Safe operation control method, operation control device, electronic equipment and storage medium

Abstract

The invention discloses a safe operation control method, an operation control device, electronic equipment and a storage medium, and the method comprises the steps that when an elevator operates normally, if a condition of entering a preparation state of a specific state is triggered, a corresponding voting switch is controlled to be switched off, and the specific state is an emergency electric operation state or a maintenance state; determining whether to enter a preparation state according to the validity of the operation control switch; if not, the corresponding voting switch is controlled to be closed, and the elevator returns to the normal operation state; if yes, determining whether to enter a specific state according to the validity of the operation control switch; when the elevator enters a specific state, the safety switch is bypassed and the corresponding voting switch is controlled to be closed, and the elevator controller controls the elevator to operate according to the state of the operation control switch. The operation control switch is connected to the processor in parallel, the wiring length is reduced, the requirement for the switch device is lowered, judgment is carried out by combining the effectiveness of the operation control switch, and the safety during elevator overhaul or emergency electric operation is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of elevator safety technology, and in particular to a safe operation control method, device, electronic equipment and storage medium. Background Art

[0002] Elevators are one of the indispensable means of transportation in modern urban life, and their appearance has greatly facilitated people's travel. However, due to the particularity of elevators, safety issues have attracted much attention. In order to ensure the safety of elevator riding, on the one hand, elevators need to be regularly inspected and maintained. Elevator maintenance is to check whether the elevator can move the car according to instructions. On the other hand, when the elevator suddenly fails, the elevator needs emergency electric operation to ensure that the elevator can move the car in a safe way to facilitate rescue and maintenance. Operations in this state require professionals to ensure safe and effective rescue. However, the existing elevator maintenance devices and emergency electric operation control devices are highly dependent on switches and buttons. The types of switches or buttons are all power switches or buttons. Due to the long wiring and high operating voltage, the protection requirements and use costs of the switches or buttons on the device are also high. Therefore, how to reduce the switch requirements while ensuring the safety of elevator maintenance and emergency electric operation is an urgent problem to be solved. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a safe operation control method, an operation control device, an electronic device and a storage medium.

[0004] In a first aspect, the present invention provides a safe operation control method, which is applied to a processor in an operation control device, wherein the operation control device further comprises an operation control switch, the operation control device is connected to an elevator control circuit, the elevator control circuit comprises a main power supply, an elevator controller, a power supply line and at least one voting switch arranged on the power supply line, the input ends of the processor are all connected to the operation control switch, and the output ends of the processor are connected to the voting switch; the operation control device is also in communication connection with the elevator controller;

[0005] The method comprises:

[0006] When the elevator is in normal operation, if the condition for entering the preparatory state of a specific state is triggered, the corresponding voting switch is controlled to be disconnected, and the specific state is an emergency electric operation state or a maintenance state;

[0007] Determining whether to enter the standby state according to the validity of the operation control switch;

[0008] When the preparatory state is not entered, the corresponding voting switch is controlled to close, and the elevator returns to the normal operating state;

[0009] When entering the preparatory state, determining whether to enter the specific state according to the validity of the operation control switch;

[0010] When entering the specific state, the corresponding voting switch is controlled to be closed, and the elevator controller controls the elevator operation according to the state of the operation control switch;

[0011] When a failure of the operation control switch is detected, the corresponding voting switch is controlled to be disconnected, and the elevator enters a safe state.

[0012] In a second aspect, the present invention provides an operation control device, comprising a processor and an operation control switch, wherein the operation control device is connected to an elevator control circuit, wherein the elevator control circuit comprises a main power supply, an elevator controller, a power supply line, and at least one voting switch arranged on the power supply line, wherein the input end of the processor is connected to the operation control switch, and the output end of the processor is connected to the voting switch; the operation control device is also connected to the elevator controller in communication; and the processor comprises:

[0013] A trigger module is used to control the corresponding voting switch to be disconnected when the elevator is in a normal operating state and the condition for entering a preparatory state of a specific state is triggered, wherein the specific state is an emergency electric operation state or a maintenance state;

[0014] A first judgment module, used to determine whether to enter the preparatory state according to the validity of the operation control switch;

[0015] A recovery module, used for controlling the corresponding voting switch to close when the elevator does not enter the preparatory state, so that the elevator returns to a normal operating state;

[0016] A second judgment module is used to determine whether to enter the specific state according to the validity of the operation control switch when entering the preparatory state;

[0017] A specific state entry module, used for controlling the corresponding voting switch to close when entering the specific state, and the elevator controller controls the elevator operation according to the state of the operation control switch;

[0018] The safety control module is used to control the corresponding voting switch to be disconnected when a failure of the operation control switch is detected, so that the elevator enters a safe state.

[0019] In a third aspect, the present invention provides a safety system, comprising an operation control device and an elevator control circuit as described in the second aspect, the operation control device also comprising an operation control switch and a processor, the operation control device being connected to the elevator control circuit, the elevator control circuit comprising a main power supply, an elevator controller, a power supply line and at least one voting switch arranged on the power supply line, the input ends of the processor are connected to the operation control switch, and the output ends of the processor are connected to the voting switch; the operation control device is also communicatively connected to the elevator controller.

[0020] In a fourth aspect, the present invention provides an electronic device, the electronic device comprising:

[0021] at least one processor; and

[0022] a memory communicatively connected to the at least one processor; wherein,

[0023] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the safe operation control method described in the first aspect of the present invention.

