WO2019163133A1 - Elevator safety control device - Google Patents

Abstract

An elevator safety control device can execute a plurality of functions by multitasking, aborts the execution of a self-diagnosis function task when an abnormality is detected by a safety control function or the self-diagnosis function, and executes a safety transition process corresponding to the detected abnormality within an execution time frame for the aborted task. In addition, when a new abnormality is detected during execution of the safety transition process and the priority of the safety transition process is lower than the priority of the safety transition process corresponding to the newly detected abnormality, the execution of the safety transition process is interrupted and the safety transition process corresponding to the newly detected abnormality is executed.

Description

Elevator safety control device

The present invention relates to an elevator safety control device, and more particularly to an elevator safety control device that provides a plurality of safety control functions.

In the conventional elevator safety control device, when providing a plurality of safety control functions, it is necessary to prepare as many devices or boards as the number of safety control functions. For example, in Patent Document 1, each device is formed with a logic unit including a CPU (Central Processing Unit) and a memory.

In the technology according to Patent Document 1, a monitoring board as a monitoring unit that monitors the position and speed of an elevator car and a brake control board as a brake control unit that controls the brake device when performing a second braking operation are provided. ing. In other words, the technology according to Patent Document 1 has two safety control functions, and the same number of devices or substrates on which the logic unit is formed are provided as the number of safety control functions.

International Publication No. 2007/057973

In the technique according to Patent Document 1, the number of devices or substrates required for the number of safety control functions is increased, which increases the cost. However, simply implementing multiple safety control functions on a single device or board will interrupt the execution of other safety control functions when an abnormality is detected by a certain safety control function and a safety transition process is executed. This may cause inconvenience in the safety control of the entire elevator. In other words, the independence of a plurality of safety control functions cannot be guaranteed.

The present invention is intended to solve the above-described problems, and an object thereof is to provide an elevator safety control device that can guarantee the independence of a plurality of safety control functions.

In order to achieve the above object, an elevator safety control device according to the present invention is an elevator safety control device capable of performing a plurality of functions in a multitasking manner, and an arithmetic processing unit that repeatedly executes processing at a constant cycle; A scheduler for assigning task execution time to the arithmetic processing unit in each cycle, and the plurality of functions executed by the arithmetic processing unit are a first group including a safety control function and a second group including a self-diagnosis function. The scheduler is classified into a third group including a group and a non-safety control function, and the scheduler allocates an execution time to each task of at least one function from the first group and the second group in each cycle, and assigns the execution time to the third group. The remaining execution time is allocated to the tasks of the included functions, and the arithmetic processing unit detects abnormalities using the safety control function or self-diagnosis function. Is the case was interrupts the execution of the function of the tasks included in the second group, to execute the interrupted execution time frame is detected by the abnormality corresponding safety migration processing tasks.

In the elevator safety control device according to the present invention, a plurality of functions can be executed by multitasking. The plurality of functions includes a first group including a safety control function, a second group including a self-diagnosis function, and non-safety control. When the abnormality is detected by the safety control function or the self-diagnosis function, the execution of the task of the function included in the second group is suspended and the suspended task By executing the safety transition process corresponding to the detected abnormality in the execution time frame, independence of a plurality of safety control functions can be ensured.

It is a figure which shows the structure of the elevator which concerns on Embodiment 1 of this invention. It is a figure which shows the hardware constitutions of the elevator safety control apparatus which concerns on Embodiment 1 of this invention. It is a figure which shows the function structure of the elevator safety control apparatus which concerns on Embodiment 1 of this invention. It is a flowchart explaining the safe transition process which concerns on Embodiment 1 of this invention. It is a figure which shows the 1st example of the scheduling which concerns on Embodiment 1 of this invention. It is a figure which shows the 2nd example of the scheduling which concerns on Embodiment 1 of this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the following embodiments are merely examples, and the present invention is not limited to these embodiments.

