Control device, control program, control method, control unit, and control system

Abstract

To provide a control device, a control program, a control method, a control unit, and a control system that are capable of suitably communicating with a control panel of electrical equipment.SOLUTION: A first control device comprises at least one processor to transmit control information to a control panel of electrical equipment installed in a facility. The at least one processor is configured to: transmit candidate information indicating that the first control device is a candidate of transmission source of the control information, to a second control device which is different from the first control device and which is configured to be able to transmit the control information to the control panel, and to a third control device which is different from the first control device and the second control device and which is configured to be able to transmit the control information to the control panel; and determine, when receiving response information to the candidate information from the second control device and the third control device, whether or not the first control device is the transmission source of the control information, on the basis of the received response information.SELECTED DRAWING: Figure 5B

Description

Technical Field

[0001] The present disclosure relates to a first control device, a control program, a control method, a control unit, and a control system for remotely controlling the operation of electrical equipment provided in each facility.

Background Art

[0002] Conventionally, regarding an elevator, which is a type of electrical equipment installed in a building, it is known to transmit image information around the elevator to an external information device and monitor the elevator using an Internet line. For example, Patent Document 1 describes "an elevator including a car that moves up and down in a hoistway, an upper camera installed above the car and capable of photographing an area above the car, a lower camera installed below the car and capable of photographing an area below the car, a transmission unit capable of transmitting an upper image signal including upper image information based on the upper image photographed by the upper camera, and a lower image signal including lower image information based on the lower image photographed by the lower camera to the outside".

[0003] However, in the elevator described in Patent Document 1, a control panel capable of using an Internet line is used to monitor the elevator using an Internet line. Therefore, in an elevator using an existing control panel that does not use an Internet line, in order to introduce the technology described in Patent Document 1, it is necessary to replace the existing control panel with a control panel capable of using an Internet line, and the introduction cost is high.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] The present disclosure has been made based on the above-described background, and an object thereof is to preferably provide a control device, a control program, a control method, a control unit, and a control system capable of transmitting control information to a control panel of electrical equipment.

Means for Solving the Problems

[0006] According to one aspect of the present disclosure, there is provided "a first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, wherein the at least one processor is configured to transmit candidate information indicating that the first control device is a candidate for the transmission source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, and when receiving response information to the candidate information from the second control device and the third control device, respectively, execute a process for determining whether the first control device is the transmission source of the control information based on the received response information."

[0007] According to one aspect of the present disclosure, there is provided "a control unit including at least the first control device, a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device."

[0008] According to one aspect of the present disclosure, there is provided "a control system including the first control device according to claim 1 configured to be able to transmit control information to a control panel of electrical equipment installed in a facility, a second control device configured to be able to transmit the control information to the control panel and different from the first control device, a control unit including at least the third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, and a management device communicably connected to the control unit and configured to manage the control panel via the control device."

[0009] According to one aspect of the present disclosure, there is provided a control system including "a control panel configured to control electrical equipment installed in a facility, a first control device configured to be able to transmit control information to the control panel as described in claim 1, a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, at least including a control unit; and a management device communicably connected to the control unit and configured to manage the control panel via the control device."

[0010] According to one aspect of the present disclosure, there is provided "a control program for a first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, the at least one processor being configured to transmit candidate information indicating that the first control device is a candidate for the transmission source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, and when receiving response information to the candidate information from the second control device and the third control device, respectively, functioning to execute a process for determining whether the first control device is the transmission source of the control information based on the received response information."

[0011] According to one aspect of the present disclosure, in a first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, a control method executed by the at least one processor, the control panel being configured to be able to transmit the control information and being a second control device different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and being different from the first control device and the second control device, the first control device transmits candidate information indicating that the first control device is a candidate for the transmission source of the control information; and when response information to the candidate information is received from the second control device and the third control device, respectively, determining whether the first control device is the transmission source of the control information based on the received response information. A control method including the above steps is provided.

Effect of the Invention

[0012] According to the present disclosure, it is possible to preferably provide a control device, a control program, a control method, a control unit, and a control system capable of transmitting control information to a control panel of electrical equipment.

[0013] Note that the above effects are merely exemplary for convenience of explanation and are not limiting. In addition to or instead of the above effects, any effects described in the present disclosure or effects obvious to those skilled in the art can also be achieved.

Brief Description of the Drawings

[0014]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5A

Figure 5B

Figure 6A

Figure 6B

Figure 7A

Figure 7B

Figure 7C

Figure 8

[0015] Hereinafter, as an example of the embodiments of the present invention, the case where the present invention is applied to a control system will be taken as an example, and each embodiment will be described with reference to the accompanying drawings. The same reference numerals are assigned to common components in the drawings.

[0016] 1. Overview and Configuration of Control System 1 According to the Present Disclosure The control system 1 according to the present disclosure is used, for example, to control electrical equipment installed in each facility from a remote location and to obtain information related to the electrical equipment even at a remote location. For example, the control system 1 according to the present disclosure is suitably used when controlling electrical equipment such as elevators installed in facilities such as buildings from outside the facility. In particular, when the control panel of the electrical equipment pre-installed in the facility does not have a configuration for connecting to the Internet line, by communicably connecting a device such as a control device that can be connected to the Internet line to the control panel, while the control device transmits the control information generated outside the facility (for example, the management system) to the control panel, it is also suitably used for transmitting and receiving information via the Internet line.

[0017] FIG. 1 is a diagram showing a schematic configuration of the control system 1 according to the present disclosure. According to FIG. 1, the control system 1 includes a management unit 3 including a management device 500 and a communication device 100, a control unit 6 including at least a first control device 200A, a second control device 200B, and a third control device 200C, and a facility unit 5 including a control panel 300 and electrical equipment 400, and each unit is communicably connected to each other. Specifically, FIG. 1 shows the connection relationship for data transmission in the facility 2 and the management system 3 provided in a facility different from the facility 2. More specifically, in the control system 1, the facility 2 is communicably connected to the management device 500 of the management system 3 via the Internet line 4.

[0018] As shown in FIG. 1, the facility unit 5 and the control unit 6 are installed in the facility 2. The facility unit 5 includes a control panel 300 pre-installed in the facility 2 and electrical equipment 400 such as an elevator controlled by the control panel 300. The control unit 6 is communicably connected to the control panel 300 of the facility unit 5 by wire or wirelessly, and relays communication between the control panel 300 and the Internet line 4. A plurality of control devices 200 are installed in the control unit 6. These devices are communicably connected by a wired or wireless internal network of the facility 2.

[0019] The control device 200 functions as a data communication gateway for Facility 2, enabling data transmission and reception with the external of Facility 2 via the Internet line 4. Specifically, the control device 200 can communicate with other control devices 200 installed in the control unit 6. Also, the control device 200 can relay the communication between the control panel 300 and the management device 500.

[0020] Such a control device 200 has multiple operating states based on the communication environment, etc. One operating state is the multi-node operating state and the single-node operating state. The multi-node operating state is a state where multiple control devices 200 included in the control unit 6 can operate, and the single-node operating state is a state where only any one of the control devices 200 included in the control unit 6 can operate.

[0021] Furthermore, another operating state is the active state and the standby state. The active state is a state where it is determined to be the source for transmitting control information to the control panel by executing the distributed consensus algorithm as the control device 200 to be made active among the multiple control devices 200 that can operate in the multi-node operating state, or a state where it is determined to be the source for transmitting control information to the control panel without executing the distributed consensus algorithm in the single-node operating state. The standby state is a state where, by executing the distributed consensus algorithm in the multi-node operating state, although it can operate, it is not determined as the source for transmitting control information to the control panel and is waiting.

[0022] Here, in the control device 200, the state transition between the multi-node operation state and the single-node operation state is determined according to the communication status with other control devices 200, the management device 500, and the control panel 300 through the Internet line. Also, in the control device 200 in the multi-node operation state, the state transition between the active state and the standby state is determined based on the communication status with other control devices 200. That is, in the multi-node operation state, the control device 200 switches between the active state and the standby state by executing a distributed consensus algorithm based on the communication status with other control devices 200 without receiving control from the management device 500. As a result, in the multi-node operation state, the control unit 6 can suppress the duplication of communication relay by multiple control devices 200 by setting one of the plurality of control devices 200 to the active state. Also, the control device 200 can switch the operation state without receiving control from the management device 500. Therefore, since the control device 200 can be controlled independently, other devices such as the management device 500 are not required for control, and the system can be configured more simply and inexpensively.

