Elevator control device, elevator monitoring system, and elevator monitoring method

Abstract

In an elevator control device that performs monitoring of an elevator, compliant use of a remote monitoring function is realized. The elevator control device is connected to a remote monitoring server that remotely monitors the elevator through a communication network. The elevator control device has a processor and a storage device, and the processor executes monitoring control processing that monitors the elevator. In the storage device, a communication function that stores a control program for performing communication with the remote monitoring server of the elevator, a remote monitoring function that stores a control program for the monitoring control processing, and a maintenance terminal function that stores a control program for connection with a maintenance terminal are stored. The remote monitoring function is stored in the storage device after being encrypted. In a case where the encrypted remote monitoring function is executed, the processor receives a decryption key of the remote monitoring function from the remote monitoring server using the communication function, and executes the monitoring control processing by decrypting the remote monitoring function using the decryption key.

Description

Technical Field

[0001] This invention relates to elevator control devices, elevator monitoring systems, and elevator monitoring methods. Background Technology

[0002] Elevator control devices sometimes store control programs related to remote monitoring functions used for monitoring and diagnosing elevators based on maintenance contracts. Patent Document 1 discloses a technique for deleting control programs upon the expiration of a maintenance contract to ensure compliant use of the remote monitoring function. In this technique, to prevent the control programs in the maintenance contract from being mistakenly deleted, the control programs used during maintenance operations are deleted when the elapsed time from the establishment of the last communication connection with the remote monitoring server during the maintenance contract period exceeds a first time threshold, and the elapsed time from the last maintenance work performed by the operator on the elevator device exceeds a second time threshold.

[0003] Existing technical documents

[0004] Patent documents

[0005] Patent Document 1: Japanese Patent Application Publication No. 2016-216151 Summary of the Invention

[0006] The problem that the invention aims to solve

[0007] Depending on the region where elevator systems are installed, there are sometimes issues regarding the stability of the communication network and the maintenance system in case of emergencies. It is also considered that in such regions, communication between the elevator system and the remote monitoring server may be unintentionally interrupted. In the aforementioned technology, the following problem arises in such cases: the conditions for erasing the control program of the remote monitoring function are met, resulting in poor usability.

[0008] The present invention was made to solve the aforementioned problems, and its object is to provide an elevator control device, an elevator monitoring system, and an elevator monitoring method that enable compliant use of remote monitoring functions in an elevator control device for monitoring elevators.

[0009] Methods for solving problems

[0010] This invention relates to an elevator control device connected to a remote monitoring server that remotely monitors the elevator via a communication network. The elevator control device includes: a processor that executes monitoring and control processing for monitoring the elevator; and a storage device storing the following functions: a communication function, storing a control program for communication with the remote monitoring server; a remote monitoring function, storing a control program for monitoring and control processing; and a maintenance terminal function, storing a control program for connection with a maintenance terminal. The remote monitoring function is encrypted and stored in the storage device. The processor is configured to receive a decryption key for the remote monitoring function from the remote monitoring server using the communication function, decrypt the remote monitoring function using the decryption key, and execute the monitoring and control processing.

[0011] Furthermore, this invention applies to an elevator monitoring system, comprising: a remote monitoring server for remotely monitoring elevators; and an elevator control device connected to the remote monitoring server via a communication network. The elevator control device includes: a processor for performing elevator monitoring and control processing; and a storage device storing the following functions: a communication function storing a control program for communication with the remote monitoring server; a remote monitoring function storing a control program for monitoring and control processing; and a maintenance terminal function storing a control program for connection with a maintenance terminal. The remote monitoring function is encrypted and stored in the storage device. Upon receiving a request for a decryption key for the remote monitoring function from the elevator control device, the remote monitoring server sends the decryption key to the elevator control device. The processor is configured to receive the decryption key from the remote monitoring server using the communication function, decrypt the remote monitoring function using the decryption key, and execute the monitoring and control processing.

