JP2021125218A - Programmable logic controller and analyzer - Google Patents

Abstract

To provide a system capable of analysing characteristics such as the periodicity and continuity of data related to each device for classification and efficiently specifying an abnormal device.SOLUTION: A programmable logic controller collects data held in a collection target device among a plurality of devices in accordance with predetermined collection settings for each scan cycle of a user program, classifies each device into any of a plurality of types based on characteristics of time-series data of each device, and determines a detection algorithm when specifying an abnormal device in accordance with the time-series data of the device collected by collection means and the type of the device classified by classification means. Moreover, in accordance with the type of the device classified by the classification means, the time-series data of the device collected by the collection means is analyzed by use of a parameter determined for the device by determination means to specify the abnormal device.SELECTED DRAWING: Figure 6

Description

The present invention relates to a programmable logic controller and an analyzer.

A programmable logic controller (PLC) is a controller that controls industrial machines such as manufacturing equipment, transfer equipment, and inspection equipment in factory automation (Patent Documents 1 and 2). The PLC controls various expansion units and controlled devices by executing a user program such as a ladder program created by a programmer.

Japanese Patent No. 5661222 JP-A-2018-097662

By the way, in order to monitor the operation of the PLC and the operation of the industrial machine controlled by the PLC, it is desired to collect and utilize the data held by the PLC. The PLC has a basic unit (CPU unit) and an expansion unit connected to the basic unit (CPU unit). The basic unit controls the expansion unit by executing a user program such as a ladder program. The expansion unit controls the industrial machine according to the command from the basic unit and returns the control result to the basic unit.

In addition, data such as these control results are used for trouble analysis and quality control. Therefore, it is required to accumulate and analyze these data and obtain the analysis results at an early stage for recovery. However, when recording the data of all devices related to PLC, a huge amount of data is stored, and it is necessary to analyze these huge amounts of data (all devices) in order to identify the abnormal device. Therefore, it is a time-consuming work. In the past, an abnormality was automatically determined by analyzing a specific device as an analysis target, and an analysis method suitable for the data was prepared in advance for the analysis method to be used. Experience and knowledge are also required to select a specific device and determine the analysis method. Therefore, in addition to appropriately storing a huge amount of data, there is a mechanism to efficiently identify an abnormal device from the huge amount of data related to each device without requiring sufficient specialized knowledge and experience. It is desired.

Therefore, in view of the above problems, it is an object of the present invention to analyze and classify features such as periodicity and continuity of data related to each device, and to efficiently identify an abnormal device.

The present invention is, for example, a programmable logic controller.
An execution engine that repeatedly executes the user program,
A device memory having a plurality of devices, which is a storage area for storing data accessed by the execution engine according to the user program, and
A collection means for collecting data held by the device to be collected among the plurality of devices according to a predetermined collection setting for each execution cycle of the user program.
A classification means for classifying each device into one of a plurality of types based on the characteristics of the time series data of each device collected by the collection means.
For each device, a determination means for determining a detection algorithm for identifying the device as an abnormal device according to the time series data of the device collected by the collection means and the type in which the device is classified by the classification means.
Anomalous devices are analyzed by analyzing the time-series data of the devices collected by the collecting means according to the type in which the devices are classified by the classification means using the detection algorithm determined by the determining means for the devices. It is characterized by having a specific means for specifying the above.

Further, the present invention includes, for example, a device memory having an execution engine that repeatedly executes a user program, a device memory having a plurality of devices that are storage areas for storing data accessed by the execution engine according to the user program, and the user program. An analyzer that is communicably connected to a programmable logic controller that includes a collection means that collects data held by the device to be collected among the plurality of devices according to a predetermined collection setting for each scan cycle.
An acquisition means for acquiring time-series data of each device collected by the collection means from the programmable logic controller, and
A classification means for classifying each device into one of a plurality of types based on the characteristics of the time series data of each device acquired by the collection means.
For each device, a determination means for determining a detection algorithm for identifying the device as an abnormal device according to the time series data of the device collected by the collection means and the type in which the device is classified by the classification means.
Anomalous devices are analyzed by analyzing the time-series data of the devices collected by the collecting means according to the type in which the devices are classified by the classification means using the detection algorithm determined by the determining means for the devices. With specific means to identify
It is characterized by including an output means for outputting a specific result by the specific means.

According to the present invention, it is possible to analyze and classify features such as periodicity and continuity of data related to each device, and efficiently identify an abnormal device.

Diagram showing PLC system Diagram explaining a PC Diagram explaining a PC Diagram illustrating PLC Diagram explaining the basic unit Diagram explaining the data utilization unit Diagram illustrating an expansion unit Diagram illustrating the format of a data record The figure explaining the transfer timing Diagram illustrating information compression Flowchart showing the overall flow Diagram showing the classification of collected data Flowchart showing classification processing procedure Flowchart showing classification processing procedure Diagram showing data type Flowchart showing the processing procedure of the learning phase Flowchart showing the processing procedure of the estimation phase Diagram explaining the abnormality judgment method Diagram showing a display example of a specific result Diagram showing a modified example of collected data Flowchart showing the processing procedure to output the monitoring start signal Flowchart showing the processing procedure of additional learning

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. It should be noted that the following embodiments do not limit the invention according to the claims, and not all combinations of features described in the embodiments are essential to the invention. Two or more of the plurality of features described in the embodiments may be arbitrarily combined. In addition, the same or similar configuration is given the same reference number, and duplicate explanations are omitted. A lowercase alphabet may be added to the end of the reference code indicating the same or similar elements. Lowercase alphabets are omitted when explaining things that are common to multiple elements.

<First Embodiment>
<System configuration>
Hereinafter, the first embodiment of the present invention will be described. First, a general PLC configuration and its operation will be described so that a person skilled in the art can better understand a programmable logic controller (PLC, which may be simply referred to as a programmable controller).

FIG. 1 is a conceptual diagram showing a configuration example of a programmable logic controller system according to an embodiment of the present invention. As shown in FIG. 1, this system is a PLC (programmable logic controller) 1 for comprehensively controlling a PC2a for editing a user program such as a ladder program and various control devices installed in a factory or the like. And have. PC is an abbreviation for personal computer. The user program may be created using a graphical programming language such as a ladder language or a flowchart-type motion program such as SFC (sequential function chart), or may be created using a high-level programming language such as C language. .. In the following, for convenience of explanation, the user program will be a ladder program. The PLC 1 includes a basic unit 3 having a built-in CPU and one or more expansion units 4. One or more expansion units 4 can be attached to and detached from the basic unit 3.

The basic unit (also referred to as a CPU unit) 3 includes a display unit 5 and an operation unit 6. The display unit 5 can display the operating status of each expansion unit 4 attached to the basic unit 3. The display unit 5 switches the display content according to the operation content of the operation unit 6. The display unit 5 usually displays the current value (device value) of the device in PLC1, error information generated in PLC1, and the like. Here, the device includes various devices (relays, timers, counters, etc.) included in the basic unit 3 and the expansion unit 4, and is on a memory provided for storing device values (device data). It also refers to an area and may be called a device memory. The device memory is a non-volatile memory and may be composed of a rewritable non-volatile ROM, or the volatile RAM or the like may be made non-volatile by battery backup or the like. ROM is an abbreviation for read-only memory. RAM is an abbreviation for random access memory. The device value is information indicating an input state from an input device, an output state to an output device, and a state of an internal relay (auxiliary relay), a timer, a counter, a data memory, etc. set on a user program. The device value type includes a bit type and a word type. The bit device stores 1-bit device values such as 0/1, ON / OFF, H / L, and the like. The word device stores the device value of one word. A variable may be specified as a device as a collection target of the data utilization program described in detail below. Variables are also holding means for holding information and are accessed by the execution engine according to the user program. Therefore, in the following description, device also refers to a variable. The memory that holds the device may be called a device memory. Further, the memory that holds the collected data may be called a data memory.

The expansion unit 4 is prepared to expand the function of the PLC1. A field device (controlled device) 10 corresponding to the function of the expansion unit 4 may be connected to each expansion unit 4, whereby each field device 10 is connected to the basic unit 3 via the expansion unit 4. Be connected. The field device 10 may be an input device such as a sensor or a camera, or an output device such as an actuator. Further, a plurality of field devices may be connected to one expansion unit 4.

For example, the expansion unit 4b may be a positioning unit that drives a motor (field device 10) to position the work, or may be a counter unit. The counter unit counts signals from an encoder (field device 10) such as a manual pulsar.

The expansion unit 4a collects data to be collected from the basic unit 3 and the expansion unit 4b, and executes a user program (data utilization program) such as a flow to process the data to be collected and display the data to be displayed. This is a data utilization unit that creates and creates display data (source data) for displaying the dashboard on the display unit 7 or the PC 2. In the present embodiment, an example in which the expansion unit 4a collects data of each device will be described, but the collecting unit may be provided in the basic unit 3 or may be provided in another expansion unit. Further, the expansion unit 4a can also function as an analyzer that analyzes the collected data according to an instruction from the basic unit 3 or a predetermined timing. In the present embodiment, an example in which the expansion unit 4a operates as an analyzer will be described, but there is no intention of limiting the present invention, and the basic unit 3 may function as an analyzer, and external devices such as PC2a and 2b may be used. The device may function as an analyzer. The flow (flow program) described below is just an example of a data utilization program. The basic unit 3 is sometimes called a CPU unit. The system including PLC1 and PC2 may be called a programmable logic controller system.

PC2a is a computer mainly operated by a programmer. On the other hand, PC2b is a computer mainly operated by a person in charge at the site. PC2a may be called a program creation support device (setting device). The PC 2 is, for example, a portable notebook type or tablet type personal computer or smartphone, and is an external computer including a display unit 7 and an operation unit 8. The external computer is a computer outside the PLC1. A ladder program, which is an example of a user program for controlling PLC1, is created using PC2a. The created ladder program is converted into a mnemonic code in PC2a. The PC 2 is connected to the basic unit 3 of the PLC 1 via a communication cable 9 such as a USB (Universal Serial Bus) cable. For example, PC2a sends a ladder program converted into a mnemonic code to the basic unit 3. The basic unit 3 converts the ladder program into machine code and stores it in the memory provided in the basic unit 3. Although the mnemonic code is transmitted to the basic unit 3 here, the present invention is not limited to this. For example, the PC 2a may convert the mnemonic code into an intermediate code and transmit the intermediate code to the basic unit 3.

Although not shown in FIG. 1, the operation unit 8 of the PC 2 may include a pointing device such as a mouse connected to the PC 2. Further, the PC 2 may be configured to be detachably connected to the basic unit 3 of the PLC 1 via a communication cable 9 other than the USB cable. Further, the PC 2 may be connected to the basic unit 3 of the PLC 1 by wireless communication without using the communication cable 9.

<Program creation support device>
FIG. 2 is a block diagram for explaining the electrical configuration of the PC 2a. As shown in FIG. 2, the PC 2a includes a CPU 11a, a display unit 7a, an operation unit 8a, a storage device 12a, and a communication unit 13a. The display unit 7a, the operation unit 8a, the storage device 12a, and the communication unit 13a are each electrically connected to the CPU 11a. The storage device 12a includes a RAM, a ROM, an HDD, and an SSD, and may further include a removable memory card. CPU is an abbreviation for central processing unit. HDD is an abbreviation for hard disk drive. SSD is an abbreviation for solid state drive.

