JP4115219B2 - Elevator control device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an elevator control device, and in particular, when a program is executed in a nonvolatile memory for storing programs, the control may be hindered due to garbled data in the memory, etc., and the elevator will fail and traffic services cannot be provided until recovery. In view of the above, the present invention relates to an elevator control device capable of avoiding an elevator failure and providing a highly reliable control program when data corruption occurs in a memory.
[0002]
[Prior art]
FIG. 6 is a configuration diagram of an operation control circuit of a conventional elevator control device.
[0003]
As shown in the figure, the operation control circuit of the elevator control device 10 includes an operation control CPU 1 for executing operation control, a program storage memory 2 which is a nonvolatile memory storing a program for operation control processing, and elevator control. A maintenance interface 4 required for communication between the apparatus 10 and the monitoring center 8 of the elevator company via the telephone line 7, an elevator state detection circuit 6 for detecting the state of the elevator, and control data are stored. The data storage memory 12 is a volatile memory.
[0004]
Further, in an environment in which multiple units are installed in one building, in a system that performs control of two units or group management control, a communication line 9 for communication between the other unit communication interface 5 and the other unit 20 is further configured. The other machine 20 is connected via the communication line 9. The internal configuration of the other machine 20 has the same operation control circuit configuration as that of the elevator control device 10 in the figure.
[0005]
Generally, the above-described operation control CPU 1 uses a CPU that performs calculations related to elevator operation control, performs arithmetic processing for determining a stop floor of an elevator car, and performs calculations from 16 bits to 32 bits.
[0006]
As the program storage memory 2, an EPROM or a flash ROM which is a nonvolatile memory of about 256 KB is generally used.
[0007]
The maintenance interface 4 communicates with the operation control CPU 1 described above, converts the data into the protocol of the telephone line 7, and communicates data with the monitoring center 8 of the elevator maintenance company.
[0008]
The other machine communication interface 5 converts the data transmitted from the operation control CPU 1 into serial data, and communicates with the other machine 20 through optical communication or a long distance communication interface such as RS-422, RS-485, and LAN via the communication line 9. Communication.
[0009]
The elevator state detection circuit 6 reads the elevator car position detection function and the status of switches and sensors attached to the elevator, including detection of landing level, as signals, and the operation control CPU 1 calculates the above signals. The elevator state is detected at.
[0010]
The data storage memory 12 is generally a static RAM, which is a volatile memory of about 256 KB, and is used for storage of elevator control data and a register for storing a checksum value obtained by calculating the sum of program data. Is done.
[0011]
In calculating the above-described signals, the operation control CPU 1 reads the program data stored in the program storage memory 2 to calculate various signals of the elevator read from the elevator state detection circuit 6 and thereby operates the elevator operation command. For this reason, it is required to accurately read out the program data stored in the program storage memory 2, and if the data is read out by mistake, the intended operation control malfunctions and the safe operation service cannot be provided. Since there is a possibility that there is a possibility, the operation control CPU 1 generally performs a checksum process for calculating the total sum of data in the program storage memory 2.
[0012]
Next, an outline of the checksum process will be described.
[0013]
The operation control CPU 1 always calculates the sum of the program data data and stores it as a checksum register in the data storage memory 12, but compares the previous checksum data with the currently calculated checksum data before storing. Whether or not there is an abnormality is determined. If there is a difference in data, it is determined that there is a difference in data in the area where the checksum is performed, and a checksum error is determined. When a checksum error occurs, the program data that is not originally changed is changed, so it is considered that the data was garbled. Therefore, the elevator failed to avoid the risk of program malfunction or runaway. To perform the process.
[0014]
[Problems to be solved by the invention]
However, along with the recent increase in the degree of integration of the program storage memory 2 due to the development of electronic components, the non-volatile memory used for the program storage memory 2 is continuously accessed with the limit value of writing frequency and a fixed address. In the case of continuing, there was a problem that a phenomenon such as garbled data occurred due to a charge gain phenomenon caused by accumulation of electric charges at the accessed address.
[0015]
SUMMARY OF THE INVENTION An object of the present invention is to provide an elevator control apparatus capable of avoiding an elevator failure and performing highly reliable control of an elevator when data corruption occurs in a memory.
