JP7316779B2 - FACILITY MONITORING SYSTEM AND COMMUNICATION METHOD IN FACILITY MONITORING SYSTEM - Google Patents

Description

The present invention relates to a facility monitoring system for monitoring or controlling equipment installed in a facility, and more particularly to a redundant facility monitoring system and a communication method in the facility monitoring system.

Conventionally, in a facility monitoring system that monitors or controls equipment in a facility, an active device and a standby device that has the same configuration as the active device and serves as a backup device for the active device is known.
For example, Patent Literature 1 discloses a building management system in which a server connected to a controller that controls building equipment has duplicated servers of an active server and a standby server.

JP 2012-128573 A

In the duplexing mechanism adopted in the server in the conventional technology represented by the technology disclosed in the above-mentioned Patent Document 1, one standby system device is provided for one active system device. I am preparing.
Therefore, in a facility monitoring system, when trying to adopt a redundant mechanism for controllers that control equipment, it is simply necessary to prepare twice as many controllers as standby controllers than active controllers. was there.

SUMMARY OF THE INVENTION The present invention was made to solve the above-mentioned problems. In a facility monitoring system that monitors or controls equipment in a facility, the number of standby controllers is twice as many as that of active controllers. It is an object of the present invention to provide a facility monitoring system and a communication method in the facility monitoring system, which can achieve redundancy without having to connect.

A facility monitoring system according to the present invention includes a plurality of controllers connected to a plurality of monitoring points in the facility via a network, and a monitoring device connected to the plurality of controllers via the network. In the monitoring system, the plurality of controllers includes a plurality of active controllers and one standby controller, and the plurality of active controllers each have a different effective value than the plurality of active controllers. It has a virtual IP address and communicates with the monitoring point and the monitoring device using the effective virtual IP address, and one standby controller is a plurality of active controllers for each of the plurality of active controllers. virtual IP addresses that differ from each other are held in an invalid state, and if a failure occurs in any one of the multiple active controllers, the multiple active controllers of each of the multiple active controllers are in an invalid state. Of the virtual IP addresses that are different between the controllers, the virtual IP address of the active controller in which the failure has occurred is made valid, and the virtual IP address made valid is used to communicate with the monitoring point and the monitoring device. It is characterized by

According to the present invention, in a facility monitoring system that monitors or controls devices in a facility, redundancy can be achieved without requiring twice as many standby controllers as active controllers.

1 is a diagram showing a configuration example of a facility monitoring system according to Embodiment 1; FIG. In the facility monitoring system according to Embodiment 1, an example of an IP address possessed by a controller and an active controller using a virtual IP address for communication, and when a failure occurs in the active controller, the standby controller FIG. 10 is a diagram for more specifically explaining the mechanism of switching to the active controller, and showing a normal state; FIG. In the facility monitoring system according to Embodiment 1, an example of an IP address possessed by a controller and an active controller using a virtual IP address for communication, and when a failure occurs in the active controller, the standby controller FIG. 10 is a diagram for more specifically explaining the mechanism of switching to the active controller, and showing a failure occurrence state; FIG. In the facility monitoring system according to Embodiment 1, an example of an IP address possessed by a controller and an active controller using a virtual IP address for communication, and when a failure occurs in the active controller, the standby controller FIG. 10 is a diagram for more specifically explaining the mechanism of switching to the active controller, and showing a post-recovery state; 5A is a block diagram showing a configuration example of a controller according to Embodiment 1, FIG. 5A showing a configuration example of an active controller, and FIG. 5B showing a configuration example of a standby system controller; 4 is a flowchart for explaining the operation of the facility monitoring system according to Embodiment 1; In the facility monitoring system according to the first embodiment, the active controller detects its own abnormality and notifies the standby controller of the occurrence of the abnormality, and the standby controller is activated by the notification from the active controller. FIG. 7A is a diagram showing a configuration example of an active controller and a standby controller when it is determined that a system controller has failed; FIG. 7A is a diagram showing a configuration example of the active controller; and FIG. 7B is a diagram showing a configuration example of a standby controller.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Embodiment 1.
FIG. 1 is a diagram showing a configuration example of a facility monitoring system according to Embodiment 1. As shown in FIG.
The facility monitoring system according to Embodiment 1 is applied to, for example, a BA system (Building Automation System).
The facility monitoring system includes a monitoring device 1 , a controller 2 , equipment 3 and a storage device 4 .
The monitoring device 1, the controller 2, the device 3, and the storage device 4 are connected via a network.
Although only one controller 2 is shown in FIG. 1 for simplicity of explanation, the facility monitoring system includes at least three controllers 2 .
One of the at least three controllers is a standby controller 22 (see FIG. 2 described later), and the others are active controllers 21 (see FIG. 2 described later). In the following description, the plurality of operating controllers 21 will be simply referred to as "operating controllers 21".
In addition, although only one device 3 is shown in FIG. 1 for simplicity of explanation, the facility monitoring system includes a plurality of devices 3 . One or more devices 3 are connected to one active controller 21 . The devices 3 are sensors, lights, switches, motors, etc., and are installed in the facility. In the following description, one or more devices 3 or a plurality of devices 3 will be simply referred to as "devices 3".

