JP2023178072A - Control device, control method, and passenger transport control device - Google Patents

Abstract

To detect both loss of function and false detection of a watchdog timer.SOLUTION: A control device has a control unit (120) in which calculations are performed by a CPU (160), and a watchdog timer (130) that notifies the control unit of an abnormality when the time interval of receiving clock signals from the CPU becomes equal to or longer than a predetermined period. In a test mode in which periodic transmission of the clock signals is stopped, the control unit counts the elapsed time after transmitting the clock signal once to the watchdog timer, in a counter variable, determines that the watchdog timer has lost its function when the counter variable exceeds a predetermined upper limit, and determines that the watchdog timer has been detected erroneously if the counter variable is less than a predetermined lower limit when the CPU is restarted by the watchdog timer.SELECTED DRAWING: Figure 1

Description

The present invention relates to watchdog timers.

Conventionally, in elevator operation control, a safety device is provided that detects abnormal operation of the elevator and stops the operation, in addition to a normal control device that performs normal control. Examples of this safety device include a door-opening protection device and a terminal floor forced deceleration device.

The door open running protection device brakes the elevator when an abnormal moving speed of the elevator car is detected with the elevator car door open. This can prevent the car from moving unintentionally (UCMP (Unintended Car Movement Protection)). Further, the terminal floor forced deceleration device brakes the elevator when an abnormal moving speed of the car is detected in the terminal region of the hoistway. This can prevent the car from colliding with the upper or lower end of the hoistway (ETS (Emergency Terminal Stopping)).

A WDT (Watch Dog Timer) is used to check whether a CPU (Central Processing Unit) used in such a safety device is operating properly. The WDT detects an abnormality in the CPU by monitoring a clock signal periodically sent from the CPU, and notifies the CPU of the abnormality.

As described above, since the WDT detects an abnormality in the CPU and notifies the CPU, it is important to confirm that the WDT itself is operating normally. Patent Document 1 has a normal period, which is a period during which the CPU executes normal program processing, and a test period, which is a period that does not interfere with the normal program processing of the CPU. discloses an inspection device that outputs a test signal to the WDT to cause the WDT to output an abnormality notification, and detects an abnormality in the WDT when the abnormality notification cannot be obtained from the WDT. The CPU is not reset by this abnormality notification.

Patent No. 5386403

The WDT determines that an abnormality has occurred in the CPU when the clock signal from the CPU cannot be received for a "predetermined period" or more, but this "predetermined period" has a lower limit value and an upper limit value. . In the inspection device disclosed in Patent Document 1, it is possible to detect a malfunction of loss of function that the WDT does not detect as an abnormality of the CPU even after the upper limit of a predetermined period has elapsed since the reception of the clock signal. However, it is not possible to detect the problem of erroneous detection in which the WDT detects an abnormality in the CPU at a timing shorter than the lower limit of the predetermined period from reception of the clock signal.

One aspect of the present invention aims to provide a control device that can detect both loss of function and false detection of a watchdog timer.

In order to solve the above problems, a control device according to one aspect of the present invention includes a control unit in which calculations are performed by a processor, and a control unit that operates when a time interval between receiving a clock signal from the processor is equal to or longer than a predetermined period. , a watchdog timer for restarting the processor, the control unit transmitting the clock signal to the watchdog timer once in a test mode in which periodic transmission of the clock signal is stopped. The elapsed time since the above is recorded as an elapsed time variable in the storage unit, and when the value of the elapsed time variable exceeds the upper limit value of the predetermined period, a function loss abnormality of the watchdog timer is detected, and the If the value of the elapsed time variable stored in the storage unit when the processor is restarted by the watchdog timer after test transmission is less than the lower limit value of the predetermined period, the watchdog timer is activated. Detect false positive abnormalities.

In order to solve the above problems, a control method for a control device according to one aspect of the present invention includes a control unit in which calculations are performed by a processor, and a time interval between receiving clock signals from the processor that is equal to or longer than a predetermined period. a watchdog timer that restarts the processor when the processor a recording step of recording the elapsed time from one test transmission of the clock signal in the storage unit as an elapsed time variable; and a recording step of recording the elapsed time variable in the storage unit; a function loss abnormality detection step of detecting a function loss abnormality of the processor; and a function loss abnormality detection step in which the value of the elapsed time variable stored in the storage unit when the processor is restarted by the watchdog timer after the test transmission is set to the predetermined value. and a false detection abnormality detection step of detecting a false detection abnormality of the watchdog timer when the period is less than a lower limit value.

