Control device, control program, control method, control unit, and control system

Abstract

Provided are a control device, a control program, a control method, a control unit, and a control system that are capable of suitably communicating with a control panel of electrical equipment.　In the present invention, a first control device comprises at least one processor in order to transmit control information to a control panel of electrical equipment installed in a facility. The at least one processor: transmits candidate information indicating that the first control device is a candidate of a transmission source of the control information with respect to a second control device which is different from the first control device and which is configured to be capable of transmitting the control information to the control panel, and with respect to a third control device which is different from the first control device and the second control device and which is configured to be capable of transmitting the control information to the control panel; and determines, when receiving response information with respect to the candidate information from the second control device and the third control device, whether or not the first control device is the transmission source of the control information, on the basis of the received response information.

Description

Control device, control program, control method, control unit, and control system

[0001] The present disclosure relates to a first control device, a control program, a control method, a control unit, and a control system that remotely control the operation of electrical equipment installed in each facility.

[0002] It has been known for some time that an elevator, which is a type of electrical equipment installed in a building, can be monitored by transmitting image information about the surrounding area to an external information device and using an internet connection. For example, Patent Document 1 describes "an elevator comprising: a car that moves up and down in a hoistway; an upper camera installed above the car and capable of capturing an image of an area above the car; a lower camera installed below the car and capable of capturing an image of an area below the car; and a transmitter capable of transmitting to the outside an upper image signal including upper image information based on an upper image captured by the upper camera and a lower image signal including lower image information based on a lower image captured by the lower camera."

[0003] However, the elevator described in Patent Document 1 uses a control panel that can use an internet connection in order to monitor the elevator using an internet connection. Therefore, in an elevator that uses an existing control panel that does not use an internet connection, in order to introduce the technology described in Patent Document 1, the existing control panel needs to be replaced with a control panel that can use an internet connection, which results in high introduction costs.

[0004] Japanese Patent Application Laid-Open No. 2020-29321

[0005] The present disclosure has been made in light of the above-mentioned background, and aims to provide a control device, a control program, a control method, a control unit, and a control system that can suitably transmit control information to a control panel of electrical equipment.

[0006] According to one aspect of the present disclosure, there is provided a first control device having at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, wherein the at least one processor transmits candidate information indicating that the first control device is a candidate source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and to a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, and upon receiving response information to the candidate information from the second control device and the third control device, respectively, the first control device is configured to execute processing to determine whether the first control device is a candidate source of the control information based on the received response information.

[0007] According to one aspect of the present disclosure, there is provided a "control unit including at least a first control device, a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device."

[0008] According to one aspect of the present disclosure, there is provided a control system including: a control unit including at least a first control device as described in claim 1, configured to be capable of transmitting control information to a control panel of electrical equipment installed in a facility; a second control device configured to be capable of transmitting the control information to the control panel and different from the first control device; and a third control device configured to be capable of transmitting the control information to the control panel and different from the first control device and the second control device; and a management device communicatively connected to the control unit and configured to manage the control panel via the control device.

[0009] According to one aspect of the present disclosure, there is provided a control system including: a control panel configured to control electrical equipment installed in a facility; a control unit including at least a first control device described in claim 1 configured to be able to transmit control information to the control panel; a second control device configured to be able to transmit the control information to the control panel and different from the first control device; and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device; and a management device communicatively connected to the control unit and configured to manage the control panel via the control devices.

[0010] According to one aspect of the present disclosure, there is provided a control program that causes a first control device having at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility to function as follows: transmitting candidate information indicating that the first control device is a candidate for the source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and to a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device; and, upon receiving response information to the candidate information from the second control device and the third control device, respectively, executing a process to determine whether the first control device is the source of the control information based on the received response information.

[0011] According to one aspect of the present disclosure, there is provided a control method executed by at least one processor in a first control device having at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, the control method including: a step of transmitting candidate information indicating that the first control device is a candidate for a source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and to a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device; and a step of receiving response information to the candidate information from the second control device and the third control device, respectively, and determining whether or not the first control device is a source of the control information based on the received response information.

[0012] According to the present disclosure, it is possible to provide a control device, a control program, a control method, a control unit, and a control system that can suitably transmit control information to a control panel of electrical equipment.

[0013] It should be noted that the above effects are merely illustrative for the sake of convenience and are not limiting. In addition to or instead of the above effects, any effect described in this disclosure or an effect obvious to a person skilled in the art may be achieved.

[0014] FIG. 1 is a diagram illustrating a schematic configuration of a control system 1 according to the present disclosure. FIG. 2 is a block diagram illustrating an example configuration of a control device 200 according to the present disclosure. FIG. 3 is a block diagram illustrating an example configuration of a management device 500 according to the present disclosure. FIG. 4 is a diagram conceptually illustrating a control information table stored in the control device 200 and the management device 500 according to the present disclosure. FIG. 5A is a diagram illustrating a processing sequence executed between the communication device 100, the control device 200, the control panel 300, and the management device 500 according to the present disclosure. FIG. 5B is a diagram illustrating a processing sequence executed between the first control device, the second control device, and the third control device according to the present disclosure. FIG. 6A is a diagram illustrating a processing flow executed by the processor 212 of the control device 200 according to the present disclosure. FIG. 6B is a diagram illustrating a processing flow executed by the processor 212 of the control device 200 according to the present disclosure. FIG. 7A is a diagram illustrating an example of the operating status of the control unit 6 in a multi-node operating state. FIG. 7B is a diagram illustrating an example of the operating status of the control unit 6 in a multi-node operating state. FIG. 7C is a diagram illustrating an example of the operating status of the control unit 6 in a single-node operating state. FIG. 8 is a diagram showing a schematic configuration of a control system 1000 according to the present disclosure.

[0015] Hereinafter, as an example of an embodiment of the present invention, a case where the present invention is applied to a control system will be described with reference to the accompanying drawings. Note that common components in the drawings are given the same reference numerals.

[0016] 1. Overview and Configuration of Control System 1 According to the Present Disclosure The control system 1 according to the present disclosure is used, for example, to remotely control electrical equipment installed in a facility and to remotely obtain information related to the electrical equipment. For example, the control system 1 according to the present disclosure is preferably used when controlling electrical equipment such as elevators installed in a facility such as a building from outside the facility. In particular, when the control panel for electrical equipment pre-installed in the facility does not have a configuration for connecting to an internet line, the control system is preferably used when a device connectable to an internet line, such as a control device, is communicatively connected to the control panel, allowing the control device to transmit control information generated outside the facility (e.g., a management system) to the control panel, while transmitting and receiving information via the internet line.

[0017] FIG. 1 is a diagram illustrating a schematic configuration of a control system 1 according to the present disclosure. According to FIG. 1, the control system 1 includes a management unit 3 including a management device 500 and a communication device 100, a control unit 6 including at least a first control device 200A, a second control device 200B, and a third control device 200C, and an equipment unit 5 including a control panel 300 and electrical equipment 400, with each unit communicatively connected to one another. Specifically, FIG. 1 illustrates a connection relationship for data transmission between a facility 2 and a management system 3 installed in a facility different from the facility 2. More specifically, in the control system 1, the facility 2 is communicatively connected to a management device 500 of the management system 3 via an internet line 4.

[0018] As shown in Fig. 1 , an equipment unit 5 and a control unit 6 are installed in the facility 2. The equipment unit 5 includes a control panel 300 that has been installed in advance in the facility 2, and electrical equipment 400 such as an elevator that is controlled by the control panel 300. The control unit 6 is communicatively connected to the control panel 300 of the equipment unit 5 by wire or wirelessly, and relays communication between the control panel 300 and the internet line 4. A plurality of control devices 200 are installed in the control unit 6. These devices are communicatively connected via a wired or wireless internal network of the facility 2.

[0019] The control device 200 functions as a gateway for data communication for the facility 2, enabling data to be sent and received from outside the facility 2 via the internet line 4. Specifically, the control device 200 can communicate with other control devices 200 installed in the control unit 6. The control device 200 can also relay communication between the control panel 300 and the management device 500.

[0020] Such a control device 200 exists in a plurality of operating states based on the communication environment, etc. One operating state is a multi-node operating state and a single-node operating state. The multi-node operating state is a state in which a plurality of control devices 200 included in the control unit 6 are operable, and the single-node operating state is a state in which only one of the control devices 200 included in the control unit 6 is operable.