Embodiment 1 FIG.
FIG. 1 is a diagram showing a configuration of an elevator apparatus 100 according to Embodiment 1 of the present invention. In FIG. 1, a car 1 and a counterweight 2 are suspended in a hoistway by suspension means 3. The suspension means 3 includes a plurality of ropes or belts.

A hoisting machine 4 for raising and lowering the car 1 and the counterweight 2 is installed in the lower part of the hoistway. The hoisting machine 4 includes a driving sheave 5 around which the suspension means 3 is wound, a hoisting machine motor (not shown) that generates driving torque to rotate the driving sheave 5, and a driving sheave that generates braking torque. The hoisting machine brake 6 as a braking means for braking the rotation of the hoisting machine 5 and the hoisting machine encoder 7 for generating a signal corresponding to the rotation of the driving sheave 5 are provided.

As the hoisting machine brake 6, for example, an electromagnetic brake device is used. At the time of braking by the electromagnetic brake device, the brake shoe is pressed against the braking surface by the spring force of the braking spring, the rotation of the drive sheave 5 is braked, and the car 1 is braked. Further, when braking is released by the electromagnetic brake device, the brake shoe is separated from the braking surface by exciting the electromagnetic magnet, and the braking force is released. In addition, the braking force applied by the hoisting machine brake 6 changes according to the current value that flows through the brake coil of the electromagnetic magnet.

The car 1 is provided with a pair of car suspension wheels 8a and 8b. The counterweight 2 is provided with a counterweight suspension vehicle 9. A car return wheel 10a, 10b and a counterweight return wheel 11 are provided at the upper part of the hoistway. One end of the suspension means 3 is connected to a first rope stop 12a provided at the upper part of the hoistway. The other end of the suspension means 3 is connected to a second rope stop 12b provided at the upper part of the hoistway.

The suspension means 3 is wound around the car suspension cars 8a and 8b, the car return cars 10a and 10b, the drive sheave 5, the counterweight return car 11 and the counterweight suspension car 9 in this order from one end side. That is, the car 1 and the counterweight 2 are suspended in the hoistway by the “2: 1 roping method”.

A governor 14 is installed at the top of the hoistway. The governor 14 includes a governor sheave 15 and a governor encoder 16 that generates a signal corresponding to the rotation of the governor sheave 15. A governor rope 17 is wound around the governor sheave 15. Both ends of the governor rope 17 are connected to an operation lever (not shown) of an emergency stop device mounted on the car 1. The lower end portion of the governor rope 17 is wound around a tension wheel 18 disposed at the lower part of the hoistway. When the car 1 is raised and lowered, the governor rope 17 is circulated, and the governor sheave 15 is rotated at a rotational speed corresponding to the traveling speed of the car 1.

An upper reference position switch 19a for detecting the position of the car 1 is provided in the upper part of the hoistway. A lower reference position switch 19b for detecting the position of the car 1 is provided at the lower part in the hoistway. The car 1 is provided with a switch operating member for operating the reference position switches 19a and 19b, for example, a cam.

A car door switch 20 is provided on the car 1 to detect opening / closing of the car door. The landing on each floor is provided with a landing door switch (not shown) for detecting opening / closing of the landing door. Further, the hoistway is provided with a plurality of floor matching plates 21a to 21c for detecting a position where the passenger can safely enter and exit the car 1, that is, the position of the car 1 in the door zone. The car 1 is provided with a floor alignment sensor 22 for detecting the floor alignment plates 21a to 21c.

The hoisting machine encoder 7, the governor encoder 16, the reference position switches 19a and 19b, the car door switch 20, the landing door switch (not shown), and the floor matching sensor 22 generate signals corresponding to the state of the car 1, respectively. Sensor.

A control panel 23 is installed in the hoistway. In the control panel 23, a drive control unit 24, which is an operation control unit, and an elevator safety control device 25 are provided. The elevator safety control device 25 can control the stop of the car 1.

