control device

Abstract

To provide a control device that avoids operation instability in applications and improves the reliability of a control system.SOLUTION: A selection processing section selects and outputs a second calculation result on the basis of a first calculation result calculated by each of a first predetermined number of applications each executing the same predetermined calculation. When the number of applications excluding a second predetermined number of applications to be rebuilt from a plurality of applications each executing the same predetermined calculation is the first predetermined number, the application management section determines whether or not to secure the reliability of the second calculation result output by the selection processing section on the basis of the first calculation result by the first predetermined number of applications, and executes rebuilding of the second predetermined number of applications to be rebuilt in a case where the reliability of the second calculation result can be secured.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a control device.

Background Art

[0002] In various plants using oil, petrochemicals, chemicals, gas, etc., various controls such as control of opening and closing of valves and control of maintaining a constant temperature are performed by a control system. Therefore, the control system is required to ensure reliability according to the control target.

[0003] The function of a control device is generally composed of hardware such as a CPU (Central Processing Unit) and a memory, and software such as a controller application. A controller application and a controller refer to a control application, and hereinafter will be collectively referred to as a "controller". In addition, in a control device, applications other than the controller also operate. Hereinafter, they will be referred to as "APP (Application)". In addition, the controller and APP are collectively referred to as an application.

[0004] In a control device, an application may operate in a virtual environment on hardware. In that case, a configuration is adopted in which a plurality of VMs (Virtual Machines) operate on an OS (Operating System) and virtual hardware, and an application operates on each VM. A VM provides a virtual OS environment called a guest OS or a container.

[0005] In a control device, if either hardware or software malfunctions, it will interfere with the operation. Therefore, a control system has been proposed (Patent Document 1) that executes and outputs a predetermined calculation by a plurality of controllers, and selects one output value from each calculation value in a selection processing unit, thereby enhancing reliability while suppressing costs.

[0006] Furthermore, a software-related problem called a memory leak can occur. A memory leak is a phenomenon where, for example, a programmatic bug in an application causes it to request memory from the OS, but the memory is not released afterward. Repeated memory leaks can deplete the memory resources held by the OS, potentially leading to instability in the OS and all applications running on it.

[0007] Therefore, in a control system where an application runs in a virtual environment, for example, a restart of the guest OS or virtual machine such as a container and the application is performed to resolve instability caused by a memory leak. However, it is preferable to prevent unstable operation from occurring between the time a memory leak occurs and the restart, if possible. This is because if the application continues to operate in a partially unstable state, the operation of the inter-application interference prevention processing unit may not be able to completely suppress the impact. Therefore, it is conceivable to prevent errors from occurring by proactively restarting the application before it becomes unstable due to a memory leak.

[0008] As a countermeasure against such memory leaks, a technique has been proposed that involves restarting the software causing the memory leak and running multiple processes that provide the service, so that the service can continue even if some processes are restarted (Patent Document 2). [Prior art documents] [Patent Documents]

[0009] [Patent Document 1] Japanese Patent Publication No. 2020-27434 [Patent Document 2] Japanese Patent Publication No. 2011-54114 [Overview of the Initiative] [Problems that the invention aims to solve]

[0010] However, depending on the state of the memory leak, it may be possible to restart multiple applications simultaneously. In that case, the technique of selecting a single output value from the calculation values ​​of multiple controllers may not be able to make an appropriate selection depending on the number of applications being restarted. To address this, it has been proposed to intentionally allocate resources to different values ​​in order to avoid simultaneous operational instability caused by memory leaks. However, it is difficult to accurately predict the degree of memory leaks, and it is difficult to achieve optimal resource allocation. Therefore, it is difficult to avoid application operational instability and improve the reliability of the control system.

[0011] Furthermore, in a technique that involves running multiple processes providing a service and then restarting software that experiences memory leaks, it is difficult to provide highly reliable service while the number of processes running after the restart falls below the set number. Also, while this technique uses a queue for process management, queue management is difficult for real-time processing such as process control systems, and management in the queue can become cumbersome. Therefore, it is difficult to avoid application instability and improve the reliability of the control system.

[0012] The disclosed technology aims to provide a control device that improves the reliability of the control system by avoiding operational instability in the application. [Means for solving the problem]

[0013] In one embodiment of the control device disclosed in this application, the selection processing unit selects and outputs a second calculation result based on the first calculation result calculated by each of a first predetermined number of applications, each of which performs the same predetermined calculation. The application management unit determines whether the reliability of the second calculation result output by the selection processing unit based on the first calculation result from the first predetermined number of applications is ensured, when the number of applications obtained by excluding a second predetermined number of applications to be rebuilt from a plurality of applications, each of which performs the same predetermined calculation, is set to the first predetermined number, and if the reliability of the second calculation result is ensured, it performs the reconstruction of the second predetermined number of applications to be rebuilt. [Effects of the Invention]

[0014] In one respect, the present invention can improve the reliability of the control system by avoiding operational instability in the application. [Brief explanation of the drawing]

[0015] [Figure 1] This is a schematic diagram showing an example of a control system. [Figure 2] This is a flowchart of the rebuild process based on a rebuild request from the VM. [Figure 3] This is a flowchart of the reconstruction process based on the reconstruction decision made by the Application Management Department. [Figure 4] This figure shows an example of the configuration of a control system according to a modified example of Embodiment 1. [Figure 5] This is a hardware configuration diagram of the control unit. [Modes for carrying out the invention]

[0016] The embodiments of the control device disclosed in this application will be described in detail below with reference to the drawings. However, the present invention is not limited by these embodiments. Furthermore, the same elements are denoted by the same reference numerals, redundant descriptions are omitted as appropriate, and each embodiment can be combined as appropriate within the bounds of consistency.

