Elevator backup system

Abstract

In elevator backup technology, the goal is to create an environment where the backup device is always functioning correctly when switching to the backup system. [Solution] The backup system is applicable to elevators where the first group control device is connected to a network and comprises a second group control device and a switching device. The switching device determines the operating status (A) of the first group control device and the second group control device based on the reception status of the alive status signal from the group control device, to determine whether the group control device is operating normally. The switching device then determines whether it is necessary to switch from the first group control device to the second group control device based on all the operating status information obtained in determination (A), and transmits all the operating status information to a monitoring device that remotely monitors the elevator.

Description

Technical Field

[0001] The present invention relates to a backup technology that enables continuous operation of an elevator.

Background Art

[0002] As an elevator backup technology, a backup group management control device that can replace the main group management control device is provided on a network, and even when the main group management control device fails, the control entity of the group management is switched to the backup group management control device so that the elevator can continue to operate (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] On the other hand, in order to further improve the robustness in the sense of continuing the operation of the elevator in the above-described backup technology, the inventor of the present invention considers that the backup group management control device may also fail, and it is necessary to create an environment in which the backup group management control device always operates normally at the time of switching to the backup.

[0005] Therefore, an object of the present invention is to create an environment in which a backup device always operates normally at the time of switching to a backup in an elevator backup technology.

Means for Solving the Problems

[0006] The backup system according to the present invention is a backup system applicable to elevators in which a first group control device is connected to a network, and has the following configuration (Aspect 1). The backup system comprises a second group control device and a switching device. The second group control device is a group control device that can replace the first group control device and is connected to a network. The switching device controls the switching from the first group control device to the second group control device.

[0007] Specifically, both the first and second group control devices transmit an "alive" status signal to the switching device via the network when they are operating normally. The switching device determines (A) whether each of the first and second group control devices is operating normally based on the reception status of the "alive" status signal from the respective group control device. Based on all the operating status information obtained in determination (A), the switching device determines whether it is necessary to switch from the first group control device to the second group control device, and transmits all of this operating status information to a monitoring device that remotely monitors the elevator.

[0008] According to the above embodiment 1, when the first group control device fails to operate normally, the switching device can immediately detect this and switch to the backup (switch from the first group control device to the second group control device), while simultaneously informing the monitoring device of the operating status of the first group control device. Furthermore, when the second group control device fails to operate normally, the switching device can also immediately detect this and inform the monitoring device. As a result, the monitoring device can identify each device that has failed to operate normally, including the backup device, based on the operating status information received from the switching device, and can instruct workers to perform maintenance on that device.

[0009] The backup system according to Embodiment 1 described above may have the following configuration (Embodiment 2). The switching device may, when it is operating normally, transmit an "alive" status signal to the monitoring device along with all the operating status information obtained in the determination (A) above.

[0010] According to the above embodiment 2, the monitoring device can determine whether the switching device is operating normally based on the reception status of the alive status signal from the switching device, and if it determines that the switching device is "not operating normally", it can instruct a worker to perform maintenance on the switching device.

[0011] The backup system according to the above embodiment 1 or 2 may have the following configuration (embodiment 3). The switching device may transmit to the monitoring device, along with all the operating status information obtained in the above determination (A), entity information indicating whether the control entity for group management at that time is the first group management control device or the second group management control device.

[0012] According to embodiment 3 described above, the monitoring device can identify whether the control entity for group management at that time is the first group management control device or the second group management control device, based on the entity information received from the switching device.

[0013] In this case, some backup systems have a control mechanism that returns the control entity for group management to the first group management control unit when the first group management control unit recovers after switching to the backup. In such systems, due to a setting error during the recovery process for the first group management control unit, the first group management control unit may become capable of sending an alive status signal, but the control entity may not return to the first group management control unit. In this case, the backup system remains in a state where the control entity has switched to the second group management control unit (the state where it has switched to the backup).

[0014] Even in such a situation, according to embodiment 3 above, the monitoring device can know that the control entity for group management remains the second group management control device, and thereby it can understand that some kind of abnormality has occurred in the first group management control device even after recovery. Therefore, the monitoring device can instruct the worker to perform further maintenance (such as checking the settings) on the first group management control device.

[0015] In an elevator, a first communication control device that communicates with a related device, which is one of a security device, a robot, or a mobile terminal used in the elevator, may also be connected to a network, and the backup system according to any of the above embodiments 1 to 3 may have the following configuration so as to be applicable to such an elevator (Embodiment 4). The backup system further comprises a second communication control device, where the second communication control device is a communication control device that can replace the first communication control device and is connected to a network. The switching device also controls the switching from the first communication control device to the second communication control device.

[0016] Specifically, both the first and second communication control devices transmit an "alive" status signal to the switching device without using the network, when they are operating normally. In addition to determination (A), the switching device performs an operational status determination (B) for each of the first and second communication control devices, based on the reception status of the "alive" status signal from the respective communication control device, to determine whether the communication control device is operating normally. Based on all the operational status information obtained from determinations (A) and (B), the switching device determines whether it is necessary to switch from the first group management control device to the second group management control device and whether it is necessary to switch from the first communication control device to the second communication control device, and transmits all of this operational status information to the monitoring device.

[0017] According to the above aspect 4, even when a backup communication control device (second communication control device) corresponding to the first communication control device is provided in the backup system, the monitoring device can individually identify a device that has become unable to operate normally based on the operation state information received from the switching device, and can instruct the worker to perform maintenance on that device.

Effect of the Invention

[0018] According to the present invention, in the elevator backup technology, it becomes possible to create an environment in which the backup device always operates normally when switching to the backup.

Brief Description of the Drawings

[0019] [Figure 1] It is a conceptual diagram showing the overall configuration of an elevator according to an embodiment. [Figure 2] It is a block diagram showing the configurations of (A) the first group management control device, (B) the second group management control device, and (C) the switching device included in the elevator according to the embodiment. [Figure 3] It is a conceptual diagram exemplifying (A) the first device management data, (B) the second device management data, and (C) the third device management data used in the embodiment. [Figure 4] It is a flowchart showing the backup process executed in the embodiment. [Figure 5] It is a flowchart showing the part following the coupler Z1 in FIG. 4. [Figure 6] It is a flowchart showing a part (the part following the coupler Z1) of the backup process executed in the second modification. [Figure 7] It is a conceptual diagram exemplifying the third device management data used in the second modification. [Figure 8] It is a flowchart showing a part (the part following the coupler Z1) of the backup process executed in the third modification. [Figure 9]It is a conceptual diagram showing the overall configuration of an elevator according to a fourth modification example. [Figure 10] It is a block diagram showing the configurations of (A) a first communication control device and (B) a second communication control device included in an elevator according to a fourth modification example. [Figure 11] It is a conceptual diagram exemplifying third device management data used in a fourth modification example.

Mode for Carrying Out the Invention

[0020] [1] Embodiment [1-1] Overall Configuration of Elevator FIG. 1 is a conceptual diagram showing the overall configuration of an elevator according to an embodiment. As shown in this figure, the elevator includes a destination floor registration device 1 installed on each floor, a plurality of carriages G, a plurality of elevator control devices 2 that individually control the plurality of carriages G, and a first group management control device 3A that centrally manages the plurality of carriages G (performs group management on those carriages G) through the elevator control device 2. The configuration of the first group management control device 3A is shown in a block diagram in FIG. 2(A).

[0021] The first group management control device 3A includes an interface Ja for connecting itself to the network Wj (see FIG. 2(A)), and is configured such that the enabling / disabling setting switching of the connection to the network Wj by the interface Ja can be performed by software. As an example, this interface Ja is a LAN interface. And when the first group management control device 3A operates as a control entity for group management, it sets the connection to the network Wj to be "enabled".

[0022] Each destination floor registration device 1 is also equipped with an interface Ja (not shown) for connecting itself to the network Wj. As a result, when the first group control device 3A is operating as the control entity (when the connection to the network Wj is set to "enabled"), all destination floor registration devices 1 will be connected to the first group control device 3A via the network Wj (see Figure 1).

