JPH11102294A - Controller for elevator - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent a program from continuing to hang up even after a power failure occurring during the rewriting of a rewritten program in a rewritable nonvolatile memory by providing flags in specific areas of the rewritten program and controlling the execution of the rewritten program according to the values of the set flags. SOLUTION: Areas 2A to 2C are areas for storing programs A to C in an FRAM 2; and 1st to 3rd flags FL1 to FL3 and the rewritten program B are both stored in the area 2B. When a rewrite command for the program B is inputted, it is judged whether the area 2B is unerased. If a power failure, etc., occurs during the rewriting to finish the rewriting abnormally, the 1st to 3rd flags FL1 to FL3 all have a specific value and the program is not stored at all. Therefore, the program B is not executed as well as in the rewriting and an abnormality detecting circuit does not operate even after the power failure.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a control device for an elevator, and more particularly to a control device having a rewritable nonvolatile memory.

[0002]

2. Description of the Related Art In recent years, a rewritable memory such as a flash ROM has been mainly used as a memory of a microcomputer, and the contents thereof have been rewritten as needed during operation of an elevator. In the rewriting, the stored contents are once erased and new data is written in a predetermined area unit.

FIGS. 7 to 9 show a conventional elevator control device. FIG. 7 is an overall configuration diagram, FIG. 8 is a content diagram of a rewritable nonvolatile memory, and FIG. 9 is a control operation flowchart. The same reference numerals indicate the same parts. As shown in FIGS. 7 and 8, a CPU 1, a rewritable nonvolatile memory (hereinafter referred to as FROM) 2, a RAM 3, and a watchdog timer (hereinafter referred to as WD) for detecting abnormalities such as program runaway.
T) 4 and interfaces 6, 8, 9
Connected to each other.

[0004] Further, programs A to C are stored in areas 2A to 2C in the FROM 2, respectively, a rewrite program is stored in an area 2B, and the rewrite program is stored in the area 2A.

[0005] The conventional elevator control device is configured as described above, and at every predetermined time, steps S1 → S in FIG.
It is repeatedly executed in the order of 8 → S9. Now, step S1
When a rewrite command of the program B is input from the terminal 12 in step 2, the contents are erased if the area 2B is not erased.
When the contents of the program to be rewritten are input from the terminal device 12 at the next interruption, the program B is rewritten sequentially. Thereafter, arithmetic processing is performed using the rewritten program B, and as a result, the drive circuit 13 drives the car 16.

As described above, since the program B is rewritten by the rewriting program in the program A, after erasing the program B, the program B is erased in step S8.
Going to, there is no program in area 2B,
Runaway occurs, WDT 4 operates, and elevator stop circuit 11
As a result, the elevator stops.

Therefore, as a countermeasure, a process shown in FIG. 10 can be considered. That is, the predetermined value “FFh” (FF in hexadecimal) from the time the rewrite command is issued until the rewrite is completed
Is set, and it is determined in step S35 whether rewriting is being performed or not by determining whether the flag FW is a predetermined value “FFh”.
During rewriting, the process jumps from step S35 to step S9 so that the program B is not executed.

[0008]

In the conventional elevator control apparatus as described above, which processes as shown in FIG. 9, a power failure or the like occurs immediately after the erasure of the rewrite program until the rewrite is completed. If the rewrite cannot be completed normally due to the occurrence of the error, even if the power is restored and the program starts running, there is a problem that the program B runs away and tries to execute.

[0009] In the processing as shown in FIG.
The flag FW is set to “0” when the program is started, that is, when the power is restored, in order to execute the program B normally (when rewriting is not performed). Therefore, step S
From 35, the process proceeds to step S8. Even if the rewriting is completed normally, if the rewritten program has a defect or the data changes during communication and the contents of the program become invalid, the program B is executed after the rewriting. There is a problem that you will run away.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problem, and prevents a program from continuing to run away after a power failure occurs during rewriting of a program to be rewritten in a rewritable nonvolatile memory. It is an object of the present invention to provide a control device for an elevator.

[0011]

According to a first aspect of the present invention, an elevator control device stores a plurality of flags in a predetermined area of a rewritable program stored in a rewritable non-volatile memory. When the rewriting is completed and after rewriting, the flag is set to a value at the time of erasing of the nonvolatile memory or a value other than the value at the time of erasing, and the execution of the program to be rewritten is controlled according to the value of the set flag. It was done.