[0021] Further operating states include an operating state and a standby state. The operating state is a state in which a control device 200 that is to be operated from among the multiple control devices 200 that can operate in the multi-node operating state is determined to be the source of control information to the control panel by executing a distributed agreement algorithm, or a state in which a control device 200 that is to be operated is determined to be the source of control information to the control panel without executing a distributed agreement algorithm in the single-node operating state. The standby state is a state in which a control device 200 that is operable is determined to be the source of control information to the control panel by executing a distributed agreement algorithm in the multi-node operating state, but is on standby without being determined to be the source of control information to the control panel.

[0022] Here, in the control device 200, switching between the multi-node operating state and the single-node operating state is determined based on the status of communication with other control devices 200, the management device 500, and the control panel 300 via the Internet. Furthermore, in the control device 200 in the multi-node operating state, switching between the active state and the standby state is determined based on the status of communication with the other control devices 200. In other words, in the multi-node operating state, the control device 200 switches between the active state and the standby state based on the status of communication with the other control devices 200 by executing a distributed consensus algorithm without being controlled by the management device 500. As a result, in the multi-node operating state, the control unit 6 can prevent communication relay from being duplicated by two or more control devices 200 by placing one of the multiple control devices 200 in the active state. Furthermore, the control device 200 can switch operating states without being controlled by the management device 500. Therefore, since the control device 200 can be controlled independently, other devices such as the management device 500 are not required for control, making it possible to configure a system more simply and inexpensively.

[0023] Here, the distributed consensus algorithm is executed assuming a relatively large number of devices (e.g., hundreds to thousands). Specifically, the distributed consensus algorithm does not assume that even if multiple devices fail, only one device will operate normally. Meanwhile, the control unit 6 is configured with a relatively small number of control devices, preferably three, at most ten, because the space available for installing the control devices 200 tends to be limited. That is, among the multiple control devices 200 installed in the control unit 6, there is a possibility that multiple devices will not operate normally due to failure, maintenance, etc., resulting in only one device operating normally. In such a case, if only the distributed consensus algorithm is used, agreement (response information) between the other control devices 200 and the candidate control device 200 (the control device 200 that transmitted the candidate information) cannot be obtained, the algorithm will not function, and processing will stop. Therefore, systems using the distributed consensus algorithm typically use a relatively large number of devices to prevent a situation in which only one device operates normally, as described above. On the other hand, when controlling the control panel 300 according to the present disclosure, it is often difficult to install a large number of control devices 200, and it is entirely conceivable that only one control device 200 will be operating normally.

[0024] Therefore, when the control device 200 is in a multi-node operating state, it determines which control device 200 should be put into the active state using a distributed agreement algorithm, but when it has entered a single-node operating state, it puts into the active state a control device 200 that can operate without executing the distributed agreement algorithm. In other words, if it always tries to make a decision using the distributed agreement algorithm, when it enters a state where it cannot receive response information (approval) using the distributed agreement algorithm (i.e., a single-node operating state), the candidate control device 200 can determine itself to be the sender of control information, and therefore can send control information even in such a state.

[0025] The distributed agreement algorithm itself is merely one example of a means for determining which control device 200 is to be put into the active state in the multi-node operating state. Naturally, other methods may be used to determine which of the multiple control devices 200 is to be put into the active state in the multi-node operating state. In that case, the condition for operating in the single-node state is not whether the distributed agreement algorithm can be executed, but whether it is possible to determine which control device 200 is to be put into the active state in the multi-node operating state.

[0026] The management system 3 includes a communication device 100 for communication connection with the control device 200 and a management device 500 for managing the electrical equipment 400 of the facility 2. The communication device 100 is connected to the management device 500 within the management system 3 so as to be able to send and receive information.

[0027] In the control system 1, the management device 500 can remotely control, monitor, and otherwise manage the electrical equipment 400 in the facility 2. Here, the management device 500 performs this management by sending and receiving data via the communication device 100. For example, between the communication device 100 and the control device 200, confidentiality of various information sent and received is ensured by, for example, a VPN connection. In other words, remote management of the electrical equipment 400 in the facility 2 from the management device 500 is performed safely and reliably with security ensured. Note that the VPN connection itself is an example of a confidential communication method, and naturally, other communication methods may also be used.

[0028] Here, the facility 2 is not limited to the above-mentioned building, but may include various structures and mobile objects located on land, sea, and air. For example, examples of the facility 2 that is a structure include a building, an observation deck on a mountain (mountain facility), a plant underwater or on the sea (marine facility), a work facility in a mine or dam, a monitoring facility in a power plant or substation, and a satellite in space. Examples of the facility 2 that is a mobile object include a passenger car, a truck, a ship, and an aircraft.

[0029] Furthermore, the electrical equipment 400 is not limited to the elevator described above, but may include general devices installed in the facility 2 that are driven or operated using electricity. Here, even devices powered by fuels other than electricity, such as those that perform auxiliary electrical functions (such as data display or data communication), are naturally included in the electrical equipment 400. For example, if the facility 2 is a building, examples of the electrical equipment 400 include elevators, escalators, access control devices, air conditioning equipment, lighting equipment, and audio equipment. If the facility 2 is a mobile object or satellite, examples of the electrical equipment 400 include driving sources, sensors, lighting fixtures, audio equipment, air conditioning equipment, etc. If the facility 2 is a mountain facility, marine facility, work facility, or monitoring facility, examples of the electrical equipment 400 include various sensors and various equipment maintenance equipment. Furthermore, the control unit 6 is not limited to being retrofitted to the equipment unit 5 including existing equipment; the control unit 6 may be installed at the same time as the equipment unit 5.

[0030] Examples of the electrical equipment 400 of the facility 2 managed by the control system 1 according to the present disclosure include electrical equipment in facilities where direct access to the site is difficult (mountain or marine facility equipment), electrical equipment that is difficult to access but where management is extremely important (sensor equipment in mines or dams), electrical equipment that requires unmanned maintenance or inspection (autonomously operable mobile objects), and electrical equipment where improved operational efficiency is expected through labor-saving operation or control (various facilities in buildings, etc.). In other words, the control system 1 can be used in a wide range of applications.

[0031] By utilizing the control system 1 in such a facility 2, end users who use the facility 2 can automate maintenance by moving away from human intervention, thereby reducing downtime of the facility 2 and the electrical equipment 400 and enabling continuous use of the facility 2. Furthermore, those who maintain or operate the facility 2 can simplify maintenance or operation work, easily improving the continuity of maintenance or operation, and reducing the maintenance and operation costs of the facility 2.

[0032] Furthermore, by utilizing the control system 1 according to the present disclosure, in a multi-node operating state in which multiple control devices 200 are operational, the control device 200 that will be in an operational state as the source of control information is determined by executing a distributed agreement algorithm. Therefore, it is possible to prevent multiple control devices 200 from being operational and causing overlapping operations. Furthermore, in a single-node operating state in which only one control device 200 is operational, the control device 200 that can operate without executing a distributed agreement algorithm is determined as the source of control information. Therefore, even in a state in which the distributed agreement algorithm cannot be executed, it is possible to preferably transmit control information.

[0033] 1 shows one facility 2 and one control panel 300, but there may be more than one of them. Also, although the number of control devices 200 is described as about 10 at most in the above, the present disclosure does not naturally limit the number of control devices 200 to 11 or more.

[0034] 1 illustrates a configuration of the control system 1 including a management unit 3, a control unit 6, and an equipment unit 5. However, it is also possible to install the control system 1 later to control a control panel 300 that has already been installed in a facility 2 such as an existing building. In such a case, the control system 1 is composed of a management unit 3 including at least a management device 500, and a control unit 6 including at least a first control device 200A, a second control device 200B, and a third control device 200C.

[0035] 2. Configuration of the Control Device 200 FIG. 2 is a block diagram illustrating an example of the configuration of the control device 200 according to the present disclosure. The control device 200 does not need to include all of the components illustrated in FIG. 2 ; it is possible to omit some components or add other components. While the present disclosure describes a control unit 6 including three control devices 200, it may include four or more control devices 200. The control devices 200 may all have the same configuration or different configurations. The present disclosure also describes a case in which a master-slave relationship is not established among the three control devices 200 (i.e., the source of control information is determined based on information received from the other control devices 200, rather than on instruction information from the other control devices 200). However, any one of the multiple control devices 200 may transmit instruction information to the other control devices 200, which serves as the source of control information. Furthermore, although the present disclosure describes that the control device 200 in the control unit 6 decides to transmit control information, some or all of the control related to the control system 1 may be performed by some or all of the multiple control devices 200 that make up the control unit 6 (i.e., the control unit may be composed of some or all of the multiple control devices 200).

