JP7085518B2 - Failure recovery method and system of the controlled device in the system in which the controlled device and the controlled device are connected - Google Patents

Description

The present invention relates to a technique for recovering from a device failure in a user plane of a mobile communication network.

The mobile communication network is built on a virtualization platform by EPC (Evolved Packet Core) and IMS (IP Multimedia Subsystem). The UE (User Equipment, mobile mobile terminal) communicates with a plurality of eNBs (evolved Node B, base station) via radio. The UE connects to the EPC via the eNB and communicates with the IMS and the transport network (Internet).

FIG. 1 is a system configuration diagram of a mobile communication network.

According to FIG. 1, the EPC has SGW (Serving-Gateway) 2, PGW (Proxy-Gateway) 1 and PCRF (Policy and Charging Rules Function) in MME (Mobility Management Entity) 4 in order to accommodate a plurality of eNBs 5. It is composed of 3 (see, for example, Non-Patent Document 1).
The MME 4 is a core network control device, and executes movement management of the UE 6, authentication of the UE 6 in cooperation with HSS (Home Subscriber Server), and setting control of an IP (Internet Protocol) transmission route.
The SGW 2 executes IP packet transmission control based on the control from the MME 4.
The PGW 1 serves as a connection point with a PDN (external network) such as the Internet or IMS, and receives all IP packets addressed to the UE from the PDN.
The mobile communication network is composed of a user plane and a control plane. PGW-U11 and SGW-U21 are arranged in the user plane, and PGW-C12 and SGW-C22 are arranged in the control plane.
PCRF3 determines the IP packet transmission policy such as QoS (Quality of Service) and billing method for executing transmission quality control in PGW1 and SGW2.
Thereby, the UE 6 communicates with the IMS and the transport network via the eNB 5, SGW 2 and PGW 1.

IMS is a service control method standardized by 3GPP (3rd Generation Partnership Project), and realizes a next-generation mobile phone network or NGN (Next Generation Network). As a result, the fixed network and the mobile network will be integrated, and all terminals will be provided with all IP.

FIG. 2 is a system configuration diagram showing the occurrence of a failure in PGW-U.

According to FIG. 2, the SGW-U21 holds session information in which an IP address and a PGW-U address as a transfer destination are associated with each user ID.
Further, the PGW-U11 also holds the session information in which the IP address and the SGW-U address as the transfer destination are associated with each user ID.
Further, the PGW-C12 holds session information in which the IP address is associated with the PGW-U address and the SGW-U address for each user ID.

If a failure occurs in the PGW-U11 in such a state, the telecommunications carrier tries to restore the PGW-U11 by, for example, restarting or switching to a standby device.
At this time, even if the PGW-U11 starts to operate normally, some or all of the session information held internally may be lost. Then, the session information does not match between SGW-U21 and PGW-C12, and a communication error occurs.
As a result, packet communication is disabled for the user accommodated in the PGW-U11, which adversely affects the service.

Conventionally, there are the following two methods for recovering session information in PGW-U.
(Recovery method 1) This is a method of cooperating with an adjacent node (see, for example, Non-Patent Document 1). This may be the case where all the session information stored in the failed node is restored all at once, or the case where the session is passively restored one session at a time.
(Recovery method 2) This is a method in which the PGW-U alone has a redundant function without coordinating with an adjacent node. This is not specified in 3GPP, and each company implements it independently.

Regardless of the recovery method, the operating PGW-U needs to store a copy of the session information in another node. Even if the session information is lost due to a failure, the session information can be recovered by using a copy of the session information at the storage destination.

Here, there are roughly two methods for copying the session information.
<Synchronization method> When a request to create (update / delete) session information is received, the session information is copied to another node, and then the response signal is returned.
<Asynchronous method> When a request to create (update / delete) session information is received, the response signal is returned, and then the session information is copied to another node.

Japanese Unexamined Patent Publication No. 2008-099797

3GPP TS 23.007 Restoration procedures 3GPP TS 23.214 Architecture enhancements for control and user plane separation of EPC nodes 3GPP TS 29.244 Interface between the Control Plane and the User Plane Nodes

In the case of the <synchronization method>, the PGW-U11 sends a recovery request to the PGW-C12 immediately after the recovery. Upon receiving this, the PGW-C12 tries to transmit all the session information of the PGW-U11 to the PGW-U11 all at once. Therefore, the PGW-C12 that manages the plurality of PGW-U11 has a high load of the transmission processing, and the processing capacity for the other PGW-U is lowered.