[0012] Furthermore, this invention applies to an elevator monitoring method utilizing an elevator monitoring system. The elevator monitoring system includes: a remote monitoring server for remotely monitoring elevators; and an elevator control device connected to the remote monitoring server via a communication network. The elevator control device stores the following functions: a communication function, storing a control program for communication with the remote monitoring server; a remote monitoring function, storing a control program for monitoring and controlling the elevator; and a maintenance terminal function, storing a control program for connecting to a maintenance terminal. The remote monitoring function is stored encrypted. When the elevator control device uses the encrypted remote monitoring function to perform monitoring and control processing, in the elevator monitoring method, the elevator control device requests a decryption key for the remote monitoring function from the remote monitoring server. The remote monitoring server generates a decryption key, the elevator control device receives the decryption key sent from the remote monitoring server, and uses the decryption key to decrypt the remote monitoring function, thereby performing the monitoring and control processing.

[0013] Invention Effects

[0014] In the elevator device of the present invention, the remote monitoring function is encrypted. A decryption key for decryption is received from the remote monitoring server. Thus, according to the elevator device of the present invention, the remote monitoring function of the elevator device can be decrypted using the decryption key received from the remote monitoring server. Therefore, the compliant use of the remote monitoring function can be achieved. Attached Figure Description

[0015] Figure 1 This is a diagram illustrating an example of an elevator monitoring system according to Embodiment 1.

[0016] Figure 2 This is a block diagram illustrating the functionality of the input / output interfaces.

[0017] Figure 3 This is a block diagram illustrating an example of a storage device in an elevator control system.

[0018] Figure 4 This is a sequence diagram showing the decryption and encryption processes of the elevator monitoring system.

[0019] Figure 5 This is a flowchart illustrating the control routines for the elevator monitoring system to perform decryption and encryption processes.

[0020] Figure 6 This is a flowchart illustrating the control routines for the elevator monitoring system to perform decryption and encryption processes.

[0021] Figure 7 This is a diagram illustrating a variation of the hardware resources of an elevator control device.

[0022] Figure 8 This is a flowchart illustrating the control routines executed in the elevator monitoring system of Embodiment 2. Detailed Implementation

[0023] The embodiments will now be described with reference to the accompanying drawings. Furthermore, elements shared across the drawings will be labeled with the same reference numerals, and repeated descriptions will be omitted.

[0024] 1. Implementation Method 1.

[0025] 1-1. Structure of Elevator Monitoring System

[0026] Figure 1This diagram illustrates an example of an elevator monitoring system according to Embodiment 1. The elevator monitoring system 100 is a system for remotely monitoring the operation of elevators located in one or more customer buildings 10 from a monitoring center 70. Each customer building 10 is equipped with an elevator control device 30 and a monitoring device 40. The elevator control device 30 controls the control object device 20 of the elevator. The elevator control device 30 and the monitoring device 40 are connected to the monitoring center 70 via a communication network 80. The communication network 80 can use telephone lines, IP (Internet Protocol), etc. The location and number of customer buildings 10 are not limited. For example, the customer buildings 10 connected to the monitoring center 70 may also be located in a second country different from the first country where the monitoring center 70 is located.

[0027] The controlled device 20 is a type of equipment controlled by the elevator control device 30. The controlled device 20 includes, for example, a traction machine that drives the elevator car, and an opening / closing device that opens and closes the car doors. The elevator control device 30 controls the controlled device 20. The elevator control device 30 includes a processor 32, a storage device 34, and an input / output interface 36.

[0028] The processor 32 performs various processes. The processor 32 is, for example, a microcomputer. Various information is stored in the storage device 34. Examples of storage devices 34 include volatile memory and non-volatile memory. The processor 32 executes these various processes by executing a control program, which is a computer program. The control program is stored in the storage device 34 or recorded on a computer-readable recording medium.

[0029] The processor 32 performs operation control processing to control the operation of the elevator's controlled equipment 20. Specifically, the processor 32 controls the movement of the traction machine, the opening and closing of the car doors, and other operations.

