JP5328754B2 - Message collection and analysis device, message collection and analysis method, and program - Google Patents

Description

  The present invention relates to a message collection and analysis device, a message collection and analysis method, and a program for collecting and analyzing messages transmitted and received through each of a plurality of networks constituting a network system such as a building facility system network that manages building facilities.

  In recent years, development of a building equipment system network that manages and controls equipment such as air conditioners installed in a building using a predetermined monitoring device (building management system) has been underway. In a conventional building equipment system network, a monitoring device connected to a higher level network such as a LAN (Local Area Network) or a WAN (Wide Area Network) has a plurality of equipment connected by a lower level network via a gateway device. Management (monitoring) and control.

  BACnet (Building Automation and Control Networking Protocol), which is one of the representative protocols of the higher level network, was defined in 2003 as the international standard ISO 16484-5. As a result, an increasing number of vendors provide devices compatible with BACnet defined as an international standard.

  The gateway device is connected between the upper network to which the monitoring device is connected and the lower network to which the equipment is connected. The gateway device converts data (packets) transmitted from the monitoring device into data that can be processed by the facility device, and converts data transmitted from the facility device into data that can be processed by the monitoring device. That is, the gateway device performs mutual conversion between a protocol on the upper network side processed by the monitoring device and a protocol on the lower network side processed by the equipment.

  As one of such gateway devices, for example, a gateway device capable of connecting a lower-level network and a higher-level network provided by a plurality of different vendors that provide equipment is provided (for example, Patent Documents). 1).

  As a result, each of a plurality of vendors can easily construct a lower-level network of an original specification. However, on the other hand, in a system in which lower-level networks of various specifications are constructed, when a problem occurs in the system, it is difficult to determine which network has the cause of the problem.

  In order to perform this separation, a message collection / analysis device that collects and analyzes messages transmitted through each network is used. The message collection and analysis device is connected to each of a plurality of networks (for example, an upper network and a lower network), and simultaneously collects messages transmitted through the connected networks. Based on the collected result, the maintenance engineer analyzes, for example, whether there is a response message for the request message or whether the content of the response message is correct.

  As an example of such a message collection and analysis apparatus, a network analyzer including a plurality of measurement terminals, one main frame, and one terminal adapter is disclosed (for example, see Patent Document 2). The plurality of measurement terminals measure the measurement target. The mainframe also controls the measurement terminal and performs analysis / determination processing of the measurement signal received from the measurement terminal. The terminal adapter switches the connection between the mainframe and one of the measurement terminals in a time division manner.

JP 2006-129283 A (FIG. 1) Japanese Patent No. 3429145 (FIG. 1)

  One telegram collection / analysis device is connected to each of an upper network and a lower network sandwiching the gateway device in a building equipment system network including the gateway device. Each message collection and analysis device collects messages transmitted to the network to which each message collection and analysis device is connected before and after the occurrence of a failure.

  The cause when a problem occurs is determined by the maintenance engineer analyzing the collected messages. The analysis items are diverse. For example, whether the monitoring device connected to the upper network correctly transmits the request message, or whether the gateway device receives the request message from the monitoring device and correctly transmits the request message to the equipment connected to the lower network, The equipment receives the request message from the gateway device, correctly controls the equipment and sends the result as a response message to the gateway device, or the gateway device receives the response message from the equipment and sends it to the monitoring device Or the like is an analysis item.

  The apparatus disclosed in Patent Document 2 can be connected to each of a plurality of networks and collect messages simultaneously. However, since the electronic messages are finally collected by the number of networks, the data amount becomes enormous. For this reason, the maintenance engineer needs to collect this enormous amount of messages before performing specific analysis work.

  This aggregation work takes a long time. Depending on the amount of collected telegram data, for example, it usually takes 30 minutes to 1 hour to collect telegrams collected in 1 to 2 hours. In addition, it takes 2 to 4 hours to collect messages collected from half a day to one day. In this way, a huge amount of time is required only for the work of consolidating messages, which increases the work load on the maintenance engineer.

  The present invention has been made in view of the above circumstances, a message collection and analysis device, a message collection and analysis method, and a message collection and analysis method capable of improving the analysis efficiency of a message transmitted through each of a plurality of networks constituting a building equipment system network. The purpose is to realize the program.