Therefore, PGW-C12 tries to transmit to PGW-U11 one session at a time. However, depending on the number of sessions being connected, the larger the amount of session information data transmitted by the PGW-C12 to the PGW-U11, the longer the transmission time, for example, it may take several tens of minutes. For example, it can be calculated as follows.
Transmission time of 1 session = 1msec
Number of session information = 1 million Session transmission time = 1 million x 1 msec = 1000 sec (about 15 minutes)
During this time, the PGW-U11 will be in the recovery time and the service will be stopped.

As described above, in the case of the synchronization method, the PGW-U11 returns a response signal after all the session information has been copied, so that a considerable response waiting time is required even from the viewpoint of the PGW-C12. Become.

In the case of the <asynchronous method>, after the PGW-U11 returns a response signal to the PGW-C12, the session information is copied to the copy destination node (storage device). Therefore, the response waiting time is shortened from the viewpoint of PGW-C12. However, if a failure occurs before the copy of the session information is completed, the session information of the copy destination node may not be updated to the latest (session information mismatch). On the other hand, since the PGW-C12 receives the response signal, it is determined that the session information completely matches the PGW-U11. In this case, even if the session information of the copy destination node is completely restored after the PGW-U11 is restored, the session information does not match the PGW-C12, and an error occurs in the user data communication.

Therefore, in the present invention, the controlled device immediately returns a response signal to the request signal of the controlled device by an asynchronous method, and a session occurs between the controlled device and the controlled device due to the occurrence of a failure of the controlled device. It is an object of the present invention to provide a failure recovery method and a system of a controlled device that can recover even if an information mismatch occurs without causing a communication error.

According to the present invention, it is a method of recovering from a failure of a controlled device in a system in which the controlled device and the controlled device are connected.
The controlled device is duplicated by the active function unit and the standby function unit.
In the first step, the control device transmits a request signal including a sequence number incremented for each transmission to the controlled device.
The second step as an asynchronous method in which the active function unit of the controlled device copies the communication establishment information and the sequence number to the standby function unit after returning the response signal including the sequence number to the control device.
When a failure occurs in the active function unit of the controlled device, the standby function unit of the controlled device transmits the sequence number stored by itself to the control device in the third step.
The standby function unit of the controlled device sends a deletion request that the control device deletes the communication establishment information up to the sequence number stored by the control device itself, which is behind the sequence number received from the standby function unit of the controlled device. It is characterized by having a fourth step of transmitting to.

According to another embodiment of the disaster recovery method of the controlled device of the present invention.
Communication establishment information is session information and
Regarding the fourth step, it is also preferable that the deletion target is session information based on a modification request.

According to another embodiment of the disaster recovery method of the controlled device of the present invention.
The controlled device further has a life-and-death monitoring function unit for the active function unit, and has a life-and-death monitoring function unit.
Regarding the third step, when the alive monitoring function unit detects that the active function unit has a failure, it activates the standby function unit, acquires a sequence number from the standby function unit, and uses the sequence number as a control device. It is also preferable to send to.

According to another embodiment of the disaster recovery method of the controlled device of the present invention.
The system further has a life and death monitoring device for the active functional part of the controlled device.
Regarding the third step, when the alive monitoring device detects that the active function unit of the controlled device has a failure, the standby function unit of the controlled device is activated, the sequence number is acquired from the standby function unit, and the sequence number is acquired. It is also preferable to transmit the sequence number to the control device.

According to another embodiment of the disaster recovery method of the controlled device of the present invention.
The control device is a C (Control) plane network device.
The controlled device is also preferably a U (User) plane network device.

According to another embodiment of the disaster recovery method of the controlled device of the present invention.
The control device is PGW (Packet data network GateWay) -C.
The controlled device is also preferably PGW-U.

According to another embodiment of the disaster recovery method of the controlled device of the present invention.
Regarding the second step, the control device stores the sequence number of the response signal to the request signal of the update request as an update log in the order of arrival.
Regarding the fourth step, the control device receives a deletion request for deleting the communication establishment information in the sequence number of the response signal arriving after the sequence number received from the standby function unit of the controlled device using the update log. It is also preferable to transmit to the standby function unit of the control device.