The user of the PC 2a causes the CPU 11a to execute the project editing program 14a stored in the storage device 12a, and edits the project data 15 through the operation unit 8a. When the CPU 11a executes the project editing program 14a, the project creation unit 16 and the project transfer unit 17 are realized. The project creation unit 16 creates the project data 15 according to the user input. The project transfer unit 17 transfers the project data 15 to the PLC1. The project data 15 is provided in one or more user programs (eg, ladder program, control program, motion program, data utilization program), configuration information of the basic unit 3 and the expansion unit 4, and the basic unit 3 and the expansion unit 4. Includes setting information for specific functions. The configuration information includes connection positions of a plurality of expansion units 4 with respect to the basic unit 3 and device allocation information. It includes information indicating the functions provided in the basic unit 3 (example: data collection function, communication function, positioning function), information indicating the functions of the expansion unit 4 (example: communication function, positioning function, shooting function), and the like. May be good. The setting information of the specific function is the setting information related to the functions (eg, data collection function, communication function, positioning function) provided in the basic unit 3, for example, in the case of the data collection function, the data collection condition and the setting of the data collection target. It includes information, and includes setting information related to the functions of the expansion unit 4 (eg, communication function, positioning function, data utilization function, shooting function). Here, the editing of the project data 15 includes the creation and modification (re-editing) of the project data 15. The user can read the project data 15 stored in the storage device 12a as needed, and change the project data 15 by using the project editing program 14a. The communication unit 13a communicates with the basic unit 3 via the communication cable 9a. The project transfer unit 17 transfers the project data to the basic unit 3 via the communication unit 13a. The communication unit 13a communicates with the expansion unit 4a via the communication cable 9b.

<PC used to display the dashboard>
FIG. 3 is a block diagram for explaining the electrical configuration of the PC 2b. As shown in FIG. 3, the PC 2b includes a CPU 11b, a display unit 7b, an operation unit 8b, a storage device 12b, and a communication unit 13b. The display unit 7b, the operation unit 8b, the storage device 12b, and the communication unit 13b are each electrically connected to the CPU 11b. The storage device 12b includes a RAM, a ROM, an HDD, and an SSD, and may further include a removable memory card.

The CPU 11b realizes the Web browser 18 by executing the Web browser program 14d. The Web browser 18 accesses the setting page of the data utilization application provided by the expansion unit 4a or the dashboard page via the communication unit 13b. Further, the CPU 11b displays the specific result on the display unit 7b according to the screen information indicating the specific result (determination result) when the abnormality occurs, which is transmitted from the expansion unit 4a.

<PLC>
FIG. 4 is a block diagram for explaining the electrical configuration of PLC1. As shown in FIG. 4, the basic unit 3 includes a CPU 31, a display unit 5, an operation unit 6, a storage device 32, a communication unit 33, and a memory card 44. The display unit 5, the operation unit 6, the storage device 32, and the communication unit 33 are each electrically connected to the CPU 31. The storage device 32 may include a RAM, a ROM, and the like. The storage device 32 has a plurality of storage areas such as a device unit 34, a project storage unit 35, and a first buffer 37a. The device unit 34 includes a bit device, a word device, and the like, and each device stores a device value and corresponds to a device memory. The project storage unit 35 stores the project data input from the PC 2a. The device value (time series data) to be collected from the device unit 34 is stored in the first buffer 37a for each scan cycle. Details of the first buffer will be described later with reference to FIG. When the storage condition is satisfied, the memory card 44 stores time-series data, which is control data from each device, stored in the first buffer 37a. By temporarily holding the time-series data in the memory card 44 in this way, for example, it is possible to verify the data of the classification target or the specific target later with an external device or the like, and hold the important latest data as log information. be able to. Further, in the present invention, since the data of all the devices related to PLC1 is basically collected, the collected data is enormous, and the effect of reducing the processing load can be expected by holding the data to be processed in another memory. Furthermore, it is also possible to facilitate the parallel execution of the collection process and the process related to the collected data (classification process and specific process). Here, the storage condition is when an abnormality occurs in the PLC, when a device to be a storage trigger is specified in advance by the user and a predetermined change is made in the device, or when an analysis command is given by the user. This is established when the monitoring cycle for periodic monitoring has elapsed, or when an analysis command is issued from the expansion unit connected to the basic unit 3. The storage conditions may be preset by the user and stored in the storage device 32 of the basic unit 3 as a part of the project data. When the CPU 31 detects that the storage condition is satisfied, the CPU 31 issues a command to save the device value stored in the first buffer 37a to a memory card 44 such as an SD card, and the expansion unit 4a is instructed to save the device value. Notify that the data to be analyzed has been saved. The control program for the basic unit 3 is stored in the project storage unit 35 as a part of the project data. The control program for the basic unit 3 may be stored in the storage device 32 separately from the project storage unit 35 or in addition to the project storage unit 35. As shown in FIG. 4, the basic unit 3 and the expansion unit 4 are connected via an expansion bus 90, which is a type of communication bus. Although the communication circuit related to the expansion bus 90 is mounted on the CPU 31 in FIG. 4, it may be mounted as a part of the communication unit 33. The communication unit 33 may have a network communication circuit. The CPU 31 receives the project data from the PC 2a via the communication unit 33.

Here, the expansion bus 90 will be supplementarily described. The expansion bus 90 is a communication bus used for input / output refresh. I / O refresh is to capture the input / output values before each execution when repeatedly executing the ladder program, and execute the ladder program based on the captured input / output values. The inside is a process to prevent the input even if the input / output value changes. The value taken in by the input / output refresh is stored in the device memory as the device value of the device corresponding to each input / output. By the input / output refresh, the device value is sent and received between the basic unit 3 and the expansion unit 4, and the device value of the corresponding device in the device memory is updated. The input / output refresh is executed every scan cycle in which the ladder program is executed once (that is, every scan). Note that one scan cycle includes an I / O refresh execution period, a ladder program execution period, and an end processing execution period.

The expansion unit 4 includes a CPU 41 and a memory 42. Further, the expansion unit 4a may be provided with a memory card (for example, an SD card) that can be attached to and detached from the expansion unit 4a and stores time-series data that is control data from each device. The CPU 41b of the expansion unit 4b controls the field device 10 according to an instruction (device value) from the basic unit 3 stored in the device. Further, the CPU 41b stores the control result of the field device 10 in a device called a buffer memory. The control result stored in the device is transferred to the basic unit 3 by input / output refresh. Further, the control result stored in the device is transferred to the basic unit 3 according to the read instruction from the basic unit 3 even at a timing different from the input / output refresh. The memory 42 includes a RAM, a ROM, and the like. In particular, the RAM has a storage area used as a buffer memory. The memory 42 may have a buffer that temporarily holds data (eg, device value, still image data, moving image data) acquired by the field device 10.

The CPU 41a of the expansion unit 4a that functions as a data utilization unit communicates with the PC 2b via the communication unit 43 and the cable 9b. A data utilization unit is an expansion unit that executes a data utilization application. The data utilization application is collected with a flow of collecting and processing control data (time series data) stored in the memory card 44 provided in the basic unit 3 or the memory card provided in the expansion unit 4a. It includes a flow that performs processing related to the data, a dashboard that displays the execution result of those flows, and a transmitter that sends the result of those flows to the outside. The data utilization application refers to the data to be saved when the above-mentioned storage conditions are satisfied without issuing a save command to the memory card 44 at the time of abnormal device analysis, and is saved in the memory card 44. Analyze using the data you have.

The function of collecting control data may be realized by a user program other than the data utilization application. In addition, the functions related to the collected data include a specific function to identify the abnormal device when the programmable logic controller is abnormal, and a device value different from usual by analyzing the deviation from the time series data at the normal time. It includes an analysis function to verify the above and a monitoring function to perform the above analysis on a regular basis. The flow may have an arithmetic block for collecting data, an arithmetic block for executing data processing, an arithmetic block for creating display data, and the like. The dashboard has graph display parts, numerical display parts, and the like. These display components may be realized by HTML data, CSS data, Javascript® code, and the like. The collection of HTML data, CSS data, and Javascript (registered trademark) code may be referred to as a Web application. In this embodiment, the flow is realized by the flow template. The flow template is prepared in advance for each application, and has one or more calculation blocks in which the flow template parameters specified by the user are set. The dashboard is also realized by the template. The dashboard template has one or more display components to which the dashboard template parameters specified by the user are set. Dashboard template parameters are a wide variety of information, such as dashboard names, device names, numbers, and unit variable names. The unit variable is a variable for the expansion unit 4a to hold the execution result of the flow.

<Functions realized by the CPU of the basic unit>
FIG. 5 shows a function realized by the CPU 31 regarding data utilization. The execution engine 51 repeatedly executes the user program at each scan cycle, which is the execution cycle. The execution engine 51 may be realized by an ASIC or FPGA provided outside the CPU 31. ASIC is an abbreviation for a special purpose integrated circuit. FPGA is an abbreviation for field programmable gate array. These dedicated circuits can often execute specific data processing at a higher speed than a combination of a CPU and a program. The collection unit 52a collects device values to be collected from the device unit 34 for each scan cycle, which is an execution cycle, creates a data record, and stores the data record in the first buffer 37a. When the execution engine executes the ladder program as a user program, the scan cycle of the ladder program corresponds to the execution cycle, and when the execution engine executes the motion program as the user program, the control cycle of the motion program is the execution cycle. Corresponds to. When collecting device values for each scan cycle of the ladder program, the device values to be collected are collected from the device unit 34 during the end processing period of the scan cycle, a data record is created, and the data record is stored in the first buffer 37a. You may. It is not essential to collect data during the end processing period, and the user program executed by the execution engine 51 may include a description (program code such as a trigger instruction) for collecting data. However, in the case of collecting data by end processing, there is an advantage that the user program does not need to be changed. The collection cycle is set by the user, transferred as a part of the project data, and stored in the storage device 32 of the basic unit 3 as the collection setting 36a. The collection setting 36a includes a device to be collected and the like in addition to the collection cycle. The collection cycle may be different from the scan cycle, which is the execution cycle, or the control cycle of the motion program. In this case, the device value to be collected may be collected from the device unit to create a data record and stored in the first buffer 37a at each collection cycle specified by the collection setting 36a. Here, the basic unit 3 may analyze features such as periodicity and continuity of each device value by its own device or by the expansion unit 4a at the time of data collection, and classify the devices according to the analysis result. .. On the other hand, at the time of data collection, without performing such analysis, the own device or at the timing when it is necessary to analyze the data at the timing when time series data of a predetermined number of scan cycles are collected or when an abnormality occurs. This may be done by the expansion unit 4a.

By providing the first buffer 37a, the execution engine 51 is less likely to be affected by an increase in scan time due to collection and transfer processing. The device value to be collected is specified by the collection setting 36a. The collection setting 36a may be stored in the basic unit 3 by the PC 2a or the expansion unit 4a. The transfer unit 53a stores one or more data records stored in the first buffer 37a in the memory card 44 provided in the basic unit 3, and transfers the data records stored in the memory card 44 to the expansion unit 4a. do. The transfer unit 53a executes the transfer process when the communication traffic on the expansion bus 90 is free, but a dedicated expansion bus for transmitting the data record to the expansion unit 4a may be provided.

Alternatively, the transfer unit 53a transfers one or more data records stored in the first buffer 37a to the expansion unit 4a via the expansion bus 90, and the transferred data is then transferred to the memory card provided in the expansion unit 4a. It may be stored in. In this case, it is preferable to provide a dedicated expansion bus for transmitting the data record to the expansion unit 4a. As described above, the data record is stored in the memory card 44 only when the storage condition is satisfied. Therefore, since it is not necessary to transfer unnecessary data to the expansion unit 4a, it is possible to reduce the weight of communication traffic.

The transfer process may be executed while avoiding the period during which the execution engine 51a is executing the input / output refresh and the period during which the data is read from the buffer memory of the expansion unit 4 according to the read instruction described in the user program. .. The communication traffic of the expansion bus 90 is monitored by the monitoring unit 54a. The compression engine 55a may compress a plurality of data records in order to reduce the transfer time of the data records. The compression engine 55a does not have to be realized by the CPU 31, and may be realized by an ASIC, FPGA, or the like. By adopting the first buffer 37a in this way, it is possible to execute the transfer process and the user program asynchronously.

<Function of data utilization unit>
FIG. 6 is a diagram illustrating a function realized by the CPU 41a of the expansion unit 4a.