[0023] On the other hand, the elevator control device 2 is connected to the first group control device 3A by a cable Wk1 that directly connects the devices without going through the network Wj, so that direct communication (such as serial communication) with the first group control device 3A is possible (see Figure 1).

[0024] Furthermore, the elevator of this embodiment is equipped with a second group control device 3B that can replace the first group control device 3A, and a switching device 4 that controls the switching of the control entity for group management (switching from one of the first group control device 3A and the second group control device 3B to the other) in order to establish a backup system in case the first group control device 3A fails to operate normally (see Figure 1). Figures 2(B) and 2(C) show the configurations of the second group control device 3B and the switching device 4 in block diagrams, respectively.

[0025] The second group control device 3B, like the first group control device 3A, is equipped with an interface Ja for connecting itself to the network Wj (see Figure 2(B)), and is configured to allow software switching of the connection to the network Wj via interface Ja. In this embodiment, the interface Ja of the second group control device 3B is assigned the same IP address as the interface Ja of the first group control device 3A.

[0026] With such an interface Ja, even with both the first group control device 3A and the second group control device 3B powered on (ON state), the connection of their interfaces Ja to the network Wj can be configured so that only one of the first group control device 3A or the second group control device 3B is always connected to the network Wj (the other is disconnected from the network Wj). In other words, even with the second group control device 3B powered on (ON state), the connection to the network Wj can be disabled in software, thereby disconnecting the second group control device 3B from the network Wj.

[0027] Therefore, even if a common IP address is assigned to the first group control device 3A and the second group control device 3B, by setting the connection to network Wj in the second group control device 3B to "disabled," the second group control device 3B can be kept powered on (ON state) without causing communication failures. Thus, when the second group control device 3B replaces the first group control device 3A, the time required to start up the second group control device 3B (the time required to start it up from the OFF state) is eliminated.

[0028] The elevator control device 2 is connected to the second group control device 3B by a cable Wk1 that directly connects the devices without going through the network Wj, so that direct communication (such as serial communication) is possible with the second group control device 3B (see Figure 1).

[0029] Furthermore, the switching device 4 is connected to the first group control device 3A and the second group control device 3B by a cable Wk2 that directly connects the devices without going through the network Wj, so that direct communication (such as serial communication) is possible with either the first group control device 3A or the second group control device 3B (see Figure 1).

[0030] [1-2] Configuration of each device The configuration of each device will be explained in more detail below.

[0031] <Destination Floor Registration Device> The destination floor registration device 1 is equipped with a touch panel, through which users can register their destination floor Fd and receive various information. The destination floor registration device 1 may also have separate input and display units. For example, the input unit may consist of mechanical buttons (such as a numeric keypad), and the display unit may consist of a dedicated monitor.

[0032] In this embodiment, a common IP address assigned to the first group control device 3A and the second group control device 3B is pre-recorded in each destination floor registration device 1. When a user operates a destination floor registration device 1 on any floor to register their destination floor Fd, that destination floor Fd is transmitted via network Wj to the group control device 3 identified by the IP address recorded in the destination floor registration device 1 (in this case, the one of the first group control device 3A and the second group control device 3B that is connected to network Wj at that time). This sends a request to the group control device 3 identified by the IP address for assigning a platform call X for that user. At this time, in order to allow the group control device 3 to recognize which registration device the operated destination floor registration device 1 is, device information Pd1 for identifying the destination floor registration device 1 from other devices is also transmitted to the group control device 3.

[0033] <Elevator control device> Each elevator control device 2 controls the elevator car G corresponding to it as needed in response to commands from the group control device 3, and transmits operation data Pm indicating the movement of the elevator car G at that time (such as the movement of the elevator car G and the opening and closing of the doors) to both the first group control device 3A and the second group control device 3B (see Figure 1).

[0034] <First group control device> The first group control device 3A, each time it receives an assignment request from any destination floor registration device 1, sets the departure floor Fc and destination floor Fd of the user registered in that destination floor registration device 1 as a single landing call X, and then assigns the landing call X to one of the elevator cars G selected as a candidate recipient (assignment process). Then, the first group control device 3A causes the elevator car G to perform a response operation to the landing call X via the elevator control device 2 (response process).

[0035] When the first group control device 3A responds to a landing call X, it registers the destination floor Fd indicated by the landing call X as a car call Y for the user to the elevator car G at an appropriate timing after the elevator car G has arrived at the departure floor Fc indicated by the landing call X (for example, when the doors begin to open or when the sensor on the door detects that a user has boarded) (registration process). Then, the first group control device 3A causes the elevator car G to perform a response operation to the car call Y via the elevator control device 2 (response process).

[0036] Furthermore, the first group management control device 3A sequentially accumulates the operation data generated by group management as learning data Dp (see Figure 2(A)), and uses this learning data Dp to perform learning to optimize group management (learning to optimize the allocation of landing calls X) (learning process). Here, the operation data includes various data related to elevator operation, such as data related to allocation and operation data Pm of the elevator car G transmitted from the elevator control device 2. The learning data Dp is obtained by statistically analyzing the operation data as it progresses, and the learning data Dp includes analysis data on the operation status of the elevator car G (average door open time, average door closed time, average travel time between floors, average stop time at each floor, etc.) and analysis data on the elevator usage status (average number of landing calls X in the past 5 minutes, average congestion level inside the elevator car G in the past 5 minutes, etc.). Note that AI (such as a neural network) may be used for the analysis of operation data, not just statistical analysis.

[0037] Furthermore, the first group control device 3A periodically transmits an "alive status signal Sx" to the switching device 4 via the cable Wk2 that directly connects the devices (i.e., without going through the network Wj) when it is operating normally (transmission process). Hereinafter, the "alive status signal Sx" output from the first group control device 3A will be referred to as the "alive status signal SxA" (see Figure 1).

[0038] Since the Alive status signal SxA is transmitted directly from the first group control device 3A to the switching device 4 via cable Wk2, the switching device 4 will be able to reliably receive the Alive status signal SxA as long as there are no problems such as a break in cable Wk2, provided that the first group control device 3A is able to transmit the Alive status signal SxA. In other words, the switching device 4 will only be unable to receive the Alive status signal SxA if the first group control device 3A becomes unable to operate normally for some reason (such as a malfunction or maintenance) and is therefore unable to transmit the Alive status signal SxA.

[0039] Therefore, the switching device 4 can determine whether the first group control device 3A is operating normally based on the reception status of the alive status signal SxA from the first group control device 3A. Specifically, the switching device 4 can determine that the first group control device 3A is no longer operating normally if it can no longer receive the alive status signal SxA from the first group control device 3A.

[0040] By utilizing the alive status signal SxA in this way and enabling it to be received directly from the first group control device 3A, it becomes possible to accurately and easily determine whether or not the first group control device 3A is operating normally.

[0041] In terms of specific configuration, the first group management control device 3A includes a storage unit 31A and a control unit 32A in addition to the interface Ja (see Figure 2(A)).

[0042] The memory unit 31A is a part composed of memory devices such as ROM and RAM, and stores information necessary for the control processing performed by the first group control device 3A. In this embodiment, the learning data Dp described above is stored in the memory unit 31A as such information, and furthermore, the first device management data Dq1, the second device management data Dq2, the landing call management data (not shown), and the car call management data (not shown) are also stored in the memory unit 31A.

[0043] Here, the first device management data Dq1 is a database for managing multiple pieces of information related to each destination floor registration device 1 by linking them together (see Figure 3(A)). The second device management data Dq2 is a database for managing multiple pieces of information related to each elevator control device 2 by linking them together (see Figure 3(B)). The landing call management data and car call management data are data for managing information on landing calls X and car calls Y for each elevator car G, respectively (not shown).

[0044] Figure 3(A) is a conceptual diagram illustrating the first device management data Dq1 used in this embodiment. In the first device management data Dq1, for each destination floor registration device 1, the device information Pd1 and installation floor Fs of that registration device are recorded in a manner that is associated with each other.

