Distributed control system and method for monitoring the same

Abstract

To realize superior real-time performance and availability through early detection of hardware failures.SOLUTION: A virtualization system is provided, having at least one virtualization device comprising a plurality of virtual machines and hardware resources including a plurality of hardware elements virtually allocated to correspond to the plurality of virtual machines. Each of the plurality of virtual machines has a monitoring unit for monitoring the operating state of a hardware element corresponding to the virtual machine.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a virtualization system and a method for monitoring a virtualization system. [Background technology]

[0002] For example, a distributed control system (DCS) is known as a control system that controls a plant containing various devices, in which the control functions are distributed to multiple control panels corresponding to each device. In a distributed control system, the scale of the configuration spans multiple control panels, so high manufacturing costs are an issue. In addition, since a controller such as a control panel is configured with software and hardware as an integrated unit, when the hardware is updated, the software also needs to be updated, which is also a factor in the cost. In order to solve such issues, by using virtualization technology, a distributed control system (virtualization system) with reduced manufacturing costs can be realized by running applications independently on each virtual machine in a virtualization device equipped with multiple virtual machines (VMs) on a single physical controller.

[0003] A virtualization system including this type of virtualization device requires real-time capability, and also requires availability to stably maintain control functions even when a failure occurs. Real-time capability can be achieved by making the virtualization software (hypervisor) real-time and installing a real-time OS as the OS (Operating System) on the virtual machine. On the other hand, high availability is generally achieved by making the physical controller redundant in preparation for random hardware failures. A redundant configuration includes an active device that actually outputs control signals to the control target, and a standby device that has the same configuration as the active device, and when a failure occurs in the active device, the control function is maintained by switching to the standby device in units of a control period (for example, milliseconds).

[0004] An example of a control system including a virtualization device that utilizes such virtualization technology is Patent Document 1. Patent Document 1 discloses that when a fault is detected in a physical device that runs a virtual machine among virtualized hardware resources, the correspondence between the physical device and the virtual machine is deleted and a new physical device is associated with the virtual machine, thereby maintaining the functionality of the control system. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 5855724 Summary of the Invention [Problem to be solved by the invention]

[0006] In a virtualization device provided in a virtualization system, when multiple virtual machines are constructed on the hardware resources, the hardware resources are divided and allocated to multiple hardware elements to correspond to each virtual machine. In a conventional virtualization system, the operating status of such multiple hardware elements is monitored by a virtualization environment (e.g., a hypervisor), and if a failure occurs in any one of the hardware elements, the entire virtualization device is stopped, which may reduce availability. In addition, after a failure is detected by the virtualization environment, it is notified to the virtual machine, and then a switchover occurs between the working device and the standby device, which may reduce real-time performance or increase the duration of operation downtime due to insufficient measures.

[0007] In addition, the monitoring of the operating status of each of these hardware elements may be performed by an external management system. In this case, when a fault is detected by the management system, a notification to that effect is sent by warning or email. However, if measures are taken after receiving such a fault detection warning or email notification, it takes time from the detection of the fault to the implementation of the measures, which may result in a decrease in real-time performance or an increase in downtime due to measures not being implemented in time. Furthermore, the installation of an external management system may also increase costs. Furthermore, if a single management system is configured to detect anomalies in multiple virtualized environments, it may be impossible to detect faults in all virtualized environments if the management system breaks down.

[0008] At least one embodiment of the present disclosure has been made in consideration of the above-mentioned circumstances, and aims to provide a virtualization system and a method for monitoring a virtualization system that can achieve excellent real-time performance and availability by detecting hardware failures early. [Means for solving the problem]

[0009] In order to solve the above problem, a virtualization system according to at least one embodiment of the present disclosure includes: A plurality of virtual machines; a hardware resource including a plurality of hardware elements virtually assigned to correspond to the plurality of virtual machines, respectively; A virtualization system having at least one virtualization device comprising: Each of the plurality of virtual machines includes a monitoring unit for monitoring an operating state of the hardware element corresponding to the virtual machine.

