Computer-implemented method for operating a terminal device with high availability in a network

Description

[0001] The invention relates to a computer-implemented method for operating an end device with high availability in a network, comprising a first edge device which operates the end device using a model, at least a second edge device, and a monitoring device with storage in the cloud.

[0002] The invention further relates to a corresponding computer program, an electronically readable data carrier, a data carrier signal, and a system for operating an end device with high availability in a network.

[0003] Edge computing is a key approach to bringing advanced processing capabilities to the factory. Data processing ranges from simple data point aggregation to advanced artificial intelligence (AI) methods for analyzing complex machine behavior or optimizing a production system.

[0004] There are various concepts for highly available systems in the cloud and fog computing context, as well as for control systems.

[0005] US 2021 / 144517 A1 reveals an edge computing environment.

[0006] Current edge systems typically suffer from the problem that they also terminate if an edge device unexpectedly interrupts the process. No known "failover" mechanisms exist at the edge that respond to such interruptions. Regarding edge computing, and specifically for maintaining the availability of AI models (artificial intelligence), no mechanisms are currently known that automatically react to errors.

[0007] Therefore, the purpose of the invention is to provide a system architecture that reacts to disturbances and errors at an edge and thus allows uninterrupted operation.

[0008] The problem according to the invention is solved by a method of the type mentioned at the outset, in which at least one identifier for a replacement device of the first edge device, which relates to the at least one second edge device, as well as the model for operating the end device and information regarding the connection configuration between the first and the at least one second edge device, the monitoring device and the end device are stored in memory, and the first edge device periodically sends a signal about its correct operation in the network, and the signal is received by the monitoring device, and when a missing or faulty signal is detected, an associated fault device is recognized, and the model and the connection configuration of the fault device are transmitted from memory to a replacement device, wherein the replacement device is determined by the identifier which is assigned to the missing or faulty signal.and the replacement device operates the end device using the received model and connection configuration.

[0009] This increases the availability of the end device by having another device in the network take over operation, with the replacement device being as equivalent as possible to the faulty device and its current operating environment.

[0010] This allows for a particularly resource-saving and efficient operation of the entire system, and a combined consideration of the model and the actually required connection configuration allows for a particularly advantageous selection of the replacement device.

[0011] A malfunction of an edge device is detected by using an operating status signal, also known as a "heartbeat" or "watchdog" signal.

[0012] An undisturbed edge device can be identified by a correctly received signal. Regular reception of this signal is therefore an indicator that the respective edge device is functioning correctly and operating an associated IoT end device, i.e., for example, capturing or receiving operating parameters, making predictions about the operation of the end device, or sending control signals to the end device.

[0013] The invention provides that a replacement Edge device is identified in a simple manner and that this replacement Edge device takes over the operation of the defective device.

[0014] It is advantageous that no additional hardware is required, thus keeping system complexity and costs low.

[0015] Furthermore, it is advantageous that the architecture according to the invention is capable of self-configuration or self-recovery, so that no costly commissioning, for example by IT specialists, is required.

[0016] Furthermore, it is advantageous that no complex and complicated cluster management is required, such as with a Kubernetes cluster, and the solution according to the invention can be run on an existing edge infrastructure, for example as a software extension.

[0017] The model for operating the end device and the information regarding the connection configuration between the first and at least one second edge device, the monitoring device and the end device, can be redefined during the operation of the end device, for example by the devices concerned themselves or by the monitoring device, and updated in memory, for example regularly, at runtime or triggered by an event.

[0018] In a further development of the invention, it is provided that at least one identifier for a failover device for the at least one second edge device is stored in memory, and furthermore, the at least one second edge device periodically sends a signal about the correct operation of the respective device in the network.

[0019] This results in increased availability for multiple edge devices when operating together.

[0020] In a further development of the invention, it is provided that at least two second edge devices are provided, and for the first and the at least two second edge devices, at least two identifiers for a failover device are stored in memory, and the identifiers are sequenced, and the failover device is selected from the identifiers according to the sequencing.

[0021] This ensures that a predetermined sequence of failover devices is provided, enabling multiple edge device failures to be detected and resolved.