[0030] In addition, processor 32 performs monitoring and control processing to acquire monitoring data representing the elevator's operating status. The monitoring data may include, for example, motion data or call data from the elevator's control device 20. Motion data may include, for example, travel status, door opening / closing status, car load, or car position. Call data may include, for example, data on elevator call registration, call allocation, or call responses. The acquired monitoring data is stored in storage device 34.

[0031] Figure 2This is a block diagram illustrating the functions of the input / output interface. As shown in the figure, the input / output interface 36 serves as an input / output port to external devices and includes an elevator mechanism connection section 361, a monitoring device connection section 362, and a maintenance terminal connection section 363. The elevator mechanism connection section 361 connects to the elevator control device 20, sends command values ​​for the operation control processing of the control device 20, and receives monitoring data for monitoring control processing. The maintenance terminal connection section 363 is a port for connecting to the maintenance terminal 60 held by the operator for maintenance and management. The monitoring device connection section 362 is a port for connecting to the monitoring device 40.

[0032] The monitoring device 40 is communicatively connected to the elevator control device 30 and communicatively connected to the monitoring center 70 via a communication network 80. Furthermore, the monitoring device 40 receives monitoring data sent from the elevator control device 30. Additionally, the monitoring device 40 receives various data required for elevator monitoring, such as image data from monitoring cameras installed in the elevator. The monitoring device 40 comprehensively monitors the elevator's status based on the received data and periodically sends the monitoring results as monitoring information to the monitoring center 70.

[0033] In addition, the monitoring device 40 periodically sends health check requests to the monitoring center 70. This health check is a check to ensure the monitoring device 40 is functioning properly. Upon receiving a health check response from the monitoring center 70, the monitoring device 40 sends the received health check response to the elevator control device 30. Furthermore, upon receiving the encryption key and decryption key (described later) from the monitoring center 70, the monitoring device 40 sends the received encryption key and decryption key to the elevator control device 30.

[0034] Monitoring center 70 remotely monitors elevators installed in one or more customer buildings 10 according to elevator maintenance contracts signed with customers. Monitoring center 70 includes a remote monitoring server 72, a storage device 74, and a communication device 76. Remote monitoring server 72 generates a health check response based on a health check request sent from monitoring device 40. Furthermore, remote monitoring server 72 generates a decryption key and an encryption key based on a decryption key request (described later) sent from monitoring device 40.

[0035] Storage device 74 stores various data received from monitoring device 40. In addition, storage device 74 stores health check responses, decryption keys, and encryption keys generated in remote monitoring server 72.

[0036] The communication device 76 has the function of sending and receiving data. The communication device 76 communicates with the monitoring device 40 through the communication network 80.

[0037] Figure 3This is a block diagram illustrating an example of a storage device 34 in an elevator control device 30. The storage device 34 stores basic communication functions 341, remote monitoring functions 342, and maintenance terminal functions 343 as a control program. Furthermore, the storage device 34 appropriately stores encryption keys and the aforementioned monitoring data.

[0038] The basic communication function 341 includes a control program for communicating with the monitoring center 70 via the monitoring device 40. The basic communication function 341 is not encrypted. Therefore, the basic communication function 341 can always be used. The processor 32 of the elevator control device 30 executes the control program of the basic communication function 341 stored in the storage device 34. This enables communication between the monitoring device 40 and the monitoring center 70.

[0039] The remote monitoring function 342 includes a control program for monitoring and diagnosing the elevator. The remote monitoring function 342 is encrypted to ensure compliant use based on the maintenance contract. Therefore, the processor 32 of the elevator control device 30 obtains the decryption key in the decryption process described later and decrypts the remote monitoring function 342. Then, the processor 32 of the elevator control device 30 performs the monitoring and control processing by executing the control program of the remote monitoring function 342.

