SG176413A1

SG176413A1 - Safety elevator

Info

Publication number: SG176413A1
Application number: SG2011039195A
Authority: SG
Inventors: Uotani Shogo; Iketomi Chikara; Sugiyama Yohei; Yamashita Daisuke; Aida Keiichi
Original assignee: Hitachi Ltd
Priority date: 2010-05-31
Filing date: 2011-05-30
Publication date: 2011-12-29
Also published as: JP2011246269A; CN102259779A; JP5422488B2

Abstract

SAFETY ELEVATOR AbstractA safety elevator controlled in operation by executing a control program (22) loaded from a storage unit (15) to a RAM (20) with use of a CPU (14), includes a detecting circuit including a parity bit generating circuit (16) and a parity check circuit (17), for detecting a memory error of the RAM, and a log saving circuit (19) for recording an occurrence of the memory error, in this way, a correction of the memory error is performed by using data stored in the storage unit when occurring the memory error, therefore, the memory error is detected to correct it even when the memory error occurs in executing the control program, so that the operation control can be performed more safely and prevented from lowering an operationefficiency Fig. 2

Description

W6045 - -1-

SAFETY ELEVATOR

BACKGROUND OF THE INVENTION

The present invention relates to an operation control device for elevators, and in particularly to an operation control device preferred for controlling safely the operation when a memory error occurs during a microcomputer for a control program is running.

Normally, the control program of elevator is copied to a RAM (random Access

Memory) from a ROM (Read Only Memory) to be executed on the RAM. A safety elevator that a danger or failure is unlikely to be caused by a malfunction of programming data during an operation is desired.

For a purpose of avoiding the elevator failure when data in a memory of a program is garbled and of performing a high reliable elevator control, there is a known technique such that a program executing memory as a volatile memory for an execution is provided other than a program storing memory as a nonvolatile memory for storing the program used for an operation control process to then perform a verify check at all times, confirm that the elevator stops, and transfer the program data to the program executing memory from the program storing memory, when occurring an error. For example, JP-A-2004-110400 discloses such technique.

Further, for a purpose of responding in safe to an abnormality even in occurring it in one program when a plurality of programs are executed in a single CPU, there is a known technique such that an entire CPU is initialized and stopped when the abnormality occurred program is a main program so as to adversely affect largely on a control device and only the abnormality occurred program is initialized and stopped when it is a subprogram having a little affect. For example, JP-A-2-299035 discloses such technique.

SUMMARY OF THE INVENTION

In the above-mentioned related art, JP-A-2004-110400 discloses that the verify check for the program executing memory is executed at all times and the program data is transferred from the program storing memory to the program executing memory when occurring an error. Therefore, it is essential to stop the operation of elevator to prevent the elevator from being uncontrolled during the transfer process is executed. In fact, when a memory error occurs on the RAM, the program execution stops even in a location (for example, a program for outputting a buzz sound) which does not disturb a normal operation.

In the technique of JP-A-2-299035, the program is merely initialized in response

’ ’ W6045 9. to the abnormality of program, therefore, it might occur that not only the technique cannot respond to a time of occurring the memory error, but also the program stops, the service stops and a trouble (over ascending/over descending, ignition/smoking, door opened) caused by the initialization process occurs when occurring the memory error on the RAM in a microcomputer.

The invention solves a problem of the above-mentioned related art and controls more safely the operation to prevent lowering of an operation efficiency even though the memory error occurs on RAM incorporated in the microcomputer for executing control programs.

In order to solve the above-mentioned problem, a safety elevator controlled in operation by executing a control program loaded from a storage unit to a RAM with use of a

CPU, provides a detecting circuit that detects a memory error of the RAM, and a log saving circuit that records an occurrence of the memory error, and a correction of the memory error is executed by using data stored in the storage unit when occurring the memory error.

According to the invention, the memory error is detected to correct it even when the memory error occurs in executing the control program. Thereby, the operation control can be performed more safely and a decrease in operation efficiency is prevented.

The other objects, features and advantages of the invention will become apparent from the following description of the embodiments of the invention taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1 is a block diagram showing an entire configuration of a safety elevator in an embodiment of the invention;

Fig. 2 is a block diagram showing a control circuit in the embodiment;

Fig. 3 is a flowchart showing a control operation in the embodiment;

Fig. 4 is a block diagram showing a configuration of a control program in the embodiment; and

Fig. 5 is a diagram showing tasks and address range of the control program in the embodiment.

DESCRIPTION OF THE EMBODIMENTS

Hereinafter, an embodiment in the invention will be described with reference to the drawings.

Fig. 1 is a block diagram showing an entire elevator. An elevator car 13 is

} W6045 -3- connected to a counterweight 11 via a rope 12 driven by a hoist 10. A control circuit 3 is provided on an elevator control panel 1 installed in a machine room 8. In the control circuit 3, a control program is copied (or loaded) to RAM from ROM (storage unit) to be executed on RAM, and the elevator car 13 is then controlled to ascend or descend in a hoistway 9. Control information required for an operation control is sent to an I/F circuit (Interface) 6 in an elevator monitoring device 4 from an I/F circuit 2 to judge a failure etc. in a control circuit 7 and transmit information including the failure and its location, a cause, etc. to a maintenance company etc. by a failure cause alarming activation unit 5.

