Control device, control system, control method, and control program

Abstract

To provide a device, system, method and program for control that allows for improving the reliability of a system for control while avoiding the operation instability of an application.SOLUTION: A device for control is allowed to select and output a computation result outputted based on computation results of respective ones of a plurality of controllers 141-143 to execute predetermined computations and has an application managing section 170 that takes any one or some of the controllers 141-143 as objects of reconstruction and determines whether or not output reliability with a selection processing section 160 can be secured by computation of a controller other than the objects of reconstruction, and executes a reconstruction of the controller which is the object of reconstruction if reliability can be secured.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a control device, a control system, a control method, and a control program.

Background Art

[0002] In various plants using oil, petrochemicals, chemicals, gas, etc., various controls such as control of opening and closing of valves and control of maintaining a constant temperature are performed by a control system. Therefore, the control system is required to ensure reliability according to the control target.

[0003] The function of a control device is generally composed of hardware such as a CPU (Central Processing Unit) and a memory, and software such as a controller application. A controller application and a controller refer to a control application, and hereinafter, they will be collectively referred to as a "controller". In addition, in the control device, applications other than the controller also operate. Hereinafter, they will be referred to as "APP (Application)". In addition, the controller and the APP are collectively referred to as an application.

[0004] In the control device, an application may operate in a virtual environment on the hardware. In that case, a configuration is adopted in which a plurality of VMs (Virtual Machines) operate on the OS (Operating System) and virtual hardware, and the application operates on each VM. The VM provides a virtual OS environment called a guest OS or a container.

[0005] In the control device, if either the hardware or the software fails, it will cause an obstacle to the operation. Therefore, a control system has been proposed that executes and outputs a predetermined calculation by a plurality of controllers, and selects one output value from each calculation value in the selection processing unit, thereby suppressing the cost while improving the reliability (Patent Document 1).

[0006] Furthermore, from the perspective of software, a phenomenon called memory leak may occur. Memory leak refers to a phenomenon where, for example, due to a programming bug in an application, after requesting a memory area from the OS, the release of that memory is not executed. If memory leaks occur repeatedly, the memory resources held by the OS may be exhausted, and the operations of the OS and all applications running on that OS may become unstable.

[0007] Therefore, for example, in a control system where an application operates in a virtual environment, in order to eliminate the unstable state caused by memory leaks, the virtual machine such as the guest OS or container and the application are restarted. However, it is preferable not to cause unstable operations that are possible from the occurrence of a memory leak until restart. This is because if the application continues to operate in a halfway unstable state, there is a possibility that the operation of the application interference prevention processing unit cannot completely suppress the influence. Therefore, it is conceivable to prevent the occurrence of errors by restarting the application preventively before the operation becomes unstable due to memory leaks.

[0008] As a technology for such countermeasures against memory leaks, a technology has been proposed (Patent Document 2) that executes a restart of the software that causes the memory leak and operates a plurality of processes that provide services, enabling the continuation of the service even when some processes are restarted.

Prior Art Documents

Patent Documents

[0009]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0010] However, depending on the state of the memory leak, it may be possible to restart multiple applications simultaneously. In that case, in a technique of selecting one output value from the respective calculation values by a plurality of controllers, there is a risk that an appropriate selection may not be made depending on the number of applications to be restarted. On the other hand, for the purpose of avoiding the simultaneous occurrence of operation instability due to memory leaks, it has been proposed to intentionally set different values for resource allocation. However, it is difficult to accurately predict the degree of occurrence of memory leaks, and it is difficult to perform optimal resource allocation. Therefore, it is difficult to avoid the operation instability of the application and improve the reliability of the control system.

[0011] Also, in a technique of executing a restart of software that causes a memory leak after operating a plurality of processes that provide services, it is difficult to provide a highly reliable service while the number of processes operating by the restart is less than the set number. Further, in this technique, process management is performed by a queue unit, but in a process where real-time performance such as a process control system is important, queue management is difficult, and there is a risk that management in the queue unit becomes complicated. Therefore, it is difficult to avoid the operation instability of the application and improve the reliability of the control system.

[0012] An object of the disclosed technology is to provide a control device, a control system, a control method, and a control program that avoid operation instability of an application and improve the reliability of a control system.

Means for Solving the Problem

[0013] In one aspect of the control device, control system, control method, and control program disclosed in the present application, the control device includes the following selection processing unit and application management unit. The selection processing unit selects and outputs an output calculation result based on the calculation results of each of a plurality of applications that execute a predetermined calculation. The application management unit targets one or some of the applications for reconstruction, and determines whether the reliability of the output by the selection processing unit can be ensured by the calculations of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application targeted for reconstruction. 、vary the determination logic according to the reliability required for the predetermined operation executed by the application and when it is determined that the reliability can be ensured, the reconstruction of the application targeted for reconstruction is executed.

Advantages of the Invention

[0014] In one aspect, the present invention can avoid unstable operation of applications and improve the reliability of the control system.

Brief Description of the Drawings

[0015]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Embodiments for Carrying Out the Invention

[0016] Hereinafter, examples of the control device, control system, control method, and control program disclosed in the present application will be described in detail with reference to the drawings. Note that the present invention is not limited by this example. Also, the same elements are denoted by the same reference numerals, and overlapping descriptions are omitted as appropriate, and each embodiment can be appropriately combined within a non-contradictory range.

[0017] [Embodiment 1] [Overall Configuration] FIG. 1 is a schematic diagram showing an example of a control system. The control system 1 shown in FIG. 1 is connected to a sensor 20 and a drive device 30 via a network. The control system 1 is used, for example, for controlling an industrial process 40 of a plant. In this specification, a plant includes industrial plants such as chemical plants, plants for managing and controlling wellheads or their surroundings such as gas fields or oil fields, plants for managing and controlling power generation such as hydraulic power, thermal power, and nuclear power, plants for managing and controlling environmental power generation such as solar power and wind power, and plants for managing and controlling water supply and drainage, dams, etc.

