Virtual machine rewriting system and virtual machine rewriting method

Abstract

To securely change a virtualized edge-side control logic under operation from a remote place.SOLUTION: A virtual machine rewriting system holds information on a request including a command to rewrite an edge-side virtual machine and a required time representing an upper limit of a rewriting process time based on the rewriting command, calculates a process time of rewriting a virtual machine to be rewritten based on the request, determines whether the process of rewriting the virtual machine to be rewritten will be completed within a requested time on the basis of the calculated process time, determines whether a function of the virtual machine to be rewritten can be replaced with a function of another virtual machine during the process of rewriting the virtual machine to be rewritten, and outputs a report for suspending the process based on the request if it is determined that the process of rewriting the virtual machine to be rewritten will not be completed within the requested time or it is determined that a function of the virtual machine to be rewritten cannot be replaced with a function of another virtual machine during the process of rewriting the virtual machine to be rewritten.SELECTED DRAWING: Figure 1A

Description

[Technical field]

[0001] The present invention relates to remote rewriting (hereinafter sometimes referred to as "deployment") of a virtual machine. [Background technology]

[0002] Regarding the deployment of virtual machines, for example, the techniques disclosed in JP 2018-32058 A (Patent Document 1) and JP 2019-86949 A (Patent Document 2) are known. According to the technique disclosed in Patent Document 1, it is possible to measure the memory access frequency of a virtual machine, measure the cache capacity that can be secured in the deployment destination machine, and deploy a virtual machine to a machine that satisfies the required performance. According to the technique disclosed in Patent Document 2, it is possible to predict the deployment start time and end time in the case where the application is scaled out when the performance is insufficient, that is, the calculation performance is improved by automatically adding virtual machines.

[0003] In addition, with respect to power system equipment, for example, the technology disclosed in International Publication No. 2022 / 118363 (Patent Document 3) is known. According to the technology disclosed in Patent Document 3, information on the power system can be collected, the voltage of the busbar in the system and the state of each transformer can be monitored, and transformer tap switching can be performed. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-32058 A [Patent Document 2] JP 2019-86949 A [Patent Document 3] International Publication No. 2022 / 118363 Summary of the Invention [Problem to be solved by the invention]

[0005] In recent years, the instability of power systems has increased with the spread of renewable energy, whose power generation amount is easily affected by weather and other factors. Existing hardware-based protective relay systems cannot flexibly respond to such unstable factors. Therefore, the system of the present invention aims to realize stable operation of the system by flexibly responding to changes in the system by replacing the protective relay system with virtualization technology.

[0006] As described above, for example, the techniques disclosed in Patent Document 1 and Patent Document 2 are known for deploying virtual machines. For example, the technique disclosed in Patent Document 3 is known for power system equipment. However, the technique disclosed in Patent Document 1 does not remotely rewrite the contents of a running virtual machine, i.e., a program running on the virtual machine or data stored on the virtual machine, from another machine. The technique disclosed in Patent Document 2 does not use the calculated deployment start and end times to stop the deployment or change the network route for deployment.

[0007] Furthermore, the technology disclosed in Patent Document 3 collects, monitors, and operates information related to the power system, but does not verify the validity of the operation, stop the operation, or operate it in a different way.

[0008] None of the techniques disclosed in Patent Documents 1, 2, and 3 provide any means for preventing the possibility of unintended results caused by the fact that, when processing a request to rewrite or deploy a running virtual machine, the rewrite time is significantly longer than expected by the user, or the function provided by the virtual machine to be rewritten stops during the rewrite, causing an unintended result by the user. For example, in a mission-critical system such as a facility related to a power system (hereinafter sometimes referred to as a power system facility), an unintended operation by the user may cause a serious accident. [Means for solving the problem]

[0009] In order to solve at least one of the above problems, the present invention provides a virtual machine rewriting system comprising a processor and a storage device, wherein the storage device holds request information including a rewrite instruction for an edge-side virtual machine and a requested time indicating an upper limit of the processing time for rewriting based on the rewrite instruction, wherein the processor calculates the processing time for rewriting the virtual machine to be rewritten based on the request, and based on the calculated processing time, determines whether the rewrite processing of the virtual machine to be rewritten is completed within the requested time, and determines whether the function of the virtual machine to be rewritten is replaced by a function of another virtual machine during the rewrite processing of the virtual machine to be rewritten, and if it is determined that the rewrite processing of the virtual machine to be rewritten is not completed within the requested time or if it is determined that the function of the virtual machine to be rewritten is not replaced by a function of another virtual machine during the rewrite processing of the virtual machine to be rewritten, the processor outputs a notification to suspend processing based on the request. Effect of the Invention

[0010] According to one aspect of the present invention, functions running on an edge virtual machine can be changed remotely and securely.

[0011] Other objects, configurations and advantages than those mentioned above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0012] [Figure 1A] 1 shows an example of a system configuration and functional blocks according to a first embodiment of the present invention. [Figure 1B] FIG. 1 is a block diagram showing an example of a hardware configuration for implementing a system according to a first embodiment of the present invention. [Diagram 2] 4 is a flowchart showing an example of an outline of processing of the system according to the first embodiment of the present invention. [Diagram 3] 3 illustrates an example of a functional block of an adaptive protection application in the first embodiment of the present invention. [Figure 4]11 is a flowchart illustrating an example of a process of an adaptive protection application in the first embodiment of the present invention. [Diagram 5] 11 is a flowchart illustrating an example of a process of a load data collecting unit in the first embodiment of the present invention. [Figure 6] 11 is a flowchart illustrating an example of a process of a protection logic state collecting unit in the first embodiment of the present invention. [Figure 7] 11 is a flowchart showing an example of processing by a request processing time check unit in the first exemplary embodiment of the present invention. [Figure 8] 11 is a flowchart illustrating an example of a process of a continuous protection check unit in the first exemplary embodiment of the present invention. [Figure 9] 11 is a flowchart showing an example of a process of a warning issuing unit in the first embodiment of the present invention. [Figure 10] FIG. 11 is an explanatory diagram showing an example of a naming rule for a substation, a virtual IED, and protection logic used when generating a request destination included in a request in the first embodiment of the present invention. [Figure 11] 1 illustrates an example of the configuration of a request retention table retained by the service collaboration infrastructure according to the first embodiment of the present invention. [Figure 12] 1 illustrates an example of the configuration of a load data table group held by the service collaboration platform according to the first embodiment of the present invention. [Figure 13] 1 illustrates an example of the configuration of a protection logic state table group held by the service collaboration platform according to the first embodiment of the present invention. [Figure 14] 1 illustrates an example of the configuration of a protection configuration DB held by the service collaboration infrastructure according to the first embodiment of the present invention. [Figure 15] 1 illustrates an example of a configuration of pre-rewrite protection state data held by the service collaboration platform according to the first embodiment of the present invention. [Figure 16] 1 shows an example of verification of accident propagation by a continuous protection check unit in the first embodiment of the present invention. [Figure 17] 13 shows an example of a system configuration and functional blocks according to a second embodiment of the present invention. [Figure 18]13 is a flowchart illustrating an example of processing by a request processing time check unit in the second exemplary embodiment of the present invention. [Figure 19A] 13 is a flowchart illustrating an example of a process of a continuous protection check unit in the second exemplary embodiment of the present invention. [Figure 19B] 13 is a flowchart illustrating an example of a process of a continuous protection check unit in the second exemplary embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] In the following description, functions may be described using the expression "yyy unit", but the functions may be realized by one or more computer programs being executed by a processor, or by one or more hardware circuits (e.g., FPGA or ASIC), or by a combination thereof. The description of each function is an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0014] In addition, in the following explanation, the embodiment will be described with a focus on power systems, but the application of the present invention is not limited to power systems, and it may be a system for other purposes as long as it is designed for the purpose of remotely changing the functions of edge side devices.

[0015] In addition, in the following description, the protection function, or protection function, is generally described as a function that prevents damage to surrounding equipment by operating hardware such as circuit breakers using a protective relay panel installed in a power system, but it may also be a function provided by other hardware or software for the purpose of protecting the power system.

