Patent Description:
An industrial network is used for a network of an industrial system such as lines or robots built in a factory. An industrial network is required to have high fault tolerance in order to ensure high productivity and safety of the industrial system. In addition, unlike an office or a data center, a factory is often in an environment where there are dust and vibration, for example. Therefore, the elements constituting an industrial network are required to have particularly high fault tolerance. Various methods are being studied to realize high fault tolerance.

For example, in Patent Literature <NUM>, when in an industrial network a failure occurs in a link between devices constituting the network, a device located close to a location where the failure has occurred transmits a message indicating the location of the failure according to a predetermined protocol. Then, a device that has received this message updates a routing table so as to avoid the location of the failure indicated in the message. With this arrangement, a single point of failure in a transmission path is avoided and the fault tolerance of the industrial system is improved.

In recent years, the standardization of the fifth-generation mobile communication system (<NUM>) has progressed, and its practical application is progressing. <NUM> provides a <NUM> network, which is a wireless network, to the public. A utilization method called local <NUM> is also being considered, in which a <NUM> network is built as a private network in a local area. By applying this local <NUM> to a network of an industrial system, effects such as reducing wiring and simplifying maintenance are expected.

A <NUM> network is composed of end terminals that participate in the <NUM> network, a RAN that serves as a base station, and a <NUM> core. Transmission data from an end terminal goes through the RAN, and is transferred to another end terminal or another network such as the Internet in a UPF on the <NUM> core. RAN is an abbreviation for radio access network. UPF is an abbreviation for user plane function. <CIT> discloses a control device, in which at least some of a plurality of controlled devices are classified such that each belongs to one of a plurality of groups. For each group, this control device stores identifying information for identifying the controlled devices that belong to that group and information regarding the behavior of the remaining controlled devices belonging to the group when an anomaly is detected in a controlled device belonging to the group. The control device detects anomalies in the controlled devices on the basis of data exchanged between said controlled devices when a user program is executed. If an anomaly is detected in one of the controlled devices, the control device refers to the abovementioned identifying information to identify the anomaly group, i.e. the group to which the controlled device in which the anomaly was detected belongs, and refers to the behavior information to control the operation of the anomaly group.

An industrial system operates such that a plurality of PLCs cooperate via a network and arbitration is performed among a plurality of lines. PLC is an abbreviation for programmable logic controller. When <NUM> is applied to the industrial system, a network between PLCs is built on the <NUM> network. In this case, a UPF is responsible for transferring all pieces of data exchanged between PLCs. If the UPF stops operating due to a failure, the PLCs will not be able to cooperate with each other, so that all the lines to be arbitrated will stop. That is, the UPF will become a single point of failure for all the lines to be arbitrated by the PLCs. Therefore, when the <NUM> network is applied to the industrial system, a problem is that fault tolerance is weak.

An object of the present disclosure is to prevent occurrence of a single point of failure on a <NUM> core in an industrial system to which a <NUM> network is applied.

A communication control system according to the present disclosure includes plurality of control devices that communicate via a fifth-generation mobile communication system (<NUM>) network and a plurality of controlled devices respectively controlled by the plurality of control devices,.

In a communication control system according to the present disclosure, each emergency stop group number is associated with a destination UPF without duplication of a destination UPF between emergency stop groups. Then, information in which each emergency stop group number is associated with a destination UPF is stored in a destination conversion table. A control device can transmit data using this destination conversion table. Therefore, even if a failure occurs in a UPF, the impact of the failure can be limited to the range of an emergency stop group corresponding to the UPF where the failure has occurred. With this arrangement, an effect of improving fault tolerance in an industrial system can be obtained.

This embodiment will be described hereinafter using the drawings. In the drawings, the same or equivalent parts are denoted by the same reference sign. In the description of the embodiment, description of the same or equivalent parts will be suitably omitted or simplified.

<FIG> is a figure illustrating an example of a configuration of a communication control system <NUM> according to this embodiment.

The communication control system <NUM> includes a plurality of control devices <NUM> that communicate via a <NUM> network and a plurality of controlled devices <NUM> respectively controlled by the plurality of control devices <NUM>.

The communication control system <NUM> is, for example, an industrial system composed of PLCs.