[0017] [Embodiment 1] [Overall Configuration] FIG. 1 is a schematic diagram showing an example of a control system. The control system 1 shown in FIG. 1 is connected to a sensor 20 and a drive device 30 via a network. The control system 1 is used, for example, for controlling an industrial process 40 of a plant. In this specification, the plant includes industrial plants such as chemical plants, plants for managing and controlling wellheads or their surroundings such as gas fields or oil fields, plants for managing and controlling power generation such as hydraulic, thermal, or nuclear power, plants for managing and controlling environmental power generation such as solar power or wind power, and plants for managing and controlling water and sewage or dams.

[0018] The sensor 20 is provided in the industrial process 40 and measures physical quantities in the industrial process 40. The sensor 20 transmits the measured physical quantity as a measurement signal to the input device 11 of the control system 1 via a network. In this specification, the sensor 20 includes, for example, sensor devices such as pressure gauges, flow meters, and temperature sensors, microphones for collecting abnormal sounds in the plant, position detection devices for outputting the position information of each device, and imaging devices such as cameras and videos for photographing the situation and objects in the plant.

[0019] When the drive device 30 receives an input of a control signal from the output device 12, it drives the industrial process 40 according to the control signal. The drive device 30 also includes valve devices such as flow control valves and on-off valves, and acoustic devices such as speakers that emit operation sounds and alarm sounds of fans and motors.

[0020] As shown in FIG. 1, the control system 1 includes a control device 10, an input device 11, and an output device 12. The control device 10 is connected to the input device 11 and the output device 12 via a network.

[0021] The input device 11 receives an input of a measurement signal from the sensor 20. Then, the input device 11 transmits the received signal to the control device 10.

[0022] The output device 12 receives the control signal transmitted from the control device 10. The output device 12 then outputs the received control signal to the drive device 30. The drive device 30 operates the industrial process 40 according to the control signal. Here, the input device 11 and the output device 12 may be integrated as hardware.

[0023] [Control device configuration] The control device 10 performs predetermined calculation processing based on the measurement signal input from the input device 11 and outputs a control signal corresponding to the calculation result to the output device 12 via the network. The control device 10 is composed of, for example, a computer device. The control device 10 may also be included in a distributed control system (DCS). The control device 10 performs calculation processing on the measurement signal input from the input device 11 using a predetermined algorithm and generates a control signal. The functions of the control device 10 consist of hardware 110 such as a CPU and memory, and software including the OS 120, VMs 131 to 133, controllers 141 to 143, and APPs 151 to 153. In the following description, if VMs 131 to 133 are not distinguished, they will be collectively referred to as "VM130". Similarly, if controllers 141 to 143 are not distinguished, they will be collectively referred to as "controller 140". Similarly, if APPs 151 to 153 are not distinguished, they will be collectively referred to as "APP150".

[0024] The control device 10 avoids unstable operation of the controller 140 by rebuilding it before the effects of the software error become apparent, rather than dealing with the unstable operation of the controller 140 after it occurs due to a software error such as a memory leak. In this way, it is easier to eliminate the overall adverse effects of software errors by systematically rebuilding the controller 140 rather than trying to suppress the effects of an unstable controller 140.

[0025] When the controller 140 is rebuilt, the control device 10 controls the controller 140 to operate at a number sufficient to ensure the reliability of the control system 1, in order to maintain the correct selection of output values ​​in the selection processing unit 160. Furthermore, the control device 10 ensures the reliability of the control system 1 by performing reconstruction such as restarting or reinstalling the controller 140 using a simple mechanism described below. Details of the control device 10 are described below.

[0026] The control device 10 runs the OS 120 on the hardware 110. The OS 120 operates as the host OS, for example, when VM 130 is the guest OS. When the OS 120 receives instructions from the application management unit 170 to start a new VM 130 and controller 140, it starts the VM 130 and controller 140 anew.

[0027] The control device 10 runs multiple virtual machines, VMs 131 to 133, on the OS 120. VM 130 is a guest OS or container. Each of VMs 131 to 133 runs controllers 141 to 143 and apps 151 to 153.

[0028] Furthermore, each VM130 predicts that a software error is likely to affect the operation of the controller 140. In other words, multiple VM130 virtual machines each operate the controller 140, which is an individual application that performs predetermined calculations, and predict the occurrence of failures in the controller 140 they operate.

