Programmable logic controller and analyzer

Abstract

A programmable logic controller and analyzer. The invention aims to effectively identify abnormal devices by analyzing and classifying features such as periodicity and continuity of data regarding each device. The programmable logic controller includes an execution engine that repeatedly executes a user program and a device memory having a plurality of devices as storage areas for storing data accessed by the execution engine according to the user program. The programmable logic controller collects data held by a device as a collection target among the plurality of devices according to a predetermined collection setting for each scan cycle of the user program, classifies each device into one of a plurality of types based on features of time-series data of each device collected, and determines a detection algorithm used in identifying the device as an abnormal device for each device according to the time-series data of the device collected by the collection section and the type of the device classified by the classification section. The programmable logic controller identifies an abnormal device by analyzing the time-series data of the device collected by the collection section using parameters determined for the device by the determination section according to the type of the device classified by the classification section.

Description

Technical Field

[0001] The present invention relates to a programmable logic controller and an analyzer. Background Art

[0002] A programmable logic controller (PLC) is a controller used to control industrial machines such as manufacturing equipment, transportation equipment, and inspection equipment in factory automation (Japanese Patent No. 5661222, Japanese Unexamined Patent Publication No. 2018-097662).

[0003] The PLC executes a user program such as a ladder program created by a programmer to control various expansion units, controlled devices, and the like.

[0004] To monitor the operation of a PLC and the industrial machinery it controls, it is desirable to collect and utilize data held by the PLC. A PLC consists of a base unit (central processing unit (CPU)) and expansion units connected to it. The base unit executes user programs, such as ladder diagrams, to control the expansion units. The expansion units control the industrial machinery based on commands from the base unit and return control results to the base unit.

[0005] These data such as control results are used for fault analysis and quality control. Therefore, it is necessary to accumulate and analyze these data and obtain analysis results in the early stage of recovery. However, in the case of recording the data of each device in all devices related to PLC, a large amount of data will be stored. In addition, it is necessary to analyze such a large amount of data (all devices) to identify abnormal devices, which requires time-consuming work. Usually, a specific device as the analysis object is analyzed to automatically judge the abnormality, and for the analysis method to be used, an analysis method suitable for the data has been prepared in advance to make the judgment. Experience and knowledge are also required to select a specific device or determine the analysis method. Therefore, in addition to appropriately storing a large amount of data, a mechanism is also required to effectively identify abnormal devices from a large amount of data related to each device without requiring sufficient professional knowledge or experience. Summary of the Invention

[0006] In view of the above problems, an object of the present invention is to effectively identify abnormal devices by analyzing and classifying characteristics such as periodicity and continuity of data related to each device.

[0007] The present invention is, for example, a programmable logic controller, comprising: an execution engine for repeatedly executing a user program; a device memory having a plurality of devices as storage areas for storing data accessed by the execution engine according to the user program; a collection unit for collecting, for each execution cycle of the user program, data maintained by a device serving as a collection object among the plurality of devices according to a predetermined collection setting; a classification unit for classifying each device into one of a plurality of types based on features of time series data of each device collected by the collection unit; a determination unit for determining, for each device, a detection algorithm used when identifying the device as an abnormal device based on the time series data of the device collected by the collection unit and the type of the device classified by the classification unit; and an identification unit for identifying an abnormal device by analyzing the time series data of the device collected by the collection unit using the detection algorithm determined for the device by the determination unit according to the type of the device classified by the classification unit.

[0008] In addition, the present invention is, for example, an analyzer that is communicatively connected to a programmable logic controller, the programmable logic controller including: an execution engine for repeatedly executing a user program, a device memory having multiple devices as storage areas for storing data accessed by the execution engine according to the user program, and a collection unit for collecting data maintained by devices serving as collection targets among the multiple devices according to predetermined collection settings for each execution cycle of the user program, the analyzer including: an acquisition unit for acquiring time series data of each device collected by the collection unit from the programmable logic controller; a classification unit for classifying each device into one of multiple types based on features of the time series data of each device acquired by the collection unit; a determination unit for determining, for each device, a detection algorithm used when identifying the device as an abnormal device based on the time series data of the device collected by the collection unit and the type of the device classified by the classification unit; an identification unit for identifying the abnormal device by analyzing the time series data of the device collected by the collection unit using the detection algorithm determined for the device by the determination unit based on the type of the device classified by the classification unit; and an output unit for outputting the identification result of the identification unit.

[0009] According to the present invention, abnormal devices can be effectively identified by analyzing and classifying characteristics such as periodicity and continuity of data related to each device. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 is a diagram showing a PLC system;

[0011] Figure 2 is a diagram for explaining a personal computer (PC);

[0012] Figure 3 It is a diagram used to illustrate PC;

[0013] Figure 4 This is a diagram used to illustrate PLC;

[0014] Figure 5 It is a diagram for explaining the basic unit.

[0015] Figure 6 This is a diagram for explaining a data utilization unit.

[0016] Figure 7 is a diagram for explaining an expansion unit;

[0017] Figure 8 is a diagram used to illustrate the format of data records;

[0018] Figure 9 is a diagram for explaining the timing of transmission time;

[0019] Figure 10 is a diagram used to illustrate information compression;

[0020] Figure 11 is a flow chart showing the overall process;

[0021] Figure 12 is a diagram showing the classification of collected data;

[0022] Figure 13A is a flowchart showing the processing procedure of classification;

[0023] Figure 13B is a flowchart showing the processing procedure of classification;

[0024] Figure 14 A diagram showing the type of data

[0025] Figure 15 is a flowchart showing the processing procedure of the learning phase;

[0026] Figure 16 is a flowchart showing the processing procedure of the evaluation phase;

[0027] Figure 17 is a diagram for explaining a method for determining an abnormality;

[0028] Figure 18 is a diagram showing a display example of a recognition result;

[0029] Figure 19 FIG. 1 is a diagram showing a modified example of collecting data;

[0030] Figure 20is a flowchart showing a processing procedure for outputting a monitoring start signal; and

[0031] Figure 21 : is a flowchart showing the processing procedure of additional learning. DETAILED DESCRIPTION

[0032] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. The following embodiments are not intended to limit the present invention according to the claims, and not all combinations of features described in the embodiments are essential to the present invention. Two or more of the multiple features described in the embodiments may be optionally combined. In addition, identical or similar components are given the same reference numerals, and repeated descriptions are omitted. Lowercase letters may be added to the end of reference numerals indicating identical or similar elements. When describing matters common to multiple elements, lowercase letters are omitted.

