermined address in the memory 37g1 during the arithmetic processing of the safety control function. Then, data such as the arithmetic processing result of the CPU 34g1 is written to a predetermined address in the memory 37g1.
- the CPU 34g2 accesses a predetermined address in the memory 37g2 during the calculation process of the safety control function. Then, data such as the arithmetic processing result of the CPU 34g2 is written to a predetermined address in the memory 37g2.
- the independence assurance units 36g1 and 36g2 obtain the address information and data of the program calculated by the CPU 34g1 via the bus 39g1.
- the independence assurance units 36g1 and 36g2 obtain the program address information and data calculated by the CPU 34g2 via the bus 39g2.
- the independence assurance units 36g1 and 36g2 use the acquired address information and data to compare the address and data of the program currently being executed in the own system with the address and data of the program being executed in the other system. . That is, the independence assurance units 36g1 and 36g2 determine whether or not the program being executed in the own system and the program being executed in the other system match (executed program monitoring function).
- the independence assurance units 36g1 and 36g2 have detected a mismatch between the programs being executed between the CPUs 34g1 and 34g2 of both systems by the execution program monitoring function.
- the independence assurance units 36g1 and 36g2 notify the CPUs 34g1 and 34g2 belonging to the own system that the program being executed in the other system is different from the program being executed in the own system.
- the elevator safety control device 25A stops the car 1 in any of the modes described in the first embodiment.
- the CPU 34g1 and the CPU 34g2 basically execute arithmetic processing according to the same program at the same time. Then, each of the CPU 34 g 1 and the CPU 34 g 2 outputs a calculation result that is a result of the calculation processing to the mutual comparison unit 40.
- the mutual comparison unit 40 compares the received calculation results with each other. As described above, basically, the CPU 34g1 and the CPU 34g2 execute the same calculation process, so the calculation results received by the mutual comparison unit 40 are also the same. However, for some reason, it is assumed that the mutual comparison unit 40 detects a mismatch between the calculation results as a result of the comparison. In this case, the elevator safety control device 25A stops the car 1 in any of the modes described in the first embodiment.
- FIG. 12 is a flowchart showing the operation of the elevator safety control device 25A according to the present embodiment.
- the operation of the elevator safety control device 25A according to the present embodiment will be described with reference to 12.
- the CPU 34g1 and the CPU 34g2 each perform the same predetermined safety control function (step S11).
- the independence assurance units 36g1 and 36g2 monitor the matching / mismatching between the program executed in the own system and the program executed in the other system by the execution program monitoring function (step S12). ).
- step S12 the elevator safety control device 25A stops the car 1 in any of the above-described modes (step S20).
- both of the independence assurance units 36g1 and 36g2 determine that the programs being executed match ("NO" in step S12). In this case, the operation of the elevator safety control device 25A proceeds to step S13.
- step S13 the mutual comparison unit 40 compares the calculation results output from both the CPUs 34g1 and 34g2. It is assumed that the mutual comparison unit 40 detects a mismatch between the received calculation results (“Yes” in step S13). In this case, the elevator safety control device 25A stops the car 1 in any of the above-described modes (step S20).
- the mutual comparison unit 40 detects a match between the received calculation results (“No” in step S13). In this case, the elevator safety control device 25A shifts to the operation of the memory interference monitoring function.
- the independence assurance units 36g1 and 36g2 monitor whether or not the independence of the safety control function is ensured by the memory interference monitoring function (step S14).
- the operation in step S14 executed by each independence assurance unit 36g1, 36g2 is the same as the operation in step S2 in FIG.
- step S14 the elevator safety control device 25A stops the car 1 in any of the above-described modes (step S20).
- each of the independence assurance units 36g1 and 36g2 makes a determination based on the operation of the execution time monitoring function (step S15).
- step S15 each of the independence assurance units 36g1 and 36g2 determines whether or not the individual calculation processing time has exceeded a specified time.