Each of the PLCs is the control device <NUM> that controls the controlled device <NUM>, which is a device such as a line or a robot.

If an anomaly, such as a behavior that will cause an injury to a worker or an unexpected behavior of a worker, occurs in the device such as a line or a robot to be controlled, each of the PLCs causes an emergency stop in the device such as a line or a robot to be controlled. In the PLCs constituting the industrial system, ranges to be affected, if an anomaly occurs, by the anomaly are set as groups. These groups are identified by identifiers, and are set in the PLCs in advance. These identifiers will be hereinafter referred to as emergency stop group numbers, and they are represented by numbers for convenience in this embodiment.

If a PLC detects an anomaly, the PLC transmits a message indicating an emergency stop group number to all the other PLCs. Each PLC that has received this message compares an emergency stop group number set in emergency stop group information with the emergency stop group number indicated in the message. If they are the same, each PLC causes the device such as a line or a robot controlled by the PLC itself to make an emergency stop. If they are different, each PLC continues control of the device such as a line or a robot.

In <NUM>, there is a function called network slicing. For applications that connect to the <NUM> network, various cases are considered such as those that require large-capacity communication or those that require low-latency communication. In network slicing, a UPF appropriate for the required communication quality can be defined for each application.

In this embodiment, the emergency stop group numbers and the network slicing function are utilized. Specifically, UPFs corresponding to the emergency stop group numbers constitute a network that transfers data of the PLCs.

As illustrated in <FIG>, the communication control system <NUM> includes the control devices <NUM>, the controlled devices <NUM>, RANs <NUM>, and a <NUM> core <NUM>.

In <FIG>, four control devices <NUM>, which are control devices 100_1, 100_2, 100_3, and 100_4, are illustrated as the control devices <NUM>. Four controlled devices <NUM>, which are controlled devices 200_1, 200_2, 200_3, and 200_4, are illustrated as the controlled devices <NUM>. Two RANs <NUM>, which are RANs 300_1 and 300_2, are illustrated as the RANs <NUM>.

In the <NUM> core <NUM>, two UPFs <NUM>, which are UPFs 410_1 and 410_2, are illustrated as the UPFs <NUM>.

Each or all of the control devices 100_1, 100_2, 100_3, and 100_4 may be referred to as the control device <NUM>. Each or all of the controlled devices 200_1, 200_2, 200_3, and 200_4 may be referred to as the controlled device <NUM>. Each or all of the RANs 300_1 and 300_2 may be referred to as the RAN <NUM>. Each or all of the UPFs 410_1 and 410_2 may be referred to as the UPF <NUM>.

Each of the control devices 100_1, 100_2, 100_3, and 100_4 controls the device such as a line or a robot. Specifically, the control devices 100_1, 100_2, 100_3, and 100_4 are connected respectively with the controlled devices 200_1, 200_2, 200_3, and 200_4. The controlled devices 200_1, 200_2, 200_3, and 200_4 are the devices such as lines or robots, and are the controlled devices of the PLCs.

The control device <NUM> is also called user equipment (UE).

An emergency stop group number <NUM> is defined for the control devices 100_1 and 100_2, and an emergency stop group number <NUM> is defined for the control devices 100_3 and 100_4.

An emergency stop group number is a group number assigned to an emergency stop group.

An emergency stop group is a group determined based on a range affected by an anomaly in each controlled device of the plurality of controlled devices <NUM>.

In <FIG>, the control devices 100_1 and 100_2 belong to the emergency stop group of the emergency stop group number <NUM>, and the control devices 100_3 and 100_4 belong to the emergency stop group of the emergency stop group number <NUM>.

Each of the RANs 300_1 and 300_2 is a radio access network in <NUM>, and functions as a base station.

In <FIG>, the control devices 100_1 and 100_2 communicate with the RAN 300_1, and the control devices 100_3 and 100_4 communicate with the RAN 300_2.

The <NUM> core <NUM> corresponds to a core network in the <NUM> network.

The core network is generally composed of various functional groups. In this embodiment, only the following functions related to operation will be described.

The UPFs 410_1 and 410_2 are user plane functions in <NUM>. The UPFs 410_1 and 410_2 each have a function of transferring data transmitted from an end terminal connected to the <NUM> network to a destination indicated in the data.

