JP2022158226A - Analysis device, analysis system, and method for controlling the same - Google Patents

Abstract

To provide an analyzer capable of easily identifying a cause of abnormality without requiring a complicated user operation by providing a report capable of easily identifying the cause of the abnormality according to an analysis result of operation record data.SOLUTION: An analysis device includes: an execution engine for repeatedly executing a user program; acquisition means for acquiring operation record data including a plurality of device values in time series collected by executing the user program; model generation means for generating a model including an analysis parameter for each device based on the learning of the acquired operation record data at a normal time; analysis means for analyzing an abnormal device which does not satisfy a normal condition according to the model for the acquired operation record data of an analysis object; and report generation means which generates an analysis report including an expression corresponding to the analysis parameter based on an analysis result of each device detected as the abnormal device.SELECTED DRAWING: Figure 17

Description

The present invention relates to an analyzer, an analysis system, and a control method thereof.

A programmable logic controller (PLC) is a controller that controls industrial machines such as manufacturing equipment, transport equipment, and inspection equipment in factory automation (Patent Documents 1 and 2). The PLC controls various expansion units and controlled devices by executing user programs such as ladder programs created by programmers.

Japanese Patent No. 5661222 JP 2018-097662 A

By the way, in order to monitor the operation of the PLC and the operation of the industrial machine controlled by the PLC, it is desired to collect and utilize the data held by the PLC. A PLC has a basic unit (CPU unit) and an expansion unit connected thereto. The basic unit controls the expansion units by executing user programs such as ladder programs. The expansion unit controls the industrial machine according to the instructions from the basic unit and returns control results to the basic unit.

Data such as these control results are used for trouble analysis and quality control. Therefore, it is required to accumulate and analyze these data and to obtain analysis results early for recovery. However, when recording data of all devices related to PLC, a huge amount of data will be stored, and in order to identify abnormal devices, it is necessary to analyze these huge amounts of data (all devices). This is a time-consuming task. In addition, experience and knowledge are required to identify abnormal devices from a huge amount of analysis results and restore the system. Therefore, there is a demand for a mechanism that efficiently analyzes a huge amount of data related to each device and displays the analysis results without requiring sufficient specialized knowledge and experience.

Therefore, in view of the above problem, it is an object of the present invention to provide a report that allows easy identification of the cause of an abnormality according to the analysis results of driving record data. Another object of the present invention is to provide a report capable of easily identifying the cause of an abnormality without requiring complicated user operations.

The present invention is, for example, an analysis apparatus comprising an execution engine that repeatedly executes a user program, and acquisition means that acquires driving record data including a plurality of time-series device values collected by executing the user program. a model generating means for generating a model including analysis parameters for each device based on the learning of the acquired driving record data in a normal state; and the acquired driving record data to be analyzed satisfies a normal condition according to the model. and a report generating means for generating an analysis report including an expression according to the analysis parameters based on the analysis result of each device detected as the abnormal device. do.

According to the present invention, a user is provided with information on a device that has behaved differently than usual and the cause thereof.

Diagram explaining the PLC system A diagram explaining the hardware of the PC 2a Diagram explaining the hardware of PC2b Diagram explaining PLC hardware A diagram for explaining functions realized by a CPU of a PC. Diagram for explaining the functions realized by the CPU of the PLC Flowchart showing basic flow Diagram explaining the result display screen Diagram explaining the result display screen Diagram explaining relation map A diagram explaining the details of an analysis comment Flowchart showing model generation flow Diagram for explaining cycle pattern discrimination control Diagram showing classification of collected data Flowchart showing classification process steps Flowchart showing the result display flow of the analysis unit Flowchart showing result display flow of PC Flowchart showing analysis comment generation flow using natural language Flowchart showing analysis comment generation flow by graphic Figure showing the settings screen for defining a cycle Diagram explaining the warning when the cycle is not set Diagram explaining model confidence Diagram for explaining a modification of the PLC system Diagram explaining the processing flow of the cycle

Embodiments are described in detail below with reference to the accompanying drawings. It should be noted that the following embodiments do not limit the invention according to the claims, and not all combinations of features described in the embodiments are essential to the invention. Two or more of the features described in the embodiments may be combined arbitrarily. Identical or similar configurations are given the same reference numerals, and duplicate descriptions are omitted. A lowercase letter may be added to the end of the reference number to distinguish between configurations. Lowercase letters may be omitted when items common to a plurality of configurations are described.

<System configuration>
First, the configuration and operation of a typical PLC will be described so that those skilled in the art can better understand programmable logic controllers (PLCs, which may be simply called programmable controllers).

FIG. 1 is a conceptual diagram showing one configuration example of a PLC system according to an embodiment of the present invention. As shown in FIG. 1, the PLC system includes a PC 2a for editing user programs such as ladder programs, a PC 2b for displaying analysis results, etc., and a PLC 1 for comprehensively controlling various industrial machines installed in factories and the like. , and a field device 10 such as a camera connected to the PLC 1 . PC is an abbreviation for personal computer. In the following description, when PC2 is simply described, the configuration and control of PC2a and PC2b are described. The user program may be created using a graphical programming language such as a ladder language or a flowchart-type motion program such as SFC (Sequential Function Chart), or may be created using a high-level programming language such as C language. . In the following, for convenience of explanation, it is assumed that the user program executed by the basic unit 3 is a ladder program. The PLC 1 has a basic unit 3 with a built-in CPU and one or more expansion units 4 . One or a plurality of extension units 4 are detachable from the basic unit 3 .

The basic unit 3 has a display section 5 and an operation section 6 . The display unit 5 can display the operation status of each expansion unit 4 attached to the basic unit 3 . The display section 5 switches the display content according to the operation content of the operation section 6 . The display unit 5 normally displays current values (device values) of devices in the PLC 1, error information occurring in the PLC 1, and the like. Here, the devices include various devices (relays, timers, counters, etc.) included in the basic unit 3 and expansion unit 4, and are stored in memory provided for storing device values (device data). It also refers to an area and may be called a device memory. Note that the device memory is a non-volatile memory, and may be composed of a rewritable non-volatile ROM, or a volatile RAM or the like may be made non-volatile by battery backup or the like. ROM is an abbreviation for read-only memory. RAM is an abbreviation for random access memory. A device value is information that indicates the state of an input from an input device, the state of an output to an output device, and the state of internal relays (auxiliary relays), timers, counters, data memories, etc. that are set on a user program. Device value types include bit type and word type. A bit device stores a 1-bit device value such as 0/1, ON/OFF, H/L, and the like. A word device stores a device value of one word. A variable may be specified as a device as a collection target of the data utilization program described in detail below. Variables are also holding means for holding information and are accessed by the execution engine according to the user program. Therefore, devices also refer to variables in the following description. Note that the memory that holds the device may be called a device memory. A memory that holds collected data may also be referred to as a data memory. The PLC 1 may be configured to handle variables as well as devices, the devices and variables are called symbols, and the values indicated by the symbols are called symbol values.

An extension unit 4 is provided to extend the functions of the PLC1. A field device (controlled device) 10 corresponding to the function of the expansion unit 4 may be connected to the expansion unit 4 , whereby each field device 10 is connected to the basic unit 3 via the expansion unit 4 . be done. The field device 10 may be an input device such as a sensor or camera, or an output device such as an actuator. Also, a plurality of field devices may be connected to one expansion unit 4 .

For example, the expansion unit 4b may be a positioning unit that drives a motor (field device 10) to position a workpiece, or may be a counter unit. The counter unit counts signals from an encoder (field device 10) such as a manual pulser.

The analysis unit 4a collects symbol values from symbols (devices, variables, etc.) in the basic unit 3, analyzes the symbol values and creates an analysis report containing the analysis results. The analysis unit 4a may have a web server that provides analysis reports to an external PC 2b. The basic unit 3 is sometimes called a CPU unit. A system including PLC1 and PC2 may be called a programmable logic controller system. In the present embodiment, an example in which the analysis unit 4a collects data of each device will be described, but the collection section may be provided in the basic unit 3 or may be provided in another expansion unit. The analysis unit 4a can also function as an analysis device that analyzes the collected data according to instructions from the basic unit 3 or predetermined timing. In this embodiment, an example in which the analysis unit 4a operates as an analysis device will be described. The device may function as an analytical device. The flow (flow program) described below is merely an example of a data utilization program. The basic unit 3 is sometimes called a CPU unit. A system including PLC1 and PC2 may be called a programmable logic controller system.

PC2a is a computer operated primarily by a programmer. On the other hand, the PC 2b is a computer mainly operated by the person in charge on site. The PC 2b may be a programmable display whose screen is set by the user. In this case, the screen for displaying the analysis results and the like may be set by the user, or a web browser function may be installed in advance and the analysis results and the like may be displayed by the web browser function. The PC 2a may be called a program creation support device (setting device). The PC 2 is, for example, a portable notebook-type or tablet-type personal computer or a smart phone, and is an external computer provided with a display unit 7 and an operation unit 8 . An external computer is a computer outside PLC1. A ladder program, which is an example of a user program for controlling the PLC 1, is created using the PC 2a. The created ladder program is converted into a mnemonic code within the PC 2a. The PC 2 is connected to the basic unit 3 of the PLC 1 via a communication cable 9 such as a USB (Universal Serial Bus) cable. For example, the PC 2a sends the basic unit 3 a ladder program converted into mnemonic codes. The basic unit 3 converts the ladder program into machine code and stores it in memory provided in the basic unit 3 . Although the mnemonic code is transmitted to the basic unit 3 here, the present invention is not limited to this. For example, the PC 2a may convert the mnemonic code into an intermediate code and send the intermediate code to the basic unit 3.

Although not shown in FIG. 1, the operation unit 8 of the PC 2 may include a pointing device such as a mouse connected to the PC 2. FIG. Also, the PC 2 may be detachably connected to the basic unit 3 of the PLC 1 via a communication cable 9 other than the USB cable. Also, the PC 2 may be connected to the basic unit 3 of the PLC 1 by wireless communication without using the communication cable 9 .

<Program creation support device>
FIG. 2 is a block diagram for explaining the electrical configuration of the PC 2a. As shown in FIG. 2, the PC 2a includes a CPU 11a, a display section 7a, an operation section 8a, a storage device 12a, and a communication section 13a. The display unit 7a, the operation unit 8a, the storage device 12a, and the communication unit 13a are each electrically connected to the CPU 11a. The storage device 12a includes RAM, ROM, HDD, SSD, and may also include a removable memory card. CPU is an abbreviation for central processing unit. HDD is an abbreviation for hard disk drive. SSD is an abbreviation for solid state drive.

The user of the PC 2a causes the CPU 11a to execute the project editing program 14a stored in the storage device 12a, and edits the project data 15 through the operation section 8a. That is, the PC 2a is an engineering tool and functions as a program creation support device. A project creation unit 16 and a project transfer unit 17 are implemented by the CPU 11a executing the project editing program 14a. A project creation unit 16 creates project data 15 according to user input. The project transfer unit 17 transfers the project data 15 to the PLC1. The project data 15 includes one or more user programs (eg, ladder program, control program, motion program, data utilization program), configuration information of the basic unit 3 and expansion unit 4, WebHMI drawing data, basic unit 3 and expansion It includes setting information for specific functions provided in the unit 4, and the like. The configuration information includes connection positions of the plurality of extension units 4 to the base unit 3 and device allocation information. It includes information indicating functions provided in the basic unit 3 (eg data collection function, communication function, positioning function), information indicating functions of the expansion unit 4 (eg communication function, positioning function, imaging function), etc. good too. Drawing data is a group of display parts for realizing WebHMI, and includes markup data describing front-end structure, such as HTML data, style data describing decoration, such as CSS data, and code describing dynamic processing. For example, it is implemented by a JavaScript (registered trademark) code or the like. The style data describing the decoration may be provided, for example, in the form of a file and may be invoked by a description calling an external style data file within the markup data describing the structure. The code describing the dynamic processing may be provided, for example, in the form of a file, and may be invoked by descriptions calling external code files within markup data describing the structure. A front-end that can be used by calling an external style data file or an external code file has high reusability and maintainability, and can use, for example, general-purpose front-end components. The drawing data is hereinafter referred to as a display component. The data utilization program includes programs for collecting control data (device values, etc.) in the PLC 1, processing the data, and creating data to be passed to the WebHMI. The setting information of the specific function is the setting information related to the functions provided in the basic unit 3 (eg data collection function, communication function, positioning function). It includes information such as setting information related to the functions of the expansion unit 4 (eg, communication function, positioning function, data utilization function, photographing function). Here, editing of the project data 15 includes creation and modification (re-editing) of the project data 15 . The user can read the project data 15 stored in the storage device 12a and change the project data 15 using the project editing program 14a, as required. The communication section 13a communicates with the basic unit 3 via the communication cable 9a. The project transfer section 17 transfers the project data to the basic unit 3 via the communication section 13a. The communication section 13a communicates with the analysis unit 4a via the communication cable 9b.