According to the present invention, in a system in which a control device and a controlled device are connected,
The controlled device is duplicated by the active function unit and the standby function unit.
The control device is
A request signal transmission means for transmitting a request signal including a sequence number incremented for each transmission to the controlled device,
A deletion request transmission means for transmitting a deletion request for deleting communication establishment information up to the sequence number stored by itself behind the sequence number received from the standby function unit of the controlled device to the standby function unit of the controlled device. And have
The controlled device is
A response signal reply means for the active function unit to return a response signal including a sequence number to the control device, and
After the response signal reply means functions, the sequence number duplication means as an asynchronous method that duplicates the communication establishment information and the sequence number to the standby function unit,
When a failure occurs in the active function unit of the controlled device, the standby function unit has a sequence number transmitting means for transmitting the sequence number stored by itself to the control device.

According to the present invention, the controlled device immediately returns a response signal to the request signal of the controlled device by an asynchronous method, and a session occurs between the controlled device and the controlled device due to a failure of the controlled device. Even if an information mismatch occurs, it can be recovered without causing a communication error.

It is a system block diagram of the mobile communication network in the prior art. It is a system configuration diagram which shows the failure occurrence of PGW-U. It is a sequence diagram of the system in this invention. It is a sequence diagram before the failure occurrence of PGW-U in this invention. It is a sequence diagram after the failure occurrence of PGW-U in this invention. It is a functional block diagram of PGW-U and PGW-C in this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 3 is a sequence diagram of the system in the present invention.

According to FIG. 3, it is assumed that the controlled device is a U (User) plane network device and is a PGW (Packet data network GateWay) -U.
Further, it is assumed that the control device is a C (Control) plane network device and is a PGW-C.

According to FIG. 3, the PGW-U11 has an active function unit 111, a standby function unit 112, and a life and death monitoring function unit 113. These functional components are realized by executing a program for operating a computer mounted on a device as a PGW-U. In addition, the processing flow of these functional units can be understood as a failure recovery method.

[Active function unit 111 and standby function unit 112]
The active function unit 111 and the standby function unit 112 are redundantly duplicated. Since the active function unit 111 and the standby function unit 112 share the same IP address, from the external PGW-C / SGW-U and other devices, the active function unit 111 or the standby function unit 112 has a PGW-U11. It is completely impossible to identify which of 112 is operating.

[Life and Death Monitoring Function Unit 113]
The life-and-death monitoring function unit 113 is called a Health Check Server, and mainly monitors the life-and-death monitoring function unit 111.
Specifically, the life-and-death monitoring function unit 113 periodically sends a "life-and-death monitoring message" to the active function unit 111 to monitor the presence or absence of a failure.
When the life-and-death monitoring function unit 113 detects that a failure has occurred in the active function unit, the life-and-death monitoring function unit 113 activates the standby function unit and controls to switch to the standby function unit 112.
As will be described later, the life-and-death monitoring function unit 113 may acquire a sequence number from the standby function unit 112 and transmit the sequence number to the PGW-C (control device) 12.

As shown in FIG. 3, the life-and-death monitoring function unit 113 may be mounted on the PGW-U11 or may exist as an external life-and-death monitoring device.

According to FIG. 3, it is divided into steps <S1> and <S2> before the occurrence of a failure and steps <S3> and <S4> after the occurrence of a failure.

<Operation before failure>
<S1> The PGW-C12 transmits a "request signal" including a sequence number incremented by 1 for each transmission to the PGW-U (controlled device) 11. The request signal also includes a session ID, a UE IP address, and other necessary information.

<S2> On the other hand, the active function unit 111 of the PGW-U11 returns a "response signal" including the sequence number to the PGW-C12 as an "asynchronous method". The sequence number of this response signal is the same as the sequence number of the request signal. The response signal also includes the session ID, the IP address of the UE, and other necessary information.

After that, the active function unit 111 of the PGW-U11 copies (reproduces) the session information (communication establishment information) and the sequence number to the standby function unit 112. As a result, the session information stored in the standby function unit 112 becomes the same as that in the active function unit 111.
Then, the standby function unit 112 of the PGW-U11 returns a success message to the active function unit 111 when the duplication of the session information and the sequence number is completed.