- the operation in step S15 executed by each independence assurance unit 36g1, 36g2 is the same as the operation in step S3 in FIG.
- step S15 the elevator safety control device 25A stops the car 1 in any of the above-described modes (step S20).
- step S16 the independence assurance units 36g1 and 36g2 monitor whether or not the calculation result of the predetermined safety control function fetched in the output buffer 35 is a normal value.
- the operation in step S16 executed by each independence assurance unit 36g1, 36g2 is the same as the operation in step S4 in FIG.
- step S16 the elevator safety control device 25A stops the car 1 in any of the above-described modes (step S20).
- step S16 the independence assurance units 36g1 and 36g2 detect that the calculation result is normal (result determined to be normal from the viewpoint of elevator safety) ("No" in step S16). ). In this case, the elevator safety control device 25A determines whether or not the calculation execution of all installed safety control functions has been completed (step S17).
- step S17 If all the safety control functions have not been calculated (“No” in step S17), the elevator safety control device 25A selects one safety control function that has not been calculated, and the selected safety control function. The operations after step S11 are repeatedly executed.
- step S17 when all the safety control functions have been calculated (“Yes” in step S17), the independence assurance units 36g1 and 36g2 determine whether or not the total calculation processing time has exceeded the specified time. (Step S18).
- the operation in step S18 executed by each independence assurance unit 36g1, 36g2 is the same as the operation in step S6 in FIG.
- step S18 the elevator safety control device 25A stops the car 1 in any of the above-described modes (step S20).
- step S16 After the calculation of each safety control function is completed (steps S11 to S15), it is individually determined whether the calculation result indicates an error (step S16). However, after all the safety control functions have been calculated, it may be determined based on whether any of the calculation results indicates an error.
- the elevator safety control device 25A includes the execution program monitoring function processing in the independence assurance units 36g1 and 36g2 and the calculation result in the intercomparison unit 40 in addition to the series of operations in FIG. Match / mismatch determination processing is added.
- the independence assurance units 36g1 and 36g2 connect the signal lines 39gm and 39gn and the buses 39g1 and 39g2 to each other.