[0029] For example, VM130 detects an increase in its own memory usage and predicts that a memory leak may soon affect the operation of controller 140. Other examples of software errors include unstable operation due to the application of security patches to OS120. VM130 may also predict that a soft error, such as a bit error caused by cosmic rays, may soon affect the operation of controller 140. In the following explanation, we will use software errors as an example, but VM130 can operate similarly for soft errors. In the following, the prediction that a software error may soon affect the operation of controller 140 will be referred to as "software error prediction."

[0030] There are no particular restrictions on how VM130 predicts software errors. For example, VM130 predicts a software error when the CPU (Central Processing Unit) temperature exceeds a threshold for a certain period of time or longer. Alternatively, VM130 may predict software errors using the operating time of the control device 10, the operating time of the application including the controller 140, or the number of operation steps. Furthermore, VM130 may predict software errors using any one of these methods, or it may use a combination of multiple methods.

[0031] If VM130 anticipates a software error, it designates the controller 140 it operates as the target for reconstruction and notifies the application management unit 170 of a request to rebuild the controller 140. Subsequently, upon receiving the reconstruction instruction from the application management unit 170, VM130 executes the reconstruction of the controller 140.

[0032] Here, the reconstruction of controller 140 can be done by any method that allows the arithmetic processing function of controller 140 to be stopped and then restored. That is, the reconstruction of controller 140 includes restarting VM130 which runs controller 140, stopping and starting VM130, and reinstalling VM130. Starting VM130 after stopping is different from a simple restart; it refers to the process of starting VM130 after it has been shut down. In this case, the information in memory is completely cleared. Also, in the case of reinstalling VM130, VM130 and controller 140 will restart from their initial state. Here, controller 140 is an example of an "application". That is, "reconstructing an application" refers to actions that allow the arithmetic processing function of an application to be stopped and then restored, such as restarting, starting after stopping, and reinstalling. Restarting controller 140 by restarting VM130 and starting controller 140 after stopping VM130 are examples of "stopping and starting".

[0033] Furthermore, the control device 10 operates the controller 140 and APP 150 in each VM 130. APP 150 is an application other than the controller 140. The control device 10 according to this embodiment has three or more sets of VM 130 and controller 140. Note that APP 150 may control the timing of outputting values ​​calculated by the controller 140.

[0034] The controller 140 receives the measurement signal input from the sensor 20 via the input device 11. Next, the controller 140 calculates a value to be applied to the drive device 30 based on the measurement signal input from the sensor 20. In other words, the controller 140 is an application that performs predetermined calculations to calculate control values ​​for the industrial process 40. Each controller 140 performs calculation processing on the input measurement signal using a predetermined algorithm and outputs the calculation result. Each controller 140 performs the same control calculation. The same control calculation is an calculation that yields exactly the same result if the input values ​​are the same and the calculation is performed correctly.

[0035] Furthermore, the control device 10 has a selection processing unit 160 that operates on the hardware 110. In this embodiment, the selection processing unit 160 is described as operating on the hardware 110, but the selection processing unit 160 may also operate on the OS 120. In this embodiment, the selection processing unit 160 is configured by software. In this case, the selection processing unit 160 may be built on the hardware 110, for example, with dedicated firmware.

[0036] The selection processing unit 160 manages the operation of each controller 140. Then, upon receiving a request from the application management unit 170, the selection processing unit 160 notifies the application management unit 170 of the total number of controllers 140 that perform the same control calculation.

[0037] Furthermore, the selection processing unit 160 receives input from each controller 140, which is the calculated value calculated by each controller 140. Here, for illustrative purposes, Figure 1 shows the communication path from controller 143 to the selection processing unit 160, but similar communication paths extend from the other controllers 140 to the selection processing unit 160.

[0038] The selection processing unit 160 selects an output value based on the calculated values ​​calculated by each controller 140. Specifically, the selection processing unit 160 selects one calculated value from among the calculated values ​​output from each controller 140 as the output value. Then, the selection processing unit 160 outputs a control signal based on the selected output value to the output device 12. This control signal is transmitted to the drive device 30, which then operates the industrial process 40 according to the control signal. In this way, the selection processing unit 160 selects and outputs a calculation result based on the calculation results of each of the multiple controllers 140 that perform predetermined calculations to calculate control values ​​for the industrial process 40.

[0039] For example, let's consider a case where sensor 20 is a sensor that measures flow rate, and the drive unit 30 is attached to a pipe and consists of an actuator that adjusts the opening degree of a valve that controls the flow rate of fluid flowing through the pipe. In this case, a signal containing information about the flow rate measured by sensor 20 is input to control device 10. The selection processing unit 160 calculates a value to be output to the actuator based on the flow rate information acquired by each of the multiple controllers 140 and obtains the result as a calculated value. Next, the selection processing unit 160 selects one of the acquired calculated values ​​as the output value. After that, the selection processing unit 160 outputs a control signal to output device 12 based on the selected output value. Subsequently, when the drive unit 30 receives the control signal, the flow rate of fluid flowing through the pipe is adjusted based on the output value.

