JP7314620B2 - Control system, control device and control program - Google Patents

Description

TECHNICAL FIELD The present invention relates to a control system capable of detecting any abnormality that may occur in a monitored object, a control device that constitutes the control system, and a control program for the control system.

At various production sites, there is a need to improve facility operating rates through predictive maintenance of machines and equipment. Predictive maintenance refers to a form of maintenance that detects an abnormality that occurs in a machine or device and performs maintenance work such as maintenance and replacement before the equipment becomes unusable unless the equipment is stopped.

In order to realize predictive maintenance, it is necessary to collect the state values of machines and devices, and to determine whether or not there is an abnormality in the machines or devices based on the collected state values. For example, Japanese Patent Laying-Open No. 2018-097662 (Patent Document 1) discloses a technique capable of monitoring a phenomenon occurring in a controlled object in a shorter cycle.

JP 2018-097662 A

A control target has a large amount of information, and experience and expertise are required to set what kind of information should be used to detect anomalies. In order to introduce and operate anomaly detection in various production sites, it is necessary to have a mechanism that can easily utilize such experience and expertise.

One object of the present invention is to provide a mechanism for facilitating the introduction and operation of anomaly detection.

According to one example of the invention, a control system is provided for controlling a controlled object. The control system includes a controller and an analysis setter connectable to the controller. The control device includes abnormality detection means for determining whether or not an abnormality has occurred in a monitored object included in the controlled object based on one or more status values collected from the controlled object, and collection means for collecting one or more condition values from the controlled object according to a specification from the analysis setting device. The analysis setting device includes analysis means for acquiring and analyzing one or more state values collected by the control device, and setting means for setting the operation of the abnormality detection means of the control device based on the analysis result of the analysis means.

According to this configuration, even if the user of the control device does not have experience or specialized knowledge, it is possible to appropriately set the operation of the abnormality detection process and operate the abnormality detection process according to the request.

The control device may be configured to execute a user program for controlling the controlled object. The operation of the anomaly detection means and the collection means may be changed according to settings defined in the user program. According to this configuration, the user of the control device can arbitrarily control the behavior of the abnormality detection means and the collection means by changing the user program.

The collection means may collect one or more status values when the settings defined in the user program are predetermined values. According to this configuration, data collection can be limited to a specific period by controlling the internal use of the user program, so that the security level can be ensured.

The user program may include instruction blocks corresponding to the anomaly detection means. The command block may contain as input settings defined in the user program. According to this configuration, the user of the control device only needs to write a specific instruction block without writing a plurality of instructions in the user program, so that the amount of work can be reduced.

The settings related to the operation of the abnormality detection means of the control device may include designation of state values to be collected, designation of feature amounts calculated from the collected state values, and determination conditions for determining whether or not there is an abnormality. According to this configuration, the behavior of the abnormality detection process executed by the control device can be controlled in detail.

The anomaly detection means may make the data collected in the process of determining whether or not any anomaly has occurred in the monitored object included in the controlled object available for external access. According to this configuration, based on the data obtained during the operation of the abnormality detection process, it is possible to easily review the abnormality detection process during operation.

The control device may disclose only information explicitly permitted by the user among the one or more state values collected by the collecting means so as to be externally accessible. According to this configuration, it is possible to arbitrarily restrict disclosure of information that may include trade secrets, know-how, and the like.

The publicly accessible information may include the result of filtering the time-series data of one or more state values collected by the collecting means. According to this configuration, even if information that is not preferable to be disclosed to the outside as it is is included, anomaly detection processing can be appropriately set.

According to another example of the present invention, a control device is provided for controlling a controlled object. The control device includes abnormality detection means for determining whether or not an abnormality has occurred in a monitored object included in the controlled object based on one or more status values collected from the controlled object, and collection means for collecting one or more condition values from the controlled object in accordance with a designation from an external device. The anomaly detection means receives settings determined based on the results of analysis by the external device of one or more state values collected by the collection means, and operates according to the settings.

According to this configuration, even if the user of the control device does not have experience or specialized knowledge, it is possible to appropriately set the operation of the abnormality detection process and operate the abnormality detection process according to the request.

According to still another example of the present invention, there is provided a control program executed by a control device for controlling a controlled object. The control program causes the control device to determine, based on one or more state values collected from the controlled object, whether or not any abnormality has occurred in a monitored object included in the controlled object, and to collect one or more state values from the controlled object in accordance with a designation from an external device. The determining step includes receiving settings determined based on the result of the external device analyzing the collected one or more state values, and operating according to the settings.

According to this configuration, even if the user of the control device does not have experience or specialized knowledge, it is possible to appropriately set the operation of the abnormality detection process and operate the abnormality detection process according to the request.

According to the present invention, it is possible to provide a mechanism for facilitating the introduction and operation of anomaly detection.

1 is a schematic diagram showing an example of the overall configuration of an anomaly detection system according to an embodiment; FIG. FIG. 2 is a block diagram showing an example hardware configuration of a control device that configures the anomaly detection system according to the present embodiment; FIG. FIG. 2 is a block diagram showing a hardware configuration example of an analysis setting device that configures the anomaly detection system according to the present embodiment; FIG. 2 is a block diagram showing a hardware configuration example of a support device that configures the anomaly detection system according to the present embodiment; FIG. FIG. 2 is a block diagram showing a configuration example for realizing anomaly detection processing executed by the anomaly detection system according to the present embodiment; FIG. FIG. 4 is a diagram for explaining processing in a data collection phase in the anomaly detection system according to the present embodiment; FIG. 4 is a diagram for explaining processing in a data analysis phase in the anomaly detection system according to the present embodiment; FIG. 4 is a diagram for explaining processing in a data utilization phase in the anomaly detection system according to the present embodiment; FIG. 3 is a diagram showing an example of anomaly detection function blocks that can be written in a user program executed by the anomaly detection system according to the present embodiment; FIG. 4 is a sequence diagram showing an example of processing procedures in the anomaly detection system according to the present embodiment; FIG. 2 is a diagram for explaining an example of an information management function provided by the anomaly detection system according to the present embodiment; FIG. FIG. 4 is a diagram for explaining an example of a filter level automatic selection function provided by the anomaly detection system according to the present embodiment;

Embodiments of the present invention will be described in detail with reference to the drawings. The same or corresponding parts in the drawings are given the same reference numerals, and the description thereof will not be repeated.