The collection unit 52c is a function of collecting (acquiring) data from the first buffer of the basic unit 3 according to the collection setting 39. The collection setting 39 is set by the user, transferred as a part of the project data, and stored in the memory 42a of the expansion unit 4a. The collecting unit 52c can be realized by the CPU 41a executing a control program such as a user program. The collection unit 52c sets the basic unit 3 so that the basic unit 3 collects the device value specified by the collection setting 39 and transfers it to the second buffer 37b of the expansion unit 4a. The collection unit 52c may write the collection setting 36a of the basic unit 3 included in the collection setting 39 to the storage device 32 of the basic unit 3. It is desirable that the collection unit 52c and the data processing unit 73 can basically operate asynchronously. A buffer may be provided to achieve this. Here, an embodiment in which the basic unit 3 collects the device values, temporarily stores them in the buffer, and then the collection unit 52c of the expansion unit 4a collects them at a predetermined timing is described. However, the present invention is not limited to this, and an analysis unit such as the expansion unit 4a may directly acquire the device value and store the device value in the memory provided in the expansion unit 4a.

The collection unit 52c may set the expansion unit 4b so that the expansion unit 4b collects the device value specified by the collection setting 39 and transfers it to the third buffer 37c of the expansion unit 4a. By providing the second buffer 37b and the third buffer 37c, even if the processing load of the data processing unit 73 fluctuates, data can be collected without being missed. The collection unit 52c may write the collection setting 36b (FIG. 7) of the expansion unit 4b included in the collection setting 39 to the memory 42b of the expansion unit 4b. Note that these setting functions may be realized by the setting unit 71. The setting unit 71 receives the collection setting 39, the processing setting 61, and the display setting 62 from the PC 2a or the PC 2b and writes them to the memory 42a. The processing setting 61 includes information and a flow (program) that defines the data processing executed for the collected data by the data processing unit 73. The display setting 62 includes a template of a dashboard (HTML data, CSS, Javascript (registered trademark) code, etc.) that provides the data processing result to the Web browser 18 through the Web server 70.

Further, the CPU 41a of the expansion unit 4a realizes the classification unit 76, the determination unit 77, the specific unit 78, and the transmission unit 79 as functional configurations. The classification unit 76 analyzes the characteristics of the time series data of each device collected (acquired) from the first buffer of the basic unit 3 by the collection unit 52c, and classifies the time series data based on the characteristics. The classification method will be described later with reference to FIG. The classification unit 76 executes the classification process at an arbitrary timing, but basically, the classification process is executed at the timing when the system operation is started or the timing when the instruction from the user is received. The determination unit 77 determines the parameters for identifying the abnormal device according to the time series data classified by the classification unit 76, and stores the parameters in the memory 42a. The parameter determination process will be described later. When the classification process is executed by the classification unit 76, the determination unit 77 performs the parameter determination process and updates the parameter if the parameter has already been determined for the same device. When updating, it may be updated by overwriting, or a new parameter may be determined from two parameters such as taking an average value. Further, the processing at the time of updating may be determined for each device. In this way, the classification unit 76 and the determination unit 77 are processing units that function in the learning phase of analyzing the collected data and learning what the normal data looks like, and estimate the abnormal device. Determine the parameters at the time. On the other hand, the specific unit 78 is a processing unit that functions in the estimation phase for estimating an abnormal device. The identification unit 78 identifies an abnormal device from the time series data of each device collected by the collection unit 52c using the determined parameters. Details of the specific processing will be described later. Here, the abnormal device indicates a storage area of a device memory in which data different from that in the normal state is held. The estimation of the abnormal device by the specific unit 78 may be started when an abnormality occurs during the operation of the programmable logic controller, periodically, or based on a monitoring instruction from the user. Further, it may be started when the storage conditions set in advance by the user are satisfied.

The generation unit 74 creates the display data of the dashboard by substituting the data processing result into the template of the dashboard according to the display setting 62 that defines the display components of the dashboard. In addition, the generation unit 74 creates display data (screen information) for displaying the specific result based on the specific result of the abnormal device by the specific unit 78. The display data may be, for example, HTML data, image data, CSS (cascading style sheet), Javascript (registered trademark) code, or the like. Display parts include, for example, pie chart parts, bar graph parts, line graph parts, numerical display parts, and the like. When the Web server 70 accesses the Web page of the dashboard by the Web browser 18, the Web server 70 transmits the display data of the dashboard to the Web browser 18. The Web browser 18 receives the display data and displays the dashboard. Further, the transmission unit 79 transmits the display data generated by the generation unit 74 to the external device. The communication line and communication method for transmission are not particularly limited. Further, it may be a wireless connection or a wired connection.

In addition, multiple data utilization applications may be provided. In this case, the data required for each data utilization application and the read timing may differ, and a subbuffer may be secured in the memory 42a for each data utilization application. The collecting unit 52c reads the data record stored in the second buffer 37b and stores the data for the first data utilization application in the first subbuffer 38a. The collecting unit 52c reads the data record stored in the second buffer 37b and stores the data for the second data utilization application in the second subbuffer 38b. The collecting unit 52c may read the data record stored in the third buffer 37c and store the data for the first data utilization application in the first subbuffer 38a. The collecting unit 52c may read the data record stored in the third buffer 37c and store the data for the second data utilization application in the second subbuffer 38b. The data processing unit 73 reads data from the first subbuffer 38a according to the first data utilization application, executes data processing, and generates a processing result. The data processing unit 73 reads data from the second subbuffer 38b according to the second data utilization application, executes data processing, and generates a processing result. The decompression engine 75 is a function of pairing with the compression engine 55a of the basic unit 3 and the compression engine 55b of the expansion unit 4b. The decompression engine 75 decompresses the data compressed and transferred by the basic unit 3 and stores it in the second buffer 37b. The decompression engine 75 decompresses the data compressed and transferred by the expansion unit 4b and stores it in the third buffer 37c. This will alleviate the congestion of communication traffic on the expansion bus 90. The defrosting engine 75 may be realized by ASIC, FPGA, or the like. In this way, data transmission between the basic unit 3 and the expansion units 4a and 4b is executed via the expansion bus 90.

Data utilization There may be multiple data required for each application. In that case, a plurality of necessary data may be stored in the subbuffer while maintaining the chunk of data collected in each scan in the buffer. Further, when data is distributed to the subbuffer, a time stamp or the like may be added to each record. As shown in FIG. 16, the second buffer 37b (which may be the third buffer 37c) holds a chunk of collected data. One record contains the scan number, the timer value (timestamp), and the collected data. In this example, the collected data includes relays RL1 to RL3, devices Dev1 and Dev2. The first data utilization application 1601 requires relays RL1 to RL3 among the collected data. Therefore, the scan number, the timer value, and the relays RL1 to RL3 are read from the second buffer 37b and stored in the first subbuffer 38a. The first data utilization application 1601 reads out the scan number, the timer value, and the relays RL1 to RL3 from the first subbuffer 38a to create a display screen (source data). The second data utilization application 1602 requires relays RL3, devices Dev1 and Dev2 among the collected data. Therefore, the scan number, the timer value, the relay RL3, the devices Dev1 and Dev2 are read from the second buffer 37b and stored in the second subbuffer 38b. The second data utilization application 1602 reads out the scan number, the timer value, the relay RL3, the devices Dev1 and the Dev2 from the second subbuffer 38b, and creates a display screen (source data). By utilizing the subbuffer in this way, it is possible to maintain the original data in the buffer without changing it. The original data held in the buffer can be used for other purposes.

<Functions of expansion unit 4b related to data utilization>
FIG. 7 is a diagram illustrating a function realized by the CPU 41b of the expansion unit 4b.

The execution engine 51b executes the basic functions of the expansion unit 4b (in the case of a motion unit, execution of a motion flow, etc.). The collection unit 52b collects the data specified by the collection setting 36 from the device unit 34b at the timing specified by the collection setting 36 and stores it in the fourth buffer 37d. The transfer unit 53b reads the data record stored in the fourth buffer 37d at the timing specified by the collection setting 36 or the timing when the transfer request is received by the expansion unit 4a, and reads the data record stored in the fourth buffer 37d via the expansion bus 90. , Transfer to the third buffer 37c of the expansion unit 4a. The transfer unit 53b may transfer the data record at a timing when the communication traffic of the expansion bus 90 monitored by the monitoring unit 54 is small. The compression engine 55b compresses the data record according to the collection setting 36. That is, the transfer unit 53b may transfer the data record information-compressed by the compression engine 55b to the expansion unit 4a. The compression engine 55b may be realized by the CPU 41b, but may be realized by an ASIC or an FPGA from the viewpoint of high-speed processing and reduction of the processing load of the CPU 41b.

<Example of data record>
FIG. 8 shows a data record 91 written to the first buffer 37a by the collecting unit 52a. The plurality of data records 91 are examples of time series data. In this example, the collection unit 52a collects the device values of the device names Dev0, Dev1, and Dev10 from the device unit 34a for each scan cycle, and adds the collection count and the time information acquired from the timer to one data. A record is created and stored in the first buffer 37a. The collection target may be data stored in the buffer memory or device allocated to the expansion unit 4b. In this example, the first buffer 37a is a FIFO (first in, first out) type buffer. The collection count is a count value of a counter that is counted up by 1 each time one data record is collected. Since the collection count is a sequential number, it is useful for detecting missing or compressed data records.

Time information such as a time stamp is useful, for example, when displaying the data acquired by the basic unit 3 and the data acquired by the expansion unit 4b on the dashboard so as to be comparable. Generally, the collection timing in the basic unit 3 and the collection timing in the expansion unit 4b do not match. Therefore, in order to compare the operation of the basic unit 3 with the operation of the expansion unit 4b, information for associating the data of the basic unit 3 with the data of the expansion unit 4b is required. Generally, the time information can be synchronized between the basic unit 3 and the expansion units 4a and 4b by synchronization between units or the like. Therefore, the basic unit 3 and the expansion unit 4b each add the time information when the data records are collected to the data records, so that the data processing unit 73 transfers a plurality of data records acquired by different units on the time axis. Can be aligned.

<Transfer timing>
FIG. 9 is a diagram for explaining the transfer timing of the data record. As shown in FIG. 9, the PLC1 repeatedly executes input / output refresh, user program execution, and end processing. In order to reduce the extension of the scan cycle, the transfer process is executed avoiding the input / output refresh period. Similarly, in order to reduce the elongation of the scan cycle, the transfer process is executed avoiding the execution period of UREAD and UWRIT. UREAD is an instruction to read data from the buffer memory allocated to the expansion unit 4, and is described in the user program. Therefore, the basic unit 3 accesses the expansion unit 4 according to UREAD and acquires data from the buffer memory during the execution period of the user program. UWRIT is an instruction to write data to the buffer memory allocated to the expansion unit 4, and is described in the user program. The basic unit 3 accesses the expansion unit 4 according to UWRIT and writes data to the buffer memory during the execution period of the user program.

As shown in FIG. 9, the transfer process is performed on the expansion bus 90 during the remaining transferable period excluding I / O refresh, UREAD and UWRIT. For example, it is assumed that the collection setting 36a is set to execute the transfer process for each of five data records. In this case, the transfer unit 53a executes the transfer process after the accumulation of five data records in the first buffer 37a is completed and at the timing when the transfer request is received by the first transferable period or the expansion unit 4a. do.

