System migration support apparatus and system migration support method

Abstract

Provided is a technique for reliably and efficiently migrating a control system. A system migration support apparatus according to the present invention comprises: a message communication unit that receives and duplicates a control message; a network communication unit that transmits the duplicated control message to a first service of a first system and a second service of a second system corresponding to the first service, and receives a first response message from the first service and a second response message from the second service to the control message; and a message comparison unit that compares and analyzes the first response message and the second response message to determine whether or not to migrate the first service in place of the second service, or whether or not to return the second service in place of the first service.

Description

System Migration Support Device and System Migration Support Method

[0001] The present invention relates to a system migration support device and a system migration support method.

[0002] The migration of a large-scale control system involves numerous difficulties. Generally, a large-scale control system includes a large number of services, and an enormous amount of time and cost are required to stably operate all these services after migration. In particular, when migrating, it is important to ensure data synchronization between services with the same function in the control systems before and after migration. However, depending on the operation field of the control system, there is also a problem that it is difficult to stop the control system for migration, which further complicates the reliable and efficient migration of the control system.

[0003] On the other hand, it is expected that the migration of large-scale control systems will further increase in the future, such as the growing demand to migrate on-premises control systems to the cloud environment recently.

[0004] In contrast, Patent Document 1 aims to provide a plant monitoring and control system migration device that enables a gradual migration of a monitoring and control system in which certain facilities are controlled by an existing monitoring and control device and other facilities are controlled by a newly installed monitoring and control device. It discloses a technology that "comprises a state signal reception and transmission unit that receives state signals transmitted from each of a plurality of facilities and transmits the state signals to an existing control device and a newly installed control device different from the existing control device; a control signal reception unit that receives an old control signal generated by the existing control device for each of the plurality of facilities based on the state signal and a new control signal generated by the newly installed control device for each of the plurality of facilities based on the state signal; and a control signal selection unit that selects a control signal to be transmitted to each of the plurality of facilities from among the old control signal and the new control signal under predetermined conditions for each of the plurality of facilities."

[0005] Furthermore, Patent Document 2 discloses a cloud service control device that offers high availability and information security, and enables rapid and flexible system migration. The device comprises: a first communication unit that controls communication with a cloud service that provides plant control functions for controlling a plant; a second communication unit that controls communication with a user device that utilizes service information related to the cloud service; a verification unit that verifies the operating status of the cloud service; a selection unit that selects the cloud service based on the verified operating status; and an information transmission unit that transmits the service information between the selected cloud service and the user device.

[0006] Japanese Patent Publication No. 2010-205163, Japanese Patent No. 6673227

[0007] However, generally speaking, large-scale control system migrations do not succeed in a single attempt, and there is a transitional period in which partial successes and failures coexist. Patent documents 1 and 2 do not address how to handle such transitional periods. Addressing these transitional periods is necessary to ensure that large-scale control system migrations are carried out reliably and efficiently. Therefore, the present invention aims to provide a technology for ensuring and efficient control system migrations by addressing the aforementioned transitional period.

[0008] To solve the above problems, one representative system migration support device of the present invention supports migration from a first system to a second system, and includes: a message communication unit that receives and duplicates a control message; a network communication unit that transmits the duplicated control message to a first service of the first system and a second service corresponding to the first service of the second system, and receives a first response message from the first service and a second response message from the second service in response to the control message; and a message comparison unit that compares and analyzes the first response message and the second response message to determine whether to migrate the first service of the first system in place of the second service of the second system, or whether to revert the second service of the second system in place of the first service of the first system.

[0009] According to the present invention, the transition of the control system can be carried out reliably and efficiently. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments for carrying out the invention.

[0010] Figure 1 shows an example of the common hardware configuration of the system according to this embodiment. Figure 2 shows an example of a control system that the system migration support device of Example 1 assists in the migration of. Figure 3 shows an example of the basic operation of the system migration support device of Example 1. Figure 4 shows an example of the overview of the system migration support device of Example 1. Figure 5 shows an example of the message flow in migration / return in Example 1. Figure 6 shows an example of the migration process for the master-slave control system of the system migration support device of Example 1. Figure 7 shows an example of the return process for the master-slave control system of the system migration support device of Example 1. Figure 8 shows an example of the means related to the message comparison unit of the system migration support device of Example 1. Figure 9 shows an example of the analysis report of Example 1. Figure 10 shows an example of the operation policy (guideline) of Example 1. Figure 11 shows an example of the operation policy (standard) of Example 1. Figure 12 shows an example of the operation policy (enhancement) and operation policy (reduction) of Example 2. Figure 13 shows an example of the control LAN simulator to which the system migration support device of Example 3 connects. Figure 14 shows an example of a connection configuration when migrating from a pre-migration system migration support device to a post-migration system migration support device using a system migration support device.

[0011] This embodiment will be described below with reference to the drawings. However, the present invention is not limited by this embodiment. Furthermore, in the drawings, identical parts are denoted by the same reference numerals.

[0012] When there are multiple components with the same or similar function, they may be described using the same symbol but with different subscripts. Furthermore, if there is no need to distinguish between these multiple components, the subscripts may be omitted. Also, terms such as "first," "second," etc., may be used to describe various elements or components, but these elements or components should not be limited by these terms. These terms are used solely to distinguish one element or component from another.

[0013] In this embodiment, the control systems supported by the system transition support device are the pre-transition control system (main system), the pre-transition control system (secondary system), the post-transition control system (main system), and the post-transition control system (secondary system). However, these four control systems are sometimes collectively referred to as the control system. Furthermore, when there is no need to distinguish between the pre-transition control system (main system) and the pre-transition control system (secondary system), they are sometimes simply referred to as the pre-transition control system. The same applies to the post-transition control system (main system) and the post-transition control system (secondary system).

