Control system, control method, and control service providing system

Abstract

To provide a control system, a control method, and a control service providing system that can satisfy an isotimic requirement required by an application even when computer resources cannot be strictly managed.SOLUTION: A control system 110 comprises: a diagnosis unit 32 that acquires metrics of a computer resource used for performing control of a control target 120; and a device management unit 31 that detects a failure in the computer resource on the basis of the metrics, prepares a plurality of alternative candidates for the computer resource in which the failure has occurred, selects, from the alternative candidates, a computer resource to be replaced with the computer resource in which the failure has occurred on the basis of the metrics of the plurality of alternative candidates, and switches from the computer resource in which the failure has occurred to the selected computer resource.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a control system, a control method, and a control service providing system, and more particularly to a control system, a control method, and a control service providing system that can be suitably used when punctuality is required when controlling a control target. [Background technology]

[0002] For example, when a virtual machine (VM) running on a public cloud is used as a control system for controlling a control target, the hardware on which the created virtual machine is deployed is left to the discretion of the cloud vendor.

[0003] Patent document 1 describes that a cloud service control device includes a first communication unit that controls communication with a cloud service that provides a plant control function that controls a plant, a second communication unit that controls communication with a user device that uses service information related to the cloud service, a verification unit that verifies the operating status of the cloud service, a selection unit that selects a cloud service based on the verified operating status, and an information transmission unit that transmits service information between the selected cloud service and the user device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-112829 A Summary of the Invention [Problem to be solved by the invention]

[0005] When a delay occurs when a control system controls a controlled object, it can become difficult to control it appropriately. In such cases, the control system must be consistent. In the past, the consistency of control systems was ensured by strictly managing the computer resources under their control. However, when a virtual machine, for example, is used as a control system, computer resources cannot be managed strictly, and depending on where the virtual machine is deployed, the punctuality requirements required by the application may not be met. An object of the present invention is to provide a control system, a control method, and a control service providing system that can satisfy the timeliness requirements required by applications even when computer resources cannot be managed strictly. [Means for solving the problem]

[0006] In order to solve the above problems, the present invention provides a control system including a metrics acquisition unit that acquires metrics of a computer resource used to control a control target, a preparation unit that detects a failure of the computer resource based on the metrics, prepares multiple replacement candidates for the failed computer resource, and selects a computer resource to replace the failed computer resource from the replacement candidates based on the metrics for the multiple replacement candidates, and a switching unit that switches from the failed computer resource to the selected computer resource. In this case, a control system that can meet the punctuality requirements required by an application can be provided even when computer resources cannot be managed strictly.

[0007] Here, the preparation unit can select a computer resource to replace the failed computer resource when a first stage is detected as a failure, and the switching unit can switch to the selected computer resource when a second stage in which the metrics have decreased from the first stage is detected as a failure. In this case, the replacement computer resource can be prepared in advance in the first stage, and switching can be performed quickly in the second stage. Furthermore, when the preparation unit detects the first stage, it can copy the internal state from the computer resource in which the failure occurred to the selected computer resource, so that both states match. In this case, after system switching is performed in the second stage, the computer resource with the better metrics can be used immediately as a secondary or the like. Furthermore, after the preparation unit has made the states consistent, it can obtain information to be input to the computer resource in which the failure occurred, and maintain the consistency of the states. In this case, it is possible to more quickly utilize the computer resource with better metrics. Furthermore, the fault may be at least one of a time delay and a communication delay. In this case, it is possible to deal with an event that is likely to cause a problem in controlling the controlled object. Furthermore, the preparation unit can cancel preparation of the selected computer resource when the failure in the first stage is resolved after selecting a computer resource to replace the failed computer resource. In this case, when the metrics are restored, the preparation of the selected computer resource can be canceled. Furthermore, the metrics are communication performance between the computer resources, and the preparation unit can select the alternative candidate with the best communication performance as the computer resource to replace the failed computer resource. In this case, it becomes easier to ensure the punctuality required for the control system. The metrics are the amount of clock correction, and the preparation unit can select an alternative candidate whose amount of clock correction is close to that of the secondary of the failed computer resource as the computer resource to replace the failed computer resource. In this case, time discrepancies are less likely to occur between the primary promoted from the secondary and the alternative system that becomes the secondary. Furthermore, the preparation unit can select a computer resource to replace a failed computer resource based on the area in which the computer resource is installed, in addition to the metrics for the replacement candidate. In this case, availability can be improved. Furthermore, computer resources within the same data center can be selected as an area, which allows the degree of distribution of the device layout designed in advance to be maintained, thereby improving availability. Furthermore, the preparation unit can select, as the area, computer resources in a data center in which there is no secondary computer for the failed computer resource. In this case, computer resources can be distributed and allocated, thereby improving availability. The preparation unit may also be configured to preselect an area for preparing replacement candidates for each predetermined period of time. In this case, computer resources to be allocated to an area with good metrics may be preselected. Furthermore, the switching unit can set the computer resource that was the secondary of the failed computer resource as the primary, and set the selected computer resource as the secondary. In this case, the computer resource with the better metrics can be assigned as the secondary.