<PC used to display the dashboard>
FIG. 3 is a block diagram for explaining the electrical configuration of the PC 2b. As shown in FIG. 3, the PC 2b includes a CPU 11b, a display section 7b, an operation section 8b, a storage device 12b, and a communication section 13b. The display unit 7b, the operation unit 8b, the storage device 12b, and the communication unit 13b are electrically connected to the CPU 11b. The storage device 12b includes RAM, ROM, HDD, SSD, and may also include a removable memory card.

The CPU 11b implements the web browser 18 by executing the web browser program 14d. The web browser 18 accesses the setting page of the data utilization application provided by the analysis unit 4a and the dashboard page via the communication unit 13b. Further, the CPU 11b displays the identification result (determination result) on the display section 7b according to the screen information indicating the identification result (determination result) at the occurrence of the abnormality transmitted from the analysis unit 4a.

<PLC>
FIG. 4 is a block diagram for explaining the electrical configuration of the PLC1. As shown in FIG. 4 , the basic unit 3 includes a CPU 31 , display section 5 , operation section 6 , memory 32 and communication section 33 . The display unit 5, the operation unit 6, the memory 32, and the communication unit 33 are electrically connected to the CPU 31, respectively. Memory 32 may include RAM, ROM, memory cards, and the like. The memory 32 has a plurality of storage areas such as a device section 34, a project storage section 35, a ring buffer 36, a driving record storage section 37, and the like.

Here, the operation record is a record of the operation state of the PLC 1 at the scan time level. For example, the symbol values and collection times of all symbols related to the operation of the PLC 1 are recorded in time series for each scan. . All symbols related to operation may be all symbols used in user programs such as ladder programs, or may be all symbols included in program units or unit units selected by the user. . In this case, the symbols to be the target of the operation record can be collectively selected in significant units such as program units and unit units, and symbols can be individually added or subtracted. As a result, for example, when a trouble occurs, the symbol values of all the symbols related to the operation of the PLC 1 before and after the trouble occurrence time and the collection times are recorded in time series for each scan to generate an operation record, and the operation record is generated. Based on this, it is possible to accurately grasp what happened when a problem occurred even afterward. Driving records contain a lot of information in order to reproduce the situation at that time. , can be selected for each program or unit by the user to be collected.

In addition to the symbols, the driving records may include time-series camera images together with the times at which they were captured. As a result, when a problem occurs, for example, it is possible to accurately understand what happened before and after the time the problem occurred. Camera images can be recorded in conjunction with A writing history from an external device such as an HMI (Human Machine Interface) or a PC or a writing history from a PLC may be included in the driving record as change point events. As a result, for example, it is possible to check in chronological order what kind of change point events occurred before and after the trouble occurred.

The device unit 34 has bit devices, word devices, etc., and each device stores a device value. The project storage unit 35 stores project data transferred from the PC 2a. The ring buffer 36 periodically collects and stores device values from the device unit 34 . When a predetermined event occurs, the driving record storage unit 37 stores an event record including the device values collected around the occurrence time (before the occurrence time, after the occurrence time, or before and after the occurrence time) and the collection time. Remember. An event means, for example, that an alarm condition or caution condition set for each device is met. An alarm condition is, for example, a condition under which the control operation of the manufacturing line by the PLC 1 should be stopped. The caution condition is, for example, a device value condition that the manager should pay attention to when controlling the manufacturing line by the PLC 1 . The CPU 31 transmits the event record to the PC 2a in response to the request from the PC 2a. Also, the CPU 31 may provide the device value to the PC 2a in real time. The memory 32 also stores control programs executed by the CPU 31 of the basic unit 3 . As shown in FIG. 3, the basic unit 3 and the expansion unit 4 are connected via a unit internal bus 90 which is a kind of expansion bus. Although the communication function related to the unit internal bus 90 is implemented in the CPU 31, it may be implemented as part of the communication section 33. FIG. The communication unit 33 may have a serial communication circuit conforming to the USB standard or the like. The CPU 31 receives the project data from the PC 2a via the communication section 33. FIG.

Here, the unit internal bus 90 will be additionally explained. This unit internal bus 90 is a communication bus used for input/output refresh. Input/output refresh is processing for updating device values between the basic unit 3 and the expansion unit 4 . The input/output refresh is executed each time the ladder program is executed (that is, each scan).

The expansion unit 4 has a CPU 41 and a memory 42 . The CPU 41b of the expansion unit 4b controls the field device 10 according to instructions (device values) from the basic unit 3 stored in the device. Note that the expansion unit 4b functions as a camera control unit in this embodiment. Further, the CPU 41b stores the control result of the field device 10 such as a camera in a device called a buffer memory. The control result stored in the device is transferred to the basic unit 3 by input/output refresh. Also, the control result stored in the device may be transferred to the basic unit 3 according to a read command from the basic unit 3 even at a timing different from the input/output refresh. The memory 42 includes RAM, ROM, and the like. Among other things, a storage area is reserved in the RAM to be used as a buffer memory. The memory 42 may have a buffer that temporarily holds data acquired by the field device 10 (eg, still image data or moving image data).

The CPU 41a of the analysis unit 4a functioning as a data utilization unit (analysis unit) communicates with the PC 2b via the communication section 43 and the communication cable 9b. Communication unit 43 includes a communication circuit that performs network communication. By analyzing the device values collected in the basic unit 3, the CPU 41a creates an analysis report including the analysis results. For example, the CPU 41a executes a driving record analysis application as a data utilization application to analyze the symbol values included in the driving record data, thereby identifying an abnormal symbol and the time when the symbol becomes abnormal, An analysis report is created that includes analysis results in which abnormal symbols are associated with times when the symbols become abnormal. Since the driving record data includes information for reproducing the situation around the time when the storage event occurred in the driving record, it may be managed in association with the analysis report. In addition, since the driving record data reproduces the situation around the time when the saving event occurred in the driving record, the data size is large because it includes the symbol values of many symbols. Therefore, for example, the CPU 41a may read data necessary for the analysis report from the driving record data, and additionally save the read data in the driving record data as data for the analysis report. As for the data for the analysis report, the data necessary for the analysis report that was originally included in the driving record data may be copied as it is, tagged as the data for the analysis report, and additionally saved in the driving record data. Data may be processed for an analysis report and additionally stored in the driving record data.

When a camera image is included in the driving record data, it is possible to grasp in more detail the situation around the time when the saving event occurred in the driving record by reproducing the camera image. The analysis report may include a UI (user interface) that reproduces camera images. Since a camera image has a large data size, only necessary camera image data may be partially downloaded when a click or scroll operation is received on the UI for reproducing the camera image. For example, when creating an analysis report, the CPU 41a processes the camera images in accordance with the display order in the analysis report, generates index information indicating the correspondence between the time and the storage position of the camera image, The camera image may be downloaded partially at high speed.

In a narrow sense, the analysis report means the analysis result itself, but in a broader sense, it may mean a web application displaying the analysis result and its user interface. The CPU 41a determines, for example, whether the device value is within the normal range and whether the timing at which the device value changes is within the normal range. Whether the timing at which the device value changes is within the normal range may be, for example, whether the length of the period during which the device value is "1" (on) is within the normal range. It may also be determined whether the number of device value changes in a step or cycle is within a normal range. If the device values collected from a device do not meet normal conditions, the device may be called an abnormal device because the device behaves differently than usual. The CPU 41a may create a web-format analysis report and provide the analysis report to the web browser of the PC 2b via the communication unit 43 and the communication cable 9b. If the CPU 31 has a protocol conversion function, the CPU 41a may transmit the analysis report to the PC 2a via the unit internal bus 90, CPU 31, communication section 33 and communication cable 9a. The analysis report may have a graph display component, a numerical display component, and the like. These display components are realized by markup data describing the structure of the front end, style data describing decoration, and code describing dynamic processing, such as HTML data, CSS data, and JavaScript (registered trademark) code. . HTML is an abbreviation for Hypertext Markup Language. CSS is an abbreviation for Cascading Style Sheets.

<Functions of PC2b>
FIG. 5 is a diagram for explaining functions realized by the CPU 11b of the PC 2b. The CPU 11b of the PC 2b executes the web browser 18 by executing the web browser program 14d. The web browser 18 executes the web application 61 and implements functions of a communication processing unit 62 , a data acquisition unit 63 , a drawing unit 65 , a reception unit 66 and a reproduction unit 67 . The web browser 18 also communicates with a web server 82 of the analysis unit 4a, which will be described later, according to HTTP (hypertext transport protocol) to receive display components.

The web browser 18 executes the web application 61 to display the analysis report on the display unit 7b. The web application 61 is composed of, for example, HTML data, CSS data, java(R) scripts, and the like. A web application 61 may be provided from the analysis unit 4a. The communication processing unit 62 processes communication with the web server 82 . The data acquisition unit 63 acquires driving record data to be displayed in the analysis report from the analysis unit 4a. The driving record is downloaded and stored in the storage device 12b. The drawing unit 65 displays the analysis report on the display unit 7b. The linking unit 64 performs time management so that the playback time in the analysis report and the playback time in the driving record are synchronized.

The receiving unit 66 receives an operation or the like on the result display screen of the analysis report. For example, in response to a reproduction request input from the reception unit 66 or the cooperation unit 64, the reproduction unit 67 causes the driving record data to be downloaded and stored in the storage device 12b. The reproduction request may include, for example, identification information that can identify the driving record (eg, unique identification information or a storage path name in the PLC 1). The reproducing unit 67 reproduces the driving record stored in the storage device 12 and displays it on the display unit 7 . The reproducing unit 67 may waveform and display the time-series device values obtained from the PLC 1 in real time, or may waveform and display the time-series device values included in the driving record.

<Function of PLC1>
FIG. 6 shows functions realized by the CPU 31 and the CPU 41a executing the control program in the PLC 1. As shown in FIG. A command processing unit 71 in the CPU 31 interprets commands received from the PCs 2a and 2b, and executes processing corresponding to the interpretation result. For example, when a request signal created by encapsulating an HTTP request is received, the command processing unit 71 transfers the request signal to the CPU 41a. When a response signal to the request signal is received from the CPU 41a, the command processing section 71 transfers the response signal to the PCs 2a and 2b. The command processing section 71 may also be provided in the analysis unit 4a. In this case, commands from the PC 2a are processed by the command processing section 71, and commands from the PC 2b are processed by the command processing section provided in the analysis unit 4a. The collection unit 72 collects symbol values (device values and values stored in variables) from the basic unit 3 and the expansion unit 4b and stores them in the ring buffer 36 . Collection setting of the collection unit 72 can be performed from at least one of the basic unit 3 and the analysis unit 4a. The logging unit 73 determines whether any error or trouble (abnormal event) has occurred in the PLC 1 based on the collected symbol values and the like. For example, the logging unit 73 may determine whether the collected symbol values satisfy recording conditions. When the collected symbol values satisfy the recording conditions, the logging unit 73 saves the symbol values as an operation log 76 within the operation record 74 . The logging unit 73 also stores in the driving record 74 the project data 75 that was being executed when the driving record was created. Furthermore, the logging unit 73 notifies the analysis unit 83 that the driving record 74 has been created. The setting unit 78 sets a control cycle used for generation of a learning model (to be described later), analysis, and generation of an analysis report according to an operator's input. A control cycle is set by specifying a timing that serves as a reference for the cycle, and the setting of the control cycle is called cycle setting. For example, the cycle setting includes a symbol name that defines the start timing of the cycle and rising/falling edge information of the symbol value. The cycle setting includes a symbol name that defines the cycle start timing, cycle start timing setting information based on rising/falling edge information of the symbol value, a symbol name that defines the cycle end timing, and symbol It may contain setting information of cycle end timing based on rising/falling edge information of the value. The setting of the control cycle by the setting unit 78 may be provided to the PLC 1 in a file format such as CSV, and the setting unit 78 may read the file such as CSV to set the control cycle. For example, the control cycle set by the setting unit 78 classifies devices synchronized with the cycle and adds the classification information to the model as attribute information, narrows down the devices to be analyzed by the control cycle, and controls the control cycle. It is used to generate analysis reports that are displayed synchronously with A plurality of control cycles may be set. A setting method will be described later. Also, the control cycle does not necessarily have to be set. For example, if the possible values of the symbol values in the normal state are determined in advance, it is determined whether the symbol values are the predetermined possible values or not. It can be determined as a normal symbol.