[0018] The sensor 20 is provided in the industrial process 40 and measures physical quantities in the industrial process 40. The sensor 20 transmits the measured physical quantity as a measurement signal to the input device 11 of the control system 1 via a network. In this specification, the sensor 20 includes, for example, sensor devices such as pressure gauges, flow meters, and temperature sensors, microphones for collecting abnormal sounds in the plant, position detection devices for outputting the position information of each device, and imaging devices such as cameras and videos for photographing the situation and objects in the plant.

[0019] When the drive device 30 receives an input of a control signal from the output device 12, it drives the industrial process 40 according to the control signal. The drive device 30 also includes valve devices such as flow control valves and on-off valves, Operating sound and acoustic devices such as speakers for emitting alarm sounds, etc.

[0020] As shown in FIG. 1, the control system 1 includes a control device 10, an input device 11, and an output device 12. The control device 10 is connected to the input device 11 and the output device 12 via a network.

[0021] The input device 11 receives an input of a measurement signal from the sensor 20. Then, the input device 11 transmits the received signal to the control device 10.

[0022] The output device 12 receives the control signal transmitted from the control device 10. Then, the output device 12 outputs the received control signal to the drive device 30. The drive device 30 operates the industrial process 40 according to the control signal. Here, the input device 11 and the output device 12 may be integrated as hardware.

[0023] [Configuration of the control device] Based on the measurement signal input from the input device 11, the control device 10 performs predetermined arithmetic processing and outputs a control signal corresponding to the arithmetic result to the output device 12 via the network. The control device 10 is composed of, for example, a computer device. The control device 10 may be included in a distributed control system (DCS). For the measurement signal input from the input device 11, the control device 10 performs arithmetic processing with a predetermined algorithm to generate a control signal. The functions of the control device 10 are composed of hardware 110 such as a CPU and a memory, and software including an OS 120, VMs 131 to 133, controllers 141 to 143, and APPs 151 to 153. In the following description, when not distinguishing each of VMs 131 to 133, they are collectively referred to as "VM130". Also, when not distinguishing each of controllers 141 to 143, they are collectively referred to as "controller 140". Also, when not distinguishing each of APPs 151 to 153, they are collectively referred to as "APP150".

[0024] Rather than dealing with the unstable operation of the controller 140 after it occurs due to a software error such as a memory leak, the control device 10 performs a reconstruction process of the controller 140 at a stage before the influence of the software error appears, thereby avoiding the occurrence of unstable operation. In this way, rather than suppressing the influence of the unstable controller 140, it is easier to eliminate the adverse effects caused by software errors as a whole by reconstructing the controller 140 in a planned manner.

[0025] When the control device 10 performs the reconstruction of the controller 140, in order to maintain and continue the selection of the correct output value in the selection processing unit 160, it controls so that more controllers 140 than the number capable of ensuring the reliability of the control system 1 operate during the reconstruction. Further, the control device 10 ensures the reliability of the control system 1 by performing reconstruction such as restarting and reinstalling the controller 140 by a simple mechanism described below. The details of the control device 10 below will be described.

[0026] The control device 10 operates the OS 120 on the hardware 110. The OS 120 operates as a host OS when, for example, the VM 130 is a guest OS. When the OS 120 receives an instruction to start a new VM 130 and controller 140 from the application management unit 170, it newly starts the VM 130 and the controller 140.

[0027] The control device 10 operates a plurality of VMs 131 to 133, which are virtual machines, on the OS 120. The VM 130 is a guest OS or a container. Each of the VMs 131 to 133 operates a controller 141 to 143 and an APP 151 to 153.

[0028] Also, each of the VMs 130 predicts that the time when the occurrence of a software error is likely to affect the operation of the controller 140 is approaching. That is, a plurality of VMs 130, which are virtual machines, each operate a controller 140 that is an individual application that executes a predetermined operation, and predict the occurrence of a failure in the controller 140 that is operated.

[0029] For example, VM130 detects an increase in its own memory usage and predicts that the time when the operation of controller 140 will be affected by a memory leak is approaching. Among other things, for example, software errors also include unstable operations such as applying security patches to OS120. Further, VM130 may predict that the time when the operation of controller 140 will be affected by the occurrence of a soft error such as a bit error due to cosmic rays or the like is approaching. In the following description, software errors will be used as an example for explanation, but VM130 can operate in the same way for soft errors. Hereinafter, the prediction that the time when the operation of controller 140 will be affected by the occurrence of a software error is approaching is referred to as "prediction of software error".

[0030] Here, there is no particular limitation on the method for predicting software errors by VM130. For example, VM130 predicts a software error when the state where the temperature of the CPU (Central Processing Unit) exceeds the threshold value continues for a certain period of time or more. Among other things, VM130 may also predict a software error using the operation time of control device 10, the operation time of the application including controller 140, or the number of operation steps. Further, VM130 may predict a software error using any one of them, or may predict a software error by combining a plurality of methods and using them.

[0031] When VM130 predicts a software error, it notifies application management unit 170 of a reconstruction request for controller 140, with the controller 140 that it operates itself being the reconstruction target. Thereafter, when VM130 receives an instruction for reconstruction from application management unit 170, it executes the reconstruction of controller 140.

[0032] Here, the reconstruction of the controller 140 may be performed in any way as long as the arithmetic processing function of the controller 140 can be restored after stopping the arithmetic processing function of the controller 140. That is, the reconstruction of the controller 140 includes restarting the VM 130 that operates the controller 140, starting the VM 130 after stopping it, reinstalling the VM 130, and the like. Starting the VM 130 after stopping refers to a process of starting the VM 130 after shutting it down, which is different from a simple restart. In this case, the information in the memory is completely cleared. Also, in the case of reinstalling the VM 130, the VM 130 and the controller 140 restart from the initial state. Here, the controller 140 is an example of an "application". That is, "reconstruction of an application" refers to an operation of restoring the arithmetic processing function of the application again after stopping the arithmetic processing function of the application, such as restarting, starting after stopping, and reinstalling. Restarting the controller 140 by restarting the VM 130 and starting the controller 140 after starting the VM 130 after stopping are each examples of "stopping and starting".