[0014] Next, the terms commonly used in this embodiment will be explained. (Service) In this embodiment, "service" means a service application (including those referred to as microservices) that constitutes a control system, which is not tightly coupled with other service applications and is a system component that can be handled independently. (Operational policy) In this embodiment, "operational policy" means the provisions relating to the migration and rollback of services by the system migration support device. For example, this includes policies when performing migration and rollback processing, criteria for obtaining migration and rollback decisions, and conditions for increasing or decreasing the resources of the new system associated with the migration process.

[0015] (Outline of this embodiment) Generally, in large-scale control system migrations, system failures after migration are fatal. Therefore, in order to overcome the aforementioned transition period, it is desirable to migrate the control system in stages. However, depending on the control system, it may be difficult to stop the current system during migration, making staged migration impossible, or even if staged migration is performed, recovery in the event of a malfunction may be restricted, making it impossible to guarantee the reliable operation of the system after migration. Therefore, in this embodiment, the unit of migration is a service, and this service is actually run on both the pre-migration control system (current system) and the post-migration control system (new system). The feasibility of migration is determined for each service, and if a problem occurs with a service after migration, that service is reverted to the pre-migration service, thereby enabling a safe and reliable migration without stopping the current system.

[0016] <Common Hardware Configuration> First, with reference to Figure 1, the hardware configuration common to each system of this embodiment, such as the pre-migration control system, the post-migration control system, and the system migration support device, will be described.

[0017] Figure 1 shows an example of a common hardware configuration for a system according to this embodiment. Each system includes, as its main components, an input / output controller 1, a CPU 2, an HDD 3, a monitor controller 4, memory 5, a network interface 6, and a display 7. Each component will be described below.

[0018] The input / output controller 1 is a device that manages the interface with external devices in each system. It controls the exchange of data with input devices (keyboard, mouse, etc.) and output devices (printer, storage device, etc.) to the system, and has the function of ensuring the overall operability and expandability of the system.

[0019] CPU 2 is a central processing unit used commonly throughout the entire system. It is responsible for overall control within the system and has the function of performing real-time processing within the system.

[0020] HDD3 is a data storage device used commonly throughout the entire system. It has the function of long-term storage of important system data and logs. Any data storage device, such as an SSD, can be used.

[0021] The monitor controller 4 is a device that connects data from the system to the display 7. It has the function of controlling the display on the display 7.

[0022] Memory 5 is a storage device used commonly throughout the entire system. It works in conjunction with the system's CPU 2 and has the function of temporarily holding data and programs necessary while the system is running.

[0023] Network interface 6 is a communication interface for connecting systems. It has the function of sending and receiving data between systems.

[0024] Display 7 is a device that visually displays the system status and operating status. It functions as a user interface.

[0025] (Example 1) <Overview of the Control System> Referring to Figure 2, the overview of the control system that the system migration support device of Example 1 assists in the migration will be described. In this example, the control system that assists in the migration is, for example, a control system for the integrated management of a mobile object (bus, transport truck, train, etc.) moving on a fixed track, but it is not limited to this.

[0026] Figure 2 shows an example of a control system that is assisted in the transition by the system transition support device of Embodiment 1. As shown in Figure 2, the pre-transition control system (main system) 20 and the pre-transition control system (subordinate system) 21, and the post-transition control system (subordinate system) 31 are each connected to the control LAN 40 via the system transition support device 10.

[0027] Here, the pre-transition control system is the current system before the transition, and the post-transition control system is the new system after the transition. The post-transition control system (main system) 30 corresponds to the new system of the pre-transition control system (main system) 20, and the post-transition control system (subordinate system) 31 corresponds to the new system of the pre-transition control system (subordinate system) 21.

[0028] The control LAN 40 is connected to the controlled devices (control devices, such as video devices, signal devices, and operation management devices) that the control system controls.

[0029] In this embodiment, the control systems are all master-slave systems. A master-slave system is a method of achieving a highly reliable system by preparing two identical systems, a master and a slave, for a single process. Normally, the master system (active machine) performs the processing, and when a failure occurs or an error is detected in the master system, it switches to the standby slave system (backup machine). In this embodiment as well, the master and slave systems have basically the same system configuration.

[0030] The control system in this embodiment provides various services for integrated management of mobile objects. The post-transition control system basically provides services corresponding to each service provided by the pre-transition control system. The following describes each service using the pre-transition control system (main system) in Figure 2 as an example.

[0031] (Real-time location display service) This service provides a function to display the real-time location of the controlled moving object (e.g., bus, transport truck, train, etc.). This allows for a visual understanding of the current location of the moving object managed by the control system, enabling efficient operation management.

[0032] (Incident Management Service) This service provides functions for managing incidents (failures and problems) that occur in the control system and recording the responses to them. This enables the rapid resolution of various problems that occur during the operation of the control system, and ensures the stable operation of the control system.

[0033] (Crew Support Service) This service provides functions that enable crew members of mobile vehicles to efficiently support mobile vehicle users. This makes it possible to provide a comfortable service that responds immediately to user needs.

[0034] (Operation Status Monitoring Service) This service provides functions for monitoring the status of transportation systems and transport facilities in real time. This makes it possible to accurately understand the operation status of moving objects.

[0035] (Communication Service) This service provides functions for communication between internal devices of a control system and between the control system and external systems. This enables rapid and accurate data exchange and information transmission between devices and systems, maintaining the integrity of the entire system.

[0036] (Map Display Service) This service displays map information used within the control system and provides functions to support navigation. This allows for the visual display of the route and location information of moving objects, enabling operations managers and crew members to make appropriate decisions.

[0037] (Schedule Management Service) This service provides functions for managing regulations and schedules for transportation and transport facilities. This makes it possible to efficiently formulate and revise operational plans and ensure the smooth operation of the entire system.

[0038] (Data Collection and Analysis Service) This function provides the ability to collect and analyze data generated within the control system. This makes it possible to obtain basic data for evaluating and optimizing the operational status and performance of the control system.

