Elevator control device and control method for elevator control device
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Filing Date
- 2024-01-29
- Publication Date
- 2025-08-07
AI Technical Summary
Elevator control devices face deadlock states due to watchdog timer (WDT) resets during initial processing when power is turned on or nonvolatile memory is rewritten, as the WDT cannot be refreshed within the monitoring time, leading to system abnormalities.
Implementing a watchdog timer with mode-specific monitoring time limits for initialization, normal operation, and ROM write modes, allowing the WDT to activate without disabling its function, thereby preventing deadlock by issuing a reset signal when abnormalities occur.
Prevents deadlock in elevator control devices by ensuring the WDT can monitor and reset the system appropriately in different operational modes, maintaining functionality during power-on initialization and memory write processes.
Abstract
Description
Elevator control device and control method for elevator control device
[0001] The present disclosure relates to an elevator control device and a control method for an elevator control device.
[0002] Japanese Patent Application Laid-Open Publication No. 2004-326629 discloses the following technology: "An abnormality monitoring device that monitors abnormalities in a microcomputer of a navigation system or the like is equipped with a watchdog timer monitoring unit (WDT monitoring unit) 4 that detects abnormalities during normal operation of the microcomputer 1, a standby monitoring unit 7 that detects abnormalities during standby operation of the microcomputer 1, and a monitoring mode switching unit 8 that switches between a normal detection mode in which the WDT monitoring unit 4 operates and a standby detection mode in which the standby monitoring unit 7 operates in accordance with a standby instruction signal to the microcomputer 1."
[0003] Japanese Patent Application Laid-Open No. 2004-326629
[0004] In elevator control devices that control elevator equipment, for example, the monitoring time of a watchdog timer (WDT) may be set to a monitoring time limit that is approximately 1.5 to 2 times the task period during normal operation. In such cases, the elevator equipment may take longer to process during initial processing when the power is turned on or when the contents of nonvolatile memory (ROM) are rewritten than during normal operation. As a result, the WDT cannot be refreshed within the monitoring time (also called the monitoring time limit), and the monitoring time expires, resulting in a reset operation. To avoid this problem, a technology is available that disables the WDT until the initial processing is completed when the power is turned on, and then enables the WDT based on a command from a microcomputer after the initial processing is completed. However, if a system abnormality occurs during the initial processing, the elevator equipment or elevator control device may enter a deadlock state.
[0005] The present disclosure provides a technology for an elevator control device that can prevent deadlock of the elevator control device by activating the monitoring device when an abnormality occurs without disabling the monitoring function, by providing the monitoring device with a monitoring time limit that corresponds to the operating mode.
[0006] Other objects and novel features will become apparent from the description of this specification and the accompanying drawings.
[0007] A brief summary of representative aspects of this disclosure is as follows.
[0008] According to one embodiment, an elevator control device includes: a car terminal control unit; and a car terminal control unit connected to the car terminal control unit, wherein the car terminal control unit is configured to be placed in an initialization operation mode when power is turned on and to transition to a normal operation mode after completion of initialization operation in the initialization operation mode, the car terminal control unit includes: a control unit that controls operation; and a watchdog timer (WDT) that monitors operation of the control unit, the WDT including a counter that counts clock signals, a mode determination unit, and a time limit setting unit, the mode determination unit has a database including: a first setting area that stores a first monitoring time limit for the counter in the initialization operation mode; and a second setting area that stores a second monitoring time limit for the counter in the normal operation mode, the mode determination unit sets the first monitoring time limit in the time limit setting unit according to the initialization operation mode, and monitors the control unit using the counter based on the first monitoring time limit in the initialization operation mode, The mode determination unit determines a transition from the initialization operation mode to the normal operation mode based on the initialization completion signal issued from the control unit, and sets the second monitoring time limit in the time limit setting unit, and monitors the control unit using the counter based on the second monitoring time limit in the normal operation mode.
[0009] According to the elevator control device of the above embodiment, by providing a watchdog timer as a monitoring device with a monitoring time limit corresponding to the operating mode, it is possible to provide a technology that can prevent deadlock in the elevator control device (controller of the car terminal control unit) by activating the monitoring device when an abnormality occurs without disabling the monitoring function.
[0010] FIG. 1 is a schematic diagram showing the overall configuration of an elevator apparatus according to an embodiment. FIG. 2 is a schematic diagram showing the configuration of a car terminal control unit of FIG. 1. FIG. 3 is a diagram illustrating an example of the configuration of a database set in the WDT mode setting unit of FIG. 2. FIG. 4 is a timing diagram illustrating an example of the operation of the WDT of FIG. 2. FIG. 5 is a flow diagram illustrating a transition from an initialization operation mode to a normal operation mode. FIG. 6 is a flow diagram illustrating a transition from the normal operation mode to a ROM write mode. FIG. 7 is a flow diagram illustrating a transition from the ROM write mode to the normal operation mode. FIG. 8 is a schematic diagram showing the configuration of a car terminal control unit according to a modified example.