[0022] In a further development of the invention, it is provided that the at least two identifiers for backup devices have a sorting that takes into account the computing capacity or storage capacity of the end device assigned according to the connection configuration.

[0023] This ensures that a performance level for a failed device is predefined, so that the replacement device is as equivalent as possible to the faulty device.

[0024] Furthermore, in addition to the power required by the user, a backup power can be specified to ensure joint operation with the user's own end device and a replacement device.

[0025] In the context of the present invention, a sorting order refers to the prioritization of a sequence of failed devices. In other words, when an edge device fails, the sorting order is searched in ascending order until a suitable available edge device can be retrieved from the priority list.

[0026] In a further development of the invention, it is provided that the at least two identifiers for replacement devices have a sorting that takes into account the geographical proximity of the end device assigned according to the connection configuration.

[0027] This ensures that performance, especially latency requirements, is predefined for a failing device, making the earth replacement device as equivalent as possible to the faulty device.

[0028] In a further development of the invention, it is provided that the at least two identifiers for replacement devices have a sorting function which takes into account at least one availability parameter of the end device assigned according to the connection configuration.

[0029] This ensures that performance, especially requirements for the transmission rate, is predefined for a failing device, so that the replacement device is as equivalent as possible to the faulty device.

[0030] In a further development of the invention, it is provided that the at least two identifiers for replacement devices have a sorting which takes into account at least one availability parameter of the end device assigned according to the connection configuration (CC).

[0031] This ensures that performance, especially availability requirements, is predefined for a failing device, making the earth replacement device as equivalent as possible to the faulty device.

[0032] Furthermore, in addition to the required availability, a backup power can be specified to ensure joint operation with the own end device and a replacement device.

[0033] In a further development of the invention, it is provided that at least two independent communication paths are provided in the network between the first edge device, the at least one second edge device, the end device and the monitoring device.

[0034] This further increases the availability of the system.

[0035] The problem according to the invention is also solved by a computer program comprising commands which, when executed by a computer, cause it to execute the method according to the invention.

[0036] The problem according to the invention is also solved by an electronically readable data carrier with readable control information stored on it, which at least includes the computer program according to the invention and is designed in such a way that it carries out the method according to the invention when the data carrier is used in a computing device.

[0037] The problem according to the invention is also solved by a data carrier signal which transmits the computer program according to the invention.

[0038] The problem according to the invention is also solved by a system for operating an end device with high availability in a network, comprising a first edge device which operates an end device, at least a second edge device, and a monitoring device with storage in the cloud, wherein the system is configured to execute the method according to the invention.

[0039] The invention is explained in more detail below with reference to an embodiment illustrated in the accompanying drawings. The drawings show: Fig. 1 a block diagram with an example of an industrial edge system, Fig. 2 an example of interconnected edge devices in a P2P edge communication topology, Fig. 3 a P2P publish-subscribe pattern via MQTT for the example according to Fig. 2, Fig. 4 the example according to Fig. 2 with a failed edge device, Fig. 5-6 Examples of a backup peers procedure with priorities across peers, Fig. 7 a flowchart in a system architecture for recovering AI models after a failure, Fig. 8 a flowchart for recovering AI models after a failure.

[0040] The following figures show only important elements of the system according to the invention. It is clear that further components are necessary for the operation of the system. However, for the sake of clarity, these have been omitted from the illustrations.

[0041] Fig. 1 This provides an overview of the Siemens Industrial Edge system, in which data 11 is transferred from a device to a cloud 1, and vice versa, data 12 is transferred from the cloud to a device.

[0042] An edge device 21 located on factory level 2 can host certain apps. An app can also be an AI model with glue code for integration into the production system.

[0043] Devices 31-33 are located in a field / device level 3.

[0044] Fig. 2 shows a P2P edge communication topology with peers and a number of edge devices AD that can communicate with each other over a standard TCP / IP network.

[0045] The AD edge devices can recognize each other using known network mechanisms.

[0046] Fig. 3 shows an example of a P2P publish-subscribe pattern using an MQTT protocol from edge devices AD.