According to the above configuration, when the processor is restarted by the watchdog timer after a test transmission, the elapsed time since the test transmission is stored in the storage unit as an elapsed time variable, so that the processor after the restart By checking the value of the elapsed time variable stored in the storage unit, it is possible to detect a false detection abnormality of the watchdog timer. That is, according to the above configuration, both loss of function and false detection of the watchdog timer can be accurately detected.

The processor is also reset by a reset signal from the watchdog timer. Therefore, the reset process can be the same in the test mode and in the normal operation, so a program for switching between the test mode and the normal operation can be made unnecessary. Further, it is possible to prevent problems caused by different reset operations between the test mode and the normal operation.

The control unit may record the elapsed time in the storage unit as three or more elapsed time variables, and may sequentially switch and record the elapsed time variables at predetermined time intervals.

If the processor is restarted by the watchdog timer, there is a possibility that an error will occur when the control unit writes the elapsed time to the elapsed time variable. In contrast, according to the above configuration, even if an error occurs in writing to one elapsed time variable, the values of the remaining two or more elapsed time variables are preserved. Here, since the values of the remaining two or more elapsed time variables are values that are sequentially switched and recorded at predetermined time intervals, they can be distinguished from the values of the elapsed time variable in which an error has occurred. That is, the control unit can recognize the elapsed time before the restart based on the values of two or more elapsed time variables in which no errors have occurred.

The control unit may start the test mode when the processor is started by cold start.

According to the above configuration, when a cold start is performed, the test mode is executed, so the operation of the watchdog timer is reliably verified when a power supply abnormality occurs or when the power is normally turned on for the first time. be able to.

A passenger transportation control device according to another aspect is a passenger transportation control device that controls a passenger transportation device that is an elevator, and includes an abnormality operation control unit that detects that the operation of the passenger transportation device has become abnormal. The abnormal operation control section is provided independently of the normal control section that controls the normal operation of the passenger transport device, and processes are performed by the control device of the above-described aspect.

According to the above configuration, the abnormal operation control section is operated by the control device that can accurately detect both loss of function and false detection of the watchdog timer, so a highly safe passenger transport control device is provided. can do.

The control device according to each aspect of the present invention may be realized by a computer, and in this case, the control device is realized by the computer by operating the computer as each part (software element) included in the control device. A control program for a control device and a computer-readable recording medium on which the program is recorded also fall within the scope of the present invention.

According to one aspect of the present invention, both loss of function and false detection of a watchdog timer can be detected.

FIG. 1 is a block diagram showing the configuration of main parts of an elevator control system. It is a figure showing an outline of reset processing in a passenger conveyance control device. 3 is a flowchart illustrating an example of the operation of the abnormal operation control section. It is a table showing how to count up three counter variables. It is a table showing how to count up four counter variables. 3 is a table showing another way of counting up four counter variables.

[Embodiment 1]
Hereinafter, one embodiment of the present invention will be described in detail.

(Configuration of elevator control system 1)
FIG. 1 is a block diagram showing the configuration of main parts of an elevator control system 1. As shown in FIG. The elevator control system 1 includes a passenger conveyance control device 10, a car 2, an elevator drive section 3, a plurality of hall call devices 4, a drive power source 31, a first cutoff circuit 32, a second cutoff circuit 33, and the like. , is provided.

Car 2 is a car in which passengers ride. By moving the car 2 up and down, the car 2 moves from the floor where the hall call has been made to the floor registered as the destination floor, making it possible to transport passengers to a different floor.

The car 2 is provided with a car operation panel 210. The car operation panel 210 is provided with a plurality of push button switches for setting the destination floor of the car 2, opening and closing the door of the car 2, and making emergency communications.

The elevator drive unit 3 is a device that drives the car 2. The elevator drive unit 3 operates with power supplied from the drive power source 31 via the first cutoff circuit 32 and the second cutoff circuit 33. The elevator drive unit 3 includes a motor that winds up or unwinds a wire that moves the car 2 up and down, and a brake that brakes the up and down movement of the car 2.

The drive power source 31 is a power source that supplies power to the elevator drive unit 3. The first cutoff circuit 32 and the second cutoff circuit 33 are circuit breakers connected in series that close the circuit based on an external command, and are opened when there is no operation command. Therefore, when there is no external command, the circuit is open and the elevator drive section 3 cannot operate, thereby ensuring safety.

In consideration of safety, a brake is used that applies braking when power is not supplied, and releases the brake when power is supplied. In other words, if the power is cut off due to a power outage or the like, vertical movement within the car is automatically stopped, thereby preventing the car 2 from falling or dangerous vertical movement.