[0033] <First embodiment>

[0034] <System Structure>

[0035] The first embodiment of the present invention will be described below. First, in order to enable those skilled in the art to better understand a programmable logic controller (PLC, which may be simply referred to as a programmable controller), the structure and operation of a general PLC will be described.

[0036] Figure 1 1 is a conceptual diagram showing an example of the structure of a programmable logic controller system according to an embodiment of the present invention. Figure 1 As shown, the system includes a PC 2a configured to edit a user program (such as a ladder diagram program, etc.), and a programmable logic controller (PLC) 1 configured to control various control devices installed in a factory, etc. as a whole. PC is the abbreviation of personal computer. User programs can be created using a graphical programming language such as ladder diagram language or a motion program in the form of a flowchart such as a sequential function chart (SFC), or a high-level programming language such as C language. In the following, for ease of description, the user program is a ladder diagram program. PLC 1 includes a basic unit 3 incorporating a CPU and one or more expansion units 4. One or more expansion units 4 can be attached to or removed from the basic unit 3.

[0037] The base unit (also called the CPU unit) 3 includes a display unit 5 and an operation unit 6. The display unit 5 can display, among other things, the operating status of each expansion unit 4 attached to the base unit 3. The display unit 5 switches its display content based on the operation performed on the operation unit 6. The display unit 5 typically displays the current values ​​(device values) of devices in the PLC 1 and error information generated in the PLC 1. Here, "device" includes various devices (relays, timers, counters, etc.) included in the base unit 3 and expansion units 4, and refers to an area on a memory device provided for storing device values ​​(device data), and can be referred to as device memory. Note that device memory is non-volatile memory and can be made of rewritable non-volatile ROM, and non-volatility can be achieved through battery backup, such as non-volatile RAM. ROM is an abbreviation for read-only memory. RAM is an abbreviation for random access memory. Device values ​​are information indicating the input status from input devices, the output status to output devices, and the status of internal relays (auxiliary relays), timers, counters, and data memory set in the user program. Device value types include bit type and word type. A bit device stores a 1-bit device value, such as 0 / 1, on / off, and H / L. A word device stores a word device value. As a collection object of the data utilization program described in detail below, a variable can be designated as a device. A variable is also a holding unit for holding information and is accessed by the execution engine according to the user program. Therefore, in the following description, a device also refers to a variable. Note that a memory for holding a device can be referred to as a device memory. A memory for holding collected data can be referred to as a data memory.

[0038] The expansion units 4 are provided for expanding the functions of the PLC 1. Field devices (controlled devices) 10 corresponding to the functions of the expansion units 4 can be connected to each expansion unit 4, whereby each field device 10 is connected to the base unit 3 via the expansion unit 4. The field devices 10 can be input devices such as sensors or cameras, or output devices such as actuators. Multiple field devices can be connected to one expansion unit 4.

[0039] For example, the extension unit 4b may be a positioning unit that drives a motor (field device 10) to position a workpiece, or may be a counter unit that counts signals from an encoder (field device 10) such as a manual pulse generator.

[0040] The extension unit 4a is, for example, a data utilization unit that collects data to be collected from the base unit 3 and the extension unit 4b, executes user programs (data utilization programs) such as streams, processes the data to be collected, creates data to be displayed, and creates display data (source data) for displaying a dashboard on the display unit 7 or PC 2. In this embodiment, an example in which the extension unit 4a collects data from each device will be described, but the collection unit can be set in the base unit 3 or other extension units. The extension unit 4a can also be used as an analyzer, which analyzes the collected data based on instructions from the base unit 3 and predetermined timing. In this embodiment, an example in which the extension unit 4a is used as an analyzer will be described, but it is not intended to limit the present invention, and the base unit 3 can be used as an analyzer, and external devices such as PCs 2a, 2b can be used as analyzers. The following process (stream program) is only an example of a data utilization program. The base unit 3 is sometimes referred to as a CPU unit. Note that a system including a PLC 1 and a PC 2 can be referred to as a programmable logic controller system.

[0041] PC 2a is a computer mainly operated by a programmer. On the other hand, PC 2b is a computer mainly operated by a person in charge on site. PC 2a can be called a program creation support device (setting device). PC 2 is, for example, a portable notebook or tablet personal computer or a smart phone, and is an external computer including a display unit 7 and an operating unit 8. The external computer is a computer located outside PLC 1. PC 2a is used to create a ladder program as an example of a user program for controlling PLC 1. The created ladder program is converted into mnemonics in PC 2a. PC 2 is connected to the basic unit 3 of PLC 1 via a communication cable 9 such as a universal serial bus (USB) cable. For example, PC 2a sends the ladder program converted into mnemonics to basic unit 3. Basic unit 3 converts the ladder program into machine code and stores the machine code in a memory provided in basic unit 3. Here, the mnemonics are sent to basic unit 3, but the present invention is not limited to this. For example, PC 2a can convert the mnemonics into an intermediate code and send the intermediate code to basic unit 3.

[0042] Despite Figure 1 Although not shown in the figure, the operation section 8 of the PC 2 may include a pointing device such as a mouse connected to the PC 2. The PC 2 may be configured to be detachably connected to the base unit 3 of the PLC 1 via a communication cable 9 other than the USB cable. In addition, the PC 2 may be connected to the base unit 3 of the PLC 1 by wireless communication without the communication cable 9.

[0043] <Program creation support equipment>

[0044] Figure 2 2a is a block diagram for explaining the electrical structure of PC 2a. Figure 2 As shown, PC 2a includes a CPU 11a, a display unit 7a, an operating unit 8a, a storage device 12a, and a communication unit 13a. The display unit 7a, operating unit 8a, storage device 12a, and communication unit 13a are each electrically connected to the CPU 11a. The storage device 12a includes RAM, ROM, HDD, and SSD, and may also include a removable memory card. CPU is the abbreviation for Central Processing Unit. HDD is the abbreviation for Hard Disk Drive. SSD is the abbreviation for Solid State Drive.