<A. Application example>
First, an example of a scene to which the present invention is applied will be described.

A functional configuration example of a control system capable of executing abnormality detection processing according to the present embodiment will be described. In the following description, the control system as a whole is also called an "abnormality detection system" because the abnormality detection processing of the control system is mainly focused on.

First, an overall configuration example of an anomaly detection system 1 according to the present embodiment will be described.
FIG. 1 is a schematic diagram showing an overall configuration example of an anomaly detection system 1 according to the present embodiment. Referring to FIG. 1, abnormality detection system 1 can control a controlled object, and includes control device 100 as a main component.

The control device 100 executes control calculations for controlling a controlled object, and also executes anomaly detection processing for detecting any anomaly that may occur in a monitored object included in the controlled object. The control device 100 may be embodied as a kind of computer such as a PLC (programmable controller).

The control device 100 is connected to the field device group 10 via the first field bus 2 and connected to one or more display devices 400 via the second field bus 4 . Furthermore, the control device 100 can be connected to external devices such as the analysis setting device 200 via the local network 6 and the Internet 8 . Also, the support device 300 may be directly connected to the control device 100 . The control device 100 exchanges data with connected devices via each network. Note that the display device 400 is an optional configuration.

As the first field bus 2 and the second field bus 4, it is preferable to adopt a network that performs fixed-period communication, in which the arrival time of data is guaranteed. EtherCAT (registered trademark) or the like is known as a network that performs such periodic communication.

The control device 100 collects data (hereinafter also referred to as “input values”) acquired by the field device group 10 and transferred to the control device 100 . The control device 100 executes control calculation and abnormality detection processing based on the collected input values and the like.

The field device group 10 includes devices that collect state values of controlled objects or control-related manufacturing devices, production lines, etc. (hereinafter also collectively referred to as “fields”) as input values.

In this specification, the term "state value" is a term that includes values that can be observed by any controlled object (including: monitored object). For example, it can include physical values that can be measured by any sensor, ON/OFF states of relays, switches, etc., command values such as position, speed, and torque that the PLC gives to the servo driver, and variable values that the PLC uses for calculations.

An input relay, various sensors, and the like are assumed as a device for collecting such state values. Field device group 10 further includes a device that gives some effect to the field based on command values (hereinafter also referred to as “output values”) generated by control device 100 . Output relays, contactors, servo drivers and servo motors, and any other actuators are contemplated as devices that exert some action on such fields. These field device groups 10 exchange data including input values and output values with the control device 100 via the first field bus 2 .

In the configuration example shown in FIG. 1 , the field device group 10 includes a remote I/O (Input/Output) device 12 , a relay group 14 , an image sensor 18 and camera 20 , a servo driver 22 and a servo motor 24 .

The remote I/O device 12 includes a communication unit that communicates via the first fieldbus 2, and an input/output unit (hereinafter also referred to as "I/O unit") for collecting input values and outputting output values. Input and output values are exchanged between the control device 100 and the field via such an I/O unit. FIG. 1 shows an example in which digital signals are exchanged as input values and output values via the relay group 14 .

The I/O units may be directly connected to the fieldbus. FIG. 1 shows an example in which an I/O unit 16 is directly connected to the first field bus 2. As shown in FIG.

The image sensor 18 performs image measurement processing such as pattern matching on image data captured by the camera 20 and transmits the processing result to the control device 100 .

The servo driver 22 drives the servo motor 24 according to an output value (for example, a position command, etc.) from the control device 100 .

With respect to the abnormality detection process according to the present embodiment, control device 100 includes an abnormality detection engine 130 in charge of the abnormality detection process, and an internal database (hereinafter also referred to as "internal DB") 140 for storing various data related to the abnormality detection process. The anomaly detection engine 130 determines whether any anomaly has occurred in a monitored object included in the controlled object, based on one or more status values collected from the controlled object.

The analysis setting device 200 is basically assumed to be placed at a place different from the place where the anomaly detection system 1 is placed. The analysis setting device 200 is used to collect analysis data from the control device 100 and perform settings related to abnormality detection processing in the control device 100 based on the collected analysis data.

The support device 300 assists in the necessary preparations for control calculations performed by the control device 100 . Specifically, the support device 300 provides a development environment (program creation editing tool, parser, compiler, etc.) for a user program executed by the control device 100, a function for determining setting parameters (configurations) for the control device 100 and various devices connected to the control device 100, a function for transmitting the generated user program to the control device 100, a function for online correction/change of the user program executed on the control device 100, and the like.

The display device 400 is connected to the control device 100 via the second field bus 4, receives an operation from the user, transmits commands and the like according to the user operation to the control device 100, and graphically displays processing results and the like in the control device 100.

An example of functions provided by an anomaly detection system 1 according to the present embodiment will be outlined with reference to FIG.

The control device 100 executes control calculations for controlling the controlled object, and also executes abnormality detection processing for determining whether or not an abnormality has occurred in a monitored object included in the controlled object ((1) control calculation and (2) abnormality detection). The control device 100 stores various information (analysis data) related to the abnormality detection process.

The analysis setting device 200 collects data for analysis stored in the control device 100 ((3) data for analysis), and performs various analyzes based on the collected data for analysis ((4) analysis). Typically, the analysis setting device 200 is assumed to be operated by experts with experience and expertise. The analysis setting device 200 determines the contents of settings related to the abnormality detection processing of the control device 100 based on the results of various analyses. Then, the analysis setting device 200 transmits the determined setting to the control device 100 ((5) setting). It should be noted that the abnormality detection process may not be executed in the control device 100 at the initial stage.

By repeating such a processing cycle, it is possible to implement anomaly detection processing suitable for the request and purpose in the control device 100 .