The hall call device 4 is an operation unit provided on each floor, and has a function of calling the car 2. The hall call device 4 is provided with a push button switch for specifying whether to go upward or downward, and it is possible to specify whether the destination floor is upward or downward.

The passenger transport control device 10 is a control device that centrally controls each part of the elevator control system 1.

(Configuration of passenger transport control device 10)
The passenger transport control device 10 includes a control power source (common) 11, a normal control section 12, and an abnormal operation control section (control device) 100.

A control power source (common) 11 supplies power to each part of the passenger transport control device 10.

The normal control unit 12 operates the elevator drive unit 3 to move the car 2 up and down in accordance with operations of the hall call device 4 and the car operation panel 210 operated by passengers. That is, control is performed to move the car 2 from the floor where the hall call was made to the floor registered as the destination floor in accordance with the passenger's operation.

The abnormal operation control unit 100 monitors whether an abnormality has occurred in the elevator control system 1, and when an abnormality occurs, performs elevator drive stop control to ensure the safety of passengers.

(Configuration of abnormal operation control unit 100)
The abnormal operation control unit 100 includes a storage unit 110, a control unit 120, a watchdog timer (hereinafter abbreviated as WDT) 130, a power supply monitoring circuit 140, and a control power supply (individual) 150. Further, FIG. 2 is a block diagram showing the hardware configuration of the abnormal operation control section 100.

The control power supply (individual) 150 is a power supply that reduces the voltage based on the power supplied from the control power supply (common) 11 and supplies power to each part of the abnormal operation control unit 100.

The storage unit 110 stores various variables, parameters, and programs used by the abnormal operation control unit 100. The storage unit 110 is roughly divided into a volatile memory 111 that temporarily stores program processing, a first nonvolatile memory that stores parameters or data to be recorded, and a second nonvolatile memory that stores programs. Ru. The same nonvolatile memory 112 may be used as the first nonvolatile memory and the second nonvolatile memory. Hereinafter, the description will be made assuming that the same nonvolatile memory 112 is used.

The control unit 120 is a control unit that ensures the safety of the elevator control system 1, and is realized by a dedicated CPU 160 executing various programs. CPU 160 outputs a clock signal to WDT 130. Further, the CPU 160 is restarted by a reset signal output from the WDT 130 or the power supply monitoring circuit 140. Details regarding the control unit 120 will be described later. The CPU 160 operates on power supplied from the control power supply (individual) 150.

WDT130 monitors the clock signal input from CPU160, and outputs a reset signal to CPU160. Specifically, when the clock signal is not output for a predetermined period or more, the WDT 130 outputs a reset signal to the CPU 160. That is, the WDT 130 monitors whether the CPU 160 is operating normally by checking whether the CPU 160 is normally outputting a clock signal.

The power supply monitoring circuit 140 outputs a reset signal to the control unit 120 when the output voltage of the controlled power supply (individual) 150 falls below a first predetermined voltage. Further, the CPU 160 monitors the output voltage of the control power supply (common) 11 and periodically updates the voltage drop flag in the nonvolatile memory of the storage unit 110. The voltage drop flag is turned on when the voltage becomes lower than a second predetermined voltage, and turned off when the voltage is equal to or higher than the second predetermined voltage. Note that the CPU 160 may recognize the output voltage of the control power supply (common) 11 based on a voltage (a voltage that can be handled by the CPU 160) obtained by stepping down the output voltage using a voltage dividing circuit.

The first predetermined voltage and the second predetermined voltage are set so that when the output voltage of the control power supply (common) 11 decreases, a voltage drop flag is first turned on, and a reset signal is output after a predetermined period of time. . As a result, the restart using the reset signal is executed with the voltage drop flag reliably turned on.

(Configuration of control unit 120)
The control unit 120 includes a WDT management unit 121, a door-open travel protection control unit 122, and a terminal floor forced deceleration control unit 123.

When the door of the elevator car 2 is opened and abnormal movement speed of the elevator car 2 is detected, the door open running protection control unit 122 shuts off power to the elevator drive unit 3 using the second cutoff circuit 33. do. In other words, when there is a possibility that a passenger is getting on or off, the elevator drive unit 3 is controlled so that the car 2 does not move up or down and the passenger can get on and off safely.

When the terminal floor forced deceleration control unit 123 detects an abnormal moving speed of the car 2 near the top floor or the bottom floor of the elevator, the terminal floor forced deceleration control unit 123 cuts off the power to the elevator drive unit 3 using the second cutoff circuit 33. The vehicle then forcibly applies the brakes and decelerates. In other words, it is possible to prevent the car 2 from colliding with the upper end or lower end of the hoistway of the car 2, which can move up and down.