[0033] Further, the control device 10 operates the controller 140 and the APP 150 in each of the VMs 130. The APP 150 is an application other than the controller 140. The control device 10 according to the present embodiment has three or more sets of the VM 130 and the controller 140. Note that the APP 150 may control the timing of outputting the value calculated by the controller 140 through arithmetic operations.

[0034] The controller 140 receives the measurement signal input from the sensor 20 via the input device 11. Next, the controller 140 calculates the value to be applied to the drive device 30 based on the measurement signal input from the sensor 20. That is, the controller 140 is an application that executes a predetermined operation for calculating a control value for the industrial process 40. Each controller 140, for example, performs arithmetic processing on the input measurement signal with a predetermined algorithm and outputs the arithmetic result. Each controller 140 executes the same control operation. The same control operation is an operation in which exactly the same arithmetic result is calculated when the input values are the same and the correct arithmetic is performed.

[0035] Furthermore, the control device 10 includes a selection processing unit 160 that operates on the hardware 110. In this embodiment, the selection processing unit 160 is described as operating on the hardware 110, but the selection processing unit 160 may operate on the OS 120. In this embodiment, the selection processing unit 160 is configured by software. In this case, the selection processing unit 160 may be constructed, for example, with dedicated firmware on the hardware 110.

[0036] The selection processing unit 160 manages the operations of each controller 140. Then, the selection processing unit 160 receives a request from the application management unit 170 and notifies the application management unit 170 of the total number of controllers 140 that execute the same control operation.

[0037] Also, the selection processing unit 160 receives the input of each arithmetic value calculated by each controller 140 from the controller 140. Here, in FIG. 1, for the sake of illustration, a communication path extending from the controller 143 to the selection processing unit 160 is described, but communication paths also extend from the other controllers 140 to the selection processing unit 160 in the same manner.

[0038] The selection processing unit 160 selects an output value based on the calculation values calculated by each controller 140. Specifically, the selection processing unit 160 selects one calculation value from among the calculation values output from each controller 140 as the output value. Then, the selection processing unit 160 outputs a control signal based on the selected output value to the output device 12. When this control signal is transmitted to the drive device 30, an operation of the industrial process 40 by the drive device 30 according to the control signal is performed. In this way, the selection processing unit 160 selects and outputs an operation result to be output based on the respective operation results of the plurality of controllers 140 that execute a predetermined operation for calculating a control value for the industrial process 40.

[0039] For example, it will be described in the case where the sensor 20 is a sensor that measures the flow rate, the drive device 30 is attached to a pipe, and is configured by an actuator that adjusts the opening degree of a valve that controls the flow rate of the fluid flowing through the pipe. In this case, a signal of information regarding the flow rate measured by the sensor 20 is input to the control device 10. The selection processing unit 160 acquires, as a calculation value, a calculation result of calculating a value to be output to the actuator based on the information regarding the flow rate acquired by each of the plurality of controllers 140. Next, the selection processing unit 160 selects one of the acquired calculation values as the output value. Then, the selection processing unit 160 outputs a control signal based on the selected output value to the output device 12. Then, when the drive device 30 receives the control signal, the flow rate of the fluid flowing through the pipe is adjusted based on the output value.

[0040] The selection process of the operation values by the selection processing unit 160 will be described in more detail. The selection processing unit 160 selects, from among the operation values output from a plurality of controllers 140, the operation value to be the output value by means of a majority logic. That is, the selection processing unit 160 selects, as the output value, the operation value for which the same value is output the most among the operation values output from the plurality of controllers 140. Alternatively, the selection processing unit 160 may select, as the output value, the operation value for which the same value is output from more than half of the plurality of controllers 140 among the operation values output from the plurality of controllers 140. Here, as the same value, even if the values do not completely match, they may be regarded as the same if they are within a predetermined tolerance range. As the tolerance range, for example, an appropriate value such as within ±1% is preferably set according to the operation. Further, when there are a plurality of operation values within the tolerance range, the selection processing unit 160 may, for example, calculate the average value of the plurality of operation values and output it as the output value. Alternatively, when there are three or more operation values within the tolerance range, the selection processing unit 160 may calculate the median value and output it as the output value. Thus, if a value representing a plurality of operation values within the tolerance range can be calculated and used as the output value, the selection processing unit 160 may determine the output value by other methods.

[0041] For example, when there are three controllers 140, the selection processing unit 160 acquires the operation values respectively output from the three controllers 140. Here, a case will be described where any two of the controllers 140 output the same operation value and the other one controller 140 outputs a different operation value. In this case, since the operation value output by the two controllers 140 is the operation value output the most, the selection processing unit 160 selects the operation value as the output value.

[0042] The selection processing unit 160 selects one output value from the calculation values input from each controller 140 using a majority logic, so that even if an abnormality occurs in part of the VM 130 or part of the controller 140, a calculation value that can be regarded as normal can be output. Therefore, the control device 10 can continuously output an output value that can be regarded as normal, and can normally drive the drive device 30. However, in order to ensure the reliability of obtaining a calculation value that can be regarded as normal by the selection processing unit 160, it is preferable that the number of controllers 140 that can ensure reliability by the majority logic or more operate.

[0043] Also, the selection processing unit 160 manages the total number of controllers 140 and the number of controllers 140 that execute the same control calculation. When the selection processing unit 160 receives an output from a new controller 140, the number of controllers 140 that execute the same control calculation is increased by one. Conversely, when an abnormality of the controller 140 is detected by comparing values or the like, the selection processing unit 160 decreases the number of controllers 140 that execute the same control calculation by one.

[0044] Furthermore, the control device 10 has an application management unit 170 that operates on the hardware 110. Here, in FIG. 1, the selection processing unit 160 and the application management unit 170 are separately illustrated, but the application management unit 170 may be included in the selection processing unit 160 as a part of the functions of the selection processing unit 160.