The active controller 21 monitors or controls the device 3 .
The active controller 21 collects data such as measured values acquired by the device 3 from the device 3 via the network. The data collected by the active controller 21 is stored in a first storage unit 215 (described later with reference to FIG. 5A) included in the active controller 21 . Also, the data is collected by the monitoring device 1 via the network. The monitoring device 1 displays information about data collected from the active controller 21 on a display device (not shown), for example, based on an instruction from an administrator or the like. The administrator or the like checks the information displayed on the display device to monitor the facility monitoring system. Hereinafter, in Embodiment 1, the device 3 monitored or controlled by the active controller 21 is also referred to as a monitoring point, and the data acquired by the monitoring point is also referred to as monitoring point data.
The active controller 21 communicates with the monitoring device 1 and monitoring points using a virtual IP address different from its own unique IP address. A virtual IP address is set by an administrator or the like for each active controller 21 . Details of the virtual IP address will be described later.

In addition, the operating system controller 21 causes the storage device 4 to store information (hereinafter referred to as “controller information”) related to the operating system controller 21 owned by the operating system controller 21 at a preset cycle. The controller information stored in the storage device 4 by the operating system controller 21 includes monitoring point data collected by the operating system controller 21, graphic data used when displaying the monitoring point data on a display device, or control over the monitoring point. It contains various information used to monitor or control the watchpoint, such as information about the

The active controller 21 is a built-in device intended to perform a function specialized for a specific application such as monitoring or controlling a monitoring point, and the capacity of the first storage unit 215 included in the active controller 21 is several. About ten gigabytes. Therefore, let the active controller 21 internally store a large amount of data such as monitoring point data or control information for the past several decades of the monitoring points monitored or controlled by the active controller 21. Then, the capacity of the first storage unit 215 provided by itself is insufficient. Therefore, the operating system controller 21 transfers the controller information to the storage device 4 outside the operating system controller 21 at a preset cycle, and stores the controller information in the storage device 4 .
When the controller information is stored in the storage device 4, the operating system controller 21 gives information such as a device ID that can identify which operating system controller 21 has stored the controller information. . In the first embodiment, the active controller 21 assigns its own device ID to the controller information and stores it. This is merely an example, and it is sufficient that the controller information is provided with information that can identify which operating controller 21 has stored the controller information.
In the first embodiment, the device ID is information specific to each controller 2 and owned by each controller 2 .

As described above, the monitoring device 1 collects monitoring point data from monitoring points via the active controller 21, and displays information about the collected monitoring point data on the display device.
In addition, the monitoring device 1 controls monitoring points via the active controller 21 . Specifically, the monitoring device 1 receives, for example, a control instruction for monitoring or controlling a monitoring point from an administrator or the like, and transmits the received control instruction to the active system controller 21 . The control instruction sent from the monitoring device 1 to the operating system controller 21 is sent to the monitoring point via the operating system controller 21, and the operating system controller 21 monitors the monitoring point based on the control instruction sent from the monitoring device 1. Or take control.

The standby controller 22 monitors whether the active controller 21 is alive. The details of the life-and-death monitoring of the active controller 21 performed by the standby controller 22 will be described later.
The standby controller 22 does not communicate with the monitoring device 1 , the monitoring point, and the storage device 4 while no failure occurs in the active controller 21 as a result of life-and-death monitoring. When a failure occurs in any of the active controllers 21 as a result of life-and-death monitoring, the standby controller 22 switches to the active controller 21 in which the failure occurred and operates as the active controller 21 . Specifically, the standby controller 22 switches to the active controller 21 and communicates with the monitoring device 1 or the monitoring point using the virtual IP address of the active controller 21 . Further, when switching to the active controller 21, the standby controller 22 acquires the controller information of the failed active controller 21 from the storage device 4, and receives the monitoring points from the failed active controller 21. Inherit controller information required for monitoring or control.
The active controller 21 and the standby controller 22 have the same configuration. Specific configurations of the active controller 21 and the standby controller 22 will be described later.

Here, FIGS. 2, 3, and 4 show an example of the IP address of the controller 2 and the virtual IP address of the active controller 21 in the facility monitoring system according to the first embodiment. 8 is a diagram for more specifically explaining a mechanism for switching a standby controller 22 to an active controller 21 when a failure occurs in the active controller 21. FIG. 2 to 4, for simplicity of explanation, the facility monitoring system is assumed to have two active controllers 21 and one standby controller 22, and one of the two active controllers 21 One is the first operating system controller 21A, and the other is the second operating system controller 21B.
Further, it is assumed that the device ID "1111" is assigned to the first active controller 21A, the device ID "1112" is assigned to the second active controller 21B, and the device ID "1113" is assigned to the standby controller 22.

FIG. 2 shows a state in which no failure has occurred in any of the active controllers 21 (hereinafter referred to as "normal state"), and FIG. 4 shows the state after recovery of the first active controller 21A in which the failure occurred in FIG. 3 (hereinafter referred to as the "post-recovery state").