In order to achieve the above object, a message collection / analysis apparatus of the present invention is a message collection / analysis apparatus of a system network composed of a plurality of networks. In this electronic message collection and analysis apparatus, the electronic message receiving means individually receives electronic messages transmitted through a plurality of networks. The message storage means assigns time information to messages transmitted through each network and stores them separately. The collected data aggregating unit generates aggregated data by aggregating the telegrams of each network separately stored in the telegram storage unit across the plurality of networks based on a predetermined aggregation condition.

  According to the present invention, since messages transmitted through each of a plurality of networks are aggregated based on a predetermined aggregation condition, it is possible to improve analysis efficiency of messages transmitted through a system network composed of a plurality of networks. it can.

It is a block diagram which shows the structure of the whole building installation system network in which the message | telegram collection analysis apparatus which concerns on Embodiment 1 of this invention is used. It is a block diagram which shows schematic structure of the message | telegram collection analysis apparatus of FIG. It is a flowchart which shows operation | movement of the message | telegram collection analysis apparatus of FIG. It is a block diagram which shows the structure of the whole building installation system network in which the message | telegram collection analysis apparatus which concerns on Embodiment 2 of this invention is used. It is a block diagram which shows the schematic structure of the message | telegram collection analysis apparatus of FIG. It is a flowchart which shows operation | movement of the message | telegram collection analysis apparatus of FIG.

  Embodiments of the present invention will be described in detail with reference to the drawings.

Embodiment 1 FIG.
First, a first embodiment of the present invention will be described.

  A case will be described in which the message collection and analysis apparatus according to the first embodiment is applied to a certain building equipment system network. As shown in FIG. 1, the message collection / analysis apparatus 1 is connected to a building equipment system network 100.

  The building equipment system network 100 includes an equipment management network 2, equipment equipment network 3, building management system 4, equipment equipment 5, and gateway device 6. That is, the building equipment system network 100 is composed of a plurality of networks (an equipment management network 2 and an equipment network 3).

  The equipment management network 2 is an upper network of the building equipment system network 100. As the equipment management network 2, for example, BACnet or the like is adopted.

  The equipment network 3 is a lower network of the building equipment system network 100. As the equipment device network 3, for example, LONWORKS (registered trademark) is adopted.

  The building management system 4 is connected to the facility management network 2. The equipment 5 is connected to the equipment network 3. The gateway device 6 is connected to the boundary between the facility management network 2 and the facility device network 3 as a network conversion device. The building management system 4 and the gateway device 6 are connected via the facility management network 2, and the gateway device 6 and the facility device 5 are connected via the facility device network 3.

  The message collection / analysis apparatus 1 is connected to two collection points for collecting messages transmitted through the facility management network 2 and messages transmitted through the facility device network 3.

  FIG. 2 shows a schematic configuration of the message collection / analysis apparatus 1 according to the first embodiment. As shown in FIG. 2, the message collection / analysis device 1 includes a message reception unit 11, a storage unit 12, a collection control management unit 13, a collection data aggregation unit 14, a display information generation unit 15, and an upper network connection port. 16, a lower network connection port 17, an operation input means 18, and a display means 19.

  The message receiving means 11 receives a message transmitted through the facility management network 2 and the facility device network 3. The message receiving unit 11 includes a first message receiving unit 11a and a second message receiving unit 11b. The first message receiving means 1a receives a message transmitted through the facility management network 2 via the higher network connection port 16 to which the BACnet protocol message is transmitted. The second message receiving means 11b receives a message transmitted through the equipment network 3 via the lower network connection port 17 through which the LONWORKS protocol message is transmitted.

  The storage unit 12 stores collected messages. The storage unit 12 includes a first storage unit 12a, a second storage unit 12b, and an aggregate data storage unit 12m. The first storage unit 1a stores the message received by the first message reception unit 1a. The second storage unit 12b stores the message received by the second message receiving unit 1b. The aggregated data storage unit 12m stores aggregated data generated by aggregating the telegram stored in the first storage unit 1a and the telegram stored in the second storage unit 1b.

  The collection control management unit 13 receives an input from the operation input unit 18.