[0045] As a result, when the first group control device 3A receives device information Pd1 along with the destination floor Fd from any of the destination floor registration devices 1, it can identify the installation floor Fs of the destination floor registration device 1 (the registration device on which the destination floor Fd was registered) from the device information Pd1. In this embodiment, the installation floor Fs of the destination floor registration device 1 is used as the departure floor Fc of the user who operated the destination floor registration device 1 to register the destination floor Fd.

[0046] Figure 3(B) is a conceptual diagram illustrating the second device management data Dq2 used in this embodiment. In the second device management data Dq2, for each elevator control device 2, device information Pd2 for identifying the elevator control device 2 from other devices and car information Pg for identifying the elevator car G controlled by the elevator control device 2 from other cars are recorded in a manner that is associated with each other.

[0047] As a result, the first group control device 3A can control each elevator car G through each elevator control device 2, and when it receives device information Pd2 along with the operation data Pm of the elevator car G from each elevator control device 2, it can identify which elevator car G the operation data Pm belongs to from the device information Pd2.

[0048] The control unit 32A is responsible for executing the control processing performed by the first group management control device 3A (including control processing for group management and control processing for setting switching). Specifically, the control unit 32A is composed of processing devices such as a CPU and an MPU, and executes the control processing it is responsible for using software by running a control program installed in the first group management control device 3A. This control program may be stored in a readable state on a portable storage medium (e.g., flash memory) or in a downloadable state on a server before being installed in the first group management control device 3A. Furthermore, the control processing performed by the first group management control device 3A is not limited to being implemented in software by executing a program, but may also be implemented in hardware by processing circuits built into the first group management control device 3A.

[0049] <Second group control device> The second group management control device 3B is configured to perform control processing for group management (including the assignment processing, registration processing, response processing, and learning processing described above), similar to the first group management control device 3A (see Figure 2(B)).

[0050] In this embodiment, when the first group control device 3A is operating normally, the connection to network Wj in the second group control device 3B is set to "disabled". As a result, the second group control device 3B is disconnected from network Wj while remaining powered on.

[0051] On the other hand, even when the second group control device 3B is disconnected from the network Wj, it remains connected to the elevator control device 2 via cable Wk1. Therefore, as long as it is powered on (ON), it can receive the elevator car G operation data Pm transmitted from the elevator control device 2. In this embodiment, even when the second group control device 3B is disconnected from the network Wj, it sequentially accumulates the elevator car G operation data Pm transmitted from the elevator control device 2 as learning data Dp (see Figure 2(B)), and uses this learning data Dp to perform learning to optimize group management (learning to optimize the assignment destination of landing calls X) (learning process). As a result, the second group control device 3B is able to perform the most optimal group management possible from the start of backup.

[0052] If the first group management control device 3A becomes unable to operate normally (for example, if it is disconnected from the network Wj due to a malfunction or maintenance), the second group management control device 3B switches the connection setting to the network Wj from "disabled" to "enabled" according to a command from the switching device 4. As a result, the second group management control device 3B becomes capable of network communication, and as a result, it becomes able to receive assignment requests from each destination floor registration device 1 on behalf of the first group management control device 3A. Then, each time the second group management control device 3B receives an assignment request, it executes the corresponding control processing (control processing for group management, including the assignment processing, registration processing, response processing, and learning processing described above). In this way, the control entity for group management is switched from the first group management control device 3A to the second group management control device 3B.

[0053] Furthermore, the second group control device 3B periodically transmits an "alive status signal Sx" to the switching device 4 via the cable Wk2 that directly connects the devices (i.e., without going through the network Wj) when it is operating normally (transmission process). Hereinafter, the "alive status signal Sx" output from the second group control device 3B will be referred to as the "alive status signal SxB" (see Figure 1).

[0054] Since the Alive status signal SxB is transmitted directly from the second group control device 3B to the switching device 4 via cable Wk2, unless there is a problem such as a break in cable Wk2, the switching device 4 will be able to reliably receive the Alive status signal SxB even if the connection to network Wj is set to "disabled" in the second group control device 3B, provided that the second group control device 3B is able to transmit the Alive status signal SxB. In other words, the switching device 4 will only be unable to receive the Alive status signal SxB if the second group control device 3B becomes unable to operate normally for some reason (such as a malfunction or maintenance) and is therefore unable to transmit the Alive status signal SxB.

[0055] Therefore, the switching device 4 can determine whether the second group control device 3B is operating normally based on the reception status of the alive status signal SxB from the second group control device 3B. Specifically, the switching device 4 can determine that the second group control device 3B is no longer operating normally if it can no longer receive the alive status signal SxB from the second group control device 3B.

[0056] By utilizing the alive status signal SxB in this way and enabling it to be received directly from the second group control device 3B, it becomes possible to accurately and easily determine whether or not the second group control device 3B is operating normally.

[0057] In terms of specific configuration, the second group management control device 3B includes a storage unit 31B and a control unit 32B in addition to the interface Ja (see Figure 2(B)).

[0058] The memory unit 31B is a part composed of memory devices such as ROM and RAM, and stores information necessary for the control processing performed by the second group control device 3B. In this embodiment, as with the first group control device 3A, learning data Dp, first device management data Dq1, second device management data Dq2, landing call management data (not shown), and car call management data (not shown) are stored in the memory unit 31B as such information.

[0059] The control unit 32B is responsible for executing the control processing performed by the second group management control device 3B (including control processing for group management and control processing for setting switching). Specifically, the control unit 32B is composed of processing devices such as a CPU and an MPU, and executes the control processing it is responsible for using software by running a control program installed in the second group management control device 3B. This control program may be stored in a readable state on a portable storage medium (e.g., flash memory) or in a downloadable state on a server before being installed in the second group management control device 3B. Furthermore, the control processing performed by the second group management control device 3B is not limited to being implemented in software by executing a program, but may also be implemented in hardware by processing circuits built into the second group management control device 3B.

[0060] <Switching device> The switching device 4 is a device that controls the switching of the control entity for group management (switching from one of the first group management control device 3A and the second group management control device 3B to the other), and in this embodiment, it is provided independently of both the first group management control device 3A and the second group management control device 3B (see Figure 1).

[0061] In this embodiment, the switching device 4 performs the following backup processing. Based on the reception status of the alive status signal SxA from the first group control device 3A, the switching device 4 determines the operating state Zs (=Zs1) of whether the first group control device 3A is operating normally, and based on the reception status of the alive status signal SxB from the second group control device 3B, it determines the operating state Zs (=Zs2) of whether the second group control device 3B is operating normally. Then, based on the information of all the operating states Zs (here, Zs1 and Zs2) obtained from these determinations, the switching device 4 determines whether it is necessary and possible to switch the control entity from the first group control device 3A to the second group control device 3B, and transmits all the operating state Zs information to the monitoring device 5 which remotely monitors the elevator. For example, the monitoring device 5 is a server installed on the cloud, and the switching device 4 can transmit the operating state Zs information to the monitoring device 5 via a gateway. Further details about this backup process will be provided later.

[0062] In terms of its specific configuration, the switching device 4 comprises a storage unit 41 and a control unit 42 (see Figure 2(C)).

[0063] The storage unit 41 is a part composed of storage devices such as ROM and RAM, and stores information necessary for the control processing performed by the switching device 4. In this embodiment, the third device management data Dq3 is stored in the storage unit 41 as such information. Here, the third device management data Dq3 is a database for managing multiple pieces of information related to each group control device 3 by linking them together (see Figure 3(C)).

[0064] Figure 3(C) is a conceptual diagram illustrating the third device management data Dq3 used in this embodiment. In the third device management data Dq3, for each group management control device 3, device information Pd3 for identifying the group management control device 3 from other devices, the type Zr and operating state Zs of the group management control device 3 are recorded in a manner that is associated with each other.