[0023] Here, the distributed consensus algorithm is executed assuming that the number of devices to execute it is relatively large (for example, several hundred to several thousand). Specifically, the distributed consensus algorithm does not assume that even if multiple devices to execute it fail, there will be only one device that operates normally. On the other hand, the multiple control devices 200 installed in the control unit 6 tend to have limited space available for installing the control devices 200, and are preferably composed of a relatively small number, preferably 3, and at most about 10. That is, for the multiple control devices 200 installed in the control unit 6, there is also a possibility that multiple devices do not operate normally due to failures and maintenance, etc., and only one control device 200 that operates normally remains. In such a case, if only the distributed consensus algorithm is used, consensus (response information) from other control devices 200 for the candidate control device 200 (the control device 200 that transmitted the candidate information) cannot be obtained, the algorithm does not hold, and the process stops. Therefore, usually, in a system using the distributed consensus algorithm, as described above, the system is configured using a relatively large number of devices to prevent there being only one device that operates normally. On the other hand, in the control of the control panel 300 according to the present disclosure, there are many cases where it is difficult to install a large number of control devices 200, and the case where only one control device 200 operates normally is also fully considered.

[0024] Therefore, when the control device 200 is in the multi-node operation state, it determines the control device 200 to be in the actual operation state by the distributed consensus algorithm, while when it enters the single-node operation state, it sets the control device 200 that can operate without executing the distributed consensus algorithm to the actual operation state. That is, if it always tries to be determined by the distributed consensus algorithm, when it enters a state where response information (approval) cannot be received by the distributed consensus algorithm (that is, the single-node operation state), since it is possible to be the transmission source of the control information by the judgment of the candidate control device 200 itself, it is possible to transmit the control information even in such a state.

[0025] Note that the distributed consensus algorithm itself is only an example of a means for determining the control device 200 to be in an active state in the multi-node operation state. Naturally, in the multi-node state, other methods may be used as the means for determining the control device 200 to be in an active state among the plurality of control devices 200. Also, in that case, the condition for operating in the single-node state is not whether the distributed consensus algorithm can be executed, but whether the control device 200 operating in the multi-node operation state can be determined.

[0026] The management system 3 includes a communication device 100 for communicating with the control device 200 and a management device 500 for managing the electrical equipment 400 of the facility 2. The communication device 100 is connected within the management system 3 so as to enable the transmission and reception of information with the management device 500.

[0027] In the control system 1, the management device 500 can remotely control and monitor the electrical equipment 400 in the facility 2. Here, the management device 500 performs such management by transmitting and receiving data via the communication device 100. For example, regarding the communication between the communication device 100 and the control device 200, the confidentiality of various types of information transmitted and received is ensured, for example, by VPN connection. That is, remotely managing the electrical equipment 400 in the facility 2 from the management device 500 is secure and can be executed safely and reliably. Note that the VPN connection itself is an example of a communication method in a confidential state, and of course, other communication methods may also be used.

[0028] Here, the facility 2 is not limited to the building described above, and may include various structures and moving objects provided on land, at sea, and in the air. For example, as the facility 2 of a structure, a building, an observatory on a mountain (mountain facility), a plant in the sea or on the sea (marine facility), a work facility in a mine or a dam, a monitoring facility in a power plant or a substation, and a satellite in space are examples. Also, as the facility 2 of a moving object, a passenger car, a truck, a ship, and an aircraft are examples.

[0029] Further, the electrical equipment 400 is not limited to the elevator described above, and may include general devices that are driven or operated using the electricity provided in the facility 2. Here, even if the device is driven by fuel or the like other than electricity, if an auxiliary operation by electricity (such as data display or data communication) is executed, it is naturally included in the electrical equipment 400. For example, when the facility 2 is a building, the elevator, escalator, entrance / exit management device, air conditioning equipment, lighting equipment, and audio equipment are examples that correspond. Also, when the facility 2 is the above-described moving body or satellite, the drive source, sensor, lighting fixture, audio fixture, air conditioning fixture, etc. are examples that correspond. Further, when the facility 2 is the above-described mountain facility, ocean facility, work facility, or monitoring facility, various sensors and various equipment maintenance devices, etc. are examples that correspond. Also, it is not limited to the mode in which the control unit 6 is retrofitted to the equipment unit 5 including the existing equipment, and the control unit 6 may be installed at the same time as the equipment unit 5.

[0030] The electrical equipment 400 of the facility 2 managed by the control system 1 according to the present disclosure includes electrical equipment of facilities where direct access to the site is difficult (equipment of mountain or ocean facilities), electrical equipment where access is difficult but the importance of management is extremely high (sensor equipment in mines or dams), electrical equipment that requires maintenance or inspection without human intervention (automobile capable of autonomous driving), electrical equipment where business efficiency improvement is expected through labor-saving operation or control (various equipment such as buildings), etc. That is, it is possible to widely utilize the control system 1.

[0031] By utilizing the control system 1 in such a facility 2, for the end user who uses the facility 2, since automation of maintenance and maintenance is achieved by eliminating human behavior, the downtime of the facility 2 and the electrical equipment 400 is reduced, and it becomes possible to continuously use the facility 2. Also, for those who perform maintenance or operation of the facility 2, the maintenance or operation work can be simplified, the continuity of maintenance or operation can be easily improved, and the maintenance and operation costs of the facility 2 can be reduced.

[0032] In addition, by utilizing the control system 1 according to the present disclosure, in a multi-node operating state where a plurality of control devices 200 can operate, a control device 200 that becomes an operating state as a transmission source of control information is determined by executing a distributed consensus algorithm. Therefore, it is possible to suppress the plurality of control devices 200 from operating in an overlapping manner when they are in an operating state. Further, in a single-node operating state where only one control device 200 can operate, a control device 200 that can operate without executing a distributed consensus algorithm is determined as the transmission source. Therefore, it is possible to suitably transmit control information even in a state where the distributed consensus algorithm cannot be executed.

[0033] Note that although the quantities of the facility 2 and the control panel 300 in FIG. 1 are both one, they may both be plural. Also, although the number of control devices 200 is described as being about 10 at most above, of course, the present disclosure does not limit the number of control devices 200 to 11 or more.

[0034] Also, in FIG. 1, a configuration including the management unit 3, the control unit 6, and the facility unit 5 is described as the control system 1. However, for example, in order to control a control panel 300 already installed in a facility 2 such as an existing building, it is also possible to install the control system 1 retroactively. Therefore, in such a case, the control system 1 is composed of a management unit 3 including at least a management device 500, and a control unit 6 including at least a first control device 200A, a second control device 200B, and a third control device 200C.

[0035] 2. Configuration of Control Device 200 FIG. 2 is a block diagram showing an example of the configuration of the control device 200 according to the present disclosure. The control device 200 does not necessarily include all of the components shown in FIG. 2, and may have a configuration in which some components are omitted, or other components may be added. In the present disclosure, although it is described that the control unit 6 includes three control devices 200, it may include four or more control devices 200. Further, the control devices 200 may all have the same configuration or different configurations. Further, in the present disclosure, it is described on the premise that no master-slave relationship is set among the three control devices 200 (that is, the transmission source of the control information is not determined based on the instruction information of another control device 200, but is determined based on the information received from another control device 200), but any one of the plurality of control devices 200 may transmit instruction information serving as the transmission source of the control information to another control device 200. Further, in the present disclosure, it is described that the control device 200 in the control unit 6 determines to transmit the control information, but a part or all of the plurality of control devices 200 constituting the control unit 6 may execute part or all of the control related to the control system 1 (that is, a part or all of the plurality of control devices 200 may constitute a control unit).

[0036] As the control device 200, a general IoT router or a network device using a general-purpose OS (Windows (registered trademark), Linux (registered trademark), or Mac OS) may be used. Further, the control device 200 may be a router having a socket into which a SIM or the like can be inserted and driven based on Linux (registered trademark). In the present disclosure, various communication devices may be used as long as they can support the above-described VPN connection and the multi-channeling described later.

[0037] According to FIG. 2, the control device 200 includes a memory 211 including a RAM, a ROM, a non-volatile memory, an HDD, etc., a processor 212 including a CPU, etc., and a communication interface 213. And these respective components are electrically connected to each other via a control line and a data line.