[0045] The application management unit 170 manages the operating states such as during and after the execution of applications including the VM 130 and the controller 140. Furthermore, the application management unit 170 issues instructions for operations such as starting, stopping, and restarting the VM 130. Also, when reconstructing the controller 140, the application management unit 170 determines whether reconstruction is possible, and causes the controller 140 to be reconstructed when reconstruction is possible.

[0046] Specifically, when the application management unit 170 receives a notification of software error prediction from the VM 130, it determines whether it is possible to reconstruct the controller 140 operated by the notified source VM 130 for the VM 130 as the target. Also, when the states of the VM 130 or the controller 140 reach a predetermined condition, the application management unit 170 determines whether it is possible to reconstruct the controller 140 operated by the VM 130 that has reached the predetermined condition or the controller 140 that has reached the predetermined condition as the reconstruction target. Reaching the predetermined condition means, for example, when the operation time of the VM 130 exceeds a predetermined time.

[0047] Here, the application management unit 170 can change the criteria for identifying the restart target based on the predetermined conditions according to the system environment. For example, the application management unit 170 changes the operation time, which is the criterion for determining that a specific controller 140 is the reconstruction target, according to the memory size assigned to each VM 130. That is, the application management unit 170 calculates the operation time, which is the determination criterion under the predetermined conditions, by multiplying the installed memory size by a coefficient. For example, when the memory size assigned to the VM 130 is 4 GB, the application management unit 170 calculates the operation time, which is the determination criterion under the predetermined conditions, as 4 × 1 day = 4 days. Also, when the The memory size is assigned memory size of the VM 130 is 8 GB, the application management unit 170 calculates the operation time, which is the determination criterion under the predetermined conditions, as 8 × 1 day = 8 days.

[0048] In both cases where a reconstruction request is received from the VM 130 and where the application management unit 170 determines the controller 140 to be restarted by itself, the application management unit 170 executes the following determination process for whether reconstruction is possible. The details of the determination process for whether reconstruction is possible by the application management unit 170 will be described below.

[0049] The application management unit 170 acquires from the selection processing unit 160 the total number of controllers 140 that execute the same control operation. Next, the application management unit 170 subtracts the number of controllers 140 to be reconstructed from the total number of controllers 140 that execute the same control operation, and calculates the number of controllers 140 that execute the same control operation and operate during reconstruction. Hereinafter, the controller 140 that executes the same control operation and operates during reconstruction is referred to as the "controller 140 that operates during reconstruction". Then, the application management unit 170 determines whether the reliability of the control system 1 can be ensured by the controller 140 that operates during reconstruction. Ensuring the reliability of the control system 1 means ensuring the reliability that the selection processing unit 160 selects a correct operation value according to the majority logic. That is, if the reliability of the control system 1 can be ensured, the control device 10 can drive the drive device 30 normally.

[0050] For example, if the number of controllers 140 that operate during reconstruction is equal to or more than half of the original total number of controllers 140 that execute the same control operation, the application management unit 170 determines that the reliability of the control system 1 can be ensured. Here, a case where the total number of controllers 140 that execute the same control operation is five will be described as an example. If the number of controllers 140 to be reconstructed is one, the application management unit 170 determines that the reliability of the control system 1 can be ensured because the number of controllers 140 that operate during reconstruction is four, which is equal to or more than half of the original total number. In contrast, if the number of controllers 140 to be reconstructed is three, the application management unit 170 determines that it is difficult to ensure the reliability of the control system 1 because the number of controllers 140 that operate during reconstruction is two, which is less than half of the original total number.

[0051] When it is determined that the reliability of the control system 1 can be ensured, the application management unit 170 determines that the reconstruction of the controller 140 to be reconstructed can be executed. Then, the application management unit 170 instructs the VM 130 in which the controller 140 to be reconstructed operates to reconstruct the controller 140 that the VM 130 operates. That is, the application management unit 170 uses one or some of the controllers 140 as the reconstruction target, and determines whether the reliability of the output value by the selection processing unit 160 can be ensured by the operation of the controllers 140 other than the reconstruction target. When the reliability can be ensured, the reconstruction of the controller 140 to be reconstructed is executed. In addition, the application management unit 170 determines whether to reconstruct each controller 140 based on the operating states of the VM 130 and the controller 140, determines whether the reliability can be ensured by the operation of the controllers 140 other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the controller 140 to be reconstructed.

[0052] On the contrary, when it is determined that the overall reliability of the control system 1 cannot be ensured, the application management unit 170 suspends the execution of the reconstruction for a certain re-judgment time. The re-judgment time can be, for example, 1 minute. After the elapse of the re-judgment time, the application management unit 170 re-executes the determination process of whether reconstruction is possible.

[0053] When repeating the determination process of whether reconstruction is possible, the application management unit 170 determines whether a certain upper limit time has been reached. The upper limit time can be, for example, 5 minutes. If the reconstruction cannot be executed even after the upper limit time has elapsed, the application management unit 170 instructs the OS 120 to start a new VM 130 and controller 140. Then, after the number of new controllers 140 increases, the application management unit 170 obtains the total number of controllers 140 that execute the same control operation to which the new controller 140 is added from the selection processing unit 160. Thereafter, the application management unit 170 uses the obtained new total number to re-execute the determination process of whether reconstruction is possible.

[0054] Here, the determination logic for the feasibility of reconstruction used by the application management unit 170 is variable depending on the reliability required for the same control operation executed by the target controller 140. For example, the application management unit 170 can vary the determination logic for the feasibility of restart as follows. That is, when high reliability is required for the same control operation executed by the controller 140, if more than half are operating (such as a state where 3 out of 5 are operating), the application management unit 170 determines that the overall reliability of the control system 1 can be ensured and executes a restart. In contrast, when high reliability is not required for the same control operation executed by the controller 140, if a plurality of units are operating (such as a state where 2 out of 5 are operating), the application management unit 170 determines that the overall reliability of the control system 1 can be ensured and executes a restart.