[0040] The selection process for selecting calculated values ​​by the selection processing unit 160 will be explained in more detail. The selection processing unit 160 selects the calculated value to be output from among the calculated values ​​output from multiple controllers 140 using a majority voting logic. That is, the selection processing unit 160 selects the calculated value that was output most frequently from among the calculated values ​​output from multiple controllers 140 as the output value. Alternatively, the selection processing unit 160 may select the calculated value that was output by more than half of the controllers 140 from among the calculated values ​​output from multiple controllers 140 as the output value. Here, even if the values ​​do not perfectly match, they may be considered identical if they are within a predetermined tolerance range. It is preferable to set an appropriate value for the tolerance range depending on the operation, for example, within ±1%. Furthermore, if there are multiple calculated values ​​within the tolerance range, the selection processing unit 160 may, for example, calculate the average value of the multiple calculated values ​​and output it as the output value. In addition, if there are three or more calculated values ​​within the tolerance range, the selection processing unit 160 may calculate the median and output it as the output value. In this way, if a representative value of multiple calculation values ​​within an acceptable range can be calculated and used as the output value, the selection processing unit 160 may determine the output value by other methods.

[0041] For example, if there are three controllers 140, the selection processing unit 160 obtains the calculated values ​​output from each of the three controllers 140. Now, let's consider the case where two of the controllers 140 output the same calculated value and the other controller 140 outputs a different calculated value. In this case, the selection processing unit 160 selects the calculated value that was output most frequently by the two controllers 140 as the output value.

[0042] The selection processing unit 160 selects one output value from the calculated values ​​input from each controller 140 using a majority voting logic, thereby outputting a calculated value that can be considered normal even if some of the VM 130 or some of the controllers 140 are malfunctioning. As a result, the control device 10 can continuously output an output value that can be considered normal and can drive the drive device 30 normally. However, in order to ensure the reliability of the selection processing unit 160 in obtaining a calculated value that can be considered normal, it is preferable that at least the minimum number of controllers 140 required to ensure reliability using the majority voting logic are in operation.

[0043] Furthermore, the selection processing unit 160 manages the total number of controllers 140 and the number of controllers 140 that perform the same control calculation. When the selection processing unit 160 receives output from a new controller 140, it increases the number of controllers 140 that perform the same control calculation by one. Conversely, if the selection processing unit 160 detects an abnormality in a controller 140 through value comparison or the like, it decreases the number of controllers 140 that perform the same control calculation by one.

[0044] Furthermore, the control device 10 has an application management unit 170 that operates on the hardware 110. Here, although the selection processing unit 160 and the application management unit 170 are shown separately in Figure 1, the application management unit 170 may be included in the selection processing unit 160 as part of its functions.

[0045] The application management unit 170 manages the operational status of applications, including VM130 and controller140, such as whether they are running or stopped. Furthermore, the application management unit 170 issues instructions for operations such as starting, stopping, and restarting VM130. In addition, when rebuilding controller140, the application management unit 170 determines whether rebuilding is possible and, if rebuilding is possible, executes the rebuilding of controller140.

[0046] Specifically, when the application management unit 170 receives a notification from VM130 regarding a predicted software error, it determines whether or not to rebuild the controller 140 operated by the VM130 that sent the notification. Furthermore, when the state of VM130 or controller 140 reaches predetermined conditions, the application management unit 170 determines whether or not to rebuild the controller 140 operated by the VM130 that has reached those predetermined conditions, or the controller 140 that has reached those predetermined conditions. Reaching predetermined conditions means, for example, when the operating time of VM130 exceeds a predetermined time.

[0047] Here, the application management unit 170 can change the criteria for identifying the target for restart based on predetermined conditions, depending on the system environment. For example, the application management unit 170 changes the operating time, which is the criterion for deciding whether to rebuild a particular controller 140, based on the memory size allocated to each VM 130. That is, the application management unit 170 calculates the operating time, which is the criterion for the predetermined conditions, by multiplying the installed memory size by a coefficient. For example, if the memory size allocated to VM 130 is 4GB, the application management unit 170 calculates the operating time, which is the criterion for the predetermined conditions, as 4 × 1 day = 4 days. Also, if the memory size allocated to VM 130 is 8GB, the application management unit 170 calculates the operating time, which is the criterion for the predetermined conditions, as 8 × 1 day = 8 days.

[0048] In both cases—when a rebuild request is received from VM130 and when the application management unit 170 itself determines which controller 140 to restart—the application management unit 170 performs the following determination process to determine whether or not to rebuild. The details of the determination process by the application management unit 170 to determine whether or not to rebuild are described below.

[0049] The application management unit 170 obtains the total number of controllers 140 that perform the same control calculation from the selection processing unit 160. Next, the application management unit 170 subtracts the number of controllers 140 to be rebuilt from the total number of controllers 140 that perform the same control calculation to calculate the number of controllers 140 that perform the same control calculation that will be running during the rebuilding process. Hereinafter, the controllers 140 that perform the same control calculation that will be running during the rebuilding process will be referred to as "controllers 140 running during rebuilding." The application management unit 170 then determines whether the reliability of the control system 1 can be ensured by the controllers 140 running during the rebuilding process. Ensuring the reliability of the control system 1 means ensuring the reliability of the selection processing unit 160 in selecting the calculation value that it deems correct using majority voting logic. In other words, if the reliability of the control system 1 can be ensured, the control device 10 can drive the drive device 30 normally.