- a signal line is connected between the independence assurance units 36g1 and 39g2 and various data and signals can be transmitted and received between the independence assurance units 36g1 and 39g2. it can.
- the case where the configuration group including the CPU, the memory, and the independence assurance unit is duplicated has been described (the first system and the second system).
- a triple or higher configuration may be employed (a configuration having three or more systems is also possible). Even in this case, wiring connections that allow data and signals to be shared with each other are required between the systems, and the intercomparison unit 40 is connected to each CPU. Even in such a configuration, it goes without saying that the effect of improving the reliability of the elevator safety control system described in the present embodiment can be obtained.
Landscapes
- Engineering & Computer Science (AREA)
- Automation & Control Theory (AREA)
- Computer Networks & Wireless Communication (AREA)
- Maintenance And Inspection Apparatuses For Elevators (AREA)
- Indicating And Signalling Devices For Elevators (AREA)
Abstract
Description
図1は、本発明の実施の形態1に係るエレベータ装置100の構成を示す図である。図1において、かご1及び釣合おもり2は、懸架手段3により昇降路内に吊り下げられている。懸架手段3は、複数本のロープ又はベルトを含んでいる。
本実施の形態では、実施の形態1で説明したメモリ干渉監視機能の別の態様について説明する。したがって、当該メモリ干渉監視機能以外の構成・動作(エレベータ装置100やエレベータ安全制御装置25の構成・動作)は、実施の形態1と実施の形態2とで同様である。
実施の形態1のメモリ干渉監視機能では、各安全制御機能が、自身のアクセスが許可されているアドレス以外のメモリ37のアドレスへ、アクセスしているか否かを監視しているのみであった。つまり、実施の形態1のメモリ干渉監視機能は、図4に示す割り当て表と、プロセスIDおよびアドレス情報とを用いて、実行されていた。
本実施の形態に係るエレベータ安全制御装置(安全制御基板)は、実施の形態1に係るエレベータ安全制御装置25と異なる。エレベータ装置全体100の構成は、実施の形態1と実施の形態4とで同じである(図1参照)。
Claims (17)
- かご(1)の停止を制御するエレベータ安全制御装置(25)であって、
エレベータの状態に関する信号を、入力値として入力する入力部(32)と、
前記入力値を用いて、複数の安全制御機能に関する演算を各々独立したプログラムで実行することにより、前記エレベータの安全制御に関する演算を行うCPU(Central Processing Unit)(34)と、メモリ(37)とを含む論理部と、
前記安全制御機能間で影響を及ぼしあわない、前記安全制御機能の独立性を保証する独立性保証部(36)とを、備えており、
前記独立性保証部は、
各前記安全制御機能が許可された領域以外の前記メモリにアクセスしているか否かを監視することにより、前記安全制御機能の独立性を保証しており、
所定の前記安全制御機能による、許可された領域以外の前記メモリへのアクセスを、前記独立性保証部が検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とするエレベータ安全制御装置。 - 前記独立性保証部は、
前記安全制御機能による演算処理時間が、予め設定された規定時間(WDT1,WDT2,・・・,WTDn,WDTtotal)を超過したか否かを監視することにより、前記安全制御機能の独立性を保証しており、
前記独立性保証部が、前記演算処理時間が前記規定時間を越えたことを検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とする請求項1に記載のエレベータ安全制御装置。 - かご(1)の停止を制御するエレベータ安全制御装置(25)であって、
エレベータの状態に関する信号を、入力値として入力する入力部(32)と、
前記入力値を用いて、複数の安全制御機能に関する演算を各々独立したプログラムで実行することより、前記エレベータの安全制御に関する演算を行うCPU(Central Processing Unit)(34)を、含む論理部と、
前記安全制御機能間で影響を及ぼしあわない、前記安全制御機能の独立性を保証する独立性保証部(36)とを、備えており、
前記独立性保証部は、
前記安全制御機能による演算処理時間が、予め設定された規定時間(WDT1,WDT2,・・・,WTDn,WDTtotal)を超過したか否かを監視することにより、前記安全制御機能の独立性を保証しており、
前記独立性保証部が、前記演算処理時間が前記規定時間を越えたことを検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とするエレベータ安全制御装置。 - 前記論理部は、
複数であり、
各前記論理部は、