[0011] Hereinafter, embodiments will be described with reference to the drawings. However, in the following description, the same components will be assigned the same reference numerals, and repeated description may be omitted. Note that the drawings may be more schematic than the actual embodiment to clarify the description, but they are merely examples and do not limit the interpretation of the present disclosure.
[0012] (Embodiment) Fig. 1 is a schematic diagram showing the overall configuration of an elevator control device according to an embodiment. Fig. 2 is a schematic diagram showing the configuration of a car terminal control unit of Fig. 1.
[0013] As shown in FIG. 1, elevator control device 100 includes car control unit 101, car unit 102 for carrying passengers or baggage, hoisting control unit 103 having motor unit 107 for moving car unit 102 up and down based on the control of car control unit 101, rope 104 installed between car unit 102 and motor unit 107, car terminal control unit 105 installed in car unit 102, and hall terminal control unit 108 installed in the hall of each floor.
[0014] The car number control unit 101 allocates cars to the car unit 102 based on information from the car terminal control unit 105 and information from the hall terminal control unit 108, and controls the output of an operation command to the hoisting control unit 103 to the car allocation floor.
[0015] The hoisting control unit 103 is a control unit that raises and lowers the car unit 102 in accordance with commands from the car control unit 101.
[0016] The car terminal control unit 105 performs processing to transmit data of devices such as destination floor buttons and open / close buttons installed in the car unit 102 that carries users or luggage to the car unit control unit 101. The car terminal control unit 105 also performs processing to transmit data transmitted from the car unit control unit 101 to devices installed in the car unit 102, such as a floor display unit.
[0017] The rope 104 connects the cage part 102 and the motor part 107. The rope 104 is wound up by the motor part 107 of the winding control part 103, whereby the cage part 102 moves up and down.
[0018] The hall terminal control unit 108 installed on each floor performs processing to transmit data from the hall button unit 106 installed in the hall to the machine control unit 101. The hall terminal control unit 108 also performs processing to transmit data transmitted from the machine control unit 101 to displays and the like installed in the hall.
[0019] The hall button unit 106 is installed in the hall that is the elevator landing on each floor, and is an up and down button that the user presses to call the car unit 102 from the elevator hall.
[0020] As shown in FIG. 2 , the car terminal control unit 105 includes an overall control unit 20 and a peripheral control unit 21. The overall control unit 20 includes a communication control unit 22 that controls communication with the car terminal control unit 101, a control unit 23 that controls the overall operation of the car terminal control unit 105, and a refresh unit (WDT refresh unit) 24 that generates a refresh instruction signal (also called a clear signal) REF for refreshing (clearing) the count value of a watchdog timer (WDT) 27 (described later). The refresh unit 24 is configured to receive a refresh request signal REFQ from the control unit 23 periodically or at regular time intervals when the control unit 23 is operating normally. Upon receiving the refresh request signal REFQ, the refresh unit 24 sends a refresh instruction signal REF to the WDT 27. This refreshes (clears) the count value of the counter 33 of the WDT 27. After being refreshed (cleared), the counter 33 is configured to start counting again.
[0021] The control unit 23 may be configured, for example, by a data processing device (processor) including a central processing unit (CPU), and may execute a boot program, an operation control program, a ROM write program, and the like, stored in a non-volatile program read-only memory (ROM) 0. When power (not shown) is applied to the elevator control device 100, the car control unit 101 and the control unit 23 of the car terminal control unit 105 transition to an initialization operation mode (INM). When the control unit 23 transitions to the initialization operation mode (INM), the boot program is executed by the control unit 23. When the boot program is executed, an initialization setting operation is performed on the car terminal control unit 105 when the car terminal control unit 105 is powered on. The initialization operation mode (INM) can also be referred to as an initial mode. After the initialization setting operation is completed, the car terminal control unit 105 and the control unit 23 transition to a normal operation mode (OM), and the control unit 23 begins executing an operation control program, which is a user program. When the operation control program is executed, the control unit 23 controls the overall operation of the car unit 102 and the opening and closing of the doors. When data is written to or rewritten in the nonvolatile memories ROM1 and ROM2, which will be described later, the car terminal control unit 105 and the control unit 23 transition to a nonvolatile memory write mode (hereinafter referred to as ROM write mode) RWM, and a ROM write program is executed by the control unit 23. When the ROM write program is executed, data is written to or rewritten in the nonvolatile memories ROM1 and ROM2. The nonvolatile memories ROM1 and ROM2 can be configured, for example, by electrically rewritable and erasable nonvolatile memories such as flash memories.