[0008] The present invention also provides a control method in which a processor executes a program recorded in a memory to acquire metrics of a computer resource used to control a control target, detects a failure of the computer resource based on the metrics, prepares a plurality of alternative candidates for the failed computer resource, selects a computer resource to replace the failed computer resource from the alternative candidates based on the metrics for the plurality of alternative candidates, and switches from the failed computer resource to the selected computer resource. In this case, a control method can be provided that can satisfy the punctuality requirements required by an application even when computer resources cannot be managed strictly.

[0009] Furthermore, the present invention can provide a control service providing system comprising a control object and a control system for controlling the control object, the control system comprising: a metrics acquisition unit for acquiring metrics of a computer resource used to control the control object, a preparation unit for detecting a failure of the computer resource based on the metrics, preparing multiple alternative candidates for the failed computer resource, and selecting a computer resource to replace the failed computer resource from the alternative candidates based on the metrics for the multiple alternative candidates, and a switching unit for switching from the failed computer resource to the selected computer resource. In this case, a control service providing system can be provided that can satisfy the punctuality requirements required by an application even when computer resources cannot be managed strictly. Effect of the Invention

[0010] According to the present invention, it is possible to provide a control system, a control method, and a control service providing system that can satisfy the timeliness requirements required by an application even when computer resources cannot be managed strictly. [Brief description of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of a control service providing system to which the present embodiment is applied. [Diagram 2] FIG. 2 is a diagram showing system configuration information. [Diagram 3] FIG. 11 is a diagram showing operation requirement information. [Figure 4] FIG. 11 is a diagram showing device status information. [Figure 5A] FIG. 13 is a diagram showing alternate system management information. [Figure 5B] FIG. 13 is a diagram showing alternative metrics information. [Figure 6] FIG. 13 is a diagram showing a processing flow of a device management unit. [Figure 7] FIG. 13 is a diagram showing a processing flow for a device management unit to create an alternate system. [Figure 8] FIG. 13 shows a system management screen in a state before the control device goes into a warning state and when the control system is operating normally (normal state). [Figure 9] FIG. 13 shows a system management screen when the control device is in a warning state. [Figure 10] FIG. 13 shows the system management screen when an alternative system is selected. [Figure 11] FIG. 13 is a diagram showing a system management screen when the control device is in an abnormal state. [Figure 12] FIG. 13 shows the system management screen when switching to the alternate system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. <Overall Description of the Control Service Providing System 100> FIG. 1 is a diagram showing an example of the overall configuration of a control service providing system 100 to which the present embodiment is applied. In the control service providing system 100, a control system 110 controls a control target 120. The control system 110 is provided as a service on the cloud, for example. The control system 110 exchanges control information and the like via a network N to control the control target 120.

[0013] The controlled object 120 is, for example, an industrial plant. The industrial plant is not particularly limited, and examples thereof include industrial plants such as steel plants and chemical plants. Examples of the industrial plant include power plants that generate electricity using thermal power, hydroelectric power, atomic power, solar power, wind power, and the like. Examples of the industrial plant include oil production plants that extract crude oil from oil wells, LNG plants that extract natural gas (LNG: Liquified Natural Gas) from gas fields, and oil refinery plants that refine crude oil. For example, when the controlled object 120 is an oil refinery plant, the control system 110 receives detection signals from temperature sensors, pressure sensors, flow meters, and the like provided in equipment such as a crude oil heating furnace, a distillation tower, and a catalyst / hydrogenation desulfurization tower that constitute the oil refinery plant. Then, based on the detection signals, the control system 110 transmits control signals that control the temperature, pressure, flow rate, opening and closing of valves, and the like of these equipment. The control system 110 is not limited to such industrial plants, and may be a railway control system that controls railway equipment. In this case, the controlled object 120 corresponds to, for example, railway signals, switches (points), and railroad crossings. Also, in FIG. 1, only one control target 120 is shown, but a plurality of control targets 120 may be controlled.