[0010] In order to solve the above problem, a method for monitoring a virtualization system according to at least one embodiment of the present disclosure includes: A plurality of virtual machines; a hardware resource including a plurality of hardware elements virtually assigned to correspond to the plurality of virtual machines, respectively; A method for monitoring a virtualization system having at least one virtualization device comprising: The operating state of the hardware element corresponding to the virtual machine is monitored by each of the plurality of virtual machines. Effect of the Invention

[0011] According to at least one embodiment of the present disclosure, it is possible to provide a virtualization system capable of achieving excellent real-time performance and availability by detecting a hardware failure at an early stage, and a method for monitoring a virtualization system. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a configuration diagram of a virtualization system according to a first embodiment. [Diagram 2] This is a first modified example of FIG. [Diagram 3] FIG. 11 is a configuration diagram of a virtualization system according to a second embodiment. [Figure 4] FIG. 13 is a configuration diagram of a virtualization system according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, some embodiments of the present disclosure will be described with reference to the accompanying drawings. However, the dimensions, materials, shapes, relative arrangements, etc. of components described as the embodiments or shown in the drawings are merely illustrative examples and are not intended to limit the scope of the present disclosure.

[0014] FIG. 1 is a configuration diagram of a virtualization system 100A according to the first embodiment. The virtualization system 100A is a virtualized control system for controlling a control target (not shown). The virtualization system 100A functions as a control system to output a control signal for controlling the control target. The control target may include any device that can be controlled based on a control signal output from the virtualization system 100A, but in this embodiment, a plant composed of various devices will be described as an example. The plant is, for example, a power plant (a thermal power plant, a nuclear power plant, a hydroelectric power plant, a wind power plant, etc.).

[0015] The virtualization system 100A includes at least one virtualization device 1. FIG. 1 illustrates an example in which the virtualization system 100A includes one virtualization device 1. The virtualization device 1 includes electronic components such as a central processing unit 4 (CPU), a storage device 6 (Memory), a disk 8, and a device 10 as hardware resources 2, and is equipped with a plurality of virtual machines VM1, VM2, ... by executing virtualization software in a hypervisor 12 included in the virtualization device 1. The virtual machines VM1, VM2, ... are constructed by executing virtualization software. For example, when the virtualization system 100A is configured as a distributed control system of the control target, they are constructed so as to virtually simulate each control panel corresponding to each device constituting the control target. The number of virtual machines VM1, VM2, ... constructed in the virtualization device 1 may be any number.

[0016] The hardware resources 2 of the virtualization device 1 are divided by virtualization software into hardware elements 2-1, 2-2, ... corresponding to a plurality of virtual machines VM1, VM2, respectively. Specifically, the hardware element 2-1 includes a central processing unit 4-1, a storage device 6-1, a disk 8-1, and a device 10-1 assigned to the virtual machine VM1, and the hardware element 2-2 includes a central processing unit 4-2, a storage device 6-2, a disk 8-2, and a device 10-2 corresponding to the virtual machine VM2. In other words, the central processing unit 4 is divided by the virtualization software into central processing units 4-1, 4-2, ... corresponding to the virtual machines VM1, VM2, ... respectively, the storage device 6 is divided by the virtualization software into storage devices 6-1, 6-2, ... corresponding to the virtual machines VM1, VM2, ... respectively, the disk 8 is divided by the virtualization software into disks 8-1, 8-2, ... corresponding to the virtual machines VM1, VM2, ... respectively, and the device 10 is divided by the virtualization software into devices 10-1, 10-2, ... corresponding to the virtual machines VM1, VM2, ... respectively.

[0017] Each of the virtual machines VM1, VM2, ... of the virtualization device 1 includes a monitoring unit 14-1, 14-2, .... The monitoring units 14-1, 14-2, ... are configured to monitor the operation status of the hardware elements 2-1, 2-2, ... corresponding to the virtual machines VM1, VM2, ..., respectively, and determine whether or not a failure has occurred in the hardware elements 2-1, 2-2, .... Such monitoring operations by the monitoring units 14-1, 14-2, ... may be performed by, for example, the virtual machines VM1, VM2, ... executing a predetermined application.

[0018] Here, a specific description will be given of a manner in which a failure is detected by the monitoring operation of the monitoring units 14-1, 14-2, . . . for each location where a failure occurs.