[0024] In a fifth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the safe operation control method described in the first aspect of the present invention when executed.

[0025] Embodiments of the present invention The safe operation control method provided by the embodiments of the present invention has the following beneficial effects:

[0026] On the one hand, the operation control switch is connected to the processor, which reduces the wiring length, and uses the processor to diagnose the switch device, which reduces the requirements for the switch device itself. At the same time, the number of switch devices can be reduced, which also makes the device integrated, reducing the product volume and cost; the reduction in wiring length can also reduce the voltage strength of the device power supply, and improve the safety when using the operation control device;

[0027] On the other hand, the effectiveness of the operation control switch is highly correlated with the effectiveness and safety of the elevator operation control. Before the elevator enters the preparatory state or a specific state, a judgment is made based on the effectiveness of the operation control switch. Only when the operation control switch meets the safety conditions is it allowed to enter the preparatory state or the specific state. When a failure of the operation control switch is detected, the elevator enters the safe state, ensuring the safety of the elevator during maintenance or emergency electric operation.

[0028] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 is a structural schematic diagram of an operation control device provided in Embodiment 1 of the present invention;

[0031] Figure 2 is a flow chart of a safe operation control method provided by Embodiment 1 of the present invention;

[0032] Figure 3 is a structural schematic diagram of another operation control device provided in Embodiment 1 of the present invention;

[0033] Figure 4 is a structural schematic diagram of another operation control device provided in Embodiment 1 of the present invention;

[0034] Figure 5 The first embodiment of the present invention provides a logic judgment process of a preparatory state of an elevator from a normal state to an emergency electric operation state;

[0035] Figure 6 The first embodiment of the present invention provides a logic judgment process of an elevator from a preparatory state of an emergency electric operation state to an emergency electric operation state;

[0036] Figure 7 The present invention provides a logic judgment process of an elevator from an emergency electric running state to an exit from an emergency electric running state.

[0037] Figure 8 is a schematic diagram of the structure of a processor provided by Embodiment 2 of the present invention;

[0038] Fig. 9 It is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0039] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0040] Embodiment 1

[0041] An embodiment of the present invention provides a flow chart of a safe operation control method. This embodiment can be applicable to situations where a safety inspection or emergency electric operation of an elevator is performed. The method can be executed by a processor in an operation control device. The operation control device can be implemented in the form of hardware and / or software. The operation control device can be configured in an electronic device.

[0042] Figure 1 A schematic diagram of the structure of an operation control device provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the operation control device 1 is connected to the elevator control circuit, the elevator control circuit includes a main power supply 21, an elevator controller 26, a power supply line 22 and at least one voting switch 23 arranged on the power supply line 22, and also includes a safety execution subsystem 24 and a main motor 25. The operation control device 1 includes an operation control switch 12 and a processor 13, and also includes a device power supply 11. The input ends of the first processor 13 and the second processor 14 are both connected to the operation control switch 12, the input ends of the processor 13 are both connected to the operation control switch 12, and the output end of 13 is connected to the voting switch 23; the operation control device 1 is also connected to the elevator controller communication 26, and the operation control device 1 can send information such as the state of the operation control switch 12 and related determination results to the elevator controller 26; the operation control switch 12 is a signal type switch, and the switch can be controlled by a small current or voltage (3V-24V), which is lower than the safety voltage 36V, thereby ensuring the safety of the operator.

[0043] Figure 2 A flowchart of a safe operation control method provided in Embodiment 1 of the present invention is shown in FIG. Figure 2 As shown, the safe operation control method includes:

[0044] S201. When the elevator is in normal operation, if the condition for entering a preparatory state of a specific state is triggered, the corresponding voting switch is controlled to be disconnected.

[0045] The specific state is an emergency electric operation state or a maintenance state, that is, the electric operation device can be an emergency electric operation control device or a maintenance device.

[0046] In an optional embodiment, the operation control device has a state switching function, and the switching switch can be a single-pole triple-throw switch, which includes a lever and three contacts. It can be set that when the lever is connected to different contacts, the operation control device can be in different circuit states. For example, when the lever is connected to the first contact, it is considered that no preparatory state is triggered. When the second contact is connected, it is considered that the preparatory state of the emergency electric operation state is triggered. When the third contact is connected, it is considered that the preparatory state of the maintenance state is triggered. In another optional embodiment, the processor is also connected to an external terminal, and the external terminal can send a preparatory state instruction to the operation device. When the preparatory state instruction is received, it is considered that the condition for entering the relevant preparatory state is triggered. When the condition of the preparatory state of the emergency electric operation state is triggered, the operation control device is an emergency electric operation control device, and when the condition of the preparatory state of the maintenance state is triggered, the operation control device is a maintenance device.

[0047] like Figure 1 As shown, in one case, when the switch connected to the processor is valid, it is considered that the condition for entering the standby state is triggered, and the condition for entering the standby state is that the switch is valid. Figure 3 In the structural schematic diagram of another electric operation device shown in FIG. 1 , the operation control switch 12 includes a first switching switch (i.e., switching switch 1) and a second switching switch (i.e., switching switch 2), and the processor 13 includes a first processor 131 and a second processor 132, wherein the switching switch may be a single-pole double-throw switch. The first switching switch is connected to the first processor 131, and the second switching switch is connected to the second processor 132. When any switching switch is valid, it is considered that the condition for entering the preparatory state is triggered.