  The collection control management unit 13 outputs a collection start instruction to the first message reception unit 11a and the second message reception unit 11b. In response to this, the first telegram receiving unit 11a starts receiving the telegram transmitted through the facility management network 2, adds time information to the received telegram, and stores it in the first storage unit 12a.

  At this time, the first message receiving unit 11a receives not only the BACnet protocol message but receives and stores all messages of the Ethernet (registered trademark) protocol.

  Similarly, in response to the collection start instruction, the second telegram receiving unit 11b starts to receive a telegram transmitted to the equipment network 3, and adds time information to the received telegram, and the second storage unit 12b. To store.

  The collection start instruction by the collection control management unit 13 can be set so as to be output in response to the collection start operation of the operation input unit 18, or set to be output at the collection start time set by the operator. You can also

  The collection control management unit 13 can individually output a collection start instruction to the first message receiving unit 11a and the second message receiving unit 11b. Thereby, the collection control management unit 13 can also cause the first message reception unit 11a and the second message reception unit 11b to start the collection simultaneously, and the first message reception unit 11a and the second message reception. It is also possible for the means 11b to start collecting separately. By making it possible to individually set the collection start timing, it is possible to collect messages transmitted through each network at the timing intended by the operator.

  As described above, in the message collection / analysis apparatus 1, the message transmitted through the facility management network 2 is received by the message reception unit 11a via the higher-level network connection port 16, and stored in the first storage unit 12a. The message transmitted to the device network 3 is received by the message receiving unit 11b via the lower network connection port 17 and stored in the second storage unit 12b. Thus, since the messages are collected individually for each network, the messages transmitted to each of the plurality of networks can be collected simultaneously.

  The collection control management unit 13 individually outputs a collection end instruction to the first message reception unit 11a and the second message reception unit 11b. In response to this collection end instruction, the first message receiving unit 11a and the second message receiving unit 11b stop receiving messages.

  The collection end instruction by the collection control management unit 13 can be set to be output by the collection end operation of the operation input unit 18 by the operator, and is output at the collection end time set by the operator setting. Can be set as follows. Further, the collection end instruction by the collection control management unit 13 may be output when the collection time set by the operator's setting has elapsed with the set collection start time as a starting point.

  Since the collection control management unit 13 individually outputs a collection end instruction to the first message reception unit 11a and the second message reception unit 11b, the first message reception unit 11a and the second message reception unit 11b It is also possible to end the collection at the same time, and it is also possible for the first message receiving unit 11a and the second message receiving unit 11b to end the collection separately. In this way, by making it possible to individually set the collection end timing, it becomes possible to stop collecting messages transmitted through the facility management network 2 and the facility device network 3 at the timing intended by the operator. .

  The collected data aggregating unit 14 sorts the messages stored in the first storage unit 12a and the second storage unit 12b in ascending order of aggregation conditions preset by the operator, for example, message reception time. Aggregated data is generated by aggregating the messages while comparing the reception times according to the conditions. The generated aggregated data is stored in the aggregated data storage unit 12m.

  The aggregation condition set in advance by the operator may be rearranged in descending order of the message reception time. Furthermore, the aggregation condition may be a condition of rearranging the transmission source addresses of the messages in ascending or descending order. Further, the aggregation condition may be a condition of rearranging the transmission destination addresses of the messages in ascending order or descending order. Further, the aggregation condition may be a condition that the message command types (service in the BACnet protocol, network variable in the LONWORKS (registered trademark)) are rearranged in ascending or descending order. Further, the aggregation condition may be a filtering condition, and an excess message may be deleted.

  A plurality of conditions can be combined as the aggregation condition described above. For example, messages can be rearranged with the ascending order of the message transmission source address as the highest priority and the ascending order of the received message time as the next priority.

  The collected data aggregation means 14 can also re-aggregate messages in accordance with the aggregation conditions newly set by the operator. Thereby, it is possible to aggregate messages according to various aggregation conditions. By consolidating messages, for example, it is possible to count the number of requests at the request source and the number of responses at the request destination, and to check whether responses are correctly returned for all requests. Analysis work becomes possible.

  The display information generation unit 15 generates display information for displaying the aggregated data stored in the storage unit 12. Based on this display information, the display unit 19 displays the aggregated data. Further, the display information generation unit 15 generates display information for displaying the electronic message stored in the storage unit 12. Based on this display information, a message is displayed on the display means 19.