<B. Hardware configuration example of each device>
Next, a hardware configuration example of main devices that constitute the abnormality detection system 1 according to the present embodiment will be described.

(b1: Hardware configuration example of control device 100)
FIG. 2 is a block diagram showing a hardware configuration example of control device 100 that configures anomaly detection system 1 according to the present embodiment. Referring to FIG. 2, control device 100 includes processor 102 such as a CPU (Central Processing Unit) or MPU (Micro-Processing Unit), chipset 104, main storage device 106, secondary storage device 108, local network controller 110, USB (Universal Serial Bus) controller 112, memory card interface 114, internal bus controller 122, fieldbus controllers 118 and 120, and I/O unit 124-1. , 124-2, .

The processor 102 reads various programs stored in the secondary storage device 108, develops them in the main storage device 106, and executes them, thereby realizing control according to the control target and various processes described later. The chipset 104 implements the processing of the control device 100 as a whole by controlling each component together with the processor 102 .

The secondary storage device 108 stores a system program 126 (corresponding to a control program) for realizing functions provided by the control device 100, as well as a user program that is executed using the execution environment provided by the system program 126. The system program 126 also stores programs for implementing the anomaly detection engine 130 and the internal DB 140 .

Local network controller 110 controls data exchange with other devices via local network 6 . The USB controller 112 controls data exchange with the support device 300 via a USB connection.

The memory card interface 114 is configured such that a memory card 116 can be attached/detached, and data can be written to the memory card 116, and various data (user program, trace data, etc.) can be read from the memory card 116.

The internal bus controller 122 is an interface that exchanges data with the I/O units 124-1, 124-2, .

The fieldbus controller 118 controls data exchange with other devices via the first fieldbus 2 . Similarly, the fieldbus controller 120 controls data exchange with other devices via the second fieldbus 4 .

FIG. 2 shows a configuration example in which the necessary functions are provided by the processor 102 executing a program, but some or all of these provided functions may be implemented using a dedicated hardware circuit (e.g., ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array), etc.). Alternatively, the main part of the control device 100 may be implemented using hardware conforming to a general-purpose architecture (for example, an industrial personal computer based on a general-purpose personal computer). In this case, a plurality of OSs (Operating Systems) for different purposes may be executed in parallel using virtualization technology, and necessary applications may be executed on each OS.

(b2: Hardware configuration example of analysis setting device 200)
Analysis setting device 200 according to the present embodiment is realized, for example, by executing a program using hardware conforming to a general-purpose architecture (for example, a general-purpose personal computer).

FIG. 3 is a block diagram showing a hardware configuration example of analysis setting device 200 that configures anomaly detection system 1 according to the present embodiment. 3, analysis setting device 200 includes a processor 202 such as a CPU or MPU, a drive 204, a main storage device 206, a secondary storage device 208, a USB controller 212, a local network controller 214, an input section 216, and a display section 218. These components are connected via bus 220 .

The processor 202 reads out various programs stored in the secondary storage device 208, develops them in the main storage device 206, and executes them, thereby realizing various processes to be described later.

The secondary storage device 208 is composed of, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The secondary storage device 208 typically stores various programs including a data mining tool 250 and a setting tool 260 . The secondary storage device 208 may further store an OS and other necessary programs.

The drive 204 can write data to the storage medium 205 and read various data (user program, trace data, time-series data, etc.) from the storage medium 205 . The storage medium 205 includes, for example, a storage medium 205 (for example, an optical storage medium such as a DVD (Digital Versatile Disc)) that stores a computer-readable program non-transitory. Programs or data stored therein are read from the storage medium 205 and installed in an internal storage area such as the secondary storage device 208 .

Various programs to be executed by the analysis setting device 200 may be installed via the computer-readable storage medium 205, or may be installed by being downloaded from a server device or the like on the network. Also, the functions provided by the analysis setting device 200 according to the present embodiment may be realized by using some of the modules provided by the OS.

The USB controller 212 controls data exchange with other devices. Local network controller 214 controls the exchange of data with other devices over any network.

An input unit 216 is configured with a keyboard, a mouse, and the like, and receives user operations. A display unit 218 includes a display, various indicators, and the like, and outputs processing results from the processor 202 and the like. A printer may be connected to the analysis setting device 200 .

FIG. 3 shows a configuration example in which the necessary functions are provided by the processor 202 executing a program, but some or all of these provided functions may be implemented using a dedicated hardware circuit (eg, ASIC, FPGA, etc.).

(b3: Hardware configuration example of support device 300)
Support device 300 according to the present embodiment is implemented, for example, by executing a program using hardware conforming to a general-purpose architecture (for example, a general-purpose personal computer).

FIG. 4 is a block diagram showing a hardware configuration example of support device 300 that configures anomaly detection system 1 according to the present embodiment. Referring to FIG. 4 , support device 300 has the same hardware configuration as analysis setting device 200 .

More specifically, the support device 300 includes a processor 302 such as a CPU or MPU, a drive 304, a main storage device 306, a secondary storage device 308, a USB controller 312, a local network controller 314, an input section 316, and a display section 318. These components are connected via bus 320 .

The processor 302 reads out various programs stored in the secondary storage device 308, develops them in the main storage device 306, and executes them, thereby realizing various processes to be described later.

The secondary storage device 308 is composed of, for example, an HDD or an SSD. The secondary storage device 308 typically stores a development tool 350 (not shown) for creating a user program to be executed in the control device 100, debugging the created program, defining the system configuration, setting various parameters, and the like. The secondary storage device 308 may store an OS and other necessary programs.

The drive 304 can write data to the storage medium 305 and read various data (user program, trace data, time-series data, etc.) from the storage medium 305 . The storage medium 305 includes, for example, a storage medium 305 (for example, an optical storage medium such as a DVD) that non-transitory stores a computer-readable program. Programs or data stored therein are read from the storage medium 305 and installed in an internal storage area such as the secondary storage device 308 .