[0055] In addition, the application management unit 170 may also determine the feasibility of restart by adding a minimum number condition such as 3 or more to the number of controllers 140 operating during reconstruction. However, the possibility that the selection processing unit 160 can select the correct output finally is higher when the number of controllers 140 operating during reconstruction is 3 rather than 2 or 4 rather than 3. Therefore, the minimum number of controllers 140 operating during reconstruction is preferably set according to the operation state.

[0056] [Reconstruction Process] FIG. 2 is a flowchart of the reconstruction process based on the reconstruction request from the VM. Next, with reference to FIG. 2, the flow of the reconstruction process based on the reconstruction request of the VMs 130 and the like in the control device 10 according to the first embodiment will be described.

[0057] The application management unit 170 receives a reconstruction request from the VM 130 (step S101).

[0058] Next, the application management unit 170 acquires the total number of controllers 140 that execute the same control operation from the selection processing unit 160 (step S102).

[0059] Next, the application management unit 170 determines whether the reliability of the control system 1 can be ensured even if the controller 140 to be reconstructed, which is the source of the reconstruction request, is stopped (step S103).

[0060] If the reliability of the control system 1 can be ensured even when the controller 140 to be reconstructed is stopped (step S103: affirmative), the application management unit 170 instructs the VM 130 that operates the controller 140 to be reconstructed to perform reconstruction (step S104). Then, the application management unit 170 ends the reconstruction process.

[0061] On the other hand, if it is difficult to ensure the reliability of the control system 1 when the controller 140 to be reconstructed is stopped (step S103: negative), the application management unit 170 waits for a re-judgment time, which is a predetermined fixed time (step S105).

[0062] Next, the application management unit 170 determines whether an upper limit time, which is a predetermined fixed time longer than the restart judgment time, has elapsed (step S106). If the upper limit time has not elapsed (step S106: negative), the application management unit 170 returns to step S102.

[0063] On the other hand, if the upper limit time has elapsed (step S106: affirmative), the application management unit 170 instructs the OS 120 to start a new VM 130 and controller 140. Then, the application management unit 170 returns to step S102.

[0064] FIG. 3 is a flowchart of the reconstruction process based on the determination of reconstruction by the application management unit. Next, with reference to FIG. 3, the flow of the reconstruction process based on the determination of reconstruction by the application management unit 170 in the control device 10 according to Embodiment 1 will be described.

[0065] The application management unit 170 determines the controller 140 to be reconstructed based on the operation time of the VM 130, the controller 140, etc. (step S201).

[0066] Next, the application management unit 170 acquires the total number of controllers 140 that execute the same control operation from the selection processing unit 160 (step S202).

[0067] Next, the application management unit 170 determines whether it is possible to ensure the reliability of the control system 1 even if the controller 140 to be reconstructed is stopped (step S203).

[0068] If it is possible to ensure the reliability of the control system 1 even if the controller 140 to be reconstructed is stopped (step S203: affirmative), the application management unit 170 instructs the VM 130 that operates the controller 140 to be reconstructed to perform reconstruction (step S204). Then, the application management unit 170 ends the reconstruction process.

[0069] On the other hand, if it is difficult to ensure the reliability of the control system 1 when the controller 140 to be reconstructed is stopped (step S203: negative), the application management unit 170 waits for a re-judgment time, which is a predetermined fixed time (step S205).

[0070] Next, the application management unit 170 determines whether an upper limit time, which is a predetermined fixed time longer than the restart judgment time, has elapsed (step S206). If the upper limit time has not elapsed (step S206: negative), the application management unit 170 returns to step S202.

[0071] On the other hand, if the upper limit time has elapsed (step S206: affirmative), the application management unit 170 instructs the OS 120 to start a new VM 130 and controller 140. Then, the application management unit 170 returns to step S202.

[0072] Here, in this embodiment, when the states of VM130 and the controller 140 reach predetermined conditions, the application management unit 170 determines the VM130 to be restarted. However, each VM130 may perform the process of determining the restart target. In that case, when the states of VM130 and the controller 140 reach predetermined conditions or in the case of predicting a software error, VM130 notifies the application management unit 170 of an instruction to restart the VM130 or the controller 140 that is the restart target, in the same manner as in the case of predicting a software error.

[0073] For example, VM130 determines whether the operating time of the controller 140 that it operates exceeds the operating time threshold corresponding to the memory size allocated to itself. When the operating time of the controller 140 that it operates exceeds the operating time threshold, VM130 predicts the occurrence of a software error. Then, VM130 notifies the application management unit 170 of a reconstruction request. In this case, the application management unit 170 determines the controller 140 to be reconstructed based on the notification from VM130 and executes a determination process on whether reconstruction is possible.

[0074] [Effect] As described above, the control system 1 according to this embodiment predicts that the operation of the system will be affected by a software error and sets the controller 140 for which the software error has been predicted as the reconstruction target. Further, when the states of VM130 and the controller 140 reach predetermined conditions, the control system 1 sets the VM130 and the controller 140 as the reconstruction targets. Then, the control system 1 determines whether the reliability of the system can be ensured even if the controller 140 to be reconstructed stops, and if it can be ensured, executes the reconstruction of the VM130 to be reconstructed.

[0075] As a result, the control system 1 can reconstruct the controller 140 in advance before a software error such as a memory leak actually occurs, and it becomes possible to reduce a decrease in reliability such as an interruption of the control operation due to the software error. In addition, since the control system 1 can ensure reliability such as the continuation of the control operation even during the reconstruction of the controller 140, it becomes possible to maintain the reliability in the entire operation of the system including the normal operation and the reconstruction process. Therefore, it becomes possible to avoid the unstable operation of the application and improve the reliability of the control system 1.

[0076] (Modification example) In the above-described Embodiment 1, the description has been made with the configuration in which the entire system operates on one piece of hardware 110, but the system configuration is not limited to this.