As a result, user data can be communicated between the UE and the transport network via the SGW-U21 and the active function unit 111 of the PGW-U11.

<Operation when a failure occurs>
<S3> When the alive monitoring function unit 113 detects that the active function unit 111 of the PGW-U11 has a failure, it instructs the PGW-U11 to switch to the standby function unit 112. Immediately, PGW-U11 switches from the active function unit 111 to the standby function unit 112.
Then, the standby function unit 112 of the PGW-U11 transmits the sequence number stored by itself to the PGW-C12.
At this time, the standby function unit 112 of the PGW-U11 may transmit the sequence number stored by itself to the PGW-C12 via the life-and-death monitoring function unit 113.

<S4> The PGW-C12 deletes the session information (communication establishment information) up to the sequence number stored by the PGW-C12 itself, which is behind the "sequence number" received from the standby function unit 112 of the PGW-U11. The deletion request to be performed is transmitted to the standby function unit 112 of the PGW-U11.
Here, it is assumed that the deletion target is session information based on a modification request. This is to respond to the update request that could not be recovered in the case of the asynchronous method.

The PGW-C12 extracts session information that is inconsistent with the PGW-U11 restored by switching to the standby function unit 112, and deletes the extracted session information.
After that, when a packet based on the deleted session information is received, it is restored one session at a time.

FIG. 4 is a sequence diagram of PGW-U in the present invention before the occurrence of a failure.

(S1) The PGW-C12 transmits an establishment request to the PGW-U11. The establishment request includes a sequence number (1) and a user ID (A).
On the other hand, the active function unit 111 of the PGW-U11 generates a session ID (x) and returns an Establish Response. The establishment response includes the sequence number (1) and the session ID (x).
After that, as an asynchronous method, the active function unit 111 of the PGW-U11 copies the session information (x) to the standby function unit 112.

(S2) The PGW-C12 transmits an establishment request to the PGW-U11. The establishment request includes a sequence number (2) and a user ID (B).
On the other hand, the active function unit 111 of the PGW-U11 generates a session ID (y) and returns an Establish Response. The establishment response includes the sequence number (2) and the session ID (y).
After that, as an asynchronous method, the active function unit 111 of the PGW-U11 copies the session information (y) to the standby function unit 112.

(S3) The PGW-C12 transmits a modification request (Modification Request) to the PGW-U11. The update request includes the sequence number (3) and the session ID (x).
In addition, the update request also includes information such as the presence / absence of bandwidth limitation, the presence / absence of HandOver, and the update of IdleTimer.
On the other hand, the active function unit 111 of the PGW-U11 updates the session ID (x) and returns an update response (Modification Response). The update response includes the sequence number (3).

At this point, the PGW-C12 stores the following session information for the update request.
PGW-U # 1, SeqNo (3), SessionID (x)
Further, the standby function unit 112 stores the sequence number of the last received update request as the following log.
SeqNo (3), SessionID (x) (y)

After that, as an asynchronous method, the active function unit 111 of the PGW-U11 copies the updated session information (x) to the standby function unit 112.

(S4) The PGW-C12 transmits a deletion request (Deletion Request) to the PGW-U11. The delete request contains the sequence number (4) and the session (x).
On the other hand, the active function unit 111 of the PGW-U11 deletes the session information (x). Then, a deletion response (EstablishResponse) including the sequence number (4) is returned.
After that, as an asynchronous method, the active function unit 111 of the PGW-U11 deletes the session information (x) with respect to the standby function unit 112.

(S5) The PGW-C12 transmits a modification request (Modification Request) to the PGW-U11. The update request includes the sequence number (5) and the session ID (y).
On the other hand, the active function unit 111 of the PGW-U11 updates the session ID (y) and returns an update response (Modification Response). The probability response includes the sequence number (5).

At this point, the PGW-C12 stores the following update log for the update request.
PGW-U # 1, SeqNo (3), SessionID (x)
PGW-U # 1, SeqNo (5), SessionID (y)
It is stored in the order of the sequence number in association with the updated session ID.

At this time, because of the asynchronous method, the active function unit 111 of the PGW-U11 assumes that the updated session information (y) has not yet been copied to the standby function unit 112.

FIG. 5 is a sequence diagram of PGW-U in the present invention after the occurrence of a failure.