[0040] Maintenance terminal function 343 includes a control program for sending and receiving data with maintenance terminal 60. Maintenance terminal function 343 is not encrypted. Therefore, in principle, maintenance terminal function 343 can always be used during the connection with maintenance terminal 60. The processor 32 of elevator control device 30 sends and receives data with maintenance terminal 60 by executing the control program of maintenance terminal function 343.

[0041] The encryption key is used to re-encrypt the decrypted remote monitoring function 342. The encryption key is generated in the remote monitoring server 72 of the monitoring center 70 and sent to the elevator control device 30 along with the decryption key. The received encryption key is stored in the storage device 34 and read out during the encryption process described later.

[0042] 1-2. Operation of the elevator monitoring system

[0043] Next, the elevator monitoring method utilizing the elevator monitoring system 100 will be described. As described above, the remote monitoring function 342 is pre-encrypted. Therefore, when the monitoring device 40 is compliantly connected to the elevator control device 30 according to the maintenance contract, the elevator monitoring system 100 performs a decryption process to decrypt the remote monitoring function 342 using a decryption key. Furthermore, to prevent the decrypted remote monitoring function 342 from being used for purposes other than its intended purpose, the elevator monitoring system 100 performs an encryption process to re-encrypt the remote monitoring function 342 when predetermined encryption conditions are met.

[0044] Figure 4 This is a timing diagram illustrating the decryption and encryption processes of the elevator monitoring system. Furthermore, Figure 5 and Figure 6 This is a flowchart illustrating the control routines for decryption and encryption processes performed by the elevator monitoring system. See also the following... Figure 4 ,right Figure 5 and Figure 6 The specific processing of the control routine shown will be explained.

[0045] exist Figure 5 In step S100 of the control routine shown, the elevator control device 30 first determines whether the monitoring device 40 is connected. As a result, if the monitoring device 40 is not connected to the elevator control device 30, step S100 is repeatedly executed until the determination is successful. When the determination is successful in step S100, the process proceeds to the next step, S102.

[0046] In step S102, the elevator control device 30 determines whether the remote monitoring function 342 has been encrypted. If the remote monitoring function 342 is not encrypted, it is determined that decryption processing is not required, and the processing is transferred to the elevator control unit 30. Figure 6 The control routine shown is step S112. On the other hand, if the remote monitoring function 342 is encrypted, the decryption process shown in step S110 is initiated from step S104.

[0047] First, in step S104, the elevator control device 30 requests a decryption key from the monitoring device 40 for decrypting the remote monitoring function 342. Upon receiving the request, the monitoring device 40 requests the decryption key from the monitoring center 70. After confirming whether the received decryption key request is a compliance request based on the maintenance contract, the monitoring center 70 generates a decryption key and sends it to the monitoring device 40. Furthermore, at this time, the monitoring center 70 generates an encryption key for re-encrypting the remote monitoring function 342 and sends it along with the decryption key to the monitoring device 40. Upon receiving the decryption key and the encryption key, the monitoring device 40 further transmits the received decryption key and encryption key to the elevator control device 30.

[0048] In the next step S106, it is determined whether the elevator control device 30 has received the decryption key and the encryption key. As a result, if the elevator control device 30 has not received the decryption key and the encryption key, the process of step S106 is repeatedly executed until the decryption key and the encryption key are received. When the determination is deemed successful in step S106, the process proceeds to the next step S108.

[0049] In step S108, the elevator control device 30 uses the received decryption key to decrypt the control program of the remote monitoring function 342. In the next step S110, the elevator control device 30 stores the received encryption key in the storage device 34. When the processing in step S110 ends, the decryption process ends, and the process terminates. Figure 6 Step S112 of the control routine shown leads to the encryption process shown in step S122.

[0050] In step S112, the elevator control device 30 starts the lifetime timer. The lifetime timer is a timer that sets the effective time of the decrypted remote monitoring function 342. In the next step S114, the elevator control device 30 performs monitoring and control processing by executing the control program of the remote monitoring function 342.