In the elevator system, in order to ensure safety, the system is monitored and controlled from a plurality of viewpoints. Therefore, a plurality of safety control functions are implemented in the elevator safety control device 25 in order to perform each monitoring / control. That is, safety control from a plurality of viewpoints of the elevator apparatus is realized by the elevator safety control apparatus 25 executing calculations related to a plurality of safety control functions with separate independent programs. Specific examples of the safety control function include a door open travel protection function, an overspeed monitoring function, a maintenance switching function, and a safety communication function.

The drive control unit 24 controls the operation of the hoisting machine 4, that is, the operation of the car 1. The drive control unit 24 controls the traveling speed of the car 1 based on a signal from the hoisting machine encoder 7.

The door-opening travel protection function determines whether the car 1 is in the landing position based on the signal from the floor alignment sensor 22. The door-open travel protection function determines whether the car door and the landing door are open or closed based on signals from the car door switch 20 and a landing door switch (not shown). Further, the door-opening travel protection function determines whether or not the car 1 is traveling based on a signal from the hoisting machine encoder 7.

In addition, the door-opening travel protection function includes a state in which at least one of the car door or the landing door is open and the car 1 is traveling even though the car 1 is not at the landing position. Nevertheless, it detects a state in which at least one of the car door and the landing door is open, and outputs a brake operation command. That is, when the door-open travel protection function detects the door-open travel state, the drive sheave 5 is braked by the hoisting machine brake 6 and the hoisting machine motor is stopped to forcibly stop the car 1.

Signals from the governor encoder 16 and the reference position switches 19a and 19b are input to an overspeed monitoring function which is one of safety control functions. The overspeed monitoring function obtains the position and speed of the car 1 independently of the drive control unit 24 based on signals from the governor encoder 16 and the reference position switches 19a and 19b, and the speed of the car 1 is predetermined. Monitor whether the overspeed level is reached.

Note that the overspeed level is set as an overspeed monitoring pattern that changes according to the position of the car 1. When the speed of the car 1 reaches the overspeed level, the overspeed monitoring function brakes the drive sheave 5 by the hoisting machine brake 6 and stops the hoisting machine motor to forcibly stop the car 1.

The maintenance switching function disables automatic operation when it detects that maintenance personnel have entered the hoistway for inspection by detecting the operation of the switch that detects the opening of the inspection door or the assembly of the handrail of the car. Turn into. In addition, when an overshoot is detected by a position switch provided at the restriction position in the hoistway, the car 1 is stopped, thereby restricting the ascending / descending stroke during the inspection operation. The return to the automatic operation is performed by a reset switch provided outside the hoistway.

The drive control unit 24 and the elevator safety control device 25 each have an independent microcomputer. The function in the drive control part 24 and the function in the elevator safety control apparatus 25 are implement | achieved by these microcomputers. It should be noted that various safety control functions implemented in the elevator safety control device 25, that is, calculations such as a door-opening travel protection function and an overspeed monitoring function are executed by independent programs. In addition, maintenance functions such as log collection and non-safety functions such as operation control such as allocation response to calls are also executed.

In the present application, a name different from “elevator safety control device” or “safety control board” is used for the elevator safety control device 25, but both are the same.

In the above configuration, a single elevator safety control device 25 is equipped with a plurality of safety control functions. However, as described above, when a plurality of safety control functions are simply implemented in one elevator safety control device 25, when an abnormality is detected by a certain safety control function and a safety transition process is executed, Execution of the safety control function is interrupted, which may cause inconvenience in the safety control of the entire elevator. In other words, the independence of each safety control function cannot be guaranteed. Therefore, it is necessary to guarantee the independence of a plurality of safety control functions so that each safety control function does not affect other safety control functions.

In the present invention, the task scheduling function using time partitioning allocates execution time to each of the tasks of the plurality of safety control functions, and executes the plurality of safety control functions in a multitask, thereby making it possible to make the plurality of safety control functions independent. Guarantee sex.