[0022] The peripheral control unit 21 includes a communication control unit 25 that controls communication with the control unit 23, an input / output control unit (IO control unit) 26 that controls input / output devices (not shown) such as a door control unit connected to the peripheral control unit 21, and a watchdog timer (WDT) 27 that functions as a monitoring device that monitors the operation of the control unit 23.
[0023] The communication control unit 25 is connected to the control unit 23 via a communication path 50. The communication control unit 25 is also connected to the nonvolatile memory ROM1 via a communication path 51, and to the nonvolatile memory ROM2 via a communication path 52. This allows the control unit 23 to write and read data to and from the nonvolatile memories ROM1 and ROM2 via the communication path 50, the communication control unit 25 of the peripheral control unit 21, and the communication paths 51 and 52. In this example, the nonvolatile memory ROM1 stores, for example, audio data. The nonvolatile memory ROM2 stores, for example, data for user functions and display-related data.
[0024] Furthermore, the car terminal control unit 105 is provided with a reset unit 40 and a power supply monitoring unit 41 that monitors the power supply. The reset unit 40 is configured to supply a reset signal RST to the overall control unit 20 and the peripheral control unit 21 in the event of a power supply abnormality or an abnormality in the control unit 23, thereby initializing the overall control unit 20 and the peripheral control unit 21.
[0025] The WDT 27 includes a clock signal (CLK) 31 generated from an oscillator circuit (not shown), a frequency divider 32 capable of dividing the CLK 31 to a desired frequency division ratio, a counter (WDT counter) 33, a mode setting unit (WDT mode setting unit) 34, a time limit setting unit (WDT time limit setting unit) 35, and a reset issuing unit (WDT reset issuing unit) 36.
[0026] The WDT counter 33 is configured to count up the CLK 31 or a clock signal frequency-divided by the frequency divider 32 until it reaches a count value corresponding to the monitoring time limit set by the WDT time limit setting unit 35. The WDT counter 33 can also be configured to count down from a count value corresponding to the monitoring time limit. The WDT 27 monitors whether the car terminal control unit 105 and the control unit 23 are operating normally by refreshing (clearing) the count value of the WDT counter 33 with the WDT refresh unit 24 before the WDT counter 33 reaches a count value corresponding to the monitoring time limit and causes an overflow or underflow. The WDT counter 33 operates in a timeout mode. The WDT counter 33 has two operating modes: a timeout mode and a window mode. The timeout mode is an operating mode in which a period longer than a specified period is detected as an abnormality. On the other hand, the window mode is an operating mode in which a period shorter than a specified period or a period longer than a specified period is detected as an abnormality.
[0027] Here, the control unit 23 and the peripheral control unit 21 communicate via the communication path 50, the communication control unit 25, etc., so by continuing this communication, the WDT refresh unit 24 can refresh (clear) the count value of the WDT counter 33 of the WDT 27.
[0028] If the car terminal control unit 105 or the control unit 23 is operating abnormally, the count value of the WDT counter 33 is not refreshed (cleared) by the WDT refresh unit 24, and the WDT counter 33 will count up to or exceed the count value corresponding to the monitoring time limit, causing an overflow or underflow. In this case, the WDT reset issuing unit 36 detects the overflow or underflow and generates a reset request signal RSTQ to the reset unit 40. As a result, the reset unit 40 supplies a reset signal RST to the overall control unit 20 and the peripheral control unit 21, and the overall control unit 20 and the peripheral control unit 21 are configured to perform a reset operation (initialization operation) in response to the reset signal RST.
[0029] The WDT mode setting unit 34 is connected to the communication paths 51 and 52. As a result, the WDT mode setting unit 34 is configured to be able to determine the address signal, data signal, and control signal output from the control unit 23 and the data signal and control signal input to the control unit 23 via the communication paths 51 and 52, the communication control unit 25, and the communication path 50. The WDT mode setting unit 34 can determine an operation mode such as an initialization operation mode INM, a normal operation mode OM, or a ROM write mode RWM, and set a predetermined monitoring time limit in the WDT time limit setting unit 35 according to the determined operation mode. The WDT mode setting unit 34 will be described in detail below.
