Safe operation control methods, operation control devices, electronic equipment and storage media

Abstract

This invention discloses a safe operation control method, operation control device, electronic device, and storage medium, comprising: when the elevator is operating normally, if the condition for entering a preparatory state of a specific state is triggered, controlling the corresponding voting switch to open, the specific state being either an emergency electric operation state or a maintenance state; determining whether to enter the preparatory state based on the validity of the operation control switch; if not, controlling the corresponding voting switch to close, and the elevator returning to normal operation; if yes, determining whether to enter the specific state based on the validity of the operation control switch; when entering the specific state, bypassing the safety switch and controlling the corresponding voting switch to close, the elevator controller controlling the elevator operation according to the state of the operation control switch. The operation control switch is connected in parallel to the processor, reducing wiring length and lowering the requirements for the switching devices themselves. The determination based on the validity of the operation control switch ensures the safety of the elevator during maintenance or emergency electric operation.

Description

Technical Field

[0001] This invention relates to the field of elevator safety technology, and in particular to a safe operation control method, device, electronic equipment, and storage medium. Background Technology

[0002] Elevators are an indispensable mode of transportation in modern urban life, greatly facilitating people's travel. However, due to the special nature of elevators, safety is a major concern. To ensure elevator safety, on the one hand, regular elevator maintenance is necessary. This maintenance checks whether the elevator can move the car according to instructions. On the other hand, in the event of a sudden elevator malfunction, emergency electric operation is required to ensure the elevator can move the car safely for rescue and repair. This operation requires professional personnel to ensure safe and effective rescue. However, existing elevator maintenance and emergency electric operation control devices rely heavily on switches and buttons, which are typically power-type switches or buttons. Furthermore, due to long wiring and high operating voltage, the protection requirements and operating costs for these switches and buttons are high. Therefore, how to reduce the requirements for switches while ensuring the safety of elevator maintenance and emergency electric operation is an urgent problem to be solved. Summary of the Invention

[0003] To address the aforementioned technical problems, this invention provides a safe operation control method, an operation control device, electronic equipment, and a storage medium.

[0004] In a first aspect, the present invention provides a safe operation control method applied to a processor in an operation control device. The operation control device further includes an operation control switch. The operation control device is connected to an elevator control circuit. The elevator control circuit includes a main power supply, an elevator controller, a power supply line, and at least one voting switch installed on the power supply line. The input terminals of the processor are all connected to the operation control switch, and the output terminal of the processor is connected to the voting switch. The operation control device is also communicatively connected to the elevator controller.

[0005] The method includes:

[0006] When the elevator is in normal operation, if the condition for entering a specific state is triggered, the corresponding voting switch is disconnected. The specific state is either emergency electric operation or maintenance.

[0007] Whether to enter the preparatory state is determined based on the validity of the operation control switch;

[0008] When the elevator does not enter the preparatory state, the corresponding voting switch is closed, and the elevator returns to normal operation.

[0009] When entering the preparatory state, it is determined whether to enter the specific state based on the validity of the operation control switch;

[0010] When the specific state is entered, the corresponding voting switch is closed, and the elevator controller controls the elevator to run according to the state of the operation control switch.

[0011] When a fault is detected in the operation control switch, the corresponding voting switch is disconnected, and the elevator enters a safe state.

[0012] Secondly, the present invention provides an operation control device, including a processor and an operation control switch. The operation control device is connected to an elevator control circuit, the elevator control circuit including a main power supply, an elevator controller, a power supply line, and at least one voting switch disposed on the power supply line. The input terminals of the processor are all connected to the operation control switch, and the output terminal of the processor is connected to the voting switch. The operation control device is also communicatively connected to the elevator controller. The processor includes:

[0013] The trigger module is used to control the corresponding voting switch to open when the elevator is in normal operation and the condition for entering a specific state of preparation is triggered. The specific state is either emergency electric operation state or maintenance state.

[0014] The first judgment module is used to determine whether to enter the preparatory state based on the validity of the operation control switch;

[0015] The recovery module is used to control the corresponding voting switch to close when the elevator is not in the preparatory state, so that the elevator returns to the normal operating state.

[0016] The second judgment module is used to determine whether to enter the specific state based on the validity of the operation control switch when entering the preparatory state.

[0017] A specific state entry module is used to control the corresponding voting switch to close when the specific state is entered, and the elevator controller controls the elevator to run according to the state of the operation control switch;

[0018] The safety control module is used to control the corresponding voting switch to open when a fault is detected in the operation control switch, so that the elevator enters a safe state.

[0019] Thirdly, the present invention provides a safety system including an operation control device and an elevator control circuit as described in the second aspect. The operation control device further includes an operation control switch and a processor. The operation control device is connected to the elevator control circuit. The elevator control circuit includes a main power supply, an elevator controller, a power supply line, and at least one voting switch disposed on the power supply line. The input terminals of the processor are all connected to the operation control switch, and the output terminal of the processor is connected to the voting switch. The operation control device is also communicatively connected to the elevator controller.

[0020] Fourthly, the present invention provides an electronic device, the electronic device comprising:

[0021] At least one processor; and

[0022] A memory communicatively connected to the at least one processor; wherein,

[0023] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the safe operation control method described in the first aspect of the present invention.

[0024] Fifthly, the present invention provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the secure operation control method described in the first aspect of the present invention.

