JP2024061405A - Monitoring device, management device, communication system, and recovery method - Google Patents

Abstract

[Problem] It is possible to change the entity that decides the contents of the recovery process depending on the type of abnormality that occurs in the device. [Solution] A monitoring device includes an abnormality detection unit that monitors one or more devices to be monitored and detects abnormalities that occur in the devices, an abnormality notification unit that outputs the detected abnormality as an abnormality notification to the outside, a recovery process determination unit that determines a recovery type depending on the abnormality type, either a self-determined recovery in which the monitoring device determines the contents of the recovery process for the device, or an instruction-received recovery determined by an external device of the monitoring device, and a recovery process execution unit that executes recovery process for the device based on the recovery type determined by the recovery process determination unit. [Selected Figure] Figure 1

Description

The present invention relates to a monitoring device, a management device, a communication system, and a recovery method.

In recent years, systems have been developed that remotely monitor and control equipment by collecting data on on-site equipment in factories and the like via communication devices and consolidating it in a management device in a remote location. Stable operation of these systems requires that abnormalities occurring in the equipment be detected and quickly restored. However, in an operation mode in which an abnormality is confirmed on the management device each time it occurs and then a recovery process is remotely commanded by an operator, the problem of recovery taking time arises. As a solution to this problem, a method is known in which a communication device connected to the equipment operates as a monitoring device, monitors the equipment for abnormalities, and when an abnormality is detected, the monitoring device automatically executes recovery processes such as restarting the equipment. By adopting this method, it becomes possible to quickly recover from abnormalities, and it is particularly effective for abnormalities with high urgency.

On the other hand, automatic execution of recovery processing by the monitoring device may cause equipment to be restarted at an unexpected timing, resulting in inconvenience in system operation. In consideration of such cases, it is desirable to selectively use a form in which the monitoring device automatically executes recovery processing and a form in which recovery processing is executed based on an instruction from a management device through operation by an operator, etc. Patent Document 1 discloses a remote power control system for a network device, including a power control device that monitors the state of the network device in real time and automatically resets the network device based on recovery standard data to restore power when an abnormality signal is generated due to the occurrence of a failure, and a management server that generates the recovery standard data and monitors the power control device in real time.

JP 2021-72076 A

The invention described in Patent Document 1 leaves room for further consideration in determining whether to perform recovery processing.

A monitoring device according to a first aspect of the present invention is a monitoring device that monitors one or more devices that are to be monitored, and includes an abnormality detection unit that detects an abnormality occurring in the device, an abnormality notification unit that outputs the detected abnormality to the outside as an abnormality notification, a recovery type that is a type of recovery depending on the abnormality type that is the type of the abnormality, to either a self-determined recovery in which the monitoring device determines the contents of the recovery processing for the device, or an instruction-received recovery that is determined by a device outside the monitoring device, and a recovery processing execution unit that executes recovery processing for the device based on the recovery type determined by the recovery processing determination unit.
A communication system according to a second aspect of the present invention is a communication system including a monitoring device that monitors one or more devices to be monitored, and a management device capable of communicating with the monitoring device, wherein the monitoring device comprises an abnormality detection unit that detects an abnormality occurring in the device, an abnormality notification unit that outputs the detected abnormality to the outside as an abnormality notification, a recovery type that is a type of recovery depending on the abnormality type that is the type of the abnormality, to either a self-determined recovery that is determined by the monitoring device, or an instruction-received recovery that is determined by an outside of the monitoring device, and a recovery process execution unit that executes recovery process of the device based on the recovery type determination by the recovery process determination unit, and the management device comprises an abnormality notification management unit that receives the abnormality notification output by the monitoring device, and a recovery process command unit that outputs the content of the recovery process determined based on the abnormality notification to the monitoring device.
A recovery method according to a third aspect of the present invention is a recovery method executed by a monitoring device that monitors one or more devices to be monitored, and includes an abnormality detection step of detecting an abnormality occurring in the device, an abnormality notification step of outputting the detected abnormality to the outside as an abnormality notification, a recovery processing determination step of determining a recovery type, which is a type of recovery, to either a self-determined recovery, in which the monitoring device determines the contents of the recovery processing for the device, or an instruction-received recovery, which is determined by an outside of the monitoring device, depending on the abnormality type, and a recovery processing execution step of executing recovery processing for the device based on the recovery type determined by the recovery processing determination step.

According to the present invention, the entity that determines the content of the recovery process can be changed depending on the type of abnormality that occurs in the device.

Overall configuration of the communication system FIG. 13 is a diagram showing an example of an abnormality definition table in the first embodiment. FIG. 1 is a diagram showing an example of a recovery process table according to the first embodiment; FIG. 4 shows a time chart when self-determined recovery is permitted. FIG. 5 shows a time chart when self-determined recovery is prohibited. 1 is a flowchart showing a process of a recovery process determination unit in the first embodiment. FIG. 13 is a diagram showing an example of a screen display for registering an abnormality definition table and a recovery process table. FIG. 13 shows an example of a screen display for outputting an abnormality notification and an example of a screen display for accepting a recovery process command. FIG. 13 is a diagram showing an example of an abnormality definition table in the second embodiment. FIG. 13 is a diagram illustrating an example of a recovery process table according to the second embodiment. 11 is a flowchart showing the process of a recovery process determination unit according to the second embodiment. FIG. 23 is a diagram showing an example of an abnormality definition table in the third embodiment. FIG. 23 is a diagram illustrating an example of a recovery process table according to the third embodiment. A flowchart showing the process of the recovery process determination unit in the third embodiment. FIG. 23 is a diagram showing an example of a recovery process table according to the fourth embodiment; 13 is a flowchart showing the process of the recovery process determination unit in the fourth embodiment.

(Summary of the Invention)
The monitoring device connected to the equipment to be monitored stores, as tables, a list of abnormality detection conditions for each abnormality type of the equipment, a list of message contents to be notified to the management device when an abnormality is detected, a list of recovery processes to be taken for each abnormality type, and a list of whether the recovery processes can be automatically executed at the judgment of the device itself. The monitoring device monitors and detects abnormalities in the equipment using the abnormality detection unit based on the above-mentioned table, and when an abnormality is detected, the abnormality notification unit transmits an abnormality notification containing the above-mentioned message to the management device. Thereafter, the recovery process determination unit of the monitoring device determines the recovery process to be taken for the abnormality and whether the recovery process can be automatically executed at the judgment of the device itself (hereinafter referred to as "self-determined recovery"). If self-determined recovery is permitted, the monitoring device executes recovery process in the recovery process execution unit to achieve early recovery. On the other hand, if self-determined recovery is not permitted for the detected abnormality type, the monitoring device waits to receive a recovery process command from the management device.

When the management device receives the abnormality notification sent by the monitoring device, it outputs the abnormality notification on a screen and presents it to the worker. When the worker confirms this output and issues a recovery processing command to the monitoring device, the recovery processing command unit sends a recovery processing command to the monitoring device. The monitoring device, which receives this recovery processing command, executes the specified recovery processing on the equipment, thereby recovering the equipment from the abnormality.

In this way, by selectively using automatic execution of recovery processing by the monitoring device and execution of recovery processing based on commands from the management device depending on the type of abnormality, it is possible to achieve both early recovery and recovery at an appropriate time that does not interfere with system operation. For example, for a highly urgent abnormality that requires early recovery, the aforementioned recovery processing management unit of the monitoring device can permit self-determined recovery, giving priority to early recovery. On the other hand, for a less urgent abnormality, self-determined recovery can be prohibited and recovery processing can be executed only when commands are received from the management device, and recovery processing can be implemented only when commands are received from the operator. As a result, it becomes possible to execute recovery processing at an appropriate time that does not interfere with system operation.

Each embodiment will be described below with reference to the drawings. Note that each embodiment described below does not limit the invention according to the claims, and not all of the elements and combinations described in the embodiments are necessarily essential to the solution of the invention. In the following description, information may be described using the expression [AAA table], but the information may be expressed in any data structure. In other words, [AAA table] can be expressed as [AAA information] to show that the information is independent of the data structure.

-First embodiment-
A first embodiment of a communication system will be described below with reference to Figures 1 to 8. First, the overall configuration of the communication system and the configurations of the devices, monitoring device, and management device that make up the communication system will be described with reference to Figure 1. Next, the tables stored in the monitoring device will be described with reference to Figures 2 and 3. After that, the flow of recovery processing performed by the monitoring device and management device will be described with reference to Figures 4 to 6, and examples of screen displays related to table input in the monitoring device, and abnormality notification output and recovery processing command input in the management device will be described with reference to Figures 7 and 8.

Figure 1 is an overall configuration diagram of a communication system. The communication system is composed of one or more devices 101 (101-a to 101-b) to be managed, monitoring devices 102 (102-a to 102-b), and a management device 103. In the following explanation, when devices 101-a to 101-b and monitoring devices 102-a to 102-b are not individually specified, the reference numbers "101" and "102" are used with the parts after "-" omitted.

