WO2025062549A1 - Interval calculation device and interval calculation method - Google Patents

Abstract

This interval calculation device (20), which is used in a redundancy system that performs switching processing from an acting device (40) to a standby device (50), in accordance with a failure of the acting device (40), has an interval calculation unit (21) that calculates a transmission interval Isb that is an interval at which survival confirmation messages are transmitted to the standby device (50). The interval calculation unit (21) calculates the transmission interval Isb by using, as input data, a switching success rate Preq that is a request value for the probability that the switching processing from the acting device (40) to the standby device (50) succeeds due to the standby device (50) being in the survival state, and an average failure interval Derr of the standby device (50).

Description

Distance calculation device and distance calculation method

The present invention relates to a distance calculation device and a distance calculation method.

As the number of services that use networks increases, the demand for improved reliability of network systems is growing year by year. However, systems are made up of a variety of devices, and it is difficult to completely avoid equipment failures. For this reason, methods of making systems redundant are widely adopted to improve system reliability and continue to provide services even when equipment failures occur (e.g., Non-Patent Document 1).

A network system that supports system redundancy comprises an acting device that operates normally, and a standby device that takes over processing in the event of a failure of the acting device. Technology for detecting failures is implemented in the acting device, and when a system failure is detected, the network service is continued using the standby device. For this reason, settings for taking over the processing of the acting device are preregistered in the standby device.

In this case, a cause of service interruption may occur when the standby device is also broken when processing is switched to the standby device. Therefore, it is effective to apply a technique (such as Non-Patent Documents 2 and 3) to the standby device to periodically check whether it is alive or not.
The periodic liveness confirmation messages are known as heartbeats, hellos, and keep-alives. The system monitoring function creates liveness confirmation messages and sends them to the standby device. When a response message to the liveness confirmation message is received from the standby device, the standby device is considered to be alive and will take over processing in the event of a failure of the active device.

Panasonic, "Link Aggregation Function", [online], [searched on September 12, 2023], Internet <URL: https://panasonic.co.jp/ew/pewnw/product/detail/22.html#:~:text=%E3%83%AA%E3%83%B3%E3%82%AF%E3%82%A2%E3%82%B0%E3%83%AA%E 3%82%B2%E3%83%BC%E3%82%B7%E3%83%A7%E3%83%B3%EF%BC%88Link%20Aggregation%EF%BC%89%E3%81%A8,% E6%89%B1%E3%81%86%E6%8A%80%E8%A1%93%E3%82%92%E8%A8%80%E3%81%84%E3%81%BE%E3%81%99%E3%80%82〉 Cisco systems, "Troubleshooting HSRP issues in Catalyst switch networks", [online], [Retrieved September 12, 2023], Internet <URL: https://www.cisco.com/c/ja_jp/support/docs/ip/hot-standby-router-protocol-hsrp/10583-62.pdf> Thomas Eri, Eric Barcelo, Cloud Computing 2nd edition, Pearson, Aug. 2023 (Early release), chapter14 Advanced Cloud Architecture

The transmission interval of the keep-alive message must be set to an appropriate interval, neither too wide nor too narrow. The keep-alive message transmission interval is evaluated based on the following two indices.
(Index 1) The "accuracy" of the standby device's survival confirmation improves as the number of survival confirmation messages sent increases. In other words, by increasing the number of messages and increasing the frequency of survival confirmation, the status of the standby device can be known sooner. This makes it possible to quickly perform recovery work when an error occurs in the standby device, and to quickly select and switch to a standby device other than the one being monitored.
(Indicator 2) The "load" on the system monitoring function is reduced as the number of alive-confirmation messages sent is reduced. Because the system monitoring function uses a processor to process alive-confirmation messages and response messages, it is important not to make the processor load too high. Because the processor load is proportional to the increase in the number of messages, an overloaded state will cause delays in message transmission and response processing, as well as errors.
In order to achieve a good balance between these two indicators, it is necessary to reduce the number of transmissions of liveness confirmation messages within a range that ensures the accuracy of liveness confirmation.