同じ演算処理を実施し、当該演算処理の結果である演算結果を出力し、
前記エレベータ安全制御装置は、
前記論理部から出力された前記演算結果同士を比較する相互比較部(40)を、さらに備えており、
前記相互比較部が、前記演算結果の不一致を検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とする請求項1または請求項3に記載のエレベータ安全制御装置。 - 一の前記論理部でのプログラムの実行と、他の前記論理部でのプログラムの実行とが、一致していないことを、前記独立性保証部が検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とする請求項4に記載のエレベータ安全制御装置。 - 前記エレベータ安全制御装置は、
前記各安全制御機能毎に、当該各安全制御機能がアクセスが許可されている前記メモリのアドレスを示すデータを、保持しており、
前記独立性保証部は、
(A-1)前記安全制御機能の実行の際に、当該安全制御機能の種別を示す識別情報と、当該安全制御機能の実行においてアクセスしようとしている前記メモリの領域を示すアドレス情報とを、前記CPUから取得し、
(A-2)前記(A-1)で取得した各情報と前記データとを比較することにより、各前記安全制御機能が許可された領域以外の前記メモリにアクセスしているか否かを監視する、
ことを特徴とする請求項1に記載のエレベータ安全制御装置。 - 前記データには、
所定の前記安全制御機能が前記メモリに対して許可されているアクセス態様を示す、アクセス権情報も含まれており、
前記独立性保証部が、前記所定の安全制御機能の実行の際に、前記所定の安全制御機能が許可されている前記アクセス権情報と異なる、前記メモリに対するアクセス態様を検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とする請求項6に記載のエレベータ安全制御装置。 - 前記メモリは、
前記安全制御機能に対応して、使用が許可されている領域が区分されており、
前記独立性保証部は、
(A-1)前記安全制御機能の実行前において、前記各領域毎に、第一の誤り検出符号(CRC1,CRC2,・・・,CRCn)を算出し、
(A-2)前記安全制御機能の実行後において、前記各領域毎に、第二の誤り検出符号(CRC1’,CRC2’,・・・,CRCn’)を算出し、
(A-3)前記各領域毎に、前記第一の誤り検出符号と前記第二の誤り検出符号を比較することにより、各前記安全制御機能が許可された領域以外の前記メモリにアクセスしているか否かを監視する、
ことを特徴とする請求項1に記載のエレベータ安全制御装置。 - 前記第一の誤り検出符号および前記第二の誤り検出符号は、
CRC(Cyclic Redundancy Code)である、
ことを特徴とする請求項8に記載のエレベータ安全制御装置。 - 前記独立性保証部は、
前記安全制御機能毎に、個別演算処理時間が前記規定時間(WDT1,WDT2,・・・,WTDn)を超過したか否かを、監視しており、
前記独立性保証部が、何れか一の前記安全制御機能において、前記個別演算処理時間が前記規定時間を越えたことを検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とする請求項3に記載のエレベータ安全制御装置。 - 前記独立性保証部は、
全前記安全制御機能のトータル演算処理時間が前記規定時間(WDTtotal)を超過したか否かを、監視しており、
前記独立性保証部が、前記トータル演算処理時間が前記規定時間を越えたことを検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とする請求項3に記載のエレベータ安全制御装置。 - 前記独立性保証部が、何れか一の前記安全制御機能において、前記安全制御機能の演算の結果がエラーであることを検出したとき、前記エレベータ安全制御装置は、
前記かごを停止させる、
ことを特徴とする請求項1または請求項3に記載のエレベータ安全制御装置。 - 前記エレベータ安全制御装置は、
前記かごを即時停止させる、
ことを特徴とする請求項1または請求項3に記載のエレベータ安全制御装置。 - 前記エレベータ安全制御装置は、
前記かごを最寄階に停止させる、
ことを特徴とする請求項1または請求項3に記載のエレベータ安全制御装置。 - エレベータ安全制御装置は、
所定の時間以内に、前記最寄階に前記かごが到着しないとき、前記最寄階に到着しない状態で前記かごを非常停止させる、
ことを特徴とする請求項14に記載のエレベータ安全制御装置。 - エレベータ安全制御装置は、
変更可能に前記所定の時間の設定ができるタイマを、さらに備えており、
前記タイマは、
前記独立性保証部の前記検出の動作に起因して測定を開始し、
エレベータ安全制御装置は、
前記タイマの前記測定の開始時から所定の時間経過後に、前記かごを非常停止させる、
ことを特徴とする請求項15に記載のエレベータ安全制御装置。 - 前記入力部、前記論理部および前記独立性保証部は、
一つの基板上に実装されている、
ことを特徴とする請求項1または請求項3に記載のエレベータ安全制御装置。
Priority Applications (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DE201011005384 DE112010005384T5 (de) | 2010-03-12 | 2010-03-12 | Aufzugsicherheitssteuerung |
US13/522,785 US9108823B2 (en) | 2010-03-12 | 2010-03-12 | Elevator safety control device |
CN201080064973.1A CN102781804B (zh) | 2010-03-12 | 2010-03-12 | 电梯安全控制装置 |
JP2012504248A JP5550718B2 (ja) | 2010-03-12 | 2010-03-12 | エレベータ安全制御装置 |
PCT/JP2010/054230 WO2011111223A1 (ja) | 2010-03-12 | 2010-03-12 | エレベータ安全制御装置 |