  The display information generation unit 15 can display the telegrams and aggregated data for each network stored in the storage unit 12 before being aggregated. From the telegrams received by the telegram reception unit 11 and the telegrams It is also possible to display the generated aggregated data. Which data is displayed can be set by an operation input by the operator.

  By the way, the message receiving unit 11 detects whether or not the received message is against the communication protocol, and if it is against the communication protocol, notifies the display information generating unit 15 to that effect. Good. When such a notification is received from the electronic message receiving unit 11, the display information generating unit 15 may generate error information to that effect as display information. In this case, the display means 19 may highlight the abnormal message together with the error display.

  If there is a message that cannot be interpreted, the message may be filtered.

  The collection control management means 13 issues a collection start instruction and a collection end instruction simultaneously to the first message reception means 11a connected to the facility management network 2 and the second message reception means 11b connected to the facility equipment network 3. Thus, it is possible to acquire a message transmitted to two networks at the same time.

  In addition, the collection start instruction and the collection end instruction can be issued at different times to the first message reception unit 11a and the second message reception unit 11b, respectively, and the timing of the collection start and collection end can be made different. Thereby, for example, when the telegram collection of the equipment network 3 is finished and only the telegram of the equipment management network 2 is desired to be collected for a long time, only the necessary telegram can be collected.

  Since the collection start instruction and the collection end instruction can be performed by the operation of the operator, the collection work can be performed at the timing set by the operator. In addition, if the collection start instruction and the collection end instruction are designated as time, the collection start and collection end timing can be specified more accurately. For example, an automatic message can be sent without the operator having to go to the site. It becomes possible to collect.

  The collection start timing and collection end timing can be specified by any combination, such as operation input by the operator and time designation. For example, collection may be started according to a collection start instruction from the operator, and collection may be terminated at a specified time. After starting the collection according to the collection start instruction, the collection time can be changed according to the operation of the operator. Thereby, for example, 5 minutes after the start of collection can be changed to 10 minutes.

  The message received by the first message receiving unit 11a and the second message receiving unit 11b and given the time information is stored in the first storage unit 12a and the second storage unit 12b and simultaneously transmitted to the display information generation unit 15. If the display information generating means 15 displays a message to the operator, the collection end timing can be determined while checking the fluctuation of the message received by the operator, so that more efficient analysis is possible. Work becomes possible.

  Further, the operation input means 18 may not be provided. In this case, the collection control management means 13 is, for example, an Ethernet (registered trademark) port, a wireless LAN, a USB (Universal Serial Bus), other serial communication, a collection start command from another computer via a connection such as ZigBee, A collection start instruction or a collection end instruction may be output by receiving a collection end command.

  FIG. 3 is a flowchart showing the operation of the message collection / analysis device 1 according to this embodiment. As shown in FIG. 3, when the telegram collection / analysis apparatus 1 accepts an operator's collection start operation (step S1), the telegram collection / analysis apparatus 1 starts collecting telegrams transmitted through the facility management network 2 and the facility device network 3 respectively (step S1). S2). Thereby, the individual reception of the message transmitted through the facility management network 2 and the facility device network 3 by the message reception unit 11 and the storage in the storage unit 12 after giving the time information to each message are performed.

  In step S2, collection of messages transmitted through the facility management network 2 and the facility device network 3 may be started after reaching a preset collection start time.

  When the telegram collection / analysis apparatus 1 accepts an operator's collection end operation (step S3), the telegram collection / analysis apparatus 1 ends collection of telegrams transmitted through the facility management network 2 and the facility equipment network 3 (step S4). Subsequently, the collected data aggregating unit 14 aggregates the messages of the facility management network 2 and the facility device network 3 stored in the storage unit 12 by aggregating the collected data based on a predetermined aggregation condition. Data is generated and stored in the storage means 12 (step S5).

  The message collection end timing may be after reaching a preset collection start time, or may be after a set collection time has elapsed from the set collection start time as a starting point.

  The electronic message collection / analysis apparatus 1 causes the display unit 19 to display the aggregated data via the display information generation unit 15 (step S6). Thereby, the operator can confirm the aggregated data.