FIG. 2 shows a hardware configuration of the elevator safety control device 25. The elevator safety control device 25 includes an I / O, that is, an input / output unit 30, a CPU 31, a ROM 32 of a nonvolatile memory, a RAM 33 of a volatile memory, a first timer 34 and a second timer 35, and memory protection. And a unit 36. In other words, the input / output unit 30, the CPU 31, the ROM 32, the RAM 33, the first timer 34 and the second timer 35, and the memory protection unit 36 are mounted on one safety control board 25. ing.

The ROM 32 stores a plurality of programs that respectively execute a safety control function and a non-safety control function. The CPU 31 reads out the program from the ROM 32, develops it on the RAM 33, and executes the program while storing temporary data in the RAM 33.

In FIG. 2, the input / output unit 30 is connected to each external component (not shown) of the safety control board 25.

The input / output unit 30 receives a signal related to the state of the elevator. As described above, there are various switches 19a and 19b for monitoring and detecting the state of the elevator. Similarly, various sensors including the governor encoder 16 exist for monitoring and detecting the state of the elevator. Signals from these switches and sensors, that is, signals relating to the state of the car 1 are input to the input / output unit 30.

Also, the input / output unit 30 counts and digitizes pulse signals including encoder signals. The input / output unit 30 also compares the duplicated input signals and compares the input signal with a signal from a reference sensor (not shown). If a mismatch is detected as a result of the comparison at the input / output unit 30, a message to that effect is sent to the CPU 31 constituting the logic unit.

CPU31 reads the signal from a sensor and a switch as an input value via the input-output part 30, and performs the calculation required for several safety control regarding an elevator. That is, the CPU 31 executes calculations related to a plurality of safety control functions by independent programs based on input values from the sensors and switches. Thereby, the safety control of an elevator is implement | achieved.

Note that these configurations can be multiplexed, and a failure can be detected by comparing each system.

Also, the input signal can be acquired via the network. In this case, in order to detect an abnormality in the network, a check by a transmission / reception address, a sequence number, an error detection code, a reception monitoring timer (not shown), etc. is performed in the program. In the present invention, these processes are classified into safety communication functions.

In the elevator safety control device 25, the CPU 31 repeatedly executes processing at a constant cycle. The task execution time is assigned to the CPU 31 in each cycle by the scheduler 37 (see FIG. 3). The scheduler 37 according to this embodiment is implemented by software.

The scheduler 37 manages the functions executed by the CPU 31 in three groups. The first group includes various safety control functions including the safety communication function described above. The second group includes self-diagnosis functions and safety transition processing. The third group includes other non-safety control functions. In FIG. 3, the safety control function, the self-diagnosis function, the safety transition process, and the non-safety control function are shown as a safety control program 41, a self-diagnosis program 42, a safety transition program 43, and a non-safety control program 44, respectively.

In each cycle, the scheduler 37 assigns the execution time of the CPU 31 with priority over the tasks of the functions included in the first and second groups, and assigns the remaining execution time to the tasks of the functions included in the third group. . Therefore, depending on the situation, the execution time may not be assigned to the task of the function included in the third group.

The safety scheduling information 51 stores the execution order and prescribed times of various safety control functions included in the first group. Based on the safety scheduling information 51, the scheduler 37 assigns execution times to various safety control function tasks.

The safety transition scheduling information 52 stores various self-diagnostic functions included in the second group and the execution order and specified time of the safety transition processing. Based on the safe transition scheduling information 52, the scheduler 37 assigns execution times to various self-diagnosis functions and safety transition processing tasks.

The non-safety scheduling information 53 stores the execution order and specified time of various non-safety control functions included in the third group. Based on the non-safety scheduling information 53, the scheduler 37 assigns execution time to various non-safety control function tasks.

When the execution of a task of a certain safety control function is started in a certain cycle according to the assignment of the scheduler 37, the execution time of the task is monitored by the first timer 34 set at the specified time of the safety control function. The monitoring time of the first timer 34 is variable and is set for each function. As the first timer 34, for example, a watchdog timer with a variable time window can be used.