First, each controller 2 in a normal state will be described.
Controllers 2 each have a valid unique IP address. Here, the first active controller 21A has a unique IP address "172.16.10.11" and the second active controller 21B has a unique IP address "172.16.10.12". , the standby controller 22 has a unique IP address "172.16.10.13".

In addition, each controller 2 has a valid virtual IP address when operating as the active controller 21 . In the example of FIG. 2, the first active controller 21A has a virtual IP address of "172.16.10.1", and the second active controller 21B has a virtual IP address of "172.16.10. 2”.
On the other hand, when the controller 2 operates as the standby controller 22, the virtual IP addresses of all the active controllers 21 included in the facility monitoring system are held in an invalid state. For example, in the example of FIG. 2, the standby controller 22 disables and retains the virtual IP address "172.16.10.1" of the first active controller 21A, and the second active controller 21B. holds the virtual IP address "172.16.10.2" held by it in an invalid state.

The active controller 21 uses a virtual IP address instead of a unique IP address when communicating with the monitoring device 1 or a monitoring point. For example, when the first active controller 21A collects the monitoring point data from the monitoring point, the monitoring point sends the monitoring point data to send. Further, for example, when the second active controller 21B receives a control instruction for a monitoring point from the monitoring device 1, the monitoring device 1 sends to send control instructions.
At this time, the virtual IP addresses "172.16.10.1" and "172.16.10.2" held by the standby controller 22 are in an invalid state. 1, or there is no communication between the standby controller 22 and the monitoring point.

Which controller 2 is operated as the active controller 21 or the standby controller 22 is appropriately set by an administrator or the like when the facility monitoring system is introduced. At this time, the administrator or the like sets the unique IP address of the active controller 21 itself and the virtual IP address of the active controller 21 itself to the controller 2 to be operated as the active controller 21 . In addition, the administrator or the like sets the unique address of the standby controller 22 itself to the controller 2 to be operated as the standby controller 22 . In addition, the administrator or the like disables the virtual IP addresses set in all the controllers 2 set as the active controllers 21 in the facility monitoring system for the controllers 2 to be operated as the standby controllers 22. do.

Here, it is assumed that, for example, the first active controller 21A fails from the state of FIG.
In this case, the standby controller 22 determines that a failure has occurred in the first active controller 21A, and changes the virtual IP address "172.16.10.1" of the first active controller 21A, which has been disabled, to Make it valid. In the standby controller 22, the virtual IP address of the active controller 21 is held in association with, for example, a device ID, and the standby controller 22 determines which virtual IP address to activate based on the device ID. do it.

As a result of the standby controller 22 enabling the virtual IP address "172.16.10.1" of the first active controller 21A, for example, the monitoring device 1 or the monitoring point has the virtual IP address "172.16.10". . 1” is now transmitted to the standby system controller 22 . In other words, the first operating system controller 21A is switched, and the controller 2 with the device ID 1113, which was operating as the standby system controller 22 in the normal state, now operates as the first operating system controller 21A (see FIG. 3).

The standby controller 22 performs life-and-death monitoring of the active controller 21 in a normal state as shown in FIG. 2 (see FIG. 2). Specifically, for example, the standby controller 22 transmits a survival confirmation command to each of the first active controller 21A and the second active controller 21B at a preset cycle. The first active controller 21A and the second active controller 21B to which the survival confirmation command has been transmitted transmit a response command to the survival confirmation command to the standby controller 22 upon receiving the survival confirmation command.
If a failure occurs in the active controller 21, the failed active controller 21 cannot send a response command. The standby controller 22 determines that a failure has occurred in the active controller 21 by not receiving the response command. Here, since a failure has occurred in the first operating system controller 21A, the standby system controller 22 determines that a failure has occurred in the first operating system controller 21A because the response command is not transmitted from the first operating system controller 21A. judge.
Note that the transmission and reception of the existence confirmation command and the transmission and reception of the response command between the controllers 2 described above are performed using unique IP addresses.

When switching to the first active controller 21A, the standby controller 22 acquires the controller information of the first active controller 21A before the failure, which is stored in the storage device 4 . Then, the standby controller 22 uses the acquired controller information to monitor or control the monitoring points as the first active controller 21A.
Since the first active controller 21A stores the controller information in the storage device 4 at a preset cycle, the standby controller 22 receives the controller information from the storage device 4 before the failure as described above. The controller information of the first operating system controller 21A can be taken over, and the monitoring point can be monitored or controlled on behalf of the first operating system controller 21A.

In the failure state, when the standby controller 22 validates the virtual IP address that has been disabled and switches to the first active controller 21A to start operation, the standby controller 22 is in the disabled state and the failure occurs. The generated virtual IP address of the active controller 21 other than the first active controller 21A is deleted. Specifically, as shown in FIG. 3, the standby controller 22 activates the virtual IP address "172.16.10.1" and deletes the virtual IP address "172.16.10.2". . However, this is only an example, and even if the standby controller 22 comes to work as the first working controller 21A, the working controllers 21 other than the faulty working controller 21 that has been disabled may be held in an invalid state.