[0019] First, when a fault occurs in the central processing units 4-1, 4-2,... of the hardware elements 2-1, 2-2,..., the monitoring units 14-1, 14-2,... periodically measure the processing load of the central processing units 4-1, 4-2,... by application software in the virtual machines VM1, VM2,..., and if a high load state continues for a certain period of time, the monitoring units 14-1, 14-2,... may measure the internal core temperatures of the central processing units 4-1, 4-2,... assigned in advance to the virtual machines VM1, VM2,... by extending the function calls of the hypervisor 12, and if a high temperature state continues for a certain period of time, the monitoring units 14-1, 14-2,... may detect a fault and determine that the central processing units 4-1, 4-2,... may cause thermal runaway. In addition, the monitoring units 14-1, 14-2, ... may extend the function calls of the hypervisor 12 to give the hypervisor 12 a WDT (Watch Dog Timer) function for each virtual machine VM1, VM2, ..., and may perform fault detection and determination by detecting the stoppage of the central processing units 4-1, 4-2, ... by periodically clearing the WDT using application software in the virtual machines VM1, VM2, ....

[0020] Furthermore, when a failure occurs in the storage devices 6-1, 6-2,... among the hardware elements 2-1, 2-2,..., for example, when the virtual machines VM1, VM2,... are equipped with a memory protection function using an MMU (Memory Management Unit), the monitoring units 14-1, 14-2,... can detect and determine the failure when the storage devices 6-1, 6-2,... fail or when a virtual address not in the page table is accessed due to a transient bit error (soft error). Furthermore, when the virtual machines VM1, VM2,... are equipped with a memory controller with an ECC function and a memory with ECC, the monitoring units 14-1, 14-2,... may detect and determine the failure when a two-bit error occurs in the storage devices 6-1, 6-2,... assuming that an unauthorized access has occurred in the storage devices 6-1, 6-2,... In addition, when using storage devices 6-1, 6-2, ... that do not have an MMU, the monitoring units 14-1, 14-2, ... may detect and determine faults in the storage devices 6-1, 6-2, ... by periodically running memory self-diagnosis such as a bit walk test of the storage devices 6-1, 6-2, ... using application software in the virtual machines VM1, VM2, ....

[0021] In addition, occurrence of a fault in the disks 8-1, 8-2, ... among the hardware elements 2-1, 2-2, ... may be detected and determined in the disks 8-1, 8-2, ... by, for example, the monitoring units 14-1, 14-2, ... periodically running self-diagnosis checks on the disks 8-1, 8-2, ... using application software in the virtual machine VM.

[0022] In addition, occurrence of a fault in the devices 10-1, 10-2, ... among the hardware elements 2-1, 2-2, ... may be detected and determined by, for example, the monitoring units 14-1, 14-2, ... by extending the function calls of the hypervisor 12, and periodically running self-diagnosis of the devices 10-1, 10-2, ... that have been assigned in advance to the virtual machines VM1, VM2, ... using application software within the virtual machines VM1, VM2, ....

[0023] As described above, in the first embodiment, the operating status of the hardware elements 2-1, 2-2, ... corresponding to each virtual machine VM1, VM2, ... is monitored by the monitoring units 14-1, 14-2, ... provided respectively in the multiple virtual machines VM1, VM2, .... In this way, by monitoring the hardware elements 2-1, 2-2, ... belonging to each virtual machine VM1, VM2, ... by the monitoring units 14-1, 14-2, ... for each virtual machine VM1, VM2, ..., it is possible to detect failures in the hardware elements 2-1, 2-2, ... earlier than in the past, and effectively reduce the time required to execute the processing required to resolve or avoid the failure. As a result, it is possible to suppress a decrease in real-time performance and a decrease in operating rate due to the processing required to resolve or avoid the failure not being executed in time.