[0025] The safe operation control method provided in this embodiment of the invention has the following beneficial effects:

[0026] On the one hand, the operation control switch is connected to the processor, which reduces the wiring length. The processor is used to diagnose the switching devices, which reduces the requirements for the switching devices themselves. At the same time, it can reduce the number of switching devices, which also makes the device more integrated, reducing the product size and cost. The reduction in wiring length can also reduce the voltage intensity of the device power supply, improving the safety when using the operation control device.

[0027] On the other hand, the effectiveness of the operation control switch is highly related to the effectiveness and safety of elevator operation control. Before the elevator enters the preparatory state or a specific state, the effectiveness of the operation control switch is used to make a judgment. Only when the operation control switch meets the safety conditions is it allowed to enter the preparatory state or a specific state. When a fault is detected in the operation control switch, it enters the safe state, thus ensuring the safety of elevator maintenance or emergency electric operation.

[0028] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram of the structure of an operation control device provided in Embodiment 1 of the present invention;

[0031] Figure 2 This is a flowchart of a safe operation control method provided in Embodiment 1 of the present invention;

[0032] Figure 3 This is a schematic diagram of another operation control device provided in Embodiment 1 of the present invention;

[0033] Figure 4 This is a schematic diagram of the structure of another operation control device provided in Embodiment 1 of the present invention;

[0034] Figure 5 This is a logical judgment process for an elevator to transition from a normal state to an emergency electric operation state, as provided in Embodiment 1 of the present invention.

[0035] Figure 6 This is a logical judgment process for an elevator to transition from a preparatory state to an emergency electric operation state, as provided in Embodiment 1 of the present invention.

[0036] Figure 7 This is a logical judgment process for an elevator to go from emergency electric operation state to exiting emergency electric operation state, provided in Embodiment 1 of the present invention.

[0037] Figure 8 This is a schematic diagram of the structure of a processor provided in Embodiment 2 of the present invention;

[0038] Figure 9 This is a schematic diagram of the structure of the electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0039] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0040] Example 1

[0041] This invention provides a flowchart of a safe operation control method. This embodiment is applicable to situations involving safe maintenance or emergency electric operation of elevators. The method can be executed by a processor in an operation control device, which can be implemented in hardware and / or software and can be configured in an electronic device.

[0042] Figure 1 This is a schematic diagram of the structure of an operation control device provided in an embodiment of the present invention, as shown below. Figure 1 As shown, the operation control device 1 is connected to the elevator control circuit. The elevator control circuit includes a main power supply 21, an elevator controller 26, a power supply line 22, and at least one voting switch 23 installed on the power supply line 22. It also includes a safety execution subsystem 24 and a main motor 25. The operation control device 1 includes an operation control switch 12 and a processor 13, as well as a device power supply 11. The input terminals of the first processor 13 and the second processor 14 are both connected to the operation control switch 12. The input terminals of the processor 13 are all connected to the operation control switch 12, and the output terminal of the processor 13 is connected to the voting switch 23. The operation control device 1 is also connected to the elevator controller communication 26, so the operation control device 1 can send the status of the operation control switch 12 and related judgment results to the elevator controller 26. The operation control switch 12 is a signal type switch, which can be controlled by a small current or voltage (3V-24V), which is lower than the safe voltage of 36V, ensuring the safety of the operator.

[0043] Figure 2 A flowchart of a safe operation control method provided in Embodiment 1 of the present invention is shown below. Figure 2 As shown, the safe operation control method includes:

[0044] S201. When the elevator is in normal operation, if the condition for entering the preparatory state of a specific state is triggered, the corresponding voting switch is disconnected.

[0045] The specific state is either emergency electric operation state or maintenance state, that is, the electric operation device can be an emergency electric operation control device or a maintenance device.

[0046] In one optional embodiment, the operation control device has a state switching function. The switching switch can be a single-pole three-throw switch, which includes a lever and three contacts. It can be set that when the lever is connected to different contacts, the operation control device is in different circuit states. For example, when the lever is connected to the first contact, no preparatory state is considered to be triggered; when the second contact is connected, the preparatory state for emergency electric operation is considered to be triggered; and when the third contact is connected, the preparatory state for maintenance is considered to be triggered. In another optional embodiment, the processor is also connected to an external terminal. The external terminal can send a preparatory state command to the operation device. Upon receiving the preparatory state command, it is considered that the condition for entering the relevant preparatory state has been triggered. When the condition for the preparatory state of emergency electric operation is triggered, the operation control device is an emergency electric operation control device; when the condition for the preparatory state of maintenance is triggered, the operation control device is a maintenance device.

[0047] like Figure 1 As shown, in one scenario, when the switch connected to the processor is active, the condition for entering the preparatory state is considered triggered; in this case, the condition for entering the preparatory state is that the switch is active. In another scenario, such as... Figure 3 The schematic diagram of another type of electric operating device shows that the operating control switch 12 includes a first switching switch (i.e., switching switch 1) and a second switching switch (i.e., switching switch 2), and the processor 13 includes a first processor 131 and a second processor 132. The switching switches can be single-pole double-throw switches. The first switching switch is connected to the first processor 131, and the second switching switch is connected to the second processor 132. When either switching switch is active, the condition for entering the preparatory state is considered to have been triggered.