[0014] The control system 110 includes data centers 1 and 2 installed in a region 1. Note that the "region" here refers to the geographical location in which each of the data centers 1 and 2 is installed. The data center 1 includes a system management device 1, a control device 1, and a gateway device 1. Furthermore, the data center 2 includes a system management device 2, a control device 2, and a gateway device 2. Furthermore, a system management device 3 is installed in the region 2. The system management devices 1 to 3, the control devices 1 and 2, and the gateway devices 1 and 2 are components that make up the control system 110, and are examples of computer resources. Each of these is a virtual machine (VM). However, these may be physical machines. Furthermore, virtual machines and physical machines may be mixed. Furthermore, containers may be used instead of virtual machines.

[0015] The system management devices 1 to 3 manage the components of the control system 110. Each of the system management devices 1 to 3 can manage the control devices 1 and 2 and the gateway devices 1 and 2. In other words, the system management devices 1 to 3 can manage the control devices 1 and 2 and the gateway devices 1 and 2 across the boundaries of regions and data centers. The control devices 1 and 2 perform control decisions for the control target 120. Furthermore, the gateway devices 1 and 2 communicate with the control target 120. The control devices 1 and 2 exchange detection signals, control signals, and the like via the gateway devices 1 and 2 to control the control target 120.

[0016] System management device 1 comprises a device manager 11, a diagnostic unit 12, system configuration information 13, operational requirement information 14, device status information 15, and backup system management information 16. Similarly, system management device 2 comprises a device manager 21, a diagnostic unit 22, system configuration information 23, operational requirement information 24, device status information 25, and backup system management information 26. Similarly, system management device 2 further comprises a device manager 31, a diagnostic unit 32, system configuration information 33, operational requirement information 34, device status information 35, and backup system management information 36. The control device 1 includes a diagnosis unit 17, and the control device 2 includes a diagnosis unit 27. The gateway device 1 includes a diagnosis unit 18, and the control device 2 includes a diagnosis unit .

[0017] The device management units 11, 21, and 31 manage the operation of the system management devices 1 to 3 to which they belong. As will be described in detail later, the device management units 11, 21, and 31 function as a preparation unit that detects a failure of a component of the control system 110 based on metrics, prepares multiple replacement candidates for the failed component, compares the metrics of the multiple replacement candidates based on predetermined requirements, and selects one of the replacement candidates as a replacement for the failed component. In this case, the failure is a warning state, which is an example of the first stage. The selected replacement candidate may hereinafter be referred to as an alternative system. At this time, the device management units 11, 21, and 31 compare the metrics of each replacement candidate according to, for example, predetermined requirements, and select the best one. Furthermore, when the degree of the failure decreases and an abnormality occurs, the device management units 11, 21, and 31 function as a switching unit that switches from the component where the failure occurred to the selected component. In this case, the failure is an abnormal state, which is an example of the second stage. Furthermore, the degree of the failure worsens when the metrics become even worse than when they were in the warning state.

[0018] The diagnostic units 12, 22, and 32 diagnose the metrics. The metrics are numerical values ​​of the performance of the control system 110. In the present embodiment, the metrics are either closed to a single component or spans multiple components among the components in the control system 110. The former are, for example, CPU (Central Processing Unit) performance and clock accuracy. The clock accuracy can be evaluated based on the clock delay. The diagnostic unit 12 can determine that the clock accuracy is degraded as the clock delay increases. The latter corresponds to the communication performance between the respective components. The communication performance can be evaluated based on, for example, the operation time required for the cooperative operation between the components. The diagnostic unit 12 can determine that the longer this time is, the larger the communication delay is, and the lower the communication performance is. The diagnostic units 17, 27, 18, and 28 also have the same function. These diagnostic units function as metrics acquisition units that acquire metrics of computer resources used to control the control target 120.