[0016] In addition, in the following explanation, functions or parts of functions may be explained using the expressions virtualization or "virtual yyy," but virtualization may refer to a virtual machine realized by IT technology, a container, or other technology.

[0017] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. EXAMPLES

[0018] <Fig.1A> FIG. 1A illustrates an example of a system configuration and functional blocks according to a first embodiment of the present invention.

[0019] Currently, existing protection relay systems are increasingly adopting IEDs (Intelligent Electronic Devices), which are multi-function general-purpose devices that integrate protection, control, and recording functions. Therefore, in the system of this embodiment, the protection relay system implemented by virtualization technology is called a virtual IED. However, the virtual IED may have the same I / F and functions as the IED, or it may have an I / F and functions different from those of the IED.

[0020] The system 100 includes an adaptive protection application 200, a service collaboration platform 300, a substation (edge) 400, and a network 500.

[0021] The adaptive protection application 200 acquires sensor data and system cross-section data from the service collaboration platform 300, and data indirectly related to the power system, such as weather information, from an external data source 600, and outputs a command to rewrite the protection function in accordance with changes in the system. Details will be described in Figures 3 and 4.

[0022] The service collaboration platform 300 is a platform having an application side input / output I / F 301 and an edge side input / output I / F 302, and plays a role of connecting a plurality of applications including the adaptive protection application 200 with a plurality of edge side devices including a substation 400. The service collaboration platform 300 continuously acquires sensor data and main unit status data from the substation 400, and stores them in a sensor data DB 303 and a status data DB 304, respectively. The service collaboration platform 300 also has a system configuration DB 305 that stores data on the equipment configuration of the power system that has been collected, organized, and created in advance by other systems or manually, and a protection configuration DB 306 that stores data on the protection relay system configuration of the power system.

[0023] The service collaboration platform 300 has a system cross section creation unit 315. The system cross section creation unit 315 is a function that creates a system cross section using data in the state data DB 304 and the system configuration DB 305. Here, the system cross section is data that includes the current system configuration, its state, and boundary conditions, and is mainly used as input data for power flow calculations and the like.

[0024] The service collaboration infrastructure 300 further includes a load data collection unit 307 that collects load data of each IT device and stores it in a load data table group 308, and a protection logic status collection unit 309 that collects current status data of the protection logic and stores it in a protection logic status table group 310. The service collaboration infrastructure 300 also includes a request processing time check unit 311 that uses the data in the load data table group 308 to determine whether a request can be processed within a required time, and a continuity protection check unit 312 that uses the data in the protection logic status table group 310 to determine whether the spread of an accident during rewriting can be prevented. The service collaboration infrastructure 300 also includes a request holding table 313 that holds requests received to execute this series of processes, and a warning transmission unit 314 that sends a warning to a user.

[0025] The substation 400 includes a virtual IED management server 401, which is a physical server on which one or more virtual IEDs 402 run, the virtual IEDs 402, a protection logic 404, which is a program running within the virtual IEDs 402, a main unit 403, which is the target to which the protection logic 404 sends and operates an operation signal depending on the results of sensor data acquired by the protection logic 404, and a data collection device 405 that collects sensor data from the virtual IED management server 401 and the main unit 403 and transmits it to the service collaboration platform 300 via a network 500.

[0026] Here, in the virtual IED management server 401, a program for managing the virtual IEDs 402 and a virtualized environment in which one or more virtual IEDs 402 operate may be on the same physical server, or may be separated into different physical servers. Also, each virtual IED may have one or more protection logics. Also, the main unit 403 may be, for example, a CBC (Circuit-Breaker Controller), and the signal transmitted by the protection logic 404 may be, for example, a trip signal instructing the CBC to open a circuit breaker (CB), that is, to stop the flow of electricity. Also, the data collection device 405 may be, for example, a SCADA (Supervisory Control And Data Acquisition).

[0027] Note that substation 400, which corresponds to the edge shown in FIG. 1A, is an example of a facility constituting a power system, and may be a facility other than a substation, such as a power plant. When the edge is substation 400, the substation includes electrical equipment such as a transformer (not shown) connected to the power system. When the edge is a power plant, the power plant includes electrical equipment such as a generator connected to the power system. The above-mentioned CB is also an example of a protective device for protecting the power system.

[0028] <Fig. 1B> FIG. 1B is a block diagram showing an example of a hardware configuration for implementing the system according to the first embodiment of the present invention.

[0029] The service collaboration infrastructure 300 of this embodiment shown in Fig. 1A can be realized by a computer system. Fig. 1B shows a computer system 3000 as an example.

[0030] The computer system 3000 includes a processor 3001, a memory (main storage device) 3002, an auxiliary storage device 3003, an output device 3004, an input device 3005, and a communication interface (I / F) 3006. The above components are connected to each other via a bus. The memory 3002 and the auxiliary storage device 3003 are storage devices that store programs and data used by the processor 3001.

[0031] The memory 3002 is configured, for example, by a semiconductor memory, and is mainly used for holding programs and data being executed. The processor 3001 executes various processes according to the programs stored in the memory 3002. The processor 3001 operates according to the programs to realize various functional units (for example, the load data collector 307, the protection logic state collector 309, the request processing time check unit 311, the continuous protection check unit 312, the warning transmitter 314, and the system cross section creator 315 shown in FIG. 1A).

[0032] The auxiliary storage device 3003 is configured with a large-capacity storage device such as a hard disk drive or a solid state drive, and is used to hold programs and data for a long period of time. For example, a sensor data DB 303, a status data DB 304, a system configuration DB 305, a protection configuration DB 306, a request holding table 313, a load data table group 308, and a protection logic status table group 310 may be held in the auxiliary storage device 3003.

[0033] The processor 3001 may be comprised of a single processing unit or multiple processing units and may include single or multiple arithmetic units or multiple processing cores. The processor 3001 may be implemented as one or more central processing units, microprocessors, microcomputers, microcontrollers, digital signal processors, state machines, logic circuits, graphic processing units, systems on a chip, and / or any device that manipulates signals based on control instructions.

[0034] Programs and data stored in the auxiliary storage device 3003 are loaded into the memory 3002 at the time of start-up or when necessary, and the programs are executed by the processor 3001, whereby various processes of the computer system 3000 are performed.

[0035] The input device 3005 is a hardware device for a user to input instructions and information, etc. The output device 3004 is a hardware device that presents various images for input and output, such as a display device or a printing device. The communication I / F 3006 is an interface for connection to the network 500.

[0036] The computer system 3000 may include two or more processors 3001. The functions of the service collaboration infrastructure 300 may be implemented in a plurality of computer systems 3000. In this case, the plurality of computer systems 3000 communicate with each other via a network. For example, some of the functions of the system of this embodiment may be implemented in one computer system 3000, and the other parts may be implemented in other computer systems 3000.

[0037] For example, the computer system 3000 may be a PC owned by a user of the system 100 of this embodiment (e.g., a person who operates a power system), or may be a server accessed by the user via a network. In the latter case, the computer system 3000 may be a virtual server on the cloud. In the latter case, the computer system 3000 shown in FIG. 2 is realized by computer resources on the cloud.

[0038] The functions of the adaptive protection application 200 can also be realized by the processor 3001 executing an application program loaded into the memory 3002 of the computer system 3000. In this case, the service collaboration infrastructure 300 and the adaptive protection application 200 may be realized by the same computer system 3000, or may be realized by different computer systems 3000.

[0039] <Figure 2> FIG. 2 is a flowchart showing an example of an outline of processing performed by the system 100 according to the first embodiment of the present invention.

[0040] In step 1001 , the adaptive protection application 200 generates an instruction to rewrite a specific protection logic 404 , and transmits a request to the request processing time check unit 311 on the service collaboration platform 300 .

[0041] In steps 1002 and 1003, the request processing time check unit 311 obtains data from the load data tables 308 and calculates the processing time of the received request, and judges whether the processing will be completed within the requested time. If it is judged that the processing will be completed within the requested time (YES in step 1003), the request processing continues and proceeds to step 1004. On the other hand, if it is judged that the processing will not be completed within the requested time (NO in step 1003), the processing is put on hold and data is sent to the warning transmission unit 314 (step 1005).