[0048] In summary, there can be multiple ways to trigger the conditions for entering the standby state. The operation control device can be a device that integrates emergency electric operation control function and maintenance function, or it can be a separate emergency electric operation device or maintenance device. This invention does not limit these possibilities.

[0049] It should also be noted that the active state of the operation control switch can correspond to either the closed or open state of the operation control switch. This is because the processor processes data based on the signals from the operation control switch, and both the closed and open states of the operation control switch can provide signals. Therefore, the open and closed states corresponding to the active state of the operation control switch can be set according to actual needs.

[0050] When the conditions for entering the preparatory state are triggered, the elevator is in normal operation. If the elevator is performing a call task, the processor controls the corresponding voting switch to open, which puts the elevator into a safe stop state and ends the current call task, allowing for further analysis on whether to enter the preparatory state. This step of opening the corresponding voting switch is to stop the elevator's current operation and prepare for entering the preparatory state. However, in the event of a fault or abnormality, opening the corresponding voting switch is to enter a safe state. The purpose of opening the voting switch differs in these two situations.

[0051] S202. Determine whether to enter the standby state based on the effectiveness of the operation control switch.

[0052] If not, then execute S203; if yes, then execute S204.

[0053] Under normal circumstances, before using the operation control device, the operation control switch in the device is usually in an inactive or deactivated state. Furthermore, it is abnormal for a switch to remain in an active state for an extended period. Therefore, before entering the standby state, the effectiveness of the operation control switch must be checked to ensure elevator operation safety. The effectiveness check verifies whether the switch is faulty, specifically whether it is effective and whether the effective timeout has exceeded the preset holding time.

[0054] In an optional embodiment, the operation control switch includes a switching switch and an operation switch. Determining whether to enter the preparatory state based on the validity of the operation control switch includes: detecting the validity of the switching switch; when the elevator is in normal operation, if the switching switch is valid, then determining that the condition for entering the preparatory state of a specific state has been triggered; if a switching switch is valid and the validity of the switching switch meets a preset first reasonable condition, then determining that the preparatory state of the specific state has been entered; if a switching switch is valid but the validity of the switching switch does not meet the preset first reasonable condition, then determining that the switching switch is faulty. In this embodiment, the first reasonable condition may be that the switching switch is valid and has not timed out.

[0055] Furthermore, when the changeover switch is valid and meets the first reasonable condition, it can also determine whether any operating switch is valid. If not, it enters a preparatory state for a specific state. If so, it determines whether the operating switch has timed out. If it has not timed out, it returns to determining whether any operating switch is valid. If it has timed out, the operating switch is determined to be faulty.

[0056] In another alternative embodiment, such as Figure 3 As shown, the operation control switch 12 includes a switching switch, and the switching switch includes a first switching switch ( Figure 3 Switch 1) and switch 2) Figure 3The system includes a switching switch 2), a processor including a first processor 131 and a second processor 132, and a voting switch including a first voting switch 231 and a second voting switch 232. The first switching switch and the first voting switch 231 are connected to the first processor 131, and the second switching switch and the second voting switch 232 are connected to the second processor 132. By setting up two processors and two switching switches, with each switching switch corresponding to one processor, the requirements for the switching switches can be reduced and the response speed can be improved, thereby enhancing the safety and timeliness of elevator operation.

[0057] The condition for entering a specific preparatory state is that at least one switching switch is active; determining whether to enter the preparatory state based on the effectiveness of the operation control switch includes:

[0058] Check if the other switch is valid; if not, determine if the duration of the signal inconsistency between the two switches has exceeded the time limit. If it has, the switch is determined to be faulty; if it has not exceeded the time limit, return to the step of checking if the other switch is valid; if yes, check if any running switch is valid; if all running switches are invalid, enter the preparation state; if a running switch is valid and its validity has not expired, return to the step of checking if the other switch is valid; if a running switch is valid and its validity has expired, the running switch is determined to be faulty.

[0059] When there are two switchers, each connected to a separate processor, both processors can obtain the status of their respective switchers. When one switch is active while the other is inactive, it indicates a mismatch in the signals. In this case, it can be determined whether the mismatch has timed out. If it has, it indicates a switch malfunction, and the voting switch can be opened to enter a safe state. When both switches are active, the signals are consistent. The validity of the running switch determines whether to enter a standby state. An inactive running switch indicates it is functioning correctly. Therefore, if all running switches are inactive, they are functioning correctly, and the standby state can be entered. If one running switch is active and its active timeout has not expired, a malfunction cannot be determined, and the process can return to checking the other switch. If one running switch is active but its active timeout has expired, a malfunction is determined, and the corresponding voting switch is opened to enter a safe state.

[0060] S203. When not in the preparatory state, control the corresponding voting switch to close, and the elevator returns to normal operation.

[0061] If the elevator does not enter the standby state, the corresponding voting switch will be closed, allowing the elevator to return to normal operation.

[0062] If the system enters the preparation state, it can then be further determined whether a specific state has been entered.

[0063] S204. When entering the standby state, determine whether to enter a specific state based on the validity of the operation control switch.

[0064] In an optional embodiment, the operation control switch includes a switching switch and an operation switch; determining whether to enter a specific state based on the validity of the operation control switch includes: detecting the validity of the operation switch; when the elevator enters the preparatory state, if there is an operation switch that is valid and the validity of the operation switch meets a preset second reasonable condition, then the specific state is entered; if there is an operation switch that is valid and the validity of the operation switch does not meet the preset second reasonable condition, then the operation switch is determined to be faulty.