[0065] Here, the type Zr of each group control device 3 indicates whether that group control device 3 is the first group control device 3A or the second group control device 3B. The operating state Zs of each group control device 3 indicates whether that group control device 3 is operating normally or not. In the example in Figure 3(C), it is shown that for each group control device 3, "First" is recorded in the type Zr if it is the first group control device 3A, and "Second" is recorded in the type Zr if it is the second group control device 3B. It is also shown that for each group control device 3, "Normal" is recorded in the operating state Zs if it is operating normally, and the operating state Zs is rewritten to "Abnormal" if it is no longer able to operate normally.

[0066] The control unit 42 is responsible for executing the control processing (including backup processing) performed by the switching device 4. Specifically, the control unit 42 is composed of processing devices such as a CPU and an MPU, and executes the control processing it is responsible for using software by running the control program installed in the switching device 4. This control program may be stored in a readable state on a portable storage medium (e.g., flash memory) or in a downloadable state on a server before being installed in the switching device 4. Furthermore, the control processing performed by the switching device 4 is not limited to being implemented in software by executing a program, but may also be implemented in hardware by processing circuits built into the switching device 4.

[0067] [1-3] Backup process Figure 4 is a flowchart showing the backup process performed in this embodiment. In the backup process, the switching device 4 first checks the operating state Zs of the first group control device 3A, which it is currently aware of, by referring to the third device management data Dq3, and determines whether the operating state Zs is "normal" or "abnormal" (step S100).

[0068] If the switching device 4 determines in step S100 that the situation is "normal", it then determines the operating state Zs (=Zs1) of the first group control device 3A based on the reception status of the alive status signal SxA from the first group control device 3A at that time, in order to determine whether the first group control device 3A continues to operate normally (step S101).

[0069] If the switching device 4 determines "normal" in step S101, it can determine that the first group control device 3A is continuing to operate normally. In this case, the switching device 4 maintains the operating state Zs of the first group control device 3A recorded in the third device management data Dq3 as "normal" without rewriting it. Then, in order to determine whether the second group control device 3B is also continuing to operate normally, the switching device 4 determines the operating state Zs (=Zs2) of the second group control device 3B based on the reception status of the alive status signal SxB from the second group control device 3B at that time (step S102).

[0070] If the switching device 4 determines "normal" in step S102, it can then determine that the second group control device 3B is also continuing to operate normally. As a result, based on all the operating status Zs (Zs1 = "normal", Zs2 = "normal") information obtained in steps S101 and S102, the switching device 4 can determine that a switch to the backup (switching from the first group control device 3A to the second group control device 3B) is not necessary at that time, but the backup system is maintained in a state where a switch to the backup is possible.

[0071] In this case, the switching device 4 proceeds to step S110 without rewriting the operating status Zs of the second group control device 3B recorded in the third device management data Dq3, which remains "normal".

[0072] On the other hand, if the switching device 4 determines "abnormal" in step S102, it can determine that the second group control device 3B has become unable to operate normally for some reason (such as a malfunction or maintenance). As a result, based on all the operating status Zs (Zs1 = "normal", Zs2 = "abnormal") information obtained in the determinations in steps S101 and S102, the switching device 4 can determine that a switch to the backup (switching from the first group control device 3A to the second group control device 3B) is not necessary at that time, but the backup system is in a state where a switch to the backup is impossible.

[0073] In this case, the switching device 4 rewrites the operating status Zs of the second group control device 3B, which is recorded in the third device management data Dq3, from "normal" to "abnormal" (step S103). After that, the switching device 4 proceeds to step S110.

[0074] In step S110, the switching device 4 transmits information on all operating states Zs (in this case, Zs1 and Zs2) obtained in the determinations of steps S101 and S102 to the monitoring device 5. Specifically, the switching device 4 transmits to the monitoring device 5 the latest information on operating states Zs (Zs1 = "normal", Zs2 = "normal" or "abnormal") recorded in the third device management data Dq3 for the first group control device 3A and the second group control device 3B. At this time, in order for the monitoring device 5 to recognize which device each operating state Zs represents, the switching device 4 also transmits to the monitoring device 5 the device information Pd3 of the device representing that operating state Zs, linked to the information on that operating state Zs. After step S110, the switching device 4 returns to step S100.

[0075] With this process, the switching device 4 can immediately detect when the second group control device 3B is unable to operate normally and notify the monitoring device 5. As a result, the monitoring device 5 can recognize that the second group control device 3B is unable to operate normally based on the operating status Zs information received from the switching device 4 and can instruct a worker to perform maintenance on that device.

[0076] If the switching device 4 determines that there is an "abnormality" in step S101, it can then determine that the first group control device 3A has become unable to operate normally for some reason (such as a malfunction or maintenance). In this case, the switching device 4 rewrites the operating status Zs of the first group control device 3A recorded in the third device management data Dq3 from "normal" to "abnormal" (step S120).

[0077] After step S120, before performing the switchover to the backup (switching from the first group control device 3A to the second group control device 3B), the switching device 4 determines the operating state Zs of the second group control device 3B based on the reception status of the alive status signal SxB from the second group control device 3B at that time, in order to determine whether the second group control device 3B is operating normally (step S121).

[0078] If the switching device 4 determines "normal" in step S121, it can determine that the second group control device 3B is operating normally based on that determination. As a result, based on all the operating status Zs (Zs1 = "abnormal", Zs2 = "normal") information obtained in the determinations of steps S101 and S121, the switching device 4 can determine that a switch to the backup (switching from the first group control device 3A to the second group control device 3B) is necessary at that time, and that the backup system is in a state where a switch to the backup is possible.

[0079] In this case, the switching device 4 performs a switch to the backup (step S122). Specifically, the switching device 4 sends a deactivation command signal Sp to the first group control device 3A, thereby commanding the first group control device 3A to set the connection to network Wj to "disabled". The switching device 4 also sends an enable command signal Sq to the second group control device 3B, thereby commanding the second group control device 3B to set the connection to network Wj to "enabled".

[0080] Here, depending on the extent of its failure, the first group control device 3A may remain powered on and connected to network Wj even if it is unable to transmit the alive status signal SxA. In such a situation, the first group control device 3A can switch the setting for connection to network Wj from "enabled" to "disabled" (setting switch) by receiving a deactivation command signal Sp from the switching device 4. Also, when the second group control device 3B receives an activation command signal Sq from the switching device 4, it switches the setting for connection to network Wj from "disabled" to "enabled" (setting switch). As a result, the second group control device 3B becomes capable of network communication and, as a result, can receive assignment requests from each destination floor registration device 1 in place of the first group control device 3A. In this way, the control entity for group management is switched from the first group control device 3A to the second group control device 3B.

[0081] After step S122, the switching device 4 transmits all the information on the operating state Zs obtained in the determinations of steps S101 and S121 to the monitoring device 5 (step S123). Specifically, the switching device 4 transmits to the monitoring device 5 the latest information on the operating state Zs (Zs1 = "abnormal", Zs2 = "normal") recorded in the third device management data Dq3 for the first group control device 3A and the second group control device 3B. At this time, in order for the monitoring device 5 to recognize which device each operating state Zs represents, the switching device 4 also transmits to the monitoring device 5 the device information Pd3 of the device showing that operating state Zs, linked to the information on that operating state Zs.

[0082] With this process, when the first group control device 3A fails to operate normally, the switching device 4 can immediately detect this and switch to the backup (switch from the first group control device 3A to the second group control device 3B), while simultaneously informing the monitoring device 5 of the operating status Zs (Zs1 = "abnormal") of the first group control device 3A. As a result, the monitoring device 5 can recognize that the first group control device 3A has failed to operate normally based on the operating status Zs information received from the switching device 4, and can then instruct a worker to perform maintenance on the device.

[0083] After step S123, the switching device 4 returns to step S100. After step S123 via step S120, the switching device 4 will determine that there is an "abnormality" in step S100. On the other hand, if the first group control device 3A recovers afterward, the transmission of the alive status signal SxA from the first group control device 3A will resume, and the switching device 4 will be able to receive the alive status signal SxA again. Therefore, if the switching device 4 determines that there is an "abnormality" in step S100, it will execute the processing from step S200 (see Figure 5) so that it can return the control entity to the first group control device 3A when the first group control device 3A recovers afterward. Details of the processing from step S200 (see Figure 5) will be described later.