[0048] In summary, there may be a variety of triggering methods for entering the standby state, and the operation control device may be a device integrating emergency electric operation control function and maintenance function, or it may be a separate emergency electric operation device or maintenance device, and the present invention does not impose any restrictions on this.

[0049] It should also be noted that the validity of the operation control switch can correspond to both the closed state and the open state of the operation control switch, because the processor processes according to the signal of the operation control switch, and both the closed and open states of the operation control switch can provide signals. Therefore, the corresponding open and closed state when the operation control switch is valid can be set according to actual needs.

[0050] When the condition for entering the preparatory state is triggered, the elevator is in normal operation. If the elevator is performing an elevator call task, the processor controls the corresponding voting switch to be disconnected, which can make the elevator in a safe stop state and end the current elevator call task to further analyze whether to enter the preparatory state. This step controls the corresponding voting switch to be disconnected in order to stop the current operation of the elevator and prepare for entering the preparatory state, while the corresponding voting switch is controlled to be disconnected in the case of a fault or abnormality in order to enter the safe state. The purpose of disconnecting the voting switch in the two situations is different.

[0051] S202: Determine whether to enter the standby state according to the validity of the operation control switch.

[0052] If not, execute S203, and if so, execute S204.

[0053] Under normal circumstances, before using the operation control device, the operation control switch in the device is usually in an invalid state or a canceled state, and it may be abnormal for the switch to remain in an effective state for a long time. Therefore, before entering the preparatory state, the effectiveness of the operation control switch needs to be tested to ensure the safety of elevator operation. The effectiveness test is to detect whether the switch is faulty, specifically whether the switch is effective and whether the switch has timed out (exceeding the preset holding time).

[0054] In an optional embodiment, the operation control switch includes a switching switch and an operation switch; determining whether to enter the preparatory state according to the validity of the operation control switch includes: detecting the validity of the switching switch, when the elevator is in a normal operation state, if the switching switch is valid, determining that the condition for entering the preparatory state of a specific state is triggered; if the switching switch is valid and the validity of the switching switch meets the preset first reasonable condition, determining that the preparatory state of the specific state is entered; if the switching switch is valid and the validity of the switching switch does not meet the preset first reasonable condition, determining that the switching switch is faulty. The first reasonable condition in this embodiment may be that the switching switch is valid and has not timed out.

[0055] In addition, when the switching switch is valid and meets the first reasonable condition, it can also be determined whether any operating switch is valid. If not, the system enters a preparatory state of a specific state. If yes, it is determined whether the operating switch is valid for timeout. If not, it returns to determine whether any operating switch is valid. If valid for timeout, it is determined that the operating switch is faulty.

[0056] In another optional embodiment, Figure 3 As shown, the operation control switch 12 includes a switching switch, and the switching switch includes a first switching switch ( Figure 3 Switch 1 in the switch) and the second switch ( Figure 3The switching switch 2 in the figure, the processor includes a first processor 131 and a second processor 132, the voting switch includes a first voting switch 231 and a second voting switch 232, the first switching switch and the first voting switch 231 are connected to the first processor 131, and the second switching switch and the second voting switch 232 are connected to the second processor 132; two processors and two switching switches are set, each switching switch corresponds to one processor, which can reduce the requirements for the switching switch and improve the response speed, thereby improving the safety and timeliness of elevator operation.

[0057] The condition for entering the preparatory state of a specific state is that at least one switching switch is valid; determining whether to enter the preparatory state according to the validity of the operation control switch includes:

[0058] Check whether the other switching switch is valid; if not, determine whether the duration of the inconsistency between the two switching switch signals has timed out, and if so, determine that the switching switch is faulty; if not, return to the step of checking whether the other switching switch is valid; if so, check whether there is a valid operating switch; if all operating switches are invalid, enter the standby state; if there is a valid operating switch and it is valid and has not timed out, return to the step of checking whether the other switching switch is valid; if there is a valid operating switch and it is valid and has timed out, determine that the operating switch is faulty.

[0059] When there are two switching switches, since the two switching switches are connected to two processors respectively, the two processors can obtain the status of the corresponding switching switches respectively. When one switching switch is valid and the other switching switch is invalid, it means that the signals of the two switching switches are inconsistent. At this time, it can be judged whether the inconsistency has timed out. If it has timed out, it means that the switching switch is faulty. Therefore, the voting switch can be controlled to disconnect to enter the safe state. When the corresponding switching switches are both valid, it means that the signals of the two switching switches are consistent. At this time, it is determined whether to enter the preparatory state according to the validity of the running switch. When the running switch is in an invalid state, it means that the running switch is normal. Therefore, if the running switches are all invalid, it means that the running switches are all normal. At this time, the preparatory state can be entered. If there is a running switch that is valid and has not timed out, and it cannot be determined that the running switch is faulty, it can be returned to continue to determine whether the other switching switch is valid; if there is a running switch that is valid and has timed out, it is determined that there is a running switch fault, and the corresponding voting switch is controlled to disconnect to enter the safe state.

[0060] S203: When the elevator does not enter the standby state, the corresponding voting switch is controlled to close, and the elevator returns to the normal operating state.

[0061] If the elevator does not enter the standby state, the corresponding voting switch will be controlled to close, so that the elevator can resume normal operation.

[0062] If the system enters the preparation state, it can be further determined whether to enter a specific state.

[0063] S204: When entering the preparatory state, determine whether to enter a specific state according to the validity of the operation control switch.