[0036] The control device 200 may be a general IoT router or a network device using a general-purpose OS (Windows (registered trademark), Linux (registered trademark), or Mac OS). The control device 200 may also be a Linux (registered trademark)-based router that has an outlet into which a SIM card or the like can be inserted. In the present disclosure, various communication devices may be used as long as they are compatible with the above-mentioned VPN connection and the multi-channelization described below.

[0037] 2, the control device 200 includes a memory 211 including RAM, ROM, non-volatile memory, an HDD, etc., a processor 212 configured by a CPU, etc., and a communication interface 213. These components are electrically connected to each other via control lines and data lines.

[0038] The memory 211 includes a RAM, a ROM, a nonvolatile memory, and a HDD and functions as a storage unit. The ROM stores instructions and commands for executing the application and OS according to the present disclosure as a program. Such programs are loaded and executed by the processor 212. The RAM is used to write and read data while the program stored in the ROM is being processed by the processor 212. The nonvolatile memory is memory into which data is written and read as the program is executed, and the data written therein is retained even after the program execution is completed. In the present disclosure, the memory 211 particularly stores programs for executing the processes described in the processing sequences of FIGS. 5A and 5B (details of the processes are described in FIGS. 5A and 5B).

[0039] The processor 212 is configured with a CPU (microcomputer) and functions as a control unit for controlling other connected components based on various programs stored in the memory 211. Specifically, the processor 212 reads and executes programs for executing applications according to the present disclosure and programs for executing the OS from the memory 211. The processor 212 may be configured with a single CPU or multiple CPUs.

[0040] In addition, by executing the program stored in the memory 211, the processor 212 performs "a process of transmitting candidate information indicating that the first control device 200A is a candidate for the source of control information to a second control device 200B configured to be able to transmit control information to the control panel 300 and different from the first control device 200A, and to a third control device 200C configured to be able to transmit control information to the control panel 300 and different from the first control device 200A and the second control device 200B" and "a process of determining whether or not the first control device 200A is a candidate for the source of control information based on the received response information upon receiving response information to the candidate information from the second control device 200B and the third control device 200C, respectively."

[0041] The communication interface 213 functions as a communication unit that transmits and receives information between the remotely installed communication device 100, the management device 500, and other control devices 200 via a communication processing circuit and an antenna. The communication processing circuit processes programs and various information used in the control system 1 to transmit and receive information from the communication device 100, the management device 500, and other control devices 200 according to the progress of processing. In the present disclosure, in particular, information such as control information is transmitted and received between the other control devices 200 and the processor 212 via the communication interface 213. The communication processing circuit operates, for example, based on processing by the processor 212 to establish a secure communication connection with the communication device 100. For example, the communication processing circuit processes based on a secure communication connection method using a virtual private network (VPN). More specifically, the communication processing circuit processes based on the IPsec and IKEv2 communication protocols, as well as the ESP and AES-GCM encryption methods.

[0042] In addition to processing based on the VPN system, the communication processing circuit may perform processing based on a wideband wireless communication system such as the 5G system, or may perform processing based on a system related to narrowband wireless communication such as a wireless LAN such as IEEE 802.11 or Bluetooth (registered trademark) or a system related to contactless wireless communication. Furthermore, wired communication can be used instead of or in addition to wireless communication.

[0043] 3. Configuration of Management Device 500 Fig. 3 is a block diagram showing an example of the configuration of management device 500 according to the present disclosure. Management device 500 does not need to include all of the components shown in Fig. 3, and it is possible to omit some components, or to add other components.

[0044] The management device 500 is typically a terminal device capable of wireless communication, such as a laptop computer, a desktop computer, or a smartphone, but is not limited to such devices. For example, the terminal device may be a smartphone, a feature phone, a personal digital assistant, a PDA, a portable game console, a stationary game console, or any other device capable of executing the program according to the present disclosure. Furthermore, there may be multiple management devices 500 communicating with the communication device 100, and the terminals do not necessarily have to be the same type or the same terminal device, but may be different types of terminal devices.

[0045] 3, the management device 500 includes an output interface 511, a processor 512, a memory 513 including RAM, ROM, or nonvolatile memory (or HDD in some cases), a communication interface 514 including a communication processing circuit and an antenna, and an input interface 515 including a touch sensor and hard keys. These components are electrically connected to each other via control lines and data lines.

[0046] The output interface 511 functions as an output unit that outputs various displays output by executing the program according to the present disclosure to devices such as a display or a printer in response to instructions from the processor 512. Such a display may be, for example, a liquid crystal display, an organic EL display, or electronic paper.

[0047] The processor 512 is configured with a CPU (microcomputer) and functions as a control unit that controls other connected components based on various programs stored in the memory 513. Specifically, the processor 512 reads and executes programs for executing applications and programs for executing an OS according to the present disclosure from the memory 513. In the present disclosure, the processor 512 particularly executes the processes described in the processing sequence of FIG. 5A (details of the processes are described in FIG. 5A). The processor 512 may be configured with a single CPU, or may be configured with a combination of multiple CPUs and GPUs.

[0048] Furthermore, the processor 512 performs processing based on SSL to establish a secure communication connection with the communication device 100. Here, since the management device 500 and the communication device 100 exist within the same management system 3, a secure communication connection is possible simply by establishing a normal communication connection. Note that the method of secure communication connection used by the processor 512 is not limited to the above, and other methods may be used as long as they can conceal the communication path to the communication device 100 that exists within the same management system 3.

[0049] The memory 513 is composed of ROM, RAM, non-volatile memory, HDD, etc., and functions as a storage unit. The ROM stores instructions and commands for executing the application and OS according to the present disclosure as a program. The RAM is used to write and read data while the program stored in the ROM is being processed by the processor 512. The non-volatile memory is memory into which data is written and read as the program is executed, and the data written therein is retained even after the execution of the program has ended. In the present disclosure, the memory 513 particularly stores programs for executing the processes described in the processing sequence of FIG. 5A (details of the processes are described in FIG. 6C).

[0050] The communication interface 514 functions as a communication unit that transmits and receives information to and from the remotely installed communication device 100 and other management devices via a communication processing circuit and an antenna. The communication processing circuit processes programs and various information used in the control system 1 to transmit and receive information from the communication device 100 and other management devices according to the progress of processing. In the present disclosure, in particular, control information is transmitted from the communication interface 514 to the control panel 300 via the communication device 100 and the control device 200.

[0051] The communication processing circuit operates based on processing by the processor 512 to establish a secure communication connection to the communication device 100. For example, the communication processing circuit performs processing based on SSL.

[0052] In addition to processing based on SSL, the communication processing circuit may perform processing based on a wideband wireless communication method such as the 5G method, or may perform processing based on a method related to narrowband wireless communication or a method related to contactless wireless communication such as a wireless LAN such as IEEE 802.11 or Bluetooth (registered trademark). Furthermore, wired communication can be used instead of or in addition to wireless communication.

[0053] The input interface 515 is composed of a touch panel, hard keys, etc., and functions as an input unit that accepts instruction inputs related to the execution of the program according to the present disclosure, operation inputs for registering various information, etc. The touch sensor is arranged to cover the output interface 511 and transmits position coordinate information corresponding to image data output from the output interface 511 to the processor 512. Known touch sensor methods, such as resistive film methods, capacitive coupling methods, and ultrasonic surface acoustic wave methods, can be used. In the present disclosure, the touch sensor detects swipe and tap operations on each icon, etc. displayed on the output interface 511 by an indicator. Note that, although the present disclosure uses the input interface 515 provided in the management device 500, it is also possible to use an input interface 515, such as a mouse, that is connected wirelessly or via a wire to a main body including the processor 512, etc.