<FIG> is a figure illustrating an example of a configuration of the control device <NUM> according to this embodiment.

<FIG> is a figure illustrating an example of a detailed functional configuration of the control device <NUM> according to this embodiment.

The control device <NUM> is a computer. The control device <NUM> includes a processor <NUM>, and also includes other hardware components such as a memory <NUM>, an auxiliary storage device <NUM>, an input/output interface <NUM>, and a communication device <NUM>. The processor <NUM> is connected with the other hardware components via signal lines, and controls these other hardware components.

The control device <NUM> includes, as functional elements, a calculation unit <NUM>, a transmission and reception unit <NUM>, a communication distribution unit <NUM>, a <NUM> connection unit <NUM>, and a storage unit <NUM>. The storage unit <NUM> stores emergency stop group information <NUM> and a destination conversion table <NUM>.

As illustrated in <FIG>, the communication distribution unit <NUM> includes an information acquisition unit <NUM>, an information creation unit <NUM>, a destination information acquisition unit <NUM>, and a destination conversion unit <NUM>.

The functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> are realized by software. The storage unit <NUM> is provided in the memory <NUM>. The storage unit <NUM> may be provided in the auxiliary storage device <NUM>, or may be divided and provided in the memory <NUM> and the auxiliary storage device <NUM>.

The processor <NUM> is a device that executes a communication control program. The communication control program is a program that realizes the functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM>.

The processor <NUM> is an integrated circuit (IC) that performs operational processing. Specific examples of the processor <NUM> are a central processing unit (CPU), a digital signal processor (DSP), and a graphics processing unit (GPU).

The memory <NUM> is a storage device to temporarily store data. Specific examples of the memory <NUM> are a static random access memory (SRAM) and a dynamic random access memory (DRAM).

The auxiliary storage device <NUM> is a storage device to store data. A specific example of the auxiliary storage device <NUM> is an HDD. Alternatively, the auxiliary storage device <NUM> may be a portable storage medium such as an SD (registered trademark) memory card, CF, a NAND flash, a flexible disk, an optical disc, a compact disc, a Blu-ray (registered trademark) disc, or a DVD. HDD is an abbreviation for hard disk drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for digital versatile disc.

The input/output interface <NUM> is a port that receives data from and transmits data to the controlled device <NUM>, which is the device such as a line or a robot.

The input/output interface <NUM> may include, as an input interface, a port to be connected with an input device such as a mouse, a keyboard, or a touch panel. Specifically, the input interface is a Universal Serial Bus (USB) terminal. The input interface may be a port to be connected with a local area network (LAN).

The input/output interface <NUM> may include, as an output interface, a port to which a cable of an output device such as a display is to be connected. Specifically, the output interface is a USB terminal or a High Definition Multimedia Interface (HDMI, registered trademark) terminal. Specifically, the display is a liquid crystal display (LCD). The output interface is also called a display interface.

The communication device <NUM> is a wireless device for connecting to the <NUM> network.

The communication device <NUM> includes a receiver and a transmitter, and may be connected to a communication network such as a LAN, the Internet, or a telephone line. Specifically, the communication device <NUM> is a communication chip or a network interface card (NIC).

The communication control program is executed in the control device <NUM>. The communication control program is read into the processor <NUM> and executed by the processor <NUM>. The memory <NUM> stores not only the communication control program but also an operating system (OS). The processor <NUM> executes the communication control program while executing the OS. The communication control program and the OS may be stored in the auxiliary storage device <NUM>. The communication control program and the OS that are stored in the auxiliary storage device <NUM> are loaded into the memory <NUM> and executed by the processor <NUM>. Part or the entirety of the communication control program may be embedded in the OS.

The control device <NUM> may include a plurality of processors as an alternative to the processor <NUM>. These processors share execution of the communication control program. Each of the processors is a device that executes the communication control program, like the processor <NUM>.

Data, information, signal values, and variable values that are used, processed, or output by the communication control program are stored in the memory <NUM>, the auxiliary storage device <NUM>, a register in the processor <NUM>, or a cache memory in the processor <NUM>.