[0039] (Mobile Object Tracking Service) This service provides functions for determining the current location and tracking the movement history of mobile objects. This makes it possible to understand the operational status of mobile objects in detail and modify the operational plan as needed.

[0040] (Infrastructure Management Service) This service provides functions for managing the infrastructure of transportation and transport facilities. This makes it possible to ensure safety and reliability in operations.

[0041] (Event Notification Service) This service provides a function to send notifications when important events occur in the control system. This enables the system administrator to respond promptly to important events.

[0042] (Device Control Service) This service provides a function to manage and control devices such as sensors and recording devices connected to the control system. This enables the operation status of each device to be grasped and adjusted or controlled as necessary.

[0043] (User Authentication and Access Control Service) This service provides a function to perform user authentication and implement access control. This enables the migration of the control system to be carried out only by users with appropriate permissions, ensuring the security of the system.

[0044] (Network Communication Service) This service provides a function to smoothly communicate with external systems. This enables reliable data synchronization and information transmission between the systems before and after migration, supporting the migration process.

[0045] <Basic Operations of the System Migration Support Device> Next, referring to FIG. 3, the basic operations of the system migration support device of this embodiment will be described. FIG. 3 is a diagram showing an example of the basic operations of the system migration support device of Embodiment 1. The basic operations of the system migration support device of this embodiment are migration and rollback. Migration is an operation to replace and introduce the services of the pre-migration control system with the services of the post-migration control system, and rollback is an operation to replace the services of the post-migration control system that have been migrated once with the services of the pre-migration control system and return them to the original state. Migration and rollback are performed in units of services.

[0046] In FIG. 3, since the crew support service and the data collection / analysis service of the pre-transition control system (main system) 20 meet the criteria related to the transition, they are transferred to the corresponding services of the post-transition control system (main system) 30, and since the operation status monitoring service of the post-transition control system (main system) 30 does not meet the criteria related to the transition after the transition, it is shown that it is reverted to the corresponding service of the pre-transition control system.

[0047] The transfer / return of the service may be automatically executed or may be in the form of a proposal to the system administrator. Also, the transfer of the service may be prioritized and executed in order from the one with the lowest importance in order to minimize the impact of troubles associated with the transfer. The details of such transfer / return can be defined by the operation policy 14 described later.

[0048] Note that since transfer and return are relatively common processes, in the following description, transfer may be taken as an example in some cases, but the same applies to return.

[0049] <Overview of System Transition Support Device> Referring to FIG. 4, the overview of the system transition support device according to the first embodiment will be described. FIG. 4 is a diagram showing an example of the overview of the stem transition support device of the first embodiment. First, referring to FIG. 4(a), the overview of the processing of the system transition support device 10 will be described. The dashed arrows in the figure represent the flow of messages.

[0050] When the system transition support device 10 receives a control message from the controlled device via the control LAN 40, it sequentially performs three processes: a process of duplicating the control message and transmitting it to the control system, a process of comparing and analyzing the response message, and a process of replying the response message to the controlled device. Each process will be described below.

[0051] (Duplication and Transmission of Control Message) When the system transition support device 10 receives a control message from the control LAN 40, it duplicates it and transmits it to both the pre-transition control system (main system) 20 and the post-transition control system (main system) 30.

[0052] In this embodiment, since the control system is a master-slave system, master-slave switching devices 50 and 60 are provided between the system transition support device and the pre-transition control system and the post-transition control system, respectively, to manage the flow of control messages between the master and slave systems. In this example, control messages transmitted from the system transition support device 10 are distributed to the master system by the master-slave switching devices 50 and 60, respectively. Note that the master-slave switching devices 50 and 60 can also distribute control messages to both the master and slave systems.

[0053] The pre-migration control system (main system) 20 and the post-migration control system (main system) 30 analyze the received control message, perform predetermined processing in the corresponding service, create a response message, and transmit it to the system migration support device 10. The response message may consist of multiple messages (a group of response messages, so to speak) for controlling the controlled device.

[0054] (Comparison and Analysis of Response Messages) When the system migration support device 10 receives response messages from the pre-migration control system (main system) 20 and the post-migration control system (main system) 30, it compares and analyzes both response messages based on the operation policy 14 (described later), makes a decision regarding the migration of the relevant service, and executes the necessary processing. Details of this comparison and analysis will be described later.

[0055] (Replying to response messages) If the system migration support device 10 determines that migration is possible, it will send one of the response messages to the controlled device via the control LAN 40. If migration is not possible, it will send only the response message from the pre-migration control system (main system) 20 to the controlled device via the control LAN 40. In this example, only the response message from the pre-migration control system (main system) is sent.

[0056] Next, with reference to Figure 4(b), an overview of each part of the system migration support device 10 will be described. As shown in Figure 4(b), the system migration support device 10 has various components (A) to (M), but the three parts that are primarily responsible for the three processes described above are (A) the message communication unit, (B) the message comparison unit, and (M) the network communication unit. Each of these parts will be described below.

[0057] (A) Message Communication Unit The message communication unit has the function of communicating between the control system and the controlled device (e.g., video device, signal device, operation management device) via the control LAN 40. This includes the function of duplicating control messages received via the control LAN and transmitting them to the pre-transition control system and the post-transition control system, the function of receiving response messages to control messages from the pre-transition control system and the post-transition control system, respectively, and the function of selectively sending response messages back to the controlled device via the control LAN.

[0058] (B) Message Comparison Unit The message comparison unit includes functions to compare and analyze response messages from the pre-migration control system and response messages from the post-migration control system to make decisions regarding migration or rollback, and to output instructions to the outside to execute the processes related to migration or rollback. Details of the message comparison unit will be described later.

[0059] (C) Message filtering unit The message filtering unit includes a function that eliminates unnecessary messages based on the content of each message and allows only appropriate messages to pass through.

[0060] (D) Data logging section The data logging section includes a function to record the transmission and reception history of each message and save it as data so that it can be analyzed later.