[0016]
[Means for Solving the Problems]
An elevator control device according to the present invention includes a processing device for performing predetermined control in an elevator, a first memory for storing program data of a program for predetermined control, and a program for predetermined control . In an elevator control device that includes a second memory that stores program data transferred from the first memory and that normally performs predetermined control by the processing device using the program data in the second memory , Communication means for performing communication, means for verifying program data between multiple units via this communication means, and confirming that the elevator of each unit has stopped when there is a verification error, programming between multiple units And means for transferring data .
[0017]
According to the present invention having such a configuration, for example, the first memory composed of the nonvolatile memory is limited to the use of the program storage memory, and the second memory serving as the program execution memory is provided separately. If, for example, a freely readable / writable volatile memory is used as the second memory to have a verification check function for preventing data corruption in the program execution memory, the elevator can be controlled with high reliability. be able to.
In addition, the reliability of the program data can be further improved by performing a program data verify check between multiple machines.
[0018]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0019]
FIG. 1 is a configuration diagram of an operation control circuit of an elevator control apparatus according to an embodiment of the present invention. As shown in the figure, the operation control circuit of the elevator control device 10 includes an operation control CPU (processing device) 1 for executing operation control, and a program storage memory which is a nonvolatile memory storing an operation control processing program. 2, and a program execution memory 3, which is a volatile memory for executing the above-described operation control processing program, and the telephone line 7 between the elevator control device 10 and the elevator company monitoring center 8. A maintenance interface 4, an elevator state detection circuit 6 for detecting the state of the elevator, a data buffer memory 11 capable of temporarily saving data, and a volatile memory storing control data. The data storage memory 12 and the above-described operation control CPU 1 are the program storage memory 2 and the program execution memory. The constituted by the bank switching control signal 13 for controlling any or the memory becomes accessible.
[0020]
As the program execution memory 3 described above, a volatile memory having a memory area equal to or greater than that of the program storage memory 2 is used, and generally a static RAM with no restriction on the number of writing is used.
[0021]
As the program storage memory 2, a non-rewritable EPROM, an electrically erasable EEPROM, an electrically erasable block ROM flash ROM, or the like is used as a nonvolatile memory. The magnetic memory MRAM and dielectric FCRAM, which are under development toward the future, have the same characteristics and can be rewritten and erased in bit units, so they are excellent in data processing and are expected to be used in the future. The
[0022]
The program execution memory 3 is arranged at the same address as the program storage memory 2 and the operation control CPU 1 accesses the memory by a bank selection function for controlling which element can be accessed using the bank switching control signal 13. I do. This is because the process of transferring data at the same address to a different bank can be performed more simply in terms of software processing than when transferring data to different addresses when transferring program data. Bank selection method.
[0023]
In an environment in which multiple units are installed in one building, in a system that performs control of two units or group management control, a communication line 9 for communication with another unit and a communication line 9 for communication with other units is further configured. The other machine 20 is connected via the communication line 9. The internal configuration of the other machine 20 has the same operation control circuit configuration as that of the elevator control device 10 in the figure.
[0024]
Next, a method for transferring program data will be described.
[0025]
First, the program activation method will be described with reference to FIG.
[0026]
When the power is turned on in advance, the bank selection control signal 13 must be prepared so that the program storage memory 2 can be selected. When the elevator control device 10 is turned on, the operation control CPU 1 first loads the program storage memory 2 into the program storage memory 2. The stored program transfer program is saved in the data buffer memory 11 (step S21). When the saving is completed, the program transfer program saved in the data buffer memory 11 is executed.
[0027]
In the program transfer program, first, the control program data in the program storage memory 2 is saved in the data buffer memory 11 (step S22). Here, since the program transfer program is also executed from the data buffer memory 11, data is saved to an area where the program transfer program is not stored. Next, the bank switching control signal 13 is changed to the program execution memory 3 (step S23), and the control program data transferred to the data buffer memory 11 is transferred to the program execution memory 3 (step S24). When the control program data cannot be transferred from the program storage memory 2 to the program execution memory 3 at a time, the bank switching control signal 13 is changed to the program storage memory 2 (step S26), the process returns to step S22, and the transfer operation is repeated. . When the transfer is completed, the control program stored in the program execution area can be executed (step S27).