"Unit" in each of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> may be interpreted as "circuit", "step", "procedure", "process", or "circuitry". The communication control program causes a computer to execute a calculation process, a transmission and reception process, a communication distribution process, and a <NUM> connection process. "Process" in each of the calculation process, the transmission and reception process, the communication distribution process, and the <NUM> connection process may be interpreted as "program", "program product", "computer readable storage medium storing a program", or "computer readable recording medium recording a program". A communication control method is a method performed by execution of the communication control program by the control device <NUM>.

The communication control program may be stored and provided in a computer readable recording medium. Alternatively, the communication control program may be provided as a program product.

The calculation unit <NUM> acquires settings and an operating status of the controlled device <NUM>, calculates a control signal to control operation of the controlled device <NUM>, and outputs a calculation result to the controlled device <NUM>.

The transmission and reception unit <NUM> transmits and receives control signals for other control devices <NUM> or the controlled device <NUM>.

In the emergency stop group information <NUM>, each control device of the plurality of control devices <NUM> is associated with an emergency stop group number assigned to an emergency stop group. That is, in the emergency stop group information <NUM>, the emergency stop group number defined for each control device <NUM> is stored. In the example in <FIG>, the emergency stop group number <NUM> is defined for the control devices 100_1 and 100_2, and the emergency stop group number <NUM> is defined for the control devices 100_3 and 100_4.

The communication distribution unit <NUM> is also referred to as a data communication distribution function.

The information acquisition unit <NUM> acquires the emergency stop group numbers from the emergency stop group information <NUM>. The information acquisition unit <NUM> is also referred to as an emergency stop group acquisition unit.

The information creation unit <NUM> calculates the total number of emergency stop groups based on the emergency stop group numbers, and creates slice information for connecting to the same number of UPFs as the total number of emergency stop groups. Specifically, the information creation unit <NUM> creates the slice information that is required, when the control device <NUM> joins the <NUM> network, for connecting to the same number of UPFs as the total number of emergency stop group numbers or for setting up the same number of UPFs as the total number of emergency stop group numbers. Then, the information creation unit <NUM> outputs the slice information to the <NUM> connection unit <NUM>. The information creation unit <NUM> is also referred to as a slice information creation unit.

The <NUM> connection unit <NUM> registers its own control device with the <NUM> network based on the slice information, and acquires UPF destination information, which is destination information of the UPFs. When the <NUM> connection unit <NUM> registers its own control device with the <NUM> network, the UPF destination information is issued from the <NUM> core <NUM>.

The destination information acquisition unit <NUM> acquires the UPF destination information issued from the <NUM> core <NUM>, and associates each emergency stop group number with UPF destination information without duplication of a destination UPF between emergency stop groups, and stores association information in the destination conversion table <NUM>.

The destination conversion unit <NUM> refers to the destination conversion table <NUM>, and converts destination information of data so that the UPF corresponding to the emergency stop group number to which its own control device belongs is the destination.

<FIG> is a diagram illustrating an example of arrangement of the destination conversion table <NUM> according to this embodiment.

The destination conversion table <NUM> is stored in a format such that each emergency stop group number is associated with UPF destination information.

In <FIG>, the UPF 410_1 is set as the destination UPF for the emergency stop group number <NUM>. Specifically, UPF destination information of the UPF 410_1 is set for the emergency stop group number <NUM>. The UPF 410_2 is set as the destination UPF for the emergency stop group number <NUM>. Specifically, UPF destination information of the UPF 410_2 is set for the emergency stop group number <NUM>.

The operation of the control device <NUM> according to this embodiment will now be described. A procedure for the operation of the control device <NUM> is equivalent to the communication control method. A program that realizes the operation of the control device <NUM> is equivalent to the communication control program. The communication control program causes the control device <NUM>, which is a computer, to execute a communication control process.

The communication control process of the control device <NUM> according to this embodiment includes a procedure A, a procedure B, and a procedure C.

In the procedure A, connection is made to the <NUM> network based on the emergency stop groups that are set in the control device <NUM> in advance.

In the procedure B, information for converting the destination is stored in the destination conversion table <NUM> so that data can be transferred to the UPF corresponding to the emergency stop group.

In the procedure C, destination information of data to be transmitted by the control device <NUM> via <NUM> is converted based on the information stored in the procedure B.