In the CPU 41a, the protocol conversion unit 81 converts the protocol of the HTTP request transferred from the PC 2b in an encapsulated form and extracts it from the request signal. The protocol converter 81 encapsulates the response information transmitted from the web server 82 in response to the HTTP request and passes it to the CPU 41a. The protocol converter 81 may provide a transparent tunnel (eg TCP tunnel). The web server 82 provides the analysis report created by the analysis unit 83 to the PC 2b. The analysis unit 83 analyzes the operation log 76 in the operation record 74 using a model described later, creates analysis results 77 , and passes them to the logging unit 73 . When the analysis unit 83 creates the analysis result 77 , the logging unit 73 adds it to the operation record 74 including the analysis result 77 in addition to the project data 75 and the operation log 76 . The driving record 74 is stored in the driving record storage unit 37 . Alternatively, analysis results 77 may be stored in memory 42a of analysis unit 4a. The notification issuing unit 84 issues a notification when the analysis result 77 is issued. This notification is sent to the CPU 11b.

For example, when the web browser 18 requests an analysis report using an HTTP request, the web server 82 passes the HTTP request to the protocol converter 81 . The HTTP request contains the URL (Uniform Resource Locator) of the analysis unit 4a (Web server) which is executed by the CPU 41a and which provides the analysis report. The protocol converter 81 encapsulates the HTTP request and converts it into a request signal (command) that can be transmitted using a predetermined communication protocol. This request signal is passed to the CPU 41a of the analysis unit 4a. The CPU 41a sends back an analysis report to the CPU 11b. The CPU 11b passes the analysis report to the web browser 18. FIG. As a result, the web browser 18 displays the analysis report on the display section 7b.

The model generation unit 86 creates a model that becomes master data for the analysis unit 83 to later compare with the driving record data. The report generator 85 generates an analysis report, which is a display screen for displaying the analysis result 77 on the web browser 18 of the PC 2b. An analysis report contains a plurality of analysis results, and these analysis results are displayed synchronously on the time axis. Details of the analysis report will be described later with reference to FIG. 8A. The model generator 86 includes a classifier 87 and a determiner 88 .

The classification unit 87 classifies to which type each device belongs from the time-series data of each device collected by the collection unit 72 . A classification method will be described later with reference to FIG. 13 . The classification unit 87 executes classification processing at arbitrary timing, but basically executes classification processing at the timing when system operation is started or when an instruction from the user is received. The determination unit 88 determines analysis parameters for detecting a device in an unusual state according to the time-series data classified by the classification unit 87, and stores them in the memory 42a. When the classification processing is executed by the classification section 87, the determination section 88 performs classification parameter determination processing, and updates the analysis parameters if the analysis parameters have already been determined for the same device. When updating, it may be updated by overwriting, or a new analysis parameter may be determined from two analysis parameters such as taking an average value. Also, the process at the time of updating may be determined for each device. In this way, the classification unit 87 and the determination unit 88 are processing units that function in the learning phase of analyzing the collected driving record data and learning what the data looks like in a normal state. determine the analytical parameters for estimating On the other hand, the analysis unit 83 is a processing unit that functions in the estimation phase for estimating abnormal devices. The analysis unit 83 uses the determined analysis parameters to detect abnormal devices from the time-series data of each device collected by the collection unit 72 . The analysis parameters include, for example, at least one of ON time, OFF time, rising timing, falling timing, ON count, OFF count, and steady state value of the device value.

<Basic flow>
FIG. 7 shows the basic flow of model generation, analysis of driving record data, and result output according to this embodiment. The processing described below is performed by the CPU 31 of the basic unit 3 and the CPU 41a of the analysis unit (expansion unit) 4a. However, without intending to limit the invention, some of those processes may be performed in other units, all of those processes may be performed in one unit, or the programmable logic controller may be performed by an external device (analyzer) communicatively connected to the

In S1, the CPU 31 of the basic unit 3 sets collection settings and analysis settings in the collection unit 72 according to information input via the PC 2a. For example, the CPU 31 can set collection targets, collection periods, storage destinations, file names, and the like as collection settings. Analysis settings include, for example, settings for the start and end of a cycle to be analyzed. Here, an example in which the basic unit 3 performs collection settings and analysis settings has been described, but the CPU 41a of the analysis unit 4a may perform collection settings according to information input via the PC 2b. Further, in S1, the CPU 31 of the basic unit 3 performs camera settings such as shooting conditions, image processing settings, and monitoring data according to information input via the setting screens displayed on the display units 7a and 7b of the PCs 2a and 2b as analysis settings. Item settings can be set. These analysis settings can also be executed by the CPU 41a of the analysis unit 4a. After that, in S2, the CPU 31 collects driving record data as data for model creation according to the collection setting set in S1, and stores it in the driving record storage unit 37. FIG. More specifically, all device values collected according to the collection settings are temporarily stored in the ring buffer 36, and necessary data from the ring buffer 36 is stored in the driving record storage unit 37 as driving record data.

Next, in S3, the CPU 41a of the analysis unit 4a creates a model using the collected driving record data. The model may include information for each device in which patterns of each device are classified based on feature amounts such as constants, bit patterns, and analog values, and information indicating the timing at which device values change. In other words, the model learns the pattern of change in the normal state of each device. Detailed processing of S3 will be described later using FIG.

Thereafter, in S4, the CPU 31 of the basic unit 3 determines whether or not a trigger for analyzing the driving record data has occurred. The trigger is basically triggered when an unusual abnormality occurs during operation. , the receipt of manual instructions from the operator, and the like. When a trigger occurs, the process proceeds to S5.

In S<b>5 , the CPU 31 of the basic unit 3 saves the driving record data for collecting and analyzing each device value in the driving record storage section 37 . Usually the trigger occurs after some unusual change has occurred. Therefore, here, pre- and post-trigger data is acquired to identify the cause of such changes. As described above, the device values of all devices are held in the ring buffer 36 during operation. Accordingly, when the CPU 31 determines that a trigger has occurred, it stores necessary device values before and after the trigger from the ring buffer 36 into the driving record storage unit 37 according to the analysis setting set in S1. Further, in S5, the CPU 41a of the analysis unit 4a acquires driving record data for analysis from the basic unit 3. FIG. Here, in addition to the driving record data, camera image data, event occurrence history, and error history information may also be acquired.

After that, in S6, the CPU 41a of the analysis unit 4a acquires the time-series data collected in the basic unit 3, compares it with the model generated in S2, and executes analysis processing. In the analysis process, for each device, the model data, which is the master data generated in S3, and the driving record data to be analyzed are compared to determine whether the target device is in an unusual state. If there is a difference equal to or greater than a predetermined value, it is determined that an unusual state has been detected. Furthermore, the CPU 41a stores the analysis result after the determination in the storage area of the analysis result 77 in the driving record storage section 37 of the basic unit 3 for each device. Here, it is desirable that the analysis result 77 stores the analysis result of the device in which an unusual state was detected and its recorded data together with time information. As a result, when an analysis report generation request is received from an operator or the like, it is possible to easily generate an analysis report that can be displayed by synchronizing each device value using the information. Note that the camera image obtained from the expansion unit 4b may also be linked and stored. Further, in S7, the CPU 41a generates display data (analysis report) indicating the results based on the analysis results, transmits the generated display data to the PC 2b or an external device via the communication section 43, and ends the process. For example, analysis results are displayed to the operator on the PC 2b. Details of the result display screen displaying the analysis report will be described later with reference to FIG. 8A.

The monitoring application is one of data utilization applications executed by the CPU 41a of the analysis unit 4a. The analysis unit 4a may be an expansion unit that runs data utilization applications. Data-utilizing applications include data-utilizing programs (eg, flows) that collect control data and process data, and dashboards that display the execution results of the data-utilizing programs. Data utilization applications include a monitoring application that monitors monitored devices and variables in real time, and an operation record analysis application that analyzes operation records to reproduce the operating state of the PLC 1 and generates an analysis report. may Further, as the data utilization application, there may be a calculation application for calculating KPIs (Key Performance Indicators) such as availability rate, non-defective product rate, or cycle time. The monitoring application is an application for constant monitoring based on the symbol values of the symbols of the PLC 1. For example, according to the settings of the monitoring application, the symbol values of one or more symbols are constantly collected at the scan time level, and the collected symbol values are It is an application that constantly displays the information based on it while updating it in real time. One or more symbols to be constantly monitored are set in advance by the user. The monitoring application has a Web server function, for example, and can be set from a general-purpose browser via the communication unit 43 . By being able to set from a general-purpose browser, it is possible to set or monitor from a PC, smartphone, or tablet without going through a dedicated tool such as a program creation support device. In addition, the monitoring application automatically sets a threshold corresponding to one or more symbols to be constantly monitored, based on symbol values of a plurality of cycles in a normal state. For example, the monitoring application accepts user instructions and automatically sets threshold values for monitoring the states of symbols collectively based on variations in symbol values of multiple cycles in normal times for multiple symbols to be constantly monitored. do. A threshold is set to monitor for unusual or abnormal conditions, and the monitoring application issues an alarm if the symbol value of the monitored symbol exceeds the threshold. In this way, for example, the PLC 1 can catch the symptom before the installation stops. The PLC 1 may set an alarm when a symbol value of a symbol to be monitored exceeds a threshold as a result of symptom monitoring by a monitoring application, as a storage condition for driving records. The PLC 1 saves driving record data before and after the trigger, with the generation of an alarm by the monitoring application as an event trigger. The PLC 1 turns on the storage completion device when the storage of the driving record data is completed. The driving record analysis application may automatically analyze the driving record data upon completion of saving the driving record data. For example, the drive record analysis application may analyze drive record data in response to turning on the save completion device. The driving record analysis application analyzes the symbol values of the symbols to be analyzed (for example, the device values of all bit devices), and extracts the symbol of the cause candidate for the alert. In this way, the driving record analysis application automatically analyzes the saved driving record data for the cause of the alarm generated by the monitoring application, and extracts unusual symbols from the driving record data. As a result, the CPU 41a constantly monitors the state of the facility using the symptom monitoring function of the monitoring application, and issues an alert based on the change factor. Furthermore, the CPU 41a automatically analyzes alert factors and extracts unusual symbols. In other words, the PLC 1 constantly monitors symbol values to monitor symptoms of the equipment to be controlled, notifies the symptoms before the equipment to be controlled is stopped by an alarm, and automatically analyzes the factors of the symptoms.

<Result display screen (analysis report)>
FIG. 8A shows a result display screen displayed on the display unit 7b when the web browser 18 according to this embodiment executes the web browser program 14d. Here, an example in which the result display screen 800 is displayed on the display unit 7b of the PC 2b will be described, but there is no intention to limit the present invention and it may be displayed on the display unit of another device. If it is possible to display on the monitor that it has, it may be displayed on that monitor. For example, other devices may include programmable displays, tablets, smart phones. Alternatively, an analysis report including the contents of the result display screen described below may be sent to another device by e-mail, SNS, FTP transfer, or the like. Arbitrary comments may be added to the analysis report, for example, handwritten or input character comments may be added to the analysis report. In this case, an analysis report including the content of the result display screen to which arbitrary comments have been added may be transmitted to another device. As a result, the recipient of the e-mail can view the site situation such as comments together with the analysis report. Further, when the analysis report is transmitted to another device, the analysis report may be transmitted in association with the driving record data that is the analysis target of the analysis report. As a result, the recipient of the mail can view both the driving record and the analysis report. Furthermore, if the PC 2b is a tablet, smartphone, or the like with a camera, a photograph of the device may also be attached.