[0077] For example, a plurality of OSs 120 may operate on the hardware 110, and one or a plurality of VMs 130 may operate on each OS 120. Also, a plurality of pieces of hardware 110 may exist, and one or a plurality of VMs 130 may operate on each of them. In that case, the selection processing unit 160 and the application management unit 170 of any one of the pieces of hardware 110 may oversee the selection processing of the calculation values and the reconstruction of the VMs 130 across the plurality of pieces of hardware 110.

[0078] Furthermore, one or a plurality of controllers 140 may be physically independent from the hardware 110. Also, the controller 140 operating on the hardware 110 and the physically independent controller 140 may coexist. Also, the application management unit 170 and the selection processing unit 160 may operate on a piece of hardware 110 different from the VMs 130 and the controller 140.

[0079] FIG. 4 is a diagram showing an example of the configuration of a control system according to a modification of Embodiment 1. In FIG. 4, the control system 1 has two control devices 10. Further, the control system 1 has two physical controllers 400 in which the controller 402 operates with controller dedicated hardware 401. The controller 402 can perform the same control operation as the controller 140. In addition to the physical controller 400, the controller 402 may be arranged in a server on the cloud or network.

[0080] In this case, the selection processing unit 160 and the application management unit 170 of either of the two control devices 10 may perform selection processing of all the VMs 130 and the calculation values of the controllers 140 and 402, and reconstruction of the VMs 130. Alternatively, when the controllers 140 and 402 are divided into a plurality of groups that perform different identical control operations, the selection processing unit 160 and the application management unit 170 in charge may be assigned to each group.

[0081] Here, when the VM 130 that operates the controller 140 to be reconstructed operates with an OS 120 different from other VMs 130, the reconstruction of the controller 140 may include restart of the OS 120, start after stopping the OS 120, and reinstallation of the OS 120.

[0082] [Embodiment 2] Next, Embodiment 2 will be described. The control device 10 according to the present embodiment is also represented by the block diagram of FIG. 1. The control device 10 according to the present embodiment identifies a controller 140 with a specific operation and issues a reconstruction request. In the following description, the operations of the respective parts similar to those in Embodiment 1 will be omitted.

[0083] The selection processing unit 160 receives calculation values from each controller 140. Then, the selection processing unit 160 identifies the controller 140 with a specific operation from the reception result of the calculation values. After that, the selection processing unit 160 outputs a reconstruction request for the identified controller 140 with a specific operation to the application management unit 170.

[0084] For example, when the calculation results of a specific controller 140 among a plurality of controllers 140 performing the same control operation are different, the selection processing unit 160 identifies the specific controller 140 as a controller 140 with abnormal operation. When the calculation results are different once, the selection processing unit 160 may determine that the calculation results of the specific controller 140 are different. When the calculation results are different multiple times, the selection processing unit 160 may also determine that the calculation results of the specific controller 140 are different. Further, when the calculation results are continuously different for a predetermined number of times, the selection processing unit 160 may determine that the calculation results of the specific controller 140 are different. When the cumulative number of different times reaches a predetermined number, the selection processing unit 160 may also determine that the calculation results of the specific controller 140 are different.

[0085] In addition, for example, when designed to receive calculation results within a certain time range, if the reception of the calculation results from a specific controller 140 is delayed by a certain time or more, the selection processing unit 160 identifies the specific controller 140 as a controller 140 with abnormal operation. This is because it is assumed that the processing ability of the controller 140 is reduced due to, for example, a memory leak or the like. Therefore, the selection processing unit 160 identifies a specific controller 140 whose reception of the calculation results is delayed by a certain time or more as a controller 140 with abnormal operation. Here, since the timings at which the calculation results reach the selection processing unit 160 from a plurality of applications may be different from each other, the selection processing unit 160 may have a function of waiting for the calculation results to be received for a certain period.

[0086] Furthermore, the selection processing unit 160 may identify a controller 140 that outputs a calculation value that was not selected among the calculation values of the same control operation as a controller 140 with abnormal operation.

[0087] In this way, the selection processing unit 160 detects abnormal operations of the controller 140 based on the results of receiving the respective calculation results of the controller 140 that is an application.

[0088] In addition, VM130 may identify a controller 140 with abnormal operations. For example, as a monitoring result of general operating states, VM130 detects a failure that can be recovered by restarting VM130, such as CPU load or network abnormalities, and determines that the operations of the controller 140 it operates are abnormal. Then, VM130 makes a reconstruction request to the application management unit 170.

[0089] The application management unit 170 receives a reconstruction request for the controller 140 with abnormal operations from the selection processing unit 160. Then, the application management unit 170 designates made Controller 140 as the reconstruction target and performs a determination process on whether reconstruction is possible. If the application management unit 170 can execute the reconstruction, it instructs the VM130 that operates the designated controller 140 with abnormal operations to perform the reconstruction.

[0090] In addition, the application management unit 170 may receive a reconstruction request from VM130 that has determined that the operations of the controller 140 it operates are abnormal. Then, the application management unit 170 sets the controller 140 operated by the VM130 that is the source of the reconstruction request as the reconstruction target. After that, the application management unit 170 performs a determination process on whether reconstruction is possible, and if reconstruction is possible, it instructs the VM130 that operates the controller 140 with abnormal operations to perform the reconstruction.

[0091] In this way, the application management unit 170 sets the controller 140 with abnormal operations detected by the selection processing unit 160 as the reconstruction target, determines whether the reliability can be ensured by the operations of the controller 140 other than the reconstruction target, and executes the reconstruction of the controller 140 that is the reconstruction target when the reliability can be ensured.

[0092] As described above, the control system 1 according to this embodiment identifies a controller 140 with abnormal operations and reconstructs a VM 130 that operates the identified controller 140. Thereby, in addition to software errors, it is possible to reconstruct the controller 140 that performs unstable operations that may affect the operation of the control system 1 before an actual failure occurs, and it becomes possible to improve the reliability of the control system 1.