[0030] Fig. 3 is a diagram illustrating an example of the configuration of a database set in the WDT mode setting unit of Fig. 2. As shown in Fig. 3, the database DB is a database that stores the monitoring time limit TL for each operation mode, such as the initialization operation mode INM, the normal operation mode OM, and the ROM write mode RWM. The horizontal axis of the database DB lists addresses (ADDRESS) and data (DATA), and the vertical axis of the database DB provides multiple WDT setting areas (a first setting area SA1, a second setting area SA2, a third setting area SA3, and a fourth setting area SA4).
[0031] The multiple WDT setting areas (SA1-SA4) include, for example, a WDT setting area 1 which is SA1, a WDT setting area 2 which is SA2, a WDT setting area 3 which is SA3, and a WDT setting area 4 which is SA4.
[0032] SA1 is the setting area for the WDT 27 in the initialization operation mode INM (boot mode, initial mode). Addresses 1 through 6 store various setting data, such as the start address, end address, R / W (read, write), mode transition destination information (after the condition is met), first monitoring time limit (TL1), and refresh mode (timeout, window) of the WDT 27. Here, "timeout" indicates timeout mode, and "window" indicates window mode. The start address and end address may be, for example, the start address and end address of the address range accessed by the control unit 23. The R / W (read, write) may be set to, for example, read and write. The mode transition destination information (after the condition is met) may be, for example, the normal operation mode OM. The refresh mode of the WDT may be set to, for example, the timeout mode. The monitoring time limit may be set, for example, to 1.5 to 2 times the actual processing time. Therefore, as an example, if the actual processing time of the initialization operation is, for example, approximately 5 to 10 seconds, it is preferable to set the set value of the monitoring time limit (TL1) in the initialization operation mode INM (boot mode) to, for example, 10 to 20 seconds. The monitoring time limit (TL1) is slower (longer) than the second monitoring time limit (TL2) in the normal operation mode described below (TL1>TL2). In this example, the set value of the monitoring time limit (TL1) is set to the initial value (default value) of the monitoring time limit of the WDT 27.
[0033] SA2 is the setting area for the WDT 27 in the normal operation mode OM. Addresses 7 to 12 store various setting data, such as the start address, end address, R / W (read, write), mode transition destination information (after the condition is met), second monitoring time limit (TL2), and refresh mode (timeout, window) of the WDT 27. The start address and end address may be, for example, the start address and end address of the address range accessed by the control unit 23. R / W (read, write) may be set to, for example, read and write. The mode transition destination information (after the condition is met) may be, for example, the ROM write mode RWM. The refresh mode of the WDT 27 may be set to, for example, the timeout mode. As an example, if the task period in the normal operation mode OM is 40 ms, and the monitoring time limit (TL2) in the normal operation mode OM is set to 1.5 to 2 times the actual processing time (task period), it is preferable to set the monitoring time limit (TL2) to 60 ms to 80 ms. It is preferable to set the monitoring time limit (TL2) to a monitoring time limit that matches the task period and monitor the system.
[0034] SA3 is the setting area for the WDT 27 when in ROM write mode RWM for ROM 1. Addresses 13 to 18 store various setting data, such as the start address, end address, R / W (read, write), mode transition destination information (after the condition is met), third monitoring time limit (TL3), and WDT refresh mode (timeout, window). The start address and end address may be, for example, the start address and end address of the address range accessed by the control unit 23. R / W (read, write) may be set to, for example, read and write. The mode transition destination information (after the condition is met) may be, for example, the normal operation mode OM. The WDT refresh mode may be set to, for example, the timeout mode. As an example, if the write processing time for ROM1 is on the order of seconds (here, for illustrative purposes, 1 second), and the monitoring time limit (TL3) is set to a guideline of 1.5 to 2 times the actual write processing time, it is preferable to set the monitoring time limit (TL3) to, for example, 1.5 to 2 seconds.
[0035] SA4 is the setting area for the WDT 37 when in ROM write mode RWM for ROM 2. Addresses 19 to 24 store various setting data, such as the start address, end address, R / W (read, write), mode transition destination information (after the condition is met), fourth monitoring time limit (TL4), and WDT refresh mode (timeout, window). The start address and end address can be, for example, the start address and end address of the address range accessed by the control unit 23. R / W (read, write) can be set to, for example, read and write. The mode transition destination information (after the condition is met) can be, for example, the normal operation mode OM. The WDT refresh mode can be set to, for example, the timeout mode. As an example, if the write processing time for ROM2 is on the order of seconds (here, for example, 1 second), and the monitoring time limit (TL4) is set to a guideline of 1.5 to 2 times the actual write processing time, it is preferable to set the monitoring time limit (TL4) to, for example, 1.5 to 2 seconds.