The device 101 and the monitoring device 102, and the monitoring device 102 and the management device 103 are connected by either wired communication or wireless communication, or both, and the device 101 transmits log information and the like that records its own operation information to the monitoring device 102. The monitoring device 102 then transmits the log information and the like to the management device 103, which provides a remote monitoring service for the device 101. Similarly, when remotely controlling the device 101 from the management device 103, the management device 103 transmits a control command to the device 101 via the monitoring device 102, thereby achieving remote control.

The monitoring device 102 not only relays communications between the equipment 101 and the management device 103, but also monitors and detects abnormalities that occur in the equipment 101. When an abnormality is detected, it sends an abnormality notification to the management device 103, and executes recovery processing for the detected abnormality, either automatically at the discretion of the monitoring device 102, or based on a command received from the management device 103. The management device 103 allows an operator to view and judge the abnormality notification sent by the monitoring device 102, and then appropriately sends a recovery processing command to the monitoring device 102, thereby achieving recovery from the abnormality.

The management device 103 may be installed in the same room or on the same site as the devices 101 and monitoring device 102, or may be installed at a different location, such as on the cloud. In addition, while FIG. 1 illustrates a configuration in which one device 101 is connected to one monitoring device 102, multiple devices 101 may be connected to one monitoring device 102, or one device 101 may be connected to multiple monitoring devices 102.

The hardware configuration of the device 101 will be described. The device 101 is a hardware device that operates at a site such as a factory, and has a communication function with the monitoring device 102. The device 101 stores data acquired from the site, such as video data and temperature data, and its own log information, in packets and transmits them to the monitoring device 102. The device 101 has various configurations depending on the data it acquires and its role. For example, the device 101 may be a surveillance camera that monitors on-site video, or an air compressor that compresses gas at the site. The device 101 may be an independent device, or a relatively small device that is incorporated into another device. In addition, as described above, the device 101 has various configurations depending on the type of on-site data it acquires, and may be configured to include, for example, a camera module, a temperature sensor, or an acceleration sensor.

The device 101 includes a communication I/F 111, which is an interface for communication (hereinafter, referred to as "I/F"), a CPU 112, an input unit 113, an output unit 114, and a storage device 115. When the communication I/F 111 transmits and receives packets to and from the monitoring device 102 via wireless communication, for example, the communication I/F 111 includes a transmitting unit that converts digital signals to wireless signals and vice versa, converts the generated digital data into wireless signals, and transmits the wireless signals, and a receiving unit that extracts digital data from the received wireless signals. The communication I/F 111 can use any communication means such as wireless communication such as 4G or 5G, IEEE 802.3, wireless LAN, or optical line, and the device 101 may further include multiple communication I/Fs 111 depending on the application. For example, the device 101 may have multiple communication I/Fs 111 in preparation for communication disconnection. The CPU 112 executes various computer programs stored in the storage device 115, thereby realizing various functions of the device 101.

The input unit 113 is composed of, for example, a keyboard, a mouse, or a touch sensor. The input unit 113 is used by the worker to input various operations and settings. The output unit 114 is composed of, for example, a liquid crystal display. The output unit 114 is used to display a setting screen and the results of various processes and present them to the worker. However, when receiving input information from an external device or providing output information to an external device via the communication I/F 111, such as in a form of remote login to the device 101 from another external device, the device 101 does not need to have the input unit 113 and the output unit 114. The input unit 113 and the output unit 114 may also be configured as one unit. The storage device 115 includes, for example, a read-only semiconductor memory or a rewritable semiconductor memory element. The storage device 115 stores computer programs that realize various processes, acquired data, and the like.

The application program 116 issues instructions to acquire data and determines the timing of transmission. The application program 116 instructs the CPU 112 connected via the internal bus to acquire data, and instructs the communication processing unit 117 to transmit the acquired data at a predetermined timing. For example, the acquisition method of log information to be transmitted to the monitoring device 102 and the transmission schedule of the log information are also managed by the application program 116. The application program 116 can function as a log information management unit that collects log information and transmits the log information to the monitoring device 102 at a predetermined timing. The communication processing unit 117 realizes the transmission and reception processing with the monitoring device 102. Specifically, the communication processing unit 117 performs packet assembly processing when transmitting, and packet analysis processing, including determining whether a packet is addressed to the device itself when receiving.

The hardware configuration of the monitoring device 102 will be described. The monitoring device 102 transmits data and log information acquired from the connected device 101 to the management device 103. The monitoring device 102 also monitors the presence or absence of abnormalities in the device 101, and executes recovery processing triggered by its own judgment or an instruction from the management device 103. The monitoring device 102 has a communication function with the device 101 and the management device 103. Note that the monitoring device 102 may be an independent device, or may be a relatively small device incorporated into another device. When acquiring on-site data, the monitoring device 102 may also be configured to include a camera module, a temperature sensor, an acceleration sensor, etc.

The monitoring device 102 includes a communication I/F 121, a CPU 122, an input unit 123, an output unit 124, a storage device 125, and a communication processing unit 127, and each component has the same configuration and function as the component with the same name in the device 101. When receiving input information from an external device or providing output information to an external device via the communication I/F 121, the monitoring device 102 does not need to include the input unit 123 or the output unit 124.

The application program 126 processes data collected from the device 101 and adjusts the transmission timing. The application program 126 instructs the CPU 122 connected via the internal bus to process the data, and instructs the communication processing unit 127 to transmit the data. Note that in cases where the data and log information received from the device 101 are transferred immediately to the management device 103 without processing, the monitoring device 102 does not need to have the application program 126.

The abnormality detection unit 128 diagnoses the device 101 and detects abnormalities. The abnormality detection unit 128 detects abnormalities using a method preset in the abnormality definition table 132, such as sending a live/dead confirmation packet to the device 101 or judging an input signal from the device 101. The abnormality notification unit 129 notifies the management device 103 of the abnormality detected by the abnormality detection unit 128 as an abnormality notification. Specifically, the abnormality notification unit 129 outputs the notification content to the communication processing unit 127 and executes the transmission process.

The recovery process determination unit 130 determines whether recovery processing for an abnormality detected by the abnormality detection unit 128 can be automatically executed at the discretion of the device itself, i.e., whether self-determined recovery is possible. Specifically, the recovery process determination unit 130 determines whether the recovery processing is to be performed at the discretion of the device itself, i.e., the monitoring device 102, without waiting for an instruction from the management device 103, or whether recovery is to be performed based on an instruction from the management device 103. However, the possibility of self-determined recovery does not refer to the difficulty of self-determined recovery due to physical constraints or technical problems, but rather to a determination of whether self-determined recovery is permitted in a pre-determined situation setting. Details of this determination will be described later in FIG. 6.

In this embodiment, the recovery that executes recovery processing instructed by the management device 103, which is the counterpart concept of self-determined recovery, is called "command-received recovery." In this embodiment, when an abnormality occurs in the device 101, the monitoring device 102 performs either self-determined recovery or command-received recovery. If self-determined recovery is permitted, the monitoring device 102 performs self-determined recovery, and if self-determined recovery is not permitted, in other words if self-determined recovery is prohibited, the monitoring device 102 performs command-received recovery.

When the recovery process determination unit 130 determines that self-determined repair is permitted, it refers to the recovery process table 133 to identify a specific recovery method, and outputs the recovery method to the recovery process execution unit 131. When the recovery process determination unit 130 determines that self-determined repair is not permitted, it outputs an instruction to the recovery process execution unit 131 to perform recovery using a method instructed by the management device 103. The recovery process execution unit 131 executes recovery processing based on an instruction from the recovery process determination unit 130 or a recovery processing instruction received from the management device 103. By executing the recovery processing, recovery of the device 101 in which the abnormality occurred is realized.

The abnormality definition table 132 stores the abnormality detection conditions for each type of abnormality, and the contents of the message to be sent to the management device when an abnormality is detected. The recovery process table 133 stores the recovery process for each type of abnormality, and whether the recovery process can be automatically executed as determined by the monitoring device 102. Specific examples of the abnormality definition table 132 and the recovery process table 133 will be described later with reference to Figures 2 and 3. The storage device management unit 134 creates or updates the abnormality definition table 132 and the recovery process table 133 based on input from the input unit 123 by the operator.

The hardware configuration of the management device 103 will be described. The management device 103 consolidates data and log information collected from the devices 101 via the monitoring device 102. The management device 103 transmits a recovery processing command to the monitoring device 102 based on an abnormality notification transmitted from the monitoring device 102. The management device 103 has a communication function with the monitoring device 102.

The management device 103 comprises a communication I/F 141, a CPU 142, an input unit 143, an output unit 144, a storage device 145, and a communication processing unit 147. Each component has the same configuration and function as the component with the same name in the device 101 or the monitoring device 102. The management device 103 does not need to comprise the input unit 143 and the output unit 144 when accepting input information from an external device or providing output information to an external device via the communication I/F 141.

The application program 146 provides the user with services that utilize data and log information collected from the equipment 101 via the monitoring device 102. For example, the application program 146 is a program that provides the average value per unit time of the field data (temperature, etc.) received from the equipment 101, and performs data analysis processing, such as calculating the average value from the collected data values. The application program 146 may also be a program that remotely sets the transmission schedule for data and log information in the equipment 101 and the monitoring device 102.