Further, the elevator control apparatus according to the second invention stores a plurality of flags in a first area of a program to be rewritten stored in a rewritable nonvolatile memory,
When the rewriting of the rewritten program is completed, the first area is erased and then the other rewritten program storage area is erased, and the flag is set to the value at the time of erasing the nonvolatile memory or the erasing according to the completion of the rewriting of the rewritten program and after the rewriting. The value is set to a value other than the hour value, and the execution of the rewriting program is controlled in accordance with the value of the set flag.

According to a third aspect of the present invention, there is provided the elevator control device according to the first or second aspect, wherein the non-rewritable nonvolatile memory is used instead of storing the rewrite program in the rewritable nonvolatile memory. It is stored in a memory.

According to a fourth aspect of the present invention, there is provided an elevator control apparatus according to the first to third aspects, wherein the plurality of flags are a first flag, a second flag, and a third flag, and when the rewriting of the rewriting program is completed. The first flag is set to a second flag when the rewrite program is called after the rewrite program is rewritten, and the third flag is set after the rewrite program is executed after the rewrite program is completed and no abnormality is detected. This is set to a value other than the value at the time of erasing of the rewritable nonvolatile memory.

According to a fifth aspect of the present invention, in the elevator control apparatus according to the fourth aspect, the initial value of the first flag is set to a value other than the value at the time of erasing of the rewritable nonvolatile memory, and The initial value of the third flag is the value at the time of erasing of the rewritable nonvolatile memory.

According to a sixth aspect of the present invention, in the elevator control apparatus according to the fourth aspect, if the first flag is a value at the time of erasing the rewritable nonvolatile memory, execution of the program to be rewritten is prevented. It is like that.

According to a seventh aspect of the present invention, in the elevator control apparatus according to the fourth aspect, after the rewrite program is rewritten, the first flag has a value other than the value at the time of erasing the rewritable nonvolatile memory. If the third flag is a value at the time of erasing of the rewritable nonvolatile memory, the second flag is a value other than the value at the time of erasing of the rewritable nonvolatile memory, and if an abnormality is detected, the program to be rewritten is The execution of is prevented.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION

Embodiment 1 FIG. 1 to 4 show first and third embodiments of the present invention.
FIG. 1 is a diagram showing an embodiment of the seventh invention, FIG. 1 is an overall configuration diagram, FIG. 2 is a content diagram of a rewritable nonvolatile memory, FIG.
Is a control operation flowchart, and FIG. 4 is a rewrite operation flowchart. In the figure, the same reference numerals indicate the same parts (the same applies to the following embodiments).

In FIG. 1, reference numeral 1 denotes a CPU, and 2 denotes a rewritable nonvolatile memory (hereinafter referred to as FRO) such as a flash ROM.
M, 2 and 3 are RAMs, and 4 is a watchdog timer (hereinafter referred to as WDT) which outputs an abnormal signal 4a when detecting abnormalities such as program runaway.
Reset U1. 5 is a counter for counting the number of occurrences of the abnormal signal 4a, 6 to 9 are interfaces (hereinafter, I / F) for inputting and outputting signals to and from the outside, and the devices 1 to 9 are mutually connected by a bus 10.

An elevator stop circuit 11 stops the elevator when the abnormal signal 4a is input.
Can also be reset from the CPU 1 via. 1
2 is a terminal connected to the I / F 8 for rewriting the FROM 2; 13 is connected to the I / F 6 to
Is a main cable driven by an electric motor 14 and has a car 16 and a counterweight 1 at both ends thereof.
7 are connected.

The I / F 9 is connected to equipment installed in the car 16 via a moving cable (not shown) to exchange signals. In addition, other than this, landings, hoistways,
There is also an I / F for transmitting and receiving signals from devices installed in a machine room or the like, but since this embodiment is not directly related, description thereof is omitted.

In FIG. 2, reference numerals 2A to 2C denote areas for storing programs A to C in the FROM 2, respectively, and an area 2B includes both a first flag FL1 to a third flag FL3 and a rewrite program B. Is stored.

Next, the operation of this embodiment will be described with reference to FIGS. The program shown in FIG.
It is repeatedly executed every predetermined time. Also,
The rewriting program of the program B shown in FIG. 4 exists in the area 2A, that is, the program A. Now, in step S21, the program B
When the rewrite command is input, the process proceeds from step S22 to step S23, and it is determined whether the area 2B has not been erased based on whether the erase flag FE is a predetermined value “FFh” (FF in hexadecimal).

If the area 2B has not been erased, step S2
In step 4, this area is erased. Thus, the first to third flags F
L1 to FL3 all have a predetermined value “FFh”. Then, in a step S25, the erase flag FE is set to a predetermined value “FF”.
h ”. In the process at the time of the next interrupt, step S2
Since the erasure flag FE is set to the predetermined value “FFh” in 3, the process proceeds to step S 26, where it is determined whether or not the rewriting is completed.
B (n is a pointer, nB is the data amount of the area 2B), and since the rewriting has not been completed, step S
The program proceeds to step 27, where the contents of the program to be rewritten are input from the terminal device 12.