  As described in detail above, according to the message collection and analysis apparatus 1 according to this embodiment, since the messages transmitted through the facility management network 2 and the facility device network 3 are aggregated based on a predetermined aggregation condition, The work efficiency of collecting messages in the building equipment system network 100 can be improved.

  Moreover, according to this embodiment, the collection start and collection end timings of messages transmitted through the facility management network 2 and the facility device network 3 can be set to, for example, operation input timings or designated times. it can. Each timing can be specified individually.

  Moreover, the timing of the end of message collection can be after a predetermined time has elapsed since the start of message collection. In this way, a telegram can be acquired at a timing desired by the operator by freely combining these collection start and collection end timings.

  Further, since the message collection and analysis apparatus 1 can display a message on the display means 19 when a message being collected is received, the operator can specify the timing of the end of collection while checking the message received. .

  Moreover, since the message collection and analysis apparatus 1 can collectively display the collected messages after the collection is completed, the operator can collect the collected messages within a short time after the collection is completed without requiring any special operation. Can be analyzed.

Embodiment 2. FIG.
Next, a second embodiment of the present invention will be described.

  FIG. 4 shows an application example of the message collection / analysis apparatus 1a, 1b according to the second embodiment to the building equipment system network 100. As shown in FIG. 4, a message collection and analysis device 1 b is connected to the building facility system network 100 instead of the message collection and analysis device 1, and a message collection and analysis device 1 a is connected to the building management system 4 in the facility management network 2. ing.

  As in the first embodiment, the building management system 4 and the gateway device 6 are connected via the facility management network 2, and the gateway device 6 and the facility device 5 are connected via the facility device network 3. Yes.

  FIG. 5 shows a schematic configuration of a message collection / analysis device 1b according to the second embodiment. As shown in FIG. 5, the message collection / analysis device 1b further includes a communication unit 20 and a collection system management unit 21 in addition to the configuration of the message collection / analysis device 1 according to the first embodiment. The storage means 12 is further provided with information storage means 12s.

  Communication between the message collection / analysis device 1a and the message collection / analysis device 1b is performed via each communication means 20. The communication means 20 are connected by, for example, Ethernet (registered trademark).

  The collection system management unit 21 performs communication via the communication unit 20 using the communication partner's IP address and port number, which are communication partner setting information held in the setting information storage unit 12s. The message collection and analysis devices 1a and 1b operate in either the master mode or the slave mode. The collection system management means 21 stores whether it is operating in the master mode or the slave mode.

  The communication partner setting information held in the storage unit 12 is information preset by the operator. The communication partner setting information can be added / deleted / changed later.

  In this embodiment, the message collection / analysis apparatuses 1a and 1b are connected by Ethernet (registered trademark), but are connected by other connection media such as wireless LAN, USB, other serial communication, ZigBee, and the like. May be. At this time, depending on the connection medium employed, the communication partner setting information held in the setting information storage unit 12s is in accordance with the connection medium, and includes, for example, an IP address and a port number, It is included.

  The message collection and analysis devices 1a and 1b send and receive a collection start instruction, a collection end instruction, aggregated data, communication partner setting information, and the like via the communication unit 20 and the higher-level network connection port 16.

  FIG. 6 shows the flow of processing when the message collection / analysis device 1b operated by the operator is a device that operates in the master mode and the message collection device 1a is a device that operates in the slave mode.

  As shown in FIG. 6, when receiving the operator's collection start operation (step S1), the message collection / analysis device 1b (master) acquires communication partner setting information from the setting information storage unit 12s (step S10), and the slave A collection start instruction is transmitted to the message collection and analysis apparatus 1a operating in the mode (step S11), and collection of messages transmitted through the facility management network 2 and the facility device network 3 is started (step S2). Also, the message collection and analysis apparatus 1a that has received the collection start instruction from the message collection and analysis apparatus 1b starts collecting messages transmitted through the facility management network 2 (step S12).

  Here, in steps S2 and S12, collection of messages may be started after reaching the collection start time included in the collection start operation.