<Compression of information>
FIG. 10 is a diagram illustrating information compression of a data record. The data record group 92a indicates a data record before information compression. The values that have changed since the previous scan cycle are shaded. Here, four relay devices RL1, RL2, RL3, and RL4 are designated as collection targets. In addition, a scan number is used as the collection count. The counter may be time information acquired by a timer or the like (example: a numerical value indicating a time interval from when a certain relay is turned on to when it is turned off). In the data record group 92a, there is no change point of the relay device between the data record of the scan number "1" and the data record of the scan number "2". That is, the data record with scan number "2" can be compressed (discarded or deleted). However, the relay device RL1 for the data record with the scan number "3" and the relay device RL1 for the data record with the scan number "1" are different. As described above, since the scan number "3" has a change point, the data record of the scan number "3" is not compressed. Since there is no change point of the relay device between the data record of scan number "3" and the data record of scan number "4", the data record of scan number "4" can be compressed. Similarly, since there is no change point of the relay device between the data record of scan number "5" and the data record of scan number "6", the data record of scan number "6" can be compressed. By executing information compression focusing on such a change point, the compressed data record group 92b is realized. Each data record constituting the compressed data record group 92b has a change point. As described above, in the present embodiment, in the group of one or more devices (RL1 to RL4), the values collected in the previous scan cycle and the values collected in the current scan cycle are all the devices in the group to be collected. If it does not change in, the values collected in this scan cycle are deleted and the time series data to be collected is compressed. Although examples of management in a group have been described here, there is no intention of limiting the present invention, and data may be compressed by determining ON / OFF for each device without grouping. Further, in the case of data (analog value) that is not in the ON / OFF bit format, a change in the device value from the previous time may be detected for each device, and control may be performed so that the change is left when the change is detected.

<Overall flow>
FIG. 11 shows an overall flow from data collection to identification processing of an abnormal device in the programmable logic controller according to the present embodiment. The process described below will be described as a process executed by the CPU 41a of the expansion unit 4a. However, there is no intention of limiting the present invention, and a part of those processes may be executed by the basic unit 3 or another expansion unit 4b, or an external device (analysis) communicably connected to the programmable logic controller. It may be executed by the device).

In S1, the CPU 41a (setting unit 71) sets the basic unit 3 and the expansion unit 4b. For example, the CPU 41a transfers the collection setting 36a for the basic unit 3 to the basic unit 3. The basic unit 3 stores the collection setting 36a in the storage device 32. The CPU 41a transfers the collection setting 36b for the basic unit 3 to the expansion unit 4b. The expansion unit 4b stores the collection setting 36b in the memory 42b.

In S2, the CPU 41a (collection unit 52c) collects time-series data of the device to be collected according to the set collection setting. Here, when a predetermined amount of collected data is stored, the process may proceed to the next process. That is, here, when the timing of transition to the learning phase is determined and a sufficient amount of data (time-series data of a predetermined number of scan cycles) for learning is accumulated in a storage unit such as a buffer or a memory card, the next step is Proceed to processing.

In S3, the CPU 41a (classification unit 76 and determination unit 77) analyzes the data collected in S2 to create a learning model (parameter in this embodiment) for identifying an abnormal device. The processing of the learning phase will be described later with reference to FIG.

In S4, the CPU 41a (collection unit 52c) collects time-series data of the device to be collected according to the set collection setting. The processing after S4 is actually the processing at the time of system operation. The data collection here is basically the same as the data collection in S2 above. The learning phase may be performed at the start of system operation, or may be started at the timing of receiving an instruction from the user. It may also be performed on a regular basis. That is, during system operation, data is always collected, the learning phase is periodically performed, and the estimation phase is performed when the storage conditions are satisfied. For example, when an abnormality occurs during the operation of the programmable logic controller and the basic unit 3 detects that the storage condition is satisfied, the time series data collected in the first buffer 37a of the basic unit 3 is stored in the memory card 44. In S5, the CPU 41a (specific unit 78) identifies the abnormal device by acquiring the time-series data stored in the memory card 44 and applying the parameters determined in S3. That is, although the processing in the estimation phase is performed here, the details will be described later with reference to FIG. Further, the CPU 41a generates display data indicating the specific result by the generation unit 74 based on the specific result specified by the specific unit 78, and displays the display data on the display unit 5 of the basic unit 3 or the transmission unit 79. The display data or the specific result generated via the communication unit 43 is transmitted to the external device. In this case, the specific result is displayed to the operator in the external device. In the operation of S5, when an abnormality occurs during the operation of the programmable logic controller as described above, the basic unit 3 detects the establishment of the storage condition and not only identifies the abnormal device but also constantly collects the device value. , A method of analyzing whether the device value is normal, or a method of analyzing the device value collected by the basic unit when the device value predetermined by the user changes by a predetermined value, periodically, Alternatively, it may be a method of analyzing whether or not there is an abnormality in the device value based on a monitoring instruction from the user. In these cases, "abnormal" means that the device value to be analyzed is different from the device value at the normal time, that is, it is different from the data at the normal time, and it does not necessarily occur in the programmable logic controller. It does not indicate any abnormalities. The processing procedure of the estimation phase for identifying an abnormal device from data collection in consideration of these collection timings will be described in detail later with reference to FIG.

<Classification of collected data>
FIG. 12 shows an example of the types of time series data collected. Reference numerals 1201 to 1206 indicate device signals (time series data) of each type. The device signal may include an external signal. The types described below are examples, and the present invention may be applied to other types without any intention of limiting the present invention. Further, in the present invention, it is desirable that the types classified include at least two types among these plurality of types in order to improve the classification effect. The classification of the time series data at the time of learning is executed based on the repeatability of the device by selecting the device for determining the cycle (operation cycle) for the classification by the user.

Reference numeral 1201 indicates a device signal of a device that operates in synchronization with the operation cycle of the device. Reference numeral 1210 indicates the operation cycle of the device. In the 1201 type, a similar change pattern (steady change pattern) occurs for each operation cycle of the device. In this type, for example, a steady-state change pattern is specified from the time-series data acquired during a period that can be regarded as a normal state, and based on the deviation from the specified steady-state change pattern for the newly acquired time-series data. A detection method such as identifying an abnormal device (a device different from usual) is assigned. Specifically, for a change pattern of time-series data having a plurality of cycles that can be regarded as a normal state, the time variation with respect to the change point is measured, and a threshold value is set according to the measured variation. A detection algorithm for detecting an abnormal device is assigned based on whether or not the change point of the time series data acquired thereafter exceeds the threshold range set corresponding to the change point. For example, a plurality of waveforms for each operation cycle of the device are superimposed, and a reference value and a threshold value of the change point are set based on the variation of the point where the device changes from OFF to ON, and an abnormality is made using these parameters. The device can be identified. Further, in each cycle of 1201, the relative time indicating the rising timing of the first signal and the phase in each cycle may be used as evaluation variables, and the parameters corresponding to the evaluation variables may be determined based on the variation of the evaluation variables. For example, when the phase in each period is used as an evaluation variable, the upper limit threshold value and the lower limit threshold value of the phase may be used as parameters, respectively.

On the other hand, 1202 indicates a device signal of a device that is not synchronized with the scan cycle and operates in synchronization with a cycle other than the operation cycle of the device. Also for this type, for example, a steady change pattern is specified from the time series data acquired during the period that can be regarded as a normal state, and based on the deviation from the specified steady change pattern for the newly acquired time series data. A detection method such as identifying an abnormal device (a device different from usual) is assigned. Specifically, for a change pattern of time-series data having a plurality of cycles that can be regarded as a normal state, the time variation with respect to the change point is measured, and a threshold value is set according to the measured variation. A detection algorithm for detecting an abnormal device is assigned based on whether or not the change point of the time series data acquired thereafter exceeds the threshold range set corresponding to the change point. Further, in each cycle of 1202, the relative time indicating the rising timing of the second signal and the phase in each cycle may be used as evaluation variables, and the parameters corresponding to the evaluation variables may be determined based on the variation of the evaluation variables. For example, when the relative time in each cycle is used as an evaluation variable, the upper limit threshold value and the lower limit threshold value of the relative time may be used as parameters, respectively.

1203 represents a device signal of a device that takes a constant value. In this type, for example, the value at the normal time is specified from the time series data acquired during the period that can be regarded as the normal state, and the newly acquired time series data that is different from the specified normal value is the abnormal device. A detection method such as identifying as (a device different from usual) is assigned. Specifically, the device value in the time-series data that can be regarded as the normal state is set as the detection reference value, and the value of the time-series data acquired thereafter is the detection reference value set corresponding to the value in the normal state. A detection algorithm that detects an abnormal device is assigned based on whether or not it differs from. That is, when the value (constant value) changes, it can be determined as abnormal. 1204 indicates a device signal of a device that operates irregularly. This type is excluded from the data used to identify anomalous devices. 1205 represents a device signal of a device that takes an analog value. As will be described later, the device that takes an analog value is not the device value of the bit device, so the process proceeds to No. S21 (S27 in FIG. 13B) in FIG. 13A, and as shown in FIG. 13B, depending on the data change method. The algorithm in the estimation phase is different for each. As an algorithm in the estimation phase of the device that takes an analog value, various methods such as a dynamic time expansion / contraction method and an autoregressive model can be used. 1206 indicates a device signal of a device that monotonically increases and decreases monotonically. In this type, anomalous devices are identified using derivative values and integrated values. Further, a relative time indicating the timing of monotonically increasing or monotonically decreasing or a phase in each cycle may be used as an evaluation variable. The type described here is an example, and devices classified into other types are also assumed. For example, there are devices that can take a plurality of states (such as a stepped device signal). For those that take multiple states, it can be determined that they are abnormal when they change to a state different from the normal state.

Here, the type of the device will be described with reference to FIG. As shown in FIG. 14, each device includes a bit type device of 0 and 1, and a word type device and a floating point number type device that take analog values. In addition, the word device further includes a one-word unsigned integer (0 to 65535), a one-word signed integer (-32768 to 32767), a two-word unsigned integer (0 to 249497295), and a two-word signed integer (0 to 249497295). -2147863648 to 214783647). Considering such a type, for example, if the rate of change per scan cycle is a predetermined value or more and the type is other than a bit, it can be determined that the device takes an analog value.

<Category>
13A and 13B are flowcharts showing a processing procedure when classifying the collected data. The processing described below is realized by the CPU 41a of the expansion unit 4a. However, there is no intention of limiting the present invention, and a part of those processes may be executed by the basic unit 3 or another expansion unit 4b, or an external device (analysis) communicably connected to the programmable logic controller. It may be executed by the device).

In S21, the CPU 41a determines whether or not the time-series data to be classified is the device value of the bit device. If it is the device value of the bit device, the process proceeds to S22. If not, the process proceeds to S27 in FIG. 13B.

In S22, the CPU 41a determines whether or not there is a change in the value of the time series data to be classified. If there is a change, the process proceeds to S24, and if there is no change and a constant value is obtained, the process proceeds to S23. In S23, the CPU 41a classifies the time-series data to be classified as a device (1203) that takes a constant value, and ends the process. Here, as the classification information, information associated with the time-series data, for example, flag information indicating the classified type is stored in association with the time-series data or the identification information indicating the device corresponding to the time-series data. In this way, by storing the flag information of the type classified at the time of classifying the learning phase and the device identification information in association with each other, in the estimation phase, the time series data to be verified is from any device. Depending on whether the data is data, evaluation variables and parameters that are abnormal device detection algorithms can be easily selected according to the type associated with the identification information of the device. That is, in the estimation phase, it is possible to omit the process of specifying which type the time series data to be verified corresponds to. As the classification information, the flag information indicating the classified type is shown as an example, but the algorithm information indicating the algorithm for identifying the abnormal device may be used instead of the flag information. Further, it goes without saying that the identification information stored as the classification information becomes the identification information indicating the variable when the device corresponding to the time series data is a variable.

In S24, when there is a change in the value of the time series data, the CPU 41a determines whether the change is a steady change pattern in each cycle. If it is determined that the change pattern is steady, the process proceeds to S25, and if it is determined that the pattern is not a steady change pattern, the process proceeds to S26. Here, the steady change pattern means a pattern that changes in the same pattern in each cycle. As described above, the steady change pattern is a pattern in which the value of the time series data changes within each cycle, and is a similar pattern that is fixed between each cycle. Therefore, it is also referred to as a fixed change pattern. In S25, the CPU 41a classifies the device as a device that operates at a predetermined cycle, and ends the process. As described above, the devices that operate in a predetermined cycle include a device that operates in synchronization with the operation cycle of the device (1201) and a device that operates in synchronization with a cycle other than the operation cycle of the device (1202). The CPU 41a classifies each of them. On the other hand, in S26, the CPU 41a classifies the device (1204) that operates irregularly and ends the process.