[0042] In steps 1004 and 1006, the continuation protection check unit 312 obtains the alternative protection configuration and its operating status related to the protection logic 404 to which the request is rewritten from the protection configuration DB 306 and the protection logic status table group 310, and judges whether protection can be continued even if the protection logic 404 to be rewritten stops. If it is judged that protection can be continued (YES in step 1006), the process of the request is continued and the process proceeds to the next step 1007. On the other hand, if it is judged that protection cannot be continued (NO in step 1006), the process is put on hold and data is transmitted to the warning transmission unit 314 (step 1005).

[0043] In step 1007, processing of the request is started, and the service collaboration infrastructure 300 sends a rewrite instruction to the virtual IED management server 401 on the edge (i.e., substation 400) side via the edge side input / output I / F 302 and the network 500, and deletes the request from the request retention table 313.

[0044] In step 1005, the warning transmission unit 314 receives the data and notifies the user that the request is pending together with the contents of the pending request. By the above processes from steps 1001 to 1007, the protection logic can be safely rewritten.

[0045] <Figure 3> FIG. 3 illustrates an example of a functional block diagram of the adaptive protection application 200 according to the first embodiment of the present invention.

[0046] The purpose of the adaptive protection application 200 is to detect changes in the grid state, predict the grid state in the near future, and propose changes to the protection logic 404 so as to provide a protection function suitable for the grid state in the near future, in order to realize a protection function that flexibly responds to changes in the grid. Here, the adaptive protection application 200 is described as an application that runs on the service collaboration platform 300, but all of its functions may be realized by software, or some of its functions may be realized by hardware or other technologies.

[0047] To this end, the adaptive protection application 200 includes a change detection unit 201, a system state prediction unit 202, a logic generation unit 203, a validity verification unit 204, and a rewrite instruction unit 205. The adaptive protection application 200 also includes an input / output I / F 206 and an I / F 207 with the service collaboration platform 300 in order to input and output necessary data.

[0048] <Figure 4> FIG. 4 is a flowchart illustrating an example of a process of the adaptive protection application 200 in the first embodiment of the present invention.

[0049] First, in steps 2001 and 2002, the change detection unit 201 acquires external data (for example, weather data) or sensor data through the input / output I / F 206 or the service collaboration platform I / F 207, continues monitoring while there is no predetermined change (NO in step 2002), and proceeds to the next process when a change of a predetermined amount or more is detected (YES in step 2002). Here, the predetermined change may be, for example, a sudden change in temperature that leads to a prediction of a weather change, or a sudden increase or decrease in the amount of current that leads to a prediction of an imbalance between supply and demand.

[0050] Next, in step 2003, the system state prediction unit 202 acquires the sensor data, state data, and system data from each DB on the service collaboration platform 300, predicts the system state after a predetermined time using a state prediction engine (not shown), and creates a predicted system cross section. Here, the state prediction engine may be a program that calculates, for example, numerical values ​​such as changes in the amount of power generated by renewable energy after 5 minutes due to weather changes, changes in demand, and changes in the allowable power of transmission lines, transformers, etc. The system state prediction unit 202 creates a predicted system cross section based on the results of these calculations.

[0051] Next, in step 2004, the logic generating unit 203 generates a proposal for protection logic suitable for the system state after a predetermined time from the predicted system cross section created in step 2003. Here, the proposal for protection logic may be, for example, a setting value of an Under Frequency Relay (UFR) for maintaining a supply-demand balance, or a decision logic for an Over Current Relay (OCR) for protecting a power transmission line.

[0052] Next, in steps 2005 and 2006, the validity verification unit 204 simulates the protection logic proposal generated by the logic generation unit 203 using the predicted system cross section generated by the system state prediction unit 202, and judges whether the protection logic proposal operates appropriately in the predicted near-future system, i.e., whether rewriting of the protection logic is appropriate. Here, the simulation may be, for example, a program that sets one or more accident points for the entire system or a part of the system, and simulates by calculation whether the system equipment will be protected by the protection logic when an accident occurs. If it is judged that rewriting of the protection logic is appropriate (YES in step 2006), the process proceeds to the next process, and if it is judged that rewriting of the protection logic is not appropriate, i.e., the system equipment cannot be protected by the proposal (NO in step 2006), the process returns to the generation of the protection logic proposal in step 2004.

[0053] Finally, in step 2007, the rewrite instruction unit 205 converts the logic received from the validity verification unit 204 into a rewrite instruction, and transmits the rewrite instruction to the edge (i.e., the substation 400) side through the service collaboration platform I / F 207. Here, the rewrite instruction means conversion into a protocol that can be interpreted by the virtual IED management server 401 on the edge side, and may be, for example, the protocol of IEC61850, which is an international standard for communication between equipment in a substation, or another protocol.

[0054] <Figure 5> FIG. 5 is a flowchart showing an example of processing of the load data collecting unit 307 in the first embodiment of the present invention.

[0055] The load data collection unit 307 is a function that creates and updates a load data table group 308 .

[0056] First, in step 3071, the load data collection unit 307 acquires the load and response time of the server on which the service collaboration platform 300 operates (for example, the computer system 3000 shown in FIG. 1B), and stores the load and response time in the columns of load 3081B and response time 3081C of the service collaboration platform load table 3081 in the load data table group 308, respectively (see FIG. 12). The column of device 3081A stores information (for example, "server A") that identifies the device (server in this example) from which the load and response time were acquired. Here, the server load and response time may be obtained by querying the OS (operating system) running on the server, or may be measured using separate hardware or software that measures the server load and response time.

[0057] Next, in step 3072, the load data collector 307 acquires the traffic and response time of the network 500 between the service collaboration platform 300 and each substation 400 through the edge-side input / output I / F 302 of the service collaboration platform 300, and stores the traffic and response time in the network load table 3082 of the load data table group 308. Specifically, the measured network path is stored in the device 3082A column, the traffic volume, for example, t / s (Transactions per second), is stored in the traffic 3082B column, and the response time is stored in the response time 3082C column.

[0058] Here, the network traffic volume and response time may be measured using hardware such as a NIC (Network Interface Controller) that constitutes the edge-side input / output I / F 302 of the service collaboration platform, or may be measured using other hardware or software.

[0059] Next, in step 3073, the load data collection unit 307 acquires the load and response time of the virtual IED management server 401 of each substation 400 through the edge-side input / output I / F 302 of the service collaboration platform 300, and stores them in the columns of load 3083B and response time 3083C, respectively, of the virtual IED management server load table 3083 of the load data table group 308. The column of device 3083A stores information identifying the device (in this example, the virtual IED management server 401) for which the load and response time have been acquired.

[0060] Up to this point, all the necessary data has been stored in the load data tables 308. Next, the load data collection unit 307 waits for a certain period of time (step 3074), and if the processing is completed normally (YES in step 3075), returns to the initial step 3071 and repeats data collection. In the second and subsequent processing, the previous data is overwritten when each data is stored. In step 3075, NO is determined if there is an abnormality in the operation of the load data collection unit 307 itself, or if the user issues a command to end the program. In other words, if data cannot be acquired due to a problem with the data acquisition source, processing continues, and a character string indicating that data could not be acquired, for example, N / A, is stored in the item where data could not be acquired.

[0061] <Figure 6> FIG. 6 is a flowchart illustrating an example of a process of the protection logic state collecting unit 309 in the first embodiment of the present invention.

[0062] The protection logic status collection unit 309 is a function that creates and updates the protection logic status table group 310.

[0063] First, in step 3091, the protection logic status collection unit 309 acquires the ID of the virtual IED 402 running on the virtual IED management server 401 of each substation 400, as well as the ID, function, logic revision, and logic status of the protection logic 404 in the virtual IED 402, from the virtual IED management server 401 of that server through the edge side input / output I / F 302 of the service collaboration platform, and stores each of them in a table for each substation in the protection logic status table group 310 (for example, substation A table 3101 here) (see Figure 13).