[0024] Fig. 2 is a first modified example of Fig. 1. A virtualization system 100A' according to this modified example further includes a hardware resource monitoring unit 16 for monitoring the hardware resource 2. The hardware resource monitoring unit 16 is a part of the virtualization system 100A' provided outside the virtualization device 1 for monitoring the hardware resource 2. The hardware resource monitoring unit 16 is configured to monitor the hardware resource 2, and when it detects the occurrence of a fault in the hardware resource 2, to transmit a signal to that effect (such as a warning or email) to the virtualization device 1. The destination of the signal sent by the hardware resource monitoring unit 16 is basically each virtual machine VM1, VM2, ... included in the virtualization device 1, but it is also possible to transmit the signal limited to a specified specific virtual machine VM1, VM2, ....

[0025] In this embodiment, the hardware resource monitoring unit 16 is set to transmit a signal indicating that a fault has occurred only to the virtual machine corresponding to the hardware element including the part where the fault has occurred, in response to a command from the monitoring units 14-1, 14-2, .... As a result, even when fault monitoring is performed by the hardware resource monitoring unit 16 installed outside the virtualization device 1, similarly to the embodiment of Fig. 1, by monitoring the hardware elements 2-1, 2-2, ... belonging to each virtual machine VM1, VM2, ... by the monitoring unit 14 for each virtual machine VM1, VM2, ..., faults in the hardware elements 2-1, 2-2, ... can be detected earlier than in the past, and the time required to execute processing required to resolve or avoid the fault can be effectively reduced.

[0026] 3 is a configuration diagram of a virtualization system 100B according to the second embodiment. The virtualization system 100B basically has the same configuration as the above-mentioned virtualization system 100A, but the virtualization device 1 has a plurality of virtual machines VM1, VM2, ..., which include a first virtual machine VM1 and a second virtual machine VM2 which are multiplexed or redundant with each other. In the virtualization device 1, under normal conditions, of the first virtual machine VM1 and the second virtual machine VM2 which are multiplexed or redundant with each other, one of the first virtual machine VM1 is in an operating state, and the second virtual machine VM2 is in a standby state (hot standby state) as a backup for the first virtual machine VM1.

[0027] In the virtualization system 100B, each of the virtual machines VM1, VM2, ... of the virtualization device 1 further includes a virtualization environment control unit 18-1, 18-2, .... The virtualization environment control units 18-1, 18-2, ... are configured to control the virtualization environment of the virtualization device 1 based on the monitoring results of the monitoring units 14-1, 14-2, ..., and specifically, when the monitoring unit 14-1 determines that a fault Tr has occurred in the hardware element 2-1 (in FIG. 3, the central processing unit 4-1 of the hardware element 2-1), the virtualization environment control units 18-1, 18-2, ... control the virtualization environment of the virtualization device 1 so as to stop the first virtual machine VM1 in an operating state and switch the second virtual machine VM2 in a standby state (hot standby state) to an operating state.

[0028] As a result, in the virtualization system 100B, when a fault Tr is detected in the hardware element 2-1 corresponding to the first virtual machine VM1 in an operating state, the first virtual machine VM1 in an operating state is stopped and the other second virtual machine VM2 in a standby state is switched to an operating state, thereby preventing a decrease in the operating rate of the entire virtualization system 100B and achieving high availability.

[0029] Note that Figure 3 illustrates an example in which a failure Tr occurs in a central processing unit 4-1 included in a hardware element 2-1 among the hardware resources 2 of the virtualization system 100B, but the same applies when a failure occurs in a storage device 6-1, a disk 8-1, or a device 10-1.

[0030] Next, FIG. 4 is a configuration diagram of a virtualization system 100C according to the third embodiment. The virtualization system 100C includes a first virtualization device 1A and a second virtualization device 1B. The first virtualization device 1A and the second virtualization device 1B have the same configuration as the virtualization device 1 included in the virtualization system 100B described above. The first virtualization device 1A and the second virtualization device 1B are multiplexed or redundant with each other, and normally, the first virtualization device 1A is in operation, and the second virtualization device 1B is in a standby state (hot standby state) as a backup for the first virtual machine VM1. That is, the virtual machines VM1, VM2, ... included in the first virtualization device 1A are each in operation, and the virtual machines VM1, VM2, ... included in the second virtualization device 1B are each in a standby state (hot standby state).