[0047] The "Message Queuing Telemetry Transport" (MQTT) is an open network protocol for machine-to-machine communication, which enables the transmission of telemetry data in the form of messages between devices, despite high delays or limited networks.

[0048] One participant subscribes to topics of another participant. This relationship is recorded in the communication matrix.

[0049] An example of subscribed participants for publish-subscribe procedures is shown in Table 1.

[0050] In the example shown, it can be seen in the column for device A that device A has subscribed to messages about changes to devices B, C, and D, thus informing each participant about the "health status" of all other devices.

[0051] Fig. 4 This shows an example of automatic error detection. Participant A is in this example opposite Fig. 3failed.

[0052] A "heart beat" mechanism (HB) is used between the edge devices (AD), which defines the set of edge devices (ED), periodically sending a request to all other participating devices with notification of the current "life" status of the sending device.

[0053] If no heartbeat signal HB is received within a predefined time interval, it is inferred that the device is no longer functioning and a backup device must be selected to take over the function of the non-functioning device.

[0054] Table 2 shows the failure of participant A.

[0055] Fig. 5 An example of a backup peers procedure with priorities, where the distribution of priorities across peers is random.

[0056] The graph shown depicts the backup peers, i.e., the replacement Edge devices, where the line thickness of the arrows indicates a prioritization.

[0057] In the figure, priority 1 is represented by solid arrows, priority 2 by dashed arrows, and priority 3 by dotted arrows.

[0058] This information can also be presented in tabular form, see Table 3.

[0059] Each device AE has a priority table.

[0060] In Table 3, first row, it can be seen that device A is the backup with priority 1 for device B, as well as the backup with priority 2 for device D and the backup with priority 3 for device C.

[0061] Fig. 6 An example of a backup peers procedure with priorities, where the distribution of priorities across peers is homogeneous.

[0062] In the figure, priority 1 is represented by solid arrows, priority 2 by dashed arrows, and priority 3 by dotted arrows.

[0063] A tabular presentation of the Fig. 5 is shown in Table 4.

[0064] Priorities are assigned in ascending order, row by row.

[0065] This can be advantageous if, for example, the devices are sorted in the table according to geographical proximity or similar device characteristics, such as computing capacity or storage capacity, and the "nearest" device is to be selected as the backup device due to the homogeneous distribution.

[0066] Fig. 7 shows a flowchart in a system architecture where an AI model AIM is operated by an application on device A.

[0067] Current data is collected from a connected IoT end device, such as a machine, and transmitted to device A via the "southern" communication path SB.

[0068] The data is processed using the AI ​​model AIM and transmitted via the "northern" communication path NB together with information on the connection configurations CC to a cloud or a local data storage DS.

[0069] The Edge device A also sends (periodically recurring) a "heartbeat" signal HB to other peers, i.e. the devices BD in this example, as well as to a monitoring device MD with a model memory MS.

[0070] The model memory MS stores artifacts for the provision of AI models and the relevant configurations of the connections CC (English: "communication configuration") to and between the "southern" communication path SB and the "northern" communication path NB.

[0071] Monitoring device MD has a computing device to perform various backup peers procedure steps, such as monitoring the "heartbeat" signal HB or providing or encrypting data from storage MS.

[0072] Fig. 8 shows a flowchart in the system architecture according to Fig. 7 to restore the AI ​​model AIM after a failure in Edge device A.

[0073] If there is a fault in the Edge device A, device A does not send a "heart-beat" signal HB, neither to the other devices BD, nor to the monitoring device MD.

[0074] This is detected by the monitoring device MD. Device B is then permitted to retrieve the respective model AIM and the associated connection configuration CC from the model memory MS.

[0075] The monitoring device MD now encrypts the artifacts using the public key of device B and the private key of the monitoring device MD.

[0076] The monitoring device MD then sends a link with a reference to the encrypted data set to device B.

[0077] Device B receives the link, loads the corresponding artifact data from the model memory MS of the monitoring device MD, and decrypts it using the private key of device B and the public key of the model memory MS.

[0078] Then, device B loads the connection configuration CC, forms the AI ​​model AIM from the decrypted artifact data, and applies the AI ​​model AIM to the IOT machine in place of the failed device A.