FIG. 10 is an explanatory diagram showing the transmission intervals of the keep-alive messages.
Statuses 210, 220, and 230 respectively show time series lines (time progresses toward the right in the figure) of an acting device (illustrated as "Act") and a standby device (illustrated as "Sby"). Events occurring on each time series line are illustrated as follows:
- Successful response to a survival confirmation message (successful response 216, etc., white triangle mark)
-Failed response to a survival confirmation message (black triangle mark such as response failure 218).
・Occurrence of a system failure (explosion mark such as failure occurrence 211)
In the following explanation, the time indicated by the black triangle mark is the time when an equipment failure was detected due to a failure to respond to a survival confirmation message, and also the time when the equipment failure was instantly restored (at the same time as it was detected) by system switching or the like.

A situation 210 shows an excessive number of survival confirmation messages. A failure 211 in an acting device is detected by a response failure 212, and at the time of detection a switchover signal to a standby device is transmitted (indicated by a dashed vertical line in the figure).
On the other hand, in the standby device, due to the high frequency of survival checks, the occurrence of a failure 217 is immediately detected by a response failure 218. As a result, the failure recovery in the standby device is completed immediately, and the system switching is successful when a switching signal is subsequently received. However, due to the high frequency of survival checks in the standby device, a high load state continues even during normal times.
In other words, although the situation 210 satisfies the "accuracy" of (index 1), the "load" of (index 2) is rated low (high load).

A situation 220 shows a situation where there are too few survival confirmation messages. An occurrence of a failure 221 in the acting device is detected by a response failure 222, and at the time of detection a switchover signal to the standby device is transmitted (indicated by a dashed vertical line in the figure).
On the other hand, in the standby device, due to infrequent survival checks (such as success response 226), there is an interval (detection delay) between failure occurrence 227 and response failure 228. As a result, the switching signal arrives before the failure is restored in the standby device, causing system switching to fail. However, due to infrequent survival checks in the standby device, the load on the standby device remains low during normal operation.
In other words, although the situation 220 does not satisfy the "accuracy" of (index 1), the "load" of (index 2) is rated high (low load).

A state 230 shows a state in which the number of survival confirmation messages is appropriate. A failure 231 in the acting device is detected by a response failure 232, and at the time of detection a switchover signal to the standby device is transmitted (indicated by a dashed vertical line in the drawing).
On the other hand, in the standby device, a failure occurrence 237 is detected by a response failure 238 due to a medium frequency survival check 236. As a result, the system switching is successful by receiving a switching signal after the standby device has completed failure recovery. Furthermore, the load on the standby device is not high even during normal operation due to the medium frequency survival check.
In other words, the situation 230 satisfies the "accuracy" of (index 1), while the "load" of (index 2) is also rated as good (medium load).

On the other hand, the conventional methods described in Non-Patent Documents 2 and 3 transmit liveness confirmation packets at a fixed transmission interval specified by the system operator without considering the durability of the system or the load on the system monitoring function. As a result, excessive liveness confirmation messages, as in situation 210, and insufficient liveness confirmation messages, as in situation 220, are transmitted.

The main objective of the present invention is to calculate a transmission interval that ensures the accuracy of the survival confirmation message while reducing the message transmission load.

In order to solve the above problems, the interval calculation device of the present invention has the following features.
The present invention provides an interval calculation device used in a redundancy system that performs a switching process from an acting device to a standby device when an acting device fails, comprising:
the interval calculation device has an interval calculation unit that calculates a transmission interval, which is an interval at which a survival confirmation message is transmitted to the standby device;
The interval calculation unit,
The transmission interval is calculated using as input data a switching success rate, which is a required value for the probability that the switching process from the acting device to the standby device will be successful because the standby device is in a survival state, and the mean time between failures of the standby device.

According to the present invention, it is possible to calculate a transmission interval that ensures the accuracy of the survival confirmation message while reducing the message transmission load.