[0051] In the next step S116, the elevator control device 30 determines whether a health check has been received. The monitoring device 40 periodically sends a health check request to the monitoring center 70, for example, once a day. Upon receiving the health check request, the monitoring center 70 sends a health check response to the monitoring device 40. Upon receiving the health check response, the monitoring device 40 sends the received health check response to the elevator control device 30.

[0052] If it is determined in step S116 that the elevator control device 30 has received a health check, it can be concluded that the communication status between the elevator control device 30 and the monitoring center 70 is normal. In this case, the process returns to step S112 again, and the lifetime timer is reset again, starting from zero (0) as the initial value. This process is also called the "initialization process". Through the initialization process, the validity period of the decrypted remote monitoring function 342 is updated.

[0053] On the other hand, if it is determined in step S116 that the elevator control device 30 has not received a health check, the process proceeds to the next step, S118. In step S118, the fulfillment of an encryption condition is determined. This encryption condition is the condition that is met when the lifespan timer expires. The elevator control device 30 determines whether the continuous time counted by the lifespan timer has reached a predetermined time. Furthermore, the predetermined time is set to be at least longer than the interval between the health check request transmissions.

[0054] If it is determined in step S118 that the lifetime timer has not expired, the encryption condition is deemed not met, and the process returns to step S114 to continue the monitoring and control process. On the other hand, if it is determined in step S118 that the lifetime timer has expired, it can be determined that no health check response has been received for the health check request. Such situations may include, for example, situations where communication between the monitoring device 40 and the elevator control device 30 is interrupted due to the connection of the monitoring device 40 being cut off from the elevator control device 30, or situations where communication between the monitoring device 40 and the monitoring center 70 is interrupted. In such cases, it is considered that there is a possibility that the decrypted remote monitoring function 342 is not being used in compliance with regulations, and the encryption condition is deemed met, proceeding to the next step S120.

[0055] In step S120, the elevator control device 30 encrypts the control program of the remote monitoring function 342 using an encryption key stored in the storage device 34. In the next step S122, the elevator control device 30 deletes the encryption key stored in the storage device 34.

[0056] According to the decryption process described above, the remote monitoring function 342 is decrypted using the decryption key obtained from the monitoring center 70. This prevents the remote monitoring function 342 from being used without going through the monitoring center 70. Furthermore, according to the encryption process, if the elevator control device 30 does not receive the health check sent from the monitoring center 70, the encryption key is deleted after encrypting the remote monitoring function 342. This prevents the remote monitoring function 342 from being used even when communication with the monitoring device 40 or the monitoring center 70 has been cut off.

[0057] Furthermore, according to the encryption process of this embodiment, the remote monitoring function 342 is not deleted from the storage device 34. Therefore, for example, in the event that communication between the monitoring center 70 and the monitoring device 40 is interrupted for an extended period due to a power outage, the remote monitoring function 342 is not deleted but encrypted. Thus, in the event of an unexpected stop of the remote monitoring function 342, there is no need to expend effort to store the remote monitoring function 342 back in the storage device 34, and the remote monitoring function 342 can be easily restored.

[0058] 1-3. Variations of Implementation Method 1

[0059] The elevator monitoring system 100 of Embodiment 1 can also be modified as described below.

[0060] 1-3-1. Monitoring device 40

[0061] In this embodiment, some or all of the functions of the monitoring device 40 may also be configured in the elevator control device 30. Furthermore, a portion of the functions of the elevator control device 30 may also be configured in the monitoring device 40.

[0062] 1-3-2. Elevator control device 30

[0063] Figure 7 This diagram illustrates a variation of the hardware resources of an elevator control device. Figure 7 In the example shown, the elevator control device 30 includes, for example, a processing circuit 31 comprising a processor 32, a storage device 34, and dedicated hardware 35. Figure 7 An example is shown where a portion of the functions of the elevator control device 30 are implemented using dedicated hardware 35. All the functions of the elevator control device 30 can also be implemented using dedicated hardware 35. The dedicated hardware 35 can be a single circuit, a composite circuit, a programming processor, a parallel programming processor, an ASIC (Application Specific Integrated Circuit), a FPGA (Field Programmable Gate Array), or a combination thereof. Furthermore, the above-described modifications of the elevator control device 30 can also be applied to the elevator monitoring system of Embodiment 2 described later.