[0045] The user of PC 2a causes CPU 11a to execute project editing program 14a stored in storage device 12a and edit project data 15 through operation unit 8a. When CPU 11a executes project editing program 14a, project creation unit 16 and project transfer unit 17 are implemented. Project creation unit 16 creates project data 15 based on user input. Project transfer unit 17 transfers project data 15 to PLC 1. Project data 15 includes one or more user programs (e.g., ladder programs, control programs, motion programs, data utilization programs), configuration information for each of the base unit 3 and expansion units 4, and setting information for the identification functions provided in each of the base unit 3 and expansion units 4. The configuration information includes information on the connection locations of multiple expansion units 4 to the base unit 3 and the allocation of devices. The configuration information may include information indicating the functions provided by the base unit 3 (e.g., data collection function, communication function, positioning function) and information indicating the functions of the expansion units 4 (e.g., communication function, positioning function, and imaging function). The setting information for the identification function includes setting information related to the functions provided in the base unit 3 (for example, data collection function, communication function, positioning function) (for example, setting information on data collection conditions and data collection targets in the case of the data collection function) and setting information related to the functions of the extension unit 4 (for example, communication function, positioning function, data utilization function, shooting function). Editing the project data 15 includes creating and changing (re-editing) the project data 15. The user can read the project data 15 stored in the storage device 12a as needed and change the project data 15 by using the project editing program 14a. The communication unit 13a communicates with the base unit 3 via the communication cable 9a. The project transmission unit 17 transmits the project data to the base unit 3 via the communication unit 13a. The communication unit 13a communicates with the extension unit 4a via the communication cable 9b.

[0046] <PC for displaying the instrument panel>

[0047] Figure 3 2b is a block diagram for explaining the electrical structure of PC 2b. Figure 3As shown, PC 2b includes CPU 11b, display unit 7b, operation unit 8b, storage device 12b, and communication unit 13b. Display unit 7b, operation unit 8b, storage device 12b, and communication unit 13b are electrically connected to CPU 11b. Storage device 12b includes RAM, ROM, HDD, and SSD, and may also include a removable memory card.

[0048] The CPU 11b executes the web browser program 14d to implement the web browser 18. The web browser 18 accesses the settings page of the data utilization application or the dashboard page provided by the extension unit 4a via the communication unit 13b. In addition, the CPU 11b displays the recognition result (judgment result) when the abnormality occurs on the display unit 7b based on the screen information indicating the recognition result sent from the extension unit 4a.

[0049] <plc>

[0050] Figure 4 is a block diagram for explaining the electrical structure of the PLC 1. As shown in Figure 4 , the base unit 3 includes a CPU 31, a display section 5, an operation section 6, a storage device 32, a communication section 33, and a memory card 44. The display section 5, the operation section 6, the storage device 32, and the communication section 33 are electrically connected to the CPU 31, respectively. The storage device 32 can include a RAM or a ROM. The storage device 32 has a plurality of storage areas such as a device section 34, an item storage section 35, and a first buffer 37a. The device section 34 has bit devices and word devices, and each device stores a device value corresponding to a device memory. The item storage section 35 stores item data input from the PC 2a. The first buffer 37a stores device values (time series data) to be collected from the device section 34 for each scan cycle. Details of the first buffer will be described later with reference to Figure 5 . When a saving condition is satisfied, the memory card 44 stores time series data, which is control data from each device stored in the first buffer 37a. For example, by temporarily holding the time series data in the memory card 44, data of a classification object or an identification object can be verified later by an external device or the like, and important latest data can be held as log information. Further, in the present application, since data of all devices related to the PLC 1 is basically collected, the collected data is enormous, and by holding data to be processed in a separate memory, an effect of reducing a processing load can be expected, and in addition, it can be facilitated to perform the collection processing and processing related to the collected data (classification processing and identification processing) in parallel. Here, the saving condition is satisfied when an abnormality occurs in the PLC, when a device to be a saving trigger is designated by a user in advance and there is a predetermined change in the device, when an analysis command is issued by the user, when a monitoring cycle of periodic monitoring has elapsed, and when an analysis command is issued from an extension unit connected to the base unit 3, and the like. The saving condition can be set in advance by the user and saved as a part of the item data in the storage device 32 of the base unit 3. When the CPU 31 detects that the saving condition has been satisfied, the CPU 31 issues a command to store the device values saved in the first buffer 37a to the memory card 44 such as a secure digital (SD) card, and notifies the extension unit 4a that the data to be analyzed has been saved. A control program for the base unit 3 is stored as a part of the item data in the item storage section 35. The control program for the base unit 3 can be stored in the storage device 32 separately from the item storage section 35 or in the storage device 32 in addition to the item storage section 35. As shown in Figure 4 , the base unit 3 and the extension unit 4 are connected to each other via an extension bus 90, which is one kind of communication bus. In Figure 4 In the embodiment, the communication circuit related to the expansion bus 90 is mounted on the CPU 31, but it may be mounted as a part of the communication unit 33. The communication unit 33 may have a network communication circuit. The CPU 31 receives project data from the PC 2a via the communication unit 33.

[0051] Here, a supplementary description of the expansion bus 90 will be given. The expansion bus 90 is a communication bus for input / output refreshing. Input / output refreshing is a process for obtaining the input / output values ​​when executing the ladder program before each execution of the ladder program, and based on the obtained input / output values ​​when repeatedly executing the ladder program. It is also a process for not obtaining the input / output values ​​even if the input / output values ​​change during a single execution. The values ​​obtained by input / output refreshing are stored in the device memory as device values ​​of the device corresponding to each input / output. Through input / output refreshing, device values ​​are sent / received between the basic unit 3 and the expansion unit 4, and the device values ​​of the corresponding devices in the device memory are updated. Input / output refreshing is performed in each scan cycle (i.e., each scan) during the execution of a ladder program. One scan cycle includes the input / output refreshing execution period, the ladder program execution period, and the end processing execution period.

[0052] The expansion unit 4 includes a CPU 41 and a memory 42. In addition, the expansion unit 4a may include a memory card (e.g., an SD card) that is detachable from the expansion unit 4a and stores time series data as control data from each device. The CPU 41b of the expansion unit 4b controls the field device 10 according to the instructions (device values) from the basic unit 3 stored in the device. The CPU 41b stores the control results of the field device 10 in a device called a buffer memory. The control results stored in the device are transferred to the basic unit 3 through input / output refresh. Even at a timing different from the input / output refresh, the control results stored in the device are transferred to the basic unit 3 according to the read command from the basic unit 3. The memory 42 includes a RAM and a ROM. In particular, in the RAM, a storage area to be used as a buffer memory is ensured. The memory 42 may have a buffer that temporarily holds data (example: device values, still image data, video data) acquired by the field device 10.