FIG. 1 is a configuration diagram of a monitoring system according to an embodiment of the present invention. FIG. 2 is an explanatory diagram of system switching executed by the monitoring system according to the present embodiment. 4 is a table showing an example of an interval database according to the present embodiment. FIG. 2 is a hardware configuration diagram of each device constituting the monitoring system according to the embodiment. 10 is a flowchart showing a monitoring process according to a request from one business operator according to the present embodiment. 11 is a graph for explaining a process for calculating a transmission interval of a keep-alive message according to the present embodiment; 1 is a time series graph of the fault detection probability according to the present embodiment. 10 is a flowchart showing a monitoring process according to requests from a plurality of businesses according to the present embodiment. 13 is a flowchart showing a monitoring process when a cancellation occurs at some of the multiple businesses according to the present embodiment. FIG. 11 is an explanatory diagram showing a transmission interval of a keep-alive message.

Below, one embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram showing the configuration of a monitoring system 100.
The monitoring system 100 is configured by connecting a business operator terminal 10, an interval calculation device 20, a monitoring device 30, an acting device 40, and a standby device 50 via a network.
The combination of the acting device 40 and the standby device 50 is an example of a redundant system. When the acting device 40 is normal, the acting device 40 is in charge of various processes. When the acting device 40 fails, a switching process is executed so that the standby device 50 takes over the various processes that were in charge of the acting device 40.
In the following embodiment, an example will be described in which the redundant system monitored by the monitoring system 100 is applied to a network system in which the acting device 40 and the standby device 50 are connected via a network. On the other hand, the redundant system of the embodiment can be applied to a wider range of systems such as servers and computing systems.

The monitoring device 30 detects a failure of the acting device 40 and also confirms the survival of the standby device 50 by sending a survival confirmation message.
The interval calculation device 20 is used in a redundant system that performs switching processing from the acting device 40 to the standby device 50 in the event of a failure of the acting device 40.
The interval calculation device 20 includes an interval calculation unit 21 that calculates a transmission interval Isb, which is the interval at which the monitoring device 30 transmits a survival confirmation message to the standby device 50 .
The operator terminal 10 notifies the interval calculation device 20 of a request from the operator, which is a parameter used to calculate the transmission interval Isb.
The monitoring device 30 manages the transmission interval Isb notified from the interval calculation device 20 in an interval database 31, and transmits a survival confirmation message to the standby device 50 from a transmission unit 32 in accordance with the transmission interval Isb. Note that the interval calculation device 20 and the monitoring device 30 may be configured as separate devices, or may be configured as separate functional modules within the same device.

Here, the switching success rate Preq is the survival probability of the standby device 50 at the time of switching processing from the acting device 40 to the standby device 50. The interval calculation unit 21 calculates the transmission interval Isb that is the minimum frequency for reducing the load while satisfying the required value of the switching success rate Preq requested by the operator terminal 10. For example, if a switching success rate Preq = 99.999% is requested, the interval calculation unit 21 satisfies the request by setting the transmission interval Isb = 12 seconds (details such as the calculation formula will be described later).

FIG. 2 is an explanatory diagram of system switching executed by the monitoring system 100. As shown in FIG.
A state 101 shows a state before switching from the acting device 40 to the standby device 50. The monitoring device 30 monitors the acting device 40 by any method such as transmitting a survival confirmation message to the acting device 40 (S101). In addition, the monitoring device 30 transmits a survival confirmation message to the standby device 50 at a transmission interval Isb (S102).
A status 102 shows a status at the time of switching from an acting device 40 to a standby device 50. The monitoring device 30 detects that a failure has occurred in the acting device 40 being monitored (S111). Then, the monitoring device 30 instructs the standby device 50 to take over processing from the failed acting device 40 (S112).

FIG. 3 is a table showing an example of the interval database 31. As shown in FIG.
Here, a table that can accommodate not only the case where one business entity uses one standby device 50, but also the case where a plurality of business entities share one standby device 50 will be described.
The interval database 31 associates, for each operator ID assigned to each operator (for each operator terminal 10), the operator-specific transmission interval Isb required by that operator with the transmission interval (set interval) when transmitting a survival confirmation message to one standby device 50 by integrating the operator-specific transmission interval Isb. Note that the operator ID for each operator in the interval database 31 may be replaced with an ID for each virtual network or an ID for each service.