KR1020127022851A KR101366955B1 (ko) | 2010-03-12 | 2010-03-12 | 엘리베이터 안전 제어 장치 |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2010/054230 WO2011111223A1 (ja) | 2010-03-12 | 2010-03-12 | エレベータ安全制御装置 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2011111223A1 true WO2011111223A1 (ja) | 2011-09-15 |
Family
ID=44563065
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2010/054230 WO2011111223A1 (ja) | 2010-03-12 | 2010-03-12 | エレベータ安全制御装置 |
Country Status (6)
Country | Link |
---|---|
US (1) | US9108823B2 (ja) |
JP (1) | JP5550718B2 (ja) |
KR (1) | KR101366955B1 (ja) |
CN (1) | CN102781804B (ja) |
DE (1) | DE112010005384T5 (ja) |
WO (1) | WO2011111223A1 (ja) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2015033462A1 (ja) * | 2013-09-09 | 2015-03-12 | 株式会社日立製作所 | エレベータ装置 |
WO2019163133A1 (ja) * | 2018-02-26 | 2019-08-29 | 三菱電機株式会社 | エレベータ安全制御装置 |
Families Citing this family (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPWO2010150341A1 (ja) * | 2009-06-22 | 2012-12-06 | 三菱電機株式会社 | エレベータ装置 |
EP2452907A1 (en) * | 2010-11-11 | 2012-05-16 | Inventio AG | Elevator Safety Circuit |
FI122473B (fi) * | 2010-12-14 | 2012-02-15 | Kone Corp | Liitäntäyksikkö, kuljetusjärjestelmä sekä menetelmä |
JP6271948B2 (ja) * | 2013-10-30 | 2018-01-31 | 株式会社日立製作所 | プーリ溝診断装置付きエレベータ |
CN106132861B (zh) * | 2014-04-09 | 2019-09-17 | 三菱电机株式会社 | 电梯装置 |
JP6322563B2 (ja) * | 2014-12-22 | 2018-05-09 | 株式会社日立製作所 | エレベータ制御装置およびエレベータ制御方法 |
ES2659789T3 (es) * | 2015-10-08 | 2018-03-19 | Kone Corporation | Método para controlar un ascensor |
EP3178768A1 (en) | 2015-12-07 | 2017-06-14 | Kone Corporation | Drive device |
WO2017103968A1 (ja) * | 2015-12-14 | 2017-06-22 | 三菱電機株式会社 | エレベーターの制御装置 |
CN107473061B (zh) | 2016-06-08 | 2020-10-16 | 奥的斯电梯公司 | 升降电梯***的维护安全装置及其操作方法 |
AU2018298657B2 (en) * | 2017-07-14 | 2021-07-01 | Inventio Ag | Method for configuring security related configuration parameters in a passenger transport installation |
EP3511280B1 (en) * | 2018-01-11 | 2022-08-24 | Otis Elevator Company | Rescue operation in an elevator system |
JP7003217B2 (ja) * | 2018-03-05 | 2022-01-20 | 三菱電機株式会社 | エレベーター安全制御装置 |
DE102019212726A1 (de) * | 2019-08-26 | 2021-03-04 | Thyssenkrupp Elevator Innovation And Operations Ag | Aufzugsanlage die einen Fahrkorb abhängig von einem Schließzustandssignal und einer Position des Fahrkorbs in einen Sicherheitsbetriebszustand überführt |
EP3960673A1 (en) * | 2020-08-27 | 2022-03-02 | Otis Elevator Company | Elevator systems |
CN112744655B (zh) * | 2020-12-29 | 2022-12-16 | 辽宁三洋电梯制造有限公司 | 一种垂直电梯安全装置检测机器人 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH02276784A (ja) * | 1989-04-18 | 1990-11-13 | Mitsubishi Electric Corp | エレベータの制御装置 |