  When receiving the operator's collection end operation (step S3), the message collection / analysis device 1b transmits a collection end instruction to the message collection / analysis device 1a (step S13). Subsequently, the message collection / analysis device 1b terminates message collection (step S4), generates aggregated data by aggregating the data collected by the collected data aggregating unit 14, and stores the aggregated data in the storage unit 12 (step S4). Step S5).

  Note that the collection of messages may end after reaching a preset collection start time, or may end after a preset collection time has elapsed with the set collection start time as a starting point. .

  The message collection and analysis apparatus 1a that has received the collection end instruction also ends the collection of messages (step S14), generates aggregated data by aggregating the data collected by the collected data aggregating means 14, and stores it in the storage means 12a. (Step S15). Subsequently, the message collection / analysis device 1a acquires the communication partner setting information from the setting information storage unit 12s (step S16), and transmits the aggregated data to the message collection / analysis device 1b operating in the master mode (step S17).

  The message collection / analysis apparatus 1a may also end the collection of messages after reaching a preset collection start time, or may end after a preset collection time has elapsed with the collection start time as a starting point. It may be.

  The message collection / analysis device 1b further re-aggregates the aggregated data received from the message collection / analysis device 1a via the communication unit 20 and the aggregated data of the message collection / analysis device 1b by the collected data aggregation unit 14, and stores aggregated data. Store in the means 12m (step S18). The re-aggregated aggregated data is output to the display information generating unit 15 and displayed on the display unit 19 (step S6). The operator can check the data collected and collected by the message collection / analysis device 1a and the message collection / analysis device 1b by looking at the display.

  In this way, the telegram collection / analysis apparatus 1b and the telegram collection / analysis apparatus 1a can cooperate to acquire the collected data of the telegrams of the facility management network 2 and the facility equipment network 3 collected. Thereby, for example, even when the telegram collection / analysis apparatus 1a is in a remote location, the operator is collected by the telegram collection / analysis apparatus 1a without going to the telegram collection / analysis apparatus 1a (without being aware of being away). Telegrams and aggregated data can be obtained.

  Moreover, the timing of the start and end of the collection of messages transmitted through the facility management network 2 and the facility equipment network 3 is the operation input, the time designation, the time designation from the collection start, etc. for the message collection analysis devices 1a and 1b. Each can be set individually. By combining these collection start and collection end timings, a message can be acquired at a timing desired by the operator.

  In addition, in order to match the timing of the start of message collection and the end of collection, it is necessary to match the time measured by all connected message collection analysis devices. For example, NTP (Network Time Protocol) can be adopted as means for adjusting the time. In addition to NTP, it is also possible to perform time adjustment using an SNTP (Simple Network Time Protocol) or an HTTP (Hypertexts Transfer Protocol) header. Such time adjustment is performed by the collection control management means 13.

  When the message collection and analysis devices 1a and 1b are connected by USB, other serial communication, or ZigBee, the time cannot be adjusted by the NTP or the like. Therefore, the message collection and analysis device 1b that operates in the master mode operates in the slave mode. The time may be adjusted by distributing the own time to the collection analysis apparatus 1a and the message collection analysis apparatus 1a operating in the received slave mode immediately adjusting to the time.

  The operator may directly collect the aggregated data using the storage medium without using the communication unit 20. Thereby, the aggregated data separately acquired by the message collection and analysis apparatus not connected to the network can be aggregated later. As such a storage medium, for example, a USB memory, a memory card, an HDD (Hard Disc Drive), or an FDD (Flexible Disc Drive) can be used.

  The aggregation conditions set in advance by the operator may be rearranged in descending order in addition to ascending order of the message reception time. The aggregation conditions may be rearranged in ascending or descending order of the message transmission source addresses. The aggregation conditions may be rearranged in ascending or descending order of the message transmission destination addresses. The aggregation conditions may be rearranged in ascending or descending order of message command types (service in the BACnet protocol, network variable in the LONWORKS). Further, the aggregation condition may be a filtering condition so that an extra message is not displayed.

  Further, the operation input means 18 may not be provided. In this case, for example, a collection start instruction or a collection end instruction may be received from another computer via an interface such as an Ethernet (registered trademark) port, wireless LAN, USB, other serial communication, or ZigBee. Further, a collection start instruction or a collection end instruction from another message collection / analysis apparatus may be received via the communication unit 20.