The abnormality notification management unit 148 records the abnormality notification received from the monitoring device 102, and outputs the notification information via the output unit 144 to present it to the worker. Specifically, based on a notification from the communication processing unit 147 that has confirmed receipt of the abnormality notification, a screen display example described later in FIG. 8 is output via the output unit 144. The recovery process command unit 149 transmits a command to execute recovery processing to the monitoring device 102 based on an operation by the worker. Specifically, in a screen display example described later in FIG. 8, a recovery process command is received from the worker via the input unit 143, and the recovery process command unit 149 outputs the command content to the communication processing unit 147.

The functions of the management device 103 may be shared and realized by multiple hardware devices. In other words, the provision of services using received data and the management of abnormality notifications and recovery processing commands may be realized separately by different hardware devices. Therefore, it is not necessary for a single management device 103 to include all of the configuration shown in FIG. 1.

Figure 2 is a diagram showing an example of anomaly definition table 132. Anomaly definition table 132 includes multiple records, and each record has fields for an event ID 201, anomaly detection condition 202, and a notification message 203. Event ID 201 is an identifier that distinguishes anomaly types. In the example of Figure 2, a notation that prioritizes readability, such as "LAN-Disconn", is used for event ID 201, but consecutive numbers such as "event01, event02, ..." may also be used.

The abnormality detection condition 202 is a condition for determining that each abnormality has occurred. When the abnormality detection condition 202 is met, the abnormality detection unit 128 determines that an abnormality of the event ID 201 has occurred. The format of the abnormality detection condition 202 is arbitrary. In the example of FIG. 2, for convenience of explanation, it is described in a sentence such as "No response three consecutive times in LAN communication with the monitored device", but the abnormality detection condition 202 may be defined by separating it into items such as "monitoring information", "comparison condition", and "threshold", and dividing it into multiple items such as "monitoring information: number of consecutive response losses in LAN communication with the monitored device", "comparison condition: ≧", and "threshold: 3". Also, FIG. 2 shows an example of detecting an abnormality based on the presence or absence of a response to a transmitted packet and the input signal value from the device 101, but as described above, the method of detecting an abnormality is arbitrary. For example, if the device 101 itself has a function of performing abnormality diagnosis of its own device and notifying an abnormality such as an increase in CPU usage rate, the reception of the notification may be specified as the abnormality detection condition, as illustrated in FIG. 2.

The notification message 203 is the message content to be sent to the management device 103 when an abnormality specified in the event ID 201 is detected. The abnormality notification containing this message content is intended to notify the occurrence of an abnormality in the device 101 and to enable the management device 103 to identify the content of the abnormality that has occurred. The format of the message content is arbitrary as long as the content achieves this purpose. Note that in the example of FIG. 2, the prefix "[Self Recovery]" is added to the message content for abnormality types for which automatic execution of recovery processing by the monitoring device 102 is permitted in the recovery processing table 133 described later in FIG. 3.

When an abnormality notification with the prefix is received, the management device 103 and the operator can determine that the recovery process is automatically executed by the monitoring device 102 and therefore it is not necessary to issue a recovery process command, and can avoid issuing redundant recovery process commands. In this way, in addition to notifying the abnormality type, any additional information may be added to the notification message 203. On the other hand, if there is an abnormality that does not require notification to the management device 103, the notification message 203 for that abnormality type may be set to blank. In addition to the fields exemplified in FIG. 2, any field may be added to the abnormality definition table 132. For example, if multiple devices 101 are connected to the monitoring device 102, a "device ID" field may be added to enable definition of the identifier of the device 101 that is the target of the abnormality detection condition 202.

Figure 3 is a diagram showing an example of the recovery process table 133. The recovery process table 133 has multiple records, and each record has fields for an event ID 301, first recovery process content 302, first timer 303, second recovery process content 304, second timer 305, and self-determined recovery feasibility 306. The "-" in Figure 3 means that no data exists.

The event ID 301 is an identifier for distinguishing the type of anomaly, and is the same as the event ID 201 in the anomaly definition table 132. The first recovery process content 302 and the second recovery process content 304 are the contents of the recovery process to be taken when the anomaly described in the event ID 301 is detected. The format of the recovery process content is arbitrary. In the example of FIG. 3, for convenience of explanation, it is described in a sentence such as "restart the communication I/F of the monitored device", but for example, a command to realize the recovery process may be described, or a script file that provides the recovery process may be prepared in advance and the script file name may be described. In addition, the recovery process content is also exemplified in FIG. 3 as a restart process for the device 101 and a change in setting value, but is not limited to a specific process. In addition, if there are multiple communication means between the device 101 and the monitoring device 102, a field may be added that explicitly specifies which means to use to take the recovery process.

The first timer 303 and the second timer 305 are the waiting time until the recovery process contents specified in the first recovery process contents 302 and the second recovery process contents 304 are executed. For example, if a problem occurs when the recovery process is executed immediately after the detection of an abnormality, the problem can be avoided by setting the timer value. In the example of FIG. 3, the timer is specified in "seconds", but the unit of specification is arbitrary. Also, instead of specifying the timer value, a time period during which the recovery process is permitted or prohibited may be specified. In the example of FIG. 3, a maximum of two combinations of recovery process contents and timer values can be registered. For example, for the abnormality "CPU-HighUsage (CPU usage abnormality)", after changing the settings to suppress the CPU usage, it is possible to perform a restart process to reflect the setting change. However, it is not essential to support multiple registrations of recovery process contents and timer values, and the number of items that can be registered can be changed arbitrarily.

Self-determined recovery possibility 306 indicates whether or not the monitoring device 102 may automatically execute the recovery process based on the above-mentioned recovery process content and timer value when the abnormality described in event ID 301 is detected, without waiting for a recovery process command to be received from the management device 103. In the example of FIG. 3, "OK" indicates that self-determined recovery is permitted, and "NG" indicates that self-determined recovery is prohibited. The format is arbitrary, and may be expressed, for example, as "True/False". It can also be said that "OK" in self-determined recovery possibility 306 indicates self-determined recovery, and "NG" indicates instruction-received recovery.

For an abnormality for which self-determined recovery is permitted, the processing described in the first recovery processing content 302 and the second recovery processing content 304 is executed after the time specified by the first timer 303 and the second timer 305 has elapsed. On the other hand, for an abnormality for which self-determined recovery is not permitted, recovery processing is not executed regardless of the above-mentioned recovery processing content or timer value, and the system waits for a recovery processing command from the management device 103.

For example, as shown in FIG. 3, for an abnormality with a high degree of urgency, such as a loss of communication with the device 101 (e.g., "LAN-Disconn" in FIG. 3), early recovery can be achieved by allowing the monitoring device 102 to automatically execute recovery processing. On the other hand, for an abnormality with a low degree of urgency that does not require immediate recovery, such as a case in which an input signal value different from that expected has begun to be observed from the device 101 (e.g., "DI-3timesLow" in FIG. 3), or for a precursor phenomenon in which the occurrence of an abnormality cannot be immediately determined, self-determined recovery can be prohibited and the decision to execute recovery processing can be left to the management device 103 and the operator, making it possible to implement recovery processing at an appropriate time.

When an input signal value different from the expected value continues to be observed, such as the event ID "DI-5timesLow" in FIG. 3, it is also possible to set the event ID to allow automatic execution of recovery processing at the discretion of the monitoring device 102 when it is determined to be an obvious abnormality. In the example of FIG. 3, recovery processing content and timer values are set even for event IDs that prohibit execution of recovery processing at the discretion of the monitoring device 102 (e.g., "DI-3timesLow" in FIG. 3), but values do not need to be set. Furthermore, the field for self-determined recovery possibility 306 may be omitted, and only event IDs that allow self-determined recovery may be described in the recovery processing table 133. In this case, it is determined that automatic execution of recovery processing at the discretion of the monitoring device 102 is prohibited for abnormalities with event IDs that are not listed in the recovery processing table 133. In addition, any field may be added to the recovery processing table 133 in addition to the fields exemplified in FIG. 3. For example, if multiple devices 101 are connected to the monitoring device 102, a "Device ID" field may be added to allow the identifier of the device 101 to be the target of the recovery process to be defined.

Figures 4 and 5 are time charts showing the recovery process. Figure 4 is a time chart when self-determined recovery is permitted, and Figure 5 is a time chart when self-determined recovery is prohibited. In Figures 4 and 5, time passes from the top to the bottom of the illustration. The final stages of the process are different between Figures 4 and 5, but the processes up to the middle are the same.

In steps S401a and S401b in FIG. 4, the abnormality detection unit 128 of the monitoring device 102 diagnoses whether or not there is an abnormality in the device 101. The abnormality detection unit 128 refers to the abnormality definition table 132 and diagnoses whether or not there is an abnormality based on the detection conditions described in the abnormality detection conditions 202 in the table. For example, in the diagnosis process for "LAN-Disconn" illustrated in FIG. 2, a live/dead confirmation packet is sent to the device 101 via LAN communication to determine whether or not there is a response. Note that the timing of the execution of the abnormality diagnosis process by the abnormality detection unit 128 in steps S401a and S401b is managed by the abnormality detection unit 128, and is executed at time intervals of a predetermined abnormality diagnosis period Δt, as illustrated in FIG. 4. In addition to this, the abnormality diagnosis process may be executed at any arbitrary timing, such as at a specified time every day.