[0064] Specifically, the column of virtual IED ID 3101A stores the ID of the virtual IED 402, and the column of protection logic ID 3101B stores the ID of the protection logic 404. The column of function 3101C stores the function provided by the protection logic 404. Here, the function refers to the type of protection function in the protection relay system, such as UFR or OLR. The column of revision 3101D stores the revision of the logic of the protection logic 404. The revision is a number that manages the logic, and for example, the more recent the date and time that the logic was created by the adaptive protection application 200, the larger the revision number. However, the revision may be a number or another character string. The column of status 3101E stores the operating status of the protection logic 404. The operating status indicates whether the protection function is operating normally or whether the operation has stopped due to some reason, such as non-use, a failure or an error, or logic being rewritten. In the example of status 3101E shown in FIG. 13, the character string "running" is stored if the device is operating normally, and "stopped" is stored if the device has stopped.

[0065] Up to this point, all the necessary data has been stored in the substation A table 3101 of the protection logic status table group 310. Next, the protection logic status collection unit 309 waits for a predetermined time (step 3092), and if the processing is completed normally (YES in step 3093), returns to the initial step 3091 to repeat data collection. In the second and subsequent processing, the previous data is overwritten when each data is stored.

[0066] The determination in step 3093 is NO if there is an abnormality in the operation of the protection logic state collection unit 309 itself, or if the user issues a command to end the program. In other words, if data cannot be acquired due to a problem with the data acquisition source, the process continues, and a character string indicating that data could not be acquired, for example, N / A, is stored in the item for which data could not be acquired.

[0067] The protection logic state collection unit 309 is started as an independent program for each substation from which information is collected, and executed in parallel. That is, the above description has been given of each step as an example of creating the substation A table 3101, but another protection logic state collection unit 309 that creates the substation B table 3102 in the same steps operates on the service collaboration platform 300. However, this method is one implementation example, and one protection logic state collection unit 309 may acquire data in sequence, such as substation A, then substation B, then substation C, and so on.

[0068] <Figure 7> FIG. 7 is a flowchart showing an example of processing of the request processing time check unit 311 in the first embodiment of the present invention.

[0069] First, in step 3111, the request processing time check unit 311 receives a rewrite instruction from the adaptive protection application 200 through the application side input / output I / F 301, and stores it in the request holding table 313. The request includes, for example, the following information: request number, request destination, request content, change content, and request time. Specifically, in step 3111, the request processing time check unit 311 stores this information in the request No. 313A column, request destination 313B column, request content 313C column, change content 313D column, and request time 313E column of the request holding table 313 (see FIG. 11). Furthermore, 0, which means that the request is not pending, is stored in the pending flag 313F column of the request holding table 313.

[0070] Here, information contained in the request will be described.

[0071] The request number 313A is a number for managing requests, and may be assigned by the adaptive protection application 200, the service collaboration platform 300, or both. The request destination 313B is the destination of the protection logic 404 to which the request content is to be applied. The naming rule for the destination may be, for example, as shown in FIG. 10.

[0072] The request content 313C indicates what is to be changed in the protection logic 404, for example, a setting value change, a sequence change, or a state change (for example, function start, stop, restart, etc.). Here, an example is given to explain the setting value and sequence. For example, if the protection logic 404 is an OCR, it has a threshold value used to determine whether or not a trip signal needs to be output, and a function to receive a current value from a sensor, compare it with the threshold value after some calculations, and output (or not) a trip signal. Here, using terms commonly used in the power industry, the former threshold value is called a setting value, and the latter function is called a sequence. However, the terms are not limited to these, and other terms may be used for the values ​​and functions equivalent to the above.

[0073] The change content 313D is the specific content of the change indicated in the request content 313C. For example, if the request content 313C is "change setting value" and the change content 313D is "change to 0.2", the request is an instruction to rewrite the setting value of the target protection logic 404 from the current value to 0.2.

[0074] The requested time 313E is an upper limit of the time required for the protection logic 404 to start functioning with the changed content after the rewrite instructed by the request is completed. For example, if the adaptive protection application 200 predicts a sudden change in the current in five minutes, determines that the protection logic needs to be rewritten, and issues a rewrite instruction, it is meaningless unless the logic change is completed before the predicted change occurs. Therefore, in this case, the requested time is set to five minutes (300 seconds). The requested time may be input by the user, or may be automatically set by the adaptive protection application 200.

[0075] In step 3112, the request processing time checking unit 311 acquires the request destination 313B of the request in the request holding table 313, identifies the route to the rewrite target, acquires the response time of each IT device on that route from the load data tables 308, and calculates the sum of these response times to calculate a predicted time until the processing is completed.

[0076] Here, the calculation method of the predicted time is specifically shown by taking the request 3131 indicated by the request No. "APS00001" in the example of the request holding table 313 shown in FIG. 11 as an example. The request destination 313B of the request 3131 is "substation A / virtual IEDA0 / protection logic A0-0". From this, it is understood that the destination is the protection logic A0-0 of the virtual IEDA0 managed by the virtual IED management server A of the substation A. Furthermore, it is understood that the IT devices on the path until the request is processed are the service collaboration platform server, the network between the service collaboration platform and the substation A, and the virtual IED management server A. Therefore, the request processing time check unit 311 obtains the respective response times of 30 ms (see 3081C), 500 ms (see 3082C), and 30 ms (see 3083C) from the load data table group 308, and calculates the predicted time of 560 ms by summing them. However, the calculation method of the predicted time is not limited to this method, and may be calculated by another method.

[0077] In steps 3113 and 3114, the request processing time check unit 311 compares the predicted time calculated in step 3112 with the requested time 313E included in the request to determine whether the predicted time is shorter than the requested time, i.e., whether the processing will end within the requested time. If the predicted time is shorter than the requested time (YES in step 3114), the request processing time check unit 311 transmits data to the continuity protection check unit 312. If the predicted time is longer than the requested time (NO in step 3114), the request processing time check unit 311 changes the pending flag 313F of the request in the request holding table 313 to 1, which means that the request is pending, and transmits data to the warning transmission unit 314. The determination in step 3114 corresponds to the determination in step 1003 in FIG. 2.

[0078] With the request processing time checking unit 311 described above, even if an IT device on the route has a malfunction, an excessive number of requests, or for other reasons causes an abnormally long response time and the request cannot be completed within the time expected by the user, the user can immediately know this and can take other measures before unexpected effects are caused on the power grid.

[0079] <Figure 8> FIG. 8 is a flowchart showing an example of a process of the continuity protection check unit 312 in the first embodiment of the present invention.

[0080] First, in step 3121, when continuity protection check unit 312 receives data from request processing time check unit 311, it acquires data from request destination 313B of the request in request holding table 313, and identifies the logic to be rewritten.

[0081] In step 3122, the continuous protection check unit 312 extracts a part of the system configuration from the protection configuration DB 306, including the system equipment (e.g., a power transmission line, a transformer, etc.) protected by the rewrite target logic and the related protection logic when an accident occurs in the identified system equipment. The protection configuration DB 306 stores data on the configuration of the power system equipment and the protection relay system that has been collected, organized, and created in advance by other systems or manually, and it is possible to search for and extract equipment related to a certain equipment and related protection logic. The data may be stored in a table format, a graph data format, or another format. The protection configuration DB 306 will be described in further detail with reference to FIG. 14.

[0082] In step 3123, the continuous protection check unit 312 acquires the operation state of the protection logic 404 included in the part of the extracted system configuration from the column of the state 3101E of the protection logic state table group 310. Then, the continuous protection check unit 312 creates pre-rewrite protection state data 700 that reflects the operation state of the acquired protection logic 404 in the part of the extracted system configuration. That is, the pre-rewrite protection state data 700 is a collection of system data of a range that may be affected when the logic to be rewritten temporarily stops functioning due to the rewrite process, the protection logic, and data on the current state (operating or stopped) of the protection logic. The pre-rewrite protection state data 700 will be described in further detail with reference to FIG. 15.

[0083] In steps 3124 and 3125, the continuous protection check unit 312 uses the pre-rewrite protection state data 700 created in step 3123 to verify whether or not the spread of the accident can be prevented by other protection logics when an accident occurs in a system device while the logic to be rewritten is stopped due to the rewrite process. The verification may be performed by a method of setting an accident point and simulating the system state, as described in relation to the processing of the adaptive protection application 200, or may be performed by a separate program for the protection configuration DB 306. An example of the verification of accident spread will be described in further detail with reference to FIG. 16.