Here, generally, communication with the terminal 12 is as follows.
Since serial transmission such as R5322C is used, area 2B
It takes a long time to input all the programs, and cannot be processed by a single interrupt process. Therefore, rewriting is performed at a time every predetermined amount m. Therefore, m (generally m bytes) rewrite data is input in step S27, and stored in the area 2B in step S28. In step S29, the pointer n for storing the storage location of the next input data is advanced by m.

When all the rewriting of the area 2B is completed, the process proceeds from step S26 to step S30, where a rewriting end code is sent to the terminal 12, and in step S31, the erase flag FE, the pointer n and the first flag FL1 are each set to "0". To clear. Here, during rewriting, the process proceeds from step S1 in FIG.
It is determined whether the flag FL1 is "0". Since the first flag FL1 is set to the predetermined value "FFh", the process jumps to step S9 and the program B is not executed.

When the rewriting is completed, the first flag FL1 is set to "0" in step S31, whereby the state shown in FIG.
From step S2 to step S3, the program B
Is determined based on whether the third flag FL3 is "0". Since the third flag FL3 has been set to the predetermined value "FFh" by the erasure in step S24, the process proceeds to step S4. In step S4, it is determined whether the program B has been called based on whether the second flag FL2 is "0". Since the second flag FL2 is also set to the predetermined value "FFh" similarly to the third flag FL3, the process proceeds to step S10, sets the second flag FL2 to "0", and then jumps to step S8 to execute the program B. I do.

When the program B is executed after rewriting, in the next interrupt processing, steps S2 → S3 → S4
Since the second flag FL2 is set to "0", the process proceeds to step S5, and the signal of the operation counter 5 of the WDT 4 is input. In step S6, it is determined whether or not the WDT 4 has operated based on whether the count number CW of the counter 5 is greater than zero. If not operating, that is, if the program B operates normally after rewriting, the process proceeds to step S7.
The third flag FL3 is set to "0", and the program B is executed in step S8. Thereafter, steps S2 → S3 →
The program B is executed by S8.

If a power failure or the like occurs during rewriting and the rewriting cannot be completed normally, the first to third flags FL1 to FL
At step S24, L3 has a predetermined value "FFh" and no program is stored. Therefore, as in the above rewriting, the program B is not executed by jumping from step S2 to step S9, and the WDT 4 does not operate even after a power failure.

When the rewriting is completed and there is a defect in the rewritten program, after the rewriting, step S2 is executed.
→ The second flag FL2 is set to “0” by → S3 → S4 → S10
Then, the program B is executed in step S8. Here, due to the above-mentioned problem, the program B runs away,
WDT 4 operates to output abnormal signal 4a. And
The elevator stop circuit 11 operates to stop the elevator. At the same time, since the CPU 1 is reset by the abnormal signal 4a, the program is started again.

When the program is started again, step S
Since the operation of WDT4 is confirmed by 2 → S3 → S4 → S5, and the counter 5 counts the operation of WDT4, the process proceeds from step S6 to S9, and the program B is not executed. Absent. Here, steps S1 to S10 correspond to the program control means,
Steps 1 to S6 and steps S2 and S9 constitute a rewriting program execution inhibiting means, and steps S24 and S31 constitute a flag setting means.

In this way, the execution of the program B is controlled by setting the first to third flags FL1 to FL3 in the storage area 2B of the rewrite program B. That is, by setting the first flag FL1, the program B is not executed until the rewriting is completed. Even if a power failure or the like makes it impossible to complete the rewriting normally during this time, the program continues to run away after the power is restored. It can be prevented.

The second and third flags FL2 and FL3
After the rewriting of the program B is completed, the program B is executed once, the operation of the WDT 4 is checked in the next calculation, and the rewritten program B is defective or the content of the program B is changed due to a change in data during communication. Is illegal, it is possible to prevent the program B from running out of control after rewriting.

Embodiment 2 FIGS. 5 and 6 show an embodiment of the second invention of the present invention. FIG. 5 is a diagram showing the contents of a rewritable nonvolatile memory, and FIG. 6 is a flowchart of a rewriting operation. 1 and 3 are also used in the second embodiment. In FIG. 5, 2A, 2B1, 2B2, 2C
Is the area of FROM2, and the rewrite program B is in area 2
B1 and the area 2B2, and the first to first flags F
L1 to FL3 are stored in the area 2B1.