[0053] The CPU 41a of the extension unit 4a serving as a data utilization unit communicates with the PC 2b via the communication unit 43 and the cable 9b. The data utilization unit is an extension unit that executes a data utilization application. The data utilization application includes: a flow for collecting or processing control data (time series data) stored in the memory card 44 provided in the basic unit 3 or the memory card provided in the extension unit 4a; a flow for performing processing related to the collected data; a dashboard for displaying the execution results of the flow; and a sending unit for sending the results of the flow to the outside. Note that the data utilization application does not issue a save command to the memory card 44 during abnormal device analysis, but refers to the data saved when the above-mentioned saving conditions have been met, and uses the data saved in the memory card 44 for analysis.

[0054] Note that in addition to data utilization applications, functions for collecting control data can be implemented through user programs. Functions for performing processing related to the collected data include: an identification function for identifying abnormal devices when the programmable logic controller is abnormal; an analysis function for analyzing deviations from normal time series data and verifying device values ​​that differ from normal values; and a monitoring function for regularly performing the above analysis. The flow can have arithmetic blocks for collecting data, arithmetic blocks for performing data processing, and arithmetic blocks for creating display data. The dashboard has a graphical display unit and a digital display unit, etc. These display units can be implemented using Hypertext Markup Language (HTML) data, Cascading Style Sheets (CSS) data, or JavaScript (registered trademark) code, etc. Note that a collection of HTML data, CSS data, and JavaScript (registered trademark) code can be referred to as a web application. In this embodiment, the flow is implemented using a flow template. The flow template is prepared in advance for each application and has one or more arithmetic blocks, in which flow template parameters specified by the user are set. The dashboard is also enabled by the template. The dashboard template has one or more display units, to which dashboard template parameters specified by the user are set. The dashboard template parameters are, for example, various information such as dashboard name, device name, numerical value, and unit variable name, etc. The unit variable is a variable used for the extension unit 4a to hold the execution result of the flow.

[0055] <Functions provided by the base unit's CPU>

[0056] Figure 5 Functions regarding data utilization implemented by the CPU 31 are shown. The execution engine 51 repeatedly executes the user program for each scan period as an execution cycle. The execution engine 51 can be implemented by an ASIC or an FPGA or the like provided outside the CPU 31. The ASIC is an abbreviation for Application Specific Integrated Circuit. The FPGA is an abbreviation for Field Programmable Gate Array. These special circuits can generally execute specific data processing at higher speed than the combination of the CPU and the program. The collection section 52a collects device values to be collected from the device section 34 for each scan period as an execution cycle, creates a data record, and stores the data record into the first buffer 37a. In a case where the execution engine executes a ladder program as the user program, the scan period of the ladder program corresponds to the execution cycle, and in a case where the execution engine executes a motion program as the user program, the control period of the motion program corresponds to the execution cycle. In a case where the device values are collected for each scan period of the ladder program, the device values to be collected can be collected from the device section 34 during an end processing period of the scan period, and a data record can be created and stored in the first buffer 37a. Collection of data during the end processing period is not necessary, and a description for collecting data (such as a program code of a trigger command or the like) can be included in the user program executed by the execution engine 51. However, in a case where data is collected by the end processing, there is an advantage that the user program does not need to be changed. The collection period is transmitted as a part of the project data and stored in the storage device 32 of the base unit 3 as the collection setting 36a. The collection setting 36a includes not only the collection period but also devices to be collection targets. Note that the collection period can be a period different from the scan period as the execution cycle or the control period of the motion program. In this case, for each collection period specified by the collection setting 36a, the device values to be collected can be collected from the device section, and a data record can be created and stored in the first buffer 37a. Here, when collecting data, the base unit 3 can analyze characteristics such as periodicity and continuity of each device value by its own device or by the extension unit 4a, and classify the devices according to the analysis result. On the other hand, such analysis can not be performed at the time of collecting data, but can be performed by the own device or by the extension unit 4a at a timing at which time series data of a predetermined number of scan periods have been collected, or at a timing at which data needs to be analyzed when an abnormality occurs.

[0057] By providing the first buffer 37a, the execution engine 51 is less susceptible to increased scan time due to collection or transfer processing. The device values ​​to be collected are specified by the collection settings 36a. The collection settings 36a can be stored in the base unit 3 by the PC 2a or the expansion unit 4a. The transfer unit 53a stores one or more data records stored in the first buffer 37a in the memory card 44 provided in the base unit 3, and transfers the data records stored in the memory card 44 to the expansion unit 4a. Note that the transfer unit 53a performs the transfer processing when the communication traffic on the expansion bus 90 is idle, but a dedicated expansion bus for sending data records to the expansion unit 4a may be provided.

[0058] Alternatively, the transmission unit 53a can transmit one or more data records stored in the first buffer 37a to the expansion unit 4a via the expansion bus 90. The transmitted data can then be stored on a memory card provided in the expansion unit 4a. In this case, it is preferable to provide an expansion bus dedicated to sending data records to the expansion unit 4a. As described above, data records are only saved to the memory card 44 when the save condition is met. This eliminates the need to transmit unnecessary data to the expansion unit 4a, thereby reducing communication traffic.

[0059] The transfer process can be performed while avoiding the time period during which the execution engine 51a performs input / output refresh or the time period during which data is read from the buffer memory of the expansion unit 4 according to a read command described in the user program. Note that the communication traffic of the expansion bus 90 is monitored by the monitoring unit 54a. To reduce the data record transfer time, the compression engine 55a can compress multiple data records. Note that the compression engine 55a does not need to be implemented by the CPU 31, but can be implemented by an ASIC or FPGA. Therefore, by using the first buffer 37a, the transfer process and the user program can be executed asynchronously.

[0060] <Function of Data Utilization Unit>

[0061] Figure 6 It is a diagram for explaining the functions implemented by the CPU 41a of the extension unit 4a.