WO2005115898A1 (ja) * | 2004-05-25 | 2005-12-08 | Mitsubishi Denki Kabushiki Kaisha | エレベータ制御装置 |
WO2007057973A1 (ja) * | 2005-11-21 | 2007-05-24 | Mitsubishi Denki Kabushiki Kaisha | エレベータのブレーキシステム |
WO2009157085A1 (ja) * | 2008-06-27 | 2009-12-30 | 三菱電機株式会社 | エレベータ装置及びその運転方法 |
Family Cites Families (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPS55106976A (en) * | 1979-02-02 | 1980-08-16 | Hitachi Ltd | Controller for elevator |
JPS5699183A (en) * | 1980-01-07 | 1981-08-10 | Hitachi Ltd | Method of controlling elevator |
JPS58144071A (ja) * | 1982-02-23 | 1983-08-27 | 三菱電機株式会社 | エレベ−タの制御装置 |
US5387769A (en) * | 1993-06-01 | 1995-02-07 | Otis Elevator Company | Local area network between an elevator system building controller, group controller and car controller, using redundant communication links |
US6286628B1 (en) * | 1999-01-28 | 2001-09-11 | Lg Otis Elevator Company | Non-linear load detection and compensation for elevators |
CN1354935A (zh) | 1999-02-26 | 2002-06-19 | 奥廷提戴特控股有限公司 | 包括安全文件标记的数字文件管理和成像***及方法 |
US6173814B1 (en) * | 1999-03-04 | 2001-01-16 | Otis Elevator Company | Electronic safety system for elevators having a dual redundant safety bus |
DE19927657A1 (de) | 1999-06-17 | 2001-01-04 | Daimler Chrysler Ag | Partitionierung und Überwachung von softwaregesteuerten Systemen |
JP4522548B2 (ja) * | 2000-03-10 | 2010-08-11 | 富士通フロンテック株式会社 | アクセス監視装置及びアクセス監視方法 |
JP2002091826A (ja) | 2000-09-13 | 2002-03-29 | Fuji Xerox Co Ltd | 情報処理装置 |
JP4204299B2 (ja) | 2002-10-18 | 2009-01-07 | 東芝エレベータ株式会社 | エレベータの制御装置 |
JPWO2005080249A1 (ja) * | 2004-02-25 | 2007-08-30 | 三菱電機株式会社 | エレベータの制御装置及びエレベータの制御方法 |
CN100475679C (zh) * | 2004-03-01 | 2009-04-08 | 三菱电机株式会社 | 电梯监视用终端和电梯监视装置 |
WO2006090470A1 (ja) | 2005-02-25 | 2006-08-31 | Mitsubishi Denki Kabushiki Kaisha | エレベータ装置 |
JP5025933B2 (ja) * | 2005-09-27 | 2012-09-12 | 三菱電機株式会社 | エレベータ制御装置及びエレベータの運転方法 |
JP2007254036A (ja) * | 2006-03-20 | 2007-10-04 | Toshiba Elevator Co Ltd | エレベータの運転制御装置 |
FI119508B (fi) * | 2007-04-03 | 2008-12-15 | Kone Corp | Vikaturvallinen tehonohjauslaitteisto |
US8267224B2 (en) * | 2007-07-17 | 2012-09-18 | Inventio Ag | Special operating mode for stopping an elevator car |
EP2322463A1 (de) * | 2009-11-12 | 2011-05-18 | Inventio AG | Aufzuganlage |
-
2010
- 2010-03-12 CN CN201080064973.1A patent/CN102781804B/zh active Active
- 2010-03-12 DE DE201011005384 patent/DE112010005384T5/de active Pending
- 2010-03-12 JP JP2012504248A patent/JP5550718B2/ja active Active
- 2010-03-12 US US13/522,785 patent/US9108823B2/en active Active
- 2010-03-12 KR KR1020127022851A patent/KR101366955B1/ko active IP Right Grant
- 2010-03-12 WO PCT/JP2010/054230 patent/WO2011111223A1/ja active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH02276784A (ja) * | 1989-04-18 | 1990-11-13 | Mitsubishi Electric Corp | エレベータの制御装置 |