The result display screen 800 includes filters 801 to 803 for filtering and displaying results, a filter result 804, a detection map 810, a detection list 820, an image display area 830, and an analysis comment 840. be done. At least one of 810, 820, 830, and 840 may be displayed as the result display. A filter 801 can select control cycles to filter the results display. The control cycle here refers to a period from the start timing to the end timing accompanied by periodic changes in device values. When the filter 801 is specified, the results are displayed focusing on the analysis results of devices operating in the selected control cycle. A filter 802 can select attribute information to filter the display of results. Attribute information indicates information about which unit or communication device it is connected to, and information about whether it is an input device.

For example, when "unit configuration information" is specified in the filter 802, the unit configuration is displayed on a pop-up screen or the like, and one of the displayed units can be selected. When a unit is selected, the results are focused on the devices connected to that unit. Also, when "input device" is specified as the attribute information, the results are displayed focusing on the devices to which the attribute information of the input device is added. Filter 802 is not limited to filtering that utilizes attribute information. For example, as a result of analysis, the same symbol may be duplicated and detected as an abnormal symbol. The earliest occurrence time is highly likely to be important in searching for the cause of the abnormality, and the filter 802 may filter out the duplicate detected same symbols other than the earliest occurrence time. . Further, the filter 802 may filter the symbols other than the earliest occurrence time among the symbols having the same detection algorithm at the time of analysis and the same types of anomalies to be described later. Furthermore, the filter 802 may be configured to filter out the same symbol, the same detection algorithm during analysis, the same type of abnormality described later, and the same cycle setting described later, other than the earliest occurrence time. good.

A filter 803 can select events or errors to filter the results display. If you specify the type of event or error, the analysis results of the devices related to it will be displayed. For example, when a "driving record storage trigger" is selected as an event, the results are displayed focusing on the analysis results before and after that event. The result display screen 800 may display the analysis results as well as events and errors in order of time of occurrence. In this case, filter 803 can filter events and errors. As a result, it is possible to switch between a mixed display of analysis results and events and errors and a display of analysis results. Here, the events include, for example, power ON/OFF, rewriting of device values, memory insertion/removal, etc., and filtering targets may be added or subtracted for each category. Errors include, for example, communication errors, PLC calculation errors, scan time excess errors, etc., and filtering targets may be added or subtracted according to the severity of the error.

Note that the filter conditions of the filters 801 to 803 are determined as a logical product, and the corresponding analysis results are displayed. Therefore, the filters 801 to 803 do not necessarily have to be selected, and the analysis results may be filtered when the operator's desired filter is selected. Alternatively, the filter may be selected by default to display the analysis results before being specified by the operator. The devices displayed as these analysis results are devices in which unusual states have been detected. An unusual state is, for example, that the device value deviates from the normal range, or the timing or number of changes of the device value deviates from the normal range. In a product manufacturing factory, the same product is mass-produced every day. That is, the same process is repeatedly executed many times. Therefore, detecting and displaying abnormal states is very useful for improving ladder programs and reviewing production equipment. A normal range (normal condition) that defines the same state as usual (normal state) may be defined by the user or may be defined by learning results of device values.

The detection map 810 displays along the time axis cycles including start timings and end timings for each of a plurality of processes executed in the PLC 1 . In the detection map 810, the horizontally extending rectangles indicate the period (control cycle) during which the process is being executed. Also, circles within the rectangles indicate abnormal points, which are abnormal locations where abnormal states occur within the cycle. The horizontal axis of the detection map 810 represents time, the left end represents the start time of data collection, and the right end represents the end time of data collection. By selecting the enlargement/reduction button on the top, enlargement/reduction in the horizontal axis direction can be performed. In that case, the initial display may be the data collection start point on the left end and the data collection end point on the right end. Alternatively, it may be determined by the time width of the cycle definition described later. For example, if the cycle time is 10 seconds, 10 seconds, 11 seconds, 9 seconds, 10 seconds, 10 seconds, and 20 seconds, take the median value of 10 seconds so that 3 cycles can be displayed at once. , 30 seconds from the left end to the right end. Here, the vertical axis is in units of devices, but may be in units of program modules, which will be described later. Further, the detection map 810 may display the values of the feature values of the camera video in parallel with the device values. By displaying them side by side with the device values, periodic changes in the video can be easily recognized.

As shown in FIG. 8A, the control cycle can be represented by a rectangular shape, with the left end indicating the start timing and the right end indicating the end timing. This makes it possible to confirm the control cycle at a glance rather than showing the device values as waveforms, and to determine whether or not the cycle is in operation. Note that the present invention is not limited to this, and may be represented by any shape as long as the start timing and the end timing can be identified. For example, instead of a rectangular shape, a vertical line indicating the start timing and a vertical line indicating the end timing may be displayed, and a cycle may be represented by using a different color for the inside of the vertical line from the background color. Also, if there is no record of the start timing and the end timing in the driving record data, it is not necessary to draw vertical lines or the like indicating them on the detection map 810 . In addition, as shown in FIG. 8A, the locations of abnormalities within the defined control cycle are shown. In the example of FIG. 8A, the locations where anomalies have occurred are displayed as anomalous points. On the other hand, an abnormality has a section from the start of the abnormality to the end of the abnormality. Therefore, the abnormal locations may be plotted in intervals. As a result, it is possible to express how other devices overlap with the abnormal occurrence section, and the operator can recognize the relationship between the devices, which is important information when identifying an error. In this way, it is possible to draw the location of an abnormality in each device by various methods.

In the detection map 810 , the process rectangles are old on the left and new on the right. A time bar 811 indicates the time being selected. A time bar 812 indicates the timing at which the drive record data storage trigger is generated. As described above, the data before and after the time bar 812 is shown because the data before and after the occurrence of the save trigger are recorded in the driving record data. The time bars 811 and 812 may be drawn in different colors, or may be drawn with different solid lines and dashed lines to improve distinguishability. Further, by operating the time bar 811, the analysis result display can be updated. According to the operation of the time bar 811, at least one time bar of the detection list 820, the image display area 830, and the analysis comment 840, which will be described later, may be similarly updated to display the corresponding analysis results.

The image display area 830 displays a camera image (hereinafter also referred to as camera video) acquired by the PLC 1 . In FIG. 8A, a camera image of master data, which is normal data, and a current camera image are displayed so as to be able to be compared. Since the camera image is also time-series data, the seek bar 831 indicates the playback time of the camera image and moves from left to right as the playback time elapses. A time bar 832 indicates the timing at which the detection target device becomes in an unusual state, and is linked with the time bar 811 described above. The time designation unit 833 is a control object for advancing the reproduction time of the camera image, returning the reproduction time, instructing the start of reproduction, and instructing the stop of reproduction. A control cycle 834 can be specified, and the camera image is reproduced with the specified cycle as the reference cycle. For example, when the fast-forward button of the time designation section 833 is operated, the video is controlled to skip to the control cycle next to the current control cycle. It may also jump at the end of the cycle.

The camera image may be stored as driving record data, or may be data associated with time and stored in an external device. For example, it may be a camera video recorded in a web camera connected to any of the expansion units, or an inspection image recorded in an image inspection machine. The data stored in the external device may be data recorded by the measuring device as well as images, and may be numerical values or may display measured waveforms. In the result display screen 800, the playback time of the detection map 810, the playback time of the camera image, and the playback time of the detection list 820 are managed and displayed so as to be synchronized. Moreover, as shown in the dotted line area of FIG. 8A, the detected abnormal portion may be highlighted in the image. This allows the user to more easily compare the normal image and the current image.

The detection list 820 shows devices that have entered an unusual state and the time when the state occurred (device value collection time). The detection list 820 is a list showing devices in an unusual state in chronological order. When the CPU 11b detects a click on a device displayed in the detection list 820, the CPU 11b, based on the identification information of the clicked device and the reproduction time information (device value collection time), displays the detection map 810, the detection list 820, and the The display of the image display area 830 can be synchronized. A time bar 821 indicates the time being selected, and interlocks with the time bars 811 and 831 to indicate the same timing. A time bar 822 indicates the timing at which the drive record data save trigger occurred.

The analysis comment 840 displays comments included in the analysis result, master data for the device selected in the detection list 820, and time-series data of the current device value. A time bar 841 indicates the timing at which an unusual state occurs, and interlocks with the time bars 811, 821, and 831 to indicate the same timing. The displayed comment indicates the contents of the abnormality of the device. The analysis comment can take various forms, and the details will be described later with reference to FIG. 10 .

When the CPU 11b detects a click on the device displayed in the detection list 820, the CPU 11b collects the identification information of the clicked device and the cycle information (cycle start time and end time, or cycle start time and next cycle start time), the display of detection map 810, detection list 820, and analysis comments 840 can be synchronized. FIG. 8B shows how detection map 810, detection list 820, and analysis comment 840 are synchronized when any item in detection list 820 is selected. Analysis comment 840 displays time series data of device values for the time range corresponding to the cycle in which the unusual state occurred. At this time, a time range 852 corresponding to the time range 854 of the time-series data displayed in the analysis comment 840 is illustrated on the detection map 810 . A time range 852 illustrated in the detection map 810 is illustrated corresponding to a process out of the plurality of processes that is in an unusual state. For example, if an item 853 of a device different from the current device among the devices displayed in the detection list 820 is clicked, the device value in the time range corresponding to the cycle in which the clicked device changed to an unusual state is displayed. Switch to series data. At that time, the display on the detection map 810 switches to a range including a time range 852 corresponding to the time range 854 of the time-series data displayed in the analysis comment 840 . Also, as indicated by an arrow 855 , a time range 852 is highlighted on the detection map 810 by a dotted line or a colored solid line frame, etc., and displayed so that the correspondence with the clipped section in the analysis comment 840 can be confirmed. This makes it possible for the operator to easily grasp which section of the waveform on the detection map 810 the analysis comment 840 is extracted from. Also, as indicated by 854, in the analysis comment 840 as well, by displaying a rectangle indicating the cycle corresponding to the cut-out section and anomalous points below the waveform, the cycle start timing, end timing, waveform, and anomaly can be displayed. The operator can easily comprehend the relationship between Further, the detection map 810 may display an enlarged abnormal point corresponding to the device selected in the detection list 820 as indicated by 851 . In addition, if the time range of the time-series data displayed in the analysis comment 840 is the start time of a cycle and the start time of the next cycle, the analysis comment 840 includes the time range of the cycle corresponding to the time axis of the time-series data. A graphical display may be provided at the location indicating the end time.

In this manner, the result display screen 800 includes displays of a plurality of analysis results such as the detection map 810, the detection list 820, the image display area 830, and the analysis comment 840. FIG. However, these result displays are examples and other result displays may additionally or alternatively be included. For example, as shown in FIG. 9, dependency information (relationship map) between devices may be displayed as an analysis result. By analyzing the ladder program, the basic unit 3 can grasp the dependencies between devices and variables. For example, when a detected device is selected, related devices can be displayed side by side, so that dependent devices can be presented to the operator. As a result, it is possible to assist the operator in grasping and identifying the abnormality.

<Relation Map>
FIG. 9 shows a relation map 900. FIG. The relation map 900 is a graphical representation showing the relationship between a program module related to a specific symbol and other symbols related to the program module in a user program such as a ladder program. UI that displays other devices related to the abnormal device through the program module in the ladder program when a device (abnormal device) used in the program that is in a different state than usual is selected becomes. This UI may be a screen that transitions by operating a display button (not shown) on the result display screen 800 , or may be additionally displayed on the result display screen 800 . By displaying the relation map, the user can easily understand the dependencies between the abnormal device and other devices. Generally, the number of devices used in the PLC 1 is several hundred to several tens of thousands, so it is not easy for the user to identify the device that caused the unusual state. The CPU 11 searches the ladder program for abnormal devices, finds descriptions of the abnormal devices, and analyzes the descriptions to identify related devices. In this example, an abnormal device (eg, R0004) is described in the output section of the ladder program, and MR000, MR001, and MR002 exist as related devices.

The CPU 11b displays the abnormal devices, related devices and program modules identified from the ladder program like a tree. A user program (ladder, C language, flow language, script, etc.) is often divided into several parts and described in units called program modules in order to improve readability and maintainability. A program for reading and writing each device is written in one program module, and although one device may be read and written by a plurality of modules, one module is mainly used in many cases. In the example of FIG. 9, the devices that are input for the calculation in the output section are displayed on the left, the program modules are displayed in the middle, and the abnormal devices are displayed on the right. As shown in FIG. 9, when a program module on the relation map 900 is selected, the CPU 11b may display the corresponding program module in the program display area 910. FIG. Although the CPU 11b of the PC 2b controls the display processing here, it is an example and may be performed by the CPU 11a of the PC 2a. Further, the detection map 810 described above may also be displayed in units of program modules instead of in units of devices.