[0050] For example, the application management unit 170 determines that the reliability of the control system 1 can be ensured if the number of controllers 140 operating during reconstruction is more than half of the original total number of controllers 140 that perform the same control calculation. Here, we will explain using the case where the total number of controllers 140 that perform the same control calculation is 5 as an example. If the number of controllers 140 to be reconstructed is 1, the application management unit 170 determines that the reliability of the control system 1 can be ensured because the number of controllers 140 operating during reconstruction is 4, which is more than half of the original total. On the other hand, if the number of controllers 140 to be reconstructed is 3, the application management unit 170 determines that it is difficult to ensure the reliability of the control system 1 because the number of controllers 140 operating during reconstruction is 2, which is less than half of the original total.

[0051] If the application management unit 170 determines that the reliability of the control system 1 can be ensured, it determines that it is possible to rebuild the controller 140 to be rebuilt. The application management unit 170 then instructs the VM 130 on which the controller 140 to be rebuilt operates to rebuild the controller 140 that the VM 130 operates. In other words, the application management unit 170 selects one or more of the controllers 140 to be rebuilt, determines whether the reliability of the output value by the selection processing unit 160 can be ensured by the calculations of the controllers 140 other than the target of reconstruction, and executes the rebuilding of the controller 140 to be rebuilt if reliability can be ensured. Furthermore, the application management unit 170 determines whether or not to rebuild each controller 140 based on the operating status of the VM 130 and the controllers 140, determines whether or not reliability can be ensured by the calculations of the controllers 140 other than the target of reconstruction, and executes the rebuilding of the controller 140 to be rebuilt if reliability can be ensured.

[0052] If the application management unit 170 determines that the overall reliability of the control system 1 cannot be ensured, it will postpone the execution of the reconstruction for a certain reassessment period. The reassessment period can be, for example, one minute. After the reassessment period has elapsed, the application management unit 170 will re-execute the process of determining whether or not to proceed with the reconstruction.

[0053] When the process of determining whether or not reconstruction is possible is repeated, the application management unit 170 determines whether or not a certain upper limit time has been reached. The upper limit time can be, for example, 5 minutes. If reconstruction cannot be performed even after the upper limit time has elapsed, the application management unit 170 instructs the OS 120 to start a new VM 130 and controller 140. After the new controller 140 is added, the application management unit 170 obtains the total number of controllers 140 that perform the same control calculation, including the new controller 140, from the selection processing unit 160. Then, the application management unit 170 uses the newly obtained total number to perform the process of determining whether or not reconstruction is possible again.

[0054] Here, the logic used by the application management unit 170 to determine whether or not to rebuild is variable depending on the reliability required for the same control calculation performed by the target controller 140. For example, the application management unit 170 can use different logic to determine whether or not to restart as follows: If high reliability is required for the same control calculation performed by the controller 140, the application management unit 170 will determine that the overall reliability of the control system 1 can be ensured and will perform a restart if more than half of the controllers are operational (e.g., 3 out of 5 are operational). Conversely, if high reliability is not required for the same control calculation performed by the controller 140, the application management unit 170 will determine that the overall reliability of the control system 1 can be ensured and will perform a restart if multiple controllers are operational (e.g., 2 out of 5 are operational).

[0055] In addition, the application management unit 170 may also determine whether or not to restart by adding a minimum number condition, such as 3 or more, for the number of controllers 140 operating during reconstruction. However, the probability that the selection processing unit 160 can ultimately select the correct output is higher when there are 3 controllers 140 operating during reconstruction than 2, and 4 controllers than 3. Therefore, it is preferable to set the minimum number of controllers 140 operating during reconstruction according to the operating status.

[0056] [Reconstruction process] Figure 2 is a flowchart of the reconstruction process based on a reconstruction request from a VM. Next, referring to Figure 2, the flow of the reconstruction process based on the reconstruction requests from VMs 130 and others in the control device 10 according to Embodiment 1 will be explained.

[0057] The application management unit 170 receives a rebuild request from VM130 (step S101).

[0058] Next, the application management unit 170 obtains the total number of controllers 140 that perform the same control calculation from the selection processing unit 160 (step S102).

[0059] Next, the application management unit 170 determines whether the reliability of the control system 1 can be ensured even if the controller 140, which is the source of the reconstruction request and is the target of reconstruction, is stopped (step S103).

[0060] If the reliability of the control system 1 can be ensured even if the controller 140 to be rebuilt is stopped (step S103: affirmative), the application management unit 170 instructs the VM 130 that operates the controller 140 to be rebuilt to perform the rebuild (step S104). Then, the application management unit 170 terminates the rebuild process.