[0064] In an optional embodiment, the operation control switch includes a switching switch and an operation switch; determining whether to enter a specific state according to the validity of the operation control switch includes: detecting the validity of the operation switch; when the elevator enters the preparatory state, if there is a valid operation switch and the validity of the operation switch meets the preset second reasonable condition, then entering the specific state; if there is a valid operation switch and the validity of the operation switch does not meet the preset second reasonable condition, then determining that the operation switch is faulty.

[0065] Optionally, the operation switch may include an up button, a down button, and an operation button. The second reasonable condition in this embodiment is that only the up button and the operation button are valid or only the down button and the operation button are valid. In addition, when the valid state of the operation switch does not meet the second reasonable condition, the valid duration of the operation switch may be judged. Only when the valid duration has timed out, the operation switch failure is determined.

[0066] In another optional embodiment, Figure 3 As shown, the operation control switch 12 includes an operation switch, the operation switch includes an up button, a down button and a run button, the processor includes a first processor 131 and a second processor 132, the voting switch includes a first voting switch 231 and a second voting switch 232, the operation switches are connected to the first processor 131 and the second processor 132, the first switching switch and the first voting switch 231 are connected to the first processor 131, and the second switching switch and the second voting switch 232 are connected to the second processor 132.

[0067] Whether to enter a specific state is determined based on the validity of the operation control switch, including:

[0068] If the up button and the down button are valid at the same time, or the up button, the down button and the run button are valid at the same time and the validity timeout occurs, it is determined that the run switch is faulty; if the up button and the run button are valid at the same time, or the down button and the run button are valid, a specific state is entered.

[0069] Specifically, for the above three operating switches, when the elevator controller controls the operation of the elevator, when the run button and the up button are pressed at the same time, the elevator can be controlled to move upward and enter a specific state; when the run button and the down button are pressed at the same time, the elevator can be controlled to move downward and enter a specific state; when any operating switch is pressed alone or all three operating switches are pressed at the same time, the elevator does not run and cannot enter a specific state at this time. Therefore, it is checked whether the operating switch has a valid timeout. If the operating switch has a valid timeout, it means that the operating switch responds to a fault. At this time, the corresponding voting switch is controlled to be disconnected to ensure the safety of the elevator. If the operating switch response does not time out, it may be that the staff accidentally touched the button or inspected the activity of the button, etc. At this time, it can return to the standby state and determine again whether to enter a specific state.

[0070] S205. When entering a specific state, the corresponding voting switch is controlled to be closed, and the elevator controller controls the elevator operation according to the state of the operation control switch.

[0071] When entering a specific state, the processor controls the corresponding voting switch to close, so that the main motor is connected to the main power supply and is in the starting state, and the elevator controller can control the elevator operation according to the state of the operation control switch.

[0072] like Figure 1 or Figure 3 As shown, the operation control switch 12 includes a switching switch, an up button, a down button and an operation button. When the switching switch is in an effective state, if the up button and the operation button are pressed at the same time, the voting switches are all closed, the elevator safety control circuit is turned on, the main motor 25 is started, and the elevator controller 26 receives the state of the operation control switch 12 including an up signal, then the elevator controller 26 sends an up control instruction to the main motor 25, and the main motor 25 drives the elevator up; if the down button and the operation button are pressed at the same time, the voting switches are all closed, the elevator safety control circuit is turned on, the main motor 25 is started, and the elevator controller 26 receives the state of the operation control switch 12 including a down signal, then the elevator controller 26 sends a down control instruction to the main motor 25, and the main motor 25 drives the elevator down. When the elevator controller 26 detects that the switching switch is in an invalid state, it controls the main motor 25 to stop starting. It can be seen that the number of switches / buttons in the device of this scheme is small, the operation is simple, which is conducive to improving the correctness of user operation and improving the safety of elevator operation.

[0073] S206: When a failure of the operation control switch is detected, the corresponding voting switch is controlled to be disconnected, and the elevator enters a safe state.

[0074] When a running switch failure is detected, the safety requirements of the elevator operation are not met, so the corresponding voting switch is controlled to be disconnected, the main motor is disconnected from the main power supply, and the elevator stops running and enters a safe state. It should be noted that in the present invention, each time a running control switch failure is detected, if the voting switch is originally in a disconnected state, it can be kept in a disconnected state.

[0075] The embodiment of the present invention provides a safe operation control method, which has the following beneficial effects:

[0076] On the one hand, the operation control switch is connected to the processor, which reduces the wiring length. The processor is used to diagnose the switch device, which can reduce the number of switch devices, reduce the requirements for the switch itself, and make the device integrated, reducing the product size and cost. The reduction in wiring length can also reduce the voltage strength of the device power supply and improve the safety when using the operation control device.

[0077] On the other hand, the effectiveness of the operation control switch is highly correlated with the effectiveness and safety of the elevator operation control. Before the elevator enters the preparatory state or a specific state, a judgment is made based on the effectiveness of the operation control switch. Only when the operation control switch meets the safety conditions is it allowed to enter the preparatory state or the specific state. When a failure of the operation control switch is detected, the elevator enters the safe state, ensuring the safety of the elevator during maintenance or emergency electric operation.

[0078] In an optional embodiment, the operation control switch includes a switching switch, an up button, a down button and an operation button, and the safe operation control method further includes: when the elevator is in a normal operation state, detecting the validity of the switching switch; when the switching switches are all invalid, if at least one operation switch is valid and the validity timeout is exceeded, determining that the operation switch is faulty. When the elevator is operating normally, regularly detecting the validity of the operation control switch can ensure that the operation control switch is normal and improve the safety of elevator control.