The CPU 41a may specify a cycle other than the operation cycle of the device and the operation cycle of the device based on the change in the value of the time series data related to the specific device. For example, the device value of a particular device is collected as time series data that has one pulse within each operation cycle of the device and has a change point that defines the start timing of each operation cycle. That is, the value of a specific device changes in synchronization with the operation cycle of the device, and the change point defines the operation cycle. Such a specific device may be set by the operator's choice. Similarly, a device that defines a cycle other than the operation cycle may be set by the operator's choice. Of course, the operation cycle of the device may be automatically specified from the collected time-series data, or may be adjusted by the operator after the specification. As a result, the operator can be further supported, and an easy-to-use operation system can be provided even to an inexperienced operator. Further, a device that operates in a cycle other than the operation cycle may be defined as a device that operates irregularly based on the operation cycle. For example, if a device that defines a cycle other than the operation cycle is not set, the CPU 41a , Devices that operate in cycles other than the operation cycle are classified into devices that operate irregularly (1204).

On the other hand, if it is determined in S21 that the device is not a bit device, the process proceeds to S27 shown in FIG. 13B, and the CPU 41a determines whether or not there is a change of a predetermined value or more in the time series data to be classified. Here, it is determined whether or not the extreme value of the changing signal is equal to or greater than a predetermined value. If there is a change, the process proceeds to S28, and if not, the process proceeds to S212.

In S28, the CPU 41a determines whether or not it has changed in a predetermined cycle, and if it has not changed in a predetermined cycle, proceeds to S29, and if it has changed, proceeds to S210. In S210, the CPU 41a determines whether or not the changing value is monotonically increasing or monotonically decreasing. If it is monotonically increasing or monotonously decreasing, the process proceeds to S211. If not, the process proceeds to S29.

In S29, the CPU 41a classifies the device into an analog value device (1205) and ends the process. There are various types of analog value devices, and individual measures are taken according to the type of device to be classified. On the other hand, in S211 the CPU 41a classifies the device as a monotonically increasing or monotonically decreasing device (1206), and ends the process. Further, in S212, the CPU 41a classifies the device as another device and ends the process. If it is determined that the device is another device, the characteristics of the time-series data to be classified cannot be extracted, and the characteristic operation during normal operation cannot be specified. Therefore, it is not used when identifying an abnormal device.

As described above, the CPU 41a automatically classifies the devices to be classified based on the time-series data to be classified, but in addition to this, the CPU 41a may accept the type setting for the devices to be classified from the operator. good. The CPU 41a accepts the type setting for the device to be classified according to the operator's designation. Then, the CPU 41a stores the flag information indicating the classified type in association with the identification information indicating the device to be classified. The type setting for the device to be classified may be executed before the classification by the CPU 41a. For example, when the type setting is executed for a specific device among a plurality of classification target devices based on the operator's specification, the CPU 41a sets the time series data of the classification target for the device for which the type is set in advance. It is not necessary to perform the classification based on. On the other hand, the CPU 41a may execute classification based on the time-series data of the classification target for the other devices for which the operator is not specified among the plurality of devices to be classified. In particular, when the device type is determined by the previous learning and additional learning is performed, the device type may be fixed by the previous learning based on the operator's specification, and the change may be made. For the required device, a type different from the device type may be determined by learning up to the previous time based on the operator's specification. For example, a type that is not used in identifying anomalous devices may be determined.

Further, the type setting for the device to be classified may be executed after the classification by the CPU 41a. For example, for a plurality of classification target devices, the CPU 41a automatically classifies the classification target devices based on the classification target time series data. After that, the CPU 41a may update the type automatically classified for the device whose type is set by the operator's designation to the type set for the device to be classified according to the operator's designation. As a result, even if the period of the time series data used for automatic classification is short or the period is biased, by combining it with the information known by the operator, the device to be classified can be efficiently desired. You can get closer to the classification.

<Learning phase>
FIG. 15 shows a processing procedure for analyzing the collected time series data, classifying it based on the characteristics of each device, and determining the detection algorithm. The processing described below is realized by the CPU 41a of the expansion unit 4a. However, there is no intention of limiting the present invention, and a part of those processes may be executed by the basic unit 3 or another expansion unit 4b, or an external device (analysis) communicably connected to the programmable logic controller. It may be executed by the device).

The timing of starting the learning phase is, for example, the timing when a predetermined period has elapsed from the previous learning process, the timing when a predetermined amount of time series data is collected, and the case where an instruction from the user is received. When the learning phase is started, the CPU 41a (collection unit 52c) collects time-series data of the device to be collected according to the set collection setting (S2).

In S31, the CPU 41a executes the classification process. The classification process is performed in the expansion unit 4a in response to an instruction from the basic unit 3, for example, when a predetermined amount of collected data is stored in the memory card 44 of the basic unit 3. The basic unit 3 may detect that a predetermined amount of collected data has been stored in the memory card 44 and send an instruction to start classification to the expansion unit. Further, the expansion unit may start by detecting that a sufficient amount of data for learning (time-series data of a predetermined number of scan cycles) has been accumulated in a storage unit such as a buffer memory or a memory card. Since the details of the classification process have already been described with reference to FIGS. 13A and 13B, they are omitted here.

Subsequently, in S32, the CPU 41a determines a parameter for identifying an abnormal device according to the time-series data classified in S31, and ends the process. The processing here is performed for each classified type, and the device type corresponding to the time series data and the parameter are stored in association with each other. If a parameter that has already been determined exists, the parameter that has already been determined is replaced with the parameter that has been determined this time, or a new parameter is used using the parameter that has already been determined and the parameter that has been determined this time. May be calculated and updated. Various methods such as an average value can be applied to the calculation method, but a method suitable for each time series data is selected. Further, these determined parameters may be changed by the operator. As a result, even if an extreme parameter is determined when the learning period is short, it can be adjusted.

Here, the parameters determined in S32 will be described. Regarding the types 1201 and 1202 in FIG. 12 (devices whose values change in a steady pattern in synchronization with a predetermined cycle), the CPU 41a determines, for example, the operation cycle of the device from the change pattern of the waveform in the operation cycle of the device. The time between arbitrary change points of each waveform is calculated, and the threshold value of the time between change points is determined as a parameter based on the time distribution between the change points. Further, the parameter in this case may include the timing at which the device value of the time series data in the normal state changes. For the time threshold between the change points, which is the above parameter, for example, the standard deviation and the average value are calculated from the variation during learning, and the average value + 3 × standard deviation is set as the upper limit threshold value, and the average value- 3 × standard deviation may be determined as the lower limit threshold. Further, for the 1203 type (device that takes a constant value), the CPU 41a uses the constant value as a parameter. As described above, for a device whose value changes in a steady pattern in synchronization with a predetermined period, the time interval between the change points, the timing of the change points, and the threshold value related to these are used as parameters.

For the 1205 type (analog value), for example, the value of the time-series data at the time of learning and the threshold value regarding the distance between the time-series data at the time of learning may be used as parameters. The distance calculation method may be, for example, a method of obtaining the sum of the differences for each point. In this case, at the time of estimation, the distance between the time-series data at the time of learning and the time-series data at the time of estimation is calculated, and it is determined whether the distance is within the threshold range. Further, for the 1206 types (monotonic increase, monotonous decrease), for example, an increase value when the monotonous increase occurs in a normal state and a decrease value when the monotonous decrease occurs are determined as parameters.

As described above, according to the present embodiment, each device is classified into one of a plurality of predetermined types based on the characteristics of the periodicity of the time series data of each device, and each of the classified devices is further classified. Apply an appropriate anomaly (unusual change) detection algorithm to the type of. That is, in the present embodiment, in the learning phase, the device is classified into one of a plurality of predetermined types from the time series data at the normal time (learning time). Furthermore, the detection algorithm is determined according to each type, and the evaluation variables and parameters corresponding to each detection algorithm are set. On the other hand, in the estimation phase, for each device for which the detection algorithm is determined in the learning phase, the detection algorithm determined according to the type is applied to the time series data of the device according to the type of the determined device to be estimated. In this way, the abnormal device is identified by analyzing the time-series data of the device using the device type and the device type determined in the learning phase and using the abnormality device detection algorithm. For devices that are not classified into a predetermined type at the time of learning, evaluation variables and parameters are not set, so it is desirable that they are not collected at the time of estimation. In other words, even if such data is collected, the detection algorithm for identifying whether or not it is an abnormal device is not set, so the processing load and memory resource consumption will be unnecessarily increased, which is prevented. To do.

<Estimation phase>
FIG. 16 is a flowchart showing a processing procedure when identifying an abnormal device. The processing described below is realized by the CPU 31 of the basic unit 3 and the CPU 41a of the expansion unit 4a. However, there is no intention of limiting the present invention, and a part of those processes may be executed by other units such as the basic unit 3 and the expansion units 4a and 4b, or may be communicably connected to the programmable logic controller. It may be executed by an external device (analyzer). Here, as a series of processes, when the device value is acquired and the storage condition is satisfied, the process of saving the device value from the buffer memory to the memory card 44 and executing the specific process will be described as a series of processes. Therefore, a series of processes of the basic unit 3 that acquires the device value and saves it in the memory card 44 and the process of the expansion unit 4a that acquires the device value stored in the memory card 44 by the basic unit 3 and executes the specific process are performed. Shown in processing. That is, the process of saving the device value when the save condition is satisfied (S41 to S46 below) is performed by the CPU 31 (collection unit 52a) of the basic unit 3, and the device value saved in the memory card 44 is used to cause an abnormality. The specifying process (S47 and S48) is executed by the CPU 41a of the expansion unit 4a. Of course, the processing of S41 to S48 or a part thereof may be executed by another unit.

Here, the storage conditions for storing the device values stored in the buffer memory (first buffer 37a) of the basic unit 3 in the memory card 44 will be described. For example, the storage condition includes an analysis command by the user when an abnormality occurs in the PLC or when a device to be a storage trigger is specified in advance by the user and a predetermined change is made in the device value of the device. In this case, the conditions are satisfied when the monitoring cycle for periodic monitoring has elapsed, or when an analysis command is issued from the expansion unit connected to the basic unit 3. These storage conditions are set by the user, transferred and stored as project data, input by the user during the operation of the PLC, and based on the information generated from the expansion unit 4.

In S41, the CPU 31 determines whether or not the collection condition is satisfied. The collection condition is, for example, a condition that is satisfied at the timing when a predetermined collection cycle elapses or the timing of the end processing of each scan.

In S42, the CPU 31 of the basic unit 3 acquires the device value collected in S4 of FIG. 11, and in S43, is the acquired device value the same as the device value previously saved in the first buffer 37a? Judge whether or not. If the values are the same, the process is returned to S41 in order to move to the process of the next device value. On the other hand, if the device value is different from the previously stored device value, the process proceeds to S44.

In S44, the CPU 31 saves the acquired device value in the first buffer 37a and proceeds to S45. In this way, the collection unit 52a acquires the device value (and time information) for each collection cycle (for example, scan cycle) set by the collection setting 36a and stores it in the first buffer 37a. It is desirable that a ring buffer is adopted as the first buffer 37a. This is because not all the data stored in the first buffer 37a is collected as log data (collected data) in consideration of the memory resource.

In S45, the CPU 31 determines whether or not the storage condition for storing the device value stored in the first buffer 37a in the memory card 44 of the basic unit 3 is satisfied. The storage conditions here are set so as to be satisfied when an abnormality occurs during the operation of the programmable logic controller, for example. As described above, the storage condition may be set so as to be satisfied even when the PLC is abnormal, and a process for identifying whether or not the device value is abnormal may be executed. That is, the “device value abnormality” does not necessarily indicate an abnormality in the PLC, but may simply indicate a value different from the usual device value. Therefore, other than when the PLC is abnormal, examples of the storage conditions being satisfied include the timing when a device value different from usual occurs, the timing when a monitoring instruction from the user is received, and after receiving the monitoring instruction from the user. Further, it is possible to assume a designated timing for determining an abnormality after a predetermined execution cycle has elapsed or periodically. These detailed explanations will be described later in the second and third embodiments. It should be noted that at least one of the functions described in the first to third embodiments can be provided.