Next, the operation of this embodiment will be described with reference to FIG. When rewriting the rewriting program B,
Proceed from step S21 → S22 → S23, and step S2
4A, the area 2B1 is erased first. With this, the first to third
The flags FL1 to FL3 have a predetermined value “FFh”. Subsequently, the area 2B2 is erased in a step S24B. The rest is the same as the first embodiment.

Since the area 2B1 is erased prior to the area 2B2 in step S24A, the area 2B1 is erased.
1, even if a power failure occurs after the erasure, the first to third flags FL1
Since FL3 takes a predetermined value “FFh”, it is possible to prevent the program from running out of control similarly to the first embodiment. If the erasure of the area 2B2 precedes, if a power failure occurs immediately after that, the first to third erasures will be performed.
When the flags FL1 to FL3 are not rewritten to the predetermined value “FFh” and the power is restored and the program is started again, the program B runs out of control.

Here, steps S24A and S24B are as follows:
It constitutes storage area erasing means. In this manner, the rewrite program B is divided into the areas 2B1 and 2B2,
The third to third flags FL1 to FL3 are stored in the area 2B1, and are erased in the order of the areas 2B1 and 2B2 after rewriting is completed. This can be applied when it is inconvenient to erase the program B at one time.

In the first and second embodiments, the program A is stored in the FROM 2. However, a non-rewritable non-volatile memory (not shown) is provided and stored therein. This can prevent the rewriting program from being erroneously rewritten (corresponding to the third invention). Further, the initial value of the first flag FL1 is set to “0”, and the second and third flags FL2 and FL3 are set to “FF”.
If "h" is set, the trial of the program B and the check of the WDT 4 can be executed when the processing of FIG. 3 is performed for the first time. For example, the execution check can be performed also for the program B prepared at the time of factory shipment. It is.

[0039]

As described above, according to the first aspect of the present invention, a plurality of flags are stored in a predetermined area of the rewritable program stored in the rewritable nonvolatile memory, and when the rewriting of the rewritable program is completed and when the rewriting is completed. The flag is set to a value at the time of erasing of the nonvolatile memory or a value other than the value at the time of erasing, and the execution of the program to be rewritten is controlled according to the value of the set flag. It is possible to prevent the program from running out of control due to incomplete rewriting due to a power failure during the rewriting, or illegal rewriting of the contents of the rewritten program.

In the second invention, a plurality of flags are stored in the first area of the rewritable program stored in the rewritable nonvolatile memory, and the first area is erased when the rewriting of the rewritable program is completed. After that, the storage area of the other program to be rewritten is erased, and the flag is set to a value at the time of erasing of the nonvolatile memory or a value other than the value at the time of erasing according to the completion of the rewriting of the program to be rewritten and after the rewriting. The execution of the rewritable program is controlled in accordance with the value of the rewritable program. This can be applied when it is inconvenient to delete the data.

In the third invention, the rewrite program is stored in the non-rewritable non-volatile memory. Therefore, the rewrite is not completed due to a power failure while the rewrite program is being rewritten, or the program runs out of control due to an illegal content of the rewrite completed program. Can be prevented, and the rewriting program can be prevented from being erroneously rewritten.

In the fourth invention, the first to third flags are provided, the first flag is set when the rewriting of the rewritten program is completed, and the second flag is set when the rewritten program is called after the rewriting of the rewritten program. After executing the program to be rewritten after the completion of the program rewriting, if no abnormality is detected, the third flag is set to a value other than the value at the time of erasing of the rewritable nonvolatile memory. Even if a power failure or the like occurs during the rewriting and the rewriting cannot be completed normally, it is possible to prevent the program from continuing runaway after the power is restored. Also, there is a problem with the rewrite completion program,
Even if the contents of the program become illegal due to a data change during communication, it is possible to prevent the program from running away after rewriting.

In the fifth invention, the initial value of the first flag is set to a value other than the value at the time of erasing of the rewritable nonvolatile memory, and the initial values of the second and third flags are respectively set to the rewritable nonvolatile memory. Because the value was the value at the time of erasing the memory, for example, for the rewrite program prepared at the time of factory shipment,
A program execution check can be immediately performed.

According to the sixth aspect of the present invention, if the first flag is a value at the time of erasing the rewritable nonvolatile memory, the execution of the rewritable program is prevented. Even if rewriting cannot be completed normally due to the occurrence of, the program can be prevented from running out of control after power recovery.