[0036] Since the storage capacities of ROM1 and ROM2 differ depending on the model and application, it is advisable to set the monitoring time limits (TL3, TL4) to match the actual storage capacities of ROM1 and ROM2.
[0037] Therefore, the relationship between each monitoring time limit (TL1, TL2, TL3, TL4) is as follows: the first monitoring time limit TL1 is longer than the second monitoring time limit TL2, the second monitoring time limit TL2 is shorter than the first monitoring time limit TL1, and the third and fourth monitoring time limits TL3, TL4 are shorter than the first monitoring time limit TL1 and longer than the second monitoring time limit TL2. The third and fourth monitoring time limits TL3, TL4 are the lengths between the first monitoring time limit TL1 and the second monitoring time limit TL2 (TL1 > (TL3, TL4) > TL2).
[0038] That is, the WDT mode setting unit 34 is configured to be able to determine the addresses, data, and control signals output from the control unit 23 and the data and control signals input to the control unit 23 via the communication paths 51, 52, the communication control unit 25, and the communication path 50, and can therefore determine each operation mode, such as the initialization operation mode INM, the normal operation mode OM, and the ROM write mode RWM, based on the database DB. The WDT mode setting unit 34 can also recognize the monitoring time limits (TL1, TL2, TL3, TL4) corresponding to each operation mode. Therefore, the WDT mode setting unit 34 can set the monitoring time limits (TL1, TL2, TL3, TL4) corresponding to each operation mode in the WDT 27, which is a monitoring device, in each operation mode, such as the initialization operation mode INM, the normal operation mode OM, and the ROM write mode RWM.
[0039] As a result, in each operation mode, without disabling the monitoring function of the WDT 27, if an abnormality occurs, the WDT 27, which is a monitoring device, can be operated to supply a reset signal RST to the overall control unit 20 and peripheral control unit 21 of the car terminal control unit 105. As a result, the overall control unit 20 and peripheral control unit 21 perform initialization operations in response to the reset signal RST, thereby preventing deadlock of the control unit 23 of the overall control unit 20.
[0040] The division ratio DRn of the frequency divider 32 can be determined by the number of bits (BT) of the WDT counter 33, the time (T1C) of one cycle of the CLK 31, and the monitoring time limit TLn (TL1, TL2, TL3, TL4). That is, since TLn = 2 to the power of BT × T1C × DRn, DRn = TLn / (2 to the power of BT × T1C). Therefore, when transitioning from the initialization operation mode INM or the ROM write mode RWM to the normal operation mode OM, the division ratio is decreased, and when transitioning from the normal operation mode OM to the ROM write mode RWM, the division ratio is increased. For example, a division ratio may be added to each of the setting areas (SA1-SA4) so that a division ratio corresponding to each operation mode can be set.
[0041] Next, a typical example of operation of the WDT 27 will be described with reference to Fig. 4. Fig. 4 is a timing diagram illustrating an example of operation of the WDT in Fig. 2.
[0042] 4 shows a timing chart as an example of the operation of the WDT 27, with the horizontal axis representing time (t) and the vertical axis representing, from top to bottom, the reset signal RST, the refresh instruction signal REF, the reset request signal RSTQ, the monitoring time limit TLn, the task period Tcyc, and the count value Vcount of the WDT counter 33. The monitoring time limit TLn is set to (task period Tcyc) x n, and in one example, as described above, n = 1.5 - 2. The WDT counter 33 counts the clock signal CLK or a frequency-divided clock signal.
[0043] In FIG. 4 , at time T1, the count value Vcount is cleared in response to the change of the refresh instruction signal REF to high level. Thereafter, the count value Vcount is incremented, and at time T2, the count value Vcount exceeds the monitoring time limit TLn. This causes the WDT reset issuing unit 36 to issue a reset request signal RSTQ to the reset unit 40. Then, at time T3, the reset unit 40 supplies a reset signal RST to the overall control unit 20 and the peripheral control unit 21, and the count value Vcount is cleared. The car terminal control unit 105 then performs initialization. This type of operation of the WDT 27 is possible in various operation modes, including the initialization operation mode INM, the normal operation mode OM, and the ROM write mode RWM. In other words, when the control unit 23 is operating normally, the counter 33 refreshes its count value before the monitoring time limit (TL1, TL2, or TL3). On the other hand, if the control unit 23 is operating abnormally, when the counter 33 exceeds the monitoring time limit (TL1, TL2 or TL3), the car terminal control unit 105 and the control unit 23 are initialized by a reset signal.