[0019] FIG. 2 is a diagram showing the system configuration information 13, 23, and 33. The system configuration information 13 , 23 , and 33 is information about the components that make up the control system 110 . The illustrated system configuration information 13, 23, 33 consists of items of components, system configuration, and communication destination. Components are types of components, and can be any one of a system management device, a control device, and a gateway device. System configuration is information on redundant configuration. A master-slave system indicates that it consists of a master system (active device) and a slave system (backup device), and a three-system system indicates that it consists of a master system (active device) and two slave systems (backup devices). Communication destination is information that indicates the party with which each component communicates.

[0020] FIG. 3 is a diagram showing the operation requirement information 14, 24, and 34. The operation requirement information 14, 24, and 34 is information about the metrics requirements required for each component. The illustrated operational requirement information 14, 24, 34 includes items of components, metrics, abnormality determination means, abnormality determination threshold, and warning determination threshold. The components are types of components, and are one of a system management device, a control device, and a gateway device. The metrics, abnormality determination means, abnormality determination threshold, and warning determination threshold are determined for each component. Among these, the metrics are items of metrics required for each component. The abnormality determination means is a method for determining whether each component is in an abnormal state or not, and a method for determining whether each component is in a warning state or not. For example, if this is "exceeding the threshold", it means that when a predetermined threshold is exceeded, it is determined that the component is in an abnormal state or a warning state. That is, the diagnostic units 12, 22, 32 determine that the component is in an abnormal state when the abnormality determination threshold is exceeded. The diagnostic units 12, 22, 32 determine that the component is in a warning state when the warning determination threshold is exceeded. When determining that the component is in an abnormal state or a warning state, it may be determined that the component is in these states when the threshold is exceeded once, but it may also be determined that the component is in these states when the threshold is exceeded a certain number of times in succession.

[0021] To explain the metrics items in more detail, intra-datacenter inter-device communication is the operation time required for cooperative operations between components in the same data center. For example, this corresponds to the operation time between the system management device 1 and the control device 1, and the operation time required between the system management device 1 and the gateway device 1. Inter-datacenter inter-device communication is the operation time required for cooperative operations between components in different data centers. For example, this corresponds to the operation time between the system management device 1 and the system management device 2. Inter-region inter-device communication is the operation time required between components in different regions. For example, this corresponds to the operation time between the system management device 1 in region 1 and the system management device 3 in region 2. The number of hops from the synchronization source clock is the number of hops from the device that is the synchronization source of the clock. The clock correction amount is the clock correction amount.

[0022] FIG. 4 is a diagram showing the device status information 15, 25, and 35. The device status information 15, 25, and 35 is information about the operating status of each component. The illustrated device status information 15, 25, 35 consists of the items of device name, region, data center, role, and device status. The device name is the device name of the component, and is the above-mentioned system management devices 1 to 3, gateway devices 1 and 2, and gateway devices 1 and 2. The region is the geographical location where the data center is installed. The data center is the name of the data center where each component is installed, and is any one of data centers 1 to 3. The role indicates whether the operating status of each component is primary or secondary. The device status indicates whether the operating status of the device is normal or abnormal. FIG. 4 shows that all the components are normal.

[0023] FIG. 5A is a diagram showing the alternate system management information 16, 26, and 36. The backup system management information 16, 26, and 36 is information about components that are candidates for backup. The illustrated alternative system management information 16, 26, 36 includes the items of device name, region, data center, role, and alternative device. The device name is the device name of the component that is an alternative candidate. Here, it means that the alternative candidate components are control device alternatives 1 to 3. The region is the geographical location where the data center is installed. The data center is the name of the data center in which each of the alternative candidate components is installed, and is one of data centers 1 to 3. The role is the role of these components, and indicates that they are alternative candidates. The alternative device is blank in the initial state in which no failure occurs in each component, as in the case shown in FIG. 4, but when a failure occurs in any of the components, the device name of the component in which the failure occurred is entered. In this case, it shows the case in which a failure occurs in the control device 1.

[0024] FIG. 5B is a diagram showing alternative system metrics information. The alternative metrics information is the metrics information of a component that is a candidate for an alternative. The illustrated alternative system metrics information consists of the following items: device name, metrics, abnormality determination means, latest value, and metrics update date and time. The device name is the device name of the component that is an alternative candidate, and is control device alternatives 1 to 3 in FIG. 5A. The metrics are the metrics items found for each component that is an alternative candidate. The abnormality determination means is a method for determining whether or not a component that is an alternative candidate is abnormal. The latest value is the latest metric for the component that is an alternative candidate. The metrics update date and time is the date and time when the latest metric value was obtained.