[0079] In an optional embodiment, if Figure 4 As shown in the structural diagram of an operation control device, the input end of the processor is also connected to a preset safety switch 3, and the safe operation control method also includes: when the elevator is ready to enter an emergency electric operation state, bypassing the safety switch.

[0080] The preset safety switch includes at least one of a limit switch, a safety switch for safety gear, a slack rope safety switch, a safety switch for safety gear, a buffer safety switch and a speed limiter safety switch. The safety switch can be connected to the two processors in series or in parallel.

[0081] The elevator safety switch is an important part of the elevator safety system. Usually, when the elevator fails or is abnormal, emergency electric operation control is required, but at this time, some safety switches will trigger the processor to cut off the voting switch, causing the main motor to stop running, and the elevator to enter a safe stop state, and the elevator cannot perform emergency electric operation control. Therefore, when the elevator is ready for emergency electric operation, the processor bypasses the safety switch first.

[0082] It should be noted that when the number of switching switches in the operation control device is two and the number of processors is one, or when the number of switching switches and the number of processors are both one, the same processing method can also be adopted, which is not elaborated here.

[0083] In an optional embodiment, when the specific state is an emergency electric operation state, the safe operation control method also includes: before entering the preparatory state or the specific state, determining whether a maintenance switching valid signal is received; if so, stopping entering the preparatory state or the specific state; after entering the preparatory state or the specific state, determining whether a maintenance switching valid signal is received; if so, exiting the preparatory state or the specific state.

[0084] This setting is to make the priority of the maintenance function higher than the priority of the emergency electric operation function, in line with the specifications of elevator maintenance. When the operation control device is an emergency electric operation control device, it is necessary to monitor whether the maintenance switching valid signal is obtained at all times.

[0085] The maintenance switching effective signal can be a signal sent from the outside of the operation control device, for example, a maintenance switching effective signal sent by an external maintenance safety switch, maintenance position switch or other terminal. In an optional example, when the operation control device is an emergency electric operation control device, the input end of the processor is also connected to the switching switch of the maintenance device. When the switching switch is effective, the processor can obtain the maintenance switching effective signal; the maintenance switching effective signal can also be a signal generated inside the operation control device. For example, the operation control device also includes a maintenance signal generator, which can be used to regularly maintain the elevator.

[0086] In an optional embodiment of the present invention, after entering a specific state, the method further includes:

[0087] Detect if there is a toggle switch revocation;

[0088] If not, determine whether the operation switch meets the second reasonable condition; if the second reasonable condition is met, return to a specific state; if the second reasonable condition is not met, cancel the bypass safety switch and control the corresponding voting switch to be disconnected;

[0089] If yes, the corresponding voting switch is controlled to be disconnected;

[0090] Detect whether another toggle switch is revoked;

[0091] If not, determine whether the operation switch is valid and has timed out; if it has timed out, control the corresponding voting switch to be disconnected; if it has not timed out, return to the step of detecting whether there is a switch cancellation;

[0092] If so, check whether the running switch is valid;

[0093] If the running switches are all invalid, the corresponding voting switches are controlled to close and the elevator returns to normal operation;

[0094] If there is a valid running switch and it is valid for timeout, the corresponding voting switch is controlled to be disconnected. If there is a valid button and it is valid for timeout, the process returns to the step of detecting whether there is a valid running switch.

[0095] After entering a specific state, the two processors still need to continuously detect whether the conditions for maintaining a specific state are met. The conditions for maintaining a specific state are: the switching switch is not revoked and the operating switch meets the second reasonable condition. If the conditions for maintaining a specific state are not met, it is considered that the specific state needs to be exited. When exiting the specific state, the corresponding voting switch is controlled to be disconnected (if it is an emergency electric operation state, the safety switch must be bypassed first) to put the elevator in a safe stop state; then determine whether the operating switch is valid. If not, it indicates that the operating control device has no elevator operation control signal, then the corresponding voting switch can be controlled to close, and the elevator returns to a normal operating state; if there is still an operating switch in a valid state, determine whether the operating switch is valid for timeout. Timeout indicates that the operating switch is faulty, and the voting switch is controlled to be disconnected to ensure the safety of the elevator. If it is not valid for timeout, the operating switch fault cannot be determined temporarily, and return to detect the valid state of the operating switch.

[0096] The safe operation control method in the present invention mainly includes three stages, the first stage is from the normal state to the preparatory state, the second stage is from the preparatory state to the specific state, and the third stage is from the specific state to exiting the specific state. In order to clearly illustrate the safe operation control method in the present invention, the following emergency electric operation control device is used as an example to illustrate the three stages respectively, and there are 2 switching switches in the following example.

[0097] Phase 1: Figure 5 It is the logical judgment process of the elevator from the normal state to the preparatory state of the emergency electric operation state, such as Figure 5 As shown, from the normal state to the preparatory state, the following steps are included:

[0098] S11, start;

[0099] S12, normal state;

[0100] S13, judging whether any switch is effective;

[0101] If not, S14 is executed to detect the validity of the button (i.e., the operation control switch). If yes, S17 is executed to cut off the voting switch to stop the current operation of the elevator and prepare for entering the standby state.

[0102] When any switch is valid, the condition for entering the standby state is triggered. Switch or button valid means that the switch or button is in the valid state.