Note that the normal control section 12 may detect an abnormality, and in this case, the first cutoff circuit 32 cuts off the power to the elevator drive section 3. That is, when at least one of the normal control section 12 and the abnormal operation control section 100 detects an abnormality, power to the elevator drive section 3 is cut off.

The WDT management unit 121 manages whether the WDT 130 is functioning normally. That is, it is important to confirm that the WDT 130 itself, which detects an abnormality in the CPU 160, is also operating normally, and the WDT management unit 121 performs this confirmation.

The WDT management section 121 includes a test mode processing section 124, a time recording control section 125, and an abnormality detection section 126.

The test mode processing unit 124 is a functional block that processes the test mode of the WDT 130. The test mode processing unit 124 stops the normal periodic transmission of the clock signal to the WDT 130 and transmits the clock signal once (test transmission).

The time recording control unit 125 counts the time since the test mode processing unit 124 transmits the clock signal to the WDT 130 using at least three counter variables. The details of how to count the counter variables will be described later.

The abnormality detection unit 126 determines that an abnormality has occurred in the WDT 130 when the value of the counter variable exceeds the upper limit value for a predetermined period without outputting a reset signal from the WDT 130 in the test mode. In addition, when the reset signal is output from the WDT 130 during execution of the test mode and the control unit 120 is restarted, the abnormality detection unit 126 detects that if the value of the counter variable is less than the lower limit value for a predetermined period after the restart, It is determined that an abnormality has occurred in the WDT 130.

(cold start and hot start)
Here, the definitions of the terms cold start and hot start in this specification will be explained.

A cold start is when the CPU 160 starts up from a state where power is not supplied to the CPU 160 from the control power supply (individual) 150. Therefore, in the cold start, the storage unit 110 and the CPU 160 are initialized, and the presence or absence of a hardware malfunction is checked. A cold start is initiated when the reset signal changes from output to non-output while the voltage drop flag is on. In other words, a cold start is performed when the passenger transport control device 10 is normally powered on, or when the power supply monitoring circuit 140 detects an abnormality (power outage, backup battery voltage drop, etc.) in the control power supply (individual) 150. These occur under the same conditions described above. In this embodiment, the process of checking whether there is a malfunction in the WDT 130 is performed at a cold start.

On the other hand, a hot start is a restart in which only software processing is reset while power is being supplied to the CPU 160 from the control power supply (individual) 150. Hot start is initiated when the reset signal changes from output to non-output in a situation where the voltage drop flag is off.

Note that while the reset signal is output, the CPU 160 stops operating.

In this specification, the CPU 160 monitors the voltage of the control power supply (common) 11 and sets a voltage drop flag in the nonvolatile memory 112 of the storage unit 110 by detecting a voltage drop. When the CPU 160 is restarted by inputting a reset signal, it performs a cold start when the voltage drop flag is set (if it is on), and performs a cold start when the voltage drop flag is cleared (if it is off). Then, perform a hot start. That is, the reset signal from the power supply monitoring circuit 140 performs a cold start, and the reset signal from the WDT 130 performs a hot start.

(Operation of control unit 120)
FIG. 3 is a flowchart showing an example of the operation of the control unit 120. Note that, as described above, the CPU 160 monitors the output voltage of the control power supply (common) 11 and periodically updates the voltage drop flag.

When the control unit 120 is activated, first in S10, power supply to the motor and brake of the elevator drive unit 3 is disabled (S10). As a result, the operation of the car 2 is stopped until safety can be confirmed.

The control unit 120 checks the nonvolatile memory 112 when the CPU 160 starts up, and checks whether the voltage drop flag is on (S11). That is, in S11, it is determined whether the startup of the CPU 160 is a cold start (Yes in S11) or a hot start (No in S11).

If a cold start has been performed (Yes in S11), the control unit 120 performs initialization processing of the abnormal operation control unit (control device) 100 (S12).

Further, the test mode processing unit 124 records initial values in three counter variables in the volatile memory 111 of the storage unit 110, and transmits a clock signal once to the WDT 130 (S13). Here, the counter variable (elapsed time variable) is data stored in the volatile memory 111 of the storage unit 110. Details of the counter variables will be described later.

The time recording control unit 125 sequentially updates each counter variable with a timer value that is updated at predetermined time intervals (S14). Thereafter, the abnormality detection unit 126 determines whether the counter value (the maximum value of each counter variable) exceeds a predetermined upper limit (S15). If the counter value does not exceed the predetermined upper limit (No in S15), the abnormality detection unit 126 returns to S14 and continues counting up.