[0025] <Explanation of the operation of the device management unit 11> FIG. 6 is a diagram showing a processing flow of the device management unit 11. In FIG. 6, the device manager 11 is the primary device manager, and performs a series of processes. First, the diagnosing unit 12 diagnoses the metrics of each device (each component) in the system management device 1, and the device management unit 11 acquires the metrics of each device from the diagnosing unit 12 (S101). Next, the device manager 11 judges whether or not there is an abnormality in each device based on the metrics of each device (S102). This is executed for each device according to the following flow (S103).

[0026] First, the device manager 11 judges whether or not an abnormality or warning has occurred in one device (S104). If an abnormality or warning has occurred (Y (Yes) in S104), the device manager 11 refers to the device status information 15 and determines whether or not the device in question with the abnormality or warning has an alternative system (S105). As a result, if there is no alternate system (N (No) in S105), the device manager 11 creates an alternate system (S106). If there is an alternative system in S104 (Y in S105) and after S106, the device manager 11 judges whether or not there is an abnormality (S107). As a result, if there is no abnormality (N in S107), the device manager 11 ends the processing in the device. On the other hand, if there is an abnormality (Y in S107), the device manager 11 stops and deletes the abnormal system (S108). Furthermore, the device manager 11 promotes the existing secondary device to a primary device (S109). That is, the device that was a secondary device for the device in which the abnormality occurred becomes a primary device. Then, the device manager 11 restores the alternate system as the secondary system (S110).

[0027] Furthermore, if no abnormality or warning has occurred in S103 (N in S104), the device manager 11 judges whether or not the device status information includes an alternative system for the device (S111). If there is an alternative system for the device (Y in S111), the alternative system is deleted (S112). This case corresponds to, for example, a case in which the metrics of the device deteriorated and a warning was issued, but then the metrics recovered and the warning was lifted. On the other hand, if there is no alternative system for the device (N in S111), the process for the device ends.

[0028] In this case, as explained in S106, it can be said that the device manager 11 selects a computer resource to replace the failed computer resource when the first stage of the failure is detected. The first stage is a warning state. Also, as explained in S107 to S110, the device manager 11 can be said to switch to the selected device when it detects a second stage in which the metrics are lower than the first stage, indicating a fault. The second stage is a stage in which an abnormality occurs. Furthermore, as explained in S112, it can be said that the device manager 11, after selecting a device to replace the failed device, releases the preparation of the selected device when the warning state is resolved. Furthermore, as explained in S109 to S110, it can be said that the device manager 11 sets the device that was the secondary of the failed device as the primary, and sets the selected alternative system as the secondary.

[0029] 7 is a diagram showing a processing flow for creating an alternate system by the device manager 11. That is, FIG. 7 is a diagram for explaining S105 in FIG. 6 in detail. First, the device manager 11 creates a plurality of devices equivalent to the target system (the component in which an abnormality or warning has occurred) (S201). That is, the device manager 11 prepares a plurality of replacement candidates. Next, the device manager 11 acquires the metrics of each system created in S201 (S202). That is, the device manager 11 acquires the metrics of each of the multiple replacement candidates. Specifically, the device manager 11 acquires the clock delay as the clock accuracy, and the operation time required for the cooperative operation between the devices as the communication performance. Next, the device management unit 11 selects the device with the best metrics as the alternative system and deletes the remaining devices (S203). That is, the device management unit 11 selects the device with the best metrics from among the alternative candidates as the alternative system to replace the computer resource in which the failure occurred. Furthermore, the device management unit 11 makes the state of the relevant component consistent with that of the primary system (S204). In this case, memory information held by the primary system is copied to make the internal states consistent. By making the internal states consistent at the warning stage, it is possible to immediately restore a device with good characteristics as the secondary system after system switching when an abnormality occurs. In addition, after making the internal states consistent, data input to the primary (or secondary) is obtained, and the internal states of the alternative system and the primary (or secondary) are maintained consistent. In the case of a control system, broadcast / multicast communication is often used. In this case, information can be cross-examined simply by connecting to network N. If communication is performed by unicast, the states are made consistent by having information sent from the primary (or secondary).