First, a certain standby device 50 starts in an unused state. The interval database 31A indicates that when a first operator (SP1) applies to use the standby device 50, the transmission interval Isb = 10 [msec] calculated by the interval calculation unit 21 for the operator (SP1) will be adopted as the set interval = 10 [msec].

Next, let us assume that two more operators (SP2, SP3) apply to share the same standby device 50 from the state of the interval database 31A. At this time, the interval database 31B adds a transmission interval Isb = 5 [msec] for the operator (SP2) and a transmission interval Isb = 20 [msec] for the operator (SP3) to the transmission interval Isb for each operator. The monitoring device 30 then adopts the transmission interval Isb = 5 [msec], which is the strictest condition (minimum value) of the total of three transmission intervals Isb for each operator in the interval database 31B, as the set interval = 5 [msec].

Then, let us assume that, based on the state of the interval database 31B, a notice has arisen that one operator (SP2) will cancel the use of the standby device 50. At this time, the transmission interval Isb = 5 [msec] for the operator (SP2) is deleted from the interval database 31B for the operator-specific transmission interval Isb. The monitoring device 30 then adopts the transmission interval Isb = 10 [msec], which is the strictest condition (minimum value) of the two operator-specific transmission intervals Isb in the interval database 31B, as the set interval = 10 [msec].

FIG. 4 is a diagram showing the hardware configuration of each device constituting the monitoring system 100. As shown in FIG.
Each device of the monitoring system 100 (operator terminal 10, interval calculation device 20, monitoring device 30, acting device 40, standby device 50) is configured as a computer 900 having a CPU 901, RAM 902, ROM 903, HDD 904, communication I/F 905, input/output I/F 906, and media I/F 907.
The communication I/F 905 is connected to an external communication device 915. The input/output I/F 906 is connected to an input/output device 916. The media I/F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (interval calculation program) loaded into the RAM 902. This program (also called an application, or an app for short) can be distributed via a communication line or can be recorded on a recording medium 917 such as a CD-ROM and distributed.

FIG. 5 is a flow chart showing a monitoring process according to a request from one business operator.
The interval calculation device 20 receives the switching success rate Preq and the mean time between failures Derr of the standby device 50 specified by the operator terminal 10 as input data (S11).
The switching success rate Preq is the probability that switching to the standby device 50 will be successful when the acting device 40 fails, and is specified as a value such as "99.999%."
The mean time between failures Derr is the mean time between failures of the standby device 50, and for example, a value such as "once a week" is specified by a network administrator, etc. Also, the reciprocal of the mean time between failures Derr (= 1 ÷ mean time between failures Derr) is defined as the mean number of failures λ (the average number of failures per unit time).

The interval calculation unit 20 calculates the transmission interval Isb from the input data in S11, and sets the calculation result in the monitoring device 30 (S12). In other words, the interval calculation unit 21 calculates the transmission interval Isb using the switching success rate Preq, which is the required value for the probability that the switching process from the acting device 40 to the standby device 50 will be successful because the standby device 50 is in a survival state, and the mean time between failures Derr of the standby device 50 as input data.

Thereafter, in steps S13 to S15, the monitoring system 100 executes monitoring processing and system switching processing.
The monitoring device 30 transmits a survival confirmation message to the standby device 50 at the set transmission interval Isb (S13). The monitoring device 30 switches to the standby device 50 upon detecting a failure in the acting device 40 (S14).
The monitoring device 30 responds to the detection of a failure in the standby device 50 detected from the survival confirmation message (S15).

6 is a graph for explaining the process (S12) for calculating the transmission interval Isb of the keep-alive message. The various symbols in this graph can be read in the same way as explained in FIG.
A failure occurrence 301 in an acting device is detected by a response failure 302, and a switchover signal is transmitted to the standby device 50 at the detection time ta (act detection time).
On the other hand, consider a case where a failure 312 occurs in the standby device 50 at occurrence time ts2 (standby occurrence time) that is a period t (survival period) that is a failure occurrence interval from detection time ts1 (standby detection time) of a success response 311 in the latest survival confirmation message before the detection time ta. Here, if the period T (switching period) is defined as the period from the detection time ts1 to the detection time ta, the survival probability Pok (standby survival probability) of the standby device 50 at the detection time ta is the probability that period t is greater than period T.