[0061] In contrast, if stopping the controller 140 to be rebuilt would make it difficult to ensure the reliability of the control system 1 (step S103: negative), the application management unit 170 waits for a predetermined period of time, which is a re-evaluation time (step S105).

[0062] Next, the application management unit 170 determines whether a predetermined time limit, which is longer than the restart determination time, has elapsed (step S106). If the upper limit time has not elapsed (step S106: negative), the application management unit 170 returns to step S102.

[0063] In response to this, if the maximum time limit has elapsed (step S106: affirmative), the application management unit 170 instructs the OS 120 to start a new VM 130 and controller 140 (step S107). After that, the application management unit 170 returns to step S102.

[0064] Figure 3 is a flowchart of the reconstruction process based on the reconstruction decision made by the application management unit. Next, referring to Figure 3, the flow of the reconstruction process based on the reconstruction decision made by the application management unit 170 in the control device 10 according to Embodiment 1 will be explained.

[0065] The application management unit 170 determines which controller 140 to be rebuilt based on the operating time of VM 130 and controller 140 (step S201).

[0066] Next, the application management unit 170 obtains the total number of controllers 140 that perform the same control calculation from the selection processing unit 160 (step S202).

[0067] Next, the application management unit 170 determines whether the reliability of the control system 1 can be ensured even if the controller 140 to be rebuilt is stopped (step S203).

[0068] If the reliability of the control system 1 can be ensured even if the controller 140 to be rebuilt is stopped (step S203: affirmative), the application management unit 170 instructs the VM 130 that operates the controller 140 to be rebuilt to perform the rebuild (step S204). Then, the application management unit 170 terminates the rebuild process.

[0069] In contrast, if stopping the controller 140 to be rebuilt would make it difficult to ensure the reliability of the control system 1 (step S203: negative), the application management unit 170 waits for a predetermined period of time, which is a re-evaluation time (step S205).

[0070] Next, the application management unit 170 determines whether a predetermined time limit, which is longer than the restart determination time, has elapsed (step S206). If the upper limit time limit has not elapsed (step S206: negative), the application management unit 170 returns to step S202.

[0071] In response to this, if the maximum time limit has elapsed (step S206: affirmative), the application management unit 170 instructs the OS 120 to start a new VM 130 and controller 140 (step S207). After that, the application management unit 170 returns to step S202.

[0072] In this embodiment, the application management unit 170 determines which VM130 to restart when the state of VM130 or controller 140 reaches predetermined conditions. However, each VM130 may perform the process of determining which VM130 to restart. In that case, when the state of VM130 or controller 140 reaches predetermined conditions, VM130 notifies the application management unit 170 of the restart instruction for the VM130 or controller 140 that it has selected to restart, similar to the case of software error prediction.

[0073] For example, VM130 determines whether the operating time of the controller 140 it operates exceeds an operating time threshold corresponding to the memory size allocated to it. If the operating time of the controller 140 it operates exceeds the operating time threshold, VM130 predicts the occurrence of a software error. Then, VM130 notifies the application management unit 170 of a rebuild request. In this case, based on the notification from VM130, the application management unit 170 determines which controller 140 to rebuild and executes a process to determine whether or not to rebuild it.

[0074] [effect] As described above, the control system 1 according to this embodiment predicts that a software error will affect the operation of the system and targets the controller 140 for reconstruction if such a software error is predicted. Furthermore, the control system 1 targets the VM 130 and its controller 140 for reconstruction when the state of the VM 130 or controller 140 reaches predetermined conditions. The control system 1 then determines whether the reliability of the system can be ensured even if the controller 140 targeted for reconstruction stops, and if so, it performs the reconstruction of the VM 130 targeted for reconstruction.

[0075] This allows the control system 1 to reconstruct the controller 140 in advance, before software errors such as memory leaks actually occur, thereby mitigating reliability degradation such as interruptions in control operations due to software errors. Furthermore, the control system 1 can ensure reliability, including the continuation of control operations, even during the reconstruction of the controller 140, thus maintaining reliability throughout the entire system operation, including normal operation and reconstruction processing. Consequently, it is possible to avoid application instability and improve the reliability of the control system 1.

[0076] (modified version) In the embodiment 1 described above, the entire system was described as running on a single piece of hardware 110, but the system configuration is not limited to this.

[0077] For example, multiple operating systems 120 may run on hardware 110, and one or more VMs 130 may run on each OS 120. Alternatively, there may be multiple hardware 110s, each running one or more VMs 130. In that case, the selection processing unit 160 and application management unit 170 of any of the hardware 110s may coordinate the selection processing of calculation values ​​and the reconstruction of VMs 130 across multiple hardware 110s.

[0078] Furthermore, one or more controllers 140 may be physically independent from the hardware 110. Also, a controller 140 operating on the hardware 110 and a physically independent controller 140 may coexist. Additionally, the application management unit 170 and the selection processing unit 160 may operate on hardware 110 different from the VM 130 and the controller 140.