[0028]
When the program data is saved / transferred to another memory, data consistency is sequentially confirmed (step S25). As a method of checking consistency, that is, as a verification check, there is a method such as data verification for comparing all area data of data before transfer and data after transfer, or checksum processing for comparing checksum data that is the sum of each transfer data. Confirm that no data corruption occurred during transfer.
[0029]
When the transfer of the program data to the program execution memory 3 is completed, the operation control CPU 1 subsequently reads the program data from the program execution memory 3 and performs operation control. In this case, since the program execution memory 3 is a volatile memory, it can be read and written at random. Therefore, in order to avoid garbled program data due to erroneous writing, a consistency check is always performed. This consistency check is performed by, for example, checksum processing by comparison with the previous checksum data in the program execution memory 3, but data verification or check of the entire data area of the program storage memory 2 and the program execution memory 3 is performed. It can also be done by sum processing.
[0030]
The program exchange procedure when a data consistency abnormality occurs during the execution of this control program will be described with reference to FIG.
[0031]
When a data consistency error occurs, the error content is first recorded in an error code storage area built in the data storage memory 12, and an error is issued to the monitoring center 8 via the maintenance interface 4, that is, an error is detected. A warning is given (step S31). In this case, the number of times the error has occurred and the date and time of occurrence can also be transmitted, so that the workers of the elevator maintenance company stationed at the monitoring center 8 can check the tendency of the error, and can be handled effectively as maintenance data. It becomes.
[0032]
Next, it is determined whether the elevator is running or stopped (step S32). If the elevator is running, the vehicle is decelerated and the car is moved to the nearest floor and stopped (step S33). This is a process that is performed when the backup transfer process of the program is performed while the elevator is running, because there is a risk that the elevator may become out of control, and the data transfer work must be performed in a safe state that the elevator is stopped. It is a process to do.
[0033]
After confirming that the elevator has stopped, an announcement is made in the car indicating that the vehicle is out of order or in recovery, or "please wait for a while" to notify the passenger of the abnormality. Further, since it can be assumed that there is a passenger who stops using the elevator during the failure, all call registrations are cleared (step S34). After completing the procedure for the failure, the program data backed up from the program storage memory 2 to the program execution memory 3 is transferred (step S35), and when the transfer is completed, the restoration completion notice is performed in the car. By executing the control program in the program execution memory 3 (step S36), it is possible to avoid a permanent failure of the elevator, so that the reliability of the elevator control can be improved.
[0034]
The data consistency check can be realized by the above-described data verification or checksum processing of the entire data area, and the program data transfer method can be realized by the same method as the control program transfer method when the control device is activated.
[0035]
Regarding the determination of the stop of the elevator, for example, the car position pulse data is not displaced within a predetermined time from the elevator state detection circuit 6, the elevator landing switch is on for a predetermined time, the motor control CPU to the inverter This can be easily judged from the fact that the control state data is received and the inverter control is stopped.
[0036]
Here, the procedure for issuing an error to the monitoring center 8 will be described with reference to FIG.
[0037]
When an abnormality occurs in the consistency of the program data, the date / address / address at which the consistency abnormality occurred and the record of normal data and abnormal data are stored in the data storage memory 12 (step S43).
[0038]
Here, for the address and data of the consistency abnormality, the data in the program storage memory 2 is transferred to the data buffer memory 11 (step S41), and the data in the data buffer memory 11 and the data in the program execution memory 3 are transferred. It can be easily realized by confirming the consistency (step S42), that is, by verifying the contents of the data in the program storage memory 2 and the data in the program execution memory 3 and recording different addresses and data. Regarding the difference data, the data in the program storage memory 2 becomes inaccessible during the execution of the program and becomes correct data, and the data in the data execution memory 3 becomes garbled data.
[0039]
These data are read from the data storage memory 12 and transmitted to the maintenance interface 4 (step S44). In addition to the abnormal data, the data to be transmitted also includes the delivery code of the control device. The maintenance interface 4 is provided with a communication control circuit, and the received data is transmitted by serial communication according to the telephone line format (step S45).