[0054] 4. Information Stored in Memory 211 FIG. 4 is a conceptual diagram illustrating a control information table stored in the control device 200 and management device 500 according to the present disclosure. In the present disclosure, the control information table is stored in the memory 211 of each of the multiple control devices 200 and the memory 513 of the management device 500. Specifically, the multiple control devices 200 and the management device 500 communicate via the communication interfaces 213 and 514 to update the control information tables stored in the respective memories 211 and 513. Note that, although the present disclosure describes a case in which the control information table is stored in the management device 500, the control information table may also be stored in a database (not shown) communicatively connected to the management device 500 via a network. In this case, the management device 500 temporarily reads and processes the information stored in the database into the memory 311 of the management device 500 as processing progresses. These tables may also be stored separately. In addition, in this disclosure, we will explain the case where the control information table is stored in multiple control devices 200 and a management device 500, but the information stored in the control information table for each device may be different, or it may be stored only in multiple control devices 200, or it may be stored only in the management device 500.

[0055] According to FIG. 4 , the control information table stores, in association with one another, control device ID information, control panel ID information, management device ID information, facility ID information, status information, and the like. The "control device ID information" is identification information assigned to each control device 200. Specifically, the control device ID information is associated with a control device information table (not shown) that stores information about the control device 200, such as the control device model, the programming language used, and destination information (e.g., IP address). That is, for example, the control device 200 and the management device 500 can extract, based on the control device information table, the destination information, etc., of the control device 200 corresponding to the control device ID information. The "control panel ID information" is identification information assigned to each control panel 300. Specifically, the control panel ID information is associated with a control panel information table (not shown) that stores information about the control panel 300, such as the control panel model, the programming language used, and destination information. That is, for example, the control device 200 and the management device 500 can extract, based on the control panel information table, the destination information, etc., of the control panel 300 corresponding to the control panel ID information. Based on the control panel ID information, it is possible to identify the control panel ID information of the control panel to which the control device of the corresponding control device ID information can transmit control information.

[0056] The "management device ID" is identification information assigned to each management device 500. Specifically, the management device ID information is associated with a management device information table (not shown) that stores information about the control device 200, such as the model of the management device, the programming language used, and destination information. That is, the control device 200 can extract destination information for the management device 500 corresponding to the management device ID information based on the management device information table. Based on the management device ID information, it is possible to identify the control panel ID information of a control panel to which the management device of the management device ID information can transmit control information. The "facility ID information" is identification information assigned to each facility 2. Specifically, the facility ID information is associated with a facility information table (not shown) that stores information about the facility 2, such as the name, address, operating company name, person in charge, and contact information of the facility 2. That is, for example, the control device 200 and the management device 500 can extract information about the facility 2 corresponding to the facility ID information based on the facility information table. Based on the facility ID information, it is possible to identify the control panel ID information of a control panel installed in the facility of the facility ID information.

[0057] The "status information" is information indicating the status of the control device corresponding to the "control device ID information." Specifically, the "status information" is assigned one of the following: an "operating state" indicating that the control panel 300 is the source of control information received from the management device 500; a "standby state" indicating that the control panel 300 is not the source of control information and is in a hot standby state; and a "fault state" indicating that a fault such as an internal sensor failure, a communication fault in communication with the control panel 300, or a communication fault in communication with the management device 500 has occurred. Note that the status information is not limited to the above, and may also include a "stopped state" indicating that operation has been intentionally stopped, an "adjustment state" indicating that maintenance is being performed, a "trial state" indicating that test operation is being performed, etc.

[0058] 5. Processing sequence executed by control system 1 (A) Processing related to remote control by management device 500 Fig. 5A is a diagram showing a processing sequence executed among communication device 100, control device 200, control panel 300, and management device 500 according to the present disclosure. Specifically, Fig. 5A is a diagram showing a processing sequence in which control information is transmitted from management device 500, which is installed in a location different from facility 2, to control panel 300 via communication device 100, control device 200, and switch 220, and the electrical equipment 400 in facility 2 is controlled.

[0059] 5A, the processor 512 of the management device 500 periodically generates control information in accordance with a predetermined program stored in the memory 513 (S11). The control information includes information related to the facility 2, the control device 200, the control panel 300, and the electrical equipment 400, as well as information on specific control details of the electrical equipment 400. Note that the control information does not need to include all of the information described above, and the included information can be changed as appropriate as long as the control target and control details are known.

[0060] Thereafter, the processor 512 of the management device 500 processes the control information in accordance with a predetermined program stored in the memory 513 (S12). As a specific example, the processor 512 rewrites or converts the control information into a format compatible with the control panel 300 based on the information about the control panel 300 included in the control information. That is, the processor 512 processes the control information generated based on the rules used in the management device 500 to generate control information that can be executed in the control panel 300. This is because the information handling and generation rules, etc., differ between the facility 2, which is a closed space, and the management system 3, which is a separate space. The processing process in S12 may be performed simultaneously with or after the VPN connection process described below. Furthermore, the processing process in S12 may not be performed depending on the information handling and generation rules, etc., of the control panel 300 and the management device 500.

[0061] Next, the processor 112 of the communication device 100 periodically executes processing related to a VPN connection with the control device 200 in accordance with a predetermined program stored in the memory 111 (S13). As a specific example, the processor 112 periodically reads and executes the program related to the VPN connection stored in the memory 111. Specifically, since the program contains information about the control device 200 and control panel 300 to be connected, the processor 512 identifies the control device 200 connected to the control panel 300 of the electrical equipment 400 to be controlled and sets it as the VPN connection destination. The processor 512 then performs authentication processing, encryption processing, and tunneling processing based on a preset communication protocol and encryption method. Thereafter, the processor 212 also performs authentication processing on the control device 200 side to permit the VPN connection, and a VPN connection between the communication device 100 and the control device 200 is established (T11). The VPN connection itself is merely an example of a confidential communication method, and other communication methods capable of concealing communications may also be used.

[0062] Thereafter, the processor 512 of the management device 500 transmits the control information to the communication device 100 via the communication interface 514 (T12), and further transmits the control information to the control device 200 via the VPN connection (T13). Here, according to the above specific example, the transmission of information between the management device 500 and the communication device 100 is performed in a confidential state, and furthermore, the transmission of information between the communication device 100 and the control device 200 is also performed in a confidential state via the VPN connection.

[0063] The processor 212 of the control device 200 transmits the received, processed control information to the control panel 300 via the communication interface 213 and the switch 220 (T14). Here, according to the above specific example, the control device 200 is positioned as a gateway for the VPN connection, and the information received by the control device 200 is processed into a format compatible with the control panel 300, and the control device 200 and the control panel 300 are connected so as to be able to communicate via wired or wireless communication. In other words, according to the above specific example, the control device 200 transmits the processed control information directly to the control panel 300. In other words, according to the above specific example, the processed control information is transmitted from the management device 500 to the control panel 300 via the control device 200, eliminating the need for additional processing in the control device 200 and enabling simplification of the control device 200.

[0064] When the processed control information is received by the control panel 300 via the communication interface 213 and the switch 220 of the facility network, the control panel 300 executes control based on the processed control information (S14). Specifically, the control panel 300 determines the electrical equipment 400 to be controlled and the control content from the processed control information. Furthermore, the control panel 300 transmits a control command to the electrical equipment 400 based on the determined control content (T13). The electrical equipment 400 is driven or operated based on the control command. Note that the control panel 300 may also drive other devices installed in the control panel 300 to drive, operate, maintain, or inspect the electrical equipment 400. Furthermore, when transmitting information acquired by the electrical equipment 400 (e.g., information captured by a camera) from the control panel 300 to the management device 500, the acquired information may be transmitted from the control panel 300 to the control device 200 via the switch 220, and then transmitted from the control device 200 to the management device 500 via the communication device 100, in the reverse order of the above-described sequence.

[0065] (B) Processing in the control unit 6 for determining the control device 200 that transmits control information. FIG. 5B is a diagram showing a processing sequence executed between the first control device, the second control device, and the third control device according to the present disclosure. Specifically, FIG. 5B shows a processing sequence when the control unit 6 is configured with three control devices 200, namely, the first control device 200A, the second control device 200B, and the third control device 200C, and determines which of these control devices will transmit the control information received from the management device 500 to the control panel. Note that in FIG. 5B, the control unit 6 is configured with three control devices 200, namely, the first control device 200A, the second control device 200B, and the third control device 200C, from the viewpoints of installation costs and communication reliability, but it is also possible to configure the control unit 6 with four or more control devices 200. In such a case, it is possible to further improve communication reliability.