The CPU 11 identifies a program module related to the symbol from the user program, identifies other symbols related to the identified program module, and generates the relation map 1500 according to the user's designation for identifying the symbol. The CPU 11 highlights abnormal devices included in the relation map 1500 based on the analysis result. The analysis result also includes the time at which the abnormal device was determined to be different from usual, and the CPU 11 may highlight only the abnormal device that occurred before the time to reproduce on the relation map 1500 . This allows the abnormal device to remain highlighted after the unusual state occurs. Further, the analysis result may include information indicating that each symbol is a non-analyzed symbol. In this case, the CPU 11 distinguishes between symbols not subject to analysis and other symbols on the relation map 1500 based on the analysis result. With this, it is possible to distinguish whether it is judged as abnormal by analysis or not judged as abnormal because it has not been analyzed. Symbols not subject to analysis are, for example, symbols whose symbol value change pattern does not have regularity with respect to the control cycle or cycle defined by the cycle setting, or symbols specified by the user as not subject to analysis. include.

<analysis comment>
FIG. 10 shows various forms of analytical comments. The analysis comment 840 shown in FIG. 8A can take various forms depending on the information of the analysis result, especially the content of the abnormality. Note that the analysis comment is automatically generated by the analysis unit 4a, and does not require operation by the operator. Three analytical comments 1000, 1010, and 1020 are illustrated here, but these forms are also part of the example.

The analysis comment 1000 indicates the content of anomalies in which the number of device changes is greater than in the master data during learning. An analysis comment is shown in 1001, and a comment to the effect that a given device has changed more than the master is shown in natural language. Reference numeral 1002 denotes the waveform of master data, and 1003 denotes the waveform of driving record data acquired this time, which is the object of analysis. Reference numeral 1004 indicates abnormal locations that have changed a lot, and are highlighted by, for example, shading. Also, the analysis comment 1010 indicates the abnormal content of the ON time of the device. In addition, model reliability 1030 is shown in analysis comment 1000 . The model reliability indicates the reliability of the learning model used for analysis, and the details will be described later with reference to FIG. 21 . An analytical comment 1011 indicates a comment in natural language to the effect that a predetermined device is turned off earlier than the master by a predetermined time. Also, as shown in FIG. 10, the predetermined time portion is described as "297.86 ms", 1012 indicates the waveform of the master data, and 1013 indicates the waveform of the driving record data acquired this time, which is the analysis target. show. Further, as indicated by 1012 and 1013, character strings "change point a1" and "change point b1" are shown at portions indicating the timing of the change from ON to OFF in each waveform. As a result, the operator can easily grasp the point of change, and can easily determine the difference between the master waveform and the current waveform by comparing them. As described above, the analytical comment according to the present embodiment includes a description of the content of the abnormality in a natural language as indicated by 1001 and 1011 and a description of the content of the abnormality by graphics as indicated by 1002 to 1004, 1012 and 1013. included. It should be noted that either one of the description of the content of the abnormality in a natural language and the description of the content of the abnormality in a graphic form may be used. You may change according to the size of the drawing area of the result display screen which displays an analysis report.

In this way, since natural language is used in the same way as conversation between people, the user does not need to learn anything new, and the content of anomaly can be expressed without the need for specialized knowledge. It has the advantage of being easy to analyze. In addition, there is an advantage that not only numerical values and judgment results (OK/NG) but also how judgments are made and where abnormalities are found are easy to understand as sentences. On the other hand, the graphical representation of the content of anomalies can be visually understood, and details such as what kind of anomaly occurred, the timing, and the degree of the anomaly can be known. In addition, in the case of a hard-to-understand black-box judgment method, some users think that the judgment results cannot be trusted. You can also change your rating.

Analysis comments 1000 and 1010 show examples of analysis comments for bit devices, but the PLC 1 according to this embodiment also includes word devices, and 1020 shows an example of analysis comments for word devices. Here, a graph in which analog values are plotted is shown as a graphical explanation of the content of the abnormality. The horizontal axis corresponds to time, and the vertical axis indicates device values. Further, 1021 indicates the operation record data of the predetermined device acquired this time, and 1022 indicates master data which is normal data. An average value of several cycles may be used instead of the master data. Also, 1023 indicates the lower limit threshold, and 1024 indicates the upper limit threshold. An error occurs when the drive record data exceeds these thresholds. A rectangle 1025 indicates a location where an unusual state is detected, and indicates a location where the driving record data acquired this time is separated from the master data by a predetermined value. Note that such highlighting by a rectangle may be displayed only for locations exceeding the lower limit threshold 1023 or the upper limit threshold 1024 .

<Model generation flow>
FIG. 11 shows the details of the model generation flow in S3 above. Here, control for classifying device values of devices as device attribute information and generating a model will be described. Note that the present invention is not limited to this, and a model may be generated based on the other attribute information described above. The processing described below will be described as processing executed by the CPU 41a of the analysis unit (extension unit) 4a. However, without intending to limit the invention, some of those processes may be performed in other units, all of those processes may be performed in one unit, or the programmable logic controller may be performed by an external device (analyzer) communicatively connected to the

First, in S31, the CPU 41a of the analysis unit 4a acquires from the basic unit 3 normal operation record data for model creation. The driving record data is the data stored in the driving record storage unit 37 in S2. Subsequently, in S32, the CPU 41a acquires cycle setting information from the basic unit 3 as information other than the device value. The cycle setting information indicates cycle pattern information set by the operator via the PC 2a, for example. For example, it indicates the start timing of the cycle and the end timing of the cycle. The information acquired here may also include information acquired by the field device 10 such as a camera connected to the expansion unit 4b, such as camera image data. These data may be acquired via the basic unit 3, but may be acquired directly from the expansion unit 4b, for example. Further, in the present embodiment, the processing of S32 is not essential, and the cycle setting information may not be acquired.

Next, in S33, the CPU 41a determines which cycle each device belongs to based on the cycle setting obtained in S32, and further determines which type each device belongs to according to the change pattern of each device value. Classify. Device classification will be described later with reference to FIG. In addition, since there are various patterns in the cycle pattern of each device, it is determined to which pattern each device belongs in the cycle setting. If the cycle settings include settings corresponding to a plurality of control cycles, the device belonging to each control cycle may be determined. At this time, there may be devices determined to belong to multiple control cycles. FIG. 12 shows control for determining the cycle pattern of each device. In FIG. 12, rectangles indicate a period (cycle) during which the process is being executed, from the start timing to the end timing, and one rectangle indicates one cycle. A cycle pattern is a pattern in which this one cycle appears. 1201 to 1203 indicate the cycled steps. 1204 to 1206 indicate cycle patterns extracted from the collected data of devices A to C, respectively. The analysis unit 4a determines which cycle setting pattern each device belongs to, for example, device A belongs to cycle setting 1, device B belongs to cycle setting 2, and device A belongs to which cycle setting. also determined not to apply. Specifically, it is determined whether the value and the number of times of change match from the start to the end of the cycle. It should be noted that there is no problem even if the start timing and the end timing are slightly off. Thus, the analysis unit 4a determines what kind of correspondence relationship exists between each cycle setting pattern and each device. The analysis unit 4a may determine which device belongs to each cycle setting pattern.

The analysis unit 4a determines the correspondence relationship between the pattern of each cycle setting and each device based on the pattern of each device value from the cycle start to the cycle end of each cycle setting. This makes it possible to determine that the device belongs to the cycle setting pattern regardless of how the device value behaves from the end of the cycle to the start of the next cycle. Further, when determining the correspondence relationship between each cycle setting pattern and each device, the analysis unit 4a determines from the reference timing of each cycle to the reference timing of the next cycle, for example, from the start of the cycle to the start of the next cycle. It may be judged whether the value of the device up to and the number of times of change match.

A cycle including a start timing and an end timing for each of a plurality of processes executed in the PLC 1, that is, a period during which the process is being executed is set as a control cycle. is not limited to FIG. 23 shows a processing flow of a cycle when there are devices that change during periods other than the period from the start timing to the end timing. As shown in FIG. 23, in order to execute the work process, there may be a confirmation phase 2301 for confirming whether the work start conditions are satisfied as preparation for executing the work process. 2302, the work phase 2303, and the work end phase 2304, there may be a preparation phase 2305 for preparing for the next process, a standby phase 2306 for waiting until the next process, and the like. Therefore, there are devices that change even during periods other than the execution of the work process, which can be a clue for identifying the cause of the abnormality. For example, the input device related to the establishment of the work start condition in the confirmation phase, the device indicating the control signal for the next preparation in the preparation phase, etc. operate in a period other than the period from the start timing to the end timing. The analysis results of this can be a clue to identify the cause of the anomaly. In short, the target of cycle setting may be from the reference timing of the cycle to the next reference timing. In the cycle setting, the user selects a device that defines the start timing and a device that defines the end timing, or the cycle is automatically set by learning operation record data during normal operation. However, if the period to be analyzed is limited to the start timing and the end timing, it is difficult to find the device that defines the start of the process and the device that defines the end of the process, unless you know exactly what the device is. It can be difficult. By setting the target of the cycle setting from the reference timing of the cycle to the next reference timing, even if the device that defines the start of the process and the device that defines the end of the process are not strictly specified, the device can be synchronized with the process. You can analyze without gaps just by selecting .

Returning to the description of FIG. In S33, the CPU 41a adds the extracted cycle pattern and the type of change pattern described later to each device as attribute information (analysis parameter). Next, in S34, the CPU 41a generates a model from the driving record data acquired in S31 based on the added attribute information, and ends the process. The generated model is master data used for analysis, and includes at least analysis parameters indicating cycle pattern information and change pattern type information for each device. The analysis parameters include, for example, a threshold indicating at least one of ON time, OFF time, rise timing, fall timing, ON count, OFF count, and steady state value of the device value. Analysis in the estimation phase is performed using these analysis parameters.

<Device type>
FIG. 13 shows an example of types of collected time-series data. 1301 to 1306 indicate device signals (time series data) of each type. Device signals may include external signals. It should be noted that the type described below is an example, and the present invention is not intended to limit the present invention, and the present invention may be applied to other types. In addition, it is desirable that the types classified in the present invention include at least two types out of the plurality of types in order to improve the classification effect. Classification of time-series data at the time of model generation is performed based on the repetitiveness of the device by the operator selecting a device for determining the period (control cycle) for classification.

1301 denotes a device signal of a device that operates in synchronization with the operation cycle of the device. 1310 indicates the operation cycle of the device. In the type of 1301, a similar change pattern (steady change pattern) occurs in each operation cycle of the device. In this type, for example, a stationary change pattern is identified from time series data acquired during a period that can be regarded as a normal state, and based on the divergence from the identified stationary change pattern for newly acquired time series data Detection techniques are assigned, such as identifying anomalous devices (devices that are in a different state than usual). Specifically, for a change pattern of time-series data of multiple cycles that can be regarded as a normal state, the variation in time with respect to the change point is measured, and a threshold value is set according to the measured variation. A detection algorithm is assigned to detect an abnormal device based on whether or not the change point of the time-series data acquired thereafter exceeds the range of a threshold set corresponding to the change point. For example, a plurality of waveforms for each operating cycle of the device are superimposed, and based on the variation in the point at which the device changes from OFF to ON, a reference value and a threshold value for the change point are set, and these parameters are used to determine whether an abnormality has occurred. Device can be identified. Also, in each cycle of 1301, the relative time indicating the timing of the first rise of the signal and the phase in each cycle may be used as evaluation variables, and parameters corresponding to the evaluation variables may be determined based on variations in the evaluation variables. For example, when the phase in each period is used as an evaluation variable, the upper threshold value and lower threshold value of the phase may be used as parameters.