[0031] The virtual machines VM1, VM2, ... of the first virtualization device 1A and the second virtualization device 1B each include a virtualization environment control unit 18-1, 18-2, ... as in the embodiment shown in Fig. 3. The virtualization environment control units 18-1, 18-2, ... are configured to control the virtualization environments in the first virtualization device 1A and the second virtualization device 1B based on the monitoring results of the monitoring units 14-1, 14-2, ..., and when it is determined that a fault Tr has occurred in the first virtualization device 1A in an operating state, the virtual machine corresponding to the hardware element in which the fault Tr has occurred in the first virtualization device 1A is stopped, and the corresponding virtual machine in the second virtualization device 1B is switched to an operating state. 4 illustrates an example in which a failure Tr occurs in a hardware element 2-1 (central processing unit 4-1) corresponding to a first virtual machine VM1 included in a first virtualization device 1A, and the virtualization environment is controlled so that the first virtual machine VM1 corresponding to the hardware element 2-1 where the failure occurred is stopped from an operating state, and the corresponding first virtual machine VM1 of a second virtualization device 1B is started from a standby state. At this time, since the other virtual machines VM2, ... included in the first virtualization device 1A are operating normally, the virtual machines VM2, ... included in the second virtualization device 1B are maintained in a standby state.

[0032] In this way, in the virtualization system 100C, if a failure Tr occurs in the hardware resource 2 in the first virtualization device 1A that is in an operational state, the virtual machine VM1 corresponding to the hardware element 2-1 where the failure Tr occurred is stopped, and the corresponding virtual machine VM1 in a standby state in the other second virtualization device 1B is switched to an operational state, thereby preventing a decrease in the operating rate of the entire virtualization system 100C and achieving high availability.

[0033] In addition, within the scope of the present disclosure, the components in the above-described embodiments may be replaced with well-known components as appropriate, and the above-described embodiments may be combined as appropriate.

[0034] The contents described in each of the above embodiments can be understood, for example, as follows.

[0035] (1) A virtualization system according to one aspect includes: A plurality of virtual machines (for example, the virtual machines VM1, VM2, ... in the above embodiment), a hardware resource (e.g., the hardware resource 2 in the above embodiment) including a plurality of hardware elements (e.g., the hardware elements 2-1, 2-2, ... in the above embodiment) virtually assigned to correspond to each of the plurality of virtual machines; A virtualization system (e.g., the virtualization systems 100A, 100A', 100B, and 100C of the above embodiments) having at least one virtualization device (e.g., the virtualization devices 1, 1A, and 1B of the above embodiments) comprising: Each of the plurality of virtual machines includes a monitoring unit (for example, the monitoring units 14-1, 14-2, . . . in the above embodiments) for monitoring the operating state of the hardware element corresponding to the virtual machine.

[0036] According to the above aspect (1), the operating state of the hardware elements assigned to each virtual machine is monitored by a monitoring unit provided in each of the virtual machines. By monitoring the hardware elements corresponding to each virtual machine for each virtual machine in this manner, a fault can be detected earlier than in the past. Furthermore, the time required to execute the processing required to resolve or avoid the fault can be effectively reduced. As a result, it is possible to suppress a decrease in real-time performance and a decrease in operating rate due to the processing required to resolve or avoid the fault not being executed in time.

[0037] (2) In another embodiment, in the above embodiment (1), The monitoring unit is configured to actively monitor the operating state of the hardware element corresponding to the virtual machine.

[0038] According to the above aspect (2), each of the multiple virtual machines in the virtualization device actively monitors the hardware elements assigned to it, thereby making it possible to detect failures earlier than in the past. Note that "actively" means that each virtual machine monitors the operating state of the hardware elements assigned to it, and also includes setting the configuration so that when the operating state of each hardware element is monitored by a configuration other than the monitoring unit, if a failure is detected in the configuration, the monitoring result is sent only to the virtual machine corresponding to the hardware element in which the failure is detected.

[0039] (3) In another embodiment, in the above embodiment (1) or (2), The monitoring unit is configured to monitor, by an application executed by the virtual machine, an operating state of the hardware element corresponding to the virtual machine.