[0061] (E) Synchronization Processing Unit The synchronization processing unit includes a function that synchronizes the pre-transition control system and the post-transition control system to ensure that both systems operate at the same time.

[0062] (F) Error Handling Unit The error handling unit includes a function for detecting errors and performing recovery processing.

[0063] (G) Status Monitoring Unit The status monitoring unit includes a function to monitor the operating status of the pre-transition control system and the post-transition control system in real time and to respond when an abnormality is detected.

[0064] (H) Failover section The failover section includes a function that automatically switches to the other system when one of the pre-transition control system or the post-transition control system experiences a system failure.

[0065] (I) Access Control Unit The access control unit includes a function to authenticate users and ensure that only users with the appropriate privileges can operate the system.

[0066] (J) Notification Section The notification section includes a function to notify administrators when important events or errors occur.

[0067] (K) Configuration Management Department The Configuration Management Department includes functions for managing various system settings and optimizing system operation.

[0068] (L) Interface section The interface section includes functions that provide an interface for connecting to other systems and devices.

[0069] (M) Network Communication Unit The network communication unit includes functions for sending and receiving messages between the pre-migration control system (main system) and the post-migration control system (main system).

[0070] <Message Flow> The message flow during transition / return will be explained with reference to Figure 5. Figure 5 is a diagram showing an example of the message flow during transition / return in Example 1. In this example, control messages are sent to the pre-transition control system (main system) and the post-transition control system (main system), but the same applies to cases where messages are sent to other control systems. Steps S1 to S7 will be explained below.

[0071] (S1) A control message is transmitted to the system transition support device 10 via the control LAN 40.

[0072] (S2) The control message is duplicated by the system transition support device 10, and the first control message and the second control message are created.

[0073] (S3-1) The first control message is transmitted to the master-slave switching device (before transition) 50.

[0074] (S3-2) A second control message is transmitted to the master-slave switching device (after transition) 60.

[0075] (S4-1) The first control message is distributed to the pre-transition control system (main system) 20 by the master-slave switching device (pre-transition) 50 and transmitted.

[0076] (S4-2) The second control message is distributed to the post-transition control system (main system) 30 by the master-slave switching device (post-transition) 60 and transmitted.

[0077] (S5-1) The first control message is processed by the service of the pre-transition control system (main system) 20, and the first response message is created.

[0078] (S5-2) The second control message is processed by the service of the post-transition control system (main system) 30, and a second response message is created.

[0079] (S6-1) The first response message is transmitted to the system transition support device 10 via the master-slave switching device (before transition) 50.

[0080] (S6-2) A second response message is transmitted to the system transition support device 10 via the master-slave switching device (after transition) 60.

[0081] (S7) The first response message and the second response message are compared and analyzed by the system migration support device 10. If there are no problems, only the first response message is allowed to pass through the control LAN, and the second response message is not allowed to pass through.

[0082] These messages are processed for all migration target services of the pre-migration control system (main system) 20, and after the migration is complete, the post-migration control system (main system) 30 will be operated as the main control system.

[0083] As a result, the system migration support device 10 can support a reliable and efficient migration between systems without stopping the current system.

[0084] <Processing for Master-Slave Control Systems> Referring to Figures 6 and 7, the processing when the system transition support device 10 of this embodiment is applied to a master-slave control system will be described. Figure 6 is a diagram showing an example of the transition processing for the master-slave control system of the system transition support device of Embodiment 1. In this example, the response message from the pre-migration control system (master system) 20 is used as a reference, and the response messages are compared for the following four cases to make a decision on whether to proceed with the transition.

[0085] In comparison case 1, the response message from the pre-migration control system (main system) 20 and the response message from the post-migration control system (main system) 30 are compared. In this case, the response message from the pre-migration control system (main system) 20 is sent back to the controlled device via the control LAN 40, while the response message from the post-migration control system (main system) 30 is not sent back. By comparing and analyzing both response messages, it is confirmed whether the service satisfies the operational policy 14 (described later).

[0086] In comparison case 2, the response message from the pre-transition control system (master system) 20 and the response message from the pre-transition control system (slave system) 21 are compared. In this case, the response message from the master system is sent back to the controlled device via the control LAN 40, while the response message from the slave system is not sent back. This is done to confirm the consistency between the master and slave systems in the pre-transition control system. This may be done when the slave system is in a hot standby state.

[0087] In comparison case 3, the response message from the pre-transition control system (slave system) 21 and the response message from the post-transition control system (slave system) 31 are compared. In this case, no response messages from either slave system are sent back to the controlled device. This is done to confirm the consistency between the slave systems.

[0088] In comparison case 4, the response message from the post-transition control system (master system) 30 and the response message from the post-transition control system (slave system) 31 are compared. In this case, no response message is sent back to the controlled device from either the master system or the slave system. This is done to confirm the consistency between the master and slave systems in the post-transition control system.

[0089] Normally, if operational policy 14 (described later) is met for all of comparison cases 1 to 4, migration is considered possible. However, for some services, it is not necessary to meet all of comparison cases 1 to 4, and this criterion can also be defined in operational policy 14.

[0090] Figure 7 shows an example of the rollback process for the master-slave control system of the system migration support device of Embodiment 1. In this example, the response message from the post-migration control system (master system) 30 is used as a reference, and the response messages are compared for the following four cases to determine whether to roll back.

[0091] In comparison case 5, the response message from the post-migration control system (main system) 30 and the response message from the pre-migration control system (main system) 20 are compared. In this case, the response message from the post-migration control system (main system) 30 is sent back to the controlled device via the control LAN 40, while the response message from the pre-migration control system (main system) is not sent back. By comparing and analyzing both response messages, it is confirmed whether the service satisfies the operational policy 14 (described later).