[0084] 2. If it is determined as a result of the verification that the spread of the accident to system equipment, consumers, distribution systems, etc. connected to the system can be prevented by other protection logic 404 operating around the logic to be rewritten (YES in step 3125), proceed to step 3126. On the other hand, if it is determined that the spread of the accident cannot be prevented, that is, that the accident will affect one or more of system equipment, consumers, distribution systems, etc. connected to the system (NO in step 3125), proceed to step 3128. The determination in step 3125 corresponds to the determination in step 1006 in FIG. 2.

[0085] In step 3126, processing of the request is started, and the service collaboration platform 300 transmits a rewrite instruction to the edge-side virtual IED management server 401 through the edge-side input / output I / F 302. Then, in step 3127, the request is deleted from the request retention table 313. Steps 3126 and 3127 correspond to step 1007 in FIG. 2.

[0086] In step 3128 , the continuity protection check unit 312 changes the pending flag 313 F of the request in the request holding table 313 to 1, which means that the request is pending, and transmits the data to the warning transmission unit 314 .

[0087] The time required to rewrite the protection logic 404 is thought to be at most a few ms if no errors occur during the process, but an accident in the power system can spread instantly and, in some cases, cause a subsequent blackout. If there is a possibility that the process of rewriting the protection logic 404 could lead to a major accident, the above-described continuous protection check unit 312 allows the user to know this before the process and to take other measures.

[0088] <Figure 9> FIG. 9 is a flowchart showing an example of a process of the warning issuing unit 314 in the first embodiment of the present invention.

[0089] The warning transmission unit 314 first receives data from the request processing time check unit 311 or the continuity protection check unit 312 (step 3141). After receiving the data, the warning transmission unit 314 next acquires information on the request in the request holding table 313, and transmits the acquired information and a message indicating that the request is pending to the adaptive protection application 200 via the application side input / output I / F 301 (step 3142).

[0090] <Figure 10> FIG. 10 is an explanatory diagram showing an example of a naming rule for the substation 400, the virtual IED 402, and the protection logic 404 used when generating a request destination included in a request in the first embodiment of the present invention.

[0091] The naming convention may be that each part is assigned a unique ID, or that IDs are assigned according to local conventions determined for each substation, and the service collaboration platform 300 converts them into unique IDs and provides them to the adaptive protection application 200. The latter involves extra processing, but has the advantage that existing equipment IDs can be used as is.

[0092] In the example of Fig. 10, the multiple substations 400 are named, for example, substation A, substation B, etc. The multiple virtual IEDs 402 operating in substation A are named, for example, virtual IED A0, virtual IED A1, etc. The multiple protection logics 404 operating in virtual IED A0 are named, for example, protection logic A0-0, protection logic A0-1, etc. With such naming, for example, from the name of protection logic A0-0, it can be known that the protection logic A0-0 operates in the virtual IED A0 of substation A.

[0093] It should be noted that this naming rule is merely an example adopted in this embodiment for the sake of convenience, and in reality, any naming rule can be used.

[0094] <Figure 11> FIG. 11 shows an example of the configuration of the request retention table 313 held by the service collaboration infrastructure 300 according to the first embodiment of the present invention.

[0095] The meaning of the values ​​in the table and the method of storing the values ​​are explained in the explanation of FIG. 7 (request processing time check unit 311).

[0096] <Figure 12> FIG. 11 shows an example of the configuration of the load data table group 308 held by the service collaboration infrastructure 300 according to the first embodiment of the present invention.

[0097] The load data table group 308 includes a service collaboration platform load table 3081, a network load table 3082, and a virtual IED management server load table 3083. The meaning of the values ​​in each table and the method of storing the values ​​are explained in the explanation of FIG. 5 (load data collection unit 307).

[0098] <Figure 13> FIG. 13 shows an example of the configuration of the protection logic state table group 310 held by the service collaboration infrastructure 300 according to the first embodiment of the present invention.

[0099] The protection logic state table group 310 includes a table for each substation 400, for example, a substation A table 3101, a substation B table 3102, and the like, the same number of which corresponds to the number of substations. The meaning of the values ​​in each table and the method of storing the values ​​are explained in the explanation of FIG. 6 (protection logic state collection unit 309).

[0100] <Figure 14> FIG. 14 shows an example of the configuration of the protection configuration DB 306 held by the service collaboration infrastructure 300 according to the first embodiment of the present invention.

[0101] The protection configuration DB 306 stores data on the configuration of power system equipment and protective relay systems that have been collected, organized, and created in advance by other systems or manually. Using the protection configuration DB 306, it is possible to search for and extract equipment related to a certain equipment and related protection logic. The data may be stored in a table format, a graph data format, or other formats. In this specification, it is assumed that the data is stored in a graph data format with each equipment as a node and the transmission line as an edge.

[0102] Examples of protection targets include a generator 3061, a transformer 3062, consumers 3063A-B, a power distribution system 3064, and a power transmission line 3067 connecting them. Also, examples of operation targets of protection logic include CBs (circuit breakers) 3065A-I, and protection logics 3066A-I on virtual IEDs that operate the respective CBs. In the protection configuration DB 306, each of these facilities and protection logics is provided with connection source and connection destination information, and based on this, the facility configuration as shown in Fig. 14 can be grasped. However, information on whether each protection logic is operating or stopped is not included.

[0103] <Figure 15> FIG. 15 illustrates an example of the configuration of pre-rewrite protection state data 700 held by the service collaboration infrastructure 300 according to the first embodiment of the present invention.

[0104] Fig. 15 shows a portion of the power system equipment and protection relay system configuration shown in Fig. 14, including the target of processing. Assume here that a rewrite request for protection logic A0-0 (protection logic 3066A in Fig. 15), for example, is about to be processed. To create pre-rewrite protection status data 700, first, peripheral equipment and protection logic that may be affected if protection logic A0-0 (protection logic 3066A in Fig. 15) stops are extracted from protection configuration DB 306, and then the status of each protection logic included in the extracted items is obtained and added as data.

[0105] 15 is an example of pre-rewrite protection state data 700 created as a result. Here, the surrounding equipment that may be affected may be, for example, equipment within a predetermined distance from CB3065A operated by the protection logic to be rewritten, equipment within a range from CB3065A to where any two of the CB, generator, or transformer are found by tracing the power transmission line, or equipment determined by other graph search algorithms.

[0106] <Fig.16> FIG. 16 shows an example of verification of accident propagation by the continuity protection check unit 312 in the first embodiment of the present invention.

[0107] Here, an example is shown in which the pre-rewrite protection state data 700 shown in FIG. 15 is used, and the protection logic A0-0 (protection logic 3066A in FIG. 16) to be rewritten is set to stopped (stopped), and an accident occurs near the generator 3061. As a result of the verification, it is found that the influence of the accident spreads without being cut off by the CB 3065A, but the influence can be stopped by the CB 3065B and CB 3065C due to the action of the protection logic A0-1 (3066B in the figure) and A1-0 (3066C in the figure). The definition of being able to stop the influence may be, for example, the case where the influence is limited to a predetermined distance from the accident point, or the case where the influence does not spread to either the consumer 3063A or the power distribution system 3064, or a definition according to the circumstances of other electric power companies.

[0108] According to the above-described first embodiment of the present invention, between an application operated by a user to output a rewrite instruction (also referred to as a request) and an edge-side virtual machine that is rewritten as a result of the request, there is a first function (e.g., a request processing time check unit 311) that estimates the request processing time and checks that the delay time does not exceed the requested time, and a second function (e.g., a continuity protection check unit 312) that checks the existence and status of alternative functions in the vicinity of the rewrite destination and checks that the functions provided by the virtual machine continue in some form even while the target virtual machine is being rewritten, and if the check result of at least one of the first function and the second function is unsuccessful (also referred to as NG), the request is temporarily suspended (also referred to as pending), and a warning is sent to the application operated by the user.

[0109] The first function calculates the request processing time using data from a group of load data tables created by a third function (e.g., the load data collection unit 307) that collects the current load status of multiple IT devices used when processing the request, and determines whether the request is passed (also written as OK) or failed by comparing the calculation result with the request time sent by the user along with the request.