[0040] According to the above aspect (3), the virtual machine executes an application, so that the operating state of the hardware element corresponding to the virtual machine can be actively monitored.

[0041] (4) In another embodiment, in the above embodiment (1) or (2), Further comprising a hardware resource monitoring unit (for example, the hardware resource monitoring unit 16 in the above embodiment) for monitoring the hardware resource, The monitoring unit is configured to set the hardware resource monitoring unit so that, when a fault is detected by the hardware resource monitoring unit, a signal from the hardware resource monitoring unit is received only by the virtual machine corresponding to the hardware element in which the fault has occurred.

[0042] According to the above aspect (4), when the hardware resource monitoring unit monitors for a failure in a hardware resource, the monitoring unit actively sets the hardware resource monitoring unit so that the destination of a signal from the hardware resource monitoring unit when a failure is detected is limited to only the virtual machine corresponding to the hardware element in which the failure occurred. This makes it possible to detect a failure in a hardware element earlier than in the past, and effectively reduces the time required to execute processing required to resolve or avoid the failure.

[0043] (5) In another embodiment, in any one of the above (1) to (4), the plurality of virtual machines include a first virtual machine (e.g., the first virtual machine VM1 in the above embodiment) and a second virtual machine (e.g., the second virtual machine VM2 in the above embodiment) that are multiplexed or redundant with each other, When a failure is detected by the monitoring unit, one of the first virtual machine and the second virtual machine in which the failure has been detected is stopped from an operating state, and the other is started from a standby state.

[0044] According to the above aspect (5), in a virtualization system having multiple virtual machines that are multiplexed or redundant, if a fault is detected in a hardware element corresponding to one of the virtual machines in an operating state, the virtual machine is stopped from operating and the other virtual machine in a standby state is started, thereby preventing a decrease in the operating rate of the entire virtualization system and achieving high availability.

[0045] (6) In another embodiment, in any one of the above (1) to (4), The at least one virtualization device includes a first virtualization device (e.g., the first virtualization device 1A in the above embodiment) and a second virtualization device (e.g., the second virtualization device 1B in the above embodiment) that are multiplexed or redundant with each other, When a failure is detected by the monitoring unit, the virtual machine in which the failure has been detected is stopped from an operating state in one of the first virtualization device and the second virtualization device, and the virtual machine corresponding to the virtual machine in the other virtualization device is switched from a standby state to an operating state.

[0046] According to the above aspect (6), in a virtualization system having multiple virtualization devices that are multiplexed or redundant, if a failure occurs in a hardware element corresponding to a specific virtual machine in one of the virtualization devices that is in an operating state, the virtual machine is stopped from an operating state and the corresponding virtual machine in the other virtualization device is switched from a standby state to an operating state, thereby preventing a decrease in the operating rate of the entire virtualization system and achieving high availability.

[0047] (7) In another embodiment, in any one of the above (1) to (6), The monitoring unit is configured to monitor the presence or absence of a fault for each of the hardware components included in the hardware element.

[0048] According to the above aspect (7), the monitoring unit monitors each of the hardware components included in the hardware element.

[0049] (8) In another embodiment, in any one of the above (1) to (7), The plurality of virtual machines are configured to generate control signals for a control object.

[0050] According to the above aspect (8), by applying a controller that generates a control signal for a controlled object to a virtualized system, a virtualized system having excellent real-time performance and availability can be realized.

[0051] (9) In another embodiment, in the above embodiment (8), The controlled object is a plant or a moving object.

[0052] The above aspect (9) is suitable for applications that require high real-time performance and availability, such as a controller that controls a plant such as a thermal power plant, etc. In addition, when the controlled object is a moving object, the present invention is applicable to, for example, a ground transportation system, a surface ship on the ocean, or an underwater vehicle.

[0053] (10) A method for monitoring a virtualization system according to one embodiment includes the steps of: A plurality of virtual machines (for example, the virtual machines VM1, VM2, ... in the above embodiment), a hardware resource (e.g., the hardware resource 2 in the above embodiment) including a plurality of hardware elements (e.g., the hardware elements 2-1, 2-2, ... in the above embodiment) virtually assigned to correspond to each of the plurality of virtual machines; A monitoring method for a virtualization system (e.g., the virtualization systems 100A, 100A', 100B, and 100C of the above-described embodiments) having at least one virtualization device (e.g., the virtualization devices 1, 1A, and 1B of the above-described embodiments), comprising: The operating state of the hardware element corresponding to the virtual machine is monitored by each of the plurality of virtual machines.