[0092] In comparison case 6, the response message from the post-transition control system (master system) 30 and the response message from the post-transition control system (slave system) 31 are compared. In this case, the response message from the master system is sent back to the controlled device via the control LAN 40, while the response message from the slave system is not sent back. This is done to confirm the consistency between the master and slave systems in the post-transition control system. This may also be done when the slave system is in a hot standby state.

[0093] In comparison case 7, the response message from the post-transition control system (slave system) 31 is compared with the response message from the pre-transition control system (slave system) 21. In this case, no response messages from either slave system are sent back to the controlled device. This is done to confirm the consistency between the slave systems.

[0094] In comparison case 8, the response message from the pre-transition control system (master system) 20 and the response message from the pre-transition control system (slave system) 21 are compared. In this case, no response message is sent back to the controlled device from either the master system or the slave system. This is done to confirm the consistency between the master and slave systems in the pre-transition control system.

[0095] Normally, if any one of comparison cases 5 to 8 does not meet operational policy 14 (described later), it is determined that a rollback is possible. However, depending on the service, it is not necessarily required that only one of comparison cases 5 to 8 is met, and this criterion can also be defined in operational policy 14.

[0096] <Comparison and Analysis of Response Messages> Next, with reference to Figure 8, the comparison and analysis of response messages in the system migration support device 10 of this embodiment will be described. Figure 8 is a diagram showing an example of the means related to the message comparison unit of the system migration support device of Embodiment 1. As shown in Figure 8, the message comparison unit of the system migration support device 10 uses means such as a message comparison buffer 11, a message comparison and analysis unit 12, an analysis report 13, and an operation policy 14 to compare and analyze, for example, a response message from the pre-migration control system (first response message) and a response message from the post-migration control system (second response message). Each means will be described below.

[0097] (Message Comparison Buffer 11) The message comparison buffer 11 is a memory area set up for each service, and for example, it records on the fly control messages sent to the pre-migration control system (main system) 20 and the post-migration control system (main system) 30, as well as a first response message sent from the pre-migration control system (main system) 20 and a second response message sent from the post-migration control system (main system) 30. The information recorded by the message comparison buffer 11 includes the exact time each message was sent and received, and the content of each message.

[0098] (Message Comparison and Analysis Unit 12) The Message Comparison and Analysis Unit 12 refers to the information recorded in the Message Comparison Buffer 11, creates the analysis report 13 described below, and makes decisions on migration or rollback based on the operational policy 14.

[0099] (Analysis Report 13) Analysis Report 13 summarizes the results of the message comparison and analysis unit 12 based on the specifications set for each service. Details of Analysis Report 13 will be described later.

[0100] (Operational Policy 14) Operational policy 14 in this embodiment defines the policies and criteria for migration / reverting, which are set for each service. Operational policy 14 may be provided outside the system migration support device 10. Details of operational policy 14 will be described later.

[0101] Referring to Figure 9, the analysis report 13 of Example 1 will be described. Figure 9 is a diagram showing an example of the analysis report of Example 1. As shown in Figure 9, the analysis report 13 has specifications for comparison items, targets, and analysis results. In this example, the first response message and the second response message are compared and analyzed using six comparison items: message content, message format, message arrival time, message ID, message arrival order, and message timestamp. Each comparison item will be described below. As mentioned above, each response message may consist of multiple messages (a group of response messages), so the analysis results in this example are also the result of comparing multiple messages between the two response messages.

[0102] The message content is analyzed by comparing the degree of similarity between the message bodies of both response messages. A higher degree of similarity indicates that there will be no problems with the operation of the service after the migration. In this example, the analysis results show that the degree of similarity between the message bodies was 98%.

[0103] The message format is the subject of comparison and analysis, focusing on the degree of formatting agreement between the two response messages. Only when this agreement is 100% will the service function correctly after the migration. In this example, the analysis results show that the formatting agreement was 100%.

[0104] The message arrival time is calculated by comparing the arrival time difference between the two response messages. A smaller time difference indicates a higher degree of real-time performance after the transition. In this example, the analysis results show that the average arrival time difference was 5 ms.

[0105] The message ID is used for comparison and analysis, specifically the number of matching message IDs between both response messages. A higher percentage of matches indicates that the message is being correctly recognized by the migrated service. In this example, the analysis results show that the match rate was 99%.

[0106] Message delivery order is the subject of comparison and analysis of the degree of agreement in the delivery order between both response messages. A higher degree of agreement indicates that the messages are being processed in the correct order in the migrated service. In this example, the analysis results show that the degree of agreement was 99%.

[0107] The message timestamping time is analyzed by comparing the time difference between the timestamps assigned to each response message. A smaller time difference indicates that the message was processed appropriately in the subsequent service. In this example, the analysis results show that the time difference was within 50 ms.

[0108] If the post-migration control system service is functioning correctly, the analysis results will typically show no difference between the two response messages in terms of comparison items such as message content, message format, message ID, and message arrival order. However, if the post-migration control system service is not exactly the same as the pre-migration control system service, for example, if it is an extension of the pre-migration control system service, the increase in response messages from the post-migration control system service may cause differences in message IDs between pre- and post-migration response messages, or discrepancies in message arrival times.

[0109] Various situations related to the migration, including whether to judge the analysis results as a service malfunction in the post-migration control system or as the result of a service function enhancement, will be handled flexibly in accordance with Operation Policy 14 described below.

[0110] <Contents of the Operational Policy> Referring to Figures 10 and 11, the details of the operational policy 14 of Example 1 will be explained. The operational policy 14 of this example includes two types: operational policy (policy) 14-1 which defines the conditions and policies for migration / return, and operational policy (criteria) 14-2 which defines the criteria for migration / return.

[0111] Figure 10 shows an example of operational policy 14-1 in this embodiment. Operational policy 14-1 is set for each service, but in this example it is shown in a list for explanatory purposes. As shown in Figure 10, operational policy 14-1 specifies policies that enable safe and efficient migration and rollback. The following describes each policy included in operational policy 14-1.