When the execution of the task of the safety control function ends normally, the task switching process, that is, the execution state of the functional task is saved and the execution state of the next functional task is saved within the specified time of the first timer 34. The returning process is performed, and the execution of the task of the next safety control function is started according to the scheduling by the scheduler 37.

When the execution of the task of the safety control function included in the first group assigned in a certain cycle is finished, the execution of the task of the self-diagnosis function included in the second group is started. At this time, also in the case of the self-diagnosis function, the task execution time is monitored by the first timer 34 set to the specified time, as in the case of the safety control function.

When the first timer 34 detects that the specified time is exceeded, execution of the task of the safety control function or the self-diagnosis function is interrupted. In addition, when execution is interrupted a predetermined number of times, a corresponding safety transition process is executed.

When the execution of the task of the self-diagnosis function included in the second group is completed, the execution of the task of the non-safety control function included in the third group according to the scheduling determined by the scheduler 37 based on the non-safety scheduling information 53 Is started. However, at this time, the execution time is not monitored by the first timer 34.

Further, the CPU 31 monitors the execution time of the entire cycle by the second timer 35. The monitoring time of the second timer 35 is fixed and is set according to the cycle time. For example, a watchdog timer with a fixed time window can be used as the second timer.

When the second timer 35 detects that the cycle time has been exceeded by the safety control function task, the corresponding safety transition process is executed. In addition, when the second timer 35 detects that the cycle time is exceeded by the task of the non-safety control function, the execution of the task is interrupted and the next cycle is started.

Further, when the excess of the cycle time due to the safety transition process is detected, the CPU 31 immediately stops the hoisting machine 4 and operates the brake.

In addition, during execution of a task of a certain function, access to a memory area used by a task of another function, that is, reading from the memory and writing to the memory are restricted by the memory protection unit 36. Each function has a memory range that can be accessed in advance. When an attempt is made to access beyond that range, the memory protection unit 36 detects a memory access violation.

Also, direct access is prohibited for input / output, and the same protection is implemented via the input / output memory. When a memory access violation is detected, for example, a “safety floor stop” safety transition process is executed.

(Safe transition process)
Next, details of the safety transition process in the elevator safety control device 25 according to the first embodiment of the present invention will be described. In the ROM 32 of the elevator safety control device 25, a plurality of safety transition processing execution programs corresponding to the type of abnormality of the elevator, that is, a safety transition program 43, and a safety transition priority 54 that determines the priority of each safety transition process. And are stored.

CPU31, for example, when the position information of the overspeed monitoring function is lost due to a sensor failure or the like, as a safety transition process, the CPU 31 performs “speed limit” that limits the maximum speed over the entire process.

In addition, when a minor calculation abnormality such as the above-mentioned memory access violation is detected, the CPU 31 instructs the drive device to stop to the nearest floor as a safety transition process and completely stops the car 1 after a certain time. Execute “Nearest floor stop”.

The CPU 31 immediately stops the hoisting machine 4 and activates the brake as a safety transition process when a serious abnormality such as the above-mentioned specified time excess, cycle time excess, or door-opening travel is detected. “Stop”.

In this case, the priority of the safety transition process is "Emergency stop", "Nearest floor stop", "Speed limit". In addition, when a safe transition process is necessary, priority can be determined by adding as appropriate.

FIG. 4 shows a flowchart of the safety transition process in the elevator safety control device 25.

During the execution of the periodic processing in the elevator safety control device 25, the task of the safety control function or the task of the self-diagnosis function is an abnormality of the elevator or the safety control function itself or the safety control device 25 itself. Check (step S1). If no abnormality is detected (step S1 = No), the process is executed as scheduled.

If an abnormality is detected in step S1 (step S1 = Yes), execution of the task of the self-diagnosis function scheduled in advance is interrupted, that is, excluded from the schedule (step S2), and the abnormality detected this time in that time frame is detected. A corresponding safety transition process is executed (step S3). If the time required for the safety transition process is short and the execution time of both the safety transition process and the self-diagnosis function can be secured, the execution of the self-diagnosis function task may be continued.