[0103] S14, judging whether any key is valid;

[0104] If yes, execute S15 to perform timeout detection, if no, return to S12 to return to normal state (or return to S13);

[0105] S15, determining whether any key has timed out;

[0106] If yes, execute S16 to enter the safe state, if no, execute S12 to return to the normal state;

[0107] S16, cut off the voting switch and enter the safe state;

[0108] S17, cut off the voting switch;

[0109] The function of switching the voting switch in this step is different from that of cutting off the voting switch in S16. This step is to stop the current operation of the elevator and prepare for entering the preparatory state. After S16, the preparatory state cannot be continued, but after S17, the preparatory state can be continued.

[0110] S18, determining whether the remaining switch is valid;

[0111] S13 requires only one switch to be valid, so it is not yet determined whether both switches are valid. This step is a supplementary determination. If so, it means that the two switches are synchronously valid, and S110 is executed to determine the validity of the key. If not, it means that the signals of the two switches are inconsistent, and S19 is executed to determine the signal timeout.

[0112] S19, determining whether there is a signal inconsistency timeout;

[0113] If yes, it means the switch is faulty, and S16 is executed to enter the safe state. If no, the switch fault cannot be determined temporarily, and the process returns to S18 to continue to determine the validity of the remaining switch.

[0114] S110, determining whether any key is valid;

[0115] If the key is invalid, it means that there are keys that are normal. If not, it means that all keys are normal, then S112 is executed to judge the maintenance signal. If yes, then S111 is executed to detect the key valid timeout;

[0116] S111, determining whether any key has timed out;

[0117] If the timeout is reached, it indicates that the key is faulty, and S16 is executed. If the timeout is not reached, the key fault cannot be determined temporarily, and S18 is returned.

[0118] S112, determining whether the switch in any maintenance state is valid;

[0119] If yes, execute S113, if no, execute S114;

[0120] S113, maintenance status switching detection;

[0121] When the switch of the maintenance state is in the effective state, since the priority of the maintenance function is higher than the priority of the emergency electric operation function, the emergency electric operation state preparation state cannot be entered at present, and only the maintenance state switching test can be performed;

[0122] S114, entering the preparation state;

[0123] When the switch of the maintenance state is in an invalid state, the standby state can be entered.

[0124] S115, end.

[0125] Phase 2: Figure 6 It is the logic judgment process of the elevator from the preparatory state of the emergency electric operation state to the emergency electric operation state, such as Figure 6 As shown, from the preparation state to the specific state, the following steps are included:

[0126] S21, start;

[0127] S22, ready state;

[0128] S23, judging whether any maintenance status switching switch is valid;

[0129] If yes, execute S24; if no, execute S25; the priority of the maintenance function is higher than the priority of the emergency operation function;

[0130] S24, maintenance status switching detection;

[0131] S25, cancel any switch;

[0132] There are two switching switches in this example. If any switching switch is cancelled and the conditions for entering the emergency electric operation state are not met, S261 is executed; if no switching switch is cancelled, S271 is executed;

[0133] S261, determining whether the remaining switch is canceled;

[0134] If yes, it means that the two switch signals are consistent, and S264 is executed to determine the validity of the key. If no, it means that the two switch signals are inconsistent, and S262 is executed to determine the signal inconsistency timeout.

[0135] S262, signal inconsistency timeout judgment;

[0136] If the signals are inconsistent but not timed out, the process returns to S261. If timed out, it indicates that the switch is faulty, and S263 is executed to cut off the safety switch.

[0137] S263, cut off the voting switch and enter the safe state;

[0138] S264, determining whether any key is valid;

[0139] At this time, the key being valid indicates that the key may be faulty. If there is a valid key, execute S265; if there is no valid key, execute S266;

[0140] S265, determining whether any key has timed out;

[0141] If yes, it means that there is a key failure, and then S263 is executed to cut off the safety switch; if no, it cannot be explained that the key failure exists temporarily, and then the process returns to S264 to continue the judgment;

[0142] S266, close the voting switch;

[0143] When there is no fault with the button and the emergency electric operation state cannot be entered, the voting switch is closed and ready to return to the normal state.

[0144] S267, return to normal state;

[0145] S271, determining that at least one key is valid;

[0146] If yes, execute S272, if no, execute S22 to return to the standby state;

[0147] S272, determining whether one or three keys are valid;

[0148] If yes, execute S273, if no, execute S275 to determine that both buttons are valid;

[0149] S273, determining whether the key has timed out;

[0150] It is abnormal that 1 or 3 keys are effective, so it is determined whether the key is effective for a timeout. If so, it indicates that the key is faulty, and S274 can be executed. If not, it cannot be explained that the key is faulty for the time being, and S22 is executed to return to the standby state;

[0151] S274, cut off the voting switch and enter the safe state;

[0152] S275, only two buttons are valid;

[0153] S276. Determine whether reasonable conditions are met;

[0154] If yes, the condition for entering the emergency electric operation state is currently met, and S277 is executed. If no, it means that the button may be faulty, and S273 is executed to analyze the button timeout situation;

[0155] S277, bypass related safety switch;

[0156] S278, close the voting switch;

[0157] S279, enter emergency electric operation state.