The occurrence of a failure 301 in the acting device 40 is independent of the detection time ta (the detection time ta and the detection time ts1 are uncorrelated), and is memoryless, so it follows a Poisson process (a discretized Markov process). In addition, the period T follows a uniform distribution, and the probability of the period T is (1÷transmission interval Isb).
On the other hand, the occurrence of the failure 312 of the standby device 50 is independent of the subsequent detection time (not shown in FIG. 6) and is memoryless, so it is assumed to follow a Poisson process. In addition, the period t is assumed to follow an exponential distribution and can be calculated from the Poisson process.
Here, the Poisson process is a process in which a random event occurs with a period t determined by an exponential distribution. If the period t and the average number of failures λ are given to the Poisson process, the probability density p(t) for period t can be calculated as "p(t) = λ × exp(-λt)". Therefore, the probability P[t<T] that the failure occurrence interval is period T can be calculated as "P[t<T] = 1-exp(-λT)". Note that exp(n) is a function that calculates the nth power of the base of the natural logarithm, e.

In S12 of FIG. 5, the interval calculation unit 21 calculates the transmission interval Isb based on the following (Equation 1).
Transmission interval Isb ≒ 2 × (1 – switching success rate Preq) × mean time between failures Derr … (Equation 1)
For example, in the example shown in S11 of Fig. 5, by substituting each value into (Equation 1), the transmission interval Isb is calculated to be approximately 12 seconds. Note that (60 x 24 x 7) represents one week (converted into minutes).
Transmission interval Isb ≒ 2 x (1-0.99999) x (60 x 24 x 7) = 0.2016 (minutes) ≒ 12 seconds

Below, a supplementary explanation will be given on how this (Equation 1) was obtained.
First, the process of deriving the formula for the survival probability Pok will be explained.
The survival probability Pok can be calculated from the period T and the mean time between failures Derr. The probability that the period t is a predetermined value can also be calculated from the mean time between failures Derr. If the period t is greater than the period T, the standby device 50 is alive at the detection time ta, and the switchover is successful.
Therefore, the switching success rate Preq for which period t>period T may be calculated from the probability model. Note that the maximum value of period T is the transmission interval Isb.

Here, the period T reaches its maximum value when the standby device 50 detects survival or down status based on the detection time ts1 immediately after the detection time ta (Δt seconds later). Therefore, the maximum value of the period T is the transmission interval Isb, and the probability that the period T = constant g (g<T) is P[T=g]=1/transmission interval Isb. As a result, the survival probability Pok when there is a prerequisite that the period T = constant g can be calculated as the conditional probability shown in (Equation 2). Also, assume that the period t is approximated by an exponential distribution.
Furthermore, when the period T = constant g, the survival probability Pok at the detection time ta can be calculated as the conditional probability shown in (Formula 3). Also, when the period T follows a uniform distribution, the survival probability Pok can be calculated as the conditional probability shown in (Formula 4). In this way, since the constant g is a random variable, the possible values of the constant g and their probabilities are taken into consideration.

Next, the process of deriving the calculation formula for the transmission interval Isb from the survival probability Pok will be described.
First, by taking the inverse function of (Equation 4), it is transformed into a form of transmission interval Isb = function h (switching success rate Preq, mean number of failures λ), and a calculation formula for the transmission interval Isb when the survival probability Pok is set is derived. Specifically, (Equation 4) is transformed into (Equation 5) where survival probability Pok = function f (transmission interval Isb, mean time between failures Derr = 1/mean number of failures λ). Next, (Equation 5) is transformed into (Equation 6).
Then, the result of transforming (Equation 5) into the form of transmission interval Isb = function h (survival probability Pok, mean time between failures Derr) becomes the calculation formula for the transmission interval Isb in (Equation 1).