[0064] Implementation method 2.

[0065] 2-1. System Structure of Elevator Monitoring System

[0066] The elevator monitoring system of Embodiment 2 has the same system structure as the elevator monitoring system 100 of Embodiment 1. Regarding the system structure of the elevator monitoring system of Embodiment 2, please refer to the description of Embodiment 1; its description is omitted here.

[0067] 2-2. Features of the elevator monitoring system in Implementation Method 2

[0068] Preferably, maintenance operations performed by the operator using the maintenance terminal 60 can be executed even if communication with the monitoring center 70 is interrupted. Therefore, the control program for the maintenance terminal function 343 stored in the storage device 34 is not encrypted using the encryption key generated by the monitoring center 70. Therefore, the maintenance terminal connection 363 of the input / output interface 36 may be used for purposes outside the maintenance contract or utilized after the maintenance contract is terminated.

[0069] Therefore, in the elevator monitoring system of Embodiment 2, the elevator control device 30 times the continuous connection time between the maintenance terminal 60 and the maintenance terminal connection section 363 of the input / output interface 36. For example, if the timed continuous connection time reaches a predetermined connection time, the elevator control device 30 performs communication restriction processing to restrict communication with the connected maintenance terminal 60. The predetermined connection time is set to a time longer than the connection time required to perform normal maintenance work on the maintenance terminal 60. Furthermore, examples of this communication restriction processing include stopping data transmission to or from the maintenance terminal 60 by not responding to data transmission requests from the maintenance terminal 60, or restricting data transmission from the maintenance terminal 60 by intentionally transmitting a large amount of data to the maintenance terminal 60.

[0070] Furthermore, the elevator control device 30 keeps track of the elapsed time since the execution of the communication restriction process. In the following description, this time is referred to as the "restriction time". Then, the elevator control device 30 terminates the executed communication restriction process when the elapsed restriction time has reached a predetermined limit time.

[0071] According to the communication restriction processing described above, non-compliant data communication from the maintenance terminal connection unit 363 can be restricted. Furthermore, since the communication restriction processing ends after a specified restriction period, remedies are provided for situations where communication restriction processing has been applied to compliant use of the maintenance terminal 60.

[0072] 2-3. Specific processing of the elevator monitoring system in Implementation Method 2

[0073] Figure 8 This is a flowchart illustrating the control routines executed in the elevator monitoring system of Embodiment 2. Figure 8 The control routine shown is executed repeatedly at predetermined control cycles. Figure 8 In step S130 of the control routine shown, the elevator control device 30 determines whether the maintenance terminal 60 is connected to the maintenance terminal connection section 363 of the input / output interface 36. If the determination is not successful, the routine ends. Conversely, if the determination is successful in step S130, the process proceeds to the next step, S132.

[0074] In step S132, the elevator control device 30 starts a monitoring timer. This monitoring timer is used to set the effective time for maintenance terminal processing utilizing the maintenance terminal function 343. In the next step S134, the elevator control device 30 executes the maintenance terminal processing by executing the control program of the maintenance terminal function 343.

[0075] In the next step S136, the elevator control device 30 determines whether the maintenance terminal 60 has been disconnected from the maintenance terminal connection 363 of the input / output interface 36. If the determination is successful, the procedure ends. Otherwise, if the determination is unsuccessful in step S136, the process proceeds to the next step S138.

[0076] In step S138, the elevator control device 30 determines whether the monitoring timer has expired. Here, the elevator control device 30 determines whether the continuous connection time measured by the monitoring timer has reached the specified connection time. As a result, if the monitoring timer has not expired, the process returns to step S134 to execute maintenance terminal processing.