[0044] Next, the control method of the elevator control device 100 will be explained in order of steps (processes) using Figures 5, 6, and 7. Figures 5, 6, and 7 explain the operation of determining the operation mode and setting the monitoring time limit by the WDT 27. Figure 5 is a flow diagram explaining the transition from the initialization operation mode to the normal operation mode. Figure 6 is a flow diagram explaining the transition from the normal operation mode to the ROM write mode. Figure 7 is a flow diagram explaining the transition from the ROM write mode to the normal operation mode.
[0045] As shown in FIG. 5 , in step S10, power is applied to the elevator control device 100, and the entire system of the elevator control device 100 is started. As a result, power is also applied to the overall control unit 20 and peripheral control unit 21 of the car terminal control unit 105, and the car terminal control unit 105 transitions to the initialization operation mode INM. At this time, the mode determination unit 34 of the WDT 27 references the setting value of SA1 in the database DB and sets the monitoring time limit TL1 in the time limit setting unit 35 as an initial value. As a result, in the initialization operation mode INM, the WDT 27 monitors the control unit 23 using the counter 33 based on the first monitoring time limit TL1.
[0046] Thereafter, the process proceeds to step S11, where, for example, the control unit 23 of the overall control unit 20 issues a system initialization command and an initialization operation is performed. In the initialization operation, the control unit 23 executes, for example, a boot program in ROM0, thereby performing initial settings of the car terminal control unit 105. Here, when the initial settings are completed, the control unit 23 issues an initialization completion signal.
[0047] Step S12 is executed during the initialization operation. In step S12, the mode determination unit 34 of the WDT 27 refers to the setting value of SA1 in the database DB to determine the address range accessed by the control unit 23 and whether an initialization completion signal has been issued. If the WDT 27 determines that an initialization completion signal has not been issued (N), the process proceeds to step S11, where the initialization operation continues. On the other hand, if the mode determination unit 34 of the WDT 27 determines that an initialization completion signal has been issued (Y), the process proceeds to step S13.
[0048] In step S13, the car terminal control unit 105 transitions from the initialization operation mode INM to the normal operation mode OM. At this time, the mode determination unit 34 of the WDT 27 references the setting value of SA2 in the database DB and sets the monitoring time limit TL2 in the time limit setting unit 35. As a result, the WDT 27 monitors the control unit 23 using the counter 33 based on the second monitoring time limit TL2 in the normal operation mode OM.
[0049] 6, in step S20, the car terminal control unit 105 is in the normal operation mode OM, and at this time, a monitoring time limit TL2 is set in the WDT 27, similar to the setting value of SA2 in the database DB. As a result, the WDT 27 monitors the control unit 23 using the counter 33 based on the second monitoring time limit TL2 in the normal operation mode OM.
[0050] In step S21, the control unit 23 issues a ROM write process.
[0051] In step S22, the mode determination unit 34 of the WDT 27 refers to the setting value of SA2 in the database DB to determine the address range accessed by the control unit 23 and whether or not a command has been issued from the control unit 23 to ROM1 (or ROM2). The command to be determined may be, for example, an erase command or a write command. If it is determined that a command has not been issued (N), the process proceeds to step S21 and step S22 is executed again. On the other hand, if it is determined that a command has been issued (Y), the process proceeds to step S23.
[0052] In step S23, the car terminal control unit 105 transitions from the normal operation mode OM to the ROM write mode RWM. At this time, the mode determination unit 34 of the WDT 27 references the setting value of SA3 (SA4) in the database DB and sets the monitoring time limit TL3 (TL4) in the time limit setting unit 35. As a result, the WDT 27 monitors the control unit 23 using the counter 33 based on the third monitoring time limit TL3 (fourth monitoring time limit TL4) in the ROM write mode RWM.
[0053] 7, in step S30, the car terminal control unit 105 is in the ROM write mode RWM, and at this time, the mode determination unit 34 of the WDT 27 sets the monitoring time limit TL3 (TL4) in the time limit setting unit 35, like the setting value of SA3 (SA4) in the database DB. As a result, the WDT 27 monitors the control unit 23 using the counter 33 based on the third monitoring time limit TL3 (fourth monitoring time limit TL4) in the ROM write mode RWM.
[0054] In step S31, the control unit 23 of the overall control unit 20 executes a write operation to the ROM1 (or ROM2) (ROM write operation in progress).
[0055] Step S32 is executed during a write operation to ROM1 (or ROM2). In step S32, the mode determination unit 34 of the WDT 27 references the setting value of SA3 (SA4) in the database DB to determine the address range accessed by the control unit 23 and whether a desired signal has been issued from ROM1 (ROM2) to the control unit 23. For example, the desired signal to be determined may be a write completion signal or a rewrite completion signal. If the mode determination unit 34 of the WDT 27 determines that a desired signal has not been issued (N), the process proceeds to step S31, where the write operation continues. On the other hand, if the mode determination unit 34 of the WDT 27 determines that a signal has been issued (Y), the process proceeds to step S33.