As described above with reference to FIG. 6, the interval calculation unit 21 calculates the transmission interval Isb from the input data in the following procedure.
(Step 1) Based on the average number of failures λ, which is the inverse of the mean time between failures Derr, the period t is calculated from the detection time ts1 at which the standby device 50 detected the latest survival confirmation message prior to the detection time ta of the failure of the acting device 40, to the occurrence time ts2 of the failure of the standby device 50.
(Step 2) The probability that the obtained period t will be longer than the period T from detection time ts1 to detection time ta is set as the survival probability Pok of the standby device 50 at the detection time ta, and the transmission interval Isb is calculated so that the survival probability Pok is equal to or greater than the switching success rate Preq.

FIG. 7 is a time series graph of the fault detection probability.
A graph 410 illustrates that the shape of the graph curve calculated from the mean time to failure Derr changes depending on the difference in the mean time to failure Derr. The interval calculation unit 21 calculates each of the curves 411 and 412 from the input mean time to failure Derr according to the Poisson process (or Markov process).
Here, the curve 412 has a steeper rise than the curve 411. This is because the curve 412 has a shorter mean time between failures Derr (more failures) than the curve 411.
Graph 420 is curve 421 obtained by enlarging curve 411 in graph 410 near t = 0. Curve 421 slopes upward to the right as the period passes (towards the right of the graph).
Here, the interval calculation unit 21 calculates the fault detection probability=1-exp(-λt) when the transmission interval Isb=period T, and calculates the survival probability Pok=1-fault detection probability=exp(-λt). The interval calculation unit 21 specifies the transmission interval Isb such that the calculation results match the range 422 of the fault detection probability and the range 423 of the survival probability Pok in the graph 420. This allows the interval calculation unit 21 to calculate the transmission interval Isb instead of (Equation 1).

FIG. 8 is a flow chart showing a monitoring process according to requests from a plurality of businesses.
The latter half of FIG. 8 (S13 to S15) is the monitoring process and system switching process by the monitoring system 100 as described in FIG. 5, and therefore a description thereof will be omitted here.

On the other hand, the first half of FIG. 5 (S11, S12) is replaced with the first half of FIG. 8 (S11B, S12B).
First, the interval calculation device 20 receives as input data the switching success rate Preq specified by the multiple operator terminals 10 and the mean time between failures of the standby device 50 (S11B). That is, in S11 of Fig. 5, one switching success rate Preq was input from one operator, but in S11B, multiple switching success rates Preq are input.
Next, the interval calculation device 20 calculates the transmission interval Isb for each operator from the input data using (Equation 1) as described in the interval database 31B of Fig. 3, and sets the minimum value of the calculation result (the strictest transmission interval) in the monitoring device 30 (S12B). This makes it possible to realize transmission control of the survival confirmation message with the transmission interval adjusted so as to satisfy all of the requirements of multiple operators.
In this way, the interval calculation unit 21 accepts individual switching success rates Preq as input data from multiple operator terminals, and sets the minimum value of the transmission intervals Isb calculated individually corresponding to the individual switching success rates Preq as the interval for transmitting a survival confirmation message to the standby device 50.

FIG. 9 is a flowchart showing the monitoring process when a cancellation occurs at some of the multiple businesses.
The latter half of FIG. 9 (S13 to S15) is the monitoring process and system switching process by the monitoring system 100 as described in FIG. 5, and therefore a description thereof will be omitted here.

On the other hand, the first half of FIG. 9 (S11C, S12C) is executed after the first half of FIG. 8 (S11B, S12B) is executed.
First, the interval calculation device 20 receives a monitoring cancellation request from a predetermined business operator (SP2) from the business operator terminal 10 to cancel the use of the standby device 50 (S11C). The reason for the cancellation is, for example, a switch to a lower-cost standby device 50 with the same performance, or insufficient performance of the current standby device 50 due to a switch to a more highly functional acting device 40.
Then, as explained in the interval database 31C of Figure 3, the interval calculation device 20 sets the minimum value obtained by subtracting the transmission interval Isb of a specific operator terminal 10 from the calculated transmission interval Isb for each operator in the monitoring device 30 (S12C).