[0065] Optionally, the operation switch may include an up button, a down button, and an operation button. In this embodiment, the second reasonable condition is that only the up button and the operation button are valid, or only the down button and the operation button are valid. Furthermore, if the effective state of the operation switch does not meet the second reasonable condition, the effective duration of the operation switch can be judged, and the operation switch is determined to be faulty only if the effective timeout occurs.

[0066] In another alternative embodiment, such as Figure 3 As shown, the operation control switch 12 includes an operation switch, which includes an up button, a down button, and an operation button. The processor includes a first processor 131 and a second processor 132. The voting switch includes a first voting switch 231 and a second voting switch 232. The operation switches are all connected to the first processor 131 and the second processor 132. The first switching switch and the first voting switch 231 are connected to the first processor 131. The second switching switch and the second voting switch 232 are connected to the second processor 132.

[0067] Determining whether to enter a specific state based on the validity of the operation control switch includes:

[0068] If both the up and down buttons are active simultaneously, or if the up, down, and run buttons are active simultaneously and the active timeout occurs, then the run switch is determined to be faulty; if both the up and run buttons are active simultaneously, or if both the down and run buttons are active, then a specific state is entered.

[0069] Specifically, regarding the three operation switches mentioned above, when the elevator controller is controlling the elevator to run, pressing the run button and the up button simultaneously will control the elevator to move upwards and enter a specific state; pressing the run button and the down button simultaneously will control the elevator to move downwards and enter a specific state. Pressing any one of the operation switches individually or pressing all three operation switches simultaneously will not cause the elevator to run, and it will be impossible to enter a specific state. Therefore, the validity of the operation switch timeout is checked. If the operation switch has a valid timeout, it indicates a malfunction in the operation switch response. In this case, the corresponding voting switch is disconnected to ensure elevator safety. If the operation switch response does not time out, it may be due to accidental button press by staff or maintenance of the button's movement. In this case, the system can return to the standby state and re-determine whether to enter a specific state.

[0070] S205. When a specific state is entered, the corresponding voting switch is closed, and the elevator controller controls the elevator operation according to the state of the operation control switch.

[0071] When a specific state is entered, the processor controls the corresponding voting switch to close, so that the main motor is connected to the main power supply and is in the start state. Then the elevator controller can control the elevator operation according to the state of the operation control switch.

[0072] like Figure 1 or Figure 3 As shown, the operation control switch 12 includes a toggle switch, an up button, a down button, and a run button. When the toggle switch is active, if the up button and the run button are pressed simultaneously, both toggle switches are closed, the elevator safety control circuit is activated, and the main motor 25 is started. The elevator controller 26 receives an up signal from the operation control switch 12 and sends an up control command to the main motor 25, which then drives the elevator upwards. Similarly, if the down button and the run button are pressed simultaneously, both toggle switches are closed, the elevator safety control circuit is activated, the main motor 25 is started, and the elevator controller 26 receives a down signal from the operation control switch 12 and sends a down control command to the main motor 25, which then drives the elevator downwards. When the elevator controller 26 detects that the toggle switch is inactive, it stops the main motor 25 from starting. Therefore, this solution uses fewer switches / buttons, is simple to operate, and improves user accuracy and elevator operation safety.

[0073] S206. When a fault is detected in the operation control switch, the corresponding voting switch is disconnected, and the elevator enters a safe state.

[0074] When a fault is detected in the operation switch, failing to meet the safety requirements for elevator operation, the corresponding voting switch is opened, disconnecting the main motor from the main power supply circuit, stopping the elevator and entering a safe state. It should be noted that in this invention, if the voting switch is already in the open state when a fault is detected in the operation control switch, it will remain open.

[0075] The safe operation control method provided in this embodiment of the invention has the following beneficial effects:

[0076] On the one hand, by connecting the operation control switch to the processor, the wiring length is reduced, and the processor is used to diagnose the switching devices, which can reduce the number of switching devices, lower the requirements for the switches themselves, and also make the device integrated, reducing the product size and cost; the reduction in wiring length can also reduce the voltage intensity of the device power supply, improving the safety when using the operation control device.

[0077] On the other hand, the effectiveness of the operation control switch is highly related to the effectiveness and safety of elevator operation control. Before the elevator enters the preparatory state or a specific state, the effectiveness of the operation control switch is used to make a judgment. Only when the operation control switch meets the safety conditions is it allowed to enter the preparatory state or a specific state. When a fault is detected in the operation control switch, it enters the safe state, thus ensuring the safety of elevator maintenance or emergency electric operation.

[0078] In an optional embodiment, the operation control switch includes a toggle switch, an up button, a down button, and a run button. The safe operation control method further includes: when the elevator is in normal operation, detecting the validity of the toggle switch; when all toggle switches are invalid, if at least one run switch is valid and its validity has timed out, then the run switch is determined to be faulty. Periodically detecting the validity of the operation control switch during normal elevator operation can ensure the normal operation of the run control switch and improve the safety of elevator control.

[0079] In an optional embodiment, such as Figure 4 The diagram shows a structural schematic of an operation control device. The input terminal of the processor is also connected to a preset safety switch 3. The safe operation control method also includes: when the elevator is about to enter the emergency electric operation state, the bypass safety switch is activated.