When the storage condition is satisfied, the CPU 31 of the basic unit 3 in S46 acquires the time-series data to be estimated from the first buffer 37a of the basic unit 3 in order to identify the abnormal device, and stores it in the memory card 44. The data to be estimated is the data of all devices by default, and may be selected according to the operator's specification or may be selected according to the type of abnormality. Further, these time-series data may include time-series data from before a predetermined period when an abnormality occurs to after a predetermined time elapses when an abnormality occurs. Alternatively, the data may be data within a predetermined period after the occurrence of the abnormality.

Next, in S47, the CPU 41a of the expansion unit 4a sets the time-series data stored in the memory card 44 in S46 into each type based on the type of the device corresponding to the time-series data determined at the time of learning. The abnormal device is identified by using the optimum detection method and the evaluation variables and parameters according to the detection method. As described above, according to the present embodiment, the characteristics of changes in device values are extracted during learning, each device value is classified into a predetermined type, and an abnormality appropriate for each type of the classified device (always). (Changes different from) are applied. That is, in the present embodiment, in the learning phase, the device values are classified from the time series data at the normal time, the detection method is determined according to each type, and the evaluation variables and parameters are set according to each detection method. do. On the other hand, in S47 of the estimation phase, an abnormality is detected by applying evaluation variables and parameters, which are detection algorithms determined according to the type of each device classified in the learning phase, to the time series data of the device. Identify. As for the type of time series data, as described above, at the time of classification, the flag information of the type and the identification information of the device corresponding to the time series data are stored in association with each other. Therefore, in S47, the CPU 41a determines the corresponding type from the identification information of the device from which the time series data to be estimated is acquired, and identifies the abnormal device by using the evaluation variable or parameter which is the detection algorithm according to the type. do. The determination method is performed by the method described above according to each parameter.

Here, with reference to FIG. 17, a determination method for identifying the device as an abnormal device will be described. 1701 and 1702 show data of abnormal devices in the types 1201 and 1202 (devices whose values change in a steady pattern in synchronization with a predetermined period). 1711 and 1712 indicate abnormal locations. In this way, if there is a device in which the signal that should change does not change, the change point shifts, or the pulse width differs compared to the normal state, the device is identified as an abnormal device. Can be done. The CPU 41a can discriminate different data from the change in the normal state by using the determined detection algorithm. Further, 1703 shows the data of the abnormal device in the 1203 type (device that takes a constant value). As shown in 1713, since the signal that should take a constant value is changing, it can be identified as an abnormal device.

The 1704 identifies an abnormal device using time-series data of two devices classified into the same type, such as the types 1201 and 1202 (devices whose values change in a steady pattern in synchronization with a predetermined period). The algorithm is shown. In the algorithm, in a device that changes in synchronization with a predetermined cycle, the time interval of the change point of each value of the two devices is checked. For example, suppose that one device has two change points (a1, a2) in one cycle and the other device has four change points (b1, b2, b3, b4) in one cycle. In this case, it may be determined whether or not the time difference at each change point is within the threshold value. Specifically, it is determined whether or not the device is an abnormal device by determining the time difference between the change point a1 and each of the change points b1 to b4 and the time difference between the change point a2 and each of the change points b1 to b4 as the respective threshold values. You may. The parameters in this case are the threshold value of each time difference between the change points, the timing of each change point, and the threshold value of the timing of each change point. When identifying an abnormal device using this determination method, two devices are identified as abnormal devices.

Returning to the description of FIG. Next, in S49, the CPU 41a outputs the specific result of S48 and ends the process. Here, first, the generation unit 74 generates display data for displaying the specific result, transmits the display data to the display unit 5 of the basic unit 3 or an external device, and displays the display data on the display unit. Here, the display screen based on the display data will be described later with reference to FIG.

FIG. 18 shows a display example of a specific result.

The screen 1800 shows the time on the horizontal axis and the number of abnormal devices on the vertical axis. The generation unit 74 generates the display data of the screen 1800 from the device specified as the abnormal device according to the specific result and the time series data at that time. When an error occurs in the programmable logic controller, the equipment tends to stop and the number of abnormal devices tends to increase. Therefore, by displaying the cumulative number of abnormal devices generated for each time interval (for example, every 5 minutes) such as the screen 1800, the operator can easily recognize when the abnormality has occurred. Can be done.

The screen 1810 is a display showing the status of each device identified as an abnormal device. Displays the time when the error occurred and the details of the error for each device. As the content of the abnormality, the information that has led to the determination of the abnormality is displayed. For example, in the device A, in the device that takes a constant value, the value at the normal time was 123, but the value changed to 127, so that it can be seen that it is determined to be abnormal. Further, in the device B, it is shown that the change interval abnormality has occurred in the device that changes in synchronization with a predetermined cycle.

The screen 1820 is a display showing the degree of abnormality of the device to be estimated. The generation unit 74 generates display data for ranking and displaying the degree of abnormality of the estimated device from the specific result. That is, on the screen 1820, candidate devices having a high possibility of abnormality are displayed so as to be identifiable by the device name or the like. As for the display, in addition to the degree of abnormality, the content of the abnormality and the classification of the device may be displayed. Here, the degree of abnormality is determined, for example, by the number of occurrences of abnormality or the magnitude of the difference from a predetermined threshold value. In other words, the degree of abnormality indicates the magnitude of the abnormality. Although the screen 1820 shows an example of displaying in descending order of the degree of abnormality, it may be sorted and displayed according to conditions such as the order of occurrence time. Further, the device may be sorted according to the classification method of the device, or only the content of the abnormality related to the classification method selected by the user in advance may be displayed. For example, the degree of abnormality may be calculated by the following formula using a predetermined threshold value.
Abnormality = (current value-average value) / (threshold value-average value)
That is, it is defined as follows according to the current value. If the current value exceeds the upper limit threshold value, the degree of abnormality is 1 or more. If the current value is equal to the upper limit threshold value, the degree of abnormality is 1. If the current value is equal to the average value, the degree of abnormality is 0. When the current value is equal to the lower limit threshold value, the degree of abnormality becomes -1. If the current value is below the lower threshold, it will be -1. The degree of anomaly may be taken as an absolute value. Further, when the value does not match the predetermined value to be compared, the degree of abnormality may be uniformly set to 1.

The screen 1830 is an example in which the signals of the devices in the normal state and the abnormal state are displayed in a comparable manner. As shown on the screen 1830, it is desirable to highlight the abnormal part. In the example of FIG. 18, the vicinity of the signal at the abnormal portion is displayed so as to be surrounded by a dotted line frame, but the signal at the relevant portion may be displayed in a color different from other colors, or the relevant portion may be displayed blinking. You may.

<Additional learning>
FIG. 21 is a flowchart showing a processing procedure when performing additional learning. Here, the additional learning is a learning process that is additionally performed at a timing different from the learning in the learning phase described with reference to FIG. Various timings are assumed, but as will be described later, when a predetermined device is identified as abnormal even though it is normal in the estimation phase, or when the timing specified by the operator and the system It is a regular timing to respond to changes over time. That is, the additional learning is learning that is additionally performed at the timing when it is necessary to update the learning model such as the parameters for identifying the abnormal device determined in S32. The processing described below is realized by the CPU 41a of the expansion unit 4a. However, there is no intention of limiting the present invention, and a part of those processes may be executed by the basic unit 3 or another expansion unit 4b, or an external device (analysis) communicably connected to the programmable logic controller. It may be executed by the device).

In S201, the CPU 41a (collection unit 52c) collects time-series data of the device to be collected when the device is operating normally according to the set collection setting. The device to be collected includes a plurality of devices to be determined in the estimation phase. In addition, devices that are not subject to determination in the estimation phase may be excluded from devices to be collected. For example, a device classified as a device (1204) that operates irregularly may be excluded from the devices to be collected.

Here, the time series data of the device to be collected when the device is operating normally is the time series of the device that is judged to be abnormal even though the judgment result in the estimation phase should be judged to be normal. It is data. For example, if learning is insufficient in the learning phase, the determination result in the estimation phase may be abnormal. Therefore, the CPU 41a may perform additional learning when the determination result of the time-series data to be collected becomes abnormal even though the device is operating normally. In addition, even if the judgment result in the estimation phase becomes abnormal and the time series data at the time of the abnormality occurrence (a state different from usual) is collected, the time corresponding to the period during normal operation in the time series data. When series data is included, the time series data corresponding to such a period of normal operation also corresponds to the time series data of the device to be collected when the device is operating normally. At this time, if the determination result for the time-series data corresponding to the period of normal operation becomes abnormal, additional learning may be performed using that portion.

Next, in S202, the CPU 41a determines whether the condition for additional learning is satisfied, that is, determines whether the timing for additional learning has arrived. The timing of starting the additional learning is, for example, the timing when a predetermined period has elapsed from the previous learning process, the timing when a predetermined amount of time series data is collected, and the timing when an instruction from the operator is received. Further, the timing of starting additional learning may be a predetermined timing in which the device is estimated to be operating normally in the estimation phase, or may be a timing in which the device is estimated to be operating abnormally in the estimation phase. For example, the device sometimes slows down, but the slowness is within the normal range, or when the air pressure changes and the operating time changes when the device is turned on again (changes over time). For example, it may be effective to update (additional learning) at intervals instead of one learning in order to improve the accuracy.

In S311 the CPU 41a determines whether or not each of the plurality of devices set as the collection target is the determination target in the estimation phase. When the CPU 41a determines that the device is the determination target, it proceeds to step S312 to perform additional learning for the device, and when it determines that the device is not the determination target, it proceeds to step S341 without performing additional learning for the device. .. For example, the CPU 41a determines that the device classified as the device (1204) that operates irregularly is not the determination target, and proceeds to step S341 without performing additional learning.

In S312, the CPU 41a executes the classification process. The classification process is performed in the expansion unit 4a in response to an instruction from the basic unit 3, for example, when a predetermined amount of collected data is stored in the memory card 44 of the basic unit 3 after the power is turned on again. The stored predetermined amount of collected data becomes time-series data of each device collected during the target period of additional learning. The basic unit 3 may detect that a predetermined amount of collected data has been stored in the memory card 44 and send an instruction to start classification to the expansion unit. Further, after the power is turned on again, a sufficient amount of data for learning (time-series data of a predetermined number of scan cycles) is accumulated in a storage unit such as a buffer memory (first buffer 37a) or a memory card 44. May be detected by the expansion unit 4a and started.

Specifically, in S312, the CPU 41a is a device to be classified based on the types determined up to the previous time, the feature amount of the time series data for the device, and the time series data to be classified this time. Is automatically classified. For example, the CPU 41a is classified into a type of device (1203) that takes a constant value by learning up to the previous time, and the time series data collected this time during normal operation for the device includes a value different from the constant value. In that case, the classification is updated to the device (1204) that operates irregularly. Here, the feature amount of the device (1203) that takes a constant value corresponds to the constant value. Similarly, the CPU 41a is classified into a device (1201) that operates in synchronization with the operation cycle of the device by learning up to the previous time, and the time series data at the time of normal operation collected this time for the device is the time series data at the time of the previous learning. If it contains a pattern different from the one, the classification is updated to the device (1204) that operates irregularly. Here, the feature amount of the device (1201) that operates in synchronization with the operation cycle of the device corresponds to the change pattern of the waveform in the operation cycle of the device, that is, the change pattern of the time series data. In addition, when the classification is updated, the detection algorithm determined according to the updated type is also updated. Further, the parameters corresponding in S324 and S334 described later are also updated according to the updated detection algorithm.