When the analysis unit 4a determines which device belongs to each cycle setting pattern, it may be determined that one device belongs to more than one cycle setting according to the criteria. If you set the criteria so that many devices belong to one cycle setting, you can increase the number of devices to be analyzed and it will be easier to clarify the cause, but there is a risk that cycle settings with a low degree of relevance to the device may be included. be. Therefore, if one device is determined to belong to a plurality of cycle settings, the cycle settings to which it belongs may be narrowed down. As an index for narrowing down, the smaller the evaluation variable, the higher the degree of relevance, and the lower the evaluation variable, the lower the degree of relevance. Devices whose device values change between the start and end of the cycle are judged to be highly relevant, and devices whose device values change during periods other than the period between the start and end of the cycle are judged to be of low relevance. . Furthermore, a device whose device value changes during a period other than between the start and end of a cycle may be less relevant if the time point at which the device value changes deviates from the start or end of the cycle. In this way, if one device is determined to belong to multiple cycle settings, the cycle settings to which it belongs may be narrowed down.

On the other hand, 1302 indicates a device signal of a device that operates in synchronization with a period other than the operation cycle of the device, not in synchronization with the scan period. For this type, for example, a stationary change pattern is identified from the time-series data acquired during a period that can be regarded as a normal state, and the newly obtained time-series data is based on the deviation from the identified stationary change pattern. A detection technique is assigned to identify anomalous devices (devices that are in a different state than usual). Specifically, for a change pattern of time-series data of multiple periods that can be regarded as a normal state, the variation in time with respect to the change point is measured, and a threshold value is set according to the measured variation. A detection algorithm is assigned to detect an abnormal device based on whether or not a change point of time-series data acquired thereafter exceeds a threshold range set corresponding to the change point. Also, in each period of 1302, the relative time indicating the second rise timing of the signal and the phase in each period may be used as evaluation variables, and parameters corresponding to the evaluation variables may be determined based on variations in the evaluation variables. For example, when the relative time in each period is used as an evaluation variable, the upper threshold value and lower threshold value of the relative time may be used as parameters.

1303 indicates a device signal of a device that takes a constant value. In this type, for example, from the time-series data acquired during a period that can be regarded as a normal state, values during normal times are specified, and for newly acquired time-series data, those that differ from the specified values during normal times are identified as abnormal devices. A detection method is assigned, such as identifying it as (a device in an unusual state). Specifically, the value of the device in the time-series data that can be regarded as normal is set as the detection standard value, and the time-series data value acquired after that is set as the detection standard value corresponding to the value in the normal state. A detection algorithm is assigned to detect an anomalous device based on whether it differs from . In other words, when the value (constant value) changes, it can be determined that there is an abnormality. A device signal 1304 indicates a device that operates irregularly. This type is excluded from the data used to identify abnormal devices. 1305 indicates a device signal of a device that takes an analog value. In a device that takes an analog value, as will be described later, it is not a device value of a bit device, so proceed to No in S91 in FIG. Each has a different algorithm in the estimation phase. Various methods such as a dynamic time warping method and an autoregressive model can be used as an algorithm in the estimation phase for devices that take analog values. 1306 denotes a device signal of a device that monotonously increases and monotonically decreases. In this type, abnormal devices are identified using differential values and integrated values. Also, a relative time indicating the timing of monotonous increase or monotonous decrease or a phase in each period may be used as an evaluation variable. Note that the type described here is just an example, and devices classified into other types are also assumed, for example, there are devices that can take a plurality of states (stepped device signal, etc.). For those that take multiple states, it can be determined as abnormal when the state changes to a state different from the normal state.

Here, the type of device will be described. Each device includes a bit type device of 0 and 1, and a word type device and a floating point number type device that take analog values. The word device further includes 1 word unsigned integer (0 to 65535), 1 word signed integer (-32768 to 32767), 2 word unsigned integer (0 to 4294967295), and 2 word signed integer ( -214783648 to 214783647). Considering such a type, for example, if the rate of change per scan period is equal to or greater than a predetermined value and the type is other than bit, it can be determined that the device takes an analog value.

<Classification process flow>
FIG. 14 is a flow chart showing a processing procedure for classifying change patterns of collected data. The processing described below is implemented by the CPU 41a of the expansion unit 4a. However, there is no intention to limit the present invention, and some of those processes may be executed in the base unit 3 or other expansion units 4b, or an external device (analysis device) communicatively connected to the programmable logic controller. device).

In S91, the CPU 41a determines whether or not the time-series data to be classified is the device value of the bit device. If it is a device value of a bit device, proceed to S92; otherwise, proceed to S97.

In S92, the CPU 41a determines whether or not there is a change in the value of the time-series data to be classified. If there is a change, the process proceeds to S94, and if there is no change and the value is constant, the process proceeds to S93. In S93, the CPU 41a classifies the time-series data to be classified as a device (1303) that takes a constant value, and ends the process. Here, as the classification information, information associated with the time-series data, for example, flag information indicating a classified type is stored in association with the time-series data or identification information indicating the device corresponding to the time-series data. In this way, by linking and storing the flag information of the type classified at the time of classification in the learning phase and the identification information of the device, in the estimation phase, the time-series data to be verified can be obtained from any device. It is possible to easily select the evaluation variables and parameters of the abnormal device detection algorithm according to the data type and the type associated with the identification information of the device. That is, in the estimation phase, it is possible to omit the process of specifying which type the time-series data to be verified corresponds to. As the classification information, flag information indicating the classified type is shown as an example, but algorithm information indicating an algorithm for identifying an abnormal device may be used instead of the flag information. In addition, if the device corresponding to the time-series data is a variable, it goes without saying that the identification information stored as the classification information is the identification information indicating the variable.

In S94, when there is a change in the value of the time-series data, the CPU 41a determines whether the change is a constant change pattern in each cycle. If it is determined that the change pattern is steady, the process proceeds to S95, and if it is determined that the change pattern is not constant, the process proceeds to S96. Here, the constant change pattern means that the pattern changes in the same pattern in each cycle. In S95, the CPU 41a classifies the device as a device that operates at a predetermined cycle, and terminates the process. As described above, the devices that operate in a predetermined cycle include the device (1301) that operates in synchronization with the operation cycle of the apparatus and the device (1302) that operates in synchronization with a period other than the operation cycle of the apparatus. and the CPU 41a classifies them accordingly. On the other hand, in S96, the CPU 41a classifies the device as an irregularly operating device (1304), and terminates the process.

On the other hand, if it is determined in S91 that it is not a bit device, the process proceeds to S97, and the CPU 41a determines whether or not there is a change of a predetermined value or more in the time-series data to be classified. Here, it is determined whether or not the extreme value of the changing signal is equal to or greater than a predetermined value. If there is a change, proceed to S98; otherwise, proceed to S912.

In S98, the CPU 41a determines whether or not it changes at a predetermined cycle.If it does not change at a predetermined cycle, the process proceeds to S99. In S910, the CPU 41a determines whether the changing value is monotonously increasing or monotonously decreasing. If monotonically increasing or monotonically decreasing, the process proceeds to S911; otherwise, the process proceeds to S99.

In S99, the CPU 41a classifies the device as an analog value device (1305) and terminates the process. There are various types of analog value devices, and each type is handled individually according to the type of device to be classified. On the other hand, in S911, the CPU 41a classifies the device as a monotonically increasing or monotonically decreasing device (1306), and terminates the process. Also, in S912, the CPU 41a classifies the device as another device, and terminates the process. If the device is determined to be other devices, the characteristics of the time-series data to be classified cannot be extracted, and the behavior with characteristics during normal operation cannot be identified. Therefore, it is not used when identifying an abnormal device.

<Result display flow>
FIG. 15 shows details of the result display flow by the analysis unit 4a in S7. The processing described below will be described as processing executed by the CPU 41a of the analysis unit (extension unit) 4a. However, without intending to limit the invention, some of those processes may be performed in other units, all of those processes may be performed in one unit, or the programmable logic controller may be performed by an external device (analyzer) communicatively connected to the

First, in S71, the CPU 41a of the analysis unit 4a determines whether or not a request for an analysis report has been received. The analysis report request includes requests received by the operator via the PC 2a and PC 2b, regular analysis report generation timing, and generation of an analysis report when an error occurs. The PLC 1 may create an analysis report without a request from the operator when a device in an unusual state is detected, or may create an analysis report only upon request from the operator. good. These controls can be switched in settings. If the request for the analysis report has been accepted, the process proceeds to S72.

In S<b>72 , the CPU 41 a acquires the analysis result 77 stored in the driving record storage section 37 of the basic unit 3 . Subsequently, in S73, the CPU 41a generates an analysis report that can be displayed on the web browser of the web client such as the PC 2a or the PC 2b, according to the acquired analysis results. The generated analysis report serves as screen information for displaying the result display screen 800 described above with reference to FIG. 8A. Synchronization information for synchronizing and displaying each analysis result is also added here. Specifically, in addition to the screen information displayed in the detection map 810, the detection list 820, the image display area 830, and the analysis comment 840, information indicating the display position of each analysis result is included. The information suggesting the display position may be the timing information of the defined control cycle, or simple time information, as described above. That is, any information may be used as long as it can be synchronized. Also, the CPU 41a generates an analysis comment 840 and embeds it in the analysis report. The analysis comment generation flow will be described later with reference to FIGS. 17 and 18. FIG.

Next, in S74, the CPU 41a transmits the analysis report generated in S73 to the requesting PC2. The information transmitted here may be information including HTML data, CSS data, JavaScript (registered trademark) code, etc., or may simply be a notification indicating that the generation of the analysis report has been completed. When a display request is received again from the PC 2 side in the case of notification, the CPU 41a transmits the screen information. Thereafter, in S75, the CPU 41a determines whether or not a request for updating the analysis report has been received from the request source. The update request includes, for example, change of display parts, change of display target by selection of filters 801 to 803, update of temporal display position of analysis result by operating time bar 811 or the like. It should be noted that the updating of the display content by operating the time bar 811 or the like may be controlled by closing the PC 2 side. In this case, it is necessary to provide the PC 2 with information on the analysis result of the device displayed on the display component in addition to the information on the display component to be displayed. If the update request is accepted, the process proceeds to S76; otherwise, the process proceeds to S77.

In S76, the CPU 41a updates the analysis report according to the contents of the update request, returns the process to S74, and transmits the updated analysis report to the request source. On the other hand, in S77, the CPU 41a determines whether or not an end instruction to end the display of the analysis report has been received. If the end instruction has not been received, the process returns to S75, and if it is determined that the end instruction has been received, the process ends.

FIG. 16 shows details of the result display flow in the PC 2b in S7. The processing described below will be described as processing executed by the CPU 11b of the PC 2b. However, it is not intended to limit the invention, and some of those processes may be performed by the PLC unit, or by other external devices (such as PC2a) communicatively connected to the programmable logic controller. may be When implemented in a PLC unit, the unit is provided with a monitor. Also, the process described here is the process of displaying the analysis report generated by the analysis unit 4a as a browser.

In S81, the CPU 11b determines whether or not an analysis report display request has been received via the operation unit 8b. If accepted, the process proceeds to S82. In S82, the CPU 11b requests an analysis report from the analysis unit 4a. Thereafter, in S83, the CPU 11b determines whether or not a response (analysis report) corresponding to the request has been received from the analysis unit 4a. The information received here may be a URL (IP address) for displaying the analysis report, or information of the analysis report itself. Here, the following processing will be described assuming that a URL has been received.

Upon receiving the response, in S84, the CPU 11b designates the Web browser 18 to display the analysis report. Subsequently, in S85, the CPU 11b determines whether or not an update request for updating the display of the analysis report has been received. If accepted, proceed to S86; otherwise, proceed to S87. At S86, when the update request is received, the CPU 11b at S86 transmits the update request to the analysis unit 4a, which is the Web server, and returns the process to S83. On the other hand, if it is not an update request, in S87 the CPU 11b determines whether or not an end instruction to end the display of the analysis report has been received. If it is determined that the end instruction has not been received, the process returns to S85, and if it is determined that the end instruction has been received, the process ends.

<Analysis comment generation flow (natural language expression)>
FIG. 17 shows the flow of generating analysis comments in natural language. The processing described here is part of the processing of S73 for generating the analysis report (processing related to generation of analysis comments). The processing described below will be described as processing executed by the CPU 41a of the analysis unit (extension unit) 4a. However, without intending to limit the invention, some of those processes may be performed in other units, all of those processes may be performed in one unit, or the programmable logic controller may be performed by an external device (analyzer) communicatively connected to the

First, in S731, the CPU 41a of the analysis unit 4a obtains the analysis result obtained in S72. As shown in FIG. 17, the acquired analysis result 1700 includes information on the type of abnormality of each device, and further includes detailed information, device names, device comments, and the like. Here, the device comment indicates a comment entered by the operator for a specific device on a user program editing screen or the like. The operator does not add comments to all devices, but usually comments to the devices that he uses. Therefore, the device comment becomes useful information for the operator. The types of abnormalities include a pattern 1701 in which an unchanged device has changed, a pattern 1702 in which the number of ON/OFF changes is abnormal, and a pattern 1703 in which the ON/OFF time is abnormal. . For each abnormality, detailed information includes, for example, change patterns and time intervals between normal and abnormal conditions, the number of changes, thresholds, detailed information, and the like. That is, the detailed information corresponds to the analysis parameters described above.