[0110] The second function uses data from a protection configuration DB (short for database) that stores a list of functions running on virtual machines currently provided to the power system, and data from a group of protection logic status tables created by a fourth function (e.g., protection logic status collection unit 308) that collects the current operating status of each function, to determine whether the requested virtual machine function can be replaced by a function running on another nearby virtual machine even while the requested virtual machine is being rewritten, that is, whether the spread of the accident in the power system can be kept below a certain level even if the requested function is stopped, and thereby determine whether the request is passed or failed.

[0111] If the judgment result is a pass, the first and second functions continue processing the request, and if the judgment result is a fail, they stop processing the request and send the data to a fifth function (e.g., warning sending unit 314) that sends a warning to the user.

[0112] This allows functions running on the edge virtual machine to be safely changed remotely. For example, when this embodiment is used in a power system control or protection system, stable operation of the power system can be achieved by flexibly rewriting functions in response to changes in the system. EXAMPLES

[0113] Next, a second embodiment of the present invention will be described with reference to Fig. 17 to Fig. 19B. The configuration and effects of the system according to the second embodiment are similar to those of the system according to the first embodiment shown in Fig. 1 to Fig. 16, except for the differences described below, and therefore the description will be omitted.

[0114] In the first embodiment, if the check is failed in either the request processing time check unit 311 or the continuity protection check unit 312, the user is simply notified. In the second embodiment, a process for attempting to pass the check is added to the request processing time check unit 311 and the continuity protection check unit 312, thereby providing an example of a system with improved user convenience.

[0115] <Fig.17> FIG. 17 illustrates an example of a system configuration and functional blocks according to the second embodiment of the present invention.

[0116] As shown in FIG. 17, in the second embodiment, a backup network 500B and a backup virtual IED management server 401B are newly added to the service collaboration platform-substation network 500 and the virtual IED management server 401 in each substation in the system configuration (FIG. 1) in the first embodiment. Also, a request processing time check unit 311B and a continuity protection check unit 312B are obtained by adding functions described later to the request processing time check unit 311 and the continuity protection check unit 312 in the first embodiment. The rest of the configuration is the same as that in FIG. 1. However, the number of the backup network 500B and the backup virtual IED management server 401B may be one or more, and although it is written as "backup," they may be in a state of being constantly used.

[0117] In the second embodiment, the load data table group 308 includes information on the load of the backup device. Furthermore, the load data table group 308 may include information that associates each device with a backup device that can replace it.

[0118] <Fig.18> FIG. 18 is a flowchart showing an example of processing by the request processing time check unit 311B in the second embodiment of the present invention.

[0119] First, steps 3111, 3112, and 3113 are the same as those in the first embodiment. In step 3114B, if it is determined that the processing will not be completed within the time limit (NO in step 3114B), the process proceeds to step 3117.

[0120] In step 3117, the request processing time check unit 311B calculates a predicted time until the request is completed when going through an alternative path via the backup network 500B and / or the backup virtual IED management server 401B. For example, the request processing time check unit 311B refers to the load data table group 308, identifies devices that can replace the devices constituting the path determined in step 3114B that the processing will not be completed within the time, generates an alternative path that includes one or more of the identified alternative devices, and calculates a predicted time when going through the alternative path.

[0121] Next, the process proceeds to steps 3118 and 3119, where the request processing time check unit 311B compares the predicted time when the alternative path is used with the requested time 313E of the request to determine whether the request can be processed within the requested time. If the request can be processed within the requested time via the alternative path (YES in step 3119), the process proceeds to step 3115, and if the request cannot be processed (NO in step 3119), the process proceeds to step 3116. Steps 3115 and 3116 are the same as in the first embodiment.

[0122] As a result, even if a request cannot be processed in the first path, if it can be processed in another path, the request is executed without being pending, thereby improving user convenience.

[0123] <Fig. 19A, Fig. 19B> 19A and 19B are flowcharts showing an example of processing of the continuity protection check unit 312B in the second embodiment of the present invention.

[0124] First, steps 3121, 3122, 3123, and 3124 are the same as those in the embodiment 1. In step 3125B, if it is determined that the accident cannot be prevented from spreading (NO in step 3125B), the process proceeds to step 3129.

[0125] In steps 3129 and 31210, the continuous protection check unit 312B acquires the reason for stopping the protection logic 404 that is currently in a stopped state from the pre-rewrite protection state data 700, from the virtual IED management server 401. If the reason for stopping is an error or due to user specification, the continuous protection check unit 312B determines that the protection logic 404 is permanently stopped, and if the reason for stopping is that the protection logic 404 is being rewritten, determines that it will be restored after a short time (i.e., there is a possibility of restoration).

[0126] For example, when the protection logic 404 of the virtual IED 402 instructed by the service collaboration platform 300 to be rewritten is stopped, it may be determined that the reason for the stop is the rewriting of the protection logic 404 (i.e., there is a possibility of recovery), and when the other protection logic 404 is stopped, it may be determined that the reason for the stop is an error or the like (i.e., there is no possibility of recovery). The status 3101E of the protection logic status table group 310 may include information indicating the reason for the stop determined in this manner or the presence or absence of a possibility of recovery determined based on the reason.

[0127] If it is determined that recovery is likely (YES in step 31210), the process proceeds to step 31215; if it is determined that recovery is not likely (NO in step 31210), the process proceeds to step 3128.

[0128] In steps 31215 and 31216, the continuation protection check unit 312B compares the time calculated by the request processing time check unit 311B plus the recovery wait time with the requested time included in the request to determine whether processing is possible within the requested time even including the recovery wait time. If it is determined that processing is possible within the requested time (YES in step 31216), the process proceeds to step 31211, and if it is determined that processing is impossible within the requested time (NO in step 31216), the process proceeds to step 3128. Note that the wait time until the currently stopped protection logic is rewritten may be a fixed value such as 1 second, or the result of predicting the rewrite time from the function and revision information of the protection logic to be rewritten may be used.

[0129] In steps 31211 and 31212, the continuous protection check unit 312B verifies whether the accident spread can be prevented by treating the stopped protection logic 404 of the pre-rewrite protection state data 700 as running. This verification can be performed in the same manner as in steps 3124 and 3125B. If it is determined that the accident spread can be prevented as a result of the verification (YES in step 31212), the process proceeds to step 31213, and if it is determined that the accident spread cannot be prevented (NO in step 31212), the process proceeds to step 3128.

[0130] In steps 31213 and 31214, the continuous protection check unit 312B waits for a predetermined time (e.g., 1 second) up to the end of rewriting the currently stopped protection logic 404 and restores it, and if the protection logic is restored within the predetermined time (YES in step 31214), the process proceeds to step 3126, and if the protection logic is not restored within the predetermined time (NO in step 31214), the process proceeds to step 3128. Steps 3126, 3127, and 3128 are the same as those in the first embodiment.

[0131] This makes it possible to prevent a request from being put on hold because another protection logic happens to be being rewritten, improving user convenience. In addition, when multiple rewrite instructions are issued within a short period of time, the order of the rewrite instructions output by the adaptive protection application 200 may not match the actual rewrite order of the protection logic, but even in this case, each process can be carried out while keeping the accident spread within an acceptable range, improving user convenience while ensuring safety.

[0132] Furthermore, the system according to the embodiment of the present invention may be configured as follows.

[0133] (1) A virtual machine rewriting system, comprising a processor (e.g., a processor 3001 of a computer system 3000 that realizes a service collaboration platform 300) and a storage device (e.g., at least one of a memory 3002 and an auxiliary storage device 3003), the storage device stores request information (e.g., a request storage table 313) including a rewrite instruction for an edge-side virtual machine (e.g., a virtual IED 402) and a request time indicating an upper limit of a processing time for rewriting based on the rewrite instruction, the processor calculates a processing time for rewriting the virtual machine to be rewritten based on the request (e.g., step 3112), and performs a process based on the calculated processing time. Then, it is determined whether the rewrite process of the virtual machine to be rewritten is completed within the requested time (e.g., steps 3113, 3114), and whether the function of the virtual machine to be rewritten will be replaced by the function of another virtual machine during the rewrite process of the virtual machine to be rewritten (e.g., steps 3121 to 3125).If it is determined that the rewrite process of the virtual machine to be rewritten will not be completed within the requested time or that the function of the virtual machine to be rewritten will not be replaced by the function of another virtual machine during the rewrite process of the virtual machine to be rewritten, a notification to suspend processing based on the request is output (e.g., steps 3116, 3128).