[0062] The collection unit 52c has a function for collecting (acquiring) data from the first buffer of the base unit 3 according to the collection settings 39. The collection settings 39 are set by the user, transmitted as part of the project data, and stored in the memory 42a of the extension unit 4a. The collection unit 52c can be implemented by the CPU 41a executing a control program such as a user program. The collection unit 52c configures the base unit 3 so that the base unit 3 collects the device values ​​specified by the collection settings 39 and transmits these device values ​​to the second buffer 37b of the extension unit 4a. Note that the collection unit 52c can write the collection settings 36a of the base unit 3 included in the collection settings 39 to the storage device 32 of the base unit 3. It is desirable that the collection unit 52c and the data processing unit 73 operate substantially asynchronously. A buffer can be provided to achieve this. Here, a description of a working example is given in which the base unit 3 collects device values ​​and temporarily stores them in a buffer. The collection unit 52c of the extension unit 4a then collects these device values ​​at a predetermined timing. However, the present invention is not limited thereto, and an analysis unit such as the extension unit 4 a may directly acquire the device value and store the device value in a memory provided in the extension unit 4 a .

[0063] The collection section 52c can set the extension unit 4b so that the extension unit 4b collects the device value specified by the collection setting 39 and transmits the device value to the third buffer 37c of the extension unit 4a. By providing the second buffer 37b and the third buffer 37c, data can be collected without loss even when the processing load of the data processing section 73 fluctuates. The collection section 52c can set the collection setting 36b ( Figure 7 ) is written into the memory 42b of the extension unit 4b. Note that these setting functions can be implemented by the setting unit 71. The setting unit 71 receives the collection settings 39, the processing settings 61, and the display settings 62 from the PC 2a or PC 2b, and writes the received settings into the memory 42a. The processing settings 61 include information and flows (programs) for defining the data processing to be performed on the collected data by the data processing unit 73. The display settings 62 include a dashboard template (HTML data, CSS, JavaScript (registered trademark) code, etc.), which provides the data processing results to the web browser 18 through the web server 70.

[0064] Furthermore, the CPU 41a of the extension unit 4a implements a classification section 76, a determination section 77, an identification section 78, and a transmission section 79 as functional components. The classification section 76 analyzes the characteristics of the time series data of each device collected (acquired) from the first buffer of the base unit 3 by the collection section 52c, and classifies the time series data based on the characteristics. Figure 12 The classification method is described below. Although the classification unit 76 performs the classification process at any timing, it basically performs the classification process at the time when the system operation starts or when an instruction from the user is received. The determination unit 77 determines the parameters used when identifying abnormal devices based on the time series data classified by the classification unit 76 and stores these parameters in the memory 42a. The parameter determination process will be described later. When the classification unit 76 performs the classification process, the determination unit 77 performs the parameter determination process, and when the parameters have already been determined for the same device, the determination unit 77 updates the parameters. When updating, the update can be performed by overwriting, or the new parameters can be determined from two parameters by taking an average or using some other method. In addition, the processing when updating can be determined for each device. As described above, the classification unit 76 and the determination unit 77 are processing units that play a role in the learning phase for analyzing the collected data and learning what the data is like when it is normal, and determine the parameters used when identifying abnormal devices. On the other hand, the identification unit 78 is a processing unit that plays a role in the evaluation phase for evaluating abnormal devices. Identification unit 78 uses the determined parameters to identify abnormal devices based on the time-series data of each device collected by collection unit 52c. Details of the identification process will be described later. Here, "abnormal device" refers to a storage area in the device memory that holds data that differs from normal data. Identification unit 78 can initiate evaluation of abnormal devices when an abnormality occurs during operation of the programmable logic controller, periodically, or based on a monitoring instruction from the user. This evaluation can be initiated when a user-preset storage condition is met.

[0065] The generating unit 74 substitutes the data processing result into the template of the dashboard according to the display setting 62 that defines the display unit of the dashboard to generate the display data of the dashboard. Based on the recognition result of the abnormal device by the recognition unit 78, the generating unit 74 generates display data (screen information) for displaying the recognition result. The display data can be, for example, HTML data, image data, cascading style sheets (CSS) or JavaScript (registered trademark) code, etc. The display unit includes, for example, a pie chart unit, a bar chart unit, a line chart unit and a numerical display unit, etc. When the web page of the dashboard is accessed through the web browser 18, the web server 70 sends the display data of the dashboard to the web browser 18. The web browser 18 receives the display data and displays the display data in the dashboard. The sending unit 79 sends the display data generated by the generating unit 74 to an external device. There is no particular restriction on the communication line and communication method used when sending. A wireless connection or a wired connection can be used.

[0066] Note that multiple data utilization applications may be provided. In this case, the required data and read timing may differ for each data utilization application, and a sub-buffer may be reserved in the memory 42a for each data utilization application. The collection unit 52c reads the data records stored in the second buffer 37b and stores the data for the first data utilization application in the first sub-buffer 38a. The collection unit 52c reads the data records stored in the second buffer 37b and stores the data for the second data utilization application in the second sub-buffer 38b. The collection unit 52c reads the data records stored in the third buffer 37c and stores the data for the first data utilization application in the first sub-buffer 38a. The collection unit 52c may read the data records stored in the third buffer 37c and store the data for the second data utilization application in the second sub-buffer 38b. The data processing unit 73 reads data from the first sub-buffer 38a according to the first data utilization application, performs data processing on the data, and generates a processing result. The data processing unit 73 reads data from the second sub-buffer 38b according to the second data utilization application, performs data processing on the data, and generates a processing result. The decompression engine 75 functions in conjunction with the compression engine 55a of the base unit 3 and the compression engine 55b of the expansion unit 4b. The decompression engine 75 decompresses data compressed and transmitted by the base unit 3 and stores the data in the second buffer 37b. The decompression engine 75 decompresses data compressed and transmitted by the expansion unit 4b and stores the data in the third buffer 37c. This reduces traffic congestion on the expansion bus 90. The decompression engine 75 can be implemented using an ASIC or FPGA. In this manner, data transmission between the base unit 3 and the expansion units 4a and 4b is performed via the expansion bus 90.