When the life-and-death monitoring function unit 113 detects that the active function unit 111 of the PGW-U11 has a failure, it instructs the PGW-U11 to switch to the standby function unit 112.

(S6) The standby function unit 112 of the PGW-U11 transmits the sequence number SeqNO (3) stored by itself to the life and death monitoring function unit 113. Then, the life-and-death monitoring function unit 113 transfers the sequence number SeqNO (3) to the PGW-C22.
At this time, the standby function unit 112 of the PGW-U11 may directly transmit the sequence number SeqNO (3) stored by itself to the PGW-C12.
After that, the PGW-U11 switches from the active function unit 111 to the standby function unit 112.

(S7) After receiving the sequence number SeqNO (3), PGW-C12 compares it with the update log stored in the past. That is, it is determined whether or not SeqNO behind SeqNO (3) is stored. According to FIG. 5, it is determined that SeqNO (5) is inconsistent.

At this time, a deletion request (DeletionRequest) for deleting the Seesion ID (y) up to the sequence number stored by the PGW-C12 itself is transmitted to the PGW-U11. The deletion request is received by the standby function unit 112 of the PGW-U11.
On the other hand, the standby function unit 112 of the PGW-U11 returns a deletion response (DeletionResponse) to the PGW-C12.

(S8) After that, it is assumed that the PGW-U11 receives the communication packet from the user ID (B) from the transport network.
At this time, since the PGW-U11 does not store the session ID for the user ID (B), the error notification (Error Indication) of the user ID (B) is transmitted to the PGW-C12.

(S9) The PGW-C12 transmits an establishment request to the PGW-U11. The establishment request includes a sequence number (6) and a user ID (B).
On the other hand, PGW-U11 generates a session ID (z) and returns an Establish Response. The establishment response includes the sequence number (6) and the session ID (z).
In this way, when a packet based on the deleted session information is received, it is restored one session at a time.

<Correspondence of out-of-order response signals including sequence numbers for PGW-C12>
Communication packets may not arrive in the order of sequence numbers due to a router or the like on the route, and for example, the response signal may arrive at PGW-C12 in the reverse order of arrival.
In this case, it is preferable that the PGW-C12 determines the SeqNO of the deletion request in consideration of the order of arrival in addition to the sequence number.

Regarding <S2>, the PGW-C12 stores the sequence number of the response signal to the request signal of the update request as an "update log" in the order of arrival.
Then, regarding <S4>, the PGW-C12 uses the update log to request deletion to delete the communication establishment information in the sequence number of the response signal arriving after the sequence number received from the standby function unit 112 of the PGW-U11. Is transmitted to the standby function unit of PGW-U11.
(SeqNO of received response signal) (SeqNO received at recovery)
・ ・ ・ ・ ・ ・ ・
SeqNO (10)
SeqNO (12)
SeqNO (11)
SeqNO (13) Seq (12)
In this case, a deletion request is also transmitted for Seq (11) received after the response signal SeqNO (12).

FIG. 6 is a functional configuration diagram of PGW-U and PGW-C in the present invention.

According to FIG. 6, the PGW-C12 has a request signal transmission unit 121 and a deletion request transmission unit 122. These functional components are realized by executing a program for operating the computer mounted on the PGW-C.
The request signal transmission unit 121 transmits a request signal including a sequence number incremented for each transmission to the PGW-U11.
When the PGW-U11 is restored, the deletion request transmission unit 122 deletes the session information (communication establishment information) up to the sequence number stored by the PGW-C12 itself, which is behind the sequence number received from the PGW-U11. The "deletion request" to be performed is transmitted to the PGW-U11.

Further, according to FIG. 6, the PGW-U11 has a user data transfer unit duplicated by the active function unit 111 and the standby function unit 112 described above, and a life and death monitoring function unit 113. Further, it further includes a response signal reply unit 111a, a sequence number duplication unit 111b, and a sequence number transmission unit 112a. These functional components are realized by executing a program for operating the computer mounted on the PGW-U.

The response signal reply unit 111a returns a "response signal" including the sequence number of the request signal to the PGW-C12 in response to the request signal received from the PGW-C12.
As an asynchronous method, the sequence number duplication unit 111b replicates the session information and the sequence number to the standby function unit after the response signal reply unit 111a returns the response signal.
When the sequence number transmission unit 112a detects that the active function unit 111 has a failure, the standby function unit 112 transmits the sequence number stored by itself to the PGW-C12.