[0084] If the switching device 4 determines "abnormal" in step S121, it can then determine that the second group control device 3B has also become unable to operate normally for some reason (such as a malfunction or maintenance). As a result, based on all the operating status Zs (Zs1 = "abnormal", Zs2 = "abnormal") information obtained in the determinations of steps S101 and S121, the switching device 4 can determine that a switch to the backup (switching from the first group control device 3A to the second group control device 3B) is necessary at that time, but that the backup system is in a state where a switch to the backup is impossible.

[0085] In this case, the switching device 4 does not perform a switchover to the backup, but instead rewrites the operating status Zs of the second group control device 3B recorded in the third device management data Dq3 from "normal" to "abnormal" (step S130).

[0086] After step S130, the switching device 4 transmits all the information on the operating states Zs obtained in the determinations of steps S101 and S121 to the monitoring device 5 (step S131). Specifically, the switching device 4 transmits to the monitoring device 5 the latest information on the operating states Zs recorded in the third device management data Dq3 for the first group control device 3A and the second group control device 3B (Zs1 = "abnormal", Zs2 = "abnormal"). At this time, in order for the monitoring device 5 to recognize which device each operating state Zs represents, the switching device 4 also transmits to the monitoring device 5 the device information Pd3 of the device showing that operating state Zs, linked to the information on that operating state Zs. In this case, since there is no group control device 3 that can operate as the control entity, the switching device 4 terminates the backup process without returning to step S100.

[0087] According to the backup process described above, when the first group control device 3A fails to operate normally, the switching device 4 can immediately detect this and switch to the backup (switch from the first group control device 3A to the second group control device 3B) (step S122), while simultaneously informing the monitoring device 5 of the operating status Zs of the first group control device 3A (step S123). Furthermore, when the second group control device 3B fails to operate normally, the switching device 4 can immediately detect this and inform the monitoring device 5 (steps S110 and S131). As a result, the monitoring device 5 can, based on the operating status Zs information received from the switching device 4, individually identify the devices that have failed to operate normally, including the backup device (in this case, the second group control device 3B), and instruct workers to perform maintenance on those devices.

[0088] Therefore, in elevator backup technology, it becomes possible to create an environment where the backup device is always functioning correctly when switching to the backup system.

[0089] Next, we will explain the details of the process from step S200 onwards (see Figure 5).

[0090] In step S200, the switching device 4 determines the operating state Zs of the second group control device 3B based on the reception status of the alive status signal SxB from the second group control device 3B at that time, in order to determine whether the second group control device 3B continues to operate normally as the control entity until the first group control device 3A recovers.

[0091] If the switching device 4 determines "normal" in step S200, it can determine that the second group control device 3B is continuing to operate normally. In this case, the switching device 4 determines whether the first group control device 3A has recovered based on the reception status of the alive status signal SxA from the first group control device 3A at that time, in order to determine whether the control entity can be returned to the first group control device 3A (step S201).

[0092] If the switching device 4 determines in step S201 that it has not recovered (No), it returns to step S200 and repeatedly executes steps S200 and S201 until it determines in step S200 that it is abnormal, or determines in step S201 that it has recovered (Yes). In this way, the switching device 4 checks at any time whether the first group control device 3A has recovered.

[0093] If the switching device 4 determines in step S201 that "recovery has occurred (Yes)", it performs a switchover to restore the backup system to its original state (recovery from backup; step S202). Specifically, immediately after recovery, the connection to network Wj is set to "disabled" in the first group control device 3A. The switching device 4 then transmits an enable command signal Sq to the first group control device 3A, instructing it to set the connection to network Wj to "enabled". The switching device 4 also transmits a deactivation command signal Sp to the second group control device 3B, instructing it to set the connection to network Wj to "disabled".

[0094] When the first group control device 3A receives an activation command signal Sq from the switching device 4, it switches the connection setting to network Wj from "disabled" to "enabled" (setting switch). Similarly, when the second group control device 3B receives a deactivation command signal Sp from the switching device 4, it switches the connection setting to network Wj from "enabled" to "disabled" (setting switch). As a result, the control authority for group management is returned from the second group control device 3B to the first group control device 3A.

[0095] After step S202, the switching device 4 rewrites the operating status Zs of the first group control device 3A, which is recorded in the third device management data Dq3, from "abnormal" to "normal" (step S203).

[0096] After step S203, the switching device 4 transmits all the information on the operating state Zs obtained in the determination or judgment in steps S200 and S201 to the monitoring device 5 (step S204). Specifically, the switching device 4 transmits to the monitoring device 5 the latest information on the operating state Zs recorded in the third device management data Dq3 for the first group control device 3A and the second group control device 3B (Zs1 = "normal", Zs2 = "normal"). At this time, in order for the monitoring device 5 to recognize which device each operating state Zs represents, the switching device 4 also transmits to the monitoring device 5 the device information Pd3 of the device showing that operating state Zs, linked to the information on that operating state Zs. After step S204, the switching device 4 returns to step S100.

[0097] If the switching device 4 determines that there is an "abnormality" in step S200, it can determine that the second group control device 3B is no longer able to continue operating normally as the control entity until the first group control device 3A recovers. In this case, it performs the same processing as in steps S130 and S131 (steps S210 and S211).

[0098] [2] Variant [2-1] First variation In the embodiment described above, the switching device 4 may, when it is operating normally, transmit an alive status signal SxC to the monitoring device 5 along with information on the operating status Zs of the first group control device 3A and the second group control device 3B. At this time, the information on the operating status Zs may be transmitted to the monitoring device 5 by a signal separate from the alive status signal SxC, or it may be recorded in the alive status signal SxC as additional information and transmitted to the monitoring device 5 using the alive status signal SxC.

[0099] According to the first modified example, the monitoring device 5 can determine whether the switching device 4 is operating normally based on the reception status of the alive status signal SxC from the switching device 4. Furthermore, if it determines that the switching device 4 is "not operating normally", it can instruct a worker to perform maintenance on the switching device 4.

[0100] [2-2] Second variation Figure 6 is a flowchart showing a portion of the backup process (the part continuing from connector Z1) performed in the second modified example.

[0101] In both the above-described embodiment and the first modified example, the alive status signal Sx of each group control device 3 may include additional information, such as type Zr, indicating whether the group control device 3 is the first group control device 3A or the second group control device 3B. After switching to the backup, if the switching device 4 is able to receive the alive status signal SxA again (if it is determined in step S201 that it has recovered (Yes)), it may refer to the type Zr in the alive status signal SxA and determine whether the type Zr is set to Zr = "First" (step S300). Only if it is determined in step S300 that it is set (Yes) may it perform a switch to return from the backup (step S202).

[0102] In this configuration, a setting error during recovery operations for the first group control device 3A may cause the first group control device 3A to become capable of transmitting the alive status signal SxA, but the control entity may not return to the first group control device 3A. In this case, the backup system will remain in a state where the control entity has switched to the second group control device 3B (the backup system).

[0103] Specifically, if the type Zr is set to Zr = "second" during the recovery operation for the first group control device 3A, the switching device 4 will be able to receive the alive status signal Sx from the first group control device 3A, but will not be able to determine in step S300 that it is "set (Yes)", and will not be able to perform the switching for recovery from backup (step S202).

[0104] Therefore, in order to enable the monitoring device 5 to recognize a situation where the control entity does not return to the first group management control device 3A, the switching device 4 may, when transmitting information on the operating status Zs of the first group management control device 3A and the second group management control device 3B to the monitoring device 5, transmit along with the operating status Zs information, entity information Pe indicating which of the first group management control device 3A or the second group management control device 3B is the control entity for group management at that time. Specifically, this is as follows.