On the other hand, if the counter value exceeds the predetermined upper limit value (Yes in S15), the abnormality detection unit 126 determines that the WDT 130 has lost the monitoring function of the CPU 160 (WDT function loss). (S16). This is because if the WDT 130 were operating normally, the WDT 130 would have outputted a reset signal to the control unit 120 before the counter variable counted up to the predetermined upper limit value. Nevertheless, since the count has increased to the predetermined upper limit value, the abnormality detection unit 126 determines that the WDT 130 has lost its function. For example, (1) the determination process of the WDT 130 is abnormal, (2) some abnormality has occurred in the connection state between the control unit 120 and the WDT 130, or in the output circuit of the WDT 130. Possible causes include that the WDT 130 is no longer able to properly output the reset signal to the CPU 160.

On the other hand, if a hot start has been performed (No in S11), the test mode processing unit 124 determines whether the counter variable is a reset value (S17). If the counter variable is the reset value (Yes in S17), it means that the hot start was performed not during the test mode but while the door open running protection control unit 122 or the terminal floor forced deceleration control unit 123 was operating. In order to ensure safety, the process is terminated without permitting power supply to the motor and brake of the elevator drive unit 3.

On the other hand, if the counter variable is not the reset value (No in S17), the transition was caused by inputting the reset signal during the loop period after it was determined No in S15. In this case, the abnormality detection unit 126 refers to the counter variable to check whether there is an abnormal value in the counter variable (details will be described later). If there is an abnormal value, the abnormality detection unit 126 recognizes the current normal counter value through a predetermined process (details will be described later) (S18). If there is no abnormal value, the current counter value is the maximum value among the values of each counter variable.

The abnormality detection unit 126 determines whether the current counter value is less than a predetermined lower limit value (S19). If the counter variable is less than the predetermined lower limit value (Yes in S19), the abnormality detection unit 126 determines that the WDT 130 is in a state of erroneous detection (WDT erroneous detection state) (S20).

It is thought that the WDT 130 is judged to have outputted a reset signal earlier than the predetermined timing, and the WDT 130 excessively detects an abnormality in the CPU 160 even though the CPU 160 is normal, which is an erroneous detection. . Therefore, the abnormality detection unit 126 determines that there is a WDT erroneous detection state based on the determination in S19. For example, (1) the determination process of the WDT 130 is abnormal, (2) some kind of abnormality has occurred in the connection state between the control unit 120 and the WDT 130 or in the input circuit of the WDT 130, and the CPU 160 Possible causes include that the WDT 130 is no longer able to properly receive the clock signal from the computer.

When the abnormality detection unit 126 determines that the WDT function has been lost or the WDT has been erroneously detected, the abnormality detection unit 126 records a reset value in the counter variable (S21). Thereafter, the abnormality operation control unit 100 may perform control so that a notification is displayed on the display device in the car 2 or the display device at the landing to the effect that the operation has been stopped due to the occurrence of an abnormal situation. . Further, the abnormality operation control unit 100 may have a function of automatically notifying the elevator management company when an abnormality is detected.

On the other hand, if the counter variable is not less than the predetermined lower limit value (No in S19), the abnormality detection unit 126 determines that the reset operation of the CPU 160 has been performed normally, and that the function of the WDT 130 is normal (WDT normal). A judgment is made (S23).

When the abnormality detection unit 126 determines that the WDT is normal, it records a reset value in the counter variable (S24). After that, the WDT management unit 121 enables power supply to the motor and brake of the elevator drive unit 3 (S25). Therefore, when the normal control unit 12 allows power supply to the elevator drive unit 3, the car 2 can operate normally.

Thereafter, the control unit 120 operates the door open running protection control unit 122 and the terminal floor forced deceleration control unit 123 (S26). Then, the CPU 160 outputs the clock signal so that the WDT 130 does not output the reset signal when the clock signal is not output for a predetermined period or more. Note that during this time, the control section 120 and the WDT 130 continue to operate, and may safely stop the elevator drive section 3 or restart the control section 120 while the car 2 is in operation.

In other words, the abnormal operation control section performs the following four types of processing.

(1) Determination of loss of function due to cold start (processing when YES in S11)
(2) Determination of false detection status at hot start (processing in case of NO in S11, NO in S17, YES in S19)
(3) Judgment of normality by hot start (processing in case of NO in S11, NO in S17, NO in S19)
(4) Hot start while the door open running protection control unit 122 and terminal floor forced deceleration control unit 123 are operating (processing when NO in S11 and YES in S17)
Here, when the reset signal is input during the period in which the determination is No in S15 and the process is in a loop (in the case of a cold start in (1)), the process moves to steps (2) and (3). Furthermore, when a reset signal is input during the normal operation in S26 (when the hot start is normal in (3)), the process shifts to (4).