When the standby controller 22 makes the virtual IP address of the first active controller 21A valid when switching to the first active controller 21A, the standby controller 22 activates the monitoring device 1 and the Information for communicating with itself (standby controller 22) is transmitted to the monitoring point. Specifically, for example, the standby controller 22 transmits GARP (Gratuitous ARP) to the monitoring device 1 and the monitoring point, and transmits an instruction to update the ARP cache. Upon receiving GARP, the monitoring device 1 and the monitoring point update the ARP table, and the MAC address of the standby controller 22 is set as the virtual IP address of the ARP table.
Therefore, even if a failure occurs in the first active controller 21A, the monitoring device 1 and the monitoring point will continue to communicate using the virtual IP address "172.16.10.1" without changing until the failure occurs. I do. Therefore, the monitoring device 1 and the monitoring point communicate with the controller 2 using the standby controller 22 as the first active controller 21A without being aware that the standby controller 22 has been switched to the first active controller 21A. It can be performed. In other words, the administrator or the like does not need to take any measures against the switching of the first active controller 21A for the monitoring device 1 and monitoring points.

The first active controller 21A (controller 2 with device ID 1111) in which a failure has occurred is, for example, temporarily disconnected from the facility monitoring system by an administrator or the like, and the administrator or the like repairs the first active controller 21A. I do. After the repair is completed, the administrator or the like connects the first active controller 21A to the facility monitoring system again.
In this case, the administrator or the like connects the repaired first active controller 21A as the standby controller 22 to the facility monitoring system. That is, in the post-restoration state, the controller 2 with the device ID 1111 becomes the standby controller 22 (see FIG. 4).
By doing so, the administrator or the like can omit switching work such as switching the controller 2 with the device ID 1113, which has been switched from the standby controller 22 to the first active controller 21A, to the standby controller 22 again. can be done.

A configuration example of the controller 2 according to the first embodiment will be described.
FIG. 5 is a block diagram showing a configuration example of the controller 2 according to the first embodiment.
In FIG. 5, FIG. 5A shows a configuration example of the active controller 21, and FIG. 5B shows a configuration example of the standby controller 22. As shown in FIG.
In FIG. 5, for the sake of simplification of explanation, the operating system controller 21 and the standby system controller 22 are configured to function when the active controller 21 and the standby system controller 22, respectively. Although only the components for performing the functions are shown, the active controller 21 and the standby controller 22 basically have the same configuration. The active controller 21 also includes components included in the standby controller 22 as shown in FIG. 5B, and the standby controller 22 also includes components included in the active controller 21 as illustrated in FIG. 5A. there is
The controller 2 is executed by program processing using a CPU based on software. The controller 2 also has an input interface device (not shown) and an output interface device (not shown) that communicate with other controllers 2 or external devices such as the monitoring device 1 .

As shown in FIG. 5A, the active controller 21 includes a survival confirmation command receiving section 211, a response command transmitting section 212, a communication section, a storage control section 214, and a storage section. Hereinafter, the communication section of the active controller 21 is also referred to as a first communication section 213 . Also, the storage unit of the operation system controller 21 is also referred to as a first storage unit 215 .

The survival confirmation command receiving unit 211 receives the survival confirmation command transmitted from the standby controller 22 .
Upon receiving the survival confirmation command, the survival confirmation command reception unit 211 outputs information to the effect that the survival confirmation command has been received to the response command transmission unit 212 .

When information indicating that the survival confirmation command has been received is output from the survival confirmation command reception unit 211 , the response command transmission unit 212 transmits a response command in response to the survival confirmation command to the standby controller 22 . At this time, the response command transmitting unit 212 adds information that can identify the active controller 21, such as the device ID, to the response command.

The first communication unit 213 communicates with the monitoring point or the monitoring device 1 .
Specifically, the first communication unit 213 collects monitoring point data from monitoring points, for example. The first communication unit 213 causes the first storage unit 215 to store the collected monitoring point data. Also, the first communication unit 213 receives, for example, a control instruction for a monitoring point transmitted from the monitoring device 1 . The first communication unit 213 causes the first storage unit 215 to store information about the control performed on the monitoring point as necessary.

The storage control unit 214 causes the storage device 4 to store the controller information stored in the first storage unit 215 at a preset cycle.

The first storage unit 215 includes a memory or the like, and stores controller information.
In Embodiment 1, the first storage unit 215 is assumed to be provided in the operation system controller 21, but this is only an example, and the first storage unit 215 is stored in the operation system controller outside the operation system controller 21. 21 and storage device 4 may be provided at a location that can be referenced.
Although not shown in FIG. 5A, the operating system controller 21 further includes a control unit. The control unit controls the monitoring points based on the control instruction received by the first communication unit 213, for example.

As shown in FIG. 5B, the standby controller 22 includes a survival confirmation command transmission unit 221, a response command reception unit 222, a survival determination unit 223, a switching control unit 224, a communication unit, a data acquisition unit 226, and a storage unit. . Hereinafter, the communication section of the standby controller 22 is also referred to as a second communication section 225 . Also, the storage unit of the standby controller 22 is also referred to as a second storage unit 227 .