[0158] Phase 3: Figure 7 The logic judgment process of the elevator from the emergency electric running state to the exit of the emergency electric running state includes the following steps:

[0159] S31, emergency electric operation state;

[0160] S32, determining whether any switch is revoked;

[0161] If not, execute S33; if so, it means that the emergency electric operation control cannot be continued, and execute S361-S363;

[0162] S33, determining whether there is a valid key;

[0163] If yes, execute S34, if no, execute S371-S373 to return to the standby state;

[0164] S34, judging that the key validity is reasonable;

[0165] If reasonable, it indicates that the emergency electric operation control can still be continued, and S34 is executed to detect the maintenance status; if unreasonable, S381-S384 are executed to exit the emergency electric operation control;

[0166] S35, determining whether any maintenance status switching switch is valid;

[0167] If yes, then execute S36, if no, then return to S31 to continue emergency electric operation control;

[0168] S36, maintenance status switching detection;

[0169] S361, cancel bypass related safety switches;

[0170] S362, disconnect the voting switch;

[0171] S363, determining whether the remaining switching switches are cancelled;

[0172] If not, it means that the two switching signals are inconsistent, and S364 is executed to detect the signal inconsistency timeout. If so, S366 is executed to determine the validity of the key;

[0173] S364, determining whether the signal inconsistency has timed out;

[0174] If yes, it means the switch is faulty, and S365 is executed to cut off the safety circuit. If no, return to S363;

[0175] S365, disconnect the voting switch and enter the safe state;

[0176] S366, determining whether any key is valid;

[0177] If not, it means that the keys are all normal, then S368 is executed; if yes, it means that the keys may have timed out, then S367 is executed to perform a timeout detection on the keys;

[0178] S367, determining whether any key has timed out;

[0179] If yes, it means the button is faulty, and S365 is executed to cut off the safety circuit. If no, return to S366;

[0180] S368, close the voting switch;

[0181] S369, return to normal state;

[0182] S371, cancel the bypass safety switch;

[0183] S372, cut off the voting switch;

[0184] S373, return to the ready state;

[0185] S381, cancel the bypass safety switch;

[0186] S382, cut off the voting switch;

[0187] S383, exit the emergency electric operation state;

[0188] S384, end.

[0189] The logic control process of the maintenance state is similar to that of the emergency electric operation state. The main difference is that the logic control process corresponding to the maintenance state does not require a bypass safety switch, and the maintenance state is not affected by the emergency electric operation state. You can refer to the logic control process of the emergency electric operation state and will not go into details.

[0190] It can be seen from the above examples that the present invention controls the elevator at each stage by detecting the validity of switches / buttons and setting relevant logic to ensure the safety of the elevator during operation. At the same time, the number of buttons is small, the operation is simple, and it is more convenient for the operator.

[0191] Embodiment 2

[0192] The present invention provides an operation control device, comprising a processor and an operation control switch, wherein the operation control device is connected to an elevator control circuit, wherein the elevator control circuit comprises a main power supply, an elevator controller, a power supply line and at least one voting switch arranged on the power supply line, wherein the input end of the processor is connected to the operation control switch, and the output end of the processor is connected to the voting switch; the operation control device is also connected to the elevator controller for communication;

[0193] Figure 8 A schematic diagram of the structure of a processor is shown in FIG. Figure 8 As shown, the processor includes:

[0194] The trigger module 801 is used to control the corresponding voting switch to be disconnected when the elevator is in a normal operation state and the condition for entering a preparatory state of a specific state is triggered, wherein the specific state is an emergency electric operation state or a maintenance state;

[0195] A first judgment module 802, used to determine whether to enter the preparatory state according to the validity of the operation control switch;

[0196] The recovery module 803 is used to control the corresponding voting switch to close when the elevator does not enter the preparatory state, so that the elevator returns to the normal operating state;

[0197] A second judgment module 804 is used to determine whether to enter the specific state according to the validity of the operation control switch when entering the preparatory state;

[0198] A specific state entry module 805 is used to control the corresponding voting switch to close when entering the specific state, and the elevator controller controls the elevator operation according to the state of the operation control switch;

[0199] The safety control module 806 is used to control the corresponding voting switch to be disconnected when a failure of the operation control switch is detected, and the elevator enters a safe state.

[0200] The processor in the operation control device provided in the embodiment of the present invention can execute the safe operation control method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0201] Embodiment 3

[0202] Embodiment 3 of the present invention provides a security system, and its specific structure can be referred to Figure 1 , Figure 3 or Figure 4 The safety system includes an operation control device and an elevator control circuit. The operation control device is connected to the elevator control circuit, and the elevator control circuit includes a main power supply, an elevator controller, a power supply line, and at least one voting switch arranged on the power supply line. The input end of the processor is connected to the operation control switch, and the output end of the processor is connected to the voting switch; the operation control device is also connected to the elevator controller for communication. The relevant structures of the operation control device and the elevator control circuit can refer to the relevant contents in Example 1 and Example 2.

[0203] The safety system provided by the embodiment of the present invention can execute the safety operation control method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0204] Embodiment 4

[0205] Fig. 9 A schematic diagram of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0206] like Fig. 9 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0207] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0208] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 performs the various methods and processes described above, such as a safe operation control method.

[0209] In some embodiments, the safe operation control method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the safe operation control method described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to perform the safe operation control method in any other appropriate manner (e.g., by means of firmware).