Various programs executed by the support device 300 may be installed via the computer-readable storage medium 305, or may be installed by being downloaded from a server device or the like on the network. Also, the functions provided by support device 300 according to the present embodiment may be realized by using some of the modules provided by the OS.

The USB controller 312 controls data exchange with the control device 100 via a USB connection. Local network controller 314 controls the exchange of data with other devices over any network.

An input unit 316 is configured with a keyboard, a mouse, and the like, and receives user operations. A display unit 318 includes a display, various indicators, and the like, and outputs processing results from the processor 302 and the like. A printer may be connected to the support device 300 .

FIG. 4 shows a configuration example in which the necessary functions are provided by the processor 302 executing the program, but some or all of these provided functions may be implemented using a dedicated hardware circuit (such as an ASIC or FPGA).

<C. Abnormality Detection Processing>
Next, anomaly detection processing executed by anomaly detection system 1 according to the present embodiment will be described.

FIG. 5 is a block diagram showing a configuration example for realizing anomaly detection processing executed by anomaly detection system 1 according to the present embodiment. Referring to FIG. 5, control device 100 includes a variable management unit 160, a feature extraction unit 142, a machine learning processing unit 144, and a result determination unit 146 as components related to abnormality detection processing.

The variable management unit 160 collects state values (input values) that appear in the controlled object at each predetermined control cycle, and updates the values of the device variables 162, which are internal state values. It should be noted that the present invention is not limited to the mode of referring to values using "variables", but can also be applied to the mode of directly referencing the physical addresses of the memory storing each value.

The feature extraction unit 142 calculates one or more feature quantities 150 from one or more state values (input values) corresponding to the monitored object. More specifically, the feature extraction unit 142 calculates one or more feature values 150 (e.g., average value, maximum value, minimum value, variance, etc. over frames) periodically or for each event according to a predetermined calculation procedure, based on values (or temporal changes in values in unit intervals) indicated by one or more designated device variables 162 (state values) according to preset setting information 158. In this way, the setting information 158 includes specification of state values to be collected and specification of feature values to be calculated from the collected state values.

A unit interval used by the feature extraction unit 142 to calculate the feature amount 150 is also called a "frame". In this specification, a "frame" means a unit interval for determining whether or not any abnormality has occurred in the monitored object. That is, the determination as to whether or not any abnormality has occurred in the monitored object is made for each “frame”. In this embodiment, the "frame" may be determined based on a state value arbitrarily set by the user.

The machine learning processing unit 144 refers to the learning model 152 and calculates a score 154, which is a value indicating the possibility that some abnormality has occurred in the monitored object, based on one or a plurality of feature values 150 calculated by the feature extraction unit 142.

As an example, the machine learning processing unit 144 may employ a method of calculating a score corresponding to an input value based on the degree of deviation of the input value from a value group in hyperspace as an algorithm for detecting anomalies. Known methods of anomaly detection based on the degree of deviation include a method of detecting an anomaly based on the shortest distance from each point to a value group (k-nearest neighbor method), a local outlier factor (LoF) method that evaluates distances including clusters containing value groups, and an iForest (isolation forest) method that uses a score calculated from a path length.

In the case where the learning model 152 is composed of the feature values of the normal state, it can be determined that the higher the degree of deviation from the learning model 152 (that is, the score), the higher the possibility that some abnormality has occurred in the monitored object. On the other hand, in the case where the learning model 152 is composed of the feature values at the time of abnormality, it can be determined that the smaller the degree of deviation from the learning model 152 (that is, the score), the higher the possibility that some kind of abnormality has occurred in the monitored object. The learning model 152 can be determined by a known data mining technique.

Based on the score 154 calculated by the machine learning processing unit 144, the result determination unit 146 generates a determination result 170 indicating whether or not any abnormality has occurred in the monitored object. The determination condition 156 includes a condition for determining whether or not there is an abnormality, and may be set in advance by the support device 300 . Typically, the judgment condition 156 includes a threshold or threshold range set for the score 154 indicating that there is a high possibility that some abnormality has occurred in the monitored object. The determination result 170 may be either "OK", which indicates that no abnormality has occurred in the monitored object, or "NG", which indicates that some abnormality has occurred in the monitored object.

By adopting the configuration as described above, it is possible to detect the occurrence of an abnormality that can occur in any monitoring target included in the control target. Note that the feature extraction unit 142, the machine learning processing unit 144, and the result determination unit 146 may be made into a library. In this case, by setting the setting information 158, the learning model 152, and the determination condition 156 in the library, even a user with little expertise can easily implement the anomaly detection process.

<D. Processing Related to Abnormality Detection Processing>
The anomaly detection process according to this embodiment has three phases: a data collection phase, a data analysis phase, and a data utilization phase. Each phase will be described below.

(d1: data collection phase)
The data collection phase is a phase for collecting data for performing various settings related to anomaly detection processing. Data collection itself is performed by the control device 100 , but various settings related to data collection and use of the collected data are performed by the analysis setting device 200 .

FIG. 6 is a diagram for explaining processing in the data collection phase in anomaly detection system 1 according to the present embodiment. Referring to FIG. 6, the user (expert with experience and specialized knowledge) uses the setting tool 260 of the analysis setting device 200 to create a variable definition 190 and a collection variable specification 192 directed to the control device 100 to be set and send it to the control device 100 to be set.

The variable definition 190 includes definitions such as variable names for referring to state values or input values that can be collected by the control device 100 . The collection variable designation 192 includes designation of state values or input values to be collected by the control device 100 in the data collection phase. In the collection variable specification 192, the state value or input value to be collected may be specified using the variable name defined in the variable definition 190 or the like.

The control device 100 includes an anomaly detection engine 130 for realizing anomaly detection processing. The anomaly detection engine 130 is implemented as a process, and a user program 132 including an anomaly detection function block 134 (hereinafter sometimes referred to as "anomaly detection FB") is cyclically executed at each predetermined control cycle. The anomaly detection function block 134 is an instruction block corresponding to an anomaly detection process. Thus, the control device 100 executes the user program 132 for controlling the controlled object. A specific example of the abnormality detection function block 134 will be described later.