[0038] The memory 211 includes a RAM, a ROM, a non-volatile memory, and an HDD, and functions as a storage unit. The ROM stores, as a program, instruction commands for executing the applications and the OS according to the present disclosure. Such a program is loaded and executed by the processor 212. The RAM is used to execute writing and reading of data while the program stored in the ROM is being processed by the processor 212. The non-volatile memory is a memory in which writing and reading of data are executed by execution of the program, and the data written therein is stored even after the execution of the program ends. In the present disclosure, the memory 211 stores, in particular, a program for executing each process and the like described in the processing sequences of FIGS. 5A and 5B (details of the processing will be described in FIGS. 5A and 5B).

[0039] The processor 212 is composed of a CPU (microcomputer: microcontroller), and functions as a control unit for controlling other connected components based on various programs stored in the memory 211. Specifically, the processor 212 reads out and executes a program for executing the application according to the present disclosure and a program for executing the OS from the memory 211. Note that the processor 212 may be composed of a single CPU or may be composed of a plurality of CPUs.

[0040] Further, by executing the program stored in the memory 211, the processor 212 performs "a process of transmitting candidate information indicating that the first control device 200A can be a transmission source of control information to a second control device 200B configured to be able to transmit control information to the control panel 300 and different from the first control device 200A, and a third control device 200C configured to be able to transmit control information to the control panel 300 and different from the first control device 200A and the second control device 200B", and "a process of determining whether or not the first control device 200A becomes a transmission source of control information based on the received response information when receiving response information to the candidate information from the second control device 200B and the third control device 200C, respectively".

[0041] The communication interface 213 functions as a communication unit that transmits and receives information between the remotely installed communication device 100, management device 500, and other control devices 200 via a communication processing circuit and an antenna. The communication processing circuit processes programs, various types of information, etc. used in the control system 1, and performs processing for transmitting and receiving information from the communication device 100, management device 500, and other control devices 200 according to the progress of the processing. In the present disclosure, in particular, information such as control information is transmitted and received between the other control device 200 and the processor 212 via the communication interface 213. The communication processing circuit operates based on, for example, processing for establishing a secure communication connection with the communication device 100 by the processor 212. For example, the communication processing circuit is processed based on a secure communication connection method using a virtual private communication network (VPN). More specifically, the communication processing circuit is processed by communication protocols of IPsec and IKEv2, and is also processed based on encryption methods of ESP and AES-GCM.

[0042] Note that, in addition to the processing based on the VPN method, the communication processing circuit may be processed based on a broadband wireless communication method such as the 5G method, or may be processed based on a method related to narrowband wireless communication such as wireless LAN represented by IEEE802.11 or Bluetooth (registered trademark), or a method related to contactless wireless communication. Furthermore, instead of or in addition to wireless communication, it is also possible to use wired communication.

[0043] 3. Configuration of Management Device 500 FIG. 3 is a block diagram showing an example of the configuration of the management device 500 according to the present disclosure. The management device 500 does not necessarily need to include all of the components shown in FIG. 3, and may have a configuration in which some are omitted, or other components may be added.

[0044] The management device 500 typically includes a wirelessly communicable terminal device represented by a laptop computer, a desktop computer, or a smartphone, but is of course not limited to only such a device. For example, as the terminal device, any device capable of executing the program according to the present disclosure, such as a smartphone, a feature phone, a personal digital assistant, a PDA, a portable game console, or a stationary game console, can be preferably applied. Also, there may be a plurality of management devices 500 that communicate with the communication device 100, and each terminal does not necessarily always be the same type or the same terminal device, and they may be different types of terminal devices from each other.

[0045] According to FIG. 3, the management device 500 includes an output interface 511, a processor 512, a memory 513 including a RAM, a ROM, or a non-volatile memory (in some cases, an HDD), a communication interface 514 including a communication processing circuit and an antenna, and an input interface 515 including a touch sensor and hard keys. And these respective components are electrically connected to each other via control lines and data lines.

[0046] The output interface 511 functions as an output unit that outputs various displays output by executing the program according to the present disclosure to devices such as a display or a printer in accordance with an instruction from the processor 512. Such a display is composed of, for example, a liquid crystal display, an organic EL display, or an electronic paper.

[0047] The processor 512 is composed of a CPU (microcomputer: microcontroller) and functions as a control unit that controls other connected components based on various programs stored in the memory 513. Specifically, the processor 512 reads and executes programs for running the application according to the present disclosure and programs for running the OS from the memory 513. In the present disclosure, the processor 512 particularly executes each process and the like described in the processing sequence of FIG. 5A (the details of the process will be described in FIG. 5A). Note that the processor 512 may be composed of a single CPU, or may be configured by combining a plurality of CPUs and GPUs.

[0048] In addition, the processor 512 performs processing based on SSL in order to establish a secure communication connection for the communication device 100. Here, since the management device 500 and the communication device 100 exist within the same management system 3, a secure communication connection can be achieved simply by performing a normal communication connection. Note that the method of the secure communication connection used by the processor 512 is not limited to the above content, and other methods may be used as long as it is possible to secure the communication path for the communication device 100 existing within the same management system 3.

[0049] The memory 513 is composed of a ROM, a RAM, a non-volatile memory, an HDD, etc. and functions as a storage unit. The ROM stores instruction commands for running the application and the OS according to the present disclosure as programs. The RAM is used for writing and reading data while the program stored in the ROM is being processed by the processor 512. The non-volatile memory is a memory in which writing and reading of data are executed by the execution of the program, and the data written therein is stored even after the execution of the program is completed. In the present disclosure, the memory 513 particularly stores a program for executing each process and the like described in the processing sequence of FIG. 5A (the details of the process will be described in FIG. 6C).

[0050] The communication interface 514 functions as a communication unit that transmits and receives information between a remotely installed communication device 100 and other management devices via a communication processing circuit and an antenna. The communication processing circuit processes programs, various types of information, etc. used in the control system 1, and performs processing for transmitting and receiving information from the communication device 100 and other management devices according to the progress of the processing. In the present disclosure, in particular, control information is transmitted from the communication interface 514 to the control panel 300 via the communication device 100 and the control device 200.

[0051] The communication processing circuit operates based on processing for establishing a secure communication connection to the communication device 100 by the processor 512. For example, the communication processing circuit is processed based on SSL.

[0052] In addition to the processing based on SSL, the communication processing circuit may be processed based on a broadband wireless communication method represented by the 5G system, or may be processed based on a method related to narrowband wireless communication such as wireless LAN represented by IEEE802.11 or Bluetooth (registered trademark), or a method related to contactless wireless communication. Furthermore, instead of or in addition to wireless communication, it is also possible to use wired communication.

[0053] The input interface 515 is composed of a touch panel, hard keys, etc., and functions as an input unit that receives instruction inputs related to the execution of the program according to the present disclosure, operation inputs for registering various information, and the like. The touch sensor is arranged so as to cover the output interface 511, and transmits information on the position coordinates corresponding to the image data output from the output interface 511 to the display to the processor 512. As the method of the touch sensor, known methods such as a resistive film method, a capacitive coupling method, and an ultrasonic surface acoustic wave method can be used. In the present disclosure, the touch sensor detects a swipe operation or a tap operation on each icon or the like displayed on the output interface 511 by an indicator. In the present disclosure, the input interface 515 provided in the management device 500 is used, but it is also possible to use an input interface 515 that is wirelessly or wiredly connected to a main body including a processor 512 or the like, such as a mouse.

[0054] 4. Information Stored in Memory 211 FIG. 4 is a diagram conceptually showing a control information table stored in the control device 200 and the management device 500 according to the present disclosure. In the present disclosure, the control information table is stored in the memories 211 of the plurality of control devices 200 and the memory 513 of the management device 500. Specifically, the control information tables stored in the respective memories 211 and 513 are updated by the plurality of control devices 200 and the management device 500 communicating with each other via the communication interfaces 213 and 514. In the present disclosure, the case where the control information table is stored in the management device 500 will be described. However, the control information table may be stored in a database (not shown) communicably connected to the management device 500 through a network. In this case, the management device 500 temporarily reads out and processes the information stored in the database into the memory 311 in the management device 500 as the processing progresses. Also, these tables may be stored separately. In the present disclosure, the case where the control information table is stored in the plurality of control devices 200 and the management device 500 will be described. However, the information stored in the control information table may be different for each device, may be stored only in the plurality of control devices 200, or may be stored only in the management device 500.