[0066] (B-1) Processing in a Multi-Node Operation State in Which the First Control Device 200A, the Second Control Device 200B, and the Third Control Device 200C Are Operable According to FIG. 5B, each processor 212 of the first control device 200A, the second control device 200B, and the third control device 200C executes a distributed consensus algorithm to determine itself as the source of control information. Specifically, each processor 212 of the first control device 200A, the second control device 200B, and the third control device 200C generates candidate information indicating that it is a candidate to become the source of control information and transmit control information to the control panel at random timing within a certain range (S21). Note that in FIG. 5B, the process related to the generation of candidate information is executed only by the second control device 200B to indicate that the second control device 200B will first be in an operational state. However, naturally, the process is also executed at random timing within a certain range by the first control device 200A and the third control device 200C. That is, when the first control device 200A and the third control device 200C generate candidate information, the subsequent processing is performed in the same manner as in FIG. 5B.

[0067] Moreover, the timing of generating candidate information in each control device 200 is determined as follows, for example. A control device 200 that has been determined as the source of control information by transmitting candidate information and is now in an active state transmits declaration information to the other control devices 200. Thereafter, the control device 200 continues to periodically transmit declaration information to the other control devices 200, and the other control devices 200 that receive this information reset their information each time. However, if a fault occurs in the control device 200 that is in an active state, the reset will not be performed. The other control devices 200 generate and transmit candidate information as described above when they detect that the reset has not been performed.

[0068] The processor 212 of the second control device 200B transmits the generated candidate information (T21) to the first control device 200A and the third control device 200C included in the control unit 6 via the communication interface 213. Upon receiving the candidate information, the processors 212 of the first control device 200A and the third control device 200C each execute a process for generating response information (S22). Details of this process will be described in FIG. 6B . Here, it is assumed that the status information associated with each of the control device ID information is in a "standby state" rather than an "active state." Therefore, each of the processors 212 of the first control device 200A and the third control device 200C generates response information indicating "approval." Each of the processors 212 of the first control device 200A and the third control device 200C transmits the generated response information indicating "approval" (T22) to the second control device 200B that transmitted the candidate information via the communication interface 213. The first control device 200A and the third control device 300C that have received the candidate information may not transmit a response signal indicating "approval" if they themselves are capable of transmitting control signals.

[0069] The processor 212 of the second control device 200B executes a decision process to determine whether or not it is acceptable to decide to become the sender of control information based on the received response information by executing a distributed consensus algorithm (S23). If a predetermined condition is satisfied, the processor 212 of the second control device 200B generates declaration information indicating that it has become the sender of control information to the control panel (S24).

[0070] The processor 212 of the second control device 200B transmits the generated declaration information (T23) to the first control device 200A and the third control device 200C via the communication interface 213. Then, the processor 212 of the second control device 200B updates the status information associated with its own control device ID information in the control information table from "standby state" to "active state," and actually transmits the control information to the control panel associated with the control panel ID information via the communication interface 213 (S25). Note that details of the processes related to S23 and S24 in FIG. 5B will be described later with reference to FIG. 6B.

[0071] 7A is a diagram showing an example of the operational status of the control unit 6 in a multi-node operating state. Specifically, FIG. 7A is a diagram showing the operational status when a series of processes S21 to S25 in FIG. 5B are performed in a multi-node operating state in which the first control device 200A, the second control device 200B, and the third control device 200C are all in an operable state (i.e., standby state).

[0072] According to FIG. 7A , the control panel 300 communicates with the management device 500 via the Internet line 4 through a communication path connecting the second control device 200B and the Internet line 4. Here, because no particular failures or other issues have occurred in any of the control devices 200, all of the control devices 200 are in a standby state where they can transmit control information, and the control unit 6 operates in a multi-node operating state. Therefore, the processors 212 of the first control device 200A, the second control device 200B, and the third control device 200C execute the distributed consensus algorithm, i.e., execute the processes S21 to S25 of FIG. 5B , thereby determining the second control device 200B as the sender of the control information. The second control device 200B then transmits information indicating that it is the sender of the control information to the management unit 3. In response to receiving this information, the management device 500 of the management unit 3 transmits information such as control information addressed to the second control device 200B. As a result, as shown in FIG. 7A, control information is transmitted from the second control device 200B to the control panel 300 via the communication line between the second control device 200B and the control panel 300.

[0073] On the other hand, the first control device 200A and the third control device 200C, which have not been determined as the transmission source by the distributed consensus algorithm, remain in a standby state and wait without transmitting any control information.

[0074] (B-2) Processing in a multi-node operating state in which the first control device 200A and the third control device 200C are operable Returning to Fig. 5B again, in the second control device 200B that is transmitting control information, a failure may occur, such as a communication failure in communication with the control panel 300 or a communication failure in communication with the management device 500. In such a case, the processor 212 of the second control device 200B updates the status information associated with its own control device ID information in the control information table to "failure state."

[0075] On the other hand, each processor of the first control device 200A and the third control device 200C, which are capable of operating normally, generates candidate information indicating that it is a candidate to become the source of control information and transmit control information to the control panel at a random timing within a certain interval, as in S21. Note that in Fig. 5B, the process related to the generation of candidate information is executed only by the first control device 200A to indicate that the first control device 200A will be in the active state in place of the second control device 200B, but naturally, the process is also executed at a random timing within a certain interval by the third control device 200C. In other words, when the third control device 200C generates candidate information, the subsequent process is executed in the same manner as in Fig. 5B.

[0076] The processor 212 of the first control device 200A transmits the generated candidate information (T31) to the third control device 200C included in the control unit 6 via the communication interface 213. At this time, since the second control device 200B is in a "failure state," the candidate information is not transmitted, or is transmitted but cannot be received. The processor 212 of the third control device 200C that received the candidate information executes processing related to generating response information (S32). Details of this processing will be described in FIG. 6B. Note that, in this example, it is assumed that the status information associated with its own control device ID information is in a "standby state" rather than an "active state." Therefore, the processor 212 of the third control device 200C generates response information indicating "approval." The processor 212 of the third control device 200C transmits the generated response information indicating "approval" (T32) via each communication interface 213 to the first control device 200A that transmitted the candidate information. If the status information associated with its own control device ID information is "operational state," it can send control information as is and will not send response information indicating "approval." Also, since the second control device 200B has not received candidate information as described above, no response information will be sent from 200B in the second control layer.

[0077] The processor 212 of the first control device 200A executes a distributed consensus algorithm to perform a decision process to determine whether or not it is acceptable to decide to become the sender of control information based on the received response information (S33). If a predetermined condition is satisfied, the processor 212 of the first control device 200A generates declaration information indicating that it has become the sender of control information to the control panel (S34).

[0078] The processor 212 of the first control device 200A transmits the generated declaration information (T33) to the third control device 200C via the communication interface 213. Then, the processor 212 of the first control device 200A updates the status information associated with its own control device ID information in the control information table from "standby state" to "active state," and actually transmits the control information to the control panel associated with the control panel ID information via the communication interface 213 (S35). Note that details of the processes related to S33 and S34 in FIG. 5B will be described later with reference to FIG. 6B.

[0079] 7B is a diagram showing an example of the operational status of the control unit 6 in a multi-node operating state. Specifically, Fig. 7B is a diagram showing the operational status when a series of processes from S31 to S35 in Fig. 5B is performed in a multi-node operating state in which the first control device 200A and the third control device 200C are in an operable state (i.e., a standby state) among the first control device 200A, the second control device 200B, and the third control device 200C.

[0080] According to FIG. 7B , the control panel 300 communicates with the management device 500 via the Internet line 4 through a communication path connecting the first control device 200A and the Internet line 4. Here, although a failure occurs in the second control device 200B, preventing it from sending or receiving control information, the first control device 200A and the third control device 200C are in a standby state where they can send control information, and the control unit 6 operates in a multi-node operating state. Therefore, the processors 212 of the first control device 200A and the third control device 200C execute the distributed consensus algorithm, i.e., execute the processes S31 to S35 of FIG. 5B , thereby determining the first control device 200A as the sender of the control information. The first control device 200A then transmits information indicating that it is the sender of the control information to the management unit 3. In response to receiving this information, the management device 500 of the management unit 3 transmits information such as control information addressed to the first control device 200A. As a result, as shown in FIG. 7B, control information is transmitted from the first control device 200A to the control panel 300 via the communication line between the first control device 200A and the control panel 300.