The CPU 41a automatically classifies the devices to be classified based on the time-series data to be classified, but in addition to this, the CPU 41a may accept the setting of the type for the devices to be classified. Of the devices to be classified, many devices do not need to change the type, and the operator may be aware of which type should be changed to which type for the type that needs to be changed. Therefore, the CPU 41a accepts the setting of the type for the device to be classified according to the designation of the operator, and stores the flag information indicating the classified type in association with the identification information indicating the device to be classified. Alternatively, it may be classified into devices (1204) that operate irregularly according to the operator's designation, and may be excluded from the determination target in the estimation phase. The type setting for the device to be classified may be executed before the classification by the CPU 41a. For example, when the type setting is executed for a specific device among a plurality of classification target devices based on the operator's specification, the time series data of the classification target by the CPU 41a is applied to the device for which the type is set in advance. Classification based on is not performed. On the other hand, among the plurality of devices to be classified, the CPU 41a executes classification based on the time-series data to be classified for other devices different from the specific device. In particular, when the device type is determined by the previous learning and additional learning is performed, the device type may be fixed by the previous learning based on the operator's specification, and the change may be made. A type different from the device type may be determined by learning up to the previous time based on the operator's specification for the required device. For example, a type that is not used in identifying anomalous devices may be determined.

In S321, the CPU 41a determines whether or not the device type determined by the previous learning is maintained in the reclassification by S312. When the CPU 41a determines that the device type determined by the previous learning is maintained, the CPU 41a shifts to S322 to determine the parameter. On the other hand, if it is determined that the device type determined by the previous learning is not maintained, that is, if it is determined that the device type has been reclassified and updated, the process proceeds to S323, and the CPU 41a updates the classification process. Based on, it is determined whether or not the device is a determination target in the estimation phase. When the CPU 41a determines that the device is the determination target, it shifts to S324 to determine the parameters for the device, and when it determines that the device is not the determination target, it shifts to S341. For example, the CPU 41a determines that the device classified as the device (1204) that operates irregularly is not the determination target, interrupts the additional learning, and shifts to S341.

In S322, the CPU 41a calculates and updates new parameters using the parameters already determined for the target device and the time-series data during normal operation collected this time for the target device, and shifts to S331. For example, when the device (1201) that operates in synchronization with the operation cycle of the device is determined by the learning up to the previous time and the type of the device is maintained, the CPU 41a determines the time series data determined by the learning up to the previous time. Based on the upper and lower thresholds that indicate the time variation between arbitrary change points and the time-series data during normal operation collected this time, the new upper and lower thresholds are set. Calculate and update the threshold value. In this way, based on the time between arbitrary change points of the time series data during normal operation collected this time and the upper limit threshold value and the lower limit threshold value, the new upper limit threshold value and lower limit threshold value are set. By calculating and updating the threshold value, the threshold value after updating according to the time variation between arbitrary change points of the time series data during normal operation collected this time and the degree of deviation from the threshold value. Widens or narrows.

In S324, the CPU 41a calculates and updates the parameters corresponding to the updated type using the time-series data during normal operation collected this time, and shifts to S331. The parameter calculated and determined here may be the same calculation method as the parameter determined in S32 of FIG. For example, various methods such as an average value can be applied to the calculation method, but a method suitable for each time series data is selected. Further, these determined parameters may be changed by the operator. As a result, even if an extreme parameter is determined when the learning period is short, it can be adjusted.

In S331, the CPU 41a determines whether or not the operator has accepted the correction input for the classification for each device. For example, the CPU 41a can accept the setting of the type for the device to be classified and modify the classified type according to the designation of the operator, and the CPU 41a can modify the classification based on the correction input from such an operator. Determine if there was a correction. When the CPU 41a determines that the correction input for the classification is not received from the operator for each device, the CPU 41a shifts to S333.

On the other hand, if it is determined that the correction input for the classification has been received from the operator, the process proceeds to S332, and the CPU 41a determines the suitability of the correction for the set type for the device to be classified according to the operator's designation, and determines that the correction is appropriate. Reflects the modification to the classification type set according to the operator's specification. That is, the CPU 41a determines whether or not the time-series data collected this time during normal operation matches the set classification type. Further, when the CPU 41a determines that the classification type set according to the operator's designation is not suitable, the CPU 41a may notify that it is not suitable, notify that it is not suitable, and prompt the redesignation of the classification. It may be. For example, the CPU 41a is classified into a type of device (1203) that takes a constant value according to the operator's designation, and the time series data collected this time during normal operation includes a value different from the constant value. May notify that the type set by the operator does not match, and may reclassify the device into a device (1204) that operates irregularly. Similarly, the CPU 41a is classified into a device (1201) that operates in synchronization with the operation cycle of the device according to the operator's designation, and the time series data at the time of normal operation collected this time contains a different pattern. May be notified that the type set by the operator does not match, and the device may be reclassified as a device (1204) that operates irregularly. When the processing of S332 is completed, the CPU 41a returns the processing to S321 again in order to determine the parameters according to the modified classification.

In S333, the CPU 41a determines whether or not there is a parameter correction input for each device from the operator. For example, the CPU 41a can further adjust the parameters updated in S322 or S324 according to the correction input of the operator. If it is determined that the parameter correction instruction by the operator is not accepted, the process proceeds to S341. On the other hand, when the operator gives an instruction to correct the parameters, the CPU 41a in S334 matches the time-series data collected this time during normal operation with respect to the parameters for the set classification target device according to the operator's specification. Determine whether or not to do so. When the CPU 41a determines that it is suitable, it reflects the modification to the parameters set according to the operator's designation. Further, when the CPU 41a determines that the modification of the parameter set according to the operator's specification is not suitable, the CPU 41a may notify that it is not suitable, and notify that it is not suitable and prompt the parameter to be redesignated. It may be. The CPU 41a may calculate the parameters by the same calculation method as in S32.

Subsequently, in S341, the CPU 41a determines whether or not the additional learning process has been completed for all the devices to be learned. When the additional learning process is not completed for any of the devices to be learned, the CPU 41a returns the process to S311 in order to perform the additional learning process for the incomplete device. On the other hand, the CPU 41a ends the additional learning process when the additional learning process is completed for all the devices to be learned.

<Modification example>
The present invention is not limited to the above embodiment and can be modified in various ways. For example, in the above embodiment, an example of analyzing and classifying collected data of a bit device or a word device has been described, but the present invention is not limited to such device values. For example, the collected data is not limited to the example described in the above embodiment, and may be information such as a camera image or an event log.

FIG. 19 shows a modified example of the collected data. Here, a case where the collected data is a camera image (moving image) will be described. 1901 shows the camera image to be collected. This is an image of a predetermined location in a factory facility. For example, the CPU 41a may divide these camera images 1901 into a plurality of regions and determine the parameters using the luminance value in the regions as a feature amount. The camera image 1901 shows how a plurality of products 1905 are conveyed at equal intervals on the belt conveyor 1904. In such a case, as shown in 1902, it is possible to determine whether or not the operation is normal by utilizing the fact that the luminance value in the predetermined region 1903 changes with time. For example, in the shaded portion of the camera image 1901, since the product passes at a predetermined time interval, the image (luminance value) of the product is periodically interrupted. By utilizing such a change in the brightness value, it is possible to confirm whether the product is flowing normally or whether the product is skewed on the belt conveyor by monitoring a plurality of areas. Further, although the transport path of the product has been described as an example in FIG. 19, for example, a portion where the robot is driven is photographed, and an image of the arm portion is periodically displayed in a predetermined image area according to the operation of the arm of the robot. It is possible to check whether the robot is operating normally even when interrupting. The camera image may be classified as a device that takes an analog value.

<Second embodiment>
The second embodiment of the present invention will be described below. In the first embodiment, the processing flow when the PLC basically shows an abnormality, that is, when the storage condition is an abnormality of the programmable logic controller has been mainly described. However, as already described, the present invention is not limited to the specific function of identifying an abnormal device by triggering the occurrence of an abnormality in PLC, but also in the process (analysis function) of analyzing the difference from the time series data at the normal time. Can also be applied. Therefore, in the present embodiment, a process of analyzing and verifying whether the collected device value is a value deviating from the time series data at the normal time (device value different from usual) will be described. In the following, only the parts different from the first embodiment will be described.

Also in this embodiment, the characteristics of changes in device values are extracted and classified, and an appropriate abnormality (change different from usual) detection algorithm is applied to each of the classified characteristics. That is, also in the present embodiment, as in the first embodiment, in the learning phase, the device values are classified from the time series data at the normal time, the detection algorithm is determined according to each type, and each of them is used. Set evaluation variables and parameters according to the detection algorithm. Also in this embodiment, these learning phases are performed in advance before the estimation phase is executed, and flag information indicating the classified type and device identification information corresponding to the time series data are stored. In the estimation phase, a detection algorithm determined according to the type of time-series data to be estimated is applied and analyzed to analyze and verify whether the device value is different from usual. That is, the classification process is not performed again in the estimation phase. In this case, it is possible to avoid unprocessable classification processing and unintended update of learning data during operation. The classification process may also be performed in the estimation phase. In this case, based on the normally learned data, the newly obtained time series data that can be regarded as normal is extracted, and the newly extracted time series data and the already learned time series data are already learned. The learning data may be updated in response to changes over time based on the time series data. For example, for a device whose value changes in a steady pattern in synchronization with a predetermined period, the threshold value included in the parameter based on the variation between the newly extracted time series data and the time series data that has already been learned. May be updated.

With reference to FIG. 16, a processing procedure for verifying whether or not the device value is different from the usual device value, that is, whether or not the device value deviates from the normal device value will be described. The processing described below is realized by the CPU 31 of the basic unit 3 and the CPU 41a of the expansion unit 4a. The description will be given only for the process (S45) different from that of the first embodiment, and the description will be omitted for the other processes.

In S45, the CPU 31 determines whether or not the storage condition for storing the device value stored in the first buffer 37a in the memory card 44 of the basic unit 3 is satisfied. Here, it has been described that in the first embodiment, the storage condition is satisfied when an abnormality occurs in the programmable logic controller. However, in the present embodiment, a device to be a save trigger is specified in advance by the user, and if there is a predetermined change in the device, or if there is an analysis command by the user, a monitoring cycle for periodically monitoring elapses. In this case, the storage condition is controlled to be satisfied, such as when an analysis command is issued from the expansion unit connected to the basic unit 3, or when the collected device value is a device value different from usual. For example, when a device value different from the previous one occurs in S43, it may be determined in S45 that the storage condition is satisfied, and the process may proceed to the specific process. Further, it may be controlled so that the storage condition is satisfied according to the difference (degree of deviation) from the previous device value and the number of generated device values different from the normal state. The analysis instruction from the user can be instructed to analyze and verify a specific device in real time, but may be an instruction to verify the past data of the specific device. Further, in S47, instead of identifying the abnormal device, the abnormal state deviating from the time series data at the normal time is analyzed and verified.

Next, a display example of the analysis result according to the present embodiment will be described with reference to FIG. Formally, the display is the same as the specific result of the first embodiment, but in this embodiment, the abnormal device is not specified, and a deviation from the time-series data at the normal time occurs ( (Abnormal state) is specified, and the displayed contents are changed accordingly.

Therefore, for example, on the screen 1800, not the number of abnormalities of the device but the number of times the deviation from the normal time series data has occurred is shown. The degree of abnormality is also calculated not by using the number of times the device abnormality has occurred, but by using the number of times the abnormal state has occurred in the present embodiment, that is, the number of times the deviation from the normal time series data has occurred. Is desirable.

<Third embodiment>
Hereinafter, a third embodiment of the present invention will be described. In the first and second embodiments, the specific function and the analysis function have been described, respectively. In the present embodiment, a monitoring function for periodically collecting and monitoring device values will be described. In the following, only the parts different from the first and second embodiments will be described.

FIG. 20 shows a flowchart showing a processing procedure for outputting a monitoring start signal for starting monitoring according to the present embodiment. The process described below is executed by the CPU 31 of the basic unit 3. However, there is no intention of limiting the present invention, and it may be executed by the CPU 41a of the expansion unit 4a.