[0134] This makes it possible to safely change functions running on edge virtual machines remotely.

[0135] (2) A virtual machine rewriting system as described in (1) above, wherein the virtual machine runs on an information system (e.g., a virtual IED management server 401) of equipment constituting a power system (e.g., a substation 400), and a protection logic (e.g., protection logic 404) that operates a protection device (e.g., a main unit 403) for protecting the power system runs in the virtual machine, and the processor collects the load state (e.g., data stored in load data table group 308) of the information system used for rewriting the virtual machine to be rewritten, and calculates the processing time for rewriting the virtual machine to be rewritten based on the collected load state of the information system.

[0136] This makes it possible to flexibly rewrite functions in a power system control or protection system in response to changes in the power system, thereby achieving stable operation of the power system.

[0137] (3) A virtual machine rewriting system as described in (2) above, wherein the storage device holds protection configuration data (e.g., protection configuration DB306) indicating a connection relationship via a power line of a plurality of devices constituting the power system, and the plurality of devices constituting the power system include a plurality of electrical devices (e.g., generator 3061, transformer 3062, etc.) installed in a plurality of facilities constituting the power system, and a plurality of the protection devices (e.g., CB3065A to 3065I, etc.) for protecting the power system, and the processor acquires the states of a plurality of the protection logics for operating the plurality of the protection devices, and determines, based on the protection configuration data and the states of the plurality of the protection logics, whether the function of the virtual machine to be rewritten will be replaced by the function of another virtual machine during the rewrite process of the virtual machine to be rewritten.

[0138] This allows the reprogramming to be carried out only after it has been confirmed that the effects of an accident occurring during the reprogramming will not spread, thereby ensuring stable operation of the power system.

[0139] (4) A virtual machine rewriting system as described in (3) above, wherein the state of the multiple protection logics includes information indicating the function of each of the protection logics and whether each of the protection logics is in an operating state or not, and the processor identifies the scope of impact of an accident that occurred during the rewriting process of the virtual machine to be rewritten (for example, the impact scope shown in FIG. 16) based on the protection configuration data and the states of the multiple protection logics, and if the identified impact scope is limited to a predetermined range, determines that the function of the virtual machine to be rewritten will be replaced by the function of another virtual machine during the rewriting process of the virtual machine to be rewritten.

[0140] This allows the reprogramming to be carried out only after it has been confirmed that the effects of an accident occurring during the reprogramming will not spread, thereby ensuring stable operation of the power system.

[0141] (5) In the virtual machine rewriting system described in (2) above, when the processor determines that the rewriting process of the virtual machine to be rewritten will not be completed within the requested time, the processor collects the load state when at least a portion of the information system used to rewrite the virtual machine to be rewritten is changed, and based on the collected load state of the information system whose at least a portion has been changed, newly calculates the processing time for rewriting the virtual machine to be rewritten (e.g., step 3117), and determines whether the rewriting process of the virtual machine to be rewritten will be completed within the requested time based on the newly calculated processing time (e.g., steps 3118, 3119).

[0142] As a result, even if a request cannot be processed in one path, if it can be processed in another path, the request is executed without being put on hold, thereby improving user convenience.

[0143] (6) In the virtual machine rewriting system described in (4) above, when the processor determines that the functions of the virtual machine to be rewritten will not be replaced by functions of another virtual machine during the rewriting process of the virtual machine to be rewritten, it determines whether the protection logic in a stopped state is likely to return to an operating state based on the acquired states of the multiple protection logics (e.g., steps 3129, 31210), and when it determines that the protection logic in a stopped state is likely to return to an operating state, it adds a predetermined waiting time to the processing time for rewriting the virtual machine to be rewritten based on the request, and determines whether the rewriting process of the virtual machine to be rewritten is completed within the requested time based on the processing time after the addition of the waiting time (e.g., steps 31215, 31216), and determines the completion of the rewriting of the virtual machine to be rewritten based on the processing time after the addition of the waiting time. If it is determined that the processing will be completed within the requested time, then assuming that the protection logic in a stopped state has been returned to an operating state, it is determined whether the function of the virtual machine to be rewritten will be replaced by the function of another virtual machine during the rewrite processing of the virtual machine to be rewritten (e.g., steps 31211, 31212), and assuming that the protection logic in a stopped state has been returned to an operating state, if it is determined that the function of the virtual machine to be rewritten will be replaced by the function of another virtual machine during the rewrite processing of the virtual machine to be rewritten, then it is determined whether the protection logic in a stopped state has been returned to an operating state after the waiting time has elapsed (e.g., steps 31213, 31214), and if it is determined that the protection logic in a stopped state has been returned to an operating state, it is determined that the function of the virtual machine to be rewritten will be replaced by the function of another virtual machine during the rewrite processing of the virtual machine to be rewritten.

[0144] This makes it possible to prevent request processing from being put on hold due to a temporary suspension of the protection logic, thereby improving user convenience.

[0145] (7) In the virtual machine rewrite system described in (6) above, when the cause of the stopped protection logic being stopped is a rewrite of the protection logic, the processor determines that the stopped protection logic is likely to return to an operating state.

[0146] This makes it possible to prevent a request from being put on hold because another protection logic happens to be being rewritten, improving user convenience. In addition, when multiple rewrite instructions are issued within a short period of time, the order of the rewrite instructions output by the adaptive protection application 200 may not match the order in which the protection logic is actually rewritten, but even in this case, each process can be carried out while keeping the accident spread within an acceptable range, improving user convenience while ensuring safety.

[0147] The present invention is not limited to the above-mentioned embodiment, but includes various modifications. For example, the above-mentioned embodiment has been described in detail for a better understanding of the present invention, and is not necessarily limited to those including all of the configurations described. Also, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Also, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0148] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as a program, table, file, etc. that realizes each function can be stored in a storage device such as a non-volatile semiconductor memory, a hard disk drive, or an SSD (Solid State Drive), or in a computer-readable non-transitory data storage medium such as an IC card, an SD card, or a DVD.

[0149] In addition, the control lines and information lines are those considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0150] 100: Adaptive Protection System 200: Adaptive Protection Applications 300: Service integration platform 400: Substation (Edge) 500: Network 600: External data source 700: Protected state data before rewriting

Claims

1. A virtual machine rewriting system, comprising: A processor and a storage device, The storage device holds request information including a rewrite instruction of the edge-side virtual machine and a request time indicating an upper limit of a processing time for the rewrite based on the rewrite instruction; The processor, Calculating a processing time for rewriting the virtual machine to be rewritten based on the request; determining whether the rewrite process of the virtual machine to be rewritten is completed within the required time based on the calculated processing time; determining whether a function of the virtual machine to be rewritten is substituted by a function of another virtual machine during a rewrite process of the virtual machine to be rewritten; A virtual machine rewriting system characterized by outputting a notification to suspend processing based on the request when it is determined that the rewriting process of the virtual machine to be rewritten will not be completed within the requested time, or when it is determined that the functions of the virtual machine to be rewritten will not be replaced by the functions of another virtual machine during the rewriting process of the virtual machine to be rewritten.

2. 2. The virtual machine rewrite system according to claim 1, The virtual machine operates on an information system of a facility that constitutes a power grid, A protection logic for operating a protection device for protecting the power grid is executed in the virtual machine; The processor, Collecting a load state of an information system used for rewriting the virtual machine to be rewritten; A virtual machine rewriting system, comprising: a processor for processing the rewriting of the virtual machine to be rewritten, the processor being configured to calculate a processing time for the rewriting of the virtual machine based on the collected load state of the information system.