If one or more of the abnormality detection conditions defined in the abnormality definition table 132 are met in the abnormality diagnosis process, the process proceeds to step S402. On the other hand, if all of the abnormality detection conditions are not met, the process waits until the timing for executing the next abnormality diagnosis process. In step S402, the abnormality detection unit 128 of the monitoring device 102 detects the occurrence of an abnormality in the device 101. In other words, in step S402, the type of abnormality is identified. The abnormality detection unit 128 refers to the abnormality definition table 132, obtains the event ID 201 corresponding to the abnormality detection condition 202 that was met in the abnormality diagnosis process described above, and detects the occurrence of an abnormality for that event ID. The abnormality detection unit 128 then notifies the abnormality notification unit 129 of the event ID.

In step S403, the abnormality notification unit 129 of the monitoring device 102 transmits an abnormality notification to the management device 103 to notify the management device 103 of the occurrence of an abnormality. The abnormality notification unit 129 refers to the abnormality definition table 132 and acquires the notification message 203 corresponding to the event ID notified by the abnormality detection unit 128 in step S402. Then, it notifies the communication processing unit 127 of the message content, and transmits an abnormality notification packet storing the message content to the management device 103. For example, if an abnormality in "LAN-Disconn" as shown in FIG. 2 is detected, it transmits an abnormality notification packet storing the message "[Self Recovery] LAN-Disconn" to the management device 103. When the transmission is completed, the monitoring device 102 proceeds to step S404.

On the other hand, when the management device 103 receives the abnormality notification, the communication processing unit 147 analyzes the packet, and if it confirms that the contents of the packet are an abnormality notification, it notifies the abnormality notification management unit 148. After that, the management device 103 proceeds to step S405. The processing of step S405 will be described later.

Step S404 is a process in which the recovery process determination unit 130 of the monitoring device 102 determines whether recovery process for the abnormality that occurred in the device 101 should be automatically executed at the discretion of the monitoring device itself, or whether it should wait for a recovery process command from the management device 103 before executing the process. Specifically, the recovery process determination unit 130 refers to the recovery process table 133 and determines whether self-determined recovery is possible or not based on the setting value of self-determined recovery possibility 306 for the event ID detected in step S402. Details of the recovery process determination will be described later with reference to FIG. 6. In FIG. 4, it is determined that self-determined recovery is possible, and the process proceeds to step S406. In FIG. 5, which will be described later, a case in which it is determined that self-determined recovery is impossible will be described.

In step S405, the management device 103 that received the abnormality notification sent in step S403 records the abnormality notification in the abnormality notification management unit 148 and outputs the notification information via the output unit 144. The abnormality notification management unit 148 may display the contents of the received abnormality notification as is, or may determine whether it is self-determined recovery or instruction-received recovery, and may change the screen display based on the determination result. An example of the screen display to be output will be described later in FIG. 8. When the output process is completed, the management device 103 waits for the receipt of a recovery processing command by the operator via the input unit 143. As described above, by including a character string indicating that self-determined recovery is permitted, such as [Self Recovery], in the abnormality notification, it is possible to prevent the operator from issuing redundant recovery processing commands.

In step S406, the recovery process execution unit 131 executes recovery process at the discretion of the monitoring device 102. Specifically, the recovery process table 133 is referenced, and recovery process is executed based on the first recovery process content 302 and second recovery process content 304 for the event ID detected in step S402, and the settings of the first timer 303 and second timer 305. For example, when an abnormality is detected in "LAN-Disconn" in FIG. 3 and recovery process is executed for this abnormality, "restart communication I/F of monitored device" is executed without waiting time. In this way, early recovery can be achieved by the monitoring device 102 detecting an abnormality that has occurred in the device 101 and automatically executing recovery process at the discretion of the monitoring device 102.

With reference to FIG. 5, a time chart in the case where self-determined recovery is not permitted will be described. In FIG. 5, steps S401a, S401b, S402, S403, S404, and S405 are the same as those in FIG. 4, and therefore will not be described. In step S501, the management device 103 accepts the issuance of a recovery processing command to the monitoring device 102 based on the operation of the operator via the input unit 143. When the operator determines that a recovery processing command is necessary in response to the abnormality notification output in step S405, the operator issues a recovery processing command to the monitoring device 102 via the input unit 143. In step S501, the management device 103 accepts the issuance, and when the operator issues a recovery processing command, the command content is linked from the input unit 143 to the recovery processing command unit 149, and the management device 103 proceeds to the processing of step S502. An example of a screen display for the operator to input and issue a recovery processing command will be described later in FIG. 8.

In step S502, the recovery process command unit 149 of the management device 103 transmits a recovery process command to the monitoring device 102. Specifically, the contents of the recovery process command received in step S501 are notified to the communication processing unit 147, and a recovery process command packet storing the command contents is transmitted to the monitoring device 102. Note that the recovery process command packet transmitted to the monitoring device 102 contains, for example, the recovery process contents and timer value to be executed by the monitoring device 102, i.e., information equivalent to the recovery process contents and timer value stored in the recovery process table 133 in FIG. 3.

However, storing this information is not essential. For example, as shown in FIG. 3, if recovery process contents and timer values are defined for an event for which the monitoring device 102 judges that recovery process execution is prohibited (e.g., "DI-3timesLow" in FIG. 3), it is possible to omit specifying this information and instead notify only the event ID for which abnormality (event ID) recovery process is to be commanded. Also, information other than the recovery process contents and timer value may be stored in the recovery process command packet as necessary.

On the other hand, when the monitoring device 102 receives the recovery processing command, the communication processing unit 127 analyzes the packet, and if it confirms that the contents of the packet are a recovery processing command, it notifies the recovery processing execution unit 131. The monitoring device 102 then proceeds to step S503. In step S503, the monitoring device 102, which has received the recovery processing command in step S502, executes recovery processing in the recovery processing execution unit 131 based on the command from the management device 103. Specifically, the recovery processing is executed based on the recovery processing content and timer value specified by the management device 103. As in the example described above, if an event ID is stored in the recovery processing command packet and notified, the recovery processing table 133 in FIG. 3 is referenced, and the recovery processing corresponding to the event ID is executed.

In this way, recovery processing is not performed at the discretion of the monitoring device 102, but is performed based on a recovery processing command from the management device 103, so that only recovery processing that the operator judges necessary can be performed. In particular, if there is a time period during which the execution of recovery processing would have a negative impact on the operation of the system, the operator can wait until the appropriate time to issue a recovery processing command, allowing efficient recovery processing without disrupting the operation of the system.

Figure 6 is a flowchart showing the processing of the recovery processing determination unit 130. Specifically, the processing shown in Figure 6 corresponds to the processing executed in step S404 in Figures 4 and 5. In this processing, the monitoring device 102 determines whether or not self-determined recovery is possible for an abnormality detected by the abnormality detection unit 128.

First, in step S601, the recovery process determination unit 130 identifies a corresponding record in the recovery process table 133. Specifically, the recovery process determination unit 130 identifies a record in the recovery process table 133 that contains the anomaly type (event ID) detected by the anomaly detection unit 128 in step S402 of FIG. 4 or FIG. 5. In the following step S602, the recovery process determination unit 130 determines whether or not self-determined recovery is possible. Specifically, if the field value of the self-determined recovery possibility 306 of the record identified in step S601 is "OK", that is, if self-determined recovery is permitted, the recovery process determination unit 130 proceeds to step S603. On the other hand, if the field value of the self-determined recovery possibility 306 is "NG", that is, if self-determined recovery is prohibited, the recovery process determination unit 130 proceeds to step S604.

In step S603, the recovery process determination unit 130 reads the recovery process content for the detected abnormality from the recovery process table 133, has the recovery process execution unit 131 execute the recovery process content, and ends the process shown in FIG. 6. Specifically, the recovery process determination unit 130 reads the first recovery process content 302, first timer 303, second recovery process content 304, and second timer 305 of the record in the recovery process table 133 that contains the abnormality type (event ID) detected by the abnormality detection unit 128, and has the recovery process execution unit 131 execute them.

In step S604, the recovery process determination unit 130 instructs the recovery process execution unit 131 to execute the command from the management device 103, and ends the process shown in FIG. 6. In this case, the management device 103 sends a recovery process command in step S502 in FIG. 5, and when the monitoring device 102 receives the command, it executes recovery process in step S503 in FIG. 5. Note that when waiting to receive a recovery process command from the management device 103, a timeout value may be explicitly set. If a recovery process command is received outside the timeout period, the command may be discarded, i.e., invalidated.

By performing the process shown in FIG. 6 with the recovery process determination unit 130, the monitoring device 102 can flexibly choose between automatically executing recovery processes determined by the device itself and executing recovery processes based on commands from the management device 103 according to the type of abnormality, based on the entries in the recovery process table 133.

Figure 7 is a diagram showing an example of a screen display for registering the abnormality definition table 132 and the recovery process table 133. The storage device management unit 134 creates or updates the abnormality definition table 132 and the recovery process table 133, for example, based on input by an operator to the screen shown in Figure 7. The display screen 700 shown in Figure 7 may be displayed on the output unit 124 of the monitoring device 102, or may be displayed on an external device via the communication I/F 121. The display screen 700 has a first display area 701 for setting the abnormality definition table 132, and a second display area 702 for setting the recovery process table 133.