[0079] Figure 4 shows an example of the configuration of a control system according to a modified embodiment of Embodiment 1. In Figure 4, the control system 1 has two control devices 10. Furthermore, the control system 1 has two physical controllers 400 on which controller 402 operates using dedicated controller hardware 401. Controller 402 can perform the same control calculations as controller 140. In addition to the physical controllers 400, controller 402 may also be located on a server in the cloud or on a network.

[0080] In this case, the selection processing unit 160 and application management unit 170 of either of the two control devices 10 may perform the selection processing of the calculated values ​​of all VMs 130, as well as controllers 140 and 402, and the reconstruction of VMs 130. Alternatively, if controllers 140 and 402 are divided into multiple groups that perform different identical control calculations, the selection processing unit 160 and application management unit 170 responsible for each group may be assigned.

[0081] In this case, if the VM130 running the controller 140 that is to be rebuilt is running on a different OS120 than other VM130s, the rebuilding of the controller 140 may include restarting OS120, stopping and then starting OS120, and reinstalling OS120.

[0082] [Embodiment 2] Next, Embodiment 2 will be described. The control device 10 according to this embodiment is also represented by the block diagram in Figure 1. The control device 10 according to this embodiment identifies the controller 140 with unique operation and requests a reconstruction. In the following description, the operation of each part, which is the same as in Embodiment 1, will be omitted.

[0083] The selection processing unit 160 receives calculated values ​​from each controller 140. The selection processing unit 160 then identifies the controller 140 with unusual behavior based on the received calculated values. Subsequently, the selection processing unit 160 outputs a reconstruction request for the identified controller 140 with unusual behavior to the application management unit 170.

[0084] For example, the selection processing unit 160 identifies a particular controller 140 as a controller 140 with unique operation when the calculation result of that particular controller 140 differs from that of a group of controllers 140 that perform the same control calculation. The selection processing unit 160 may determine that the calculation result of that particular controller 140 is different when the calculation result differs once, or it may determine that the calculation result of that particular controller 140 is different when the calculation result differs multiple times. Furthermore, the selection processing unit 160 may determine that the calculation result of that particular controller 140 is different when the calculation result differs a predetermined number of times consecutively, or it may determine that the calculation result of that particular controller 140 is different when the cumulative number of differing results reaches a predetermined number.

[0085] In addition, for example, if the system is designed to receive calculation results within a certain time range, the selection processing unit 160 identifies a particular controller 140 as a controller 140 with unusual behavior if the reception of calculation results from that controller 140 is delayed by a certain amount of time or more. This is because, for example, the processing power of the controller 140 may be reduced due to a memory leak, so the selection processing unit 160 identifies a particular controller 140 whose reception of calculation results is delayed by a certain amount of time or more as a controller 140 with unusual behavior. Here, since the timing at which calculation results arrive at the selection processing unit 160 from multiple applications may differ, the selection processing unit 160 may have a function to wait for a certain period of time for the calculation results to arrive.

[0086] Furthermore, the selection processing unit 160 may identify the controller 140 that output the calculation value that was not selected from among the calculation values ​​of the same control calculation as the controller 140 with unique operation.

[0087] In this way, the selection processing unit 160 detects abnormal operation of the controller 140 based on the results of the calculations it receives from the application controller 140.

[0088] Furthermore, VM130 may identify a controller 140 with unusual operation. For example, as a result of monitoring general operating conditions, VM130 detects a failure that can be recovered by restarting VM130, such as CPU load or network anomalies, and determines that the operation of the controller 140 it operates is unusual. Then, VM130 requests a rebuild from the application management unit 170.

[0089] The application management unit 170 receives a request from the selection processing unit 160 to rebuild a controller 140 exhibiting unusual behavior. The application management unit 170 then determines whether or not to rebuild the controller 140 designated as the controller 140 exhibiting unusual behavior. If the application management unit 170 determines that rebuilding is possible, it instructs the VM 130 that operates the designated controller 140 exhibiting unusual behavior to perform the rebuild.

[0090] Furthermore, the application management unit 170 may receive a rebuild request from a VM 130 that has determined that the operation of the controller 140 it operates is unusual. The application management unit 170 then targets the controller 140 operated by the VM 130 that sent the rebuild request for rebuilding. Subsequently, the application management unit 170 performs a determination process to determine whether rebuilding is possible, and if rebuilding is possible, it instructs the VM 130 operating the controller 140 with unusual operation to rebuild it.

[0091] In this manner, the application management unit 170 identifies the controller 140 with unusual behavior detected by the selection processing unit 160 as a target for reconstruction, determines whether reliability can be ensured by the calculations of the other controllers 140, and if reliability can be ensured, executes the reconstruction of the target controller 140.

[0092] As described above, the control system 1 according to this embodiment identifies a controller 140 with unusual operation and reconstructs the VM 130 that operates the identified controller 140. This makes it possible to reconstruct a controller 140 that is performing unstable operation that may affect the operation of the control system 1, in addition to software errors, before an actual failure occurs, thereby improving the reliability of the control system 1.

[0093] [system] Unless otherwise specified, the processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings may be changed at will.

[0094] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown. That is, all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions.