  Note that the message collection / analysis apparatus according to each of the above-described embodiments is capable of aggregating messages transmitted in each of three or more networks, not limited to two networks, based on a predetermined aggregation condition.

  The message collection / analysis apparatus according to each of the above embodiments can collect messages of the same or different protocols at three or more message collection points at the same time and store them individually, so that a complex system combining a number of networks Even a network can handle it.

  In addition, the message collection and analysis apparatus according to each of the above embodiments starts collecting messages individually at arbitrary timings by operating input, time designation or time designation for messages transmitted through three or more networks. Can be obtained or terminated, so that it is possible to obtain telegrams and aggregated data according to the state of the system.

  Further, the display unit 19 can display the current message and aggregated data, and can also display the message and aggregated data stored in the past. Thereby, the analysis efficiency can be remarkably improved.

  Moreover, even if there are three or more message collection / analysis devices, the time of all connected message collection / analysis devices can be set to the same time. NTP, SNTP, and HTTP headers can be used as means for adjusting the time of all connected message collection and analysis devices to the same time. Further, Ethernet (registered trademark), USB, other serial communication, Bluetooth (registered trademark), ZigBee, wireless LAN, or the like can be used as means for communicating with other electronic message collection and analysis devices.

  Even if there are three or more message collection / analysis devices, one of them may be operated in the master mode and the other may be operated in the slave mode. Whether the mode is the master mode or the slave mode is held in the storage unit 12 and can be set or switched during operation.

  The message collection and analysis apparatus according to the above embodiment can be applied to a system that covers a wide area including a large number of networks.

  If the operator operates the operation input means 18 of the message collection / analysis device operating in the slave mode to instruct the start / end of message collection, the device operates in the master mode from the message collection / analysis device. A message collection start notification and a collection end notification may be transmitted to other message collection and analysis devices including Even in this case, a cooperative operation between the apparatuses is possible. In this case, the message collection / analysis device operated by the operator may be switched from the slave mode to the master mode.

  When the message collection and analysis device 1 according to each of the above embodiments manages an identifier for identifying a message collection point of each message collection and analysis device and a mode in which each identified message collection and analysis device operates, In addition, it is easy to analyze messages. The identifier is preferably managed using an IP address and a port number when connected by Ethernet (registered trademark) or wireless LAN. Further, when the identifier is connected by USB, serial, or ZigBee, it is desirable that the identifier be managed using a port number. The identifier and operation mode managed in this way are set by the operator and stored in the storage means 12 as setting information. The stored setting information is distributed to the other message collection / analysis device. Thereby, each message collection and analysis device can recognize at which collection point other message collection and analysis devices collect messages.

  Further, information regarding the transmission destination of the collected data may be stored in the setting information storage unit 12s. In this case, at the end of the collection, the collection system management unit 21 may acquire information on the transmission destination and transmit the aggregated data to the transmission destination via the communication unit 20.

  Further, the operator may collect the aggregated data directly using the storage medium without transmitting / receiving the aggregated data between the message collection / analysis devices. In such a case, for example, a USB memory, a memory card, an HDD, or an FDD is used as a storage medium, which facilitates the collection operation.

  The present invention can efficiently analyze a system composed of a plurality of networks regardless of the number, complexity, and protocol of the networks.

  So far, the case where the message collection analysis devices 1, 1a, 1b are applied to the building equipment system network 100 has been described. However, the present invention is not limited to this, and the message collection analysis devices 1, 1a, 1b are, for example, The present invention may be applied to other networks such as home appliance networks, FA networks, office equipment networks such as PCs, and the Internet.

  In each of the above embodiments, the program to be executed is computer-readable such as a flexible disk, a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), and an MO (Magneto-Optical Disk). A system that executes the above-described processing may be configured by storing and distributing the program in a recording medium and installing the program.

  Further, the program may be stored in a disk device or the like of a predetermined server device on a communication network such as the Internet, and may be downloaded, for example, superimposed on a carrier wave.

  In addition, when the above functions are realized by sharing an OS (Operating System), or when the functions are realized by cooperation between the OS and an application, only the part other than the OS may be stored in a medium and distributed. You may also download it.

  In addition, this invention is not limited by the said embodiment and drawing. It goes without saying that the embodiments and the drawings can be modified without changing the gist of the present invention.