When an operator inputs various information such as anomaly detection conditions and notification message contents for each anomaly type (event ID) from the input unit 123 in the first display area 701, the input values are set in the anomaly definition table 132. Note that it is also possible that event IDs are added as needed during the operation of the system. Therefore, in the example of FIG. 7, a first addition button 703 is provided for adding an input field (row) for the event ID. When an operator presses the first addition button 703, a new input field with each value left blank is added.

In the second display area 702, when the worker inputs various information such as the recovery process content, timer value, and whether or not self-determined recovery is possible for each abnormality type (event ID) from the input unit 123, the input value is set in the recovery process table 133. A second addition button 704 is provided in the second display area 702, and when the worker presses the second addition button 704, a new input field with each value left blank is added.

In addition, various table information can be managed not only on the display screen 700 of FIG. 7, but also in other external files using import and export functions. Therefore, the example screen display of FIG. 7 also has a file input button 706 and a file output button 705. When the worker presses the file input button 706 via the input unit 123, various table values stored in another external file are read onto the display screen 700 of FIG. 7. When the worker presses the file output button 705, the table values entered on the display screen 700 of FIG. 7 are output to the external file. This makes it easy to realize linkage with external files in which table values are stored. However, the inclusion of this function is optional.

By displaying a setting screen for various table information as shown in Figure 7, the operator can easily register various table values or make changes during the process. Note that the example screen display in Figure 7 shows examples of a format in which table values are directly entered, and a format in which values are selected or set using a pull-down menu, but the display format for accepting settings is arbitrary.

8 is a diagram showing an example of a screen display in which the management device 103 outputs an abnormality notification in step S405 in FIG. 4 and FIG. 5, and an example of a screen display for receiving a recovery processing command from an operator in step S501 in FIG. 5. The display screen 800 is displayed on the output unit 144. The display screen 800 has a third display area 801 for outputting an abnormality notification received from the monitoring device 102, and a fourth display area 802 for receiving the issuance of a recovery processing command. The abnormality notification management unit 148 may display the fourth display area 802 on the output unit 144 only when it determines that the instruction reception is restored based on the contents of the received abnormality notification. For example, when the received message does not include [Self Recovery], the abnormality notification management unit 148 determines that the instruction reception is restored and displays the fourth display area 802 on the output unit 144. In this case, if a recovery instruction is not required, the fourth display area 802 is not displayed, so the operator does not need to determine whether an instruction is required.

The third display area 801 displays the sender of the abnormality notification (monitoring device ID), notification message, and last notification time (i.e., the last time the abnormality notification was received) for the abnormality notification received from the monitoring device 102. This display allows the operator to easily know which monitoring device 102 detected what abnormality, and when. Furthermore, as described above, by adding a prefix such as "[Self Recovery]" to the message content stored in the abnormality notification to indicate automatic execution of recovery processing by the monitoring device 102, the operator can determine whether or not to issue a recovery processing command.

Note that other arbitrary information may be output in the third display area 801 as necessary. For example, not only the sender of the abnormality notification (monitoring device ID), but also the identifier of the device 101 connected to the monitoring device 102 may be output. Also, instead of the table format as in FIG. 8, a screen display that outputs in text format, for example, may be used, and the display format is not limited to a specific method. Note that in the example of FIG. 8, the monitoring device IDs of the monitoring devices 102-a and 102-b are expressed as "monitoring device a, monitoring device b", but the monitoring device IDs may be substituted with arbitrary host names, IP addresses, etc.

The operator inputs a recovery processing command to be issued to the monitoring device 102 in the fourth display area 802. Specifically, the operator inputs the destination (monitoring device ID) of the recovery processing command, the recovery processing content to be commanded, and the timer value until the recovery processing is executed. Then, when the operator presses (or clicks) the command issue button 803 from the input unit 143, this input information is accepted by the management device 103 in step S501 of FIG. 5, and the recovery processing command is then sent in the subsequent step S502.

As described above, in the recovery process table 133 of the monitoring device 102, if recovery process content and timer values are set for an abnormality that prohibits automatic execution of recovery process at the device's own discretion, such as "DI-3timesLow" in FIG. 3, the following change may be made. That is, instead of inputting recovery process content and timer values in the fourth display area 802, the operator may input an event ID indicating which abnormality (event ID) recovery process is to be ordered for.

By providing a display screen such as that shown in FIG. 8, an operator can view anomalies detected by the monitoring device 102 and can issue a recovery processing command for the anomaly at any time. The recovery processing command is issued when the operator presses the command issue button 803, so the operator can flexibly control the timing of the recovery processing, for example, by waiting until a time period that will not interfere with the operation of the system when issuing the command.

According to the above-described first embodiment, the following advantageous effects can be obtained.
(1) The monitoring device 102 monitors one or more devices 101 to be monitored. The monitoring device 102 includes an abnormality detection unit 128 that detects an abnormality occurring in the device 101, an abnormality notification unit 129 that outputs the detected abnormality as an abnormality notification to the outside, a recovery process determination unit 130 that determines the recovery type, which is a type of recovery, to either a self-determined recovery in which the monitoring device determines the content of the recovery process for the device 101, or an instruction-received recovery determined by an outside of the monitoring device, depending on the abnormality type, and a recovery process execution unit 131 that executes the recovery process of the device 101 based on the recovery type determined by the recovery process determination unit 130. Therefore, the subject that determines the content of the recovery process can be changed depending on the type of abnormality occurring in the device 101. Specifically, depending on the type of abnormality occurring in the device 101, automatic execution of the recovery process by the monitoring device 102 and execution of the recovery process based on an instruction from the management device 103 can be flexibly used.

(2) The monitoring device 102 includes a storage device 125 that stores anomaly definitions that define each anomaly type, self-determined recovery possibility 306 that indicates whether each anomaly type is a self-determined recovery or an instruction-received recovery, and first recovery process content 302 and second recovery process content 304 that are the contents of the recovery process for each anomaly type that is a self-determined recovery.

(3) The storage device 125 stores a notification message 203, which is the content of the abnormality notification for each abnormality type, and a timer, which is the time until recovery processing is performed for each abnormality type, i.e., a first timer 303 and a second timer 305.

(4) The monitoring device 102 includes a storage device management unit 134 that records at least one of the following in the storage device 125 based on an external input: anomaly definition, self-determined recovery possibility, recovery process content, content of anomaly notification for each anomaly type, and a timer. Therefore, the data stored in the storage device 125 can be updated after the fact.

(5) When the recovery process determination unit 130 decides to perform recovery upon receiving an instruction, the recovery process execution unit 131 of the monitoring device 102 waits until the recovery process content of the device 101 is instructed from the outside, and immediately executes the recovery process content of the device 101 when the recovery process content of the device 101 is instructed from the outside. Therefore, the management device 103, which is an external device, can freely set the timing of the recovery process of the device 101. For example, an operator of the management device 103 can efficiently execute the recovery process by immediately instructing the recovery process content for a high-urgency abnormality to achieve early recovery, and by waiting until a timing that does not interfere with the operation of the system for a low-urgency abnormality.

(6) The management device 103 includes an abnormality notification management unit 148 that receives abnormality notifications output by the monitoring device 102, and a recovery process command unit 149 that outputs to the monitoring device 102 the contents of the recovery process determined based on the abnormality notification.

(7) The management device 103 has an output unit 144 that presents information to the user. The abnormality notification management unit 148 outputs the abnormality notification received from the monitoring device 102 to the output unit 144. The management device 103 has an input unit 143 that accepts the contents of the recovery process for the monitoring device 102 from the user. The recovery process command unit 149 outputs the contents of the recovery process input to the input unit 143 to the monitoring device 102 via the communication processing unit 147.

(Variation 1)
In the first embodiment described above, it is assumed that an operator operates the system, but the system may be configured so that an operator is not required. That is, in this embodiment, an abnormality notification is output to the operator as shown in Fig. 8, and a recovery processing command is received from the operator via the input unit 143 in step S501 in Fig. 5. However, the management device 103 may automatically send the recovery processing command without requiring an operator to operate the system.

For example, this can be achieved by predefining in the abnormality notification management unit 148 of the management device 103 an abnormality notification that permits automatic return of a recovery processing command, and a recovery processing command (recovery processing content and timer value) for the abnormality notification. In this case, the content of the recovery processing command may be linked from the abnormality notification management unit 148 to the recovery processing command unit 149 at the timing when the abnormality notification is received, and the recovery processing command may be automatically sent without waiting for an operator's operation. According to this modified example, while realizing early recovery equivalent to the self-determined recovery by the monitoring device 102, the recovery processing command history, in other words the content and execution time of the recovery processing, can also be left as management information in the management device 103.

(Variation 2)
The abnormality definition table 132 and the recovery process table 133 stored in the storage device 125 of the monitoring device 102 may be configured as an integrated unit. Also, there may be only one recovery process content, and a timer need not be set. Furthermore, the abnormality notification sent by the monitoring device 102 to the management device 103 may be, for example, the event ID itself, and the notification message 203 need not be included in the abnormality definition table 132. According to this modification, the storage capacity required for managing the abnormality definition table 132 and the recovery process table 133 can be reduced.

