Multiprocessor supervisory control for an elevator system

• US 4,567,560 A
• Filed: 09/09/1983
• Issued: 01/28/1986
• Est. Priority Date: 09/09/1983
• Status: Expired due to Fees

• Current Assignee: Inventio AG (Schindler Holding AG)
• Original Assignee: Westinghouse Electric Corporation (Paramount Global (f/k/a ViacomCBS Inc.))
• Inventors: Husson, Alan L., Polis, Marjorie J.
• Primary Examiner(s): Smith, Jerry
• Assistant Examiner(s): NOT, DEFINED
• Application Number:
  US06/530,808
• Time in Patent Office: 872 Days
• Field of Search: 371/14, 371/12, 371/15, 371/16, 371/18, 371/25, 371/28, 371/67, 371/68, 187/29 R, 364/132, 364/184
• US Class Current: 700/79
• CPC Class Codes: B66B 5/0006 Monitoring devices or performance analysers B66B5/02 takes precedence
• CPC Class Codes: B66B 5/0018 Devices monitoring the operating condition of the elevator system
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0763 by bit configuration check, e.g. of formats or tags

Abstract

An elevator system, and method of monitoring same, which includes a plurality of elevator cars under the group supervisory control of at least first and second processors, which all share a common memory over a system bus. The first processor periodically monitors its own status, and it sets a predetermined location of the shared memory each time it finds its status to be normal. The second processor periodically checks the predetermined location, and upon finding it set, it resets it. The second processor also monitors its own status. The second processor triggers a retriggerable hardware timer each time it determines that the first processor and itself are both operating normally, with the trigger rate preventing the timer from reaching the end of a predetermined timing period. When the second processor finds the status of either processor to be abnormal, it terminates its triggering of the timer. The timer then provides a signal at the end of its timing period, which reinitializes both processors.

Claims

1. An elevator system, comprising:

a plurality of elevator cars;

a control system for controlling said plurality of elevator cars including a dispatcher processor, a communication processor for polling the elevator cars for information for use by said dispatcher processor, and for selecting an elevator car to receive information from said dispatcher processor, a memory, a system bus interconnecting said dispatcher processor, said communication processor, and said memory, with said memory being shared by said master processor and said communication processor via said system bus;

said dispatcher processor including means for preparing car mode information for said elevator cars, and means for writing said car mode information into said shared memory;

said communication processor including means for reading said shared memory to obtain car mode information, and means for transmitting said car mode information to associated elevator cars;

said elevator cars including means for providing car status information;

said communication processor including means for obtaining car status information from the elevator cars, and means for writing said car status information into said shared memory;

said dispatcher processor including means for reading said shared memory to obtain said car status information;

a selected one of the dispatcher and communication processors being a master processor, with the non-selected processor being a slave processor;

said slave processor including storage means, and program means stored in said storage means for periodically setting a predetermined location of said shared memory;

said master processor including storage means, and diagnostic program means stored in said storage means, said diagnostic program means including checking means for periodically checking said predetermined location to determine if it is set or reset, resetting means for resetting the predetermined location each time the checking means finds said predetermined location set, detecting means for periodically determining if the operation of the master processor is normal or abnormal, and trigger signal means for providing trigger signals;

said trigger signal means providing a trigger signal responsive to the checking means finding said predetermined location of said shared memory set and the detecting means detecting normal operation of the master processor, with said trigger signals being provided by trigger signal means at a predetermined triggering rate when the checking and detecting means continue to respectively find said predetermined location of the shared memory set, and normal operation of the master processor;

and a single retriggerable hardware timer in communication with said master processor via said system bus, said hardware timer being responsive to the trigger signals provided by the trigger signal means of said master processor;

said hardware timer having a predetermined timing period when triggered by a trigger signal, with said predetermined timing period being selected such that the predetermined triggering rate of the trigger signals prevents said hardware timer from reaching the end of said predetermined timing period;

said trigger signal means of the master processor ceasing to provide trigger signals as a function of either said checking means finding said first predetermined location of said shared memory reset or the detecting means detecting abnormal operation of said master processor,

said hardware timer applying an interrupt signal to said system bus when it reaches the end of its timing period;

said master processor and said slave processor including first and second interrupt responsive program means, respectively, which reinitialize the master processor and slave processor in response to the interrupt signal being placed on the system bus by said hardware timer.

2. The elevator system of claim 1 wherein the second program means of the master processor includes counting means for providing a count responsive to the number of times the checking means of the master processor finds the predetermined location of the shared memory reset on successive checks,

and wherein the trigger signal means ceases to provide trigger signals when said count reaches a predetermined value.

3. The elevator system of claim 1 wherein the hardware timer provides a plurality of spaced interrupt signals when it reaches the end of the predetermined timing period, with the first and second interrupt responsive means being responsive to each interrupt signal, in the event a prior one of such interrupt signals does not successfully reinitialize both the master processor and slave processor.