[0030] Furthermore, the device management unit 11 may preselect an area for preparing a replacement candidate for each predetermined period. The operation time required for the cooperative operation varies depending on, for example, the area, the time for communication, etc. Therefore, the device management unit 11 obtains metrics from the diagnosis unit 12 for each predetermined period, and preselects an area for preparing a replacement candidate. This allows a replacement candidate with good metrics to be preselected.

[0031] <How to select an alternative system> A method for selecting an alternative system from alternative candidates will be described below with reference to (1) to (4) with reference to Figures 5A and 5B. Note that the method will be described here in terms of a case where an alternative system is selected to replace the control device 1 in the data center 1 when the control device 1 is in a warning state.

[0032] (1) Simply choose the metric that is best. (1) is the method performed in S203 of Fig. 7. In the example of Fig. 5B, when comparing alternative control device 1 and alternative control device 2, the number of hops from the synchronization source clock, the amount of clock correction, and communication between devices between regions are equivalent. On the other hand, between devices within a data center and between devices between data centers, alternative control device 1 is better than alternative control device 2. Therefore, alternative control device 1 is selected. According to this selection method, a device with higher real-time performance can be adopted. It should be noted that the alternative control device 3 is not subject to comparison of metrics because the number of hops from the synchronization source clock is too large and does not satisfy the requirements of the abnormality determination means in FIG. 5B. In the method (1), the metrics are the communication performance between devices, and the device management unit 11 can be said to select the alternative candidate with the best communication performance as an alternative system to replace the failed device.

[0033] (2) Prioritize data centers that meet the metric requirements and are the same as the alternative device as much as possible. In the example of Fig. 5A, when comparing alternative control device 1 and alternative control device 2, alternative control device 1 is in the same data center 1 as control device 1, but alternative control device 2 is in a different data center 2 from control device 1. Therefore, alternative control device 1 is selected. According to this selection method, it is possible to maintain the degree of dispersion of the device layout designed in advance, and to increase availability.

[0034] (3) Prioritize data centers that meet the metric requirements and do not have a secondary for the failed device. For example, if the secondary of control device 1 is control device 2, then the devices belonging to data centers 1 and 3 other than data center 2 to which control device 2 belongs are selected. In this case, control device alternative 1 belonging to data center 1 and control device alternative 3 belonging to data center 3 are selected. In this case, the devices can be distributed and availability can be increased.

[0035] In the methods (2) and (3), it can be said that the device management unit 11 selects an alternative system to replace the failed device based on the area in which the computer resource is installed, in addition to the metrics for the alternative candidate. Also, in the method (2), it can be said that the device management unit 11 selects a device in the same data center as the area as the alternative system. Furthermore, in the method (3), it can be said that the device management unit 11 selects a device in a data center in which there is no secondary for the failed computer resource as the area as the alternative system.

[0036] (4) Select a device that meets the metrics requirements and has a clock correction amount close to that of the secondary device of the failed device. For example, if the secondary of the control device 1 is the control device 2, then the control device with the closest correction amount to the control device 2's clock is selected from the alternative control devices 1 to 3. In this case, time skew is less likely to occur between the primary system promoted from secondary and the alternate system that will become secondary. This makes it less likely that inconsistencies in status will occur due to a difference in the timing of execution of a cyclically executed program and the timing of receiving input data. In the method (4), the metric is the amount of clock correction, and the device management unit 11 can be said to select an alternative candidate whose clock correction amount is close to that of the secondary device of the failed device as an alternative system to replace the failed device.

[0037] <System Administration Screen Explanation> 8 to 12 are diagrams showing system management screens. Note that, here, an example will be described in which the metrics of the control device 1 drop to a warning state, and the metrics further drop to an abnormal state, causing the control device alternative 1 to be selected as the alternative system.

[0038] FIG. 8 is a diagram showing the system management screen in a state before the control device 1 goes into a warning state and in which the control system 110 is operating normally (normal state). In the illustrated system management screen, the system operation status is displayed in the upper part. This shows that the system management device 1, control device 1, and gateway device 1 installed in data center 1 in region 1 are primary. Also, it shows that the system management device 2, system management device 3, control device 2, and gateway device 2 installed in data center 2 in region 1 are secondary. In addition, the illustrated system management screen displays a device list in the middle section. The device list is the same as that in Fig. 4, and displays the device name, region, data center, role, and device status for each component of the system management devices 1 to 3, control devices 1 and 2, and gateway devices 1 and 2. Fig. 8 shows that all the components are normal. Furthermore, in the illustrated system management screen, information on backup system management is displayed in the lower part. In Fig. 8, since all components are normal, a backup system has not been created and the message "There is no device requiring a backup system" is displayed.