By executing the abnormality detection function block 134, abnormality detection processing as shown in FIG. 5 is executed. Concurrently, a data sampling 136 procedure is executed. Data sampling 136 collects one or more state values from the controlled object according to the specification from analysis setting device 200 (collection variable specification 192). The data sampling 136 procedure is typically enabled in the user program 132 by specifying certain parameters to the anomaly detection function block 134 .

The internal DB 140 can store raw data 180 , filter data 182 and score data 184 . Raw data 180, filter data 182, and score data 184 are all time-series data. The raw data 180 is data in which collected state values or input values are arranged in chronological order. The filter data 182 is data obtained by arranging the results of filtering the raw data 180 in chronological order according to the settings described later. The score data 184 is data in which the scores calculated by the anomaly detection process are arranged in time series. In the collection phase, it is assumed that the anomaly detection process is not enabled, so score data 184 is often not generated.

In addition, in the anomaly detection process according to the present embodiment, one or more scores can be calculated for each “frame” that is a unit section. Information for defining such frames may be included in the collection variable specification 192 . Specifically, one or more variable names that define the frame and a condition for each variable (eg, either TRUE or FALSE) may be specified in collection variable specification 192 . Also, a condition for defining "subframes" obtained by subdividing a frame may be included. Furthermore, an "event" may be specified as a condition for executing the anomaly detection process. In this case, the definition of “event” may be included in the collection variable specification 192 . Frames, subframes, occurrence and termination of events, etc., as described above, may be determined according to instructions contained in the user program 132 .

The data sampling 136 procedure requests the data storage service 148 included in the internal DB 140 to store the data (state values or input values) collected according to the collection variable specification 192 . Data storage service 148 responds to requests from data sampling 136 to store analysis data 186 , which is data in which values collected according to collection variable specification 192 are arranged in time series.

Further, the data storage service 148 generates all or part of the stored analysis data 186 as analysis data 188 that can be referenced from an external device such as the analysis setting device 200 . An external device such as the analysis setting device 200 can access the analysis data 188 via the data transmission service 138 of the control device 100 .

In the configuration example shown in FIG. 6 , when the data collection service 270 of the analysis setting device 200 accesses the control device 100 , the data transmission service 138 of the control device 100 outputs (exports) the analysis data 188 to the analysis setting device 200 .

The analysis setting device 200 analyzes the analysis data 188 collected by the data collection service 270 using an arbitrary analysis application 280 . The analysis application 280 may be an application dedicated to analysis or any spreadsheet application.

The user (expert with experience and expertise) may recreate or update the variable definition 190 and the collection variable specification 192 by trial and error while referring to the analysis results obtained using the analysis application 280.

Through the data collection phase as shown in FIG. 6, it is possible to find the optimum settings related to the abnormality detection process executed in the control device 100 to be set. In addition, the user of the control device 100 (maintenance personnel of the control device 100 or an operator of the facility including the control device 100) can disclose only the data necessary for finding the optimum setting of the abnormality detection process while limiting disclosure of important information such as know-how as much as possible.

(d2: data analysis phase)
The data analysis phase is a phase in which the data collected in the data collection phase are analyzed to find optimal settings for the anomaly detection process.

FIG. 7 is a diagram for explaining processing in the data analysis phase in anomaly detection system 1 according to the present embodiment. Referring to FIG. 7, the user (expert with experience and expertise) uses the data mining tool 250 of the analysis setting device 200 to analyze the analysis data 188 (including one or more state values) collected by the control device 100 to be set and generate anomaly detection settings 252.

The data mining tool 250 assists in determining the types of state values and features (mean, maximum, minimum, variance, etc.) suitable for anomaly detection processing.

The anomaly detection settings 252 include learned data, feature parameters, and score parameters. The learned data is data for configuring the learning model 152, and includes feature amounts calculated from raw data or the like collected during normal or abnormal conditions. A feature amount parameter is a parameter that defines a feature amount to be calculated. The score parameter is a parameter that defines a method of calculating the score 154 (a value indicating the possibility that some kind of abnormality has occurred in the monitored object).

The setting tool 260 sets the operation of the anomaly detection engine 130 of the control device 100 based on the analysis result by the data mining tool 250 which is the analysis means. More specifically, the setting tool 260 generates settings (learning model 152 , determination conditions 156 , setting information 158 ) to be given to the control device 100 to be set based on the anomaly detection settings 252 generated by the data mining tool 250 . This setting relates to the operation of the abnormality detection engine 130 of the control device 100 .

The setting tool 260 also functions as an interface with the control device 100 and can transmit the generated settings to the control device 100 . Then, the abnormality detection engine 130 of the control device 100 receives settings determined based on the analysis result of the analysis data 188 by the analysis setting device 200, and operates according to the settings.

(d3: data utilization phase)
The data utilization phase is a phase in which data obtained during operation of the abnormality detection process in the control device 100 is utilized.

FIG. 8 is a diagram for explaining processing in the data utilization phase in anomaly detection system 1 according to the present embodiment. Referring to FIG. 8, in abnormality detection engine 130 of control device 100, feature quantity calculation processing 133 for calculating a feature quantity and score calculation processing 135 for calculating a score are cyclically executed in each control cycle. At the same time, data sampling 136 for collecting state values or input values and data writing processing 137 for writing the collected state values or input values to internal DB 140 are also cyclically executed. These processes are executed according to the values of system defined variables 128 .

Data sampling 136 produces respective raw data for each cycle (control period). A feature amount is generated for each frame by the feature amount calculation processing 133 . A score is generated for each frame by the score calculation process 135 .

The data storage service 148 receives the raw data from the data sampling 136, the feature amount from the feature amount calculation process 133, and the score from the score calculation process 135, and generates raw data 180, filter data 182, score data 184, and analysis data 186.

The internal DB 140 publishes all or part of the filter data 182, the score data 184, and the analysis data 186 so as to be externally accessible. The disclosure method may be selectable according to settings for the control device 100 . As a disclosure method, for example, Web access (http server), FTP access, storage media such as an SD card, and the like are assumed. By using these externally disclosed data, it is possible to examine the adequacy and review of the abnormality detection process operated in the control device 100 .