[0093] [System] Regarding the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings, they can be arbitrarily changed unless otherwise specified.

[0094] Also, each component of each illustrated device is a functional concept, and it is not necessarily physically configured as shown in the figure. That is, the specific forms of distribution and integration of each device are not limited to those shown in the figure. In other words, all or part of it can be functionally or physically distributed and integrated in any unit according to various loads and usage situations.

[0095] Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic.

[0096] [Hardware] Next, a hardware configuration example of the control device 10 will be described. FIG. 5 is a hardware configuration diagram of the control device. As shown in FIG. 5, the control device 10 includes a processor 91, a memory 92, a communication device 93, and an HDD (Hard Disk Drive) 94. The processor 91, the memory 92, the communication device 93, and the HDD 94 correspond to an example of the hardware 110 illustrated in FIG. 1. The processor 91 is connected to the memory 92, the communication device 93, and the HDD 94 via a bus.

[0097] The communication device 93 is a network interface card or the like and is used for communication with other information processing devices. For example, when there are a plurality of control devices 10, the communication device 93 relays communication between the processors 91 of different control devices 10.

[0098] The HDD 94 is an auxiliary storage device. The HDD 94 stores various programs including programs that implement the functions of the OS 120, VMs 131 to 133, controllers 141 to 143, APPs 151 to 153, selection processing unit 160, and application management unit 170 illustrated in FIG. 1.

[0099] The processor 91 reads out various programs stored in the HDD 94, expands them in the memory 92, and executes them. Thereby, the processor 91 realizes the functions of the OS 120, VMs 131 to 133, controllers 141 to 143, APPs 151 to 153, selection processing unit 160, and application management unit 170 illustrated in FIG. 1.

[0100] In this way, the control device 10 operates as an information processing device that executes various processing methods by reading and executing programs. Further, the control device 10 can also read the above program from a recording medium by a medium reading device and realize the same functions as the above-described embodiments by executing the read program. Note that the program referred to here is not limited to being executed by the control device 10. For example, the present invention can be similarly applied when another computer or server executes the program, or when these cooperate to execute the program.

[0101] This program can be distributed via a network such as the Internet. Further, this program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, a MO (Magneto-Optical disk), a DVD (Digital Versatile Disc), and can be executed by being read from the recording medium by a computer.

[0102] Some examples of combinations of the disclosed technical features are described below. (1) A selection processing unit that selects and outputs an operation result to be output based on the operation results of each of a plurality of applications that execute a predetermined operation, determines whether the reliability of the output by the selection processing unit can be ensured by the operations of the applications other than the reconstruction target, with any one or some of the applications as the reconstruction target, and when the reliability can be ensured, an application management unit that executes the reconstruction of the application to be reconstructed A control device characterized by comprising: (2) The application executes the same control operation in which each performs the same operation as the predetermined operation, The selection processing unit selects the operation result to be output using a majority logic for the operation result The control device according to (1), characterized in that: (3) The application management unit according to (2), characterized in that when the number of applications other than the reconstruction target is equal to or greater than the number of applications that can ensure the reliability of the output using the majority logic of the selection processing unit, it is determined that the reliability can be ensured. (4) The application management unit determines whether to reconstruct each application based on the operation state of the application, determines whether the reliability can be ensured by the operations of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application to be reconstructed. The control device according to any one of (1) to (3), characterized in that: (5) The selection processing unit detects an abnormal operation of the application based on the result of receiving the operation results of each of the applications, The application management unit sets the application in which an abnormal operation has been detected by the selection processing unit as a reconstruction target, determines whether the reliability can be ensured by the calculation of the applications other than the reconstruction target, and executes the reconstruction of the application to be reconstructed when the reliability can be ensured. The control device according to any one of (1) to (4), characterized in that. (6) The application management unit reconstructs the application to be reconstructed by stopping and starting, or reinstalling, the application to be reconstructed. The control device according to any one of (1) to (5), characterized in that. (7) The application management unit controls so that the number of applications capable of ensuring the reliability of the output by the selection processing unit during reconstruction operates. The control device according to any one of (1) to (6), characterized in that. (8) When the selection processing unit receives an output from a new application, the selection processing unit increases the number of applications that execute the predetermined calculation by one, and when the selection processing unit detects an abnormality in the application, the selection processing unit decreases the number of applications that execute the predetermined calculation by one, and determines whether the reliability of the output by the selection processing unit can be ensured. The control device according to any one of (1) to (7), characterized in that. (9) The application management unit varies the determination logic for whether the reliability of the output by the selection processing unit can be ensured according to the reliability required for the predetermined calculation executed by the application. The control device according to any one of (1) to (8), characterized in that. (10) The application management unit determines the application to be reconstructed based on the operation time of the application. The control device according to any one of (1) to (9), characterized in that. (11) The control device according to (1) to (10), characterized in that the application is an application that executes the predetermined calculation for calculating a control value for an industrial process. (12) A control system having an input device that receives an input of measurement results from sensors arranged in a plant facility, an output device that drives a drive device that drives a mechanism provided in the plant facility, and a control device, wherein the control device a plurality of virtual machines each operating an application that executes a predetermined calculation based on the measurement results by the sensors input to the input device, a selection processing unit that selects an operation result to be output based on the operation result of each of the applications and causes the output device to output the selected operation result to drive the drive device, regards any one or some of the applications as a reconstruction target, determines whether the reliability of the output by the selection processing unit can be ensured by the operations of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application that is the reconstruction target An application management unit A control system characterized by comprising. (13) In the control device, execute a plurality of applications that execute a predetermined calculation, select and output an operation result to be output based on the operation result of each of the plurality of applications regard any one or some of the applications as a reconstruction target, and determine whether the reliability of the output of the operation result to be output can be ensured by the operation results of the applications other than the reconstruction target, and execute the reconstruction of the application that is the reconstruction target when the reliability can be ensured A control method characterized by the above. (14) operate a plurality of applications that execute a predetermined calculation, select and output an operation result to be output based on the operation result of each of the plurality of applications, Taking any one or several of the applications as the reconstruction target, it is determined whether the reliability of the output of the calculation result to be output can be ensured by the calculation results of the applications other than the reconstruction target. When the reliability can be ensured, the reconstruction of the application to be reconstructed is executed. A control program characterized by causing a computer to execute the process.