[0039] FIG. 9 shows the system management screen when the control device 1 is in a warning state. In the illustrated system management screen, the system operation status in the upper part indicates that alternative candidates have been prepared. In this case, it is shown that alternative control devices 1 to 3 have been prepared as alternative candidates in data centers 1 to 3, respectively. Furthermore, on the illustrated system management screen, the device list in the middle section indicates that the device status of the control device 1 has become a warning. Furthermore, in the illustrated system management screen, the alternate system management in the lower part displays the device name, region, data center, role, and metrics of the control device alternates 1 to 3. Note that a selection button may be provided in this alternate system management screen so that the system administrator can select an alternate system.

[0040] FIG. 10 shows the system management screen when the alternate system is selected. In the illustrated system management screen, the system operation status in the upper part indicates that control device alternative 1 has been selected as the alternative system. In this case, the one with the best metrics among control device alternatives 1 to 3 is selected as the alternative system. Furthermore, in the illustrated system management screen, the device list in the middle section indicates that the device status of the control device 1 remains in a warning state. Furthermore, on the illustrated system management screen, in the alternate system management section at the bottom, the device name, region, data center, role, and metrics of the selected alternate control device 1 are displayed.

[0041] FIG. 11 shows the system management screen when the control device 1 is in an abnormal state. In the illustrated system management screen, the device list in the middle section indicates that the device status of the control device 1 has transitioned from warning to abnormal. The other screens are the same as those in FIG.

[0042] FIG. 12 shows the system management screen when switching to the alternate system. In the illustrated system management screen, the system operating status at the top indicates that the control device 2 has been promoted to primary. Also, it indicates that the alternative control device 1 has become secondary as the control device 3. Also, in the illustrated system management screen, the device list in the middle section shows that control device 3 has been added in place of control device 1. The device status of control device 3 is normal. Furthermore, in the illustrated system management screen, in the alternate system management at the bottom, since all components are normal, the message "There are no devices requiring an alternate system" is displayed.

[0043] According to the control system 110 described above, even if the management of components, which are an example of computer resources, cannot be strictly performed, it is possible to satisfy the punctuality requirements required by applications.

[0044] In the above embodiment, the types of components, which are examples of computer resources, are a system management device, a control device, and a gateway device, but are not limited thereto, and the types and numbers of components can be freely set as long as they can control the control target 120 and have redundancy. Also, in the above embodiment, the control system 110 is exemplified by a virtual machine running on a public cloud, but is not limited thereto, and does not have to run on a cloud.

[0045] <Control method explanation> The above-described processing performed by the control system 110 is realized by the cooperation of software and hardware resources. That is, a processor in a computer constituting the control system 110 loads software for realizing each of the above-described functions into a main storage device, executes the software, and realizes each of these functions. Therefore, the processing performed by control system 110 can be considered as a control method in which a processor executes a program recorded in memory to obtain metrics of the components used to control the control target 120, detect a failure of the component based on the metrics, prepare multiple replacement candidates for the failed component, select a component to replace the failed component from among the replacement candidates based on the metrics for the multiple replacement candidates, and switch from the failed component to the selected component. In this case, this processing does not have to be performed by one computer device, but may be realized by a plurality of computer devices.

[0046] Although the present embodiment has been described above, the technical scope of the present invention is not limited to the scope described in the above embodiment. It is clear from the claims that various modifications and improvements to the above embodiment are also included in the technical scope of the present invention. [Explanation of symbols]

[0047] 11, 21, 31 ... device management unit, 12, 22, 32 ... diagnosis unit, 100 ... control service providing system, 110 ... control system, 120 ... controlled object

Claims

1. a metrics acquisition unit that acquires metrics of computer resources used to control the control target; a preparation unit that detects a failure of a computer resource based on the metrics, prepares a plurality of alternative candidates for the failed computer resource, and selects a computer resource to replace the failed computer resource from the alternative candidates based on metrics for the plurality of alternative candidates; a switching unit for switching from a failed computer resource to a selected computer resource; Equipped with the metrics are communication performance between computer resources, The preparation unit selects the alternative candidate with the best communication performance as a computer resource to replace the computer resource in which a failure has occurred.