[0055] According to FIG. 4, in the control information table, control device ID information, control panel ID information, management device ID information, facility ID information, status information, etc. are stored in association with each other. The "control device ID information" is identification information assigned to each control device 200. Specifically, the control device ID information is associated with a control device information table (not shown) in which information about the control device 200, such as the type of the control device, the programming language used, and destination information (e.g., IP address), is stored. That is, for example, the control device 200 and the management device 500 can extract the destination information of the control device 200 corresponding to the control device ID information based on the control device information table. The "control panel ID information" is identification information assigned to each control panel 300. Specifically, the control panel ID information is associated with a control panel information table (not shown) in which information about the control panel 300, such as the type of the control panel, the programming language used, and destination information, is stored. That is, for example, the control device 200 and the management device 500 can extract the destination information of the control panel 300 corresponding to the control panel ID information based on the control panel information table. It is possible to specify the control panel ID information of the control panel for which the control device corresponding to the corresponding control device ID information based on the control panel ID information can transmit control information.

[0056] The "management device ID" is identification information assigned to each management device 500. Specifically, the management device ID information is associated with a management device information table (not shown) that stores information about the control device 200 such as the model of the management device, the programming language used, and destination information. That is, the control device 200 can extract the destination information of the management device 500 corresponding to the management device ID information based on the management device information table. Based on the management device ID information, it is possible to identify the control panel ID information of the control panel to which the management device of the management device ID information can transmit control information. The "facility ID information" is identification information assigned to each facility 2. Specifically, the facility ID information is associated with a facility information table (not shown) that stores information about the facility 2 such as the name, address, operating company name, person in charge, and contact information of the facility 2. That is, for example, the control device 200 and the management device 500 can extract information about the facility 2 corresponding to the facility ID information based on the facility information table. Based on the facility ID information, it is possible to identify the control panel ID information of the control panel installed in the facility of the facility ID information.

[0057] The "status information" is information indicating the status of the control device corresponding to the "control device ID information". Specifically, the "status information" is the "operating status" indicating the state that is the source of the control information received from the management device 500 for the control panel 300, the "standby status" indicating that it is not the source and is in the hot standby state, and the "failure status" indicating that a failure such as a failure of the internal sensor, a communication failure in communication with the control panel 300, and a communication failure in communication with the management device 500 has occurred. Any one of them is assigned. Note that the status information is not limited to the above, and may include a "stop state" indicating that the operation is intentionally stopped, an "adjustment state" indicating that maintenance is in progress, a "trial state" indicating that a test operation is being performed, and the like.

[0058] 5. Processing Sequence Executed by Control System 1 (A) Processing related to remote control by the management device 500 FIG. 5A is a diagram showing a processing sequence executed among the communication device 100, the control device 200, the control panel 300, and the management device 500 according to the present disclosure. Specifically, FIG. 5A is a diagram showing a processing sequence until control information is transmitted from the management device 500 installed at a location different from the facility 2 to the control panel 300 via the communication device 100, the control device 200, and the switch 220 to control the electrical equipment 400 in the facility 2.

[0059] According to FIG. 5A, the processor 512 of the management device 500 periodically generates control information according to a predetermined program stored in the memory 513 (S11). The control information includes information related to the facility 2, the control device 200, the control panel 300, and the electrical equipment 400, and information on specific control contents of the electrical equipment 400. Note that not all of the above-described information needs to be included in the control information, and the included information can be appropriately changed as long as the control target and the control content are known.

[0060] Thereafter, the processor 512 of the management device 500 processes the control information according to a predetermined program stored in the memory 513 (S12). As a specific example, the processor 512 rewrites or converts the control information into a format corresponding to the control panel 300 based on the information of the control panel 300 included in the control information. That is, the processor 512 processes the control information generated based on the rules handled in the management device 500 to generate control information executable in the control panel 300. This is because the information handling and generation rules are different between the facility 2, which is a closed space, and the management system 3, which is a different space. Note that the processing in S12 may be executed simultaneously with or after the VPN connection processing described later. Also, the processing in S12 may not be executed depending on the information handling and generation rules in the control panel 300 and the management device 500.

[0061] Next, the processor 112 of the communication device 100 periodically executes processing related to the VPN connection with the control device 200 according to a predetermined program stored in the memory 111 (S13). As a specific example, the processor 112 periodically reads and executes a program related to the VPN connection stored in the memory 111. Specifically, since the program includes information on the control device 200 and the control panel 300 of the connection destination, the processor 512 identifies the control device 200 connected to the control panel 300 of the electrical equipment 400 to be controlled and sets it as the VPN connection destination. Then, the processor 512 performs authentication processing, encryption processing, and tunneling processing based on a preset communication protocol and encryption method. After that, on the control device 200 side, authentication processing for permitting the VPN connection by the processor 212 is also performed, and the VPN connection between the communication device 100 and the control device 200 is established (T11). Note that the VPN connection itself is an example of a communication method in a confidential state, and of course, other communication methods capable of communication confidentiality may also be used.

[0062] Thereafter, the processor 512 of the management device 500 transmits control information to the communication device 100 via the communication interface 514 (T12), and further transmits it to the control device 200 beyond via the VPN connection (T13). Here, according to the above specific example, the transmission of information between the management device 500 and the communication device 100 is performed in a confidential state, and further, the transmission of information between the communication device 100 and the control device 200 is also performed in a confidential state by the VPN connection.

[0063] The processor 212 of the control device 200 transmits the received processed control information to the control panel 300 via the communication interface 213 and the switch 220 (T14). Here, according to the above specific example, the control device 200 is positioned as a window for VPN connection. The information received by the control device 200 is processed into a format corresponding to the control panel 300, and the control device 200 and the control panel 300 are communicably connected by wired or wireless communication. That is, according to the above specific example, the control device 200 directly transmits the processed control information to the control panel 300. That is, according to the above specific example, the processed control information is transmitted from the management device 500 to the control panel 300 via the control device 200, eliminating the need for additional processing in the control device 200 and enabling simplification of the control device 200.

[0064] When the processed control information is received by the control panel 300 via the communication interface 213 and the switch 220 of the in-facility network, the control panel 300 executes control based on the processed control information (S14). Specifically, the control panel 300 determines the electrical equipment 400 to be controlled and the control content from the processed control information. Further, the control panel 300 transmits a control command to the electrical equipment 400 based on the determined control content (T13). In the electrical equipment 400, driving or operation is performed based on the control command. Note that the control panel 300 may drive other devices provided in the control panel 300 to execute driving, operation, maintenance, or inspection of the electrical equipment 400. Also, when transmitting information acquired by the electrical equipment 400 (for example, imaging information by a camera) from the control panel 300 to the management device 500, contrary to the above-described sequence, the acquired information may be transmitted from the control panel 300 to the control device 200 via the switch 220 and then from the control device 200 to the management device 500 via the communication device 100.

[0065] (B) Processing related to the determination of the control device 200 that transmits control information in the control unit 6 FIG. 5B is a diagram showing a processing sequence executed among the first control device, the second control device, and the third control device according to the present disclosure. Specifically, FIG. 5B shows a case where the control unit 6 is composed of three control devices 200, namely the first control device 200A, the second control device 200B, and the third control device 200C, and determines which of these will transmit the control information received from the management device 500 to the control panel. Note that in FIG. 5B, although it is composed of three control devices 200, namely the first control device 200A, the second control device 200B, and the third control device 200C, from the viewpoints of installation cost and communication reliability, etc., it is also possible to be composed of four or more control devices 200. In such a case, it is possible to further improve the communication reliability.

[0066] (B-1) Processing in the multi-node operating state where the first control device 200A, the second control device 200B, and the third control device 200C are operable According to FIG. 5B, each processor 212 of the first control device 200A, the second control device 200B, and the third control device 200C executes a process for determining itself as the transmission source of the control information by executing a distributed consensus algorithm. Specifically, each processor 212 of the first control device 200A, the second control device 200B, and the third control device 200C generates candidate information indicating that it stands as a candidate for becoming the transmission source of the control information and transmitting the control information to the control panel at a random timing of a certain width (S21). Note that in FIG. 5B, since it is shown that the second control device 200B first becomes the operating state, the process related to the generation of the candidate information is executed only by the second control device 200B, but of course, it is also executed at the respective random timings of a certain width in the first control device 200A and the third control device 200C. That is, when the first control device 200A and the third control device 200C generate the candidate information, the subsequent processes are performed in the same manner as in FIG. 5B.