Explanation of Signs

[0103] 1 Control system 10 Control device 11 Input device 12 Output device 20 Sensor 30 Driving device 110 Hardware 120 OS 130~133 VM (Virtual Machine) 140~143 Controller 150~153 APP 160 Selection processing unit 170 Application management unit

Claims

1. A selection processing unit that selects and outputs a calculation result for output based on the calculation results of each of a plurality of applications that execute a predetermined calculation; An application management unit that determines whether any one or some of the applications are to be reconstructed, and determines, according to the reliability required for the predetermined calculation executed by the application, whether the reliability of the output by the selection processing unit can be ensured by the calculations of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application to be reconstructed; A control device characterized by comprising the above.

2. A selection processing unit that selects and outputs a calculation result for output based on the calculation results of each of a plurality of applications that execute a predetermined calculation; An application management unit that determines an application to be reconstructed based on the operation time of the application from among the plurality of applications, determines whether the reliability of the output by the selection processing unit can be ensured by the calculations of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application to be reconstructed; A control device characterized by comprising the above.

3. The control device according to claim 1, wherein the application management unit determines whether to reconstruct each application based on the operating state of the application, determines whether the reliability can be ensured by the calculations of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application to be reconstructed.

4. The selection processing unit detects an abnormal operation of the application based on the result of receiving the calculation results of each of the applications; The application management unit sets the application in which an abnormal operation has been detected by the selection processing unit as a reconstruction target, determines whether the reliability can be ensured by the calculation of the applications other than the reconstruction target, and executes the reconstruction of the application as the reconstruction target when the reliability can be ensured. The control device according to claim 1, characterized in that.

5. The control device according to claim 1, characterized in that the application management unit reconstructs the application as the reconstruction target by stopping and starting, or reinstalling, the application as the reconstruction target.

6. The control device according to claim 1, characterized in that the application management unit controls so that the number of applications capable of ensuring the reliability of the output by the selection processing unit during reconstruction operates.

7. The control device according to claim 1, characterized in that when the selection processing unit receives an output from a new application, the number of applications executing the predetermined calculation is increased by one, and when an abnormality of the application is detected, the number of applications executing the predetermined calculation is decreased by one, and a determination is made as to whether the reliability of the output by the selection processing unit can be ensured.

8. The control device according to claim 1, characterized in that the application is an application that executes the predetermined calculation for calculating a control value for an industrial process.

9. A control system having an input device that receives an input of a measurement result from a sensor disposed in a plant facility, an output device that drives a drive device that drives a mechanism provided in the plant facility, and a control device, The control device is A plurality of virtual machines each operating an application that executes a predetermined calculation based on the measurement result by the sensor input to the input device, A selection processing unit that selects an operation result to be output based on the respective operation results of the applications, and causes the output device to output the selected operation result to drive the drive device; An application management unit that determines one or some of the applications as reconstruction targets, and determines whether the reliability of the output by the selection processing unit can be ensured by the operations of the applications other than the reconstruction targets, according to different determination logics according to the reliability required for the predetermined operations executed by the applications, and executes the reconstruction of the applications to be reconstructed when the reliability can be ensured; A control system characterized by comprising the above.

10. A control system having an input device that receives the input of measurement results from sensors arranged in a plant facility, an output device that drives a drive device that drives a mechanism provided in the plant facility, and a control device, wherein The control device A plurality of virtual machines each operating an application that executes a predetermined operation based on the measurement results by the sensors input to the input device; A selection processing unit that selects an operation result to be output based on the respective operation results of the applications, and causes the output device to output the selected operation result to drive the drive device; An application management unit that determines an application to be reconstructed based on the operation time of the applications from among the applications, determines whether the reliability of the output by the selection processing unit can be ensured by the operations of the applications other than the reconstruction targets, and executes the reconstruction of the applications to be reconstructed when the reliability can be ensured; A control system characterized by comprising the above.

11. In a control device, Execute a plurality of applications that execute a predetermined operation, Select and output an operation result to be output based on the operation results of each of the plurality of applications Regarding any one or some of the applications as the reconstruction target, it is determined with different determination logics according to the reliability required for the predetermined operation executed by the application whether the reliability of the output of the operation result to be output can be ensured by the operation results of the applications other than the reconstruction target. When the reliability can be ensured, the reconstruction of the application to be reconstructed is executed. A control method characterized by the above.

12. A control device causes a plurality of applications that execute a predetermined operation to be executed, selects and outputs an operation result to be output based on the operation results of each of the plurality of applications, determines an application to be reconstructed based on the operation time of the applications from among the plurality of applications, and determines whether the reliability of the output of the operation result to be output can be ensured by the operation results of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application to be reconstructed. A control method characterized by the above.

13. Operates a plurality of applications that execute a predetermined operation, selects and outputs an operation result to be output based on the operation results of each of the plurality of applications, Regarding any one or some of the applications as the reconstruction target, it is determined with different determination logics according to the reliability required for the predetermined operation executed by the application whether the reliability of the output of the operation result to be output can be ensured by the operation results of the applications other than the reconstruction target, and when the reliability can be ensured, executes the reconstruction of the application to be reconstructed. A control program characterized by causing a computer to execute the process.

14. Operate a plurality of applications that execute a predetermined calculation, Select and output a calculation result that is output based on the calculation result of each of the plurality of applications, Determine an application to be reconstructed based on the operation time of the application from among the plurality of applications, and determine whether it is possible to ensure the reliability of the output of the calculation result to be output by the calculation results of the applications other than the reconstruction target, Execute reconstruction of the application to be reconstructed when the reliability can be ensured, A control program characterized by causing a computer to execute the process.

Images