[0105] Figure 7 is a conceptual diagram illustrating the third device management data Dq3 used in the second modified example. In this third device management data Dq3, each group management control device 3 is associated with a flag information Pf in addition to the device information Pd3, type Zr, and operating state Zs of that group management control device 3. Here, the flag information Pf indicates which group management control device 3 is the control entity for group management. In the example in Figure 6, not being the control entity is indicated by Pf = "0", and being the control entity is indicated by Pf = "1".

[0106] Then, when the switching device 4 performs a switch to the backup (step S122 in Figure 4), it rewrites the flag information Pf of the second group control device 3B in the third device management data Dq3 from "0" to "1", while simultaneously rewriting the flag information Pf of the first group control device 3A from "1" to "0".

[0107] Subsequently, if the switching device 4 determines in step S201 that it has recovered (Yes) and in step S300 that it is set (Yes), and as a result performs a switchover for recovery from backup (step S202), then in the third device management data Dq3, it rewrites the flag information Pf of the first group management control device 3A from "0" to "1", while simultaneously rewriting the flag information Pf of the second group management control device 3B from "1" to "0".

[0108] On the other hand, if the switching device 4 can determine in step S201 that it has "recovered (Yes)" but in step S300 it determines that it is "not set (No)", and as a result it is unable to perform the switchover for recovery from the backup (step S202) (i.e., if it is not possible to return the control entity to the first group control device 3A), then the switching device 4 will maintain the flag information Pf recorded in the third device management data Dq3 without rewriting any of them. That is, the switching device 4 will maintain the flag information Pf of the first group control device 3A as "0" in the third device management data Dq3, and will maintain the flag information Pf of the second group control device 3B as "1".

[0109] In this way, the switching device 4 always knows whether the control entity for group management is the first group management control device 3A or the second group management control device 3B.

[0110] Then, when the switching device 4 transmits information on the operating status Zs of the first group control device 3A and the second group control device 3B to the monitoring device 5, it refers to the third device management data Dq3 at that time to extract the device information Pd3 of the group control device 3 whose flag information Pf is set to Pf = "1", and transmits this device information Pd3 as the main information Pe along with the operating status Zs information to the monitoring device 5.

[0111] In this modified example, even if the switching device 4 determines in step S300 that it is "not set (No)", it transmits information on the operating status Zs of the first group control device 3A and the second group control device 3B to the monitoring device 5, and also transmits the subject information Pe at that time (in this case, that the control subject is the first group control device 3A) to the monitoring device 5 (step S204).

[0112] According to the second modified example, the monitoring device 5 can determine whether the control entity for group management at that time is the first group management control device 3A or the second group management control device 3B, based on the entity information Pe received from the switching device 4.

[0113] Therefore, even if the control entity does not return to the first group control device 3A, the monitoring device 5 can know that the control entity for group management remains the second group control device 3B, and thereby it can understand that some kind of abnormality has occurred in the first group control device 3A even after recovery. Thus, the monitoring device 5 can instruct the worker to perform further maintenance (such as checking the settings) on the first group control device 3A.

[0114] [2-3] Third variation In the embodiment described above, when the switching device 4 switches the control entity for group management from the first group management control device 3A to the second group management control device 3B, it may operate the second group management control device 3B as the new first group management control device 3A. On the other hand, if the first group management control device 3A that has become unable to operate normally is subsequently restored and becomes able to operate normally, it may operate it as the new second group management control device 3B.

[0115] Figure 8 is a flowchart showing part of the backup process (the part continuing from connector Z1) performed in the third modified example. In this modified example, if the switching device 4 determines that it has "recovered (Yes)" in step S201, instead of returning the control entity of group management to the first group management control device 3A, it keeps the first group management control device 3A disconnected from network Wj even after recovery (the connection to network Wj is set to "disabled"), and changes "1st" and "2nd" to "2nd" and "1st" respectively in the type Zr column of the third device management data Dq3 (see Figure 3(C)) (step S400).

[0116] In this way, the switching device 4 uses the second group control device 3B as the new first group control device 3A, while using the recovered first group control device 3A as the new second group control device 3B.

[0117] Subsequently, the switching device 4 rewrites the operating state Zs of the new second group control device 3B (the recovered first group control device 3A) in the third device management data Dq3 from "abnormal" to "normal" (step S401).

[0118] After step S401, the switching device 4 transmits the latest information on the operating status Zs recorded in the third device management data Dq3 for the new first group control device 3A and second group control device 3B (Zs1 = "normal", Zs2 = "normal") to the monitoring device 5 (step S402). At this time, in order for the monitoring device 5 to recognize which device each operating status Zs represents, the switching device 4 also transmits the device information Pd3 of the device showing that operating status Zs to the monitoring device 5, linked to the information of that operating status Zs. After step S402, the switching device 4 returns to step S100.

[0119] According to the third modified example, when the first group control device 3A, which has become unable to operate normally, recovers, the control and operation of returning the control entity for group management from the second group control device 3B to the first group control device 3A becomes unnecessary.

[0120] Furthermore, this configuration, in which the second group control device 3B continues to operate as a new first group control device 3A even after the first group control device 3A has recovered, can also be applied to the first and second modified examples described above.

[0121] [2-4] Fourth variation [2-4-1] Overall configuration of the elevator Figure 9 is a conceptual diagram showing the overall configuration of an elevator according to the fourth modified example. As shown in this figure, the elevator may further include a first communication control device 6A. Figure 10(A) shows a block diagram of the configuration of the first communication control device 6A.

[0122] Here, the first communication control device 6A is a device that communicates with one of the following related devices used in the elevator: a security device (such as a security gate), a robot (such as a transport robot), and a mobile terminal (such as a smartphone that functions as a destination floor registration device 1). Specifically, if the related device is a security device, the first communication control device 6A is a security management device that centrally manages the security device; if the related device is a robot, it is a robot management device that centrally manages the robot; and if the related device is a mobile terminal, it is a terminal management device that centrally manages the destination floors Fd registered on the mobile terminal.

[0123] Furthermore, the first communication control device 6A is equipped with an interface Jb for connecting itself to the network Wj (see Figure 10(A)), and is configured to allow software to switch the setting of enabling / disabling the connection to the network Wj via interface Jb. When the first communication control device 6A is operating as the managing entity for the related devices (a control entity that centrally manages the related devices), it sets the connection to the network Wj to "enabled".

[0124] Furthermore, the elevator in this modified version is equipped with a second communication control device 6B, which can replace the first communication control device 6A, as an element of the backup system. Figure 10(B) shows a block diagram of the configuration of the second communication control device 6B. The switching device 4 controls not only the switching of the control entity for group management, but also the switching of the management entity for related devices (switching from one of the first communication control device 6A and the second communication control device 6B to the other).

[0125] The second communication control device 6B, like the first communication control device 6A, is equipped with an interface Jb for connecting itself to the network Wj (see Figure 10(B)), and is configured to allow software switching of the connection to the network Wj via interface Jb. In this modified example, the interface Jb of the second communication control device 6B is assigned the same IP address as the interface Jb of the first communication control device 6A.

[0126] With such an interface Jb, even with both the first communication control device 6A and the second communication control device 6B powered on (ON state), the connection between their interfaces Jb and the network Wj can be enabled or disabled so that only one of the two communication control devices, either the first or the second, is always connected to the network Wj. In other words, even with the second communication control device 6B powered on (ON state), the connection to the network Wj can be disabled in software, thereby disconnecting the second communication control device 6B from the network Wj.

[0127] Therefore, even if a common IP address is assigned to the first communication control device 6A and the second communication control device 6B, by setting the connection to network Wj in the second communication control device 6B to "disabled," the second communication control device 6B can be kept powered on (ON state) without causing communication failures. Thus, when the second communication control device 6B replaces the first communication control device 6A, the time required to start up the second communication control device 6B (the time required to start it up from the OFF state) is eliminated.