[0067] Also, the timing of generating candidate information in each control device 200 is determined as follows as an example. The control device 200 that has become the actual operating state with confidence determined as the transmission source of the control information by transmitting the candidate information transmits declaration information to other control devices 200. And thereafter, the control device 200 continues to transmit the declaration information to other control devices 200 regularly, and other control devices 200 that receive it reset the information each time. However, if a failure occurs in the control device 200 in the actual operating state, the above reset will not be performed. Other control devices 200 generate and transmit candidate information as described above at the timing when it is detected that the reset has not been performed.

[0068] The processor 212 of the second control device 200B transmits the candidate information (T21) generated via the communication interface 213 to the first control device 200A and the third control device 200C included in the control unit 6. Each processor 212 of the first control device 200A and the third control device 200C that has received the candidate information executes processing related to the generation of response information (S22). The details of the processing will be described in FIG. 6B. Here, it is assumed that the status information associated with the ID information of each own control device is not in the "actual operating state" but in the "standby state". Therefore, each processor 212 of the first control device 200A and the third control device 200C will generate response information indicating "approval". Each processor 212 of the first control device 200A and the third control device 200C transmits the generated response information (T22) indicating "approval" to the second control device 200B that has transmitted the candidate information via each communication interface 213. Note that the first control device 200A and the third control device 300C that have received the candidate information may not transmit a response signal indicating "approval" if they are capable of transmitting a control signal themselves.

[0069] The processor 212 of the second control device 200B executes a determination process (S23) to determine whether it may be determined that it is the transmission source of the control information based on the received response information by executing a distributed consensus algorithm. Then, when the processor 212 of the second control device 200B satisfies a predetermined condition, it generates declaration information (S24) indicating that it has become the transmission source for transmitting control information to the control panel.

[0070] The processor 212 of the second control device 200B transmits the generated declaration information (T23) to the first control device 200A and the third control device 200C via the communication interface 213. Then, the processor 212 of the second control device 200B updates the status information associated with its own control device ID information in the control information table from the "standby state" to the "active state", and actually transmits control information to the control panel associated with the control panel ID information via the communication interface 213 (S25). Note that the details of the processes related to S23 and S24 in FIG. 5B will be described later in FIG. 6B.

[0071] Here, FIG. 7A is a diagram showing an example of the actual operation status of the control unit 6 in the multi-node operation state. Specifically, FIG. 7A is a diagram showing the actual operation status when a series of processes of S21 to S25 in FIG. 5B are performed in the multi-node operation state where all of the first control device 200A, the second control device 200B, and the third control device 200C are in an operable state (i.e., standby state).

[0072] According to FIG. 7A, the control panel 300 communicates with the management device 500 via the Internet line 4 through a communication path connecting the second control device 200B and the Internet line 4. Here, since no particular failure or the like has occurred in any of the control devices 200, any of the control devices 200 is in a standby state where transmission of control information is possible, and the control unit 6 will operate in a multi-node operation state. Therefore, each of the processors 212 of the first control device 200A, the second control device 200B, and the third control device 200C executes a distributed consensus algorithm, that is, each process of S21 to S25 in FIG. 5B, whereby the second control device 200B is determined as the transmission source of the control information. Then, the second control device 200B transmits information indicating that itself is the transmission source of the control information to the management unit 3. The management device 500 of the management unit 3 transmits information such as control information to the second control device 200B as the destination in response to the reception of the information. As a result, as shown in FIG. 7A, the control information is transmitted from the second control device 200B to the control panel 300 via the communication line between the second control device 200B and the control panel 300.

[0073] On the other hand, the first control device 200A and the third control device 200C, which have not been determined as the transmission source by the distributed consensus algorithm, will remain in the standby state without transmitting the control information.

[0074] (B-2) Processing in the multi-node operation state in which the first control device 200A and the third control device 200C are operable Returning to FIG. 5B again, in the second control device 200B that is transmitting the control information, failures such as a communication failure in communication with the control panel 300 and a communication failure in communication with the management device 500 may occur. In such a case, the processor 212 of the second control device 200B updates the status information associated with its own control device ID information in the control information table to the "failure state".

[0075] On the other hand, the processors of the first control device 200A and the third control device 200C that can operate normally generate candidate information (S31) indicating that they are candidates to become the transmission sources of control information and transmit the control information to the control panel at random timings with a certain width, similarly to S21. In FIG. 5B, since it is shown that the first control device 200A is in an operating state instead of the second control device 200B, the process related to the generation of candidate information is executed only by the first control device 200A. Naturally, it is also executed at random timings with a certain width in the third control device 200C. That is, when the third control device 200C generates candidate information, the subsequent processes are performed in the same manner as in FIG. 5B.

[0076] The processor 212 of the first control device 200A transmits the candidate information (T31) generated via the communication interface 213 to the third control device 200C included in the control unit 6. At this time, since the second control device 200B is in a "fault state", the candidate information is not transmitted or, if transmitted, cannot be received. The processor 212 of the third control device 200C that has received the candidate information executes the process related to the generation of response information (S32). The details of this process will be described in FIG. 6B. Here, it is assumed that the status information associated with its own control device ID information is not in the "operating state" but in the "standby state". Therefore, the processor 212 of the third control device 200C will generate response information indicating "approval". The processor 212 of the third control device 200C transmits the generated response information (T32) indicating "approval" via each communication interface 213 to the first control device 200A that has transmitted the candidate information. When the status information associated with its own control device ID information is in the "operating state", since it can directly transmit control information, it does not transmit response information indicating "approval". Also, since the second control device 200B has not received the candidate information as described above, no response information is transmitted from the second control layer 200B.

[0077] The processor 212 of the first control device 200A executes a determination process (S33) of determining whether it may be determined that it is the transmission source of the control information based on the received response information by executing a distributed consensus algorithm. Then, when the processor 212 of the first control device 200A satisfies a predetermined condition, it generates declaration information (S34) indicating that it has become the transmission source that transmits control information to the control panel.

[0078] The processor 212 of the first control device 200A transmits the generated declaration information (T33) to the third control device 200C via the communication interface 213. Then, the processor 212 of the first control device 200A updates the status information associated with its own control device ID information in the control information table from the "standby state" to the "operating state", and actually transmits control information to the control panel associated with the control panel ID information via the communication interface 213 (S35). The details of the processes related to S33 and S34 in FIG. 5B will be described later with reference to FIG. 6B.

[0079] Here, FIG. 7B is a diagram showing an example of the operating status of the control unit 6 in the multi-node operating state. Specifically, FIG. 7B shows the operating status when a series of processes of S31 to S35 in FIG. 5B are performed in a multi-node operating state in which the first control device 200A and the third control device 200C among the first control device 200A, the second control device 200B, and the third control device 200C are in an operable state (i.e., the standby state).

[0080] According to FIG. 7B, the control panel 300 communicates with the management device 500 via the Internet line 4 through a communication path connecting the first control device 200A and the Internet line 4. Here, although a failure has occurred in the second control device 200B and control information cannot be transmitted or received, the first control device 200A and the third control device 200C are in a standby state where transmission of control information is possible, and the control unit 6 will operate in a multi-node operation state. Therefore, each processor 212 of the first control device 200A and the third control device 200C executes a distributed consensus algorithm, that is, each process of S31 to S35 in FIG. 5B, whereby the first control device 200A is determined as the transmission source of the control information. Then, the first control device 200A transmits information indicating that it has become the transmission source of the control information to the management unit 3. The management device 500 of the management unit 3 transmits information such as control information to the first control device 200A as the destination in response to the reception of the said information. As a result, as shown in FIG. 7B, control information is transmitted from the first control device 200A to the control panel 300 via the communication line between the first control device 200A and the control panel 300.

[0081] On the other hand, the third control device 200C which has not been determined as the transmission source by the distributed consensus algorithm will remain in the standby state without transmitting the control information and will wait.