Next, in S732, the CPU 41a selects and acquires a prestored message format from the memory 42a according to the error content for each device. Reference numeral 1720 shows the pre-stored message format. The message format 1720 defines a format for generating analysis comments in natural language for each type of anomaly. The CPU 41a selects the appropriate message format according to the content of the device abnormality. In 1704, a message format 1705 of a pattern in which an unchanged device has changed is defined. In 1706, a message format 1707 of a pattern in which the number of ON/OFF changes is abnormal is defined. 1708 defines a message format 1709 of a pattern in which the ON/OFF time is abnormal.

Next, in S733, the CPU 41a selects and embeds numerical values and natural language corresponding to the content of the abnormality (analysis result) of each device in the selected message format. More specifically, values and natural language are embedded in the "{ }" shown in the message formats 1705, 1707, and 1709 according to the error content (analysis result) of each device. Further, in S734, the CPU 41a generates an analysis report including the generated analysis comment in addition to other analysis results such as the detection map 810, the detection list 820, and the image display area 830, and ends the process.

<Analysis comment generation flow (graphic expression)>
FIG. 18 shows the flow of generation of graphical analysis comments. The processing described here is part of the processing of S73 for generating the analysis report (processing related to generation of analysis comments). The processing described below will be described as processing executed by the CPU 41a of the analysis unit (extension unit) 4a. However, without intending to limit the invention, some of those processes may be performed in other units, all of those processes may be performed in one unit, or the programmable logic controller may be performed by an external device (analyzer) communicatively connected to the

First, in S736, the CPU 41a of the analysis unit 4a obtains the analysis result obtained in S72. As shown in FIG. 18, the acquired analysis result 1800 includes information on the type of abnormality of each device, and further includes detailed information, device names, device comments, and the like. The type of abnormality includes a pattern 1801 in which the number of ON/OFF changes is abnormal, a pattern 1802 in which the ON/OFF time is abnormal, and the like. Of course, other abnormal content patterns may be included. For each abnormality, detailed information includes, for example, change patterns and time intervals between normal and abnormal conditions, the number of times of change, thresholds, detailed information, and the like. That is, the detailed information corresponds to the analysis parameters described above.

Next, in S737, the CPU 41a selects and acquires a graphic format held in advance from the memory 42a according to the content of the abnormality for each device. Reference numeral 1820 indicates a graphic format held in advance. The graphical format 1820 defines a format for generating graphical analysis comments for each type of abnormality. The CPU 41a selects a corresponding graphic format according to the content of the device abnormality. In 1803, graphic formats 1804 to 1808 of patterns with an abnormal number of ON/OFF changes are defined. In 1809, graphic formats 1810 to 1816 of patterns with abnormal ON/OFF times are defined.

Next, in S738, the CPU 41a selects and embeds a graphic (partially including words and numerical values) corresponding to the content of abnormality (analysis result) of each device in the selected graphic format. More specifically, in the "?" areas shown in graphic formats 1804 to 1808 and 1810 to 1816, graphics corresponding to the content of the abnormality (analysis result) of each device are embedded. Further, in S739, the CPU 41a generates an analysis report including other analysis results, such as the detection map 810, the detection list 820, and the image display area 830, as well as the generated analysis comment, and ends the process.

Note that, as shown in the analysis comment 840, the expression of the content of the abnormality in a natural language and the expression of the content of the abnormality in a graphic form may be included at the same time. In this case, it is realized by executing the flowchart of FIG. 17 and the flowchart of FIG. 18, or by executing a flowchart combining the two flowcharts.

<Cycle setting>
FIG. 19 shows a setup screen 1900 for defining a cycle. The setting screen 1900 is, for example, a screen displayed on the display unit 7a of the PC 2a when a predetermined operation is performed from the UI 100 being displayed on the display unit 7a. As shown in FIG. 19 , it may be displayed superimposed on the program editor displayed on the UI 100 , or may be displayed as a screen transitioned from the program editor displayed on the UI 100 . Note that the setting screen 1900 may be displayed on the web browser 18 on the PC 2b.

A setting screen 1900 includes setting areas 1901 and 1902 for designating an application and an application name when driving record analysis is performed. These setting areas 1901 and 1902 are for setting analysis targets. Default settings are shown in FIG. 19, and the operator does not need to make any particular settings. Further, the setting screen 1900 has a basic setting area, where the control cycle can be specified. 1903 can set the designation method of the control cycle, 1904 can set the cycle name, 1905 can set the start trigger, and 1906 can set the end trigger. Also, by default, no control cycle is specified, and only the add button 1907 is displayed.

In the example shown in FIG. This indicates that 0, 1, 2 control cycles have already been specified. According to this embodiment, one or more control cycles can be specified as control cycles to be analyzed in this way. Therefore, when the operator wants to analyze a wide range, he can confirm a more intended analysis report by designating a plurality of control cycles. The designation method 1903 can select the start/end designation that designates the start timing that is the starting point and the end timing that is the end point of the control cycle, or the start designation that designates only the start timing. Therefore, the end trigger 1906 can designate the end timing only when the start/end designation is selected. Here, the device to which each cycle definition belongs and the device group are not set. Therefore, the analysis unit 4a or the like identifies and analyzes the device corresponding to the defined control cycle. Since multiple control cycles can be specified, one device may correspond to multiple control cycles. In this case, a higher priority may be set as the analysis target. If the priority is high, it may be preferentially displayed in the analysis report. On the other hand, it may be possible to set a specific device to be linked to each cycle definition.

The setting screen 1900 further includes a save setting 1911 , read setting 1912 , OK button 1913 , and cancel button 1914 . A setting save 1911 is a button for saving the setting content set in the setting screen 1900 . A setting read 1912 is a button for reading a setting file pre-stored in the project storage section 35 of the memory 32 of the basic unit 3 . One or more control cycles are specified in advance in the setting file. It is also possible to add more control cycles after reading the configuration file. An OK button 1913 is a button for validating the contents set on the setting screen 1900 and ending the setting process. A cancel button 1914 is a button for ending the setting process without applying the contents set on the setting screen 1900 .

<Cycle not set>
FIG. 20 shows a detection map 810 for an uncycled analysis report. The analysis unit 4a can perform analysis even if the cycle is not set, but there are extremely few devices capable of analysis. That is, it is limited to devices that do not have cycle patterns. A device that does not have a cycle pattern is, for example, a device whose device value is fixed and does not change. For example, as shown at 2001 in FIG. 20, an always-on or always-off device can be analyzed even if the cycle is not set. On the other hand, a device having a predetermined cycle pattern cannot be analyzed if the cycle is not set. As described above, since the number of devices capable of analysis is small, the analysis itself is possible even when the cycle is not set, but the effectiveness of the analysis results is limited. Therefore, as shown in FIG. 20, the analysis report may display a message 2002 indicating that the cycle has not been set and prompting the user to set the cycle. When "set cycle and analyze" is selected, a pop-up screen for cycle setting is displayed, and the operator can set the cycle.

<Model Reliability>
FIG. 21 is a diagram for explaining model reliability. Here, the model reliability indicated by 1030 in FIG. 10 will be described in detail. The reliability of the generated model changes according to the amount of data handled at the time of generation. Therefore, the analysis unit 4a measures the reliability of the model at the time of model generation and adds it to the model as attribute information. FIG. 21 shows how models are generated and analyzed when driving record data for 10 cycles is acquired. For example, even if 10 cycles of driving record data are acquired, it may be sufficient data for model generation for a simple device, but insufficient for an asynchronous device. Therefore, it is difficult to estimate the reliability of the generated model only from the number of cycles. Therefore, if the reliability of the model can be measured and presented, the operator can judge whether a good model was created during learning, and the operator can judge whether the detected content is reliable during anomaly detection. can.

Reference numerals 2101 to 2103 show how normal data is learned one cycle at a time, additional learning is repeated, and the data of the next cycle is analyzed. 2101 shows a case where a model is generated using 7 cycles and the 8th cycle is analyzed. 2102 shows a case where a model is generated using 8 cycles and the 9th cycle is analyzed. 2103 shows a case where a model is generated using 9 cycles and the 10th cycle is analyzed. In the example shown in FIG. 21, for example, in each generated model, the number of abnormalities detected is 8 in 2101, 3 in 2102, and 5 in 2103. Since it is originally normal data, it is desirable that the number of detections is 0. However, it will not be 0 if the amount of normal data is insufficient. The number of detections of these abnormalities may be presented to the operator as the reliability as it is, or the number of detections may be normalized to the reliability and presented. For example, if the number of detections is 0, the highest reliability is set to "3", if the number of detections is 1 to 10, the reliability is set to "2", and if the number of detections is 11 to 20, the reliability is set to "1". ”, and if the number of detections is 21 or more, the reliability may be set to “0”. For example, as shown in FIG. 21, the reliability may be obtained using the measured value 2101 with the largest number of detections. Note that the completion of learning and the reliability of the generated model may be presented at the timing when the learning is once completed, and the operator may be allowed to select whether to perform further learning. Alternatively, learning may be repeated until a predetermined reliability is reached.

<Modification>
The present invention is not limited to the above embodiment, and various modifications are possible. Various modifications will be described below with reference to the drawings.

<Modified example of system configuration>
FIG. 22 shows a modification of the PLC system configuration. In the above-described embodiment, the PLC system includes a PLC 1 composed of a basic unit 3, an analysis unit 4a, and an expansion unit 4b such as a camera unit, a PC 2a connected to the basic unit 3, and an analysis unit 4a connected to the analysis unit 4a. An example configured including a PC 2b for displaying a report has been described. However, these configurations are only examples, and the above-described collection of driving record data, generation of models, analysis, and display of analysis results may be performed by any device or unit. It may be implemented by other expansion units. A modification of such a configuration will be described here.

For example, as shown in FIG. 22, the function of the analysis unit 4a according to the above embodiment may be realized by an analysis device (functioning as a data processing device) 2c arranged in the upper layer of the PLC1. Since the processing of the learning phase of the model has a very high processing load and requires a long processing time, it can be assumed to be implemented externally according to the processing capability of the PLC unit. In addition, by providing an analysis function in the device of the upper layer, it is possible to obtain information from other PLCs, and it is possible to generate a more reliable model. The analysis device 2c has functions such as analysis of PLC-specific information, model generation, analysis, and analysis report creation. These functions are the same processing as those of the analysis unit 4a, so description thereof will be omitted.

Also, in the above embodiment, the basic unit 3 collects the operation record data of all devices, but other expansion units may collect the operation record data. For example, as shown in FIG. 22, a recorder unit 4c may be provided as an expansion unit. The recorder unit 4c includes a CPU 41c, a memory 42c, and a communication section 43c. The memory 42c is provided with the storage areas of the ring buffer 44c provided in the basic unit 3 in the above embodiment and the driving record storage section 45c. Since the collection of driving records is the same processing as that of the basic unit 3 of the above-described embodiment, detailed description thereof will be omitted.

As described above, according to the present invention, the devices or units that implement the processing functions described in the above embodiments can be changed within the possible range, and the present invention encompasses those modifications. . In the above modification, an example was described in which the recorder unit 4c for collecting driving record data was provided separately from the basic unit 3. However, this unit is provided with a collection function and a communication function, and the storage destination is connected via a network. It is good also as the database which carried out. As a result, a larger amount of data can be stored, and analysis can be performed much earlier than when the trigger was generated, and data from other PLC systems can also be used.

Further, in the above modified example, an example in which the processing functions are realized by a unit separate from the basic unit 3 or by an external device has been described, but there is a form in which these processing functions are integrated into the basic unit 3. good too. An advantage of such a configuration is that communication processing with other units and external devices can be omitted, so the processing load due to communication can be reduced, and the influence on PLC control can be reduced. Since the performance in the case of integration depends on the performance of the basic unit 3, it is necessary to improve the performance of the basic unit 3. FIG.