[0067] There are cases where multiple data are required for each data utilization application. In this case, the multiple data required can be stored in the sub-buffer, while the data blocks collected by each scan are maintained in the buffer. In addition, when the data is also allocated to the sub-buffer, a timestamp or the like can be given to each record. Figure 16 As shown, the second buffer 37b (which may be the third buffer 37c) holds the collected data blocks. A record includes a scan number, a timer value (timestamp), and the collected data. In this example, the collected data includes relays RL1 to RL3 and devices Dev1 and Dev2. The first data utilization application 1601 requires relays RL1 to RL3 for the collected data. Therefore, the scan number, timer value, and relays RL1 to RL3 are read from the second buffer 37b and stored in the first sub-buffer 38a. The first data utilization application 1601 reads the scan number, timer value, and relays RL1 to RL3 from the first sub-buffer 38a to create a display screen (source data). The second data utilization application 1602 requires relay RL3 for the collected data and devices Dev1 and Dev2. Therefore, the scan number, timer value, relay RL3, and devices Dev1 and Dev2 are read from the second buffer 37b and stored in the second sub-buffer 38b. The second data utilization application 1602 reads the scan number, timer value, relay RL3, and devices Dev1 and Dev2 from the second sub-buffer 38b to create a display screen (source data). By utilizing the sub-buffer in this manner, the original data can be maintained in the buffer without being changed. The original data retained in the buffer can be used for other purposes.

[0068] <Functions of the Extension Unit 4b Related to Data Utilization>

[0069] Figure 7 It is a diagram for explaining the functions realized by the CPU 41b of the extension unit 4b.

[0070] The execution engine 51b performs the basic functions of the expansion unit 4b (in the case of a motion unit, it executes the motion flow). The collection unit 52b collects data specified by the collection settings 36 from the device unit 34b at the timing specified by the collection settings 36 and stores this data in the fourth buffer 37d. The transmission unit 53b reads the data record stored in the fourth buffer 37d at the timing specified by the collection settings 36 or when the expansion unit 4a receives a transmission request, and transmits this data record to the third buffer 37c of the expansion unit 4a via the expansion bus 90. Note that the transmission unit 53b can transmit the data record at a time when the communication traffic on the expansion bus 90 monitored by the monitoring unit 54 is low. The compression engine 55b compresses the data record according to the collection settings 36. In other words, the transmission unit 53b can transmit the data record, which has undergone information compression by the compression engine 55b, to the expansion unit 4a. The compression engine 55b can be implemented by the CPU 41b, but from the perspective of high-speed processing and reducing the processing load on the CPU 41b, it can be implemented by an ASIC or FPGA.

[0071] <Data record example>

[0072] Figure 8 : The data record 91 written by the collection unit 52a to the first buffer 37a is shown. The multiple data records 91 are examples of time series data. In this example, the collection unit 52a collects the device values ​​of the device names Dev0, Dev1, and Dev10 from the device unit 34a for each scanning cycle, adds the time information obtained from the collection count and the timer to create a data record, and stores the data record in the first buffer 37a. Note that the collection object can be data stored in the buffer memory or device assigned to the expansion unit 4b. In this example, the first buffer 37a is a first-in-first-out (FIFO) type buffer. The collection count is the count value of the counter that increases by 1 each time a data record is collected. The collection count is a consecutive number and is therefore used to detect the loss or compression of data records.

[0073] For example, when displaying data acquired by the base unit 3 and data acquired by the expansion unit 4b in a comparable manner on a dashboard, time information such as a timestamp is useful. Typically, the collection timing in the base unit 3 and the collection timing in the expansion unit 4b do not coincide. Therefore, comparing the operation of the base unit 3 with the operation of the expansion unit 4b requires information for linking the data of the base unit 3 with the data of the expansion unit 4b. Typically, time information can be synchronized between the base unit 3 and the expansion units 4a and 4b through inter-unit synchronization or the like. Therefore, the base unit 3 and the expansion unit 4b each assign the time information when the data record was collected to the data record, allowing the data processing unit 73 to align multiple data records acquired by different units on the time axis.

[0074] <Transmission Timing>

[0075] Figure 9 is a diagram for explaining the transmission timing of data records. Figure 9 As shown, PLC 1 repeatedly performs input / output refresh, execution of the user program, and end processing. In order to reduce the extension of the scan cycle, the time period used for input / output refresh is avoided to perform transfer processing. Similarly, in order to reduce the extension of the scan cycle, the time period for executing UREAD and UWRIT is avoided to perform transfer processing. UREAD is a command to read data from the buffer memory assigned to the expansion unit 4 and is described in the user program. Therefore, during the execution time period of the user program, the basic unit 3 accesses the expansion unit 4 according to UREAD to obtain data from the buffer memory. UWRIT is a command to write data to the buffer memory assigned to the expansion unit 4 and is described in the user program. During the execution time period of the user program, the basic unit 3 accesses the expansion unit 4 according to UWRIT and writes the data to the buffer memory.

[0076] like Figure 9 As shown, during the remaining transferable time periods other than input / output refresh, UREAD, and UWRIT, transfer processing is performed on the expansion bus 90. For example, it is assumed that the collection setting 36a has been set to perform transfer processing for five data records at a time. In this case, after the five data records are stored in the first buffer 37a and during the first transferable time period or when the extension unit 4a receives a transfer request, the transfer section 53a performs the transfer processing.

[0077] <Information Compression>

[0078] Figure 10 This is a diagram used to illustrate information compression of data records. Data record group 92a shows data records before information compression. Note that values ​​that have changed from the previous scan cycle are displayed in shading. Here, four relay devices RL1, RL2, RL3, and RL4 are designated as collection targets. The scan number is used as a collection count. The counter can be time information obtained by a timer, etc. (for example, a numerical value indicating the time interval between when a relay is turned on and when it is turned off). In data record group 92a, there is no change point in the relay device between the data record of scan number "1" and the data record of scan number "2". In other words, the data record of scan number "2" can be compressed (discarded or deleted). However, the relay device RL1 of the data record of scan number "3" is different from the relay device RL1 of the data record of scan number "1". In the case where scan number "3" has the above-mentioned change point, the data record of scan number "3" is not compressed. Since there is no change point in the relay device between the data record of scan number "3" and the data record of scan number "4", the data record of scan number "4" can be compressed. Similarly, since there are no change points in the relay devices between the data record for scan number "5" and the data record for scan number "6," the data record for scan number "6" can be compressed. By focusing on the change points and performing information compression as described above, compressed data record group 92b is achieved. Each data record that constitutes compressed data record group 92b has a change point. As described above, in this embodiment, in a group of one or more devices (RL1 to RL4), when there is no change between the values ​​collected in the previous scan cycle and the values ​​collected in the current scan cycle in all devices in the group that are the collection targets, the values ​​collected in the current scan cycle are deleted and the time series data to be collected is compressed. Although a working example of management in a group has been described here, it is not intended to limit the present invention, and data compression can be performed by determining on / off for each device without grouping. In addition, in the case where the data is not in a bit format of on / off (analog value), control can be performed to detect changes in device values ​​relative to the previous time for each device and retain the data when a change is detected.