[0210] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0211] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0212] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0213] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0214] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0215] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0216] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0217] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A safe operation control method, characterized in that: A processor applied to an operation control device, the operation control device further comprising an operation control switch, the operation control device being connected to an elevator control circuit, the elevator control circuit comprising a main power supply, an elevator controller, a power supply line and at least one voting switch arranged on the power supply line, the input ends of the processor being connected to the operation control switch, and the output ends of the processor being connected to the voting switch; The operation control device is also in communication connection with the elevator controller; The method comprises: When the elevator is in normal operation, if the condition for entering the preparatory state of a specific state is triggered, the corresponding voting switch is controlled to be disconnected, and the specific state is an emergency electric operation state or a maintenance state; Determining whether to enter the standby state according to the validity of the operation control switch; When the preparatory state is not entered, the corresponding voting switch is controlled to close, and the elevator returns to the normal operating state; When entering the preparatory state, determining whether to enter the specific state according to the validity of the operation control switch; When entering the specific state, the corresponding voting switch is controlled to be closed, and the elevator controller controls the elevator operation according to the state of the operation control switch; When a failure of the operation control switch is detected, the corresponding voting switch is controlled to be disconnected, and the elevator enters a safe state.

2. The method according to claim 1, characterized in that The operation control switch includes a switching switch and an operation switch; The step of determining whether to enter the standby state according to the validity of the operation control switch includes: Check the validity of the switch; When the elevator is in a normal operating state, if there is a valid switching switch, it is determined that the condition for entering the preparatory state of the specific state is triggered; If there is a valid switching switch and the validity of the switching switch meets the preset first reasonable condition, then determine to enter the preparatory state of the specific state; If there is a valid switch and the validity of the switch does not meet the preset first reasonable condition, it is determined that the switch is faulty; Determining whether to enter the specific state according to the validity of the operation control switch includes: Check the validity of the operation switch; When the elevator enters the standby state, if there is a valid running switch and the validity of the running switch meets the preset second reasonable condition, then the elevator enters the specific state; If there is a valid operating switch and the validity of the operating switch does not meet the preset second reasonable condition, it is determined that the operating switch is faulty.

3. The method according to claim 1, characterized in that The operation control switch includes a switching switch, the switching switch includes a first switching switch and a second switching switch, the processor includes a first processor and a second processor, the voting switch includes a first voting switch and a second voting switch, the first switching switch and the first voting switch are connected to the first processor, and the second switching switch and the second voting switch are connected to the second processor; The condition for entering the preparation state of a specific state is that at least one switching switch is valid; Determining whether to enter the standby state according to the validity of the operation control switch includes: Check if another toggle switch is active; If not, determine whether the duration of the inconsistency between the two switch signals has timed out. If so, determine that the switch is faulty. If not, return to the step of detecting whether the other switch is valid. If so, check whether the running switch is valid; If the operation switches are all invalid, the system enters the standby state; If there is a running switch that is valid and has not timed out, return to the step of detecting whether another switching switch is valid; if there is a running switch that is valid and has timed out, it is determined that the running switch is faulty.

4. The method according to claim 1, characterized in that The operation control switch includes an operation switch, and the operation switch includes an up button, a down button, and an operation button. The processor includes a first processor and a second processor. The voting switch includes a first voting switch and a second voting switch. The operation switches are connected to the first processor and the second processor. The first switching switch and the first voting switch are connected to the first processor. The second switching switch and the second voting switch are connected to the second processor. Determining whether to enter the specific state according to the validity of the operation control switch includes: If the up button and the down button are both valid, or the up button, the down button and the run button are both valid and have timed out, it is determined that the run switch is faulty; If the up button and the run button are both valid or the down button and the run button are valid, the specific state is entered.

5. The method according to claim 4, characterized in that Also includes: When the elevator is in normal operation, check the validity of the switch; When all the switching switches are invalid, if at least one operating switch is valid and the validity timeout has occurred, it is determined that the operating switch is faulty.

6. The method according to any one of claims 1 to 5, characterized in that: The input end of the processor is also connected to a preset safety switch, and the method further includes: When the elevator is ready to enter the emergency electric operation state, the safety switch is bypassed.

7. The method according to any one of claims 1 to 5, characterized in that: When the specific state is an emergency electric operation state, before entering the preparatory state or the specific state, the method further includes: Determine whether a maintenance switching valid signal is received; if so, stop entering the preparatory state or the specific state; After entering the preparation state or the specific state, the method further includes: Determine whether a maintenance switching valid signal is received; if so, exit the preparatory state or the specific state.

8. An operation control device, characterized in that: It includes a processor and an operation control switch, wherein the operation control device is connected to an elevator control circuit, wherein the elevator control circuit includes a main power supply, an elevator controller, a power supply line, and at least one voting switch arranged on the power supply line, wherein the input end of the processor is connected to the operation control switch, and the output end of the processor is connected to the voting switch; The operation control device is also connected to the elevator controller in communication; the processor includes: A trigger module is used to control the corresponding voting switch to be disconnected when the elevator is in a normal operating state and the condition for entering a preparatory state of a specific state is triggered, wherein the specific state is an emergency electric operation state or a maintenance state; A first judgment module, used to determine whether to enter the preparatory state according to the validity of the operation control switch; A recovery module, used for controlling the corresponding voting switch to close when the elevator does not enter the preparatory state, so that the elevator returns to a normal operating state; A second judgment module, used for determining whether to enter the specific state according to the validity of the operation control switch when entering the preparatory state; A specific state entry module, used for controlling the corresponding voting switch to close when entering the specific state, and the elevator controller controls the elevator operation according to the state of the operation control switch; The safety control module is used to control the corresponding voting switch to be disconnected when a failure of the operation control switch is detected, so that the elevator enters a safe state.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the safe operation control method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the safe operation control method according to any one of claims 1 to 7 when executed.

Images