The survival confirmation command transmission unit 221 transmits a survival confirmation command to each active controller 21 at a preset cycle.

The response command receiving unit 222 receives, from each of the active controllers 21 , a response command in response to the survival confirmation command transmitted by the survival confirmation command transmission unit 221 .
Response command reception section 222 outputs the received response command to survival determination section 223 .

The survival determination unit 223 determines whether or not any of the active controllers 21 has failed. Specifically, when the response command receiving unit 222 does not receive a response command from any of the active controllers 21, the survival determination unit 223 determines that the active controller 21 that does not receive the response command has failed. determined to be The survival determination unit 223 can identify the active controller 21 that does not receive the response command from the device ID given to the response command received by the response command reception unit 222 .
When determining that a failure has occurred in any of the active controllers 21, the survival determination unit 223 transmits failure occurrence information indicating that a failure has occurred in the active controller 21 to the switching control unit 224 and data acquisition. Output to unit 226 . The failure occurrence information includes information on the device ID of the active controller 21 determined to have a failure.

When failure occurrence information is output from survival determination unit 223, switching control unit 224 enables the virtual IP address of active controller 21 determined by survival determination unit 223 to have a failure.
At this time, the switching control unit 224 may delete the virtual IP address of the active controller 21 that is not in the valid state, or may store the virtual IP address in the invalid state. The standby controller 22 stores the virtual IP address of the active controller 21 in the second storage unit 227, for example.
In addition, the switching control unit 224 transmits information for communicating with itself (standby controller 22) as the address of the controller 2 to the monitoring device 1 and the monitoring point via the second communication unit 225 described later. do. Specifically, for example, the switching control unit 224 transmits GARP to the monitoring device 1 and the monitoring point via the second communication unit 225, and transmits an instruction to update the ARP cache.
By the switching control unit 224 performing the above operation, the standby system controller 22 is switched to the active system controller 21 that has determined that a failure has occurred.

The second communication unit 225 communicates with the monitoring point and the monitoring device 1 using the virtual IP address activated by the switching control unit 224 .

When failure occurrence information is output from the survival determination unit 223, the data acquisition unit 226 refers to the storage device 4 and acquires controller information of the active controller 21 determined to have a failure. Note that the data acquisition unit 226 may acquire the minimum controller information necessary for monitoring or controlling the monitoring points when the standby controller 22 is switched to the active controller 21 .

The second storage unit 227 stores the virtual IP address of the active controller 21 and the like.
In Embodiment 1, the second storage unit 227 is provided in the standby controller 22, but this is only an example, and the second storage unit 227 is provided in the standby controller outside the standby controller 22. 22 may be provided at a location where it can be referenced.

Although not shown in FIG. 5B, the standby controller 22 further includes a control unit.
For example, the survival determination unit 223 determines that a failure has occurred in one of the active controllers 21, and the switching control unit 224 determines that a failure has occurred in the active controller 21. After switching to the active controller 21 with the virtual IP address enabled, when the data acquisition unit 226 acquires the controller information, the monitoring point is controlled based on the acquired controller information.

Next, operation of the facility monitoring system according to Embodiment 1 will be described.
FIG. 6 is a flow chart for explaining the operation of the facility monitoring system according to the first embodiment.
The standby system controller 22 performs life-and-death monitoring of the active system controller 21 (step ST601). Specifically, at a preset cycle, the life confirmation command transmission unit 221 of the standby controller 22 transmits a life confirmation command to each of the active controllers 21 .
The survival confirmation command receiving unit 211 of the active controller 21 receives the survival confirmation command transmitted from the standby controller 22, and the response command transmission unit 212 sends a response to the survival confirmation command to the standby controller 22. Send command.

The survival determination unit 223 of the standby controller 22 determines whether or not any of the active controllers 21 has failed (step ST602). If the response command receiving unit 222 does not receive a response command from any of the active controllers 21, the survival determination unit 223 determines that the active controller 21 that does not receive the response command is faulty.
On the other hand, if the survival determination unit 223 receives response commands from all the active controllers 21, it determines that no fault has occurred in the active controllers 21. FIG.

In step ST602, if survival determination section 223 determines that no failure has occurred in active controller 21 (“NO” in step ST602), active controller 21 and monitoring device 1 monitor monitoring points. Alternatively, control is performed (step ST603). At this time, the active controller 21 and the monitoring point, and the active controller 21 and the monitoring device 1 communicate using the virtual IP address of the active controller 21 .

When the preset period comes (“YES” in step ST604), the storage control unit 214 of the operating system controller 21 stores the controller information stored in the first storage unit 215 in the storage device 4 ( step ST605). Then, the process returns to step ST601.
If the preset cycle has not been reached (“NO” in step ST604), the memory control unit 214 of the operating system controller 21 skips step ST604 and returns to step ST601.