[0056] In step S33, the car terminal control unit 105 transitions from the ROM write mode RWM to the normal operation mode OM. At this time, the mode determination unit 34 of the WDT 27 references the setting value of SA2 in the database DB and sets the monitoring time limit TL2 in the time limit setting unit 35. As a result, the WDT 27 monitors the control unit 23 using the counter 33 based on the second monitoring time limit TL2 in the normal operation mode OM.
[0057] With the above configuration, the WDT 27 is provided with monitoring time limits (TL1, TL2, TL3, TL4) corresponding to each operation mode (INM, OM, RWM) with different processing times, so that if an abnormality occurs, the WDT 27 can issue a reset supply signal RSTQ to perform a reset operation (initialization operation) of the overall control unit 20 and peripheral control unit 21 of the car terminal control unit 105 without disabling the monitoring function of the WDT 27. This makes it possible to provide a technology for preventing deadlock of the overall control unit 20.
[0058] (Modification) Next, a car terminal control unit according to a modification will be described with reference to Fig. 8. Fig. 8 is a schematic diagram showing the configuration of a car terminal control unit according to a modification.
[0059] The car terminal control unit 105A shown in FIG. 8 differs from the car terminal control unit 105 shown in FIG. 2 in that a second refresh unit (WDT refresh unit 2) 38 different from the first refresh unit 24 provided in the overall control unit 20 is provided within the peripheral control unit 21. The second refresh unit 38 is configured to be usable during the ROM write mode RWM, and is configured to refresh (clear) the count value of the WDT counter 33 in response to a refresh instruction signal REF2 issued by the second refresh unit 38. The second refresh unit 38 is connected to the communication control unit 25, and is configured to detect erase commands, write commands, write addresses, write data, etc. output by the control unit 23 via the communication path 50 to the communication path 51 connected to the nonvolatile memory ROM1 and the communication path 52 connected to the nonvolatile memory ROM2 during the ROM write mode RWM, thereby determining whether the ROM write mode RWM is in progress or whether a ROM write process is being performed. When the second refresh unit 38 determines that the ROM write mode RWM is in progress or that a ROM write process is in progress, it periodically refreshes the count value of the WDT counter 33 before the monitoring time limit (TL3 or TL4) in place of the control unit 23 and the first refresh unit 24. The other configurations and effects of Figure 8 are the same as those of Figure 2, so duplicated explanations will be omitted.
[0060] In this way, by providing the second refresh unit 38 in the peripheral control unit 21, the control unit 23 does not need to refresh (clear) the count value of the WDT counter 33 during the ROM write mode RWM or while the ROM write process is being performed. This allows the control unit 23 to prioritize the ROM write process, resulting in the effects of simplifying the ROM write program executed by the control unit 23 and shortening the ROM write time. Simplifying the ROM write program means, for example, eliminating program processing for performing periodic refresh operations.
[0061] The present disclosure made by the present inventor has been specifically described above based on examples, but it goes without saying that the present disclosure is not limited to the above-described embodiments and examples, and various modifications are possible.
[0062] 100: elevator control device, 101: car unit control unit, 102: car unit, 105: car terminal control unit, 20: overall control unit, 21: peripheral control unit, 23: control unit, 24, 38: refresh unit, 27: watchdog timer (WDT), 34: mode setting unit, 35: time limit setting unit, 40: reset unit, DB: database, SA1, SA2, SA3, SA4: setting area, TL1, TL2, TL3, TL4: monitoring time limit.
Claims
1. A car terminal control unit comprising: a car unit control unit; and a car terminal control unit connected to the car unit control unit, wherein the car terminal control unit is configured to be placed in an initialization operation mode when power is turned on and to transition to a normal operation mode after completion of initialization operation in the initialization operation mode, the car terminal control unit comprising: a control unit for controlling operation; and a watchdog timer (WDT) for monitoring operation of the control unit, the WDT comprising: a counter for counting clock signals, a mode determination unit, and a time limit setting unit, the mode determination unit having a database including: a first setting area for storing a first monitoring time limit for the counter in the initialization operation mode; and a second setting area for storing a second monitoring time limit for the counter in the normal operation mode, the mode determination unit sets the first monitoring time limit in the time limit setting unit according to the initialization operation mode, and monitors the control unit using the counter based on the first monitoring time limit in the initialization operation mode, the mode determination unit determines a transition from the initialization operation mode to the normal operation mode based on an initialization completion signal issued from the control unit, and sets the second monitoring time limit in the time limit setting unit, and monitors the control unit using the counter based on the second monitoring time limit in the normal operation mode.