During the execution of the safety transition process, it is checked whether the return condition is satisfied (step S4). For example, it is checked whether or not the sensor input abnormality has been resolved and whether or not the overspeed state has been resolved by the return by the maintenance staff.

If the return condition is satisfied in step S4 (step S4 = Yes), the safety transition process is terminated (step S5), and the execution of the self-diagnosis function task is resumed in that time frame (step S6).

When the safety control function task detects a new abnormality during the execution of the safety transition process (step S7 = Yes), the priority of the safety transition process corresponding to the newly detected abnormality is checked. (Step S8) If the priority of the safety transition process being executed is higher (Step S8 = No), the current safety transition process is continued (returns to Step S4).

On the other hand, if the priority of the new safety transition process is higher (step S8 = Yes), the current safety transition process is interrupted, that is, excluded from the schedule (step S9), and newly detected in that time frame. A safety transition process corresponding to the abnormal condition is executed (step S10). Thereafter, if the return condition is satisfied, the process returns (steps S4 to S6).

(First example of scheduling)
FIG. 5 shows a first example of scheduling in the elevator safety control device 25 according to Embodiment 1 of the present invention.

The CPU 31 of the elevator safety control device 25 executes the task of the safety communication function and the task of the overspeed detection function from the first group as shown in the pattern (a1) in a certain cycle. Next, the self-diagnosis function task is executed from the second group. In the last free time, the maintenance function task is executed from the third group and the process ends.

In the next cycle, as shown in the pattern (a2), the CPU 31 executes a task of the safety communication function, a task of the door-opening travel protection function, and a task of the maintenance switching function from the first group. Next, the self-diagnosis function task is executed from the second group. In the last vacant time, the task of the operation function is executed from the third group and the process ends.

Here, for example, when the overspeed detection function detects a sensor abnormality and requests the execution of “speed limit” as the safety transition process, the CPU 31 first performs the first operation as shown in the pattern (b1). The task of the safety communication function and the task of the overspeed detection function are executed from the group. Next, in the execution time of the second group, a “speed limit” process is executed instead of the self-diagnostic function task. Then, in the last free time, the maintenance function task is executed from the third group, and the process ends.

However, when the door-opening travel protection function further detects an abnormality of the elevator and requests the execution of “emergency stop” as the safety transition process, the CPU 31 first displays the pattern (b2) as shown in FIG. A safety communication function task, a door-opening travel protection function task, and a maintenance switching function task are executed from the first group. Next, the safety transition process is executed at the execution time of the second group. Since the priority of “emergency stop” is higher than the priority of “speed limit” currently being executed, "Emergency stop" is executed instead of "". Then, in the last free time, the task of the operation function is executed from the third group, and the process ends.

After that, the normal pattern as shown in pattern (a1) is restored again by the restoration by the maintenance personnel.

As described above, the elevator safety control device 25 according to Embodiment 1 of the present invention can execute a plurality of safety control functions in a multitasking manner by the task scheduling function using time partitioning.

The plurality of functions executed by the CPU 31 are classified into a first group including a safety control function, a second group including a self-diagnosis function, and a third group including a non-safety control function.

In each cycle, the scheduler 37 assigns execution time to tasks of at least one function from the first and second groups, and assigns remaining execution time to tasks of functions included in the third group.

When abnormality is detected by the safety control function or the self-diagnosis function, the CPU 31 interrupts the execution of the task of the function included in the second group, and is detected in the execution time frame of the interrupted task. The safety transition process corresponding to the abnormality is executed.

This ensures the independence of multiple safety control functions.

Further, the CPU 31 detects a new abnormality during the execution of the safety transition process, and the priority of the safety transition process corresponding to the newly detected abnormality is higher than the priority of the safety transition process. First, the execution of the safety transition process is interrupted, and the safety transition process corresponding to the newly detected abnormality is executed.