--Second embodiment--
A second embodiment of the communication system will be described with reference to Figures 9 to 11. In the following description, the same components as in the first embodiment are denoted by the same reference numerals, and differences will be mainly described. Points that are not particularly described are the same as in the first embodiment. This embodiment differs from the first embodiment mainly in that the execution of recovery processing for an abnormality that has occurred can be dynamically switched from automatic execution based on the judgment of the monitoring device 102 to execution based on an instruction from the management device 103.

In the first embodiment described above, an example is given of a form in which the automatic execution of recovery processing by the monitoring device 102 and the execution of recovery processing based on an instruction from the management device 103 are statically used depending on the type of abnormality. However, if the recovery processing executed by the monitoring device 102 in the self-determined recovery for the abnormality that has occurred is not appropriate, the device 101 may not be able to recover from the abnormality, and the monitoring device 102 may repeat the detection of the abnormality and the automatic execution of the recovery processing. For example, if the communication disconnection with the device 101 (e.g., "LAN-Disconn" in FIG. 3) is detected and the monitoring device 102 executes the recovery processing of "restarting the communication I/F of the monitored device", but the communication disconnection with the device 101 is not resolved and the same abnormality continues to be detected, the possibility of recovery is low even if the monitoring device 102 executes the same recovery processing again. In such a case, it is desirable to stop the automatic execution of the recovery processing by the monitoring device 102 and dynamically switch to execute another recovery processing based on an instruction from the management device 103, i.e., the judgment of the operator.

The configurations and functions of the management device 103 and the device 101 in the second embodiment are the same as those in the first embodiment. The hardware configuration of the monitoring device 102 is the same as that in the first embodiment. The monitoring device 102 differs from the first embodiment in the configurations of the anomaly definition table 132 and the recovery process table 133. The processing of the recovery process determination unit 130 also differs from that in the first embodiment. The operations of the application program 126, the communication processing unit 127, the anomaly detection unit 128, the anomaly notification unit 129, the recovery process execution unit 131, and the storage device management unit 134 are the same as those in the first embodiment.

Figure 9 is a diagram showing an example of anomaly definition table 132 in the second embodiment. Event ID 901, anomaly detection condition 902, and first notification message 903 in Figure 9 are similar to event ID 201, anomaly detection condition 202, and notification message 203 in anomaly definition table 132 in Figure 2 in the first embodiment, so their description will be omitted. Second notification message 904 is a message sent to management device 103 when an anomaly specified by event ID 901 is detected and meets the conditions described in message switching condition 905 described below. Hereinafter, second notification message 904 is also referred to as "changed notification content".

The message switching condition 905 is a condition for switching the message content notified to the management device 103 from the first notification message 903 to the second notification message 904 when an abnormality is detected. While this condition is met, when an abnormality specified by the event ID 901 is detected, the message content described in the second notification message 904 is notified to the management device 103. Hereinafter, the message switching condition 905 is also referred to as the "fourth change condition."

In the example shown in FIG. 9, if a communication disconnection with the device 101 ("LAN-Disconn" in FIG. 9) is detected three or more times within one hour, the abnormality notification unit 129 of the monitoring device 102 changes the content of the message notified to the management device 103 from "[Self Recovery] LAN-Disconn" to "LAN-Disconn." In the example of the recovery process table 133 in FIG. 10 described below, if a communication disconnection with the device 101 is detected three or more times within one hour, the monitoring device 102 disables (prohibits) automatic execution of recovery processing at its own discretion, and changes its operation to execute recovery processing based on a command from the management server.

At this time, as shown in FIG. 9, for example, the message content to be notified to the management device 103 can be changed to delete the prefix "[Self Recovery]" and the operator can determine by viewing the screen in FIG. 8 that the automatic execution of recovery processing by the monitoring device 102 has been disabled and that a new recovery processing command needs to be issued. Note that if it is not necessary to switch the message content to be notified, the second notification message 904 may contain the same content as the first notification message 903, or may be left blank.

Figure 10 is a diagram showing an example of the recovery process table 133 in the second embodiment. The event ID 906, first recovery process content 907, first timer 908, second recovery process content 909, second timer 910, and self-determined recovery feasibility 911 in Figure 10 are similar to the event ID 301, first recovery process content 302, first timer 303, second recovery process content 304, second timer 305, and self-determined recovery feasibility 306 in the recovery process table 133 in Figure 3 in the first embodiment, so their explanation will be omitted.

The invalidation condition 912 is a condition for invalidating (prohibiting) automatic execution of recovery processing at the judgment of the monitoring device 102. While the condition is met, even if automatic execution at the judgment of the device itself is permitted in the field of self-determined recovery feasibility 911, automatic execution of recovery processing is invalidated. In the example shown in FIG. 10, when a communication disconnection with the device 101 ("LAN-Disconn" in FIG. 10) is detected three or more times within one hour, the recovery processing determination unit 130 of the monitoring device 102 invalidates automatic execution of recovery processing for the communication disconnection and determines to wait for a command from the management device 103 to execute recovery processing. Details of this process will be described later with reference to FIG. 11. Below, the invalidation condition 912 is also called the "first change condition". When the first change condition of a certain record is met, the recovery processing determination unit 130 changes the value of "OK" in the self-determined recovery feasibility 911 of that record to "NG".

In the examples of Figures 9 and 10, for convenience of explanation, the message switching condition 905 and the invalidation condition 912 are written in sentences such as "the same event is detected three times within one hour", but the format is arbitrary. In addition to specifying these conditions by detection frequency, the condition content may also be defined arbitrarily, such as by detection time or detection time period. Furthermore, the timing for returning the notification message content to the original first notification message 903 after the message switching condition 905 and the invalidation condition 912 are met, and the timing for canceling the invalidation of the execution of the recovery process determined by the own device may be set arbitrarily. For example, the invalidation may be canceled when a certain amount of time has passed after the conditions are met.

Figure 11 is a flowchart showing the processing of the recovery processing determination unit 130 in the second embodiment. Steps S601, S602, S603, and S604 in Figure 11 are the same as those in Figure 6, so their explanation will be omitted. In steps S601 to S602, the recovery processing table 133 in Figure 10 is referenced, and if "OK" is entered in the field of self-determined recovery feasibility 911 corresponding to the detected abnormality, the process proceeds to step S1001. In step S1001, the recovery processing determination unit 130 references the invalidation conditions 912 in the recovery processing table 133, and acquires the invalidation conditions for executing recovery processing at the device's own discretion.

In the next step S1002, the recovery process determination unit 130 performs a match determination for the invalidation conditions acquired in step S1001. In the example of FIG. 10, when a communication disconnection with the device 101 ("LAN-Disconn" in FIG. 10) is detected, the match determination is performed using the number of times the same event was detected within one hour. If the invalidation conditions for the detected abnormality are not registered (blank) or the invalidation conditions are not matched (YES), the process proceeds to step S603, where it is determined that the monitoring device 102 will automatically execute the recovery process. On the other hand, if the invalidation conditions are matched (NO), the value of "OK" in the self-determined recovery feasibility 911 is changed to "NG", and it is determined that the execution of the recovery process based on the judgment of the monitoring device 102 is disabled, and the process proceeds to step S604, where it instructs the recovery process execution unit 131 to execute the recovery process based on the command from the management device 103.

According to the above-described second embodiment, the following advantageous effects can be obtained.
(8) The storage device 125 stores a first change condition for changing the self-determined recovery in the self-determined recovery possibility to the instruction-received recovery for each anomaly type. When the first change condition is met, the recovery process determination unit 130 changes the self-determined recovery possibility to the instruction-received recovery. Therefore, the entity that decides the contents of the recovery process can be dynamically changed from the monitoring device 102 to the management device 103.

(9) The first change condition is the detection frequency of the same anomaly or the time of anomaly detection. Therefore, when the same anomaly is detected frequently or when an anomaly is detected during a specific time period, changing the self-determined recovery to an instruction-received recovery is expected to enable the operator to instruct a more appropriate recovery process.

(10) The storage device 125 stores a fourth change condition, which is a message switching condition 905 that is a condition for changing the content of the abnormality notification for each abnormality type, and a second notification message 904 (changed notification content) that is the content of the abnormality notification when the fourth change condition is met. When the fourth change condition is met, the abnormality notification unit 129 outputs the second notification message 904 instead of the first notification message 903. Therefore, an operator who sees the output of the output unit 144 of the management device 103 can know that self-determined recovery has been changed to instruction-received recovery.

--Third embodiment--
A third embodiment of a communication system will be described with reference to Figures 12 to 14. In the following description, the same components as in the first embodiment are given the same reference numerals, and differences will be mainly described. Points that are not particularly described are the same as in the first embodiment. This embodiment differs from the first embodiment mainly in that the execution of recovery processing can be dynamically switched from execution based on a command from the management device 103 to automatic execution based on the judgment of the monitoring device 102.