3. 3. The virtual machine rewriting system according to claim 2, the storage device holds protection configuration data indicating a connection relationship via a power transmission line of a plurality of devices constituting the power system; The plurality of devices constituting the power system include a plurality of electric devices installed in a plurality of facilities constituting the power system, and a plurality of protective devices for protecting the power system, The processor, acquiring states of the protection logics for operating the protection devices; A virtual machine rewriting system characterized by determining whether the functions of the virtual machine to be rewritten will be replaced by the functions of another virtual machine during the rewrite process of the virtual machine to be rewritten based on the protection configuration data and the states of multiple protection logics.

4. 4. The virtual machine rewriting system according to claim 3, the states of the plurality of protection logics include information indicating a function of each of the protection logics and whether each of the protection logics is in an operating state; The processor determines the extent of the impact of an accident that occurred during the rewrite process of the virtual machine to be rewritten based on the protection configuration data and the states of the multiple protection logics, and if the determined extent of the impact is limited to a predetermined range, determines that the functions of the virtual machine to be rewritten will be replaced by the functions of another virtual machine during the rewrite process of the virtual machine to be rewritten.

5. 3. The virtual machine rewriting system according to claim 2, The processor, if it is determined that the rewrite process of the rewrite target virtual machine is not completed within the requested time, a load state is collected when at least a part of an information system used for rewriting the rewrite target virtual machine is changed; Based on the collected load state of the information system in which at least a part has been changed, a new processing time for rewriting the virtual machine to be rewritten is calculated; A virtual machine rewriting system characterized in that it is determined whether the rewriting process of the virtual machine to be rewritten will be completed within the required time based on the newly calculated processing time.

6. 5. The virtual machine rewriting system according to claim 4, The processor, when it is determined that the function of the virtual machine to be rewritten is not substituted by a function of another virtual machine during the rewrite process of the virtual machine to be rewritten, based on the acquired states of the plurality of protection logics, determine whether the protection logic in a stopped state is likely to return to an operating state; when it is determined that the protection logic in a stopped state is likely to return to an operating state, adding a predetermined waiting time to a processing time for rewriting the virtual machine to be rewritten based on the request, and determining whether the processing for rewriting the virtual machine to be rewritten is completed within the requested time based on the processing time after the addition of the waiting time; When it is determined based on the processing time after the addition of the waiting time that the rewrite process of the virtual machine to be rewritten will be completed within the requested time, it is determined whether the function of the virtual machine to be rewritten is substituted by a function of another virtual machine during the rewrite process of the virtual machine to be rewritten, assuming that the protection logic in a stopped state has returned to an operating state; Assuming that the protection logic in a stopped state has been restored to an operating state, when it is determined that the function of the virtual machine to be rewritten is substituted by a function of another virtual machine during the rewrite process of the virtual machine to be rewritten, after the waiting time has elapsed, it is determined whether the protection logic in a stopped state has been restored to an operating state; A virtual machine rewriting system characterized by determining that when it is determined that the protection logic in a stopped state has returned to an operating state, the function of the virtual machine to be rewritten will be replaced by the function of another virtual machine during the rewriting process of the virtual machine to be rewritten.

7. 7. A virtual machine rewrite system according to claim 6, A virtual machine rewriting system characterized in that the processor determines that there is a possibility that the stopped protection logic will return to an operating state when the cause of the stopped protection logic is a rewrite of the protection logic.

8. A virtual machine rewriting method executed by a virtual machine rewriting system, comprising: The virtual machine rewriting system includes a processor and a storage device, The storage device holds request information including a rewrite instruction of the edge-side virtual machine and a request time indicating an upper limit of a processing time for the rewrite based on the rewrite instruction; The virtual machine rewriting method includes: a first step of calculating a processing time for rewriting the virtual machine to be rewritten based on the request by the processor; a second step of determining, based on the calculated processing time, whether the rewrite process of the virtual machine to be rewritten is completed within the required time; a third step of determining whether a function of the virtual machine to be rewritten is substituted by a function of another virtual machine during a rewrite process of the virtual machine to be rewritten; a fourth step of outputting a notification to suspend processing based on the request when the processor determines that the rewriting process of the virtual machine to be rewritten will not be completed within the requested time, or that the functions of the virtual machine to be rewritten will not be replaced by functions of another virtual machine during the rewriting process of the virtual machine to be rewritten.

9. 9. A virtual machine rewriting method according to claim 8, comprising: The virtual machine operates on an information system of a facility that constitutes a power grid, A protection logic for operating a protection device for protecting the power grid is executed in the virtual machine; In the first step, the processor Collecting a load state of an information system used for rewriting the virtual machine to be rewritten; A virtual machine rewriting method, comprising: calculating a processing time for rewriting the virtual machine to be rewritten based on the collected load state of the information system.

10. 10. A virtual machine rewriting method according to claim 9, comprising: the storage device holds protection configuration data indicating a connection relationship via a power transmission line of a plurality of devices constituting the power system; The plurality of devices constituting the power system include a plurality of electric devices installed in a plurality of facilities constituting the power system, and a plurality of protective devices for protecting the power system, In the third step, the processor acquiring states of the protection logics for operating the protection devices; A virtual machine rewriting method characterized by determining whether the functions of the virtual machine to be rewritten will be replaced by the functions of another virtual machine during the rewrite process of the virtual machine to be rewritten based on the protection configuration data and the states of multiple protection logics.

11. The virtual machine rewriting method according to claim 10, the states of the plurality of protection logics include information indicating a function of each of the protection logics and whether each of the protection logics is in an operating state; A virtual machine rewriting method characterized in that in the third step, the processor identifies the scope of impact of an accident that occurred during the rewrite process of the virtual machine to be rewritten based on the protection configuration data and the states of the multiple protection logics, and if the identified scope of impact is limited to a predetermined range, determines that the functions of the virtual machine to be rewritten will be replaced by the functions of another virtual machine during the rewrite process of the virtual machine to be rewritten.

12. 10. A virtual machine rewriting method according to claim 9, comprising: a step of collecting a load state when at least a part of an information system used for rewriting the virtual machine to be rewritten is changed by the processor when it is determined in the second step that the rewriting process of the virtual machine to be rewritten is not completed within the requested time; a step of the processor newly calculating a processing time for rewriting the virtual machine to be rewritten based on the collected load state of the information system in which at least a part has been changed; The virtual machine rewriting method further comprises a step of determining, based on the newly calculated processing time, whether the rewriting process of the virtual machine to be rewritten is completed within the required time.

13. The virtual machine rewriting method according to claim 11, a step of determining, in the third step, whether or not the protection logic in a stopped state is expected to return to an operating state based on the acquired states of the protection logics when it is determined in the third step that the function of the virtual machine to be rewritten will not be substituted by a function of another virtual machine during the rewrite process of the virtual machine to be rewritten; a step of adding a predetermined waiting time to a processing time for rewriting the virtual machine to be rewritten based on the request when the processor determines that the protection logic in a stopped state is likely to return to an operating state, and determining whether the processing for rewriting the virtual machine to be rewritten is completed within the requested time based on the processing time after the waiting time has been added; a step of determining whether a function of the virtual machine to be rewritten is substituted by a function of another virtual machine during the rewriting process of the virtual machine to be rewritten, assuming that the protection logic in a stopped state has returned to an operating state, when the processor determines based on the processing time after the addition of the waiting time that the rewriting process of the virtual machine to be rewritten will be completed within the required time; a step of determining whether the protection logic in a stopped state has been restored to an operating state after the waiting time has elapsed, when the processor determines that a function of the virtual machine to be rewritten is substituted by a function of another virtual machine during the rewrite process of the virtual machine to be rewritten, assuming that the protection logic in a stopped state has been restored to an operating state; A virtual machine rewriting method characterized by further comprising a procedure of determining, when the processor determines that the protection logic in a stopped state has returned to an operating state, that the functions of the virtual machine to be rewritten will be replaced by the functions of another virtual machine during the rewrite process of the virtual machine to be rewritten.

14. A method for rewriting a virtual machine according to claim 13, comprising: A virtual machine rewriting method, characterized in that in a procedure for determining whether the protection logic in a stopped state is likely to return to an operating state, the processor determines that the protection logic in a stopped state is likely to return to an operating state if the cause of the stoppage of the protection logic in a stopped state is a rewrite of the protection logic.

Images