On the other hand, in step ST602, if survival determination section 223 of standby controller 22 determines that a failure has occurred in active controller 21 (“YES” in step ST602), in other words, survival determination section 223 However, if no response command is received from any of the active controllers 21 , the standby controller 22 switches the controller 2 . Specifically, in the standby controller 22, the switching control unit 224 enables the virtual IP address of the active controller 21 determined to have a failure. Then, the switching control unit 224 transmits information for communicating with itself as the address of the controller 2 to the monitoring device 1 and the monitoring points via the second communication unit 225 which will be described later. The second communication unit 225 communicates with the monitoring point and the monitoring device 1 using the virtual IP address activated by the switching control unit 224 .
Then, the data acquisition unit 226 refers to the storage device 4 and acquires the controller information of the active controller 21 determined to be faulty.
Then, it progresses to step ST606.

Thus, in the facility monitoring system according to the first embodiment, for two or more active controllers 21, one standby controller holding the virtual IP addresses of all the two or more active controllers 21 is provided. 22 was prepared. Then, the one standby controller 22 performs life-and-death monitoring of the active controllers 21, and when a failure occurs in any of the active controllers 21, the one standby controller 22 Redundancy is realized by enabling switching to the active system controller 21 that has occurred.

When attempting to adopt a redundant mechanism for the controllers 2 that monitor or control the monitoring points using the above-described conventional technology, the number of controllers 2 twice as many as that of the active controllers 21 is simply replaced with the standby controllers. 22 should be prepared. This results in equipment costs.
Also, the number of monitoring points that can be monitored or controlled by one active controller 21 is limited. For example, when the facility monitoring system is applied to a large-scale facility, the number of active controllers 21 must also be increased in order to monitor or control a huge number of monitoring points installed within the facility. In this case, the number of standby system controllers 22 to be prepared is twice that of the active system controllers 21, which further increases the equipment cost.

On the other hand, the controller 2 is a built-in device, and has a lower probability of failure than a device such as a PC (Personal Computer) intended for general-purpose use and intended to perform a wide variety of functions. Some controllers 2 guarantee such quality as continuous operation for 10 years, for example.
In spite of this, it can be said that preparing the number of standby system controllers 22 twice as many as the number of active system controllers 21 requires unnecessary equipment costs for the standby system controllers 22 .

On the other hand, in the facility monitoring system according to the first embodiment, for two or more active controllers 21, one standby controller holding the virtual IP addresses of all the two or more active controllers 21 is provided. 22, the facility monitoring system can be duplicated. Thus, the facility monitoring system according to Embodiment 1 can continue monitoring and controlling monitoring points even if a failure occurs in one of the two or more active controllers 21 .
As described above, the controller 2, which is a built-in device, has a low probability of failure. Therefore, the possibility of a plurality of active controllers 21 failing at the same time is extremely low.
The facility monitoring system according to Embodiment 1 can realize cost reduction by making use of the high reliability of the controller 2 .

Further, as described above, in the facility monitoring system according to the first embodiment, the active controller 21 uses a valid virtual IP address to communicate with the monitoring device 1 and the monitoring point, and monitor or monitor the monitoring point. control.
When a failure occurs in the active controller 21, the monitoring device 1 and the monitoring point use the same virtual IP address before the failure occurs and after the active controller 21 is switched due to the failure. Since communication is performed with the active controller 21, there is no need to be aware that the active controller 21 has been switched. In other words, the administrator or the like does not need to take any measures against the switching of the first active controller 21A for the monitoring device 1 and monitoring points.

In the first embodiment described above, the standby controller 22 transmits a survival confirmation command to the active controller 21, and the response command to the survival confirmation command is not transmitted from the active controller 21. It is determined that a fault has occurred in the active controller 21 .
However, this is only an example, and the standby controller 22 can also determine that a failure has occurred in the active controller 21 by other methods.
Specifically, the operating system controller 21a (see FIG. 7 described later) detects an abnormality in itself (the operating system controller 21a), and notifies the standby system controller 22a (see FIG. 7 described later) of the detection of the abnormality. to notify. Then, the standby controller 22a may determine that a failure has occurred in the active controller 21a upon receiving notification from the active controller 21a that an abnormality has been detected.

FIG. 7 shows that in the facility monitoring system according to the first embodiment, the active controller 21a detects its own abnormality and notifies the standby controller 22a of the occurrence of the abnormality. FIG. 7A is a diagram showing a configuration example of an active controller 21a and a standby controller 22a when it is determined that a failure has occurred in the active controller 21a based on a notification from the controller 21a; FIG. FIG. 7B is a diagram showing a configuration example of an active controller 21a, and FIG. 7B is a diagram showing a configuration example of a standby controller 22a.

In FIG. 7A, the same reference numerals are assigned to the same components as those of the active controller 21 described with reference to FIG. 5A, and redundant descriptions are omitted.
Also, in FIG. 7B, the same reference numerals are assigned to the same configurations as those of the standby controller 22 described using FIG. 5B, and redundant descriptions will be omitted.