[0082] (B-3) Processing in the single-node operation state where only the first control device 200A is operable Returning to FIG. 5B again, failures such as communication failures in communication with the control panel 300 and communication failures in communication with the management device 500 may occur in the second control device 200B and the third control device 200C. In such a case, each processor 212 of the second control device 200B and the third control device 200C may update the status information associated with its own control device ID information in the control information table to the "fault state".

[0083] On the other hand, similar to S21, the processor of the first control device 200A that can operate normally generates candidate information (S41) indicating that it is a candidate to be the source of control information and transmit control information to the control panel at random timings of a certain width respectively. In FIG. 5B, since the second control device 200B and the third control device 200C are in a failure state respectively, candidate information is not generated.

[0084] The processor 212 of the first control device 200A transmits the candidate information (T41) generated via the communication interface 213 to the third control device 200C included in the control unit 6. At this time, since the second control device 200B and the third control device 200C are in a "failure state", the candidate information is not transmitted or, if transmitted, cannot be received. Therefore, response information is not generated in either the second control device 200B or the third control device 200C, and the first control device 200A does not receive the response information.

[0085] If a predetermined number of response information indicating approval cannot be received based on all the response information received after the elapse of a predetermined period, the processor 212 of the first control device 200A executes the determination process of the source even in the single-node operation state (S42). Then, the processor 212 of the first control device 200A updates the status information associated with its own control device ID information in the control information table from the "standby state" to the "active state" via the communication interface 213 (S43), and actually transmits control information to the control panel associated with the control panel ID information via the communication interface 213 (S44). The details of the processes related to S42 and S43 in FIG. 5B will be described later with reference to FIG. 6B.

[0086] Here, FIG. 7C is a diagram showing an example of the actual operation status of the control unit 6 in the multi-node operation state. Specifically, FIG. 7C shows the actual operation status when a series of processes from S41 to S34 in FIG. 5B are performed in the single-node operation state where only the first control device 200A among the first control device 200A, the second control device 200B, and the third control device 200C is operable (i.e., the standby state).

[0087] According to FIG. 7C, the control panel 300 communicates with the management device 500 via the Internet line 4 through a communication path connecting the first control device 200A and the Internet line 4. Specifically, for example, the processor 512 of the management device 500 transmits information such as control information with the first control device 200A, the second control device 200B, and the third control device 200C as destinations. Here, although a failure occurs in the second control device 200B and the third control device 200C and control information cannot be transmitted or received, only the first control device 200A is in a standby state where transmission of control information is possible, and the control unit 6 operates in a single-node operation state. Therefore, regardless of the distributed consensus algorithm, that is, by executing each process from S41 to S44 in FIG. 5B, the first control device 200A is determined as the transmission source of control information. As a result, as shown in FIG. 7C, control information is transmitted from the first control device 200A to the control panel 300 via the communication line between the first control device 200A and the control panel 300.

[0088] In this way, in FIGS. 7A and 7B, the control device 200 that is actually operating is determined only by the first control device 200A, the second control device 200B, and the third control device 200C by the distributed consensus algorithm, enabling efficient operation. Also, in FIG. 7C, even when the operable control device 200 is only the first control device 200A and response information indicating approval cannot be received from other control devices 200, it is possible to determine a control device 200 that is determined and operates flexibly in the single-node operation state.

[0089] In addition, in FIG. 5B, although not particularly shown, the first control device 200A and the third control device 200C can execute the same processing as S21 to S25 of the second control device 200B. Also, in FIG. 5B, although not particularly shown, the third control device 200C can execute the same processing as S31 to S35 of the first control device 200A.

[0090] 6. Processing Flow of Control Unit 6 in Control System 1 (A) Processing related to generation of response information FIG. 6A is a diagram showing a processing flow executed by the processor 212 of the control device 200 according to the present disclosure. Specifically, FIG. 6A is a diagram showing the flow of processing related to the generation of response information performed by the first control device 200A and the third control device 200C in S22 and S32 of FIG. 5B. This processing flow is mainly performed by the processor 212 of the control device 200 reading and executing a program stored in the memory 211. In S21 to S25 of FIG. 5A, the case where candidate information is transmitted from the second control device 200B is described, so this processing flow is executed in the first control device 200A and the third control device 200C. However, when candidate information is transmitted from the first control device 200A, this processing flow is executed in the second control device 200B and the third control device 200C, and when candidate information is transmitted from the third control device 200C, this processing flow is executed in the first control device 200A and the second control device 200B. Similarly, in S31 to S35 of FIG. 5B, the case where candidate information is transmitted from the first control device 200A is described, so this processing flow is executed in the third control device 200C. However, when candidate information is transmitted from the third control device 200C, this processing flow is executed in the first control device 200A.

[0091] According to FIG. 6A, the processor 212 receives candidate information (S201) from any other control device 200 (the second control device 200B in the case of S22 in FIG. 5B) via the communication interface 213. The candidate information is information indicating that it is a candidate for being the source of control information and transmitting the control information to the control panel 300. When receiving the candidate information, the processor 212 refers to the status information associated with the control device ID of its own control device 200 to check whether it is in a "standby state" indicating that it is operable as a source. Then, when it is confirmed that the status information is in the "standby state", the processor 212 determines that it is "approve" of the candidacy of the other control device 200 (Yes in S202), and generates response information indicating approval (S203).

[0092] Next, the processor 212 transmits the response information generated in S203 to the other control device (the second control device 200B in the case of S22 in FIG. 5B) that has transmitted the candidate information via the communication interface 213 (S204). In addition, when a failure or the like has occurred in the control device 200, response information indicating approval is not generated, and such information is not transmitted to the other control device 200. Thus, the processing flow ends.

[0093] (B) Processing related to determination of the operating control device 200 FIG. 6B is a diagram showing a processing flow executed by the processor 212 of the control device 200 according to the present disclosure. Specifically, FIG. 6B is a diagram showing a flow of processing related to generation of response information performed by the first control device 200A and the second control device 200B in S23 and S24, S33 and S33, and S42 and S43 of FIG. 5B. The processing flow is mainly performed by the processor 212 of the control device 200 reading and executing a program stored in the memory 211. In S23 and S24 of FIG. 5B, since the second control device 200B is a candidate, the processing flow is executed in the second control device 200B. However, even when either the first control device 200A or the third control device 200C is a candidate, the same processing flow is executed in each control device. In S33 and S33, and S42 and S43 of FIG. 5B, since the first control device 200A is a candidate, the processing flow is executed in the first control device 200A. However, even when either the second control device 200B or the third control device 200C is a candidate, the same processing flow is executed in each control device.

[0094] According to FIG. 6B, the processor 212 determines whether or not a predetermined time has elapsed after transmitting candidate information to another control device 200 (S101). During this period, when the processor 212 receives response information from another control device that has received the candidate information via the communication interface 213, the processor 212 stores the received response information in the memory 211 at any time. If the time has not elapsed yet, the processor 212 waits until it elapses.

[0095] On the one hand, when the elapsed time has passed, the processor 212 counts the number of response information indicating approval that has been received from other control devices 200 that have received the candidate information and stored in the memory 211 during that period. The processor 212 checks whether, as a result of the counting, it has received response information indicating approval that is equal to or more than a predetermined number that can be determined based on the distributed consensus algorithm (S102). This number is preferably set to the number of other control devices 200 (for example, one) that are minimally required to operate in a multi-node operation state with its own control device 200. However, of course, it is not limited to only one, and any number can be set.

[0096] When the processor 212 determines that it has received response information equal to or more than a predetermined number (for example, one), it determines that a decision can be made by the distributed consensus algorithm, and counts the number of response information indicating "approval" in the response information. Then, the processor 212 checks whether, as a result of the counting, it has obtained response information indicating approval that is equal to or more than a predetermined number (S103). This number is set to, for example, more than half of the number of the remaining control devices 200 excluding the control device 200 that transmitted the candidate information. For example, when there are a first control device 200A, a second control device 200B, and a third control device 200C, and the second control device 200B transmits the candidate information, since it is more than half of the two control devices 200A and 200C, "2" is set. Also, when only the first control device 200A and the third control device 200C are operating and the first control device 200A transmits the candidate information, since the remainder is only the third control device 200C, "1" is set. However, it is not limited to the "2" or "1", and any number can be set.