[0079] <Overall Process>

[0080] Figure 11 The overall flow of processing from data collection to abnormal device identification in the programmable logic controller according to this embodiment is shown. The processing described below will be described as processing to be executed by the CPU 41a of the expansion unit 4a. However, this is not intended to limit the present invention, and part of the processing may be executed by the base unit 3 or other expansion units 4b, or may be executed by an external device (analyzer) communicatively connected to the programmable logic controller.

[0081] In S1, the CPU 41a (setting unit 71) sets up the base unit 3 and the expansion unit 4b. For example, the CPU 41a transmits the collection settings 36a of the base unit 3 to the base unit 3. The base unit 3 stores the collection settings 36a in the storage device 32. The CPU 41a transmits the collection settings 36b of the base unit 3 to the expansion unit 4b. The expansion unit 4b stores the collection settings 36b in the memory 42b.

[0082] In S2, the CPU 41a (collection unit 52c) collects time-series data from the target device according to the set collection settings. When a predetermined amount of collected data has been stored, the process proceeds to the next step. Specifically, the timing for transitioning to the learning phase is determined, and when a sufficient amount of data for learning (time-series data for a predetermined number of scan cycles) has been stored in a storage unit such as a buffer or memory card, the process proceeds to the next step.

[0083] In S3, the CPU 41a (classification unit 76 and determination unit 77) analyzes the data collected in S2 and creates a learning model (parameters in this embodiment) for identifying abnormal devices. The processing of the learning stage will be referred to later. Figure 15 Provide a description.

[0084] In S4, the CPU 41a (collection unit 52c) collects the time series data of the device that is the collection object according to the set collection setting. The processing of S4 and thereafter is actually the processing when the system is operating. The data collection here is basically performed in the same way as the data collection in S2. Note that the learning phase can be performed at the start of the operation of the system, or can be started at the timing of receiving an instruction from the user. The learning phase can be performed periodically. That is, when the system is operating, data is always collected, the learning phase is performed periodically, and the evaluation phase is performed at the timing when the saving condition is met. For example, when an abnormality occurs during the operation of the programmable logic controller and the basic unit 3 detects that the saving condition is met, the time series data collected in the first buffer 37a of the basic unit 3 is stored in the memory card 44. In S5, the CPU 41a (identification unit 78) obtains the time series data stored in the memory card 44, and applies the parameters determined in S3 to identify the abnormal device. That is, the processing in the evaluation phase is performed here, and will be referred to later. Figure 16 Describe the details. In addition, the CPU 41a generates display data indicating the recognition result through the generating unit 74 based on the recognition result recognized by the recognition unit 78, and displays the display data on the display unit 5 of the basic unit 3, or sends the generated display data or recognition result to the external device through the transmitting unit 79 via the communication unit 43. In this case, the recognition result is displayed to the operator in the external device. In addition to the method in which the basic unit 3 detects the satisfaction of the saving condition and identifies the abnormal device when an abnormality occurs during the operation of the programmable logic controller as described above, the operation of S5 may also be a method of continuously collecting device values ​​and analyzing whether there is no abnormality in the device value, a method of analyzing the device values ​​collected by the basic unit when a predetermined change is made to the device value previously determined by the user, or a method of analyzing whether there is no abnormality in the device value periodically or based on a monitoring instruction from the user. In these cases, the term "abnormal" means that the device value to be analyzed is different from the device value at normal time, that is, deviates from the data at normal time, and does not necessarily mean an abnormality occurring in the programmable logic controller. Note that reference will be made later Figure 16 The processing procedure of the evaluation phase for identifying abnormal devices from data collection in consideration of collection timing is described in detail.

[0085] <Categories of collected data>

[0086] Figure 12 An example of the type of time series data to be collected is shown. Reference numerals 1201 to 1206 each represent a device signal (time series data) of each type. The device signal may include an external signal. Note that the types described below are merely examples and are not intended to limit the present invention, and the present invention may be applied to other types. In the present invention, it is desired that the types to be classified include at least two of a plurality of types to improve the classification effect. Note that the classification of time series data during learning is performed by the user selecting a device for determining a cycle (operation cycle) for classification, and is performed based on the repeatability of the device.

[0087] Reference numeral 1201 represents a device signal of a device that operates synchronously with the operating cycle of the device. Reference numeral 1210 represents the operating cycle of the device. In type 1201, the same change pattern (stable change pattern) occurs for each operating cycle of the device. In this type, for example, a detection method is assigned in which a stable change pattern is identified from time series data acquired during a period that can be considered a normal state, and an abnormal device (a device that is different from the normal device) is identified based on the deviation from the stable change pattern identified from the newly acquired time series data. Specifically, the time change for the change point is measured for the change pattern of the time series data of each cycle in a plurality of cycles that can be considered a normal state, and a threshold is set based on the measured change. Based on whether the change point of the time series data acquired thereafter exceeds the threshold range set corresponding to the change point, a detection algorithm for detecting abnormal devices is assigned. For example, multiple waveforms for each operating cycle of the device are superimposed, and based on the change at the point where the device changes from disconnection to connection, a reference value and a threshold value of the change point are set so that these parameters can be used to identify abnormal devices. In each cycle of 1201, the relative time indicating the rising timing of the first signal or the phase in each cycle can be used as an evaluation variable, and a parameter corresponding to the evaluation variable can be determined based on the change in the evaluation variable. For example, when the phase in each cycle is used as the evaluation variable, the upper and lower thresholds of the phase can be used as parameters.

[0088] On the other hand, reference numeral 1202 represents a device signal for a device that is not synchronized with the scanning cycle but operates synchronously with a cycle other than the operating cycle of the device. Similarly, for this type, for example, a detection method is assigned in which a stable change pattern is identified from time series data acquired during a period that can be considered a normal state, and an abnormal device (a device that is different from the normal device) is identified based on the deviation from the stable change pattern identified in the newly acquired time series data. Specifically, the time change for the change point is measured for the change pattern of the time series data of each cycle in a plurality of cycles that can be considered a normal state, and a threshold is set based on the measured change. Based on whether the change point of the time series data acquired thereafter exceeds the threshold range set corresponding to the change point, a detection algorithm for detecting abnormal devices is assigned. In each cycle of 1202, the relative moment indicating the rising timing of the second signal or the phase in each cycle can be used as an evaluation variable, and a parameter corresponding to the evaluation variable can be determined based on the change of the evaluation variable. For example, when the relative moment in each cycle is used as the evaluation variable, the upper and lower thresholds of the relative moment can be used as parameters.