WO2005115898A1 (ja) * | 2004-05-25 | 2005-12-08 | Mitsubishi Denki Kabushiki Kaisha | エレベータ制御装置 |
WO2007057973A1 (ja) * | 2005-11-21 | 2007-05-24 | Mitsubishi Denki Kabushiki Kaisha | エレベータのブレーキシステム |
WO2009157085A1 (ja) * | 2008-06-27 | 2009-12-30 | 三菱電機株式会社 | エレベータ装置及びその運転方法 |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2015033462A1 (ja) * | 2013-09-09 | 2015-03-12 | 株式会社日立製作所 | エレベータ装置 |
JP6027686B2 (ja) * | 2013-09-09 | 2016-11-16 | 株式会社日立製作所 | エレベータ装置 |
WO2019163133A1 (ja) * | 2018-02-26 | 2019-08-29 | 三菱電機株式会社 | エレベータ安全制御装置 |
JPWO2019163133A1 (ja) * | 2018-02-26 | 2020-07-30 | 三菱電機株式会社 | エレベータ安全制御装置 |
Also Published As
Publication number | Publication date |
---|---|
JPWO2011111223A1 (ja) | 2013-06-27 |
KR20120118058A (ko) | 2012-10-25 |
CN102781804B (zh) | 2014-09-17 |
JP5550718B2 (ja) | 2014-07-16 |
DE112010005384T5 (de) | 2012-12-27 |
US20120292136A1 (en) | 2012-11-22 |
CN102781804A (zh) | 2012-11-14 |
US9108823B2 (en) | 2015-08-18 |
KR101366955B1 (ko) | 2014-02-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP5550718B2 (ja) | エレベータ安全制御装置 | |
KR101121826B1 (ko) | 엘리베이터 장치 | |
JP5312571B2 (ja) | エレベータ装置 | |
WO2006106575A1 (ja) | エレベータ装置 | |
JP5624845B2 (ja) | 電子安全エレベータ | |
CN107922151B (zh) | 电梯装置 | |
JP5404787B2 (ja) | エレベータ装置 | |
JP2006298538A (ja) | エレベータ装置 | |
WO2017008849A1 (en) | Elevator control system | |
JP5355543B2 (ja) | エレベータ装置 | |
JP6207961B2 (ja) | エレベータの安全システム | |
US20170320703A1 (en) | Method and apparatus for commissioning an elevator installation | |
JP5492732B2 (ja) | 電子安全エレベータ | |
WO2021005656A1 (ja) | エレベータの戸開走行保護装置の試験方法、並びにエレベータの戸開走行保護装置 | |
JP5611937B2 (ja) | エレベータ装置 | |
JP6230729B2 (ja) | エレベータ安全制御装置およびエレベータ安全制御方法 | |
JP2005343602A (ja) | エレベータ制御装置 | |
JP2009091101A (ja) | エレベータのエミュレーション装置 | |
WO2019163133A1 (ja) | エレベータ安全制御装置 | |
JP2014169190A (ja) | エレベータ装置 | |
KR20080110689A (ko) | 엘리베이터 장치 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 201080064973.1 Country of ref document: CN |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 10847453 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2012504248 Country of ref document: JP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 13522785 Country of ref document: US |
|
ENP | Entry into the national phase |
Ref document number: 20127022851 Country of ref document: KR Kind code of ref document: A |
|
WWE | Wipo information: entry into national phase |
Ref document number: 1120100053847 Country of ref document: DE Ref document number: 112010005384 Country of ref document: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 10847453 Country of ref document: EP Kind code of ref document: A1 |