[0081] On the other hand, the third control device 200C, which has not been determined as the transmission source by the distributed consensus algorithm, remains in a standby state and waits without transmitting any control information.

[0082] (B-3) Processing in a Single-Node Operation State Where Only the First Control Device 200A is Operable Returning to Fig. 5B again, in the second control device 200B and the third control device 200C, a failure such as a communication failure in communication with the control panel 300 or a communication failure in communication with the management device 500 may occur. In such a case, each processor 212 of the second control device 200B and the third control device 200C may update the status information associated with its own control device ID information in the control information table to "failure state."

[0083] On the other hand, the processor of the first control device 200A, which is capable of normal operation, generates candidate information indicating that it will be a candidate to become the source of control information and transmit control information to the control panel at random timings within a certain range, as in S21 (S41). Note that in Fig. 5B, the second control device 200B and the third control device 200C are both in a fault state, so no candidate information is generated.

[0084] The processor 212 of the first control device 200A transmits the generated candidate information (T41) to the third control device 200C included in the control unit 6 via the communication interface 213. At this time, the second control device 200B and the third control device 200C are in a "failure state," so the candidate information is not transmitted, or is transmitted but cannot be received. Therefore, no response information is generated in either the second control device 200B or the third control device 200C, and the first control device 200A does not receive the response information.

[0085] If a predetermined number of response information indicating approval has not been received based on all the response information received after the predetermined period has elapsed, the processor 212 of the first control device 200A executes a process to determine the transmission source even in the single-node operating state (S42). Then, the processor 212 of the first control device 200A updates the status information associated with its own control device ID information in the control information table from "standby state" to "active state" via the communication interface 213 (S43), and actually transmits the control information to the control panel associated with the control panel ID information via the communication interface 213 (S44). Note that details of the processes S42 and S43 in FIG. 5B will be described later in FIG. 6B.

[0086] 7C is a diagram showing an example of the operating status of the control unit 6 in a multi-node operating state. Specifically, Fig. 7C is a diagram showing the operating status when a series of processes from S41 to S34 in Fig. 5B is performed in a single-node operating state in which only the first control device 200A of the first, second, and third control devices 200A, 200B, and 200C is in an operable state (i.e., standby state).

[0087] According to FIG. 7C, the control panel 300 communicates with the management device 500 via the Internet line 4 through a communication path connecting the first control device 200A and the Internet line 4. Specifically, the processor 512 of the management device 500 transmits information such as control information to, for example, the first control device 200A, the second control device 200B, and the third control device 200C. Note that, in this example, although failures occur in the second control device 200B and the third control device 200C and they are unable to send or receive control information, only the first control device 200A is in a standby state where it can send control information, and the control unit 6 operates in a single-node operating state. Therefore, regardless of the distributed agreement algorithm, the processor 212 of the first control device 200A executes the processes of S41 to S44 of FIG. 5B, thereby determining the first control device 200A as the sender of the control information. As a result, as shown in FIG. 7C, control information is transmitted from the first control device 200A to the control panel 300 via the communication line between the first control device 200A and the control panel 300.

[0088] 7A and 7B, the control device 200 that is in the active state is determined by the distributed consensus algorithm using only the first control device 200A, the second control device 200B, and the third control device 200C, enabling efficient operation. Also, in FIG. 7C, even if the only operable control device 200 is the first control device 200A and response information indicating approval cannot be received from the other control devices 200, it is possible to determine the control device 200 that is in the single-node operating state and operate flexibly.

[0089] Although not specifically shown in Fig. 5B, the first control device 200A and the third control device 200C can execute the same processes as S21 to S25 of the second control device 200B. Furthermore, although not specifically shown in Fig. 5B, the third control device 200C can execute the same processes as S31 to S35 of the first control device 200A.

[0090] 6. Processing Flow of Control Unit 6 in Control System 1 (A) Processing Related to Generation of Response Information FIG. 6A is a diagram showing a processing flow executed by the processor 212 of the control device 200 according to the present disclosure. Specifically, FIG. 6A is a diagram showing a processing flow related to generation of response information performed by the first control device 200A and the third control device 200C in S22 and S32 of FIG. 5B. This processing flow is mainly performed by the processor 212 of the control device 200 reading and executing a program stored in the memory 211. Note that S21 to S25 of FIG. 5A describe the case where candidate information is transmitted from the second control device 200B, and therefore, the processing flow is executed by the first control device 200A and the third control device 200C. However, when candidate information is transmitted from the first control device 200A, the processing flow is executed by the second control device 200B and the third control device 200C, and when candidate information is transmitted from the third control device 200C, the processing flow is executed by the first control device 200A and the second control device 200B. Similarly, S31 to S35 in Figure 5B describe the case where candidate information is sent from the first control device 200A, so the processing flow is executed in the third control device 200C, but if candidate information is sent from the third control device 200C, the processing flow is executed in the first control device 200A.

[0091] 6A , the processor 212 receives candidate information from one of the other control devices 200 (the second control device 200B in the case of S22 in FIG. 5B ) via the communication interface 213 (S201). The candidate information indicates that the processor 212 is willing to be the source of control information and to transmit control information to the control panel 300. Upon receiving the candidate information, the processor 212 references the status information associated with the control device ID of the processor 212 to confirm whether the processor 212 is in a "standby state," indicating that the processor 212 is ready to operate as a source of control information. If the processor 212 confirms that the status information is in a "standby state," it determines that the candidacy of the other control device 200 can be "approved" (Yes in S202) and generates response information indicating approval (S203).

[0092] Next, the processor 212 transmits the response information generated in S203 via the communication interface 213 to the other control device that transmitted the candidate information (the second control device 200B in the case of S22 in FIG. 5B) (S204). Note that if a failure or the like occurs in the control device 200, response information indicating approval is not generated, and the information is not transmitted to the other control device 200. This ends the processing flow.

[0093] (B) Process for Determining the Control Device 200 to Operate FIG. 6B is a diagram showing a process flow executed by the processor 212 of the control device 200 according to the present disclosure. Specifically, FIG. 6B is a diagram showing a process flow for generating response information executed by the first control device 200A and the second control device 200B in S23 and S24, S33 and S33, and S42 and S43 of FIG. 5B. This process flow is mainly executed by the processor 212 of the control device 200 reading and executing a program stored in the memory 211. Note that in S23 and S24 of FIG. 5B, the second control device 200B is running as a candidate, so this process flow is executed in the second control device 200B. However, even if either the first control device 200A or the third control device 200C runs as a candidate, the same process flow is executed in each control device. In addition, in S33 and S33, and S42 and S43 of Figure 5B, the processing flow is executed in the first control device 200A because the first control device 200A is running as a candidate, but if either the second control device 200B or the third control device 200C runs as a candidate, a similar processing flow is executed in each control device.

[0094] 6B, the processor 212 determines whether a predetermined time has elapsed since transmitting candidate information to another control device 200 (S101). During this time, when the processor 212 receives response information from another control device that has received the candidate information via the communication interface 213, the processor 212 stores the received response information in the memory 211 as needed. If the time has not yet elapsed, the processor 212 waits until the time has elapsed.

[0095] On the other hand, if the time has elapsed, the processor 212 counts the number of pieces of response information indicating approval that have been received from other control devices 200 that have received the candidate information during that time and stored in the memory 211. The processor 212 checks whether the counted number of pieces of response information indicating approval is equal to or exceeds a predetermined number that can be determined based on the distributed consensus algorithm (S102). This number is preferably set to the minimum number of other control devices 200 (e.g., one) required to operate in a multi-node operating state with the control device 200 itself. However, it is of course not limited to one and can be set to any number.

[0096] When the processor 212 determines that a predetermined number (e.g., one) or more pieces of response information have been received, it determines that a decision can be made using the distributed consensus algorithm and counts the number of pieces of response information indicating "approval" in the response information. The processor 212 then checks whether the counting result indicates that a predetermined number or more pieces of response information indicating approval have been acquired (S103). As an example, this number is set to a majority of the number of remaining control devices 200 excluding the control device 200 that transmitted the candidate information. For example, if there are a first control device 200A, a second control device 200B, and a third control device 200C, and the second control device 200B transmitted the candidate information, the majority of the first control device 200A and the third control device 200C is set to "2." Furthermore, if only the first control device 200A and the third control device 200C are operating and the first control device 200A transmitted the candidate information, the remaining device is the third control device 200C, and the remaining device is set to "1." However, any number can be set, not limited to "2" or "1."