2. the preparation unit, when detecting a first stage as the failure, selects a computer resource to replace the failed computer resource; 2. The control system according to claim 1, wherein the switching unit switches to the selected computer resource when detecting a second stage in which the metrics have decreased from the first stage as the failure.

3. 3. The control system according to claim 2, wherein the preparation unit copies the internal state of the computer resource selected from the computer resource in which the failure occurred when the first stage is detected, thereby matching the states of both the computer resources.

4. 4. The control system according to claim 3, wherein the preparation unit, after making the states consistent, acquires information input to the computer resource in which the failure has occurred, and maintains the consistency of the states.

5. The control system according to claim 2 , wherein the fault is at least one of a clock delay and a communication delay.

6. 3. The control system according to claim 2, wherein the preparation unit selects a computer resource to replace the computer resource in which a failure has occurred, and then cancels preparation of the selected computer resource when the failure in the first stage is resolved.

7. 2. The control system according to claim 1, wherein the preparation unit selects a computer resource to replace a failed computer resource based on an area in which the computer resource is installed in addition to metrics for the replacement candidate.

8. The control system according to claim 7 , wherein the preparation unit selects computer resources in the same data center as the area.

9. 2. The control system according to claim 1, wherein the switching unit sets the computer resource that was secondary to the failed computer resource as the primary computer resource, and sets the selected computer resource as the secondary computer resource.

10. A metrics acquisition unit that acquires metrics of computer resources used to control a control target; a preparation unit that detects a failure of a computer resource based on the metrics, prepares a plurality of alternative candidates for the failed computer resource, and selects a computer resource to replace the failed computer resource from the alternative candidates based on metrics for the plurality of alternative candidates; a switching unit for switching from a failed computer resource to a selected computer resource; Equipped with the metric is a correction amount of a clock; The preparation unit selects the alternative candidate whose clock correction amount is closest to that of the secondary of the failed computer resource as the computer resource to replace the failed computer resource.

11. A metrics acquisition unit that acquires metrics of computer resources used to control a control target; a preparation unit that detects a failure of a computer resource based on the metrics, prepares a plurality of alternative candidates for the failed computer resource, and selects a computer resource to replace the failed computer resource from the alternative candidates based on metrics for the plurality of alternative candidates; a switching unit for switching from a failed computer resource to a selected computer resource; Equipped with The preparation unit selecting a computer resource to replace the failed computer resource based on the area in which the computer resource is installed in addition to the metrics for the replacement candidate; A control system that selects, as the area, a computer resource in a data center where there is no secondary computer resource for the failed computer resource.

12. A metrics acquisition unit that acquires metrics of computer resources used to control a control target; a preparation unit that detects a failure of a computer resource based on the metrics, prepares a plurality of alternative candidates for the failed computer resource, and selects a computer resource to replace the failed computer resource from the alternative candidates based on metrics for the plurality of alternative candidates; a switching unit for switching from a failed computer resource to a selected computer resource; Equipped with The preparation unit is a control system that preselects an area in which the replacement candidate is to be prepared for each predetermined period.

13. The processor executes the program stored in the memory. Acquire metrics of the computer resources used to control the control target, Detecting a failure of a computer resource based on the metrics, preparing a plurality of alternative candidates for the computer resource in which the failure has occurred, and selecting a computer resource to replace the computer resource in which the failure has occurred from among the alternative candidates based on metrics for the plurality of alternative candidates; Switching from the failed computer resource to the selected computer resource; the metrics are communication performance between computer resources, A control method for selecting the alternative candidate with the best communication performance as a computer resource to replace a computer resource in which a failure has occurred.

14. a control object and a control system that controls the control object; Equipped with The control system includes: a metrics acquisition unit that acquires metrics of computer resources used to control the control target; a preparation unit that detects a failure of a computer resource based on the metrics, prepares a plurality of alternative candidates for the failed computer resource, and selects a computer resource to replace the failed computer resource from the alternative candidates based on metrics for the plurality of alternative candidates; a switching unit for switching from a failed computer resource to a selected computer resource; Equipped with the metrics are communication performance between computer resources, A control service providing system in which the preparation unit selects the alternative candidate with the best communication performance as a computer resource to replace the computer resource in which a failure has occurred.

Images