In this way, in the data utilization phase, the anomaly detection engine 130 publishes the data (filter data 182, score data 184, analysis data 186, etc.) collected in the process of determining whether or not any anomaly has occurred in the monitored objects included in the controlled objects so that they can be accessed externally.

<E. Function block example>
Next, an example of the abnormality detection function block 134 (see FIG. 6) capable of handling each phase as described above will be described.

FIG. 9 is a diagram showing an example of anomaly detection function block 134 that can be written in a user program executed by anomaly detection system 1 according to the present embodiment. An abnormality detection function block 134 shown in FIG. 9 is for detecting an abnormality that can occur in a device having a ball screw mechanism.

The anomaly detection function block 134 includes as inputs an axis designation 1340 , an enable flag 1342 , an axis designation output 1341 and an enable flag output 1343 . The axis designation 1340 designates a variable indicating the axis for which abnormality detection is to be performed, and the activation flag 1342 designates a variable indicating a flag for activating the abnormality detection process. The axis designation output 1341 outputs the information of the variable designated by the axis designation 1340 , and the activation flag output 1343 outputs the value of the flag designated by the activation flag 1342 .

The anomaly detection function block 134 includes remote monitor designation 1344, phase designation 1345, and output mode designation 1346 as inputs for realizing processing corresponding to each phase described above. That is, the anomaly detection function block 134 includes as input settings defined in the user program.

The remote monitor specification 1344 accepts a specification as to whether or not the mode change by the operation from the outside of the control device 100 is permitted. When TRUE is set in the remote monitor specification 1344, the phase specified in the phase specification 1345 can be changed by an external operation. On the other hand, when FALSE is set in the remote monitor specification 1344, external operation is prohibited.

From the viewpoint of security, a restriction may be set when changing the value set in the remote monitor designation 1344 to TRUE. Specifically, while the operation of changing the remote monitor designation 1344 from TRUE to FALSE can be performed without restriction, the operation of changing from FALSE to TRUE may be performed only by a user having predetermined authority. By providing such restrictions, it is possible to limit external operations to the control device 100 as much as possible, thereby increasing the security level.

The phase specification 1345 accepts the specification of the phase for the target abnormality detection process. Specifically, the phase designation 1345 designates one of the above-described data collection phase, data analysis phase, and data utilization phase. However, in the data analysis phase, the analysis setting device 200 executes the processing, so the control device 100 does not need to execute any special processing. In this way, the operations of the anomaly detection engine 130, the data sampling 136, etc. are changed according to the settings such as the phase designation 1345 defined in the user program. That is, data sampling 136 collects one or more state values when the setting of phase designation 1345 defined in the user program is a predetermined value (in this case, a value designating "data collection phase").

When the data collection phase is designated in the phase designation 1345, the control device 100 collects the time-series data of the designated variable according to the collection variable designation 192 transmitted from the analysis setting device 200, and generates the analysis data 188 (see FIG. 6).

On the other hand, when the data utilization phase is specified in the phase specification 1345, the control device 100 executes anomaly detection processing and releases all or part of the filter data 182, the score data 184, and the analysis data 186 for external access (see FIG. 8). The analysis data 186 includes feature amounts and scores calculated for each frame.

The output mode specification 1346 accepts specification of the output (disclosure) method of generated data. Specifically, any one of Web access (http server), FTP access, and SD card as described above is specified.

By including information specifying the abnormality detection function block 134 (for example, the function block name) in the file name or attribute information of the output data, it is possible to uniquely identify from which abnormality detection function block 134 the data is output.

Furthermore, a method of automatically transmitting data to a server prepared by the maker of the control device 100 or the maker of the device incorporating the control device 100 may be specified. For example, a method of sending data to a web server prepared by the manufacturer (http client), a method of sending data to an FTP server prepared by the manufacturer (ftp client), a method of sending data by e-mail, etc. are assumed. In this case, the data output (disclosure) destination may also be specifically specified.

Input settings of the abnormality detection function block 134 can be arbitrarily changed by the user of the control device 100 (maintenance personnel of the control device 100 or an operator of the facility including the control device 100 ) operating the support device 300 . Therefore, from the viewpoint of the user of the control device 100, it is possible to select only anomaly detection processing that requires setting and adjustment, transmit only necessary data to an external expert, and realize optimum anomaly detection processing while ensuring a security level.

Note that when the remote monitor specification 1344 is set to TRUE, the history of external operations may be stored in the control device 100 as a log.

<F. Processing procedure>
Next, a typical processing procedure in anomaly detection system 1 according to the present embodiment will be described.

FIG. 10 is a sequence diagram showing an example of processing procedures in anomaly detection system 1 according to the present embodiment. FIG. 10 shows a processing procedure consisting of three phases: a data collection phase, a data analysis phase, and a data utilization phase.

Referring to FIG. 10, as an initial procedure, a user of control device 100 (maintenance personnel of control device 100 or an operator of equipment including control device 100) operates support device 300 to create a user program (sequence SQ2). This user program includes an anomaly detection function block 134 . In sequence SQ2, the code of the abnormality detection function block 134 may be incorporated into an existing user program. Then, the user of control device 100 transmits the created user program to control device 100 (sequence SQ4).

Further, the user of the control device 100 operates the support device 300 (sequence SQ6), sets the remote monitor specification 1344 of the anomaly detection function block 134 included in the user program to "TRUE" (sequence SQ8), and sets the phase specification 1345 to "data collection phase" (sequence SQ10). This series of operations enables the control device 100 to be operated from outside.

On the other hand, the user of analysis setting device 200 (expert with experience and expertise) operates analysis setting device 200 to determine settings for data collection (variable definition 190 and collection variable specification 192) (sequence SQ12). Then, the determined variable definition 190 and collection variable designation 192 are sent to control device 100 (sequence SQ14). Then, in control device 100, collection of designated data is started (sequence SQ16).