[0128] Furthermore, the switching device 4 is connected to the first communication control device 6A and the second communication control device 6B by a cable Wk3 that directly connects the devices without going through the network Wj, so that they can communicate individually and directly (serial communication, etc.) with the first communication control device 6A and the second communication control device 6B (see Figure 9).

[0129] [2-4-2] Configuration of each device The configuration of each device will be explained in more detail below.

[0130] <First communication control device> The first communication control device 6A centrally manages the related devices in order to link them with the elevator, while also communicating the information necessary for coordination with the elevator to the group management control device 3, which is operating as the control entity for group management at that time. In this modified example, the switching device 4 performs a switch so that the first communication control device 6A becomes the management entity only when the first group management control device 3A is the control entity (in other words, if the second group management control device 3B becomes the control entity due to a switch to backup, the second communication control device 6B becomes the management entity). Details of the switch will be described later.

[0131] Furthermore, the first communication control device 6A periodically transmits an "alive status signal Sy" to the switching device 4 via the cable Wk3 that directly connects the devices (i.e., without going through the network Wj) when it is operating normally (transmission process). Hereinafter, the "alive status signal Sy" output from the first communication control device 6A will be referred to as the "alive status signal SyA" (see Figure 9).

[0132] Since the Alive status signal SyA is transmitted directly from the first communication control device 6A to the switching device 4 via cable Wk3, the switching device 4 will be able to reliably receive the Alive status signal SyA as long as there are no problems such as a break in cable Wk3, provided that the first communication control device 6A is able to transmit the Alive status signal SyA. In other words, the switching device 4 will only be unable to receive the Alive status signal SyA if the first communication control device 6A becomes unable to operate normally for some reason (such as a malfunction or maintenance) and is therefore unable to transmit the Alive status signal SyA.

[0133] Therefore, the switching device 4 can determine whether the first communication control device 6A is operating normally based on the reception status of the alive status signal SyA from the first communication control device 6A. Specifically, the switching device 4 can determine that the first communication control device 6A is no longer operating normally when it can no longer receive the alive status signal SyA from the first communication control device 6A.

[0134] By utilizing the alive status signal SyA in this way and enabling it to be received directly from the first communication control device 6A, it becomes possible to accurately and easily determine whether or not the first communication control device 6A is operating normally.

[0135] In terms of specific configuration, the first communication control device 6A includes a storage unit 61A and a control unit 62A in addition to the interface Jb (see Figure 10(A)).

[0136] The memory unit 61A is composed of memory devices such as ROM and RAM, and stores information necessary for the control processing performed by the first communication control device 6A (including control processing for managing related devices and control processing for setting switching). The control unit 62A is responsible for executing the control processing performed by the first communication control device 6A. Specifically, the control unit 62A is composed of processing devices such as a CPU and an MPU.

[0137] <Second group control device> In this modified example, if at least one of the first group management control device 3A and the first communication control device 6A becomes unable to operate normally (for example, if it is disconnected from the network Wj due to a malfunction or maintenance), the second group management control device 3B switches the connection setting to the network Wj from "disabled" to "enabled" in accordance with a command from the switching device 4. As a result, the control entity for group management is switched from the first group management control device 3A to the second group management control device 3B.

[0138] <Second communication control device> The second communication control device 6B is configured to perform control processing for managing related devices, similar to the first communication control device 6A (see Figure 10(B)).

[0139] In this modified example, if both the first group control device 3A and the first communication control device 6A are operating normally, the connection to network Wj in the second communication control device 6B is set to "disabled". As a result, the second communication control device 6B is disconnected from network Wj while remaining powered on.

[0140] On the other hand, if at least one of the first group management control device 3A and the first communication control device 6A becomes unable to operate normally (for example, if it is disconnected from the network Wj due to a malfunction or maintenance), the second communication control device 6B switches the connection setting to the network Wj from "disabled" to "enabled" according to a command from the switching device 4. As a result, the second communication control device 6B becomes capable of network communication and, consequently, becomes able to communicate with the related devices on behalf of the first communication control device 6A. In this way, the management authority for the related devices is switched from the first communication control device 6A to the second communication control device 6B.

[0141] Thus, in this modified example, if at least one of the first group management control device 3A and the first communication control device 6A becomes unable to operate normally (for example, if it is disconnected from the network Wj due to a malfunction or maintenance), the control entity for group management is switched to the second group management control device 3B, and in parallel, the control entity for related devices is switched to the second communication control device 6B.

[0142] Furthermore, the second communication control device 6B, when it is operating normally, periodically transmits an "alive status signal Sy" to the switching device 4 via the cable Wk3 that directly connects the devices (i.e., without going through the network Wj) (transmission process). Hereinafter, the "alive status signal Sy" output from the second communication control device 6B will be referred to as the "alive status signal SyB" (see Figure 9).

[0143] Since the Alive status signal SyB is transmitted directly from the second communication control device 6B to the switching device 4 via cable Wk3, unless there is a problem such as a break in cable Wk3, the switching device 4 will be able to reliably receive the Alive status signal SyB even if the connection to network Wj is set to "invalid" in the second communication control device 6B, as long as the second communication control device 6B is able to transmit the Alive status signal SyB. In other words, the switching device 4 will only be unable to receive the Alive status signal SyB if the second communication control device 6B becomes unable to operate normally for some reason (such as a malfunction or maintenance) and is therefore unable to transmit the Alive status signal SyB.

[0144] Therefore, the switching device 4 can determine whether the second communication control device 6B is operating normally based on the reception status of the alive status signal SyB from the second communication control device 6B. Specifically, the switching device 4 can determine that the second communication control device 6B is no longer operating normally if it can no longer receive the alive status signal SyB from the second communication control device 6B.

[0145] By utilizing the alive status signal SyB in this way and enabling it to be received directly from the second communication control device 6B, it becomes possible to accurately and easily determine whether or not the second communication control device 6B is operating normally.

[0146] In terms of specific configuration, the second communication control device 6B includes a storage unit 61B and a control unit 62B in addition to the interface Jb (see Figure 10(B)).

[0147] The memory unit 61B is composed of memory devices such as ROM and RAM, and stores information necessary for the control processing performed by the second communication control device 6B (including control processing for managing related devices and control processing for setting switching). The control unit 62B is responsible for executing the control processing performed by the second communication control device 6B. Specifically, the control unit 62B is composed of processing devices such as a CPU and an MPU.

[0148] <Switching device> In this modified example, the switching device 4 performs the following processing as a backup process.

[0149] In addition to determining the operating state Zs (=Zs1) for the first group control device 3A and the operating state Zs (=Zs2) for the second group control device 3B, the switching device 4 also determines the operating state Zs (=Zs3) of whether the first communication control device 6A is operating normally based on the reception status of the alive status signal SyA from the first communication control device 6A, and determines the operating state Zs (=Zs4) of whether the second communication control device 6B is operating normally based on the reception status of the alive status signal SyB from the second communication control device 6B.

[0150] Based on the information of all the operating states Zs (in this case, Zs1, Zs2, Zs3, and Zs4) obtained from those determinations, the switching device 4 determines whether it is necessary and possible to switch the control entity from the first group control device 3A to the second group control device 3B, and whether it is necessary and possible to switch the management entity from the first communication control device 6A to the second communication control device 6B, and transmits the information of all the operating states Zs to the monitoring device 5.

[0151] In this modified example, the switching device 4 determines that a combined switchover of the control entity for group management and the management entity for related devices is necessary if it determines that at least one of the operating states Zs (=Zs1) of the first group management control device 3A and the operating state Zs (=Zs3) of the first communication control device 6A is "abnormal". On the other hand, if the switching device 4 determines that both the operating state Zs (=Zs1) of the first group management control device 3A and the operating state Zs (=Zs3) of the first communication control device 6A are "normal", it determines that a combined switchover of the control entity for group management and the management entity for related devices is unnecessary.