(counter variable count up)
FIG. 4 is a table showing how the three counter variables in the volatile memory 111 are counted up.

The time recording control unit 125 sequentially updates the counter variables at predetermined time intervals ("1 ms"). The count increment used for this update is "1".

When recording the initial value to the counter variable in S13, at 0 ms, -2 is set to the first counter variable (CNT1), -1 is set to the second counter variable (CNT2), and 0 is set to the third counter variable (CNT3). ,substitute.

The reset values in S21 and S24 are, for example, the first counter variable, the second counter variable, and the third counter variable all set to 0. Note that the reset value may be any value as long as it is different from the value generated during counting or the initial value.

Thereafter, the time recording control unit 125 updates the counter variables in the order of the first counter variable, the second counter variable, and the third counter variable using the timer value at that time. After the third counter variable, it returns to the first counter variable and continues counting up.

That is, at 1 ms, the first counter variable is set to "1", at 2 ms, the second counter variable is set to "2", at 3 ms, the third counter variable is set to "3", and at 4 ms, the first counter variable is set to "2". Set it to 4. Counter variables other than the target counter variable are not changed. In this way, the counter variables are updated in order.

Here, a reset signal may be input to the CPU 160 from the WDT 130 during the count-up. At this time, an incorrect value may be written to the counter variable that was supposed to count up at that timing.

For example, in the example shown in FIG. 4, "7" was supposed to be written to the first counter variable at 7 ms, but because the reset signal was input at this timing, the first counter variable changed to the wrong value "26". It is written in.

(Identification of appropriate counter value)
Here, the control unit 120 hot-starts with the reset signal, but when hot-starting, it is determined in S18 whether an incorrect value as in the above example has been written, and an appropriate counter value is set. need to be specified.

Since the three counter variables are updated in order, each counter value has a predetermined correspondence relationship. Specifically, (a) the second counter variable is greater than the first counter variable by an increment. (b) the third counter variable is incrementally greater than the second counter variable; (c) the first counter variable is incrementally greater than the third counter variable; It is normal if one of the correspondence relationships (a) to (c) does not hold true (two hold true at the same time). If only one of these correspondences holds true (the other two do not hold the correspondences), the abnormality detection unit 126 determines that an incorrect value has been written to one of the counter variables.

This correspondence is confirmed at 7 ms in the above example. The second counter variable is not incrementally greater than the first counter variable. The third counter variable is incrementally larger than the second counter variable. The first counter variable is not incrementally greater than the third counter variable. From the above three correspondences, it can be seen that the processing proceeded normally until the third counter variable was updated. Therefore, the abnormality detection unit 126 specifies the current counter value as "6", which is the counter value at the most recent timing when the processing was progressing normally.

Furthermore, instead of the counter value "6" at the most recent timing, it may be specified as "7", which is the counter value that would have been written if the processing had originally progressed normally.

In the processes after S18, judgments are made based on this specified counter value. Therefore, even if an abnormal value is written to one of the counter variables due to a hot start, etc., if at least two consecutive counter variables are normal, the counter value in which the abnormality occurred can be identified. be able to.

(Brief Summary)
Therefore, when the counter value exceeds the predetermined upper limit value, it can be determined that the WDT 130 has lost its function, and when the counter value is less than the predetermined lower limit value, it can be determined that the WDT 130 has been erroneously detected. That is, both loss of function and false detection of the WDT 130 can be accurately detected.

Furthermore, depending on the timing of the reset signal from the WDT 130, an abnormal counter value may be written when updating the counter variable. Even in such a case, the counter value that was most recently normal or the counter value in the normal case can be specified, and the WDT management unit 121 can recognize the counter value before or at the time of reset.

Furthermore, in addition to diagnosing the state of the WDT 130, the test mode can also diagnose the connection state between the control unit 120 and the WDT 130, the state of the input circuit of the WDT 130, and the state of the output circuit of the WDT 130. can.

According to the above configuration, in the test mode, the value of the elapsed time variable is the predetermined initial value or the actual elapsed time of the test mode, while when the test mode ends, the value of the elapsed time variable is The reset value will be different from the value or initial value. Therefore, when the CPU 160 is restarted, it is possible to control by checking the elapsed time variable whether the restart is executed during a test mode or during normal operation, which is not a test mode. The portion 120 can be grasped.