This makes it possible to respond appropriately even when multiple abnormalities are detected at the same time while ensuring the independence of multiple safety control functions.

(Second example of scheduling)
FIG. 6 shows a second example of scheduling in the elevator safety control device 25 according to Embodiment 1 of the present invention. The scheduling (a1 ′, a2 ′) during normal operation of the elevator is the same as that in the first example described above.

In a certain cycle, when an abnormality of the safety control function itself is detected and it is difficult to continue the execution of the task of the safety control function, for example, when a fatal calculation error or an excessive execution time is detected, the CPU 31 As shown in the pattern (b1 ′) or the pattern (b2 ′), the time allocation of the task of the safety control function is canceled, and the execution time frame indicates the pattern (b1 ′) or the pattern (b2 ′). The safety transition process is executed. That is, the safety transition process at this time is executed not in the execution time frame of the second group but in the execution time frame of the safety control function included in the first group.

When it is difficult to continue the execution of the tasks of the plurality of safety control functions, the CPU 31 cancels the time allocation of the tasks of the plurality of safety control functions, and is the most in the safety transition process corresponding to those abnormalities. The one with the higher priority is executed in a free time frame. In this case, a plurality of execution time frames may be assigned to the safety transition process in the same cycle.

Alternatively, the CPU 31 extends the execution time frame of the second group by deallocating the time allocation of the task of the safety control function and moving forward the execution start time of the task of the subsequent safety control function, In the execution time frame of the second group, the task of the safety transition process and the self-diagnosis function may be executed.

Claims (8)

An elevator safety control device capable of performing a plurality of functions by multitasking,
An arithmetic processing unit that repeatedly executes processing at a fixed period;
A scheduler for assigning task execution time to the arithmetic processing unit in each cycle,
The plurality of functions executed by the arithmetic processing unit are classified into a first group including a safety control function, a second group including a self-diagnosis function, and a third group including a non-safety control function,
The scheduler assigns an execution time to each task of at least one function from each of the first and second groups in each cycle, and assigns a remaining execution time to the task of the function included in the third group,
When an abnormality is detected by the safety control function or the self-diagnosis function, the arithmetic processing unit interrupts the execution of the task of the function included in the second group, and the execution time of the interrupted task An elevator safety control device that executes a safety transition process corresponding to the detected abnormality in a frame. When a new abnormality is detected during the execution of the safety transition process, and the priority of the safety transition process corresponding to the newly detected abnormality is higher than the priority of the safety transition process, the safety transition The elevator safety control device according to claim 1, wherein the execution of the process is interrupted and a safety transition process corresponding to the newly detected abnormality is executed. When the abnormality of the safety control function itself is detected, the arithmetic processing unit cancels the execution time allocation of the task of the safety control function, and the safety control function itself is released in the released execution time frame. The elevator safety control device according to claim 1 or 2, wherein a safety transition process corresponding to an abnormality of itself is executed. A memory protection unit for detecting memory access violations of the plurality of functions;
The elevator safety control device according to any one of claims 1 to 3, wherein when the memory access violation is detected, the arithmetic processing unit executes a safety transition process corresponding to the memory access violation. A first timer for detecting an excess of a specified time of a task of a function included in the first and second groups;
The elevator safety control device according to any one of claims 1 to 4, wherein the arithmetic processing unit executes a corresponding safety transition process when the specified time excess is detected a predetermined number of times. A second timer for detecting a total cycle time excess;
6. The arithmetic processing unit according to claim 1, wherein when the excess of the period time is detected by a task of a function included in the first and second groups, the arithmetic processing unit executes a corresponding safety transition process. The elevator safety control device according to one item. The elevator safety control device according to claim 6, wherein when an excess of the cycle time is detected by a task having a function included in the third group, execution of the task is interrupted. The elevator safety control device according to any one of claims 1 to 7, wherein the safety transition processing includes emergency stop, nearest floor stop operation, and speed limit in descending order of priority.

Images