DESCRIPTION OF SYMBOLS 1, 1a, 1b Message collection analysis device 2 Equipment management network 3 Equipment network 4 Building management system 5 Equipment 6 Gateway apparatus 11 Message receiving means 11a First message receiving means 11b Second message receiving means 12 Storage means 12a First 1 storage means 12b second storage means 12m aggregated data storage means 12s setting information storage means 13 collection control management means 14 collected data aggregation means 15 display information generation means 16 upper network connection port 17 lower network connection port 18 operation input means 19 Display means 20 Communication means 21 Collection system management means 100 Building equipment system network

Claims (13)

A system network message collection and analysis device composed of a plurality of networks,
Message receiving means for individually receiving messages transmitted through each of the plurality of networks;
Message storage means for adding time information to the messages transmitted through each network and storing them separately;
Collected data aggregating means for generating aggregated data by aggregating the messages of each network separately stored in the message storage means across the plurality of networks based on a predetermined aggregation condition;
A message collection and analysis device. The message receiving means
Receiving a message transmitted through each of the plurality of networks via a connection port connected to each of the plurality of networks;
The message collection and analysis apparatus according to claim 1, wherein Further comprising a collection control management means for individually controlling the timing of starting and ending the collection of messages of each network in the message reception means;
The message collection / analysis apparatus according to claim 1 or 2, The collection control management means includes
The timing of the start of message collection for each network,
When there is an operation input, it is at least one of the predetermined times,
The timing of the start of message collection for each network,
When there is an operation input, at least one of when a predetermined time comes and when a predetermined time has elapsed since the start of collection,
The message collection / analysis apparatus according to claim 3. A display unit that selectively displays at least one of a message received by the message reception unit, a message stored in the message storage unit, and aggregated data generated by the collected data aggregation unit;
The message collection and analysis apparatus according to claim 1, wherein A communication means for communicating with other electronic message collection and analysis devices;
Collecting system management means for communicating with the other electronic message collection and analysis device via the communication means, and for synchronizing the time with the other electronic message analysis device,
With
The collection system management means includes
When the master mode in which start instructions and end instructions are transmitted to all message collection analysis apparatuses or when the start instruction and end instructions transmitted from the other message analysis apparatuses are received, the start and end of message collection are started. Works in one of the slave modes to do,
The message collection and analysis device according to claim 1, wherein When operating in the slave mode, the collection system management means transmits aggregated data to the other message collection and analysis device operating in the master mode,
When operating in the master mode, the collection system management means collects aggregated data from the other message collection and analysis device operating in the slave mode, and re-aggregates.
The message collection and analysis device according to claim 6. The master mode and the slave mode can be switched.
The message collection and analysis apparatus according to claim 6 or 7, The collection system management means includes
Managing an identifier for identifying a message collection point of the other message collection and analysis apparatus and an operation mode;
The message collection and analysis device according to claim 6, wherein the message collection and analysis device is characterized in that The storage means includes
Holds information about the destination to which the aggregated data is sent,
The collection system management means includes
Transmitting the aggregated data based on information about the destination;
The message collection and analysis apparatus according to claim 6, wherein The telegram and the aggregated data can be stored in a removable storage medium.
The electronic message collection and analysis apparatus according to claim 1, wherein A telegram collection and analysis method for a building equipment system network composed of a plurality of networks,
A telegram receiving process in which the telegram collection and analysis device individually receives a telegram transmitted through each of the plurality of networks;
A message storing and analyzing step, in which the message collection and analysis device stores time information separately for messages transmitted through the networks, and
Collected data aggregation in which a telegram collection and analysis device generates aggregated data by aggregating the telegrams of each network separately stored in the telegram storage step across the plurality of networks based on a predetermined aggregation condition Process,
A message collection and analysis method including A computer that collects and analyzes messages in a system network composed of multiple networks.
Message receiving means for individually receiving messages transmitted through each of the plurality of networks;
A message storage means for storing time information separately for messages transmitted through the networks,
Collected data aggregating means for generating aggregated data by aggregating the messages of each network separately stored in the message storage means across the plurality of networks based on a predetermined aggregation condition;
Program to function as.

Images