[0112] The nighttime switching policy stipulates that migrations and rollbacks should be performed during nighttime hours (22:00 to 5:00) when the operational load is relatively low. This allows for low-load, low-risk migrations and rollbacks, minimizing the impact on normal operations. Migrations and rollbacks are performed automatically based on a time schedule.

[0113] The weekend switching policy stipulates that migration / reverting operations should be performed on weekends (Saturdays, Sundays, and public holidays) when the operational load differs from that of weekdays. This allows for verification of migration / reverting operations under different conditions than those of weekdays. Migration / reverting operations are performed automatically based on a time schedule.

[0114] The phased service migration policy stipulates that migration and rollback will be carried out gradually and sequentially during a predetermined migration period. This diversifies the risks of the migration and makes it easier to roll back if problems occur. Migration and rollback will be carried out according to a pre-determined schedule.

[0115] The function-based switching policy stipulates that migration / reverting should be performed on a function-by-function basis. This allows for detailed verification of the operation of each function and identification of inter-service interactions. Migration / reverting is carried out according to a pre-determined schedule.

[0116] The artificial load testing policy stipulates that migration / reverting should be tested in advance under artificial load in a simulated environment. This allows for verification of operation under loads close to actual operating conditions. Migration / reverting is performed automatically through simulation.

[0117] The random switching test policy specifies that migrations and rollbacks will be performed randomly. This allows for verification of operation under actual operational conditions and allows for testing of unexpected problems. Migrations and rollbacks are performed automatically in real time.

[0118] A regionally limited transition policy stipulates that migration / reverting procedures are limited to specific regions or departments. This allows for verification within a limited scope, minimizing risk. Migration / reverting is performed automatically on a regional or departmental basis, selecting the relevant regions and services.

[0119] The pre-migration testing policy stipulates that the new system be tested by a limited number of users before the full migration. By obtaining feedback from users, it is possible to predict problems related to the new system.

[0120] The network load comparison policy defines migration / revert in relation to a network load threshold. This allows for operational verification based on actual load, minimizing risks due to load fluctuations. For example, migration is performed automatically when the network load exceeds the threshold.

[0121] The response delay time comparison policy defines migration / revert in relation to a response delay time threshold. Because it allows for responses based on fluctuations in response delay, it helps maintain overall system performance. For example, migration is performed automatically when the response delay time exceeds the threshold.

[0122] As a result, the system migration support device of this embodiment enables the safe and efficient migration of the control system and allows for rapid rollback as needed.

[0123] Next, Figure 11 shows an example of the operational policy (criteria) 14-2 of Example 1. The operational policy (criteria) 14-2 determines the analysis results for each comparison item in the analysis report 13. As shown in Figure 11, the operational policy (criteria) 14-2 sets a target and judgment criteria for each comparison item.

[0124] The evaluation criteria may include those that directly assess the analysis results, such as the message format, those that evaluate based on the average value of the analysis results, such as the message content, and those that evaluate based on the worst-case value of the analysis results, such as the message arrival time. Furthermore, a comprehensive provision may be included to determine the final decision on whether or not to proceed with the transition based on the pass / fail status of each comparison item.

[0125] Taking item 1 of operational policy (standard) 14-2 as an example, this is the item that determines the message content among the comparison items. If the analysis result "98%" in analysis report 13 in Figure 9 is evaluated using the judgment criterion "Pass if average 95% / hour or more", it will be judged as "Pass". In this example, the final decision on the migration of the relevant service is made according to item 7, which is the provision for overall judgment, based on the results of judgments made in items 1 to 6 of operational policy (standard) 14-2 for each comparison item in analysis report 13.

[0126] Regarding remands, the reverse is also true; if any one of items 1 through 6 is not passed, it may be decided to remand the work. Alternatively, separate provisions may be established for the overall judgment regarding remands.

[0127] (Example 2) Generally, when migrating a control system, it is necessary to pay attention to whether the resources of the new system after the migration are sufficient or insufficient. Even if the decision to migrate is negative, if this is due to a lack of resources rather than a malfunction in the service itself, it is desirable to address the issue by increasing resources without changing the service itself. On the other hand, if the resources of the new system are excessive for the service after the migration, even if there is no disruption to the operation of the new system, it cannot be said that there are no problems with the migration in terms of being over-specified.

[0128] To address these issues, operational policy 14 can also be used to increase or decrease the resources of the post-migration control system.

[0129] Referring to Figure 12, the enhancement / reduction of resources in the post-migration control system by the system migration support device of Example 2 will be explained. Figure 12 shows an example of operational policy (enhancement) 14-3 and operational policy (reduction) 14-4 of Example 2. The system migration support device of this example uses operational policy (enhancement) 14-3 shown in Figure 12(a) or operational policy (reduction) 14-4 shown in Figure 12(b), in addition to or instead of operational policy (guideline) 14-1 and operational policy (criteria) 14-2 of Example 1.

[0130] The following describes the resource enhancement flow using the network load comparison policy from Operation Policy (Enhancement) 14-3 as an example. In this example, when migrating the services of the pre-migration control system to the services of the post-migration control system, an attempt is made to enhance resources if the network load exceeds a threshold. The enhancement process is carried out in the following order and continues until an effect is achieved, at which point it is terminated.

[0131] (1) Vertical scaling is performed. The CPU or memory is doubled to enhance the processing capacity of the service. If the network load falls below the threshold as a result of the increase, the scaling process is terminated. If the network load still exceeds the threshold, the process proceeds to the next step.

[0132] (2. Storage device replacement) Replace the HDD with an SSD or an SSD using NVMe (Non-Voltage Memory Express) to improve I / O performance. If the network load falls below the threshold as a result of the change, the enhancement process will end; if the network load still exceeds the threshold, proceed to the next step.

[0133] (3. Introduction of caching) Caching will be introduced for frequently used data to reduce access times. If the network load falls below the threshold as a result of the introduction, the enhancement process will end; if the network load still exceeds the threshold, the process will proceed to the next step.