In addition, in the above-mentioned Patent Document 1, in the test mode, even if an abnormality notification is sent to the CPU from the WDT, control is performed such that the CPU is not reset. That is, the processing when an abnormality notification is issued from the WDT will be different between the test mode and the normal operation, and it is necessary to create a program that can handle this. Further, if the reset operation is different between the test mode and the normal operation, there is a risk that a problem may occur where there was no problem in the test mode, but an appropriate reset operation cannot be performed during the normal operation.

On the other hand, according to the control unit 120 in this embodiment, even in the test mode, the control unit 120 is restarted by the reset signal from the WDT 130. Therefore, the reset process can be the same in the test mode and in the normal operation, so a program for switching between the test mode and the normal operation can be made unnecessary. Further, it is possible to prevent problems caused by different reset operations between the test mode and the normal operation.

[Embodiment 2]
Other embodiments of the invention will be described below. For convenience of explanation, parts having the same functions as those described in the above embodiment are given the same reference numerals, and the description thereof will not be repeated.

(When there are 4 counter variables)
Four counter variables may be provided in the storage unit 110. FIG. 5 is a table showing how to count up the four counter variables.

When recording the initial value to the counter variable, at 0 ms, -3 is set to the first counter variable (CNT1), -2 is set to the second counter variable (CNT2), -1 is set to the third counter variable (CNT3), Assign 0 to the fourth counter variable (CNT4).

Thereafter, the time recording control unit 125 updates the counter variables in the order of the first counter variable, the second counter variable, the third counter variable, and the fourth counter variable with the current timer value. After the fourth counter variable, it returns to the first counter variable and continues counting up.

That is, at 1 ms, the first counter variable is set to "1", at 2 ms, the second counter variable is set to "2", at 3 ms, the third counter variable is set to "3", and at 4 ms, the fourth counter variable is set to " 4", and at 5 ms, the first counter variable is set to "5". In this way, the counter variables are updated in order.

Furthermore, since the four counter variables are updated in order, each counter variable has a predetermined correspondence. Specifically, (d) the second counter variable is greater than the first counter variable by an increment. (e) the third counter variable is incrementally greater than the second counter variable; (f) The fourth counter variable is incrementally greater than the third counter variable. (g) the first counter variable is incrementally greater than the fourth counter variable; The abnormality detection unit 126 checks the correspondence between (d) to (g) and determines whether the counter value is abnormal. The determination method is the same as the method described above, and if three of the four correspondences hold true, it is determined to be normal.

In this way, the number of counter variables is not limited to three, but may be at least three or more, for example four. When the number of counter variables is four, reliability can be improved more than when there are three counter variables. In other words, when the number of counter variables is three, if the values of two counter variables have a predetermined relationship, those values are determined to have been properly written, but if there is an abnormality, Even if a certain write is performed, there is a possibility that the predetermined relationship will be satisfied by chance, and there is a possibility that the counter value will be misrecognized. On the other hand, when the number of counter variables is 4, if the values of the 3 counter variables have a predetermined relationship, it is determined that the values have been appropriately written. Therefore, the possibility of the above-mentioned judgment error can be significantly reduced. However, if the number of counter variables is small, the required memory capacity can be reduced. Therefore, considering the trade-off relationship between reliability and memory capacity, the abnormal operation control section Preferably, 100 designs are made.

FIG. 6 is a table showing another way of counting up four counter variables. In FIG. 6, the initial values of each counter variable are different from those in FIG. Furthermore, the update period (predetermined time interval) is now 2 ms instead of 1 ms, and the increment is 2 instead of 1. In this way, the method of counting up the counter variable can be changed in various ways.

[Modified example]
(Storage format of counter variables)
In the first and second embodiments, the counter variables are stored in volatile memory, but they may be stored in nonvolatile memory.

(Test mode in hot start)
In the first and second embodiments, the test mode is started at a cold start (the control unit 120 transmits a clock once to the WDT 130), but the present invention is not limited to this. For example, even in the case of a hot start, the test mode may be started.

(Hot start according to schedule)
The test mode may be forcibly implemented using the schedule function in the normal control unit 12. For example, the abnormal operation control unit 100 resets the WDT 130 once a day. Thereby, the test mode is executed periodically, so that the reliability of the abnormal operation control section 100 can be improved. Further, the user may be able to manually execute the test mode when the elevator is not in normal operation, for example during inspection.

(Data in non-volatile memory 112)
The update period of the counter variable, the increment value for the counter variable, and the upper and lower limit values of the counter variable may be stored as parameters in the nonvolatile memory 112 of the storage unit 110. Further, these parameters are determined based on the relationship between the upper limit value of the counter variable determined by the specifications of the CPU used in the control unit 120 and the predetermined period to be monitored by the WDT 130.