Fig. 2 shows a configuration of a memory error detecting circuit in the control circuit 3. In Fig. 2, a reference numeral 14 denotes a CPU (Central Processing Unit), 15 is a

PLD (Programmable Logic Device) as ROM storing the control program etc., 16 is a parity bit generating circuit, 17 is a parity check circuit, 18 is an interrupt signal generating circuit, 19 is a log saving circuit, 20 is a RAM and 21 is an ECC RAM (Error Check Correct Random Access

Memory). An access to RAM 20 and ECC RAM 21 from CPU 14 is performed via the PLD 15 and the control program is executed.

The PLD 15 includes the parity bit generating circuit 16, parity check circuit 17, interrupt signal generating circuit 18 and log saving circuit 19 as shown in Fig. 2. The parity bit generating circuit 16 generates parity bits from the control program stored in PLD 15 to then store in ECC RAM 21. The parity check circuit 17 performs a parity check on the basis of read data read out from RAM 20 and a parity bit stored in ECC RAM 21 to check presence or absence of occurring a memory error.

The interrupt signal generating circuit 18 generates an interrupt signal, when detecting the memory error, to then output to CPU 14. The log saving circuit 19 records an address and data that a memory error occurred when detecting the memory error.

Next, a process in detecting the memory error will be described with reference to

Fig. 3.

Fig. 3 shows an operation flow of the elevator when the memory error occurs during the control program 22 is executed. The CPU 14 performs a reading or writing process for data to RAM 20 by the control program loaded on RAM 20. The parity bit generating circuit 16 generates parity bits to then write to ECC RAM 21, at a step S11, after starting the process at a step S10.

The parity check circuit 17 detects whether there is an error in read data on the basis of the parity bits corresponding to the read data read out from RAM 20 and the read data stored in ECC RAM 21, that is, the occurrence of memory error is detected, at a step S12.

) ’ Wo6045 4.

The log saving circuit 19 records the address and data in RAM 20 on which the memory error occurs, at a step S13, when detecting the occurrence of memory error (Yes, in Fig. 3). Further, the interrupt signal generating circuit 18 outputs an interrupt signal to CPU 14 at a step S14, when confirming the occurrence of memory error.

When CPU 14 detects the interrupt signal, the CPU 14 writes normal data stored in a storage unit in PLD 15 in the address, where the memory error occurs, and a memory error correction is performed at a step S15.

The operation is continued at a step S17 when the memory error correction is completed at a step S16.

When the memory error correction is not completed at the step S16, a failure region corresponding to the address, where the memory error occurs, is specified by a database recording a relation between the address and failure region previously recorded in the log saving circuit 19 at a step S18.

As mentioned later, when the process judges that the memory error occurs at a location where a normal operation is directly disturbed at a step S19, the operation control is performed to make an emergency stop at a step S21 if the elevator is running at a step S20. The failure cause alarming activation unit 5 provided in the elevator monitoring device 4 then transmits information of failure location and a cause of failure to the maintenance company etc. at a step S22. If the elevator is not running at the step S20, the service is paused at a stopping floor at a step S23 and the failure cause alarming activation unit 5 provided in the elevator monitoring device 4 transmits the information of failure location and the cause of failure to the maintenance company at the step S22.

When the process judges that the memory error occurs at a location where a normal operation is directly disturbed at the step S19, the program belonging to the location, where the memory error occurs, is separated off from the operating program. In fact, a portion which is masked such that CPU 14 does not read the portion is determined and the operation is continued at a step S24, and the failure cause alarming activation unit 5 provided in the elevator monitoring device 4 transmits the information of failure location and the cause of failure to the maintenance company or a maintenance department etc. at the step S22.

Next, the following description will be concerned with a judgment of whether the memory error occurs at the location where the normal operation is directly disturbed.

Fig. 4 is a block diagram showing a part of a configuration of an elevator control program. In Fig. 4, a reference numeral 22 denotes an elevator control program and 23 is a major control program relative to the control for operating the elevator car, a speed, opening and

’ © We04s -5- closing a door, and also the control directly relative to trouble etc., in which a reference numeral 24 denotes an operation control task, 25 is a speed control task and 26 is a door control task.

A reference numeral 27 denotes an option program for executing functions other than the major control program 23, 28 is a display/output task, 29 is an announcement by broadcast, 30 is a liquid crystal display, 31 is a buzzer sound and 32 is a button lamp lighting.