[0097] When the processor 212 determines that it has received a predetermined number (e.g., two) or more pieces of response information indicating "approval," it generates declaration information indicating that it will become the source of control information and will transmit control information to the control panel (S104). The processor 212 then transmits the generated declaration information to all control devices 200 that have transmitted the response information via the communication interface 213 (S105) and updates the status information associated with its own control device ID information in the control information table to "active status." On the other hand, when the processor 212 determines that it has not received a predetermined number (e.g., two) or more pieces of response information indicating "approval," it withdraws its candidacy to become the source of control information (S106). In this case, the processor 212 transmits withdrawal information to all control devices 200 that have transmitted the response information via the communication interface 213, as necessary.

[0098] Next, if the processor 212 determines in S102 that it has not received a predetermined number (e.g., one) or more pieces of response information indicating approval, it determines that a failure has occurred in another control device 200. Then, in order to confirm whether it is possible to send control information in a single-node operating state, the processor 212 first determines whether it is possible to communicate with the control panel 300 (S107). Although the specific method for this is not particularly shown in the figures, it is possible, for example, for the processor 212 to send a confirmation signal to the control panel 300 via the communication interface 213 and determine whether it has received response information from the control panel 300.

[0099] If the processor 212 determines in S107 that it is able to communicate with the control panel 300, it similarly checks whether it is able to communicate with the management device 500 and the like via the Internet line 4 (S108). Although the specific method for this is not particularly shown in the figures, it is possible to make this determination, for example, by having the processor 212 send a confirmation signal to the management device 500 via the communication interface 213 and then determining whether response information has been received from the management device 500.

[0100] If the processor 212 determines in S108 that communication via the Internet line 4 is possible, it determines itself as the sender of the control information, regardless of whether or not there is response information from other control devices 200 (S109). In other words, in this case, the sender of the control information is determined without performing processing using a distributed algorithm that determines the sender based on the number of "approved" response information. Then, the processor 212 updates the status information associated with its own control device ID information in the control information table to "active status" (S110). This ends the processing flow.

[0101] 6B, when a decision can be made using the distributed consensus algorithm, the source control device 200 is determined by only the multiple control devices 200, enabling more efficient decision processing. Furthermore, even if the distributed consensus algorithm becomes unable to be executed, a decision processing unrelated to the distributed consensus algorithm can be performed, preventing delays in the control information transmission process and enabling stable transmission of control information.

[0102] As described above, in this embodiment, it is possible to provide a control device, a control program, a control method, a control unit, and a control system that can suitably transmit control information to a control panel of an electrical equipment.

[0103] 7. Modifications (1) Configuration Including a Switch In the control system 1 of FIG. 1 , the control unit 6 is configured with three control devices 200. However, instead of this, as shown in FIG. 8 , the control unit 600 can be configured with three control devices 200 plus a switch 220A and a switch 220B. That is, FIG. 8 is a diagram showing a schematic configuration of a control system 1000 according to the present disclosure. The configuration of the control system 1000 of FIG. 8 will be described below, but the same configurations and parts that perform the same processes as those of the control system 1 shown in FIGS. 1 to 7C will not be specifically mentioned again.

[0104] 8 , in the control system 1000, a facility 2 is communicatively connected to a management device 500 of a management system 3 via an internet line 4. An equipment unit 5 and a control unit 600 are installed in the facility 2. The equipment unit 5 includes a control panel 300 pre-installed in the facility 2 and electrical equipment 400, such as an elevator, controlled by the control panel 300. The control unit 600 is communicatively connected to the control panel 300 of the equipment unit 5 via a wired or wireless connection and relays communication between the control panel 300 and the internet line 4. The control unit 600 is installed with a plurality of control devices 200 (a first control device 200A, a second control device 200B, and a third control device 200C) and a plurality of switches 220 (a first switch 220A and a second switch 220B). These devices are communicatively connected via a wired or wireless internal network of the facility 2.

[0105] The control device 200 functions as a gateway for data communication for the facility 2, enabling data to be sent and received from outside the facility 2 via the internet line 4. Specifically, the control device 200 can communicate with other control devices 200 installed in the control unit 600. The control device 200 can also relay communication between the control panel 300 and the management device 500.

[0106] The management system 3 includes a communication device 100 for communication connection with the control device 200 and a management device 500 for managing the electrical equipment 400 of the facility 2. The communication device 100 is connected to the management device 500 within the management system 3 so as to be able to send and receive information.

[0107] In the control system 1000, the management device 500 can remotely control, monitor, and otherwise manage the electrical equipment 400 in the facility 2. Here, the management device 500 performs this management by sending and receiving data via the communication device 100. For example, a VPN connection ensures that various pieces of information sent and received between the communication device 100 and the control device 200 are kept confidential. In other words, remote management of the electrical equipment 400 in the facility 2 from the management device 500 is performed safely and reliably with security ensured.

[0108] By utilizing the control system 1000 according to the present disclosure, in a multi-node operating state in which multiple control devices 200 are operational, the control device 200 that will be in an operational state as the source of control information is determined by executing a distributed agreement algorithm. Therefore, it is possible to prevent multiple control devices 200 from being in an operational state and causing overlapping operations. Furthermore, in a single-node operating state in which only one control device 200 is operational, a control device 200 that can operate without executing a distributed agreement algorithm is determined as the source of control information. Therefore, even in a state in which the distributed agreement algorithm cannot be executed, it is possible to preferably transmit control information.

[0109] In the control system 1000 configured as described above, the control device 200 may have a limited number of output ports as the communication interface 113. For example, if the first control device 200A has only two output ports, connecting one to the control panel 300 and the other to the second control device 200B makes it impossible to connect to the third control device 200C. Therefore, in the example of FIG. 8 , a switch is interposed between the first control device 200A and the control panel 300, and operation of the first switch 220A enables connection to the third control device 200C. In this way, interposing a switch between the control device 200 and the control panel 300 can compensate for the lack of output ports.

[0110] 8, the control unit 6 includes a first switch 220A and a second switch 220B between each control device 200 and the control panel 300. That is, control information transmitted from any one of the plurality of control devices 200 is transmitted to the control panel 300 via either the first switch 220A or the second switch 220B.

[0111] 8, the first switch 220A is connected to the first control device 200A and the second control device 200B, and the second switch 220B is connected to the third control device 200C. The first switch 220A and the second switch 220B are connected to each other so that they can communicate with each other.

[0112] A case will be described in which all three control devices, the first control device 200A, the second control device 200B, and the third control device 200C, are in an operable standby state. When the first control device 200A is determined as the source of control information by the processing of the distributed agreement algorithm shown in Figures 5B and 6B, the first switch 220A turns on the first switch 220A by sending a switching signal to the first switch 220A, and relays the transmission of control information between the first control device 200A and the control panel 300. Similarly, when the second control device 200B is determined as the source of control information by the distributed agreement algorithm, the first switch 220A turns on the first switch 220A by sending a switching signal to the first switch 220A, and relays the transmission of control information between the second control device 200B and the control panel 300. Furthermore, when the third control device 200C is determined as the sender of the control information by the distributed consensus algorithm, a switching signal is sent to the second switch 220B to turn on the second switch 220B, and the transmission of the control information is relayed between the third control device 200C and the control panel 300. In this way, the control information is sent from each control device 200 to the control panel 300.

[0113] However, in a configuration in which the first control device 200A, the second control device 200B, and the third control device 200C have a limited number of output ports and do not require switches, a failure may occur in one of the first control device 200A, the second control device 200B, and the third control device 200C, leaving only the remaining two control devices operational. For example, even if a failure occurs only in the second control device 200B, the first control device 200A and the third control device 200C are not connected, and the first control device 200A and the third control device 200C cannot send or receive candidate information (T21 in FIG. 5B) or response information (T22 in FIG. 5B) to or from each other. In this case, the first control device 200A may determine that the third control device 200C has a failure, even though it is operating normally. That is, for the first control device 200A, in each of the processes of S102, S107, and S108 of FIG. 6B, the remaining two control devices cannot send and receive information, so the predetermined number of response information cannot be received, and the decision-making process using the distributed consensus algorithm cannot be executed (No in S102). On the other hand, since the third control device 200C itself is capable of communication with the control panel 300 and communication via the Internet line 4 (Yes in both S107 and S108), each of the first control device 200A and the third control device 200C independently determines that it is in a single-node operating state and transitions to an active state in which it is the source of control information. This causes the remaining two control devices to each attempt to send control information, resulting in a problem of overlapping processes.