[0079] The transmission of the AIM model and the CC configuration can also be done in other ways.

[0080] In summary, the entire data and AI flow was restored quickly and easily without manual intervention.

[0081] Prediction gaps can even be circumvented by, for example, buffering the data on a controller of the IoT machine and transferring the buffered data as soon as the backup edge device is available again and the AI ​​model AIM is loaded. Reference symbol list:

[0082] 1 Cloud level 11 Data device-to-cloud 12 Data cloud-to-device 2 Factory level 3 Field / device level AD, 21, E Edge device with edge application (to cloud and device) AIMKI model B Replacement device CC Communication configuration DS Data storage HB Heartbeat IoT, 31-33 End device, machine MD Monitoring device MS Model storage NB Northbound communication path SB Southbound communication path

Claims

1. Computer-implemented method for operating a terminal with high availability in a network, comprising a first edge device (A, 21) which operates the terminal (IOT) using a model (AIM), at least one second edge device (B-D) and a monitoring device (MD) having a store (MS) in the cloud (1), wherein the store (MS) is used to store at least one identifier for a failure backup device of the first edge device (A, 21), which identifier relates to the at least one second edge device (B-D), and also the model (AIM) for operating the terminal (IOT, 31-33) and information relating to the communication configuration (CC) between the first and the at least one second edge device (A-D), the monitoring device (MD) and the terminal (IOT, 31-33), and the first edge device (A, 21) periodically sends a signal (HB) about its correct operation in the network, and the signal (HB) is received by the monitoring device (MD), and if a missing or erroneous signal (HB) is detected, an associated defective device is recognised, and the model (AIM) and the communication configuration (CC) of the defective device is transmitted from the store (MS) to a backup device (BD), wherein the backup device (BD) is determined by the identifier associated with the missing or erroneous signal (HB), and the backup device (BD) operates the terminal device (IOT, 31-33) using the received model (AIM) and the communication configuration (CC).

2. Method according to the preceding claim, wherein, in addition, for the at least one second edge device (B-D), at least one identifier for a failure backup device for the at least one second edge device (B-D) is stored in the store (MS), and, in addition, the at least one second edge device (B-D) periodically sends a signal (HB2) about the correct operation of the respective device in the network.

3. Method according to the preceding claim, wherein at least two second edge devices (A-D) are provided, and at least two identifiers for a failure backup device are stored in the store (MS) for the first and the at least two second edge devices (A-D, 21) in each case, and the identifiers are queued, and the failure backup device is selected from the identifiers in accordance with the queuing.

4. Method according to claim 3, wherein the at least two failure backup device identifiers have a sorting which reflects the computing capacity or memory capacity of the terminal (IOT, 31-33) assigned according to the communication configuration (CC).

5. Method according to claim 3, wherein the at least two failure backup device identifiers have a sorting which takes into account the geographical proximity of the terminal (IOT, 31-33) assigned according to the communication configuration (CC).

6. Method according to claim 3, wherein the at least two failure backup device identifiers have a sorting which takes into account at least one availability parameter of the terminal (IOT, 31-33) assigned according to the communication configuration (CC).

7. Method according to claim 3, wherein the at least two failure backup device identifiers have a sorting which takes into account at least one availability parameter of the terminal (IOT, 31-33) assigned according to the communication configuration (CC).

8. Method according to one of the preceding claims, wherein at least two independent communication paths are provided in the network between the first edge device (A, 21), the at least one second edge device (B-D), the terminal (IOT, 31-33), and the monitoring device (MD).

9. Computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method according to one of the preceding claims.

10. Electronically readable data carrier with readable control information stored thereon which comprises at least the computer program according to the preceding claim and is designed such that, when the data carrier is used in a computing device, it carries out the method according to one of claims 1 to 8.

11. Data carrier signal that transmits the computer program according to claim 9.

12. System for operating a terminal with high availability in a network, comprising a first edge device (A, 21) which operates the terminal (IOT, 31-33) using a model (AIM), at least one second edge device (B-D), and a monitoring device (MD) with a store (MS) in the cloud (1), characterised in that the system is designed to carry out the method according to one of the preceding claims.