[0097] When the processor 212 determines that it has received response information indicating a predetermined number (e.g., two) or more of "approvals", it generates declaration information indicating that it will be the source of the control information and transmit the control information to the control panel (S104). Then, the processor 212 transmits the generated declaration information to all the control devices 200 that have transmitted the response information via the communication interface 213 (S105), and updates the status information associated with its own control device ID information in the control information table to "operational state". On the other hand, when the processor 212 determines that it has not received response information indicating a predetermined number (e.g., two) or more of "approvals", it removes itself as a candidate to be the source of the control information (S106). In this case, the processor 212 transmits removal information to all the control devices 200 that have transmitted the response information via the communication interface 213 as necessary.

[0098] Next, when the processor 212 determines in S102 that it has not received response information indicating a predetermined number (e.g., one) or more of approvals, it determines that a failure has occurred in another control device 200. Then, the processor 212 first determines whether it is possible to communicate with the control panel 300 in order to confirm whether it is possible to transmit control information in the single-node operation state (S107). Although the specific method is not particularly illustrated, for example, the processor 212 can transmit a confirmation signal to the control panel 300 via the communication interface 213 and determine based on whether it has received response information from the control panel 300.

[0099] When the processor 212 determines in S107 that it is possible to communicate with the control panel 300, it similarly confirms whether it is possible to communicate with the management device 500 etc. via the Internet line 4 (S108). Although the specific method is not particularly illustrated, for example, the processor 212 can transmit a confirmation signal to the management device 500 via the communication interface 213 and determine based on whether it has received response information from the management device 500.

[0100] When the processor 212 determines in S108 that it can communicate via the Internet line 4, it determines itself as the source of the control information regardless of the presence or absence of response information from other control devices 200 (S109). That is, in this case, the source of the control information is determined without performing the processing by the distributed algorithm determined by the number of "approval" response information. Then, the processor 212 updates the status information associated with its own control device ID information in the control information table to the "operational state" (S110). Thus, the present processing flow ends.

[0101] According to FIG. 6B, when a decision can be made by the distributed consensus algorithm, since the decision of the control device 200 serving as the source is made only by a plurality of control devices 200, more efficient decision processing is possible. Further, even when the distributed consensus algorithm cannot be executed, since decision processing unrelated to the distributed consensus algorithm can be performed, the transmission process of the control information is not delayed, and stable transmission of the control information is possible.

[0102] As described above, in the present embodiment, it is possible to preferably provide a control device, a control program, a control method, a control unit, and a control system capable of transmitting control information to the control panel of the electrical equipment.

[0103] 7. Modification Example (1) Configuration including switches In the control system 1 of FIG. 1, the control unit 6 is composed of three control devices 200. However, instead of this, as shown in FIG. 8, the control unit 600 can also be composed of three control devices 200, a switch 220A, and a switch 220B. That is, FIG. 8 is a diagram showing a schematic configuration of the control system 1000 according to the present disclosure. In the following, the configuration of the control system 1000 of FIG. 8 will be described, but parts that perform the same configuration and processing as the control system 1 shown in FIGS. 1 to 7C are not particularly mentioned again.

[0104] According to FIG. 8, in the control system 1000, the facility 2 is communicably connected to the management device 500 of the management system 3 via the Internet line 4. In the facility 2, an equipment unit 5 and a control unit 600 are installed. The equipment unit 5 includes a control panel 300 pre-installed in the facility 2 and electrical equipment 400 such as an elevator controlled by the control panel 300. The control unit 600 is communicably connected to the control panel 300 of the equipment unit 5 by wire or wirelessly, and relays the communication between the control panel 300 and the Internet line 4. A plurality of control devices 200 (a first control device 200A, a second control device 200B, and a third control device 200C), and a plurality of switches 220 (a first switch 220A and a second switch 220B) are installed in the control unit 600. These devices are communicably connected by the wired or wireless internal network of the facility 2.

[0105] The control device 200 functions as a gateway for data communication in the facility 2, enabling the transmission and reception of data between the outside of the facility 2 and the Internet line 4. Specifically, the control device 200 can communicate with other control devices 200 installed in the control unit 600. Further, the control device 200 can relay the communication between the control panel 300 and the management device 500.

[0106] The management system 3 includes a communication device 100 for communicably connecting to the control device 200 and a management device 500 for managing the electrical equipment 400 of the facility 2. The communication device 100 is communicably connected to the management device 500 within the management system 3 for information transmission and reception.

[0107] In the control system 1000, the management device 500 can remotely control and manage facilities such as the electrical equipment 400 in the facility 2. Here, the management device 500 performs such management through data transmission and reception via the communication device 100. For example, between the communication device 100 and the control device 200, the confidentiality of various transmitted and received information is ensured through a VPN connection. That is, remotely managing the electrical equipment 400 in the facility 2 from the management device 500 ensures security and is executed safely and reliably.

[0108] By utilizing the control system 1000 according to the present disclosure, in a multi-node operating state where a plurality of control devices 200 can operate, a control device 200 that becomes an operating state as a transmission source of control information is determined by executing a distributed consensus algorithm. Therefore, it is possible to suppress the overlapping of operations when a plurality of control devices 200 are in an operating state. Also, in a single-node operating state where only one control device 200 can operate, a control device 200 that can operate without executing a distributed consensus algorithm is determined as the transmission source. Therefore, even in a state where the distributed consensus algorithm cannot be executed, it is possible to suitably transmit control information.

[0109] Here, in the control system 1000 configured as described above, the number of output ports as the communication interface 113 of the control device 200 may be limited. For example, when the output ports of the first control device 200A are limited to two, if one is connected to the control panel 300 and the other is connected to the second control device 200B, it cannot be connected to the third control device 200C. Therefore, in the example of FIG. 8, a switch is interposed between the first control device 200A and the control panel 300, and the first switch 220A is operated to enable connection to the third control device 200C. In this way, it is possible to compensate for the shortage of output ports by interposing a switch between the control device 200 and the control panel 300.

[0110] Specifically, as shown in FIG. 8, the control unit 6 includes a first switch 220A and a second switch 220B between each control device 200 and the control panel 300. That is, the control information transmitted from any of the plurality of control devices 200 is transmitted to the control panel 300 via either the first switch 220A or the second switch 220B.

[0111] According to FIG. 8, the first switch 220A is connected to the first control device 200A and the second control device 200B, and the second switch 220B is connected to the third control device 200C. Also, the first switch 220A and the second switch 220B are communicably connected to each other.

[0112] A case where all three control devices, i.e., the first control device 200A, the second control device 200B, and the third control device 200C, are in an operable standby state will be described. When the first control device 200A is determined as the transmission source of the control information by the processing of the distributed consensus algorithm shown in FIGS. 5B and 6B, the first switch 220A is turned on by transmitting a switching signal to the first switch 220A, and the transmission of the control information between the first control device 200A and the control panel 300 is relayed. Similarly, when the second control device 200B is determined as the transmission source of the control information by the distributed consensus algorithm, the first switch 220A is turned on by transmitting a switching signal to the first switch 220A, and the transmission of the control information between the second control device 200B and the control panel 300 is relayed. Also, when the third control device 200C is determined as the transmission source of the control information by the distributed consensus algorithm, the second switch 220B is turned on by transmitting a switching signal to the second switch 220B, and the transmission of the control information between the third control device 200C and the control panel 300 is relayed. As a result, the control information is transmitted from each control device 200 to the control panel 300.

[0113] Incidentally, in the first control device 200A, the second control device 200B, and the third control device 200C, in the case of a configuration where the number of output ports is limited and no switch is required, a failure may occur in any one of the first control device 200A, the second control device 200B, and the third control device 200C, and only the remaining two control devices may be in an operable state. For example, even if a failure occurs only in the second control device 200B, the first control device 200A and the third control device 200C are not connected to each other, and the first control device 200A and the third control device 200C cannot transmit and receive candidate information (T21 in FIG. 5B) and response information (T22 in FIG. 5B) to and from each other. Then, from the perspective of the first control device 200A, the third control device 200C is determined as if a failure has occurred even though it is normally operable. That is, for the first control device 200A, in each of the processes of S102, S107, and S108 in FIG. 6B, since information cannot be transmitted and received between the remaining two control devices, a predetermined number of response information cannot be received, and the decision process by the distributed consensus algorithm cannot be executed (No in S102). On the other hand, since the third control device 200C itself is in a state where communication with the control panel 300 and communication via the Internet line 4 are possible (Yes in both S107 and S108), each of the first control device 200A and the third control device 200C is determined to be in a single-node operation state alone, and each will shift to an active state where it is the transmission source of control information. Then, each of the remaining two control devices tries to transmit control information, and a problem of overlapping processes occurs.