[0077] On the other hand, if the monitoring timer expires in step S138, it can be determined that there is a possibility that the maintenance terminal 60 is continuously connected for purposes other than maintenance. For example, consider a scenario where the maintenance terminal 60 continuously reads elevator monitoring data from the maintenance terminal connection unit 363. In such a case, it is determined that communication with the maintenance terminal 60 needs to be restricted, and the process proceeds to the next step, S140.

[0078] In step S140, the elevator control device 30 starts a limit timer. This limit timer is used to measure the elapsed time as a limit period since the execution of the communication restriction process. In the next step S142, the communication restriction process is executed. In the next step S144, the elevator control device 30 determines whether the limit timer has expired. Here, it is determined whether the limit time measured by the limit timer has reached the specified limit time. If the determination in step S144 is not true, the process returns to step S142. That is, the elevator control device 30 repeatedly executes the communication restriction process until the determination in step S144 is true. On the other hand, if the determination in step S144 is true, the communication restriction process ends, and this routine ends.

[0079] The elevator monitoring system configured as described above can prevent the maintenance terminal 60 from sending and receiving data from the maintenance terminal connection unit 363 for longer than the specified connection time.

[0080] Label Explanation

[0081] 10: Customer building; 20: Controlled object equipment; 30: Elevator control device; 31: Processing circuit; 32: Processor; 34: Storage device; 35: Dedicated hardware; 36: Input / output interface; 40: Monitoring device; 60: Maintenance terminal; 70: Monitoring center; 72: Remote monitoring server; 74: Storage device; 76: Communication device; 80: Communication network; 100: Elevator monitoring system; 341: Basic communication function; 342: Remote monitoring function; 343: Maintenance terminal function; 361: Elevator mechanism connection part; 362: Monitoring device connection part; 363: Maintenance terminal connection part.

Claims

1. An elevator control device, which is connected to a remote monitoring server for remote monitoring of the elevator via a communication network, wherein, The elevator control device includes: processor; It performs monitoring and control processing to monitor the elevator; and The storage device stores the following functions: a communication function, storing control programs for communication with a remote monitoring server of the elevator; a remote monitoring function, storing control programs for the monitoring and control processing; and a maintenance terminal function, storing control programs for connection with a maintenance terminal. The elevator control device is configured as follows: The remote monitoring function is encrypted and then stored in the storage device. The processor uses the communication function to receive the decryption key for the remote monitoring function from the remote monitoring server, uses the decryption key to decrypt the remote monitoring function, and executes the monitoring control process. in, The elevator control device is configured as follows: When the decryption key is received from the remote monitoring server using the communication function, the processor receives an encryption key for re-encrypting the decrypted remote monitoring function, and stores the received encryption key in the storage device. When predetermined encryption conditions are met, the processor uses the encryption key to encrypt the remote monitoring function and then deletes the encryption key.

2. The elevator control device according to claim 1, wherein, The encryption condition is a condition that is met when a predetermined time has elapsed since no response has been received from the remote monitoring server.

3. The elevator control device according to claim 2, wherein, The response from the remote monitoring server is a response to a health check request that is performed periodically.

4. The elevator control device according to claim 2 or 3, wherein, The elevator control device is configured as follows: When the remote monitoring function is decrypted using the decryption key, the processor starts timing the continuous period using a timer. If the timed continuous period reaches the predetermined time, the encryption condition is deemed met. Upon receiving a response from the remote monitoring server using the communication function, an initialization process is performed to reset the timer to its initial value.

5. The elevator control device according to any one of claims 1 to 3, wherein, The elevator control device includes a maintenance terminal connection part for connecting the maintenance terminal. The elevator control device is configured as follows: The maintenance terminal functions are stored in the storage device without encryption. If the continuous connection time of the maintenance terminal reaches a predetermined connection time, the processor performs a communication restriction process to limit communication with the maintenance terminal.