[0095] Furthermore, each processing function performed by each device may be implemented, in whole or in part, by a CPU and a program executed for analysis by that CPU, or by wired logic hardware.

[0096] [Hardware] Next, an example of the hardware configuration of the control device 10 will be described. Figure 5 is a hardware configuration diagram of the control device. As shown in Figure 5, the control device 10 has a processor 91, memory 92, communication device 93, and HDD (Hard Disk Drive) 94. The processor 91, memory 92, communication device 93, and HDD 94 are examples of the hardware 110 illustrated in Figure 1. The processor 91 is connected to the memory 92, communication device 93, and HDD 94 via a bus.

[0097] The communication device 93 is a network interface card or the like, and is used for communication with other information processing devices. For example, if there are multiple control devices 10, the communication device 93 relays communication between the processors 91 of different control devices 10.

[0098] HDD94 is an auxiliary storage device. HDD94 stores various programs, including programs that implement the functions of OS120, VM131~133, controllers141~143, APP151~153, selection processing unit 160, and application management unit 170, as illustrated in Figure 1.

[0099] The processor 91 reads various programs stored in the HDD 94, loads them into memory 92, and executes them. This allows the processor 91 to implement the functions of the OS 120, VMs 131-133, controllers 141-143, APPs 151-153, selection processing unit 160, and application management unit 170, as illustrated in Figure 1.

[0100] Thus, the control device 10 operates as an information processing device that performs various processing methods by reading and executing a program. Furthermore, the control device 10 can also achieve the same functionality as the embodiment described above by reading the program from the recording medium using a media reader and executing the read program. It should be noted that the program referred to here is not limited to being executed by the control device 10. For example, the present invention can be similarly applied when another computer or server executes the program, or when these computers or servers collaborate to execute the program.

[0101] This program can be distributed via networks such as the Internet. Furthermore, this program can be recorded on computer-readable storage media such as hard disks, flexible disks (FDs), CD-ROMs, MO (Magneto-Optical disks), and DVDs (Digital Versatile Discs), and executed by reading the program from these media using a computer.

[0102] Some examples of the combinations of technical features that will be disclosed are listed below.

[0103] (1) A selection processing unit that selects and outputs a second calculation result based on the first calculation result calculated by each of a first predetermined number of applications, each of which performs the same predetermined calculation, The application management unit determines whether the reliability of the second calculation result output by the selection processing unit can be ensured based on the first calculation result of the first predetermined number of applications, when the number of applications obtained by excluding a second predetermined number of applications to be rebuilt from multiple applications, each of which performs the same predetermined calculation, is set to the first predetermined number, and if the reliability of the second calculation result can be ensured, it reconstructs the second predetermined number of applications to be rebuilt. A control device characterized by being equipped with (2) The selection processing unit selects the output calculation result using a majority voting logic for the first calculation result. The control device according to (1), characterized in that (3) The control device according to (2), characterized in that the application management unit determines that reliability can be ensured when the first predetermined number is equal to or greater than the number of applications for which the reliability of the output using the majority voting logic of the selection processing unit can be ensured. (4) The control device according to any one of (1) to (3), characterized in that the application management unit determines the second predetermined number of applications to be reconstructed based on the operating status of the applications. (5) The selection processing unit detects abnormal operation of the application based on the results of the calculations received from each of the applications, The application management unit determines that the application in which abnormal operation was detected by the selection processing unit is one of the second predetermined number of applications to be reconstructed. A control device according to any one of (1) to (4), characterized by the above. [Explanation of symbols]

[0104] 1. Control System 10 Control device 11 Input devices 12 Output device 20 sensors 30 Drive unit 110 Hardware 120 OS 130-133 VMs (Virtual Machines) 140-143 Controller 150~153 APP 160 Selection Processing Unit 170 Application Management Department

Claims

1. A selection processing unit that selects and outputs a second calculation result based on the first calculation result calculated by each of a first predetermined number of applications, each of which performs the same predetermined calculation, The application management unit determines whether the reliability of the second calculation result output by the selection processing unit can be ensured based on the first calculation result of the first predetermined number of applications, when the number of applications obtained by excluding a second predetermined number of applications to be rebuilt from a plurality of applications each performing the same predetermined calculation, is determined, and if the reliability of the second calculation result can be ensured, it reconstructs the second predetermined number of applications to be rebuilt. A control device characterized by being equipped with

2. The selection processing unit selects the output calculation result using a majority voting logic for the first calculation result. The control device according to feature 1.

3. The control device according to claim 2, characterized in that the application management unit determines that reliability can be ensured when the first predetermined number is equal to or greater than the number of applications for which the reliability of the output using the majority voting logic of the selection processing unit can be ensured.

4. The control device according to claim 1, characterized in that the application management unit determines the second predetermined number of applications to be reconstructed based on the operating status of the applications.

5. The selection processing unit detects abnormal operation of the application based on the results of the calculations received from each of the applications, The application management unit determines that the application in which abnormal operation was detected by the selection processing unit is one of the second predetermined number of applications to be reconstructed. The control device according to feature 1.

Images