Compared with the active controller 21 described with reference to FIG. 5A, the active controller 21a shown in FIG. The difference is that the
The anomaly detection unit 216 detects its own anomaly.
When detecting an abnormality, the abnormality detection unit 216 outputs information to the effect that the abnormality has been detected to the abnormality notification unit 217 .
The anomaly notification unit 217 transmits anomaly occurrence notification information for notifying the occurrence of an anomaly to the standby controller 22a. The abnormality occurrence notification information includes information that can identify the active controller 21a that has transmitted the abnormality occurrence notification information.
It should be noted that transmission of abnormality occurrence notification information from the abnormality notification unit 217 to the standby controller 22a is performed using a unique IP address.

The standby controller 22a shown in FIG. 7B is different from the standby controller 22 described with reference to FIG. different.
The abnormality notification receiving unit 228 receives abnormality occurrence notification information transmitted from the active controller 21a.
When the abnormality notification reception unit 228 receives the abnormality notification information, the abnormality notification reception unit 228 outputs the abnormality notification information to the survival determination unit 223a.

In the standby system controller 22a, the existence determining unit 223a determines that a failure has occurred in the active controller 21a when the abnormality notification information is output from the abnormality notification receiving unit 228. FIG. It should be noted that which active controller 21a has a fault can be identified from the fault occurrence notification information.

The operation of the facility monitoring system when the active controller 21a and the standby controller 22a are configured as shown in FIGS. 7A and 7B, respectively, is the operation described with reference to FIG. Only the specific operation contents of are changed.
Specifically, in step ST601, the standby controller 22a performs life-and-death monitoring of the active controller 21a based on whether or not it has received abnormality notification information from the active controller 21a.
Then, in step ST602, when the standby controller 22a receives the abnormality occurrence notification information from the active controller 21a, it determines that a failure has occurred in the active controller 21a (in the case of "YES" in step ST602). If no abnormality notification information is received from the system controller 21a, it is determined that no failure has occurred in the active system controller 21a ("NO" in step ST602).
Since the operations of steps ST603 to ST605 have already been explained, redundant explanations will be omitted.

In this way, the operating controller 21a detects its own abnormality and notifies the standby controller 22a of the detection of the abnormality. Upon receiving the notification, it may be determined that a failure has occurred in the active controller 21a.
Further, in the facility monitoring system according to Embodiment 1, in addition to the configuration described with reference to FIG. 217, and the standby controller 22 may further include an anomaly notification receiving unit 228 as described with reference to FIG. 7B in addition to the configuration described with reference to FIG. 5B.

Further, in Embodiment 1 described above, the facility monitoring system includes the storage device 4, and the operating system controller 21 stores the controller information in the storage device 4 at a preset cycle.
However, this is only an example, the facility monitoring system does not include the storage device 4, and the operating system controller 21 stores the controller information in the first storage unit 215 of itself (the operating system controller 21). may be used only.
For example, when the active controller 21 uses only the current monitoring point data for monitoring or controlling the monitoring points, the information that the active controller 21 should hold is only the current monitoring point data. , the capacity of the first storage unit 215 included in the active controller 21 is sufficient for storing the current monitoring point data. In such a case, the facility monitoring system does not necessarily have the storage device 4 .
When a failure occurs in the active controller 21, the standby controller 22, when switched to the failed active controller 21, collects current monitoring point data from monitoring points, and performs monitoring based on the collected monitoring point data. Continue to monitor or control points.

Further, in Embodiment 1 described above, the controller 2 may include a higher controller and a lower controller. The upper controller is connected to the monitoring device 1 via the upper network, and monitors or controls the lower controllers connected via the lower network according to the control by the monitoring device 1 . The subordinate controller is connected to the superordinate controller via the subordinate network, and controls a plurality of monitoring points connected via the subordinate network according to control by the superordinate controller. In this case as well, two or more active controllers 21 and one standby controller 22 as described in the first embodiment are prepared as the upper controller and the lower controller, and one standby controller 22 is prepared. However, the life-and-death monitoring of the active controllers 21 is performed, and if a failure occurs in any of the active controllers 21, the standby controller 22 switches to the failed active controller 21. A configuration that achieves duplication by making it possible can be applied.

As described above, according to Embodiment 1, a plurality of controllers 2 connected to a plurality of monitoring points (devices 3) in the facility via the network, and a plurality of controllers 2 connected to the plurality of controllers 2 via the network In the facility monitoring system provided with the monitoring device 1, the plurality of controllers 2 includes a plurality of active controllers 21 and one standby controller 22, and the plurality of active controllers 21 are: Each has a valid virtual IP address, and uses the valid virtual IP address to communicate with the monitoring point and the monitoring device 1. is held in an invalid state, and when a failure occurs in one of the plurality of active controllers 21, the virtual IP address of the active controller 21 in which the failure occurred, which has been in an invalid state, is made valid, and the valid It is configured to communicate with the monitoring point and the monitoring device 1 using the virtual IP address in the state. In this way, one standby controller 22 performs life-and-death monitoring of a plurality of active controllers 21, and when a failure occurs in any of the active controllers 21, the single standby controller 22 However, by making it possible to switch to the active controller 21 in which a failure has occurred, it is possible to realize redundancy without requiring double the number of standby controllers as the active controller.