The analysis setting device 200 acquires the analysis data collected by the control device 100 (sequence SQ18). The user of the analysis setting device 200 performs an analysis operation using the acquired analysis data (sequence SQ20). Settings determined by the analysis operation (setting information 158, learning model 152 and determination condition 156) are transmitted from analysis setting device 200 to control device 100 (sequence SQ22).

On the other hand, the user of the control device 100 operates the support device 300 (sequence SQ24) to set the phase specification 1345 of the abnormality detection function block 134 included in the user program to "data utilization phase" (sequence SQ26). By this series of operations, the control device 100 starts operation of the abnormality detection process.

Control device 100 executes anomaly detection processing according to the setting from analysis setting device 200 (sequence SQ28). Analysis data 186, filter data 182, and score data 184, which are generated along with execution of the abnormality detection process, can be transmitted to analysis setting device 200 (sequence SQ30). The user of the analysis setting device 200 considers whether or not the anomaly detection processing operated by the control device 100 is appropriate or reviewed as necessary.

Optimal settings for the abnormality detection process executed by the control device 100 can be determined by the procedure described above.

<G. Information management function>
Next, the anomaly detection system 1 according to this embodiment may have an information management function. The information management function is a function that can conceal part of the information collected by the control device 100 . As a specific process of the information management function, for example, among the collected raw data, only the raw data of a specific section may be disclosed (the section to be disclosed is limited). As another specific processing of the information management function, only filtered data 182 obtained by filtering collected raw data may be made public.

FIG. 11 is a diagram for explaining an example of an information management function provided by anomaly detection system 1 according to the present embodiment. User interface screen 360 shown in FIG. 11 is typically provided by support device 300 . For example, the user interface screen 360 may be displayed when the corresponding anomaly detection function block 134 is selected on the editor of the user program executed by the support device 300 .

Referring to FIG. 11, user interface screen 360 includes a temporal waveform 362 showing raw data collected. A start position 364 and an end position 366 of the extraction section can be set for the time waveform 362 . By operating the pointer 368, the user arranges the start position 364 and the end position 366 at arbitrary positions. Typically, a portion where some kind of abnormality occurs can be set as an extraction section. These operations determine the portion of the raw data to be extracted.

After setting the extraction section, the user of the control device 100 can operate the filter dialog 370 to select an arbitrary filter level (basically, a low-pass filter). Multiple filter levels may be selectable according to time granularity. It is also possible to output the raw data as it is without filtering.

The user of the control device 100 can operate the output destination dialog 372 to select an arbitrary output destination (disclosure destination). Then, when the output button 374 is selected, the data is output (published) to the selected output destination.

In this way, the control device 100 can disclose only information explicitly permitted by the user among one or more state values collected by data sampling so as to be externally accessible. The publicly accessible information may also include filtered data 182 that is the result of filtering time-series data of one or more state values collected by data sampling. This allows the user of the control device 100 to select and publish only the information necessary to implement the abnormality detection process.

Note that the filter level may be automatically determined according to the disclosure destination.
FIG. 12 is a diagram for explaining an example of a filter level automatic selection function provided by anomaly detection system 1 according to the present embodiment. Referring to FIG. 12, the filter level 380 defines that the filter level is changed according to the release destination. For example, when outputting information collected by the control device 100 to the manufacturer of the control device 100, filter data 182 obtained by applying a low-pass filter of "minute order" is output. On the other hand, for internal public use, raw data without filters will be output.

By varying the strength of the filter level according to the disclosure destination in this way, it is possible to secure a security level according to the disclosure destination of the information.

<H. Note>
The present embodiment as described above includes the following technical ideas.
[Configuration 1]
A control system (1) for controlling a controlled object,
a controller (100);
An analysis setting device (200) connectable to the control device,
The control device is
Abnormality detection means (130) for determining whether or not an abnormality has occurred in a monitored object included in the controlled object based on one or more state values collected from the controlled object;
collecting means (136) for collecting one or more state values from the controlled object according to the specification from the analysis setting device;
The analysis setting device is
analysis means (250) for obtaining and analyzing one or more state values collected by the controller;
and setting means (260) for setting the operation of the abnormality detection means of the control device based on the analysis result of the analysis means.
[Configuration 2]
The control device is configured to execute a user program (132) for controlling the controlled object,
The control system according to configuration 1, wherein the operation of the abnormality detection means and the collection means is changed according to settings defined in the user program.
[Configuration 3]
3. The control system according to configuration 2, wherein the collecting means collects the one or more state values when the setting defined in the user program is a predetermined value.
[Configuration 4]
The user program includes an instruction block (134) corresponding to the anomaly detection means,
4. The control system of configuration 3, wherein the instruction block includes as input settings (1344, 1345) defined in the user program.
[Configuration 5]
The control system according to any one of configurations 1 to 4, wherein the settings (152, 156, 158) related to the operation of the abnormality detection means of the control device include designation of a state value to be collected, designation of a feature amount calculated from the collected state value, and a determination condition for determining whether or not there is an abnormality.
[Configuration 6]
The control system according to any one of configurations 1 to 5, wherein the abnormality detection means publishes data (182, 184, 186) collected in the process of determining whether or not any abnormality has occurred in the monitored object included in the controlled object so as to be externally accessible.
[Configuration 7]
The control system according to any one of configurations 1 to 6, wherein the control device publishes only information explicitly permitted by the user among the one or more state values collected by the collecting means so as to be externally accessible.
[Configuration 8]
8. The control system of configuration 7, wherein the publicly accessible information includes results (182) of filtering time-series data of one or more state values collected by the collecting means.
[Configuration 9]
A control device (100) for controlling a controlled object,
Abnormality detection means (130) for determining whether or not an abnormality has occurred in a monitored object included in the controlled object based on one or more state values collected from the controlled object;
collecting means (136) for collecting one or more state values from the controlled object according to a designation from an external device;
The control device, wherein the abnormality detection means receives settings (152, 156, 158) determined based on a result of analysis by an external device of one or more state values collected by the collection means, and operates according to the settings.
[Configuration 10]
A control program (126) executed by a control device (100) for controlling a controlled object, the control program causing the control device to:
a step (SQ28) of determining whether or not any abnormality has occurred in a monitored object included in the controlled object, based on one or more status values collected from the controlled object;
executing a step (SQ16) of collecting one or more state values from the controlled object according to a designation from an external device;
The control program, wherein the determining step includes a step of receiving settings determined based on the results of analysis of the collected one or more status values by an external device and operating according to the settings (SQ22).