According to the seventh aspect of the present invention, after the rewriting of the program to be rewritten, the first flag is set to a value other than the value at the time of erasing the rewritable nonvolatile memory, and the third flag is erased from the rewritable nonvolatile memory. If the second flag is a value other than the value at the time of erasing of the rewritable nonvolatile memory and an abnormality is detected, the execution of the program to be rewritten is prevented. Even if there is a problem or the contents of the program become illegal due to a data change during communication, it is possible to prevent the program from running away after rewriting.

[Brief description of the drawings]

FIG. 1 is an overall configuration diagram showing a first embodiment of the present invention.

FIG. 2 is a diagram showing the contents of the FROM of FIG. 1;

FIG. 3 is a control operation flowchart showing the first embodiment of the present invention.

FIG. 4 is a rewrite operation flowchart showing the first embodiment of the present invention.

FIG. 5 is a content diagram of a FROM showing the second embodiment of the present invention.

FIG. 6 is a rewrite operation flowchart showing Embodiment 2 of the present invention.

FIG. 7 is an overall configuration diagram showing a conventional elevator control device.

FIG. 8 is a view showing the contents of the FROM of FIG. 7;

FIG. 9 is a control operation flowchart showing a conventional elevator control device.

FIG. 10 is a control operation flowchart obtained by improving FIG. 9;

[Explanation of symbols]

1 CPU, 2 rewritable nonvolatile memory (FRO)
M) 2A-2C, 2B1, 2B2 storage area, 3R
AM, 4 abnormality detection circuit (WDT), 5 counter, 1
1 elevator stop circuit, 12 terminal, 13 drive circuit, S1 to S10 program control means, S1 to S
6, S2, S9 rewritable program execution inhibiting means, S
24, S31 flag setting means, S24A, S24B
Storage area erasing means.

Claims (7)

[Claims] 1. An apparatus, comprising: an electrically rewritable nonvolatile memory storing an elevator control program; and externally rewriting and executing the program stored in the nonvolatile memory. A rewrite program stored in a predetermined area of the rewrite program, a rewrite program stored in an area other than the predetermined area and rewriting the rewrite program, and a plurality of flags stored in a predetermined area of the rewrite program. Flag setting means for setting the flag to a value at the time of erasing of the nonvolatile memory or a value other than the value at the time of erasing according to the completion of rewriting of the rewriting program and after the rewriting, and according to the value of the set flag A program control means for controlling execution of the rewrite program. Controller of the motor. 2. An apparatus, comprising: an electrically rewritable nonvolatile memory storing an elevator control program; and externally rewriting and executing the program stored in the nonvolatile memory. A rewrite program stored in a plurality of areas including the first area, a rewrite program stored in an area other than the rewrite program storage area, and a rewrite program for rewriting the rewrite program; and a first area of the rewrite program. A plurality of stored flags, a storage area erasing means for erasing the first area after the rewriting of the rewritten program is completed, and then erasing another rewritten program storage area, and completing the rewriting of the rewritten program. The flag is set to the value at the time of erasing of the nonvolatile memory or to the A control device for an elevator, comprising: flag setting means for setting a value other than an hour value; and program control means for controlling execution of the rewriting program in accordance with the value of the set flag. 3. A non-rewritable nonvolatile memory is provided,
The elevator control device according to claim 1 or 2, wherein the rewriting program is stored in the non-rewritable nonvolatile memory instead of being stored in the rewritable nonvolatile memory. 4. A method according to claim 1, wherein the plurality of flags are a first flag, a second flag, and a third flag, and the flag setting means sets the first flag upon completion of the rewriting of the program to be rewritten after the rewriting of the program to be rewritten. When the rewriting program is called, the second flag is set. When the rewriting program is executed after the rewriting of the rewriting program is completed, the third flag is set if the abnormality detection circuit is not operating. The elevator control device according to any one of claims 1 to 3, wherein the value is set to a value other than the value at the time of erasing the memory. 5. The method according to claim 5, wherein the initial value of the first flag is a value other than the value at the time of erasing of the rewritable nonvolatile memory, and
The elevator control device according to claim 4, wherein the initial value of the flag is a value at the time of erasing the rewritable nonvolatile memory. 6. After rewriting the rewritable program, the first
5. The elevator control device according to claim 4, further comprising means for preventing execution of the rewritable program if the flag is a value at the time of erasing of the rewritable nonvolatile memory. 7. After rewriting the rewritable program, the first
The flag is a value other than the value at the time of erasing the rewritable nonvolatile memory, the third flag is the value at the time of erasing the rewritable nonvolatile memory, and the second flag is the value at the time of erasing the rewritable nonvolatile memory. 5. The elevator control apparatus according to claim 4, further comprising a rewritable program execution preventing means for preventing the execution of the rewritable program when the abnormality detection circuit is operating at a value other than the value of (1). .