<FIG> is a figure illustrating an operational flow of the procedure A in the control device <NUM> according to this embodiment.

When the control device <NUM> starts participating in the <NUM> network, processing of step S101 is started.

In a specific example, the operation of the control device 100_1 of <FIG> will be described.

In step S101, the information acquisition unit <NUM> acquires, from the emergency stop group information <NUM>, the emergency stop group numbers that are set in the emergency stop group information <NUM>. Specifically, the information acquisition unit <NUM> acquires, from the emergency stop group information <NUM>, the emergency stop group numbers that are defined for the control device 100_1 to the control device 100_4.

In the specific example, the information acquisition unit <NUM> acquires the emergency stop group numbers <NUM> and <NUM>.

In step S102, the information creation unit <NUM> calculates the total number of emergency stop groups based on the emergency stop group numbers, and creates slice information for connecting to the same number of UPFs as the total number of emergency stop groups.

In the specific example, the information creation unit <NUM> calculates the total number of emergency stop groups as two based on the acquired emergency stop group numbers <NUM> and <NUM>. Then, the information creation unit <NUM> creates slice information for connecting to the two UPFs.

In step S103, the information creation unit <NUM> outputs the slice information created in step S102 to the <NUM> connection unit <NUM>.

In step S104, the <NUM> connection unit <NUM> connects its own control device to the <NUM> network based on the slice information.

In the specific example, the <NUM> connection unit <NUM> registers the control device 100_1 with the <NUM> network based on the slice information, and establishes connection to the UPFs 410_1 and <NUM><NUM>.

<FIG> is a figure illustrating an operational flow of the procedure B in the control device <NUM> according to this embodiment.

The procedure B is performed after the connection between the control device <NUM> and the UPF is established.

In step S201, UPF destination information, which is destination information of the UPF <NUM> in the <NUM> core <NUM>, is issued from the <NUM> core <NUM> to the <NUM> connection unit <NUM>. The <NUM> connection unit <NUM> acquires the UPF destination information issued from the <NUM> core <NUM>.

In step S202, the destination information acquisition unit <NUM> acquires the UPF destination information issued in step S201 through the <NUM> connection unit <NUM>.

In step S203, the destination information acquisition unit <NUM> stores, in the destination conversion table <NUM>, information in which each emergency stop group number is associated with a destination UPF, based on the UPF destination information, without duplication of a destination UPF between emergency stop groups. Specifically, based on the UPF destination information acquired in step S202, the destination information acquisition unit <NUM> associates each emergency stop group number with UPF destination information of a destination UPF without duplication of the UPF 410_1 or 410_2 to be the destination between the emergency stop group numbers <NUM> and <NUM>.

In the specific example, the destination information acquisition unit <NUM> stores, in the destination conversion table <NUM>, information in which UPF destination information of the UPF 410_1 is associated with the emergency stop group number <NUM> and UPF destination information of the UPF 410_2 is associated with the emergency stop group number <NUM>.

<FIG> is a figure illustrating an operational flow of the procedure C in the control device <NUM> according to this embodiment.

The procedure C is performed when the control device <NUM> is to transmit data to another control device after the procedure A and the procedure B. In the specific example, a case will be described where the control device 100_1 transmits data to one of the control device 100_2 to the control device 100_4, which are other control devices.

In step S301, when data is to be transmitted to another control device, the destination conversion unit <NUM> converts the destination information of the data so that the data is transmitted to the destination UPF corresponding to the emergency stop group to which its own control device <NUM> belongs, based on the destination conversion table <NUM>.

Specifically, the destination conversion unit <NUM> acquires, from the destination conversion table <NUM>, UPF destination information of the destination UPF corresponding to the emergency stop group number of the emergency stop group to which its own control device <NUM> belongs.

In the specific example, the destination conversion unit <NUM> acquires, as the destination UPF, UPF destination information of the UPF 410_1 corresponding to the emergency stop group number <NUM> of the emergency stop group to which its own control device 100_1 belongs.

In step S302, for the data to be transmitted by the transmission and reception unit <NUM>, the destination conversion unit <NUM> converts the destination information of the data so that the data is transmitted to the destination UPF obtained in step S301.

In the specific example, using the UPF destination information of the UPF 410_1, the destination conversion unit <NUM> converts the destination information of the data so that the data is transmitted to the UPF 410_1.