(Application to passenger conveyor)
The elevator control system 1 in the first and second embodiments controls an elevator that moves a car 2 up and down. However, the abnormal operation control section 100 is not limited to controlling elevators. Specifically, the abnormal operation control unit 100 may control a passenger conveyor such as an escalator or a moving walkway. Even in these cases, a safe stop operation can be achieved by controlling the motor and brake of the passenger conveyor when loss of function or false detection of the WDT 130 is detected in the test mode.

[Example of implementation using software]
The function of the abnormal operation control unit 100 (hereinafter referred to as the “device”) is a program for making a computer function as the device, and each control block of the device (particularly each part included in the control unit 120) This can be realized by a program for making a computer function.

In this case, the device includes a computer having at least one control device (for example, a processor) and at least one storage device (for example, a memory) as hardware for executing the program. By executing the above program using this control device and storage device, each function described in each of the above embodiments is realized.

The above program may be recorded on one or more computer-readable recording media instead of temporary. This recording medium may or may not be included in the above device. In the latter case, the program may be supplied to the device via any transmission medium, wired or wireless.

Further, part or all of the functions of each of the control blocks described above can also be realized by a logic circuit. For example, an integrated circuit in which a logic circuit functioning as each of the control blocks described above is formed is also included in the scope of the present invention. In addition to this, it is also possible to realize the functions of each of the control blocks described above using, for example, a quantum computer.

Further, each process described in each of the above embodiments may be executed by AI (Artificial Intelligence). In this case, the AI may operate on the control device, or may operate on another device (for example, an edge computer or a cloud server).

[Additional notes]
The present invention is not limited to the embodiments described above, and various modifications can be made within the scope of the claims, and embodiments obtained by appropriately combining technical means disclosed in different embodiments. are also included within the technical scope of the present invention.

1 Elevator control system 2 Car 3 Elevator drive unit 4 Hall calling device 10 Passenger transportation control device 11 Control power source (common)
12 Normal control section 31 Drive power supply 32 First cutoff circuit 33 Second cutoff circuit 100 Abnormal operation control section (control device)
110 Storage unit 111 Volatile memory 112 Non-volatile memory 120 Control unit 121 WDT management unit 122 Door open running protection control unit 123 Terminal floor forced deceleration control unit 124 Test mode processing unit 125 Time recording control unit 126 Abnormality detection unit 130 Watchdog timer (WDT)
140 Power supply monitoring circuit 150 Control power supply (individual)
160 CPUs
210 Car operation panel

Claims (5)

a control unit in which calculations are performed by a processor;
a watchdog timer that restarts the processor when a time interval for receiving clock signals from the processor exceeds a predetermined period;
Equipped with
In a test mode in which the regular transmission of the clock signal is stopped, the control unit
Recording the elapsed time since one test transmission of the clock signal to the watchdog timer as an elapsed time variable in a storage unit;
When the value of the elapsed time variable exceeds the upper limit value of the predetermined period, detecting a functional loss abnormality of the watchdog timer,
If the value of the elapsed time variable stored in the storage unit when the processor is restarted by the watchdog timer after the test transmission is less than the lower limit value of the predetermined period, the watchdog timer A control device characterized by detecting a false detection abnormality. The control unit records the elapsed time as three or more elapsed time variables in the storage unit, and sequentially switches and records the elapsed time variables at predetermined time intervals. control device. 3. The control device according to claim 1, wherein the control unit starts the test mode when the processor is started by cold start. a control unit in which calculations are performed by a processor;
A control method for a control device comprising: a watchdog timer that restarts the processor when a time interval of receiving a clock signal from the processor is equal to or longer than a predetermined period;
In a test mode in which the periodic transmission of the clock signal is stopped,
a recording step of recording the elapsed time since one test transmission of the clock signal to the watchdog timer in a storage unit as an elapsed time variable;
a function loss abnormality detection step of detecting a function loss abnormality of the watchdog timer when the value of the elapsed time variable exceeds an upper limit value of the predetermined period;
If the value of the elapsed time variable stored in the storage unit when the processor is restarted by the watchdog timer after the test transmission is less than the lower limit value of the predetermined period, the watchdog timer A method for controlling a control device, comprising: a step of detecting a false positive abnormality. A passenger transport control device that controls a passenger transport device that is an elevator,
an abnormal operation control unit that detects that the operation of the passenger transport device has become abnormal, independent of a normal control unit that controls normal operation of the passenger transport device;
A passenger transport control device, wherein the abnormal operation control section performs processing by the control device according to claim 1 or 2.

Images