In S51, the CPU 31 determines whether or not the monitoring cycle has elapsed. The monitoring cycle is a value that can be set by the operator (administrator) of the programmable logic controller, and any cycle can be set. The set value is set, for example, in the collection setting 36a of the storage device 32. If the monitoring cycle has elapsed, the process proceeds to S53, otherwise the process proceeds to S52.

In S52, the CPU 31 determines whether or not the monitoring instruction has been received from the user. The monitoring instruction can be received through user input via the operation unit 6 of the PC 2a or the basic unit 3. If the monitoring instruction from the user is received, the process proceeds to S53, and if not, the process returns to S51.

In S53, the CPU 31 generates a monitoring start signal, outputs it to the basic unit 3, and ends the process. When the basic unit 3 receives the monitoring start signal, it determines that the storage condition is satisfied in S46 of FIG. 16, executes the processing after S47, and executes the analysis processing. Here, the storage condition of S46 is satisfied immediately after receiving the monitoring start signal, and time-series data stored in the memory card 44 from before a predetermined period to the present is collected. Further, the storage condition of S46 is satisfied after a predetermined execution cycle has elapsed after receiving the monitoring start signal, and the time series data stored in the memory card 44 during the predetermined period after receiving the monitoring start signal is stored. You may collect it. Alternatively, the storage condition of S46 is satisfied after a predetermined execution cycle has elapsed after receiving the monitoring start signal, and time-series data stored in the memory card 44 is collected during a predetermined period before and after receiving the monitoring start signal. You may.

The data to be monitored can be selected by user setting. As in the second embodiment, in S48, the abnormal device is not specified, but the abnormal state deviating from the time series data at the normal time is analyzed and verified. Further, the analysis result is output in the same manner as in the second embodiment.

<Summary>
As described above, the programmable logic controller according to the present embodiment includes an execution engine that repeatedly executes the user program and a device memory having a plurality of devices that are storage areas for storing data accessed by the execution engine according to the user program. To be equipped. In addition, the programmable logic controller collects the data held by the device to be collected among a plurality of devices according to a predetermined collection setting for each scan cycle of the user program, and features the time-series data of each collected device. Based on this, each device is classified into one of a plurality of types, and an abnormal device is identified for each device according to the time series data of the device collected by the collecting means and the type in which the device is classified by the classification means. Determine the detection algorithm when doing so. Further, by analyzing the time series data of the device collected by the collecting means according to the type in which the device is classified by the classification means, the device is analyzed by using the detection algorithm determined by the determining means. Identify the anomalous device. As described above, according to the programmable logic controller according to the present embodiment, features such as periodicity and continuity of data related to each device can be analyzed and classified, and an abnormal device can be efficiently identified.

In addition, this program controller further analyzes the deviation of the collected time-series data of each device from the normal time-series data by using the determined detection algorithm in response to the user's instruction, and an abnormality occurs. Verify if not. It should be noted that such an analysis function may be performed periodically at a predetermined cycle (monitoring function).

Further, when the time-series data of a predetermined number of scan cycles are accumulated, the programmable logic controller classifies each time-series data based on the characteristics of the time-series data, determines the detection algorithm, and updates the time-series data. As described above, according to the present invention, the function corresponding to the learning phase is periodically executed during the operation of the programmable logic controller, and the accuracy in the specific processing at the time of abnormality can be improved.

Further, in this programmable logic controller, in one or more groups of devices, the value collected in the previous scan cycle and the value collected in the current scan cycle must be changed in all the devices in the group to be collected. For example, the values collected in this scan cycle are deleted, and the time-series data to be collected is compressed. As a result, memory resources can be effectively used.

Further, in this programmable logic controller, at least, among a plurality of devices, a device that takes a constant value and a device whose value changes in a steady pattern in synchronization with the operation cycle of the device have different operation cycles of the device. It is classified into a device whose value changes in a steady pattern in synchronization with a cycle, a device whose value changes irregularly, a device having an analog value, and a device whose value monotonically increases or decreases. Furthermore, by determining the detection algorithm based on the characteristics based on these classifications, it is possible to efficiently identify the abnormal device at the time of abnormality. Note that devices whose values change irregularly cannot extract features, so they are not used to identify abnormalities.

Further, when the programmable logic controller identifies an abnormal device, it compares the determined detection algorithm with the characteristics of the time series data corresponding to the detection algorithm, and when the difference exceeds a predetermined threshold value. In addition, identify it as an abnormal device. Further, this programmable logic controller determines the time difference between the change points of the respective values in the two time series data as a detection algorithm when identifying an abnormality, and the time difference between the two time series data is not within a predetermined range. In some cases, the two devices corresponding to the two time series data may be identified as abnormal devices. As described above, according to the present invention, the detection algorithm is determined according to each of the classified types, and when an abnormality occurs, the abnormal device is identified by a method suitable for each type using the detection algorithm.

In addition, the programmable logic controller creates display data indicating a specific result and displays it on the display device of the programmable logic controller or transmits it to an external device. As the display screen, a specific result can be displayed on various display screens (FIG. 18).

Further, in the above embodiment, an example in which the expansion unit 4a included in the programmable logic controller collects and classifies time series data, determines a detection algorithm according to the classification, and identifies an abnormal device in the event of an abnormality has been described. However, the present invention is not limited to this, and at least a part of the above-mentioned functions may be realized by a basic unit or another expansion unit. Further, an analyzer (external device) communicatively connected to the programmable logic controller may realize the above-mentioned functions.

The invention is not limited to the above-described embodiment, and various modifications and changes can be made within the scope of the gist of the invention.

Claims (20)

An execution engine that repeatedly executes the user program,
A device memory having a plurality of devices, which is a storage area for storing data accessed by the execution engine according to the user program, and
A collection means for collecting data held by the device to be collected among the plurality of devices according to a predetermined collection setting for each execution cycle of the user program.
A classification means for classifying each device into one of a plurality of types based on the characteristics of the time series data of each device collected by the collection means.
For each device, a determination means for determining a detection algorithm for identifying the device as an abnormal device according to the time series data of the device collected by the collection means and the type in which the device is classified by the classification means.
Anomalous devices are analyzed by analyzing the time-series data of the devices collected by the collecting means according to the type in which the devices are classified by the classification means using the detection algorithm determined by the determining means for the devices. A programmable logic controller, characterized in that it comprises a specific means of identifying the. The specific means further, in response to a user instruction or periodically, using the detection algorithm determined by the determination means, the time series data of each device collected by the collection means and the time series in normal time. The programmable logic controller according to claim 1, wherein an abnormal device is identified by analyzing a deviation from data. When the time-series data of a predetermined number of scan cycles are accumulated by the collection means, the classification means classifies each time-series data based on the characteristics of the time-series data.
The programmable logic controller according to claim 1 or 2, wherein the determination means determines and updates the detection algorithm when identifying an abnormality according to the time-series data classified by the classification means. The programmable logic controller according to any one of claims 1 to 3, wherein when the classification means receives a user instruction for an arbitrary device, the device is classified according to the user instruction. If the value collected in the previous scan cycle and the value collected in the current scan cycle are not changed in all the devices in the group to be collected in the group of one or more devices, the collection means is described. The programmable logic controller according to any one of claims 1 to 4, wherein the values collected in the current scan cycle are deleted and the collected time-series data is compressed. The types are a type that takes a constant value, a type in which the value changes in a steady pattern in synchronization with the operation cycle of the programmable logic controller, and a type in which the value is constant in synchronization with a cycle different from the operation cycle. A claim characterized by including at least two types of a device that changes in a pattern, a type in which a value changes irregularly, a type in which an analog value is used, and a type in which a value monotonically increases or decreases. The programmable logic controller according to any one of 1 to 5. The sixth aspect of claim 6 is characterized in that the determination means excludes time-series data classified as a device whose value changes irregularly by the classification means and determines a detection algorithm for identifying an abnormality. Programmable logic controller. The specific means analyzes by using the evaluation variable used for the analysis of the abnormal device and the parameter corresponding to the evaluation variable based on the type of the time series data classified by the classification means as the detection algorithm. The programmable logic controller according to any one of claims 1 to 7, wherein an abnormal device is identified. Further equipped with an additional learning determination means for determining whether or not the additional learning conditions are satisfied,
When it is determined that the additional learning condition is satisfied by the additional learning determination means, the classification means determines the type of each current device and the time series data of each device collected by the collection means during the target period of the additional learning. Each device is reclassified into one of a plurality of types based on the characteristics of the device, and the determination means includes time-series data of the devices collected by the collection means for each device during the target period of additional learning. The eighth aspect of claim 8, wherein the detection algorithm for identifying the device as an abnormal device is redetermined according to the type in which the device is reclassified by the classification means or the current detection algorithm of each device. Programmable logic controller. The specific means compares the detection algorithm determined by the determination means with the characteristics of the time-series data corresponding to the detection algorithm, and identifies the device as an abnormal device when the difference exceeds a predetermined threshold value. The programmable logic controller according to any one of claims 1 to 9, wherein the programmable logic controller. The determination means determines the time difference between the change points of the respective values in the two time series data as a detection algorithm for identifying an abnormality.
The specific means is characterized in that when the time difference between the two time series data is not within a predetermined range, the two devices corresponding to the two time series data are specified as abnormal devices. The programmable logic controller according to any one of 1 to 10. The programmable logic controller according to any one of claims 1 to 11, further comprising an output means for identifiable output of a candidate device having a high possibility of abnormality as a specific result. 12. The output means is characterized in that, as the specific result, each device is displayed on the display unit in descending order of the degree of abnormality indicating the magnitude of the abnormality or in the order of the earliest occurrence time of the abnormality. Programmable logic controller described in. The output means is characterized in that, as the specific result, the normal time series data of the device identified as the abnormal device and the abnormal time series data are displayed on the display unit in a comparable manner. 12. The programmable logic controller according to 12 or 13. The programmable logic controller according to any one of claims 1 to 14, wherein the time-series data collected by the collecting means includes image data. The programmable logic controller according to any one of claims 1 to 15, wherein the feature of the time series data is a feature relating to periodicity or continuity. Further equipped with a basic unit and an expansion unit connected to the basic unit,
The basic unit is
The execution engine, the device memory, and the collection means are included.
The expansion unit
The programmable logic controller according to any one of claims 1 to 16, further comprising the classification means, the determination means, and the specific means. A setting means for setting the monitoring cycle of the device and
A generation means for generating a monitoring start signal for starting monitoring for each monitoring cycle set by the setting means, and a generation means for generating a monitoring start signal.
In response to the monitoring start signal generated by the generation means, the time-series data to be analyzed among the devices collected by the collection means and the detection algorithm determined by the determination means are used. The programmable logic controller according to any one of claims 1 to 17, further comprising an analysis means for analyzing the time-series data to be analyzed and outputting the analysis result to the display unit. One of claims 1 to 18, further comprising a memory card that temporarily holds the time-series data of the device collected by the collecting means before being used by the classification means and the specific means. Programmable logic controller described in. An execution engine that repeatedly executes the user program, a device memory having a plurality of devices that are storage areas for storing data accessed by the execution engine according to the user program, and a predetermined collection setting for each scan cycle of the user program. An analyzer that is communicably connected to a programmable logic controller comprising a collecting means for collecting data held by the device to be collected among the plurality of devices according to the above.
An acquisition means for acquiring time-series data of each device collected by the collection means from the programmable logic controller, and
A classification means for classifying each device into one of a plurality of types based on the characteristics of the time series data of each device acquired by the collection means.
For each device, a determination means for determining a detection algorithm for identifying the device as an abnormal device according to the time series data of the device collected by the collection means and the type in which the device is classified by the classification means.
Anomalous devices are analyzed by analyzing the time-series data of the devices collected by the collecting means according to the type in which the devices are classified by the classification means using the detection algorithm determined by the determining means for the devices. With specific means to identify
An analyzer comprising an output means for outputting a specific result by the specific means.

Images