Then, the transmission and reception unit <NUM> transmits the data based on the destination information of the data.

As described above, the control device <NUM> according to this embodiment realizes a configuration in which the procedure A, the procedure B, and the procedure C are taken so that the UPF corresponding to the emergency stop group transfers data. This makes it possible to avoid a situation where a UPF on a <NUM> network becomes a single point of failure in an industrial system. Even if a failure occurs in a UPF, the impact of the failure can be limited to the range of the emergency stop group corresponding to the UPF where the failure has occurred.

In this embodiment, the functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> are realized by software. As a variation, the functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> may be realized by hardware.

Specifically, the control device <NUM> includes an electronic circuit <NUM> in place of the processor <NUM>.

<FIG> is a figure illustrating an example of the configuration of the control device <NUM> according to a variation of this embodiment.

The electronic circuit <NUM> is a dedicated electronic circuit that realizes the functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM>. Specifically, the electronic circuit <NUM> is a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

The functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> may be realized by one electronic circuit, or may be distributed to and realized by a plurality of electronic circuits.

As another variation, some of the functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> may be realized by the electronic circuit, and the rest of the functions may be realized by software. Alternatively, some or all of the functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> may be realize by firmware.

Each of the processor and the electronic circuit is also referred to as processing circuitry. That is, the functions of the calculation unit <NUM>, the transmission and reception unit <NUM>, the communication distribution unit <NUM>, and the <NUM> connection unit <NUM> are realized by the processing circuitry.

As described above, the control device <NUM> according to this embodiment realizes a configuration in which a UPF corresponding to an emergency stop group transfers data. This makes it possible to avoid a situation where a UPF on a <NUM> network becomes a single point of failure in an industrial system. Even if a failure occurs in a UPF, the impact of the failure can be limited to the range of the emergency stop group corresponding to the UPF where the failure has occurred. Therefore, according to the control device <NUM> of this embodiment, an effect of improving fault tolerance of an industrial system can be obtained.

In Embodiment <NUM> above, each unit of the control device is described as an independent functional block. However, the configuration of the control device may be different from the configuration in the embodiment above. The functional blocks of the control device may be arranged in any configuration, provided that the functions described in the embodiment above can be realized. The control device may be a system composed of a plurality of devices, instead of a single device.

Portions of Embodiment <NUM> may be implemented in combination. Alternatively, one portion of this embodiment may be implemented. Alternatively, this embodiment may be implemented as a whole or partially in any combination.

That is, in Embodiment <NUM>, Embodiment <NUM> can be freely combined, any constituent element of Embodiment <NUM> can be modified, or any constituent element may be omitted in Embodiment <NUM>.

The embodiment described above is an essentially preferable example, and is not intended to limit the scope of the present disclosure, the scope of applications of the present disclosure, and the scope of uses of the present disclosure. The embodiment described above can be modified in various ways as needed.

Claim 1:
A communication control system (<NUM>) including a plurality of control devices (<NUM>) configured to communicate via a fifth-generation mobile communication system , <NUM>,
network and a plurality of controlled devices (<NUM>) respectively controlled by the plurality of control devices (<NUM>),
wherein each control device (<NUM>) of the plurality of control devices (<NUM>) comprises
an information creation unit (<NUM>) configured to calculate a total number of emergency stop groups based on emergency stop group information in which each emergency stop group number assigned to each emergency stop group that is determined based on a range to be affected by an anomaly in each controlled device (<NUM>) of the plurality of controlled devices (<NUM>) is associated with each corresponding control device (<NUM>) of the plurality of control devices (<NUM>), and create slice information for connecting to the same number of user plane functions, UPFs,
as the total number of emergency stop groups;
a <NUM> connection unit (<NUM>) configured to register the control device (<NUM>) of the <NUM> connection unit (<NUM>) itself with the <NUM> network, and acquire UPF destination information, which is destination information of the UPFs; and
a destination information acquisition unit (<NUM>) configured to, based on the UPF destination information, associate each emergency stop group number with a destination UPF without duplication of a destination UPF between the emergency stop groups, and store information in which each emergency stop group number is associated with a destination UPF in a destination conversion table.