2. An elevator control device according to claim 1, further comprising a non-volatile memory (ROM) connected to the car terminal control unit, the car terminal control unit having a ROM write mode for writing data to the ROM, the database having a third setting area for storing a third monitoring time limit for the counter in the ROM write mode, and the mode determination unit determining a transition from the normal operation mode to the ROM write mode based on an erase command issued by the control unit, and setting the third monitoring time limit in the time limit setting unit, and monitoring the control unit using the counter based on the third monitoring time limit in the ROM write mode.
3. An elevator control device according to claim 2, wherein the mode determination unit determines a transition from the ROM write mode to the normal operation mode based on a write completion signal issued from the ROM, and sets the second monitoring time limit in the time limit setting unit, and monitors the control unit using the counter based on the second monitoring time limit in the normal operation mode.
4. An elevator control device as described in claim 1, wherein the counter refreshes its count value before the first monitoring time limit or the second monitoring time limit when the control unit is operating normally, and the car terminal control unit is initialized by a reset signal when the first monitoring time limit or the second monitoring time limit is exceeded when the control unit is operating abnormally.
5. An elevator control device according to claim 4, wherein the first monitoring time limit is longer than the second monitoring time limit.
6. An elevator control device according to claim 4, wherein the car terminal control unit includes a frequency divider that divides the frequency of the clock signal, and when transitioning from the initialization operation mode to the normal operation mode, the frequency division ratio of the frequency divider is reduced.
7. An elevator control device according to claim 4, wherein the car terminal control unit includes a refresh unit that refreshes the counter and a reset unit that outputs the reset signal, and the refresh unit refreshes the count value of the counter based on a refresh request signal from the control unit.
8. An elevator control device according to claim 2, wherein, when the control unit is operating normally, the counter refreshes its count value before the first monitoring time limit, the second monitoring time limit or the third monitoring time limit; and, when the control unit is operating abnormally, the car terminal control unit is initialized by a reset signal when the first monitoring time limit, the second monitoring time limit or the third monitoring time limit is exceeded.
9. An elevator control device according to claim 8, wherein the first monitoring time limit is longer than the second monitoring time limit, and the third monitoring time limit is shorter than the first monitoring time limit and longer than the second monitoring time limit.
10. An elevator control device according to claim 8, wherein the car terminal control unit includes a frequency divider that divides the frequency of the clock signal, and when transitioning from the initialization operation mode or the ROM write mode to the normal operation mode, the frequency division ratio of the frequency divider is decreased, and when transitioning from the normal operation mode to the ROM write mode, the frequency division ratio of the frequency divider is increased.
11. An elevator control device according to claim 8, wherein the car terminal control unit includes a refresh unit that refreshes the counter, and a reset unit that outputs the reset signal.
12. An elevator control device as described in claim 11, wherein the car terminal control unit includes an overall control unit and a peripheral control unit, the refresh unit includes a first refresh unit provided in the overall control unit, and the first refresh unit refreshes the count value of the counter based on a refresh request signal from the control unit.
13. An elevator control device as described in claim 12, wherein the refresh unit further includes a second refresh unit provided in the peripheral control unit, and the second refresh unit refreshes the count value of the counter in place of the first refresh unit during the ROM write mode.
14. A control method for an elevator control device including a car terminal control unit and a car terminal control unit connected to the car terminal control unit, wherein the car terminal control unit is configured to be placed in an initialization operation mode when power is turned on and to transition to a normal operation mode after completion of initialization operation in the initialization operation mode, the car terminal control unit including a control unit that controls operation and a watchdog timer (WDT) that monitors the operation of the control unit, the WDT including a counter that counts clock signals, a mode determination unit, and a time limit setting unit, the mode determination unit having a database including a first setting area that stores a first monitoring time limit for the counter in the initialization operation mode and a second setting area that stores a second monitoring time limit for the counter in the normal operation mode, the method comprising the steps of: the mode determination unit setting the first monitoring time limit in the time limit setting unit in accordance with the initialization operation mode, and monitoring the control unit using the counter based on the first monitoring time limit in the initialization operation mode; the mode determination unit determines a transition from the initialization operation mode to the normal operation mode based on an initialization completion signal issued from the control unit, and sets the second monitoring time limit in the time limit setting unit, and monitors the control unit using the counter based on the second monitoring time limit in the normal operation mode.