<Summary>
[Viewpoint 1]
The present invention is an analysis apparatus comprising: an execution engine that repeatedly executes a user program; an acquisition means that acquires drive record data including a plurality of time-series device values collected by executing the user program; model generation means for generating a model including analysis parameters for each device based on the learning of the normal driving record data; The apparatus includes analysis means for analyzing normal devices, and report generation means for generating an analysis report including expressions corresponding to the analysis parameters based on analysis results of each device detected as the abnormal device. According to this embodiment, it is possible to provide a report that allows easy identification of the cause of the abnormality, according to the analysis result of the driving record data. In addition, it is possible to provide a report that can easily identify the cause of the abnormality without requiring complicated user operations.

[Viewpoint 2]
In the above embodiment, the expression according to the analysis parameter includes at least one of a natural language expression and a graphical representation indicating the analysis result according to the analysis parameter. According to this embodiment, since the abnormal content is expressed in natural language, the natural language is the same method as a conversation between people, so the user does not have to learn anything new, and does not require specialized knowledge. Abnormal content can be easily analyzed. On the other hand, the graphical representation of the content of the anomaly makes it possible to visually understand it, and to know details such as what kind of anomaly occurred, the timing, and the degree of the anomaly.

[Viewpoint 3]
In the above-described embodiment, each of the expression in natural language and the expression in graphic has a predefined format corresponding to the content of the abnormality, and the report generation means selects the format in accordance with the content of the abnormality for each device. to generate an expression according to the analysis parameters. According to this embodiment, expressions in natural language and graphical expressions in analysis comments can be automatically created using a pre-stored database, so that complex operations by the operator are not required. can be done.

[Viewpoint 4]
In the above embodiment, the report generation means generates the natural language expression by selecting and embedding the natural language or graphics based on the analysis result in a format corresponding to the content of the abnormality. According to the liquid of this embodiment, it is possible to obtain the same effects as those of the above embodiments by simple processing such as embedding a natural language or graphics in a format corresponding to the content of the abnormality.

[Viewpoint 5]
In the above-described embodiment, the graphical representation includes waveforms of a normal device and waveforms detected as an abnormal device so that they can be compared. According to the present embodiment, it is possible to compare and confirm normal behavior and behavior to be analyzed, and to more easily grasp unusual behavior.

[Viewpoint 6]
In the above embodiment, the abnormal portion is highlighted in the waveform detected as the abnormal device. According to this embodiment, it is possible to easily confirm at which position in the detected waveform an abnormality occurs.

[Viewpoint 7]
In the above embodiment, the model generation means classifies each device into one of a plurality of types indicating change patterns from the plurality of time-series device values of each device, and the analysis means according to the classified types. determine the analysis parameters to be used in detecting abnormal devices. According to this embodiment, appropriate analysis can be performed for each type of device change pattern, and more accurate analysis results can be obtained.

[Viewpoint 8]
In the above embodiment, the analysis parameter includes at least one of device value ON time, OFF time, rise timing, fall timing, ON count, OFF count, and steady state value. According to this embodiment, it is possible to perform analysis corresponding to various change patterns, and more accurate analysis results can be obtained.

[Viewpoint 9]
In the above embodiment, the method further comprises transmission means for transmitting screen information of a result display screen showing the content of the analysis report output from the report generation means to an external device, wherein the result display screen can be operated on the external device. is displayed on the display. According to this embodiment, the analysis report can be transmitted to an external device, for example, the analysis report can be analyzed by a higher-performance PC or the like, and the results can be displayed with more detailed analysis and a richer operation system. Enable screen display.

[Viewpoint 10]
In the above embodiment, the result display screen further includes a filter setting area in which conditions for narrowing down the display items of the analysis report can be specified. According to this embodiment, unnecessary display items can be excluded from the result display screen, and abnormality can be analyzed more easily.

[Viewpoint 11]
In the above embodiment, in the filter setting area, a filter can be specified by at least one of device control cycle specification, attribute information specification, and event/error specification. According to this embodiment, various options can be provided when the operator narrows down the display items.

[Viewpoint 12]
In the above embodiment, display means for displaying an edit screen of the user program is further provided, and the analysis report synchronized with the time axis of the edit screen can be displayed on the edit screen. According to this embodiment, an analysis report can be displayed in cooperation with a user program, and analysis can be performed in consideration of the user program.

[Viewpoint 13]
In the above embodiment, when the analysis report is generated by the reception means for receiving the analysis report generation request and the report generation means in response to the generation request, the requester is notified that the analysis report generation has been completed. and notification means for performing. According to this embodiment, the operator can be notified that the generation of the analysis report has been completed, and a more user-friendly operation system can be realized.

[Viewpoint 14]
In the above embodiment, further comprising setting means for setting definitions of one or more control cycles, the model generating means, based on the set definitions of the one or more control cycles, of the acquired driving record data. After learning, the report generating means synchronizes and displays the analysis results of each device detected as the abnormal device on the time axis according to the one or more set control cycle definitions. Generate analysis reports that According to this embodiment, the processing of the learning phase and the estimation phase can be performed according to the control cycle, the processing can be simplified, and accurate analysis and synchronization can be performed.

[Viewpoint 15]
In the above-described embodiment, the analyzing means analyzes the driving record data for a device that does not have a cycle pattern of a control cycle when the control cycle is not defined by the setting means. According to this embodiment, it is possible to easily output an analysis report without requiring the operator to perform a cycle pattern setting operation. Therefore, the operator can generate a trial analysis report without setting the cycle pattern, and also perform analysis methods such as analyzing the generated analysis report and setting the cycle pattern for more detailed analysis. be able to.

[Viewpoint 16]
In the above embodiment, the report generation means generates an analysis report of the analysis result of a device that does not have a control cycle cycle pattern,
The analysis report includes a message to the effect that the control cycle has not been set and a message prompting the setting means to set the control cycle. According to this embodiment, when the operator forgets to set the cycle, it is possible to prompt the operator to set the cycle, thereby providing a more user-friendly operation system.

[Viewpoint 17]
The present invention is an analysis system in which a data processing device and a programmable logic controller can communicate, and includes an execution engine that repeatedly executes a user program, and a plurality of time-series device values collected by executing the user program. Acquisition means for acquiring driving record data including the analysis means for analyzing abnormal devices that do not satisfy normal conditions according to a model; and report generation means for generating an analysis report that displays the analysis results of each device detected as abnormal devices in synchronization on the time axis. Prepare. According to this embodiment, it is possible to provide a report that allows easy identification of the cause of the abnormality, according to the analysis result of the driving record data. In addition, it is possible to provide a report that can easily identify the cause of the abnormality without requiring complicated user operations.

[Viewpoint 18]
In the above embodiment, at least one of the acquisition means, the model generation means, the analysis means, and the report generation means is provided in the data processing device. According to this embodiment, the configuration for realizing the present invention can be flexibly incorporated into an appropriate component according to the development cost of the PLC, the performance of the data processing device, etc., and the degree of freedom in system design is increased. can be improved.

[Viewpoint 19]
In the above embodiment, the programmable logic controller
A CPU unit comprising the execution engine, and a recorder unit provided in the programmable logic controller that implements the acquisition means, wherein the data processing device comprises the model generation means, the analysis means, and the report generation means. According to this embodiment, the configuration for realizing the present invention can be flexibly incorporated into an appropriate component according to the development cost of the PLC, the performance of the data processing device, etc., and the degree of freedom in system design is increased. can be improved.

The invention is not limited to the above embodiments, and various modifications and changes are possible within the scope of the invention.

Claims (20)

an analytical device,
an execution engine that repeatedly executes a user program;
Acquisition means for acquiring drive record data including a plurality of time-series device values collected by executing the user program;
model generation means for generating a model including analysis parameters for each device based on learning of the acquired driving record data during normal operation;
analysis means for analyzing the acquired drive record data to be analyzed for abnormal devices that do not satisfy normal conditions according to the model;
and report generating means for generating an analysis report including an expression corresponding to the analysis parameter based on the analysis result of each device detected as the abnormal device. 2. The analysis apparatus according to claim 1, wherein the expression corresponding to the analysis parameter includes at least one of a natural language expression and a graphic expression indicating the analysis result according to the analysis parameter. Each of the expression in the natural language and the expression in the graphic has a predefined format corresponding to the content of the abnormality,
3. The analysis apparatus according to claim 2, wherein said report generation means selects said format according to the content of abnormality for each device and generates an expression according to said analysis parameter. 4. The report generation means according to claim 3, wherein said report generating means generates said natural language expression by selecting and embedding a natural language or graphic based on said analysis result in a format corresponding to said abnormality content. Analysis equipment. 5. The analysis according to any one of claims 2 to 4, characterized in that the graphical representation includes waveforms of the device during normal operation and waveforms detected as abnormal devices in a comparable manner. Device. 6. The analyzer according to claim 5, wherein an abnormal portion is highlighted in the waveform detected as the abnormal device. The model generation means is
classifying each device into one of a plurality of types indicating change patterns from the plurality of time-series device values of each device;
7. The analyzer according to any one of claims 1 to 6, wherein the analysis parameters used when the abnormal device is detected by the analysis means are determined according to the classified type. 3. The analysis parameters include at least one of ON time, OFF time, rise timing, fall timing, ON count, OFF count, and steady state value of the device value. 8. The analyzer according to 7. further comprising transmission means for transmitting screen information of a result display screen showing the content of the analysis report output from the report generation means to an external device;
9. The analyzer according to any one of claims 1 to 8, wherein the result display screen is operably displayed on a display unit of the external device. 10. The analyzer according to claim 9, wherein the result display screen further includes a filter setting area in which conditions for narrowing down the display items of the analysis report can be specified. 11. The analyzer according to claim 10, wherein in said filter setting area, a filter can be specified by at least one of device control cycle specification, attribute information specification, and event/error specification. further comprising display means for displaying an edit screen of the user program,
12. The analyzer according to claim 10, wherein the analysis report can be displayed on the edit screen in synchronization with the time axis of the edit screen. receiving means for receiving a request for generating the analysis report;
13. The apparatus according to claim 12, further comprising notifying means for notifying a source of the request that the analysis report has been generated when the analysis report is generated by the report generating means in response to the generation request. analyzer. Further comprising setting means for setting one or more control cycle definitions,
The model generation means learns the acquired driving record data based on the set definition of the one or more control cycles,
The report generating means generates an analysis report displaying the analysis results of each device detected as the abnormal device in synchronization with the time axis according to the one or more set control cycle definitions. 14. The analysis device according to any one of claims 1 to 13, wherein the analysis device generates a 14. When the control cycle is not defined by the setting means, the analysis means analyzes the operation record data for a device that does not have a cycle pattern of the control cycle as an analysis target. The analyzer described in . The report generation means generates an analysis report of an analysis result of a device that does not have a control cycle cycle pattern,
16. The analyzer according to claim 15, wherein said analysis report includes a message to the effect that no control cycle has been set and a message prompting said setting means to set a control cycle. An analysis system in which a data processing device and a programmable logic controller can communicate,
an execution engine that repeatedly executes a user program;
Acquisition means for acquiring drive record data including a plurality of time-series device values collected by executing the user program;
a model generating means for generating a model for each device based on learning of the acquired driving record data in a normal state;
analysis means for analyzing the acquired drive record data to be analyzed for abnormal devices that do not satisfy normal conditions according to the model;
and report generation means for generating an analysis report displaying the analysis results of each device detected as the abnormal device in synchronization on the time axis. 18. The analysis system according to claim 17, wherein at least one of said acquisition means, said model generation means, analysis means, and said report generation means is provided in said data processing device. The programmable logic controller is
a CPU unit comprising the execution engine;
A recorder unit provided in the programmable logic controller that realizes the acquisition means,
The data processing device is
18. The analysis system according to claim 17, comprising said model generation means, analysis means, and said report generation means. A control method for a system in which a data processing device and a programmable logic controller can communicate,
repeatedly executing a user program;
an acquisition step of acquiring driving record data including a plurality of time-series device values collected by executing the user program;
a model generation step of generating a model for each device based on learning of the acquired normal driving record data;
an analysis step of analyzing the acquired drive record data to be analyzed for abnormal devices that do not satisfy normal conditions according to the model;
and a report generating step of generating an analysis report displaying the analysis results of each device detected as the abnormal device in synchronization on the time axis.

Images