The facility monitoring system also includes a storage device 4 connected to a plurality of controllers 2 via a network. When a failure occurs in one of the plurality of active controllers 21 , the controller 22 acquires data related to the failed active controller 21 from the storage device 4 . As a result, the standby controller 22 can take over the controller information necessary for the active controller 21 before the failure to monitor or control the monitoring point via the storage device 4, and the active controller 21 can It can switch to monitor or control watchpoints.

It should be noted that, within the scope of the present invention, any component of the embodiment can be modified or any component of the embodiment can be omitted.

1 monitoring device 2 controllers 21, 21a operating system controller 21A first operating system controller 21B second operating system controllers 22, 22a standby system controller 3 device 4 storage device 211 survival confirmation command receiving unit 212 response command transmitting unit 213 first communication unit 214 Memory control unit 215 First storage unit 216 Abnormality detection unit 217 Abnormality notification unit 221 Existence confirmation command transmission unit 222 Response command reception units 223, 223a Existence determination unit 224 Switching control unit 225 Second communication unit 226 Data acquisition unit 227 Second Storage unit 228 Abnormality notification receiving unit

Claims (6)

In a facility monitoring system comprising a plurality of controllers connected via a network to a plurality of monitoring points within a facility, and a monitoring device connected to the plurality of controllers via a network,
The plurality of controllers includes a plurality of active controllers and one standby controller, and the plurality of active controllers are effective virtual controllers different from each other among the plurality of active controllers. having an IP address and communicating with the monitoring point and the monitoring device using the valid virtual IP address;
The one standby controller maintains virtual IP addresses of the plurality of active controllers , which are different from each other among the plurality of active controllers , in an invalid state. When a failure occurs in one of the plurality of active controllers, among the virtual IP addresses that are different from each other among the plurality of active controllers, the virtual IP address of the active controller in which the failure has occurred is disabled. A facility monitoring system, wherein an IP address is set in a valid state, and communication is performed with the monitoring point and the monitoring device using the virtual IP address set in the valid state. A storage device connected to the plurality of controllers via a network,
the storage device stores information about the plurality of active controllers;
When the failure occurs in one of the plurality of active controllers, the one standby controller acquires data related to the failed active controller from the storage device. The facility monitoring system according to claim 1. The plurality of active controllers collect monitoring point data from the monitoring points,
3. The facility monitoring system according to claim 2, wherein the information about the plurality of active controllers stored in the storage device includes the monitoring point data. The plurality of active controllers are
a survival confirmation command receiving unit that receives a survival confirmation command transmitted from the one standby controller;
a response command transmission unit that transmits a response command in response to the survival confirmation command received by the survival confirmation command reception unit;
The one standby controller is
a survival confirmation command transmission unit that transmits the survival confirmation command to each of the plurality of active controllers;
a response command receiving unit that receives the response command responding to the life confirmation command transmitted by the life confirmation command transmission unit from each of the plurality of active controllers;
If the response command receiving unit does not receive the response command from any one of the plurality of active controllers, the failure occurs in the active controller that does not receive the response command. a survival determination unit that determines that
A switching control unit that, when the life determination unit determines that the failure has occurred, sets the virtual IP address of the active controller that the life determination unit has determined that the failure has occurred to the valid state. and,
and a communication unit that communicates with the monitoring point and the monitoring device using the virtual IP address that is activated by the switching control unit. or the facility monitoring system according to 1. each of the plurality of operating system controllers includes an abnormality detection unit that detects an abnormality of the plurality of operating system controllers themselves;
an anomaly notification unit that notifies the one standby controller of the occurrence of the anomaly when the anomaly detection unit detects the anomaly;
The one standby controller includes a survival determination unit that, when notified of the occurrence of the abnormality from the abnormality notification unit, determines that the failure has occurred in the active controller that has notified the occurrence of the abnormality. ,
a switching control unit that activates the virtual IP address of the active controller determined by the survival determining unit that the failure has occurred;
and a communication unit that communicates with the monitoring point and the monitoring device using the virtual IP address that is activated by the switching control unit. or the facility monitoring system according to 1. A communication method for a facility monitoring system comprising a plurality of controllers connected via a network to a plurality of monitoring points within a facility, and a monitoring device connected to the plurality of controllers via a network,
The plurality of controllers includes a plurality of active controllers and one standby controller, and the plurality of active controllers are effective virtual controllers different from each other among the plurality of active controllers. having an IP address and communicating with the monitoring point and the monitoring device using the valid virtual IP address;
The one standby controller maintains virtual IP addresses of the plurality of active controllers , which are different from each other among the plurality of active controllers , in an invalid state. When a failure occurs in one of the plurality of active controllers, among the virtual IP addresses that are different from each other among the plurality of active controllers, the virtual IP address of the active controller in which the failure has occurred is disabled. A communication method for a facility monitoring system, comprising the steps of validating an IP address and using the validated virtual IP address to communicate with the monitoring point and the monitoring device.

Images