[0080] The preset safety switches include at least one of the following: limit switch, safety gear safety switch, slack rope safety switch, buffer safety switch, and speed limiter safety switch. The safety switches can be connected to the two processors in series or parallel.

[0081] Elevator safety switches are a crucial component of elevator safety systems. Typically, in the event of an elevator malfunction or abnormality, emergency electric operation control is required. However, in such situations, some safety switches may trigger the processor to cut off the voting switch, causing the main motor to stop and the elevator to enter a safe stop state, thus preventing emergency electric operation control. Therefore, when the elevator is preparing for emergency electric operation, the processor first bypasses the safety switches.

[0082] It should be noted that when there are two switches and one processor in the operation control device, or when there is one switch and one processor, the same processing method can be used, which will not be elaborated here.

[0083] In an optional embodiment, when the specific state is an emergency electric operation state, the safe operation control method further includes: before entering the preparatory state or the specific state, determining whether a valid maintenance switching signal is received; if so, stopping the entry into the preparatory state or the specific state; after entering the preparatory state or the specific state, determining whether a valid maintenance switching signal is received; if so, exiting the preparatory state or the specific state.

[0084] This setting is to prioritize the maintenance function over the emergency electric operation function, which complies with elevator maintenance standards. Therefore, when the operation control device is the emergency electric operation control device, it is necessary to constantly monitor whether a valid maintenance switching signal is obtained.

[0085] The maintenance switching valid signal can be a signal sent from outside the operation control device, such as a maintenance safety switch, maintenance position switch, or other terminal. In an optional example, when the operation control device is an emergency electric operation control device, the processor's input is also connected to the maintenance device's switching switch. When the switching switch is active, the processor can obtain the maintenance switching valid signal. The maintenance switching valid signal can also be a signal generated internally by the operation control device. For example, the operation control device also includes a maintenance signal generator, which can be used to periodically inspect the elevator.

[0086] In an optional embodiment of the present invention, after entering a specific state, the method further includes:

[0087] Check if the switch has been deactivated;

[0088] If not, determine whether the operation switch meets the second reasonable condition; if the second reasonable condition is met, return to the specific state; if the second reasonable condition is not met, cancel the bypass safety switch and control the corresponding voting switch to open.

[0089] If so, then control the corresponding voting switch to disconnect;

[0090] Check if the other switch has been deactivated;

[0091] If not, determine whether the operation switch has timed out; if it has timed out, control the corresponding voting switch to open; if it has not timed out, return to the step of checking whether the switching switch has been cancelled.

[0092] If so, check if the running switch is active;

[0093] If all operation switches are ineffective, the corresponding voting switch is closed, and the elevator returns to normal operation.

[0094] If a running switch is valid and the validity period has expired, the corresponding voting switch is turned off. If a button is valid and the validity period has not expired, the process returns to the step of checking if a running switch is valid.

[0095] After entering a specific state, both processors must continuously check whether the conditions for maintaining the specific state are met. The conditions for maintaining the specific state are: the switching switch is not revoked and the running switch meets the second reasonable condition. If the conditions for maintaining the specific state are not met, it is considered that the specific state needs to be exited. When exiting the specific state, the corresponding voting switch is opened (if it is an emergency electric operation state, the safety switch must be bypassed first) to put the elevator in a safe stop state; then it is checked whether the running switch is valid. If not, it indicates that the operation control device has no elevator operation control signal, so the corresponding voting switch can be closed and the elevator returns to the normal operation state; if there is still a running switch in the valid state, it is checked whether the running switch has expired. If it has expired, it indicates that the running switch is faulty, and the voting switch is opened to ensure the safety of the elevator. If it has not expired, it cannot be determined that the running switch is faulty for the time being, and the system returns to checking the validity of the running switch.

[0096] The safe operation control method of this invention mainly includes three stages: the first stage is from the normal state to the ready state; the second stage is from the ready state to the specific state; and the third stage is from the specific state to exiting the specific state. To clearly illustrate the safe operation control method of this invention, the following emergency electric operation control device will be used as an example to explain the three stages respectively. In the following example, there are two switching switches.

[0097] Phase 1: Figure 5 The logical judgment process for the elevator to transition from normal state to emergency electric operation state, such as... Figure 5 As shown, the transition from the normal state to the ready state includes the following steps:

[0098] S11, Begin;

[0099] S12, Normal state;

[0100] S13. Determine if any switch is valid;

[0101] If not, execute S14 to check the validity of the button (i.e., the operation control switch); if yes, execute S17 to cut off the voting switch to stop the elevator's current operation and prepare for entering the standby state.

[0102] The condition for entering the standby state is triggered when any toggle switch is active. "Active switch or button" means that the switch or button is in an active state.

[0103] S14. Determine if any button is valid;

[0104] If yes, then execute S15 to perform a timeout check; if no, then return to S12 to return to the normal state (or return to S13).

[0105] S15. Determine whether any key press has timed out.

[0106] If yes, execute S16 to enter the safe state; otherwise, execute S12 to return to the normal state.

[0107] S16. Disconnect the voting switch and enter the safe state;

[0108] S17. Disconnect the voting switch;

[0109] The function of switching the voting switch in this step differs from that of cutting off the voting switch in S16. This step is to stop the elevator's current operation and prepare for entering the standby state. It is impossible to enter the standby state after S16, but it is possible to enter the standby state after S17.