In the second embodiment described above, the execution of recovery processing for an abnormality is dynamically switched from automatic execution based on the judgment of the monitoring device 102 to execution based on the command of the management device 103. On the other hand, there are also cases where efficiency is improved by switching from recovery processing execution based on the command of the management device 103 to automatic execution based on the judgment of the monitoring device 102. For example, when an input signal different from that expected is detected from the device 101 (e.g., "DI-3timesLow" in FIG. 3), an abnormality notification is sent to the management device 103, and recovery processing is executed based on the command from the management device 103, that is, by asking for the judgment of the operator. In this case, if the recovery processing command is received with a high probability after the abnormality notification is sent, it is considered that there is little point in asking the operator for judgment every time. In such a case, the time required for recovery can be shortened by dynamically switching to self-determined recovery.

The configurations and functions of the management device 103 and the device 101 in the third embodiment are the same as those in the first embodiment. The hardware configuration of the monitoring device 102 is the same as that in the first embodiment. The monitoring device 102 differs from the first embodiment in the configurations of the anomaly definition table 132 and the recovery process table 133. The processing of the recovery process determination unit 130 also differs from that in the first embodiment. The operations of the application program 126, the communication processing unit 127, the anomaly detection unit 128, the anomaly notification unit 129, the recovery process execution unit 131, and the storage device management unit 134 are the same as those in the first embodiment.

Figure 12 is a diagram showing an example of the abnormality definition table 132 in the third embodiment. The configuration of this table is the same as that of the abnormality definition table 132 shown in Figure 9 in the second embodiment, so a description is omitted. In the example shown in Figure 12, after observing a "Low" digital input signal three consecutive times from the device 101 ("DI-3timesLow" in Figure 12), if a recovery processing command for the same event is received from the management device 103 three or more times within one day, the abnormality notification unit 129 of the monitoring device 102 changes the message content notified to the management device 103 from "DI-3timesLow" to "[Self Recovery] DI-3timesLow". In the example of the recovery processing table 133 in Figure 13 described later, when the same condition is met, the monitoring device 102 enables (permits) self-determined recovery and changes the operation so that recovery processing is performed for the abnormality without waiting for a command from the management server.

When self-determined recovery is enabled, as shown in FIG. 12, the message content notified to the management device 103 is also changed to include the prefix "[Self Recovery]". With this change, the operator can determine by viewing the screen in FIG. 8 that automatic execution of recovery processing by the monitoring device 102 has been enabled and that it is no longer necessary to issue a recovery processing command. This makes it possible to prevent redundant recovery processing commands from being issued.

Figure 13 is a diagram showing an example of the recovery process table 133 in the third embodiment. In Figure 13, the event ID 1101, the first recovery process content 1102, the first timer 1103, the second recovery process content 1104, the second timer 1105, and the self-determined recovery possibility 1106 are the same as the event ID 906, the first recovery process content 907, the first timer 908, the second recovery process content 909, the second timer 910, and the self-determined recovery possibility 911 in the recovery process table 133 shown in Figure 10 in the second embodiment, so their explanation will be omitted.

The enabling condition 1107 is a condition for enabling (allowing) self-determined recovery. While this condition is met, even if self-determined recovery is prohibited in the field of self-determined recovery enable/disable 1106, self-determined recovery is enabled. In the example of FIG. 13, if a recovery processing command is received three or more times from the management device 103 within one day after sending an abnormality notification related to "DI-3timesLow" in FIG. 12, the enabling condition 1107 is satisfied. Therefore, the recovery processing determination unit 130 of the monitoring device 102 enables self-determined recovery for the abnormality and executes recovery processing without waiting for a command from the management device 103. Details of this processing will be described later with reference to FIG. 14. Below, the enabling condition 1107 is also called the "second change condition."

In the example of FIG. 13, for ease of explanation, the activation condition 1107 is written in a sentence such as "recovery processing commands for the same event are received three times within one day," but the format is arbitrary. These conditions may be specified by the frequency of receiving recovery processing commands, or the condition content may be defined arbitrarily, such as by the time an abnormality was detected. In addition, the timing for deactivating the recovery processing determined by the device itself after the activation condition 1107 is met may be set arbitrarily. For example, the activation may be deactivated when a certain amount of time has passed after the condition is met.

Figure 14 is a flowchart showing the processing of the recovery processing judgment unit 130 in the third embodiment. Steps S601, S602, S603, and S604 in Figure 11 are the same as those in Figure 6, so their explanation will be omitted. In steps S601 to S602, the recovery processing table 133 is referenced, and if "NG" is entered in the field of self-determined recovery feasibility 911 corresponding to the detected abnormality, the process proceeds to step S1201.

In step S1201, the recovery process determination unit 130 of the monitoring device 102 refers to the activation conditions 1107 and acquires the activation conditions for self-determined recovery. In the following step S1202, the recovery process determination unit 130 of the monitoring device 102 performs a match determination of the activation conditions acquired in step S1201. In the example of FIG. 13, if a "Low" digital input signal is observed three consecutive times from the device 101 ("DI-3timesLow" in FIG. 13), a match determination is performed using the number of times a recovery process command was received within the past day after the abnormality notification was sent for the abnormality. If the activation condition for the detected abnormality is not registered (blank) or does not match the activation condition (YES), the process proceeds to step S604, and a decision is made to execute recovery processing based on a command from the management device 103. On the other hand, if the activation condition is met (NO), it is decided to activate the execution of recovery processing at the discretion of the monitoring device 102, and the process proceeds to step S603, where it is decided to automatically execute recovery processing at the discretion of the monitoring device 102 without waiting for a command from the management device 103.

According to the above-described third embodiment, the following advantageous effects can be obtained.
(11) The storage device 125 stores a second change condition for changing the instruction reception recovery to the self-determined recovery in the self-determined recovery for each anomaly type. When the second change condition is met, the recovery process determination unit 130 changes the instruction reception recovery to the self-determined recovery. Therefore, the execution of the recovery process for the occurred anomaly can be dynamically switched from execution based on the command of the management device 103 to automatic execution based on the judgment of the monitoring device 102.

(12) The second change condition is the frequency of receiving an external command to execute a recovery process for the same anomaly, or the time when the anomaly was detected. Therefore, if the rate at which recovery process commands are issued for the same anomaly is high, or if an anomaly is detected during a specific time period, the recovery time from the anomaly can be shortened by switching to automatic execution of the recovery process at the discretion of the monitoring device 102.

--Fourth embodiment--
A fourth embodiment of the communication system will be described with reference to Figures 15 and 16. In the following description, the same components as in the first embodiment are denoted by the same reference numerals, and differences will be mainly described. Points that are not specifically described are the same as in the first embodiment. This embodiment differs from the first embodiment mainly in that the contents of the recovery process executed in the self-determined recovery are dynamically switched.

Let us assume that even though the monitoring device 102 detects a communication disconnection with the device 101 and executes a recovery process of "restarting the communication I/F of the monitored device", the communication disconnection with the device 101 is not resolved and the same abnormality continues to be detected. In this case, there may be a problem with the communication I/F 121 of the monitoring device 102, not the communication I/F 111 of the device 101. Therefore, recovery from the communication disconnection can be expected by changing the recovery process executed by the monitoring device 102 in its self-determined recovery from "restarting the communication I/F of the monitored device" to "restarting the communication I/F of its own device". Therefore, in this embodiment, it is possible to dynamically switch the contents of the recovery process that the monitoring device 102 automatically executes in response to an abnormality that has occurred.

The configurations and functions of the management device 103 and the device 101 in the fourth embodiment are the same as those in the first embodiment. The hardware configuration of the monitoring device 102 is the same as that in the first embodiment. The monitoring device 102 differs from the first embodiment in the configuration of the recovery processing table 133. The processing of the recovery processing judgment unit 130 also differs from that in the first embodiment. The operation of the application program 126, the communication processing unit 127, the abnormality detection unit 128, the abnormality notification unit 129, the recovery processing execution unit 131, and the storage device management unit 134 are the same as those in the first embodiment. The configuration of the abnormality definition table 132 is also the same as that in the first embodiment.

Figure 15 is a diagram showing an example of the recovery processing table 133 in the fourth embodiment. The event ID 1301, first recovery processing content 1302, first timer 1303, second recovery processing content 1304, second timer 1305, self-determined recovery possibility 1306, and invalidation condition 1307 in Figure 15 are the same as the event ID 906, first recovery processing content 907, first timer 908, second recovery processing content 909, second timer 910, self-determined recovery possibility 911, and invalidation condition 912 in the recovery processing table 133 shown in Figure 10 in the second embodiment, so their explanations are omitted. The recovery processing table 133 in Figure 15 has a field for the activation condition 1308, and this item is the same as the activation condition 1107 shown in the recovery processing table 133 in Figure 13 in the third embodiment, so its explanation is omitted.

In the example shown in FIG. 15, if a communication disconnection with the device 101 ("LAN-Disconn" in FIG. 15) is detected three or more times within one hour, the recovery process determination unit 130 of the monitoring device 102 disables the automatic execution of "restarting the communication I/F of the monitored device" determined by the monitoring device 102. Instead, the automatic execution of "restarting the communication I/F of the own device" is enabled, and the recovery process content to be taken in response to the communication disconnection is switched. In other words, if the number of detections of communication disconnection with the device 101 within the past hour is less than three, recovery is attempted by restarting the communication I/F 111 of the device 101, and if the number of detections reaches three or more, the target for restart is switched to the communication I/F 121 of the own device. Details of this process will be described later with reference to FIG. 16.