[effect]
The present invention provides an interval calculation device 20 used in a redundant system that performs switching processing from an acting device 40 to a standby device 50 in response to a failure of the acting device 40,
The interval calculation device 20 has an interval calculation unit 21 that calculates a transmission interval Isb, which is an interval for transmitting a survival confirmation message to the standby device 50,
The interval calculation unit 21
A feature of this method is that the transmission interval Isb is calculated using as input data a switching success rate Preq, which is a required value for the probability that the switching process from the acting device 40 to the standby device 50 will be successful because the standby device 50 is in a survival state, and the mean interval between failures Derr of the standby device 50.

This makes it possible to send survival confirmation messages at a frequency according to the mean time between failures Derr while satisfying the required value of the switching success rate Preq. Therefore, it is possible to detect failures in the standby device 50 at a frequency that satisfies the required conditions while reducing the processing load on the redundant system.

In the interval calculation device 20 of the present invention, the interval calculation unit 21 calculates the transmission interval Isb from input data as follows:
Based on the average number of failures λ, which is the reciprocal of the mean failure interval Derr, a period t is calculated from a detection time ts1 at which the standby device 50 detects the latest survival confirmation message before the detection time ta of the failure of the acting device 40 to a time ts2 at which the failure of the standby device 50 occurs;
The probability that the obtained period t will be longer than the period T from the detection time ts1 to the detection time ta is set as the survival probability Pok of the standby device 50 at the detection time ta, and the transmission interval Isb is calculated so that the survival probability Pok is equal to or greater than the switching success rate Preq.

This allows the processor load of the monitoring function to be reduced by calculating the transmission interval Isb that prevents excessive transmission of survival confirmation messages according to the period t during which the standby device 50 is in a survival state.

In the interval calculation device 20 of the present invention, an interval calculation unit 21 receives individual switching success rates Preq from a plurality of carrier terminals as input data,
The minimum value of the transmission intervals Isb calculated individually corresponding to the individual switching success rates Preq is set as the interval for transmitting a survival confirmation message to the standby device 50.

This makes it possible to receive individual requests from multiple operators and calculate a transmission interval Isb that satisfies the requests from all of the operators.

REFERENCE SIGNS LIST 10: business operator terminal 20: interval calculation device 21: interval calculation unit 30: monitoring device 31: interval database 32: transmission unit 40: acting device 50: standby device 100: monitoring system

Claims (4)

An interval calculation device used in a redundancy system that performs a switching process from an acting device to a standby device when an acting device fails, comprising:
the interval calculation device has an interval calculation unit that calculates a transmission interval, which is an interval for transmitting a survival confirmation message to the standby device;
The interval calculation unit is
An interval calculation device, characterized in that the transmission interval is calculated using as input data a switching success rate, which is a required value for the probability that the switching process from the acting device to the standby device will be successful because the standby device is in a survival state, and a mean time between failures of the standby device. The interval calculation unit calculates the transmission interval from the input data by
calculating a survival time from a standby detection time at which the standby device detected the latest survival confirmation message prior to an act detection time, which is a failure detection time of the acting device, to a failure occurrence time of the standby device, based on an average failure frequency which is the reciprocal of the mean failure interval;
The interval calculation device according to claim 1, characterized in that the probability that the calculated survival period will be longer than the switching period from the standby detection time to the act detection time is set as the standby survival probability of the standby device at the act detection time, and the transmission interval is calculated so that the standby survival probability is greater than or equal to the switching success rate. The interval calculation unit receives the switching success rates from a plurality of carrier terminals as the input data,
The interval calculation device according to claim 1 , further comprising: setting a minimum value of the transmission intervals calculated individually corresponding to the individual switching success rates as the interval for transmitting the survival confirmation message to the standby device. An interval calculation method executed by an interval calculation device used in a redundant system that performs a switching process from an acting device to a standby device when an acting device fails, comprising:
the interval calculation device has an interval calculation unit that calculates a transmission interval, which is an interval for transmitting a survival confirmation message to the standby device;
The interval calculation unit is
An interval calculation method, comprising: calculating the transmission interval using as input data a switching success rate, which is a required value for the probability that a switching process from the acting device to the standby device will be successful because the standby device is in a survival state, and a mean time between failures of the standby device.

Images