[0134] (4. Network Bandwidth Enhancement) The bandwidth is doubled to improve latency. If the network load falls below the threshold after the increase, the enhancement process ends. If the network load still exceeds the threshold, the process proceeds to the next step.

[0135] (5. Storage and Memory Optimization) Optimize disk I / O by optimizing cache and memory efficiency. If the network load falls below the threshold as a result of the optimization, the enhancement process will be terminated. If the network load still exceeds the threshold, the migration of the service will be stopped or rolled back.

[0136] These enhancement processes 1-5 can be executed automatically or they can be proposed to the system administrator. While the network load comparison policy was used as an example to explain enhancement processes, enhancement flows can also be appropriately prepared and implemented for response delay time comparison policies.

[0137] Next, we will explain the resource reduction flow using the response delay time comparison policy from Operation Policy (Reduction) 14-4 in Figure 12(b) as an example. When migrating the services of the pre-migration control system to the services of the post-migration control system, if the response delay time does not exceed the threshold, an attempt is made to reduce resources. The reduction process is carried out in the following order and continues until an abnormality is detected, at which point it is returned to the previous point and terminated.

[0138] (1. Reducing Network Bandwidth) Reduce the bandwidth by half. If the response delay time exceeds the threshold as a result of the reduction, revert to the original value and end the reduction process. If the response delay time remains below the threshold, proceed to the next step.

[0139] (2. Stopping the implementation of the cache) Switch from implementing the cache to not implementing it. If the response delay time exceeds the threshold as a result of the switch, revert to the previous setting and end the reduction process. If the response delay time is still below the threshold, proceed to the next step.

[0140] (3. Storage Device Replacement) Replace the SSD using NVMe (Non-Voltage Memory Express) with another SSD or HDD. If the response delay time exceeds the threshold as a result of the replacement, revert to the original setting and terminate the reduction process. If the response delay time remains below the threshold, proceed to the next step.

[0141] (4) Vertical scaling is performed. Either the CPU processing performance is reduced by half, or the amount of memory is reduced by half. If the response delay time exceeds the threshold as a result of the reduction, the settings are restored to their original values ​​and the reduction process is terminated. If the response delay time remains below the threshold, the reduction process is terminated at that point.

[0142] These reduction processes 1-4 can be executed automatically or they can be proposed to the system administrator. While the reduction process was explained using the response delay time comparison policy as an example, reduction flows can also be prepared and implemented for network load comparison policies as well.

[0143] This makes it possible to continue the migration without changing the service entity and to avoid over-specifying the post-migration control system.

[0144] (Example 3) When migrating a control system, it is necessary to confirm that the system after the migration is always in proper working order. As shown in Example 1, normally, the operation of the service is monitored based on the operational policy 14 for a predetermined period after the migration to confirm that no problems occur. However, it is also necessary to verify in advance that the control system after the migration will be in proper working order even for events that are not likely to occur within the predetermined period (for example, accidents or failures).

[0145] The control LAN simulator 41 in this embodiment simulates various anticipated situations, including these events, and generates virtual control messages, thereby making the migration support provided by the system migration support device safer and more reliable.

[0146] Referring to Figure 13, the system migration support device of Embodiment 3 will be described. Figure 13 is a diagram showing an example of a control LAN simulator to which the system migration support device of Embodiment 3 is connected. As shown in Figure 13, the system migration support device 10 of this embodiment differs from the system migration support device 10 of Embodiment 1 in that it is connected to the control LAN simulator 41. Hereinafter, the same reference numerals are used for the components described in Embodiment 1 and their descriptions are omitted, and the relationship with the control LAN simulator 41 will be the main focus of the description.

[0147] The control LAN simulator 41 includes virtual control target devices, such as a virtual video device, a virtual signaling device, and a virtual operation management device, and transmits virtual scenarios (e.g., accident scenarios) to the virtual control target devices to generate virtual control messages. Next, each of these devices will be described.

[0148] The virtual video device is a virtual device for real-time monitoring in the control system and simulates virtual video data (such as virtual accident footage). The control LAN simulator 41 transmits virtual control messages corresponding to the virtual video data to the system transition support device 10. The virtual video device may be implemented as software.

[0149] The virtual signaling device is a virtual device for managing signal data in the control system, and simulates virtual signals (for example, virtual traffic signals or fault signals). The control LAN simulator 41 transmits virtual control messages corresponding to the virtual signals to the system transition support device 10. The virtual signaling device may also be implemented as software.

[0150] The virtual operation management device is a virtual device for operation management in the control system, and simulates virtual operation conditions (such as virtual accident situations). The control LAN simulator 41 transmits virtual control messages corresponding to the virtual operation conditions to the system transition support device 10. The virtual operation management device may also be implemented as software.

[0151] The processing of the system migration support device 10 will now be described. The system migration support device 10 uses the control LAN simulator 41 to evaluate the operation of the post-migration control system, for example, in the following procedure.

[0152] (1) Sending and Receiving Virtual Control Messages The system migration support device 10 receives virtual control messages corresponding to the virtual scenario from the control LAN simulator 41, duplicates them, and sends them to the pre-migration control system and the post-migration control system.

[0153] (2) Analysis of Simulation Results The system transition support device 10 receives response messages to virtual control messages from the pre-transition control system and the post-transition control system, respectively, and compares and analyzes both response messages.

[0154] (3) Evaluation of Simulation Results The system migration support device 10 evaluates whether there are any problems with the operation of the post-migration control system based on the analysis results. If problems occur, the system configuration and settings are reviewed. Such evaluations and reviews may be specified in the operation policy 14.

[0155] As a result, the system migration support device 10 in this embodiment can consider countermeasures in advance for accidents and failures that may occur in the post-migration control system, thereby ensuring the stability and reliability of the post-migration control system.

[0156] <Modifications> Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above, and various modifications are possible without departing from the spirit of the present invention.