As described in detail above, according to the present invention, the controlled device immediately returns a response signal to the request signal of the controlled device by an asynchronous method, and the control device is caused by a failure of the controlled device. Even if there is a discrepancy in session information between the controlled device and the controlled device, it can be recovered without causing a communication error.

Various changes, modifications and omissions of the technical idea and the scope of view of the present invention can be easily carried out by those skilled in the art with respect to the various embodiments of the present invention described above. The above explanation is just an example and does not attempt to limit anything. The present invention is limited only to the scope of claims and their equivalents.

11 PGW-U
111 Active function unit 111a Response signal reply unit 111b Sequence number duplication unit 112a Sequence number transmission unit 112 Standby function unit 113 Life and death monitoring function unit 12 PGW-C
121 Request signal transmitter 122 Deletion request transmitter 21 SGW-U
22 SGW-C
3 PCRF
4 MME
5 eNB
6 UE

Claims (8)

It is a failure recovery method of the controlled device in the system in which the controlled device and the controlled device are connected.
The controlled device is duplicated by the active function unit and the standby function unit.
In the first step, the control device transmits a request signal including a sequence number incremented for each transmission to the controlled device.
The second step as an asynchronous method in which the active function unit of the controlled device copies the communication establishment information and the sequence number to the standby function unit after returning the response signal including the sequence number to the control device.
When a failure occurs in the active function unit of the controlled device, the standby function unit of the controlled device transmits the sequence number stored by itself to the control device in the third step.
The standby function unit of the controlled device sends a deletion request that the control device deletes the communication establishment information up to the sequence number stored by the control device itself, which is behind the sequence number received from the standby function unit of the controlled device. A method for recovering from a failure of a controlled device, which comprises a fourth step of transmitting to. The communication establishment information is session information and is
The method for recovering from a failure of a controlled device according to claim 1, wherein the deletion target is session information based on a modification request in the fourth step. The controlled device further has a life-and-death monitoring function unit for the active function unit, and has a life-and-death monitoring function unit.
Regarding the third step, when the alive monitoring function unit detects that the active function unit has a failure, it activates the standby function unit, acquires a sequence number from the standby function unit, and uses the sequence number as a control device. The method for recovering from a failure of a controlled device according to claim 1 or 2, wherein the device is transmitted to. The system further includes a life-and-death monitoring device for the active functional unit of the controlled device.
Regarding the third step, when the alive monitoring device detects that the active function unit of the controlled device has a failure, the standby function unit of the controlled device is activated, the sequence number is acquired from the standby function unit, and the sequence number is acquired. The method for recovering from a failure of a controlled device according to claim 1 or 2, wherein the sequence number is transmitted to the control device. The control device is a C (Control) plane network device.
The method for recovering from a failure of a controlled device according to any one of claims 1 to 4, wherein the controlled device is a U (User) plane network device. The control device is PGW (Packet data network GateWay) -C.
The method for recovering from a failure of a controlled device according to claim 5, wherein the controlled device is a PGW-U. Regarding the second step, the control device stores the sequence number of the response signal to the request signal of the update request as an update log in the order of arrival.
Regarding the fourth step, the control device uses the update log to request deletion of the communication establishment information in the sequence number of the response signal arriving after the sequence number received from the standby function unit of the controlled device. The method for recovering from a failure of a controlled device according to any one of claims 1 to 6, wherein the information is transmitted to the standby function unit of the controlled device. In a system in which a control device and a controlled device are connected,
The controlled device is duplicated by the active function unit and the standby function unit.
The control device is
A request signal transmission means for transmitting a request signal including a sequence number incremented for each transmission to the controlled device,
A deletion request transmission means for transmitting a deletion request for deleting communication establishment information up to the sequence number stored by itself behind the sequence number received from the standby function unit of the controlled device to the standby function unit of the controlled device. And have
The controlled device is
A response signal reply means for the active function unit to return a response signal including the sequence number to the control device, and
A sequence number duplication means as an asynchronous method that replicates the communication establishment information and the sequence number to the standby function unit after the response signal reply means functions.
A system characterized in that the standby function unit has a sequence number transmitting means for transmitting a sequence number stored by itself to the control unit when a failure occurs in the active function unit of the controlled device.

Images