[0110] S18. Determine whether the remaining switch is valid;

[0111] S13 requires only one switch to be valid, so it is not yet possible to determine whether both switches are valid. This step makes a supplementary judgment. If yes, it means that both switches are valid simultaneously, so S110 is executed to judge the validity of the button. If no, it means that the signals of the two switches are inconsistent, so S19 is executed to judge the signal timeout.

[0112] S19. Determine if there is a signal inconsistency timeout;

[0113] If yes, it indicates that the switch is faulty, and S16 is executed to enter the safe state; otherwise, it is temporarily impossible to determine that the switch is faulty, so return to S18 to continue to determine the validity of the remaining switch.

[0114] S110. Determine whether any button is valid;

[0115] If a button is invalid, it means that some buttons are working properly. If not, it means that all buttons are working properly. Then, execute S112 to check the maintenance signal. If yes, execute S111 to check the button validity timeout.

[0116] S111. Determine whether any key press has timed out.

[0117] If the timeout occurs, it indicates a button malfunction, and S16 is executed. If the timeout does not occur, it is temporarily impossible to determine whether the button is malfunctioning, so S18 is returned.

[0118] S112. Determine whether the switch for any maintenance status is valid;

[0119] If yes, execute S113; otherwise, execute S114.

[0120] S113, Maintenance status switching detection;

[0121] When the switch for maintenance status is active, since the priority of the maintenance function is higher than that of the emergency electric operation function, it is not possible to enter the preparatory state for emergency electric operation. Only maintenance status switching detection can be performed.

[0122] S114. Enter the ready state;

[0123] When the maintenance status switching is in an invalid state, it can enter the standby state.

[0124] S115, End.

[0125] Phase Two: Figure 6 The logical judgment process for the elevator to transition from the preparatory state to the emergency electric operation state, such as... Figure 6 As shown, the transition from the preparatory state to a specific state includes the following steps:

[0126] S21, Begin;

[0127] S22, Ready state;

[0128] S23. Determine whether any maintenance status switch is effective;

[0129] If yes, then execute S24; if no, then execute S25; the maintenance function has a higher priority than the emergency operation function.

[0130] S24. Maintenance status switching detection;

[0131] S25. Cancel any switch;

[0132] In this example, there are two switching switches. If any switching switch is deactivated, and the conditions for entering the emergency electric operation state are not met, then S261 is executed; if no switching switch is deactivated, then S271 is executed.

[0133] S261. Determine whether the remaining switch should be deactivated;

[0134] If yes, it means that the two switch signals are consistent, and S264 is executed to determine the validity of the button; if no, it means that the two switch signals are inconsistent, and S262 is executed to determine the signal inconsistency timeout.

[0135] S262, Signal inconsistency timeout judgment;

[0136] If the signals are inconsistent but the timeout has not occurred, return to S261. If the timeout has occurred, it indicates that the switching switch is faulty, and then execute S263 to cut off the safety switch.

[0137] S263. Disconnect the voting switch and enter the safe state;

[0138] S264. Determine if any key is valid;

[0139] If a button is active at this time, it indicates that the button may be faulty. If a button is active, execute S265; otherwise, execute S266.

[0140] S265. Determine whether any key press has timed out.

[0141] If yes, it indicates a button malfunction, and S263 is executed to cut off the safety switch; if no, it cannot be determined that there is a button malfunction, and the process returns to S264 to continue the judgment.

[0142] S266. Close the voting switch;

[0143] If the button is functioning correctly and cannot enter the emergency electric operation state, then close the voting switch to prepare to return to the normal state.

[0144] S267. Return to normal state;

[0145] S271. Determine that at least one button is valid;

[0146] If yes, then execute S272; otherwise, execute S22 to return to the ready state.

[0147] S272. Determine whether one or three buttons are valid;

[0148] If yes, then execute S273; otherwise, execute S275 to confirm that both buttons are valid.

[0149] S273. Determine if the button press has timed out.

[0150] It is abnormal for one or three buttons to be valid. Therefore, it is necessary to determine whether the button validity timeout has occurred. If so, it indicates a button malfunction, and S274 can be executed. If not, it is not possible to determine a button malfunction at this time, and S22 is executed to return to the standby state.

[0151] S274. Disconnect the voting switch and enter the safe state;

[0152] S275, Only two buttons are active;

[0153] S276. Determine whether the reasonable conditions are met;

[0154] If yes, the conditions for entering the emergency electric operation state are met, and S277 is executed; if no, it indicates that the button may be faulty, and S273 is executed to analyze the button timeout situation.

[0155] S277, bypass related safety switch;

[0156] S278. Close the voting switch;

[0157] S279, Enter emergency electric operation mode.

[0158] Phase Three: Figure 7 The logical decision-making process for the elevator to transition from emergency electric operation to exiting emergency electric operation includes the following steps:

[0159] S31, Emergency electric operation status;

[0160] S32. Determine whether any switch has been deactivated;

[0161] If not, then execute S33; if yes, it means that emergency electric operation control cannot continue at present, then execute S361-S363.

[0162] S33. Determine if any key is valid;

[0163] If yes, then execute S34; otherwise, execute S371-S373 to return to the ready state.