[0114] Therefore, as shown in FIG. 8, by enabling the remaining two control devices to communicate with each other via the first switch 220A and the second switch 220B, transmission and reception of response information are enabled, and the decision process by the distributed consensus algorithm is executed. As a result, it is possible to prevent the processes from overlapping when each of the remaining two control devices tries to transmit control information.

[0115] Here, a case where a failure occurs in the second control device 200B and the first control device 200A and the third control device 200C are in an operational awareness state will be described with reference to FIG. 5B. Each processor of the first control device 200A and the third control device 200C that can operate normally generates candidate information (S31) indicating that it is a candidate to be the source of control information and transmit control information to the control panel at random timings with a certain width. In FIG. 5B, since it is shown that the first control device 200A becomes the actual operating state instead of the second control device 200B, the process related to the generation of candidate information is executed only by the first control device 200A, but of course, it is also executed at random timings with a certain width in the third control device 200C. That is, when the third control device 200C generates candidate information, the subsequent processes are performed in the same manner as in FIG. 5B.

[0116] The processor 212 of the first control device 200A transmits the candidate information (T31) generated via the communication interface 213 to the third control device 200C included in the control unit 6. At this time, although the first control device 200A and the third control device 200C are not directly communicably connected to each other, the candidate information is transmitted from the first control device 200A to the third control device 200C via the first switch 220A connected to the first control device 200A and the second switch 220B connected to the third control device 200C. The processor 212 of the third control device 200C that has received the candidate information executes the process related to the generation of response information (S32). Here, it is assumed that the status information associated with its own control device ID information is not in the "operational state" but in the "standby state". Therefore, the processor 212 of the third control device 200C generates response information indicating "approval".

[0117] The processor 212 of the third control device 200C transmits response information (T32) indicating the generated "approval" to the first control device 200A that has sent candidate information via each communication interface 213. At this time, although the first control device 200A and the third control device 200C are not directly communicably connected to each other, the response information is transmitted from the third control device 200C to the first control device 200A via the first switch 220A connected to the first control device 200A and the second switch 220B connected to the third control device 200C.

[0118] The processor 212 of the first control device 200A executes a determination process (S33) to determine whether it is acceptable to determine that it is the source of control information based on the received response information by executing a distributed consensus algorithm. Then, when a predetermined condition is satisfied, the processor 212 of the first control device 200A generates declaration information (T33) indicating that it has become the source of transmitting control information to the control panel (S34).

[0119] The processor 212 of the first control device 200A transmits the generated declaration information (T33) to the third control device 200C via the communication interface 213. At this time, although the first control device 200A and the third control device 200C are not directly communicably connected to each other, the declaration information is transmitted from the first control device 200A to the third control device 200C via the first switch 220A connected to the first control device 200A and the second switch 220B connected to the third control device 200C. Then, the processor 212 of the first control device 200A updates the status information associated with its own control device ID information in the control information table from the "standby state" to the "active state", and actually transmits control information to the control panel associated with the control panel ID information via the communication interface 213 (S35).

[0120] In this way, various types of information such as candidate information, response information, and declaration information can be transmitted and received between the first control device 200A and the third control device 200C via the first switch 220A and the second switch 220B. Therefore, when the processor 212 determines whether it has received the response information in S102 of FIG. 6B, it is also possible to make a normal determination, and it is possible to prevent a situation where both the first control device 200A and the third control device 200C are determined as the transmission sources.

[0121] Note that in FIG. 8, the case where the first switch 220A and the second switch 220B are included has been described, but the number of such switches can be appropriately changed according to the number of control devices 200.

[0122] (2) Operating control device In the above embodiment, it has been described that three first control devices 200A, second control devices 200B, and third control devices 200C are used, but four or more control devices 200 may be used. Also, in the above embodiment, it has been described that one operating control device is determined by communicating between the first control device 200A, the second control device 200B, and the third control device 200C, but a plurality of operating control devices may be determined. The operating control device determined by communicating between the first control device 200A, the second control device 200B, and the third control device 200C may be used as a temporary determination, and the management device 500 may make a final determination. Further, in the above embodiment, it has been described that the operating control device is changed when a failure occurs in any of the first control device 200A, the second control device 200B, and the third control device 200C, but for example, a process of periodically changing the operating control device may be executed.

[0123] The processes and procedures described in this specification can be implemented not only by those explicitly described in this disclosure, but also by software, hardware, or a combination thereof. Specifically, the processes and procedures described in this specification are realized by implementing the logic corresponding to the processes in media such as integrated circuits, volatile memories, non-volatile memories, magnetic disks, and optical storage. Also, the processes and procedures described in this specification can be implemented as a computer program and executed on various computers including terminal devices and management devices.

[0124] Even if it is described that the processes and procedures described in this specification are executed by a single device, software, component, or module, such processes or procedures can be considered to be executed by a plurality of devices, a plurality of software, a plurality of components, and / or a plurality of modules. Also, even if it is described that various information described in this specification is stored in a single memory or storage unit, such information can be considered to be distributed and stored in a plurality of memories provided in a single device or a plurality of memories distributed in a plurality of devices. Furthermore, the software and hardware elements described in this specification can be considered to be realized by integrating them into fewer components or decomposing them into more components.

Description of Reference Numerals

[0125] 1 Control system 3 Management system 6 Control unit 200 Control device 212 Processor 300 Control panel 400 Electrical equipment 500 Management device

Claims

1. A first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, wherein the at least one processor is configured to: transmit candidate information indicating that the first control device is a candidate for the source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device; when receiving response information to the candidate information from the second control device and the third control device respectively, determine whether the first control device is the source of the control information based on the received response information; A first control device configured to execute a process for the above purposes.

2. The first control device according to claim 1, wherein when the response information cannot be received from the second control device, it is determined whether the first control device is the source of the control information based on the response information received from the third control device.

3. The first control device according to claim 2, wherein the at least one processor is configured to execute a process for determining that a failure has occurred in the second control device when the response information cannot be received from the second control device.

4. The first control device according to claim 1, wherein when the response information cannot be received from either the second control device or the third control device, it is determined that the first control device is the source of the control information regardless of the response information.

5. When the response information can be received from at least one of the second control device and the third control device, it is determined whether the first control device is the source of the control information by executing a distributed consensus algorithm between the first control device and at least one of the second control device and the third control device that transmitted the response information; When the response information cannot be received from either the second control device or the third control device, it is determined that the first control device is the source of the control information; The first control device according to claim 1.

6. When it is determined that the first control device is the source, the at least one processor is configured to transmit declaration information indicating that it is the source to at least one of the second control device and the third control device that has transmitted the response information, and to execute a process for transmitting the control information to the control panel. The first control device according to claim 1.

7. The first control device according to claim 1, which is configured to be able to transmit control information to a control panel of electrical equipment installed in a facility, A second control device configured to be able to transmit the control information to the control panel and different from the first control device, A third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, A control unit including at least the above.

8. The first control device according to claim 1, which is configured to be able to transmit control information to a control panel of electrical equipment installed in a facility, a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device. A control unit including at least the above, A management device communicably connected to the control unit and configured to manage the control panel via the control device, A control system including the above.

9. A control panel configured to control electrical equipment installed in a facility, The first control device according to claim 1, which is configured to be able to transmit control information to the control panel, a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device. A control unit including at least the above, A management device communicably connected to the control unit and configured to manage the control panel via the control device, A control system including the above.

10. In a first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, the at least one processor is A second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, the first control device transmits candidate information indicating that the first control device is a candidate for the transmission source of the control information, when the first control device receives response information for the candidate information from the second control device and the third control device respectively, the first control device determines whether or not the first control device is the transmission source of the control information based on the received response information, A control program that functions to execute a process for this purpose.

11. In a first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, a control method executed by the at least one processor, a step of transmitting candidate information indicating that the first control device is a candidate for the transmission source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device; a step of determining whether or not the first control device is the transmission source of the control information based on the received response information when the first control device receives response information for the candidate information from the second control device and the third control device respectively; A control method including the above.

Images