[0152] Furthermore, if the switching device 4 determines that both the operating state Zs (=Zs2) of the second group management control device 3B and the operating state Zs (=Zs4) of the second communication control device 6B are "normal", it determines that a combined switchover of the control entity for group management and the management entity for related devices is possible. On the other hand, if the switching device 4 determines that at least one of the operating state Zs (=Zs2) of the second group management control device 3B and the operating state Zs (=Zs4) of the second communication control device 6B is "abnormal", it determines that a combined switchover of the control entity for group management and the management entity for related devices is not possible.

[0153] In this manner, if the switching device 4 determines that either the first group control device 3A or the first communication control device 6A is no longer functioning properly, it will switch both the first group control device 3A and the first communication control device 6A to the second group control device 3B and the second communication control device 6B, respectively, even if the other device is functioning properly, provided that a switchover is possible (i.e., both the second group control device 3B and the second communication control device 6B are functioning properly).

[0154] Figure 11 is a conceptual diagram illustrating the third device management data Dq3 used in this modified example. In this third device management data Dq3, for each device, device information Pd3 for identifying the device from other devices, the type Zr of the device, and the operating state Zs are recorded in a manner that is associated with each other, targeting the group management control device 3 and the communication control device 6.

[0155] Here, the type Zr of each device indicates whether the device is the first group control device 3A or the second group control device 3B if it is the group control device 3, or whether it is the first communication control device 6A or the second communication control device 6B if it is the communication control device 6. The operating status Zs of each device indicates whether the device is operating normally or not. In the example in Figure 11, it is shown that for each device, if the device is the first group control device 3A or the first communication control device 6A, "First" is recorded in the type Zr, and if the device is the second group control device 3B or the second communication control device 6B, "Second" is recorded in the type Zr. It is also shown that for each device, if the device is operating normally, "Normal" is recorded in the operating status Zs, and if the device is no longer able to operate normally, the operating status Zs is rewritten to "Abnormal".

[0156] The switching device 4 then transmits to the monitoring device 5 the latest information (Zs1, Zs2, Zs3, and Zs4) of the operating status Zs recorded in the third device management data Dq3 for the first group management control device 3A, the second group management control device 3B, the first communication control device 6A, and the second communication control device 6B. At this time, in order for the monitoring device 5 to recognize which device each operating status Zs represents, the switching device 4 also transmits to the monitoring device 5 the device information Pd3 of the device showing that operating status Zs, linked to the information of that operating status Zs.

[0157] According to the fourth modified example, even when a backup communication control device 6 (second communication control device 6B) corresponding to the first communication control device 6A is provided in the backup system, the monitoring device 5 can individually identify devices that have become unable to operate normally based on the operating status Zs information received from the switching device 4, and can instruct workers to perform maintenance on those devices.

[0158] [2-5] Fifth variation In the fourth modified example described above, if the switching device 4 determines that at least one of the operating state Zs (=Zs1) of the first group control device 3A and the operating state Zs (=Zs3) of the first communication control device 6A is "abnormal", it may switch only the device that was determined to be "abnormal" to the backup device.

[0159] [2-6] Sixth variation In all of the embodiments described above and the first to fifth modifications, the switching device 4 may determine not only whether or not a switch in the control entity is necessary, but also whether or not a switch in the control entity is possible, based on the information of the operating state Zs (i.e., Zs1 and Zs2) obtained from the reception status of the alive state signals SxA and SxB, but may also determine only whether or not a switch in the control entity is necessary. In this configuration, if the switching device 4 determines that a switch in the control entity is necessary, it may transmit a command signal to execute the switch (transmission of a deactivation command signal Sp to the first group control device 3A and transmission of an activation command signal Sq to the second group control device 3B), regardless of whether or not the switch is possible.

[0160] Furthermore, in the fourth and fifth modified examples described above, the switching device 4 may determine not only whether a switch in the management entity is necessary, but also whether it is possible to switch the management entity from the first communication control device 6A to the second communication control device 6B, based on the information of the operating state Zs (i.e., Zs3 and Zs4) obtained from the reception status of the alive state signals SyA and SyB. In this configuration, if the switching device 4 determines that a switch in the management entity is necessary, it may transmit a command signal to execute the switch (transmission of a deactivation command signal Sp to the first communication control device 6A and a activation command signal Sq to the second communication control device 6B), regardless of whether the switch is possible or not.

[0161] [2-7] Seventh variation In all of the embodiments described above and the first to sixth modifications, the elevator may be equipped with a backup switching device that can replace the switching device 4 as an element of the backup system. In this configuration, the backup switching device can determine whether or not it is necessary to switch to itself (switch to the backup) by checking the operating status Zs of the switching device 4 via a cable directly connecting it to the switching device 4.

[0162] The above-described embodiments and modifications should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims, rather than by the above-described embodiments and modifications. Furthermore, the scope of the present invention is intended to include all modifications within the meaning and scope equivalent to the claims.

[0163] From the embodiments and modifications described above, the subject matter of the invention may not be limited to a backup system, but may also be individually extracted from control processes (including control methods corresponding to said control processes) or programs performed by said backup system. Furthermore, some or all of the elevator described above, and even some or all of the control processes performed by said elevator, may also be extracted as the subject matter of the invention. [Explanation of Symbols]

[0164] 1. Destination Floor Registration Device 2. Elevator control device 3. Group Control System 3A First Group Control Device 3B Second Group Control Device 4. Switching device 5 Monitoring device 6. Communication control device 6A First communication control device 6B Second communication control device G Car X boarding area call Y Calling 31A, 31B Storage section 32A, 32B Control Unit 41 Storage section 42 Control Unit 61A, 61B storage section 62A, 62B Control Unit Dp training data FC Departure Floor Fd Destination Floor Fs installation floor Ja, Jb interface PE Subject Information Pf Flag Information Pg Shopping Cart Information PM Operation Data Sp Disable command signal Sq Activation command signal Sx, Sy Alive status signals WJ Network Zr Type Zs operating status Dq1 First Device Management Data Dq2 Second Device Management Data Dq3 Third Device Management Data Pd1, Pd2, Pd3 Device Information SxA, SxB, SxC, SyA, SyB Alive status signals Wk1, Wk2, Wk3 Cables

Claims

1. The first group control device is a backup system applicable to elevators connected to a network, A group control device that can replace the first group control device, comprising a second group control device connected to the network, A switching device that controls the switching from the first group control device to the second group control device, Equipped with, Both the first group control device and the second group control device transmit an "alive" status signal to the switching device without going through the network when they are operating normally. The aforementioned switching device is For each of the first and second group control devices, a determination (A) of the operating status of whether or not the group control device is operating normally is made based on the reception status of the alive status signal from the group control device. An elevator backup system that determines whether it is necessary to switch from the first group control device to the second group control device based on all the operating status information obtained in the determination (A), and transmits all the operating status information to a monitoring device that remotely monitors the elevator.

2. The elevator backup system according to claim 1, wherein the switching device transmits an "alive" status signal to the monitoring device, along with the operating status information, when it is operating normally.

3. The elevator backup system according to claim 1 or 2, wherein the switching device transmits to the monitoring device, along with the operating status information, entity information indicating whether the control entity for group management at that time is the first group management control device or the second group management control device.

4. The elevator further has a first communication control device connected to the network that communicates with an associated device which is one of a security device, a robot, or a mobile terminal used in the elevator, and the backup system according to claim 1 or 2 is applied to the elevator. A communication control device that can replace the first communication control device, a second communication control device connected to the network, Furthermore, The switching device also controls the switching from the first communication control device to the second communication control device. Both the first communication control device and the second communication control device transmit an "alive" status signal to the switching device without going through the network, when they are operating normally. The aforementioned switching device is In addition to the determination (A) above, for each of the first and second communication control devices, a determination (B) is made regarding the operating status of whether the communication control device is operating normally, based on the reception status of the alive status signal from the communication control device. An elevator backup system that determines, based on all the operating status information obtained in the above determinations (A) and (B), whether or not it is necessary to switch from the first group control device to the second group control device and whether or not it is necessary to switch from the first communication control device to the second communication control device, and transmits all the operating status information to the monitoring device.

Images