As shown in Fig. 4, in the elevator control program, the operation control task 24, speed control task 25, door control task 26, etc. relative directly to the elevator operation are sectionalized as the major control program 23. In contrast, the display/output task 28 performing the announcement by broadcast 29, liquid crystal display 30, buzzer sound 31, button lamp lighting 32, etc. are sectionalized as the option program 27 since they are not relative directly to the elevator operation,

Fig. 5 shows a memory map indicating a relation and allocation between an address range for every section and the respective tasks of the major control program 23 and option program 27 in the RAM copied from ROM storing the control program, and the respective tasks are stored in the address range as shown in Fig. 5. When the memory occurs, the log saving circuit 19 records an address of the location, where the error occurs. Itis therefore found in which task the memory error occurs by referring to a memory map 33 on the basis of the address recorded in the log saving circuit 19. In consequence, it can be judged that whether the memory error occurs at the location where the normal operation is directly disturbed.

In fact, when the address, where the memory error occurs, is present in the address range of the task sectionalized as the major control program 23, it is judged that the error occurs on the location disturbing the normal operation.

In Fig. 5 for example, when the address of location, where the memory error occurs, recorded in the log saving circuit 19 is 0x5000, it is determined that the error corresponds 26 to the location disturbing the normal operation since the memory error occurs in the speed control task 25.

Merely, not only the elevator operation stops in emergency as disturbed the normal operation, but also the control procedure led to the emergency stop for each of the operation control task 24, speed control task 25 and door control task 26 may be changed to the following procedure.

When the memory error corresponds to the location which is not adversely affect on the safety of elevator operation in the operation control task 24, for example, the location for performing a registration of an elevator call, the operation is paused after the elevator car 13 arrives at a nearest floor.

) ’ W6045 -G-

When the memory error corresponds to the location which does not adversely affect on the safety of elevator operation in the speed control task 25, for example, the location for performing a correction function for correcting a minute displacement of the elevator car 13 when the elevator car 13 arrived at a floor, the emergency stop is not performed, but the operation is paused after the elevator car 13 arrives at any floor.

When the memory error corresponds to the location which does not adversely affect on the safety of elevator operation in the door control task 26, for example, the location which is not relative directly to a selection of which the front or back door of elevator car 13 is open or closed, the emergency stop is not performed, but the operation is paused after the elevator car stops at any floor.

When the address, where the memory error occurs, is present in the address range of the tasks (display/output task 28, announcement by broadcast 29, liquid crystal display 30, buzzer sound 31 and button lamp lighting 32) sectionalized as the option program 27, it is judged that the error corresponds to the location which does not disturb the normal operation. For example, when the recorded address of location, where the memory error occurs, is 0xD0O0O, it is judged that the error occurs at the location which does not disturb the normal operation since the memory error occurs in the display/output task 28 in Fig. 5.

It should be further understood by those skilled in the art that although the foregoing description has been made on embodiments of the invention, the invention is not limited thereto and various changes and modifications may be made without departing from the spirit of the invention and the scope of the appended claims.

Claims

) W6045 -7- CLAIMS:

1. A safety elevator controlled in operation by executing a control program (22) loaded from a storage unit (15) to a RAM (20) with use of a CPU (14), comprising: a detecting circuit (16, 17) that detects a memory error of the RAM; and a log saving circuit (19) that records an occurrence of the memory error, wherein a correction of the memory error is performed by using data stored in the storage unit when occurring the memory error.

2. The safety elevator according to claim 1, wherein the log saving circuit (19) records an address of the RAM (20) on which the memory error occurs.

3. The safety elevator according to claim 1, wherein the operation is stopped in accordance with an address of the memory error detected by the detecting circuit (16, 17).

4. The safety elevator according to claim 1, wherein an address of the memory error detected by the detecting circuit (16, 17) is judged whether the address corresponds to a location disturbing the operation in the control program (22).

5. The safety elevator according to claim 1, wherein the operation is stopped when an address of the memory error detected by the detecting circuit (16, 17) relates to either an operation control, a speed control or a door control in the control program (22).

6. The safety elevator according to claim 1, wherein the operation is continued when an address of the memory error detected by the detecting circuit (16, 17) relates to a display/output task in the control program (22).

7. The safety elevator according to claim 1, wherein an operation is continued when a correction of the memory error is completed.

8. The safety elevator according to claim 1, wherein when it is judged that an address of the memory error detected by the detecting circuit (16, 17) belongs to a display/output task in the control program (22), a portion where the CPU (14) does not read is determined to continue the operation and information of a failure location is transmitted to a maintenance company.

9. The safety elevator according to claim 1, further comprising: the log saving circuit (19) that records an address of the RAM (20) on which the memory error occurs; and a database that records a relation between the address and a failure region, wherein the failure region is specified by the database.

10. The safety elevator according to claim 1, wherein when the correction of the

) Ww 6045 -8- memory error is not completed, an elevator car (13) is stopped if the elevator car is running and a service is paused if the elevator car is not running and is stopped at a floor.

11. The safety elevator according to claim 1, wherein when the correction of the memory error is not completed, it is judged that the memory error corresponds to a location disturbing the operation, and when it is judged that the memory error corresponds to the location which does not adversely affect largely on a safety, a service is paused after an elevator car (13) 1s stopped at a nearest floor.