6. The elevator control device according to claim 5, wherein, The communication restriction process is to stop sending and receiving data with the maintenance terminal.

7. The elevator control device according to claim 5, wherein, The elevator control device is configured as follows: If the elapsed time since the start of the communication restriction process exceeds a predetermined limit, the processor terminates the communication restriction process.

8. The elevator control device according to any one of claims 1 to 3, wherein, The elevator control device also includes a monitoring device, which, by connecting to the elevator control device, performs at least a portion of the communication function. The elevator control device is configured as follows: When the monitoring device is connected to the elevator control device, the processor uses the communication function of the monitoring device to send a decryption key request to the remote monitoring server, and receives the decryption key generated upon receiving the decryption key request from the remote monitoring server.

9. An elevator monitoring system comprising: a remote monitoring server for remotely monitoring elevators; and an elevator control device connected to the remote monitoring server via a communication network. The elevator monitoring system is configured such that, The elevator control device includes: The processor; which performs the monitoring and control processing of the elevator; and The storage device stores the following functions: a communication function, storing control programs for communication with a remote monitoring server of the elevator; a remote monitoring function, storing control programs for the monitoring and control processing; and a maintenance terminal function, storing control programs for connection with a maintenance terminal. The remote monitoring function is encrypted and then stored in the storage device. Upon receiving a request from the elevator control device for the decryption key of the remote monitoring function, the remote monitoring server sends the decryption key to the elevator control device. The processor uses the communication function to receive the decryption key from the remote monitoring server, uses the decryption key to decrypt the remote monitoring function, and executes the monitoring control process. in, The elevator monitoring system is configured as follows: Upon receiving the request for the decryption key, the remote monitoring server sends an encryption key to the elevator control device for re-encrypting the decrypted remote monitoring function. The processor uses the communication function to receive the encryption key from the remote monitoring server and stores the encryption key in the storage device. When predetermined encryption conditions are met, the processor uses the encryption key to encrypt the remote monitoring function and then deletes the encryption key.

10. The elevator monitoring system according to claim 9, wherein, The encryption condition is a condition that is met when a predetermined time has elapsed since no response has been received from the remote monitoring server.

11. The elevator monitoring system according to claim 10, wherein, The response from the remote monitoring server is a response to a health check request that is performed periodically.

12. The elevator monitoring system according to claim 10 or 11, wherein, The elevator monitoring system is configured as follows: When the remote monitoring function is decrypted using the decryption key, the processor starts timing the continuous period using a timer. If the timed continuous period reaches the predetermined time, the encryption condition is deemed met. Upon receiving a response from the remote monitoring server using the communication function, an initialization process is performed to reset the timer to its initial value.

13. An elevator monitoring method utilizing an elevator monitoring system, the elevator monitoring system comprising: a remote monitoring server for remotely monitoring elevators; and an elevator control device connected to the remote monitoring server via a communication network. The elevator control device stores the following functions: a communication function, which stores a control program for communicating with a remote monitoring server of the elevator; a remote monitoring function, which stores a control program for monitoring and controlling the elevator; and a maintenance terminal function, which stores a control program for connecting to a maintenance terminal. The remote monitoring function is stored in encrypted form. In the case where the elevator control device uses the encrypted remote monitoring function to perform the monitoring and control processing, in the elevator monitoring method... The elevator control device requests the decryption key for the remote monitoring function from the remote monitoring server. The remote monitoring server generates the decryption key. The elevator control device receives the decryption key sent from the remote monitoring server. The elevator control device uses the decryption key to decrypt the remote monitoring function. The elevator control device performs the monitoring and control processing. The elevator control device is configured as follows: When the decryption key is received from the remote monitoring server using the communication function, the processor of the elevator control device receives an encryption key for re-encrypting the decrypted remote monitoring function, and stores the received encryption key in a storage device. When predetermined encryption conditions are met, the processor uses the encryption key to encrypt the remote monitoring function and then deletes the encryption key.

Images