[0040]
The monitoring center 8 side receives the abnormality information from the telephone line, records the abnormality information on the server of the monitoring center 8 (step S46), and notifies the elevator maintenance company employees on a display device such as a monitor (step S47). .
[0041]
Further, as a means for confirming the consistency of program data in the program data backup method described above, the program data checksum values with other machines 20 are checked for consistency between machines, and a program is executed when a consistency error occurs. It is also effective to perform backup transfer processing.
[0042]
A program exchange procedure with another machine 20 will be described with reference to FIG.
[0043]
In general, unit-to-unit communication uses serial communication to exchange data from the viewpoint of reducing the number of wires on the communication line 9, and when performing a verification check of the entire program data area, the length of the check time hinders elevator control. In addition, the checksum value consistency check by the checksum processing is valid.
[0044]
As a method for confirming the consistency of the checksum value, the checksum data of the other machine 20 is converted from serial data to parallel data by the other machine communication interface 5, and the operation control CPU 1 stores the data storage memory as the checksum data of the other machine 20. 12 (step S51). Further, the operation control CPU 1 always stores the checksum data of the own machine in the data storage memory 12 in the same manner (step S52). Here, if there is a difference between the stored checksum data, it is impossible to determine which unit's program has failed, so the checksum data received from the other unit one time ago and the previous one's own Similarly, the checksum data of the unit is also stored in the data storage memory 12.
[0045]
Then, the checksum data of the own machine and the other car stored in the data storage memory 12 are compared (step S53). If there is a difference in the checksum data, the previous one stored in the data storage memory 12 is compared. With reference to the checksum data, the data machine having the difference is determined to be a program error (step S54). That is, if you refer to the checksum data of your own machine and the other machine and the checksum data of your own machine and the other machine of the previous time, it is different from the other three by one, so that machine has a program error. Can be determined.
[0046]
If the own machine is abnormal, first check and check the checksum data of the program storage memory 2 of the own machine and the checksum data of the other machine. If they match, the program data is programmed according to the program startup procedure described above. The program is transferred from the storage memory 2 to the program execution memory 3, and the control program in the program execution memory 3 is started after the transfer is completed.
[0047]
When the checksum of the program storage memory 2 of the own machine and the checksum of the other machine stored in the data storage memory 12 are different, the machine that sends the data program data and the machine that receives the program data stop the elevator After confirming the stop (steps S55 to S60), the program data is communicated by serial communication via the communication line 9 (steps S61 to S63), and the receiver receives the data in the other unit communication interface 5 in parallel. The data is converted and stored in the data buffer memory 11 (step S64).
[0048]
The elevator stop procedure is realized by the program exchange procedure when a data consistency abnormality occurs during the execution of the control program.
[0049]
When the program data from the other machine is transferred to the data buffer memory 11, the program data stored in the data buffer memory 11 is transferred to the program storage memory 2 and the program execution memory 3 (step S65). The control program is executed from the program execution memory 3 (step S66). Data transfer processing from the data buffer memory 11 to the program storage memory 2 and the program execution memory 3 is realized by the same means as the program activation method using the bank switching control signal 13.
[0050]
On the other hand, in order to improve the reliability of the program data in the program storage memory 2, in the case where the program storage memory 2 is a rewritable EEPROM or flash ROM, the checksum value of the data in the program execution memory 3 is set once. When the checksum processing is always performed for comparison with the checksum value of the data in the program execution memory 3 and the checksum in the program execution memory 3 is normal, the program data in the program execution memory 3 is programmed while the elevator is stopped at a constant cycle. It is possible to ensure the reliability of the backed up program data by transferring the data to the storage memory 2. The program transfer procedure is realized by the same means as the program activation method using the bank switching control signal 13.