<I. Advantage>
In the anomaly detection system according to the present embodiment, even if the user of the control device does not have experience or expertise in anomaly detection processing, necessary data is transmitted to the analysis setting device, and an expert with experience and expertise can analyze the transmitted data and make appropriate settings for the control device. Therefore, necessary abnormality detection processing can be easily implemented according to the control device or the controlled object. Also, an expert with experience and specialized knowledge can analyze the data transmitted from the control device without going to the site where the control device is installed, so that work efficiency can be improved.

It should be considered that the embodiments disclosed this time are illustrative in all respects and not restrictive. The scope of the present invention is indicated by the scope of the claims rather than the above description, and is intended to include all modifications within the scope and meaning equivalent to the scope of the claims.

1 Anomaly detection system 2 First field bus 4 Second field bus 6 Local network 8 Internet 10 Field device group 12 Remote I/O device 14 Relay group 16, 124 I/O unit 18 Image sensor 20 Camera 22 Servo driver 24 Servo motor 100 Control device 102, 202, 302 Processor 104 Chipset 106, 206, 306 Main memory Device 108,208,308 Secondary storage device 110,214,314 Local network controller 112,212,312 USB controller 114 Memory card interface 116 Memory card 118,120 Fieldbus controller 122 Internal bus controller 126 System program 128 System definition variable 130 Anomaly detection engine 132 User program 133 Feature value calculation process 134 Anomaly detection function block, 135 score calculation processing, 136 data sampling, 137 data writing processing, 138 data transmission service, 140 internal DB, 142 feature extraction unit, 144 machine learning processing unit, 146 result determination unit, 148 data storage service, 150 feature amount, 152 learning model, 154 score, 156 determination condition, 158 setting information, 160 variable management unit, 162 device variable, 170 Judgment result 180 raw data 182 filter data 184 score data 186,188 analysis data 190 variable definition 192 collection variable specification 200 analysis setting device 204,304 drive 205,305 storage medium 216,316 input section 218,318 display section 220,320 bus 250 data mining tool 252 abnormality detection Setting, 260 Setting tool, 270 Data collection service, 280 Analysis application, 300 Support device, 350 Development tool, 360 User interface screen, 362 Time waveform, 364 Start position, 366 End position, 368 Pointer, 370 Filter dialog, 372 Output destination dialog, 374 Output button, 380 Filter level, 400 Display device, 1340 Axis designation, 1341 Axis designation output, 13 42 activation flag, 1343 activation flag output, 1344 remote monitor designation, 1345 phase designation, 1346 output mode designation.

Claims (9)

A control system for controlling a controlled object,
a control device configured to execute a user program for controlling the controlled object ;
an analysis setting device connectable to the control device ;
A support device connectable to the control device ,
The control device is
Abnormality detection means for determining whether or not an abnormality has occurred in a monitored object included in the controlled object based on one or more state values collected from the controlled object;
collecting means for collecting one or more state values from the controlled object according to the specification from the analysis setting device;
The analysis setting device is
analysis means for obtaining and analyzing one or more state values collected by the control device;
setting means for setting the operation of the abnormality detection means of the control device based on the analysis result by the analysis means ;
The operation of the anomaly detection means and the collection means is changed according to settings defined in the user program,
A control system , wherein the settings defined in the user program are changed by a user operation on the support device . 2. The control system according to claim 1 , wherein said collecting means collects said one or more state values when the setting defined in said user program is a predetermined value. The user program includes an instruction block corresponding to the anomaly detection means,
3. The control system of claim 2 , wherein the instruction block includes as input settings defined in the user program. The control system according to any one of claims 1 to 3 , wherein the settings related to the operation of the abnormality detection means of the control device include designation of a state value to be collected, designation of a feature amount calculated from the collected state value, and a judgment condition for judging whether or not there is an abnormality. The control system according to any one of claims 1 to 4 , wherein the abnormality detection means publishes data collected in a process of determining whether or not an abnormality has occurred in a monitored object included in the controlled object so as to be externally accessible. 6. The control system according to any one of claims 1 to 5 , wherein the control device publishes only information explicitly permitted by the user among the one or more state values collected by the collecting means so as to be externally accessible. 7. The control system according to claim 6 , wherein said publicly accessible information includes results of filtering time-series data of one or more state values collected by said collecting means. A control device for controlling a controlled object,
execution means for executing a user program for controlling the controlled object;
Abnormality detection means for determining whether or not an abnormality has occurred in a monitored object included in the controlled object based on one or more state values collected from the controlled object;
collecting means for collecting one or more state values from the controlled object according to a designation from an external device;
The control device receives operation settings of the anomaly detection means determined based on a result of analysis by an external device connectable to the control device of one or more state values collected by the collection means ,
The operation of the anomaly detection means and the collection means is changed according to settings defined in the user program,
The control device, wherein the settings defined in the user program are changed by a user operation on a support device connectable to the control device. A control program executed by a control device for controlling a controlled object, the control program causing the control device to :
execution means for executing a user program for controlling the controlled object;
Abnormality detection means for determining whether or not an abnormality has occurred in a monitored object included in the controlled object based on one or more state values collected from the controlled object;
collecting means for collecting one or more state values from the controlled object according to a designation from an external device;
functioning as reception means for receiving operation settings of the anomaly detection means determined based on the results of analysis by an external device connectable to the control device of one or more state values collected by the collection means ;
The operation of the anomaly detection means and the collection means is changed according to settings defined in the user program,
A control program , wherein settings defined in the user program are changed by a user operation on a support device .

Images