[0114] 8, the remaining two control devices are made capable of communicating with each other via the first switch 220A and the second switch 220B, enabling them to send and receive response information and execute decision-making processing using a distributed consensus algorithm. This prevents the two remaining control devices from attempting to send control information and causing duplication of processing.

[0115] Here, a case where a failure occurs in the second control device 200B and the first control device 200A and the third control device 200C are in an operable, known state will be described with reference to FIG. 5B . Each processor of the first control device 200A and the third control device 200C, which are operable normally, generates candidate information at a fixed, random timing interval, indicating that it is a candidate to become the source of control information and transmit control information to the control panel (S31). Note that in FIG. 5B , the process related to the generation of candidate information is executed only by the first control device 200A to indicate that the first control device 200A is in an operational state in place of the second control device 200B. However, naturally, the process is also executed at a fixed, random timing interval by the third control device 200C. In other words, if the third control device 200C generates candidate information, the subsequent process is performed in the same manner as in FIG. 5B .

[0116] The processor 212 of the first control device 200A transmits the generated candidate information (T31) to the third control device 200C included in the control unit 6 via the communication interface 213. At this time, although the first control device 200A and the third control device 200C are not directly connected to each other for communication, the candidate information is transmitted from the first control device 200A to the third control device 200C via the first switch 220A connected to the first control device 200A and the second switch 220B connected to the third control device 200C. The processor 212 of the third control device 200C that received the candidate information executes processing related to the generation of response information (S32). Note that, in this example, it is assumed that the status information associated with its own control device ID information is in a "standby state" rather than an "active state." Therefore, the processor 212 of the third control device 200C generates response information indicating "approval."

[0117] The processor 212 of the third control device 200C transmits the generated response information (T32) indicating "approval" to the first control device 200A that transmitted the candidate information, via each communication interface 213. At this time, although the first control device 200A and the third control device 200C are not connected to each other so as to be able to communicate directly with each other, the response information is transmitted from the third control device 200C to the first control device 200A via the first switch 220A connected to the first control device 200A and the second switch 220B connected to the third control device 200C.

[0118] The processor 212 of the first control device 200A executes a distributed consensus algorithm to perform a decision process to determine whether or not it is acceptable to decide to become the sender of control information based on the received response information (S33). If a predetermined condition is satisfied, the processor 212 of the first control device 200A generates declaration information indicating that it has become the sender of control information to the control panel (S34).

[0119] The processor 212 of the first control device 200A transmits the generated declaration information (T33) to the third control device 200C via the communication interface 213. At this time, although the first control device 200A and the third control device 200C are not connected so as to be able to communicate directly with each other, the declaration information is transmitted from the first control device 200A to the third control device 200C via the first switch 220A connected to the first control device 200A and the second switch 220B connected to the third control device 200C. Then, the processor 212 of the first control device 200A updates the status information associated with its own control device ID information in the control information table from "standby state" to "active state," and actually transmits the control information to the control panel associated with the control panel ID information via the communication interface 213 (S35).

[0120] In this way, various types of information such as candidate information, response information, and declaration information can be transmitted and received between the first control device 200A and the third control device 200C via the first switch 220A and the second switch 220B. Therefore, when the processor 212 determines whether or not response information has been received in S102 of Fig. 6B, it can make a correct determination, and it is possible to prevent a case in which both the first control device 200A and the third control device 200C are determined to be the transmission source.

[0121] Although the case where the first switch 220A and the second switch 220B are included has been described in FIG. 8, the number of switches can be changed as appropriate depending on the number of control devices 200.

[0122] (2) Operating Control Device In the above embodiment, three control devices, the first control device 200A, the second control device 200B, and the third control device 200C, are used. However, four or more control devices 200 may be used. Furthermore, in the above embodiment, one operating control device is determined through communication between the first control device 200A, the second control device 200B, and the third control device 200C. However, multiple operating control devices may be determined. The operating control device determined through communication between the first control device 200A, the second control device 200B, and the third control device 200C may be a temporary determination, and the management device 500 may make a final determination. Furthermore, in the above embodiment, the operating control device is changed when a failure occurs in any of the first control device 200A, the second control device 200B, and the third control device 200C. However, for example, a process of changing the operating control device may be performed periodically.

[0123] The processes and procedures described herein can be implemented not only by those explicitly described in this disclosure, but also by software, hardware, or a combination thereof. Specifically, the processes and procedures described herein can be implemented by implementing logic corresponding to the processes in media such as integrated circuits, volatile memory, non-volatile memory, magnetic disks, and optical storage. Furthermore, the processes and procedures described herein can be implemented as computer programs and executed by various computers, including terminal devices and management devices.

[0124] Although processes and procedures described herein are described as being performed by a single device, software, component, or module, such processes or procedures may be performed by multiple devices, multiple software, multiple components, and / or multiple modules. Furthermore, although various information described herein is described as being stored in a single memory or storage unit, such information may be stored in multiple memories within a single device or multiple memories distributed across multiple devices. Furthermore, software and hardware elements described herein may be realized by integrating them into fewer components or by decomposing them into more components.

[0125] REFERENCE SIGNS LIST 1 Control system 3 Management system 6 Control unit 200 Control device 212 Processor 300 Control panel 400 Electrical equipment 500 Management device

Claims

1. A first control device comprising at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, wherein the at least one processor is configured to transmit candidate information indicating that the first control device is a candidate for the source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, and when receiving response information to the candidate information from the second control device and the third control device respectively, execute a process for determining whether the first control device is the source of the control information based on the received response information.

2. The first control device according to claim 1, wherein when the response information cannot be received from the second control device, it is determined whether the first control device is the source of the control information based on the response information received from the third control device.

3. The first control device according to claim 2, wherein the at least one processor is configured to execute a process for determining that a failure has occurred in the second control device when the response information cannot be received from the second control device.

4. The first control device according to claim 1, wherein when the response information cannot be received from either the second control device or the third control device, it is determined that the first control device is the source of the control information regardless of the response information.

5. The first control device according to claim 1, wherein when the response information can be received from at least one of the second control device and the third control device, it is determined whether the first control device is the source of the control information by executing a distributed consensus algorithm between the first control device and at least one of the second control device and the third control device that transmitted the response information; when the response information cannot be received from either the second control device or the third control device, it is determined that the first control device is the source of the control information.

6. The at least one processor is configured to transmit declaration information indicating that it is the source to at least one of the second control device and the third control device that has transmitted the response information when it is determined that the first control device is the source, and to execute a process for transmitting the control information to the control panel. The first control device according to claim 1.

7. A control unit including at least: the first control device according to claim 1 configured to be able to transmit control information to a control panel of electrical equipment installed in a facility; a second control device configured to be able to transmit the control information to the control panel and different from the first control device; and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device.

8. A control system including: the first control device according to claim 1 configured to be able to transmit control information to a control panel of electrical equipment installed in a facility; a second control device configured to be able to transmit the control information to the control panel and different from the first control device; and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, at least including a control unit; and a management device communicably connected to the control unit and configured to manage the control panel via the control device.

9. A control system including: a control panel configured to control electrical equipment installed in a facility; the first control device according to claim 1 configured to be able to transmit control information to the control panel; a second control device configured to be able to transmit the control information to the control panel and different from the first control device; and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, at least including a control unit; and a management device communicably connected to the control unit and configured to manage the control panel via the control device.

10. In a first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, the at least one processor is configured to transmit candidate information indicating that the first control device is a candidate for the transmission source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device. When response information to the candidate information is received from the second control device and the third control device, respectively, a control program that functions to execute processing for determining whether the first control device is the transmission source of the control information based on the received response information.

11. In a first control device including at least one processor for transmitting control information to a control panel of electrical equipment installed in a facility, a control method executed by the at least one processor includes a step of transmitting candidate information indicating that the first control device is a candidate for the transmission source of the control information to a second control device configured to be able to transmit the control information to the control panel and different from the first control device, and a third control device configured to be able to transmit the control information to the control panel and different from the first control device and the second control device, and a step of determining whether the first control device is the transmission source of the control information based on the received response information when response information to the candidate information is received from the second control device and the third control device, respectively.

Images