[0164] S34. The validity of the button is deemed reasonable;

[0165] If the indication is reasonable, emergency electric operation control can continue, and S34 will be executed to check the maintenance status; if it is unreasonable, S381-S384 will be executed to exit emergency electric operation control.

[0166] S35. Determine if any maintenance status switch is valid;

[0167] If yes, then execute S36; otherwise, return to S31 to continue emergency electric operation control.

[0168] S36, Maintenance status switching detection;

[0169] S361. Cancel the bypass-related safety switches;

[0170] S362, Disconnect the voting switch;

[0171] S363. Determine whether the remaining toggle switches should be deactivated;

[0172] If not, it means that the two switching signals are inconsistent. Execute S364 to detect signal inconsistency timeout. If yes, execute S366 to determine the validity of the button.

[0173] S364. Determine if signal inconsistency has timed out;

[0174] If yes, it indicates a fault in the switch, and S365 is executed to cut off the safety circuit; otherwise, return to S363.

[0175] S365. Disconnect the voting switch and enter the safe state;

[0176] S366. Determine if any key is valid;

[0177] If not, it means that all buttons are working properly, so execute S368; if yes, it means that the buttons may have timed out, so execute S367 to check the timeout of the buttons.

[0178] S367. Determine if any key press has timed out;

[0179] If yes, it indicates a button malfunction, and S365 is executed to cut off the safety circuit; otherwise, return to S366.

[0180] S368. Close the voting switch;

[0181] S369. Return to normal state;

[0182] S371, Cancel the bypass safety switch;

[0183] S372, Disconnect the voting switch;

[0184] S373, Return to ready state;

[0185] S381. Cancel the bypass safety switch;

[0186] S382, Disconnect the voting switch;

[0187] S383, Exit emergency electric operation mode;

[0188] S384, End.

[0189] The logic control process for maintenance status is similar to that for emergency electric operation status. The main difference is that the logic control process for maintenance status does not require a bypass safety switch, and maintenance status is not affected by emergency electric operation status. You can refer to the logic control process for emergency electric operation status, which will not be repeated here.

[0190] As can be seen from the above examples, the present invention controls the elevator by detecting the validity of switches / buttons and setting relevant logic at each stage, ensuring the safety of the elevator operation. At the same time, the number of buttons is small, the operation is simple, and it is convenient for the operator.

[0191] Example 2

[0192] This invention provides an operation control device, including a processor and an operation control switch. The operation control device is connected to an elevator control circuit, which includes a main power supply, an elevator controller, a power supply line, and at least one voting switch installed on the power supply line. The input terminals of the processor are all connected to the operation control switch, and the output terminal of the processor is connected to the voting switch. The operation control device is also communicatively connected to the elevator controller.

[0193] Figure 8 This is a schematic diagram of the structure of a processor, such as... Figure 8 As shown, the processor includes:

[0194] The trigger module 801 is used to control the corresponding voting switch to open when the elevator is in normal operation and the condition for entering a specific state of preparation is triggered. The specific state is either emergency electric operation state or maintenance state.

[0195] The first judgment module 802 is used to determine whether to enter the preparatory state based on the validity of the operation control switch;

[0196] The recovery module 803 is used to control the corresponding voting switch to close when the elevator is not in the preparatory state, so that the elevator returns to the normal operating state.

[0197] The second judgment module 804 is used to determine whether to enter the specific state based on the validity of the operation control switch when entering the preparatory state.

[0198] The specific state entry module 805 is used to control the corresponding voting switch to close when the specific state is entered, and the elevator controller controls the elevator to run according to the state of the operation control switch.

[0199] The safety control module 806 is used to control the corresponding voting switch to open when a fault is detected in the operation control switch, so that the elevator enters a safe state.

[0200] The processor in the operation control device provided in the embodiments of the present invention can execute the safe operation control method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0201] Example 3

[0202] Embodiment 3 of the present invention provides a security system, the specific structure of which can be referred to Figure 1 , Figure 3 or Figure 4 The safety system includes an operation control device and an elevator control loop. The operation control device is connected to the elevator control loop, which includes a main power supply, an elevator controller, a power supply line, and at least one voting switch installed on the power supply line. The processor's input terminals are all connected to the operation control switch, and the processor's output terminal is connected to the voting switch. The operation control device is also communicatively connected to the elevator controller. The relevant structures of the operation control device and the elevator control loop can be found in Embodiments 1 and 2.

[0203] The safety system provided in the embodiments of the present invention can execute the safety operation control method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0204] Example 4

[0205] Figure 9 A schematic diagram of an electronic device 40 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0206] like Figure 9 As shown, the electronic device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded into the RAM 43 from storage unit 48. The RAM 43 may also store various programs and data required for the operation of the electronic device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0207] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0208] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as secure operation control methods.

[0209] In some embodiments, the secure operation control method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the secure operation control method described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to perform the secure operation control method by any other suitable means (e.g., by means of firmware).