As shown in this embodiment, if the invalidation condition 1307 and the activation condition 1308 are set to the same value, the recovery process content to be executed when that condition is met is changed. Therefore, the same value of the invalidation condition 1307 and the activation condition 1308 in this case are specially referred to as the "third change condition." The third change condition is a condition for changing the recovery process content.

Figure 16 is a flowchart showing the processing of the recovery processing determination unit 130 in the fourth embodiment. Steps S601, S602, S603, and S604 in Figure 16 are similar to those in Figure 6 in the first embodiment, and steps S1001 and S1002 are similar to those in Figure 11 in the second embodiment. Also, steps S1201 and S1202 in Figure 16 are similar to those in Figure 14 in the third embodiment. Therefore, a description of these will be omitted.

For example, if the abnormality detection unit 128 of the monitoring device 102 detects a communication disconnection with the device 101 ("LAN-Disconn" in FIG. 15), the recovery process determination unit 130 of the monitoring device 102 refers to the recovery process table 133 in FIG. 15 in the process of steps S601 to S602, and proceeds to step S1001 since the record for "Restart communication I/F of monitored device" has self-determined recovery possibility 1306 set to "OK". At this time, if a communication disconnection with the device 101 has been detected three or more times within one hour, the invalidation condition 1307 in FIG. 15 is met in step S1002 (NO), and the process proceeds to step S1401.

In step S1401, the recovery process determination unit 130 of the monitoring device 102 refers to the recovery process table 133 and determines whether there is an undetermined recovery process for the detected abnormality. If there is an undetermined recovery process (YES), the recovery process determination unit 130 returns to step S601. If there is no undetermined recovery process (NO), the recovery process determination unit 130 proceeds to step S604 and instructs the recovery process execution unit 131 to execute a command from the management device 103. In the example shown in FIG. 15, there is an undetermined recovery process ("restart communication I/F of own device") for communication disconnection with the device 101 (LAN-Disconn), so the recovery process determination unit 130 returns to step S601.

After that, in the processing of steps S601 to S602, the recovery processing determination unit 130 of the monitoring device 102 again refers to the recovery processing table 133 in FIG. 15, and since automatic execution of "restarting the communication I/F of the own device" is prohibited (NO), the processing proceeds to step S1201. Furthermore, in the determination processing of step S1202, it is determined that the automatic execution of "restarting the communication I/F of the own device" matches the enabling condition 1308 in FIG. 15 (NO), and the processing proceeds to step S603. As a result, the automatic execution of "restarting the communication I/F of the own device" is determined by the judgment of the monitoring device 102, and dynamic switching of the recovery processing content is realized.

According to the above-described fourth embodiment, the following advantageous effects can be obtained.
(13) The storage device 125 further stores a third change condition, which is a condition for changing the recovery process content for each anomaly type, and a post-change recovery process content, which is the content of the recovery process when the third change condition is met. The recovery process execution unit 131 executes the post-change recovery process content when the third change condition is met. Therefore, the recovery process content that the monitoring device 102 automatically executes in response to the generated anomaly can be dynamically switched. In particular, in cases where the recovery process that the monitoring device 102 automatically executes is inappropriate and does not result in recovery, the recovery from the anomaly can be realized by dynamically switching the recovery process content.

The above configurations, functions, etc. may be realized in part or in whole by hardware, for example by designing them as integrated circuits. Also, the above configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information on the programs, tables, files, etc. that realize each function may be recorded in advance in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD, and read into each device.

In each of the above-described embodiments and variations, the functional block configurations are merely examples. Several functional configurations shown as separate functional blocks may be configured together, or a configuration shown in a single functional block diagram may be divided into two or more functions. In addition, some of the functions of each functional block may be provided by other functional blocks.

The above-mentioned embodiments and modifications may be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these. Other aspects that are conceivable within the scope of the technical concept of the present invention are also included within the scope of the present invention.

101: Device 102: Monitoring device 103: Management device 123: Input unit 124: Output unit 125: Storage device 127: Communication processing unit 128: Abnormality detection unit 129: Abnormality notification unit 130: Recovery process determination unit 131: Recovery process execution unit 132: Abnormality definition table 133: Recovery process table

Claims (15)

A monitoring device for monitoring one or more devices to be monitored,
an abnormality detection unit that detects an abnormality occurring in the device;
an abnormality notification unit that outputs the detected abnormality to an external device as an abnormality notification;
a recovery process determination unit that determines a recovery type, which is a type of recovery, according to an abnormality type, to be either a self-determined recovery in which the content of a recovery process for the device is determined by the monitoring device, or an instruction-received recovery in which the content of a recovery process for the device is determined by an external device of the monitoring device;
a recovery process execution unit that executes recovery process of the device based on the decision of the recovery type by the recovery process determination unit. The monitoring device according to claim 1,
The monitoring device further includes a storage device that stores anomaly definitions which are definitions of the anomaly types, a self-determined recovery possibility indicating whether the self-determined recovery is for each anomaly type or the instruction reception recovery, and a recovery processing content which is the content of the recovery processing for each anomaly type that is the self-determined recovery. The monitoring device according to claim 2,
The storage device further stores a timer indicating a grace period until the recovery process is executed for each of the abnormality types. The monitoring device according to claim 3,
The monitoring device further includes a storage device management unit that records at least one of the abnormality definition, the self-determined recovery possibility, the recovery processing content, the content of the abnormality notification for each abnormality type, and the timer in the storage device based on an external input. The monitoring device according to claim 2,
The storage device further stores a first change condition for changing the self-determined recovery to the instruction reception recovery in the self-determined recovery possibility for each of the abnormality types,
The recovery process determination unit is a monitoring device that changes the self-determined recovery possibility to the instruction reception recovery when the first change condition is met. The monitoring device according to claim 5,
The first change condition includes at least one of a detection frequency for the same abnormality, a time when the abnormality is to be detected, and a time period when the abnormality is to be detected. The monitoring device according to claim 2,
The storage device further stores a second change condition for changing the instruction reception recovery to the self-determined recovery in the self-determined recovery possibility for each of the abnormality types,
The recovery process determination unit is a monitoring device that changes the self-determined recovery possibility to the self-determined recovery when the second change condition is met. The monitoring device according to claim 7,
The second change condition includes at least one of a frequency of receiving an execution command for the recovery process from outside for the same abnormality, or a time of abnormality detection. The monitoring device according to claim 2,
The storage device further stores a third change condition, which is a condition for changing the recovery process content for each of the abnormality types, and a changed recovery process content, which is a content of the recovery process when the third change condition is met,
The recovery process execution unit is a monitoring device that executes the changed recovery process content when the third change condition is met. The monitoring device according to claim 2,
The storage device further stores a fourth change condition, which is a condition for changing the content of the abnormality notification for each abnormality type, and a changed notification content, which is the content of the abnormality notification when the fourth change condition is met,
The abnormality notification unit is a monitoring device that outputs the changed notification content when the fourth change condition is met. 2. The monitoring device according to claim 1,
When the recovery processing determination unit determines to perform the instruction reception recovery, the recovery processing execution unit waits until the contents of the recovery processing for the equipment are instructed from outside, and immediately executes the contents of the recovery processing for the equipment when instructed from outside. A management device capable of communicating with the monitoring device according to claim 1,
an abnormality notification management unit that receives the abnormality notification output by the monitoring device;
a recovery process command unit that outputs the content of the recovery process determined based on the abnormality notification to the monitoring device. The management device according to claim 12,
An output unit that presents information to a user,
The abnormality notification management unit is a management device that determines whether the abnormality notification received from the monitoring device is the self-determined recovery or the instruction-received recovery, and differs the output to the output unit based on the determination. A communication system including a monitoring device that monitors one or more devices to be monitored, and a management device that can communicate with the monitoring device,
The monitoring device includes:
an abnormality detection unit that detects an abnormality occurring in the device;
an abnormality notification unit that outputs the detected abnormality to an external device as an abnormality notification;
a recovery process determination unit that determines a recovery type, which is a type of recovery, according to an abnormality type, which is a type of the abnormality, to be either a self-determined recovery in which the content of a recovery process for the device is determined by the monitoring device or an instruction-received recovery in which the content of a recovery process for the device is determined by an external device of the monitoring device;
a recovery process execution unit that executes a recovery process of the device based on the determination of the recovery type by the recovery process determination unit,
The management device includes:
an abnormality notification management unit that receives the abnormality notification output by the monitoring device;
a recovery process command unit that outputs the content of the recovery process determined based on the abnormality notification to the monitoring device. A recovery method executed by a monitoring device that monitors one or more devices to be monitored, comprising:
an abnormality detection step of detecting an abnormality occurring in the device;
an abnormality notification step of outputting the detected abnormality as an abnormality notification to an outside;
a recovery process determination step of determining a recovery type, which is a type of recovery, to be either a self-determined recovery in which the monitoring device determines the contents of a recovery process for the device, or an instruction-received recovery in which the outside of the monitoring device determines the contents of the recovery process for the device, according to the abnormality type, which is a type of the abnormality;
a recovery processing execution step of executing a recovery processing of the device based on the decision of the recovery type in the recovery processing decision step.

Images