[0051]
Although the reliability of the program data has been described as described above, the reliability of the data can be improved by the same processing for the processing for preventing data corruption of the control fixed data. That is, the control fixed data is backed up in a certain free area of the program storage memory 2 to verify the control fixed data originally stored in the data storage memory 12 and the backup data (data verification of the entire data area). Or checksum processing), or a verification check that compares the control-fixed data stored in the data storage memory 12 with the previous control-fixed data stored in the data storage memory 12 (data verification or check of the entire data area) (Sum processing) is always performed, and in the case of a verify error, after confirming that the elevator is stopped, the backup data can be transferred to the data area of the data storage memory 12 that is originally stored.
[0052]
Currently, the mainstream of nonvolatile memory for storing programs is a memory that writes and erases in blocks, such as a flash ROM, but elements currently under development in the memory industry include one byte such as magnetic memory MRAM and dielectric memory FCRAM. Since correction of programs and data is expected to be possible in units, correction of small-capacity fixed data will be an effective function in the future.
[0053]
Further, in this embodiment, the elevator operation control circuit is described as an example, but motor control, door control, landing control, on-car control, and car operation panel control that are controlled by the CPU in the elevator control device. Since the control using the CPU as described in the embodiment is also performed in the control such as the display device control, the group management control, and the second unit control, the reliability of the program data is improved by the same configuration and means of the control device. Can be achieved.
[0054]
By performing the above processing, the elevator control device can perform safe elevator control that is safe and is unlikely to cause a failure due to malfunction such as garbled data.
[0055]
【The invention's effect】
ADVANTAGE OF THE INVENTION According to this invention, the safe elevator control apparatus with which the danger by the malfunction of the data of an elevator, and a failure hardly occur can be obtained.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an elevator control apparatus according to an embodiment of the present invention.
FIG. 2 is a flowchart showing a program start method according to an embodiment of the present invention.
FIG. 3 is a flowchart showing a program exchange procedure according to an embodiment of the present invention.
FIG. 4 is a flowchart showing a procedure for issuing an error according to an embodiment of the present invention.
FIG. 5 is a flowchart showing a program exchange procedure with another machine according to an embodiment of the present invention.
FIG. 6 is a block diagram showing a configuration of a conventional example.
[Explanation of symbols]
1 ... Operation control CPU
2 ... Program storage memory 3 ... Program execution memory 4 ... Maintenance interface 5 ... Other unit communication interface 6 ... Elevator state detection circuit 7 ... Telephone line 8 ... Monitoring center 9 ... Communication line 10 ... Elevator controller 11 ... Data buffer memory 12 ... Data storage memory 13 ... Bank switching control signal 20 ... Other units

Claims (5)

A processing device for performing predetermined control in an elevator, a first memory for storing program data of the predetermined control program, and transfer from the first memory for executing the predetermined control program And a second memory for storing the program data, and in an elevator control device that normally performs predetermined control by the processing device using the program data in the second memory , communication between a plurality of units is performed. Means for verifying the program data between a plurality of units through the communication means, and confirming that the elevator of each unit has stopped when a verification error occurs, the program data between the plurality of units elevator control apparatus characterized by comprising a means for transferring.   2. The elevator control device according to claim 1, wherein checksum processing of program data in the second memory is always performed, and when an abnormality occurs, it is confirmed that the elevator has stopped and the second memory is changed from the first memory to the second memory. An elevator control device comprising means for transferring program data to the elevator.   3. The elevator control device according to claim 1, wherein checksum processing of program data in the second memory is always performed, and when normal, it is confirmed that the elevator has stopped and the second memory is An elevator control device comprising means for transferring program data to a first memory.   2. The elevator control device according to claim 1, wherein a verification check of program data in the first memory and the second memory is constantly performed to detect whether there is an abnormality, and when the second memory is abnormal, the elevator is An elevator control apparatus comprising means for confirming that the program is stopped and transferring program data from the first memory to the second memory. 5. The elevator control apparatus according to claim 1, wherein a control fixed data storage memory for storing control fixed data, control fixed data backup means for backing up control fixed data, and control fixed data storage. A means for performing a verification check between the control fixed data in the memory and the backed-up control fixed data, or a control check of the control fixed data in the memory for storing the control fixed data and the control fixed data of the previous time, and the elevator in the event of a verify error An elevator control apparatus comprising: means for confirming that the control has been stopped and transferring the backed-up control fixed data to the control fixed data storage memory .

Images