[0054] According to the above aspect (10), the operating status of the hardware elements assigned to each virtual machine is monitored by a plurality of virtual machines. By monitoring the hardware elements corresponding to each virtual machine for each virtual machine in this manner, a fault can be detected earlier than in the past. Furthermore, the time required to execute the processing required to resolve or avoid the fault can be effectively reduced. As a result, it is possible to suppress a decrease in real-time performance and a decrease in operating rate due to the processing required to resolve or avoid the fault not being executed in time. [Explanation of symbols]

[0055] 1 Virtualization Device 1A First virtualization device 1B Second virtualization device 2. Hardware Resources 2a, 2b, ... Hardware elements 4. Central Processing Unit 6 Storage device 8 Discs 10 Devices 12 Hypervisor 14 Monitoring Department 16 Hardware Resource Monitoring Unit 18 Virtualization Environment Control Section 100(100A, 100B, 100C, 100A´) Virtualization System Tr failure VM1, VM2, ... Virtual Machines

Claims

1. At least one virtualization device having hardware resources including a plurality of virtual machines constructed to virtually simulate a plurality of control panels respectively corresponding to a plurality of devices constituting a plant, and a plurality of hardware elements virtually assigned to respectively correspond to the plurality of virtual machines; a hardware resource monitoring unit provided outside the at least one virtualization device for monitoring the hardware resources; A distributed control system having: each of the plurality of virtual machines includes a monitoring unit for monitoring an operation state of the hardware element corresponding to the virtual machine; A distributed control system, wherein the hardware resource monitoring unit is configured to send a warning or email to only the virtual machine among the plurality of virtual machines that corresponds to the hardware element in which the failure has occurred when a failure is detected in the hardware resource.

2. The distributed control system according to claim 1 , wherein the monitoring unit is configured to actively monitor an operating state of the hardware element corresponding to the virtual machine.

3. The distributed control system according to claim 1 , wherein the monitoring unit is configured to monitor an operating state of the hardware element corresponding to the virtual machine by an application executed by the virtual machine.

4. the plurality of virtual machines include a first virtual machine and a second virtual machine which are multiplexed or redundant with each other, 4. The distributed control system according to claim 1, wherein, when a failure is detected by the monitoring unit, one of the first virtual machine and the second virtual machine in which the failure is detected is stopped from an operating state, and the other is started from a standby state.

5. the at least one virtualization device includes a first virtualization device and a second virtualization device which are multiplexed or redundant with each other, 4. The distributed control system according to claim 1, wherein, when a failure is detected by the monitoring unit, the virtual machine in which the failure is detected is stopped from an operating state in one of the first virtualization device and the second virtualization device, and the virtual machine corresponding to the virtual machine in the other virtualization device is switched from a standby state to an operating state.

6. The distributed control system according to claim 1 , wherein the monitoring unit is configured to monitor the presence or absence of a fault for each of the hardware components included in the hardware element.

7. The distributed control system according to claim 1 , wherein the plurality of virtual machines are configured to generate control signals for controlled objects.

8. At least one virtualization device having hardware resources including a plurality of virtual machines constructed to virtually simulate a plurality of control panels respectively corresponding to a plurality of devices constituting a plant, and a plurality of hardware elements virtually assigned to respectively correspond to the plurality of virtual machines; a hardware resource monitoring unit provided outside the at least one virtualization device for monitoring the hardware resources; A method for monitoring a distributed control system comprising: monitoring, by each of the plurality of virtual machines, an operational state of the hardware element corresponding to the virtual machine; A monitoring method for a distributed control system, in which, when the hardware resource monitoring unit detects a fault in the hardware resource, it sends a warning or email to only the virtual machine among the multiple virtual machines that corresponds to the hardware element in which the fault has occurred.

Images