[0157] For example, in this embodiment, the target of the migration support is a control system for the integrated management of mobile objects, but it is not limited to this, and it is possible to support the migration of various control systems.

[0158] Referring to Figure 14, we will now explain the case where the system migration support device targets both the old and new system migration support devices. Figure 14 is a diagram showing an example of a connection configuration when migrating from the old system migration support device to the new system migration support device using the system migration support device.

[0159] To verify the operation of the system migration support device (pre-migration) 10-1 and the system migration support device (post-migration) 10-2, a hub 70 with port mirroring functionality and a system migration support device (for verification) 10-3 are used. As shown in Figure 14, the four systems, the pre-migration control system (main system) 20 and (subordinate system) 21 and the post-migration control system (main system) 30 and (subordinate system) 31, are connected to the system migration support device (pre-migration) 10-1 and also to the system migration support device (post-migration) 10-2 via the hub 70.

[0160] The system migration support device (pre-migration) 10-1 and the system migration support device (post-migration) 10-2 operate under the same operational policy while maintaining time synchronization, and are expected to perform the same actions. In other words, if both devices behave identically, they will send the same message to the system migration support device (for verification) 10-3.

[0161] The system migration support device (for verification) 10-3 compares these messages to confirm whether the system migration support device (before migration) 10-1 and the system migration support device (after migration) 10-2 are behaving the same way. This allows for a determination of whether the migration of the system migration support device is appropriate or whether it should be reverted to the state before the migration.

[0162] In addition, while this embodiment uses operational policies for migration / revert, it is not limited to this. When the control system's services are simple, for example, it is also possible to determine migration / revert by simply comparing response messages as needed.

[0163] Furthermore, while this embodiment demonstrates an example of reducing the resources of the post-migration control system through operational policies, it is also possible to reflect the excessive resource specifications of the post-migration control system in the migration priority.

[0164] 1 Input / Output Controller, 2 CPU, 3 HDD, 4 Monitor Controller, 5 Memory, 6 Network Interface, 7 Display, 10 System Migration Support Device, 10-1 System Migration Support Device (Before Migration), 10-2 System Migration Support Device (After Migration), 10-3 System Migration Support Device (Verification), 11 Message Comparison Buffer, 12 Message Comparison and Analysis Unit, 13 Analysis Report, 14 Operation Policy, 14-1 Operation Policy (Guidelines), 14-2 Operation Policy (Standards), 14-3 Operation Policy (Enhancement), 14-4 Operation Policy (Reduction), 20 Pre-Migration Control System (Primary), 21 Pre-Migration Control System (Secondary), 30 Post-Migration Control System (Primary), 31 Post-Migration Control System (Secondary), 40 Control LAN, 41 Control LAN Simulator, 50 Master / Slave Switching Device (Before Migration), 60 Master / Slave Switching Device (Post-Migration), 70 Hub

Claims

1. A system migration support device that assists in the transition from a first system to a second system, comprising: a message communication unit that receives and duplicates a control message; a network communication unit that transmits the duplicated control message to a first service of the first system and a second service of the second system corresponding to the first service, and receives a first response message from the first service and a second response message from the second service in response to the control message; and a message comparison unit that compares and analyzes the first response message and the second response message to determine whether to migrate the first service of the first system in place of the second service of the second system, or whether to roll back the second service of the second system in place of the first service of the first system.

2. A system migration support device according to claim 1, wherein the message comparison unit performs the migration process or the rollback process based on the policy defined in the operational policy.

3. A system migration support device according to claim 1 or 2, wherein the message comparison unit makes a determination of whether or not to migrate or whether or not to roll back based on the determination criteria specified in the operational policy.

4. A system migration support device according to claim 2 or 3, wherein the message comparison unit further performs processing to enhance or reduce the second system based on the conditions specified in the operation policy.

5. A system migration support device according to claim 4, wherein the message comparison unit outputs the contents of the enhancement or reduction process to a display, or automatically executes the process.

6. A system migration support device according to any one of claims 1 to 5, wherein the message communication unit receives a control message from the controlled device via a control LAN, duplicates it, and sends back only one of the first response message and the second response message to the controlled device via the control LAN.

7. A system migration support device according to any one of claims 1 to 6, wherein the message communication unit receives a control message from a control LAN simulator that simulates a device to be controlled, duplicates it, and sends back only one of the first response message and the second response message to the control LAN simulator.

8. A system migration support method for assisting the transition from a first system to a second system, characterized in that: a message communication unit receives and duplicates a control message; a network communication unit transmits the duplicated control message to a first service of the first system and a second service of the second system corresponding to the first service; a first response message from the first service and a second response message from the second service in response to the control message; and a message comparison unit compares and analyzes the first response message and the second response message to determine whether to migrate the first service of the first system in place of the second service of the second system, or whether to roll back the second service of the second system in place of the first service of the first system.

9. A system migration support method according to claim 8, characterized in that the message comparison unit performs the migration process or the rollback process based on the operational policy.

10. A system migration support method according to claim 8 or 9, characterized in that the message comparison unit makes a determination of whether or not to migrate or whether or not to roll back based on the determination criteria defined in the operational policy.

11. A system migration support method according to claim 9 or 10, characterized in that the message comparison unit further performs processing to enhance or reduce the second system based on the conditions specified in the operation policy.

12. A system migration support method according to claim 11, characterized in that the message comparison unit causes the contents of the enhancement or reduction process to be output to a display, or causes the process to be automatically executed.

13. A system migration support method according to any one of claims 8 to 12, characterized in that the message communication unit receives a control message from the controlled device via the control LAN and duplicates it, and sends back only one of the first response message and the second response message to the controlled device via the control LAN.

14. A system migration support method according to any one of claims 8 to 13, characterized in that the message communication unit receives a control message from a control LAN simulator that simulates a device to be controlled, duplicates it, and sends back only one of the first response message and the second response message to the control LAN simulator.

Images