[0210] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0211] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0212] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0213] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0214] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0215] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0216] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0217] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A safe operation control method, characterized in that, A processor is used in an operation control device, which also includes an operation control switch. The operation control device is connected to an elevator control circuit, which includes a main power supply, an elevator controller, a power supply line, and at least one voting switch installed on the power supply line. The input terminals of the processor are all connected to the operation control switch, and the output terminal of the processor is connected to the voting switch. The operation control device is also communicatively connected to the elevator controller; The method includes: When the elevator is in normal operation, if the condition for entering a specific state is triggered, the corresponding voting switch is disconnected. The specific state is either emergency electric operation or maintenance. Whether to enter the preparatory state is determined based on the validity of the operation control switch; When the elevator does not enter the preparatory state, the corresponding voting switch is closed, and the elevator returns to normal operation. When entering the preparatory state, it is determined whether to enter the specific state based on the validity of the operation control switch; When the specific state is entered, the corresponding voting switch is closed, and the elevator controller controls the elevator to run according to the state of the operation control switch. When a fault is detected in the operation control switch, the corresponding voting switch is disconnected, and the elevator enters a safe state.

2. The method as described in claim 1, characterized in that, The operation control switch includes a switching switch and an operation switch; The step of determining whether to enter the preparatory state based on the validity of the operation control switch includes: Test the effectiveness of the switch; When the elevator is in normal operation, if a switching switch is active, the condition for entering the preparatory state for the specific state is triggered. If a switch is active and the active status of the switch meets the preset first reasonable condition, then the preparatory state for entering a specific state is determined. If a switch is active but the activation condition of the switch does not meet the preset first reasonable condition, then the switch is determined to be faulty. Determining whether to enter the specific state based on the validity of the operation control switch includes: Test the effectiveness of the operating switch; When the elevator enters the preparation state, if the operation switch is active and the activation of the operation switch meets the preset second reasonable condition, then it enters the specific state. If a running switch is active but its activation does not meet the preset second reasonable condition, then the running switch is determined to be faulty.

3. The method as described in claim 1, characterized in that, The operation control switch includes a switching switch, which includes a first switching switch and a second switching switch; the processor includes a first processor and a second processor; the voting switch includes a first voting switch and a second voting switch; the first switching switch and the first voting switch are connected to the first processor; and the second switching switch and the second voting switch are connected to the second processor. The condition for entering the preparatory state of a specific state is that at least one switching switch is active; Determining whether to enter the preparatory state based on the validity of the operation control switch includes: Check if another toggle switch is working; If not, determine whether the duration of the inconsistency between the two switch signals has exceeded the time limit. If it has, determine that the switch is faulty; if it has not, return to the step of checking whether the other switch is valid. If so, then check if a running switch is active; If all operation switches are ineffective, then enter the preparatory state; If a running switch is valid and its validity has not expired, return to the step of checking if another switch is valid; if a running switch is valid but its validity has expired, then the running switch is determined to be faulty.

4. The method as described in claim 1, characterized in that, The operation control switch includes an operation switch and a switching switch. The switching switch includes a first switching switch and a second switching switch. The operation switch includes an up button, a down button, and an operation button. The processor includes a first processor and a second processor. The voting switch includes a first voting switch and a second voting switch. The operation switch is connected to both the first processor and the second processor. The first switching switch and the first voting switch are connected to the first processor. The second switching switch and the second voting switch are connected to the second processor. Determining whether to enter the specific state based on the validity of the operation control switch includes: If the up button and down button are both active at the same time, or the up button, down button and run button are all active at the same time and the active timeout expires, then the run switch is determined to be faulty. If both the up button and the run button are active simultaneously, or both the down button and the run button are active, then the specific state is entered.

5. The method as described in claim 4, characterized in that, Also includes: When the elevator is in normal operation, check the effectiveness of the switching switch; If all switching switches are invalid, and at least one operating switch is valid and its validity has expired, then the operating switch is determined to be faulty.

6. The method according to any one of claims 1-5, characterized in that, The processor's input terminal is also connected to a preset safety switch, and the method further includes: When the elevator is preparing to enter emergency electric operation mode, the bypass safety switch is activated.

7. The method according to any one of claims 1-5, characterized in that, When the specific state is an emergency electric operation state, before entering the preparatory state or the specific state, the following is also included: Determine whether a valid maintenance switching signal has been received; if so, stop entering the preparatory state or the specific state. After entering the preparatory state or the specific state, the following is also included: Determine whether a valid maintenance switching signal has been received; if so, exit the prepared state or the specific state.

8. An operation control device, characterized in that, The device includes a processor and a running control switch. The running control device is connected to the elevator control circuit. The elevator control circuit includes a main power supply, an elevator controller, a power supply line, and at least one voting switch installed on the power supply line. The input terminals of the processor are all connected to the running control switch, and the output terminal of the processor is connected to the voting switch. The operation control device is also communicatively connected to the elevator controller; the processor includes: The trigger module is used to control the corresponding voting switch to open when the elevator is in normal operation and the condition for entering a specific state of preparation is triggered. The specific state is either emergency electric operation state or maintenance state. The first judgment module is used to determine whether to enter the preparatory state based on the validity of the operation control switch; The recovery module is used to control the corresponding voting switch to close when the elevator is not in the preparatory state, so that the elevator returns to the normal operating state. The second judgment module is used to determine whether to enter the specific state based on the validity of the operation control switch when entering the preparatory state. A specific state entry module is used to control the corresponding voting switch to close when the specific state is entered, and the elevator controller controls the elevator to run according to the state of the operation control switch; The safety control module is used to control the corresponding voting switch to open when a fault is detected in the operation control switch, so that the elevator enters a safe state.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the safe operation control method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the safe operation control method according to any one of claims 1-7.

Images