[0089] Reference numeral 1203 denotes a device signal of a device that adopts a constant value. In this type, for example, a detection method is assigned in which a value at a normal time is identified from time series data acquired during a time period that can be regarded as a normal state, and newly acquired time series data that is different from the value identified at a normal time is identified as an abnormal device (a device that is different from normal). Specifically, a detection algorithm is assigned in which the value of the device in the time series data that can be regarded as a normal state is set as a detection reference value, and an abnormal device is detected based on whether the value of the time series data acquired thereafter is different from the detection reference value set corresponding to the value at a normal time. In other words, when a value (constant value) changes, the value can be judged as abnormal. Reference numeral 1204 denotes a device signal of a device that does not operate regularly. This type is excluded from the data used when identifying an abnormal device. Reference numeral 1205 denotes a device signal of a device that adopts an analog value. In a device that adopts an analog value, as described below, in a case where the device value is not the device value of a bit device, the processing enters Figure 13A The "No" in S21 ( Figure 13B S27), and as Figure 13B As shown, the algorithm in the evaluation phase is different depending on the method used to change the data. As the algorithm in the evaluation phase of the device using analog values, various methods such as dynamic time warping methods and autoregressive models can be used. Reference numeral 1206 represents a device signal of a monotonically increasing and monotonically decreasing device. In this type, differential values ​​and integral values ​​are used to identify abnormal devices. In addition, the relative moment of the timing indicating a monotonically increasing or monotonically decreasing or the phase in each cycle can be used as an evaluation variable. Note that the types described here are only examples, and devices classified as other types are also assumed, for example, some devices can take multiple states (step-shaped device signals, etc.). When changed to a state different from that in normal times, a device taking multiple states can be judged as abnormal.

[0090] Here, we will refer to Figure 14 Describes the device type. Figure 14 As shown, each device includes 0- and 1-bit type devices, as well as word type devices or floating-point type devices that use analog values. Note that word devices also include 1-word unsigned integers (0 to 65535), 1-word signed integers (-32768 to 32767), 2-word unsigned integers (0 to 4294967295), and 2-word signed integers (-214783648 to 214783647). Considering this type, for example, when the rate of change per scan cycle is equal to or greater than a predetermined value and the type is not bit, the device can be determined to be a device that uses analog values.

[0091] <Category>

[0092] Figure 13A and 13B is a flowchart illustrating the processing procedure used when classifying the collected data. The processing described below is implemented by the CPU 41a of the expansion unit 4a. However, this is not intended to limit the present invention, and a portion of the processing may be performed by the base unit 3 or other expansion units 4b, or may be performed by an external device (analyzer) communicatively connected to the programmable logic controller.

[0093] In S21, the CPU 41a judges whether the time series data to be classified is a device value of a bit device. When the device value is a device value of a bit device, the process proceeds to S22; otherwise, the process proceeds to Figure 13B S27.

[0094] In S22, the CPU 41a determines whether the value of the time series data to be classified has changed. If there has been a change, the process proceeds to S24, while if there has been no change and the value is constant, the process proceeds to S23. In S23, the CPU 41a classifies the time series data to be classified as a device that uses a constant value (1203) and ends the process. As classification information, information associated with the time series data is stored, for example, label information indicating the classification type is stored in association with the time series data or discrimination information indicating the device corresponding to the time series data. As described in this way, the label information of the type classified during the classification in the learning phase and the discrimination information of the device are associated and stored in advance. Therefore, in the evaluation phase, it is possible to easily select the evaluation variables or parameters of the abnormal device detection algorithm based on the type associated with the discrimination information of the device, depending on which device the time series data to be verified is from. That is, in the evaluation phase, the process of identifying which type the time series data to be verified corresponds to can be omitted. Although the label information indicating the classification type has been shown as an example of classification information, algorithm information indicating the algorithm for identifying abnormal devices can be used instead of the label information. When a device corresponding to time series data is a variable, it goes without saying that the discrimination information stored as the classification information is discrimination information indicating the variable.

[0095] In S24, when there is a change in the value of the time series data, the CPU 41a determines whether the change is a stable change pattern in each cycle. When it is determined that the pattern is a stable change pattern, the process enters S25, and when it is determined that the pattern is not a stable change pattern, the process enters S26. Here, the stable change pattern indicates a pattern that changes in the same pattern in each cycle. As described above, the stable change pattern is a pattern in which the value of the time series data changes in each cycle, and since it is the same fixed pattern during each cycle, it is also called a fixed change pattern. In S25, the CPU 41a classifies the device as a device that operates in a predetermined cycle and ends the process. As described above, the device that operates in a predetermined cycle includes a device (1201) that operates synchronously with the operating cycle of the device and a device (1202) that operates synchronously with a cycle outside the operating cycle of the device, and the CPU 41a classifies the device into each device. On the other hand, in S26, the CPU 41a classifies the device as a device that operates irregularly (1204) and ends the process.

[0096] Note that the CPU 41a can specify the operating cycle of the device or a cycle other than the operating cycle of the device based on the change in the value of the time series data related to the specific device. For example, the device value of the specific device has a pulse within each operating cycle of the device and is collected as time series data with a change point that defines the start timing of each operating cycle. That is, the value of the specific device changes synchronously with the operating cycle of the device, and the change point defines the operating cycle. Such a specific device can be set by the operator's selection. Similarly, a device that defines a cycle other than the operating cycle can also be set by the operator's selection. Naturally, the operating cycle of the device can be automatically specified from the collected time series data, or can be adjusted by the operator after identification. Therefore, the operator can be further supported, and a user-friendly operating system can be provided even for inexperienced operators. In addition, a device that operates with a cycle other than the operating cycle can be defined as a device that operates irregularly based on the operating cycle, and for example, when a device that specifies a cycle other than the operating cycle is not set, the CPU 41a classifies the device that operates with a cycle other than the operating cycle as a device that operates irregularly (1204).

[0097] On the other hand, when it is determined in S21 that the device is not a bit device, the process proceeds to step Figure 13B In S27 shown, the CPU 41a determines whether the time series data to be classified has changed by a predetermined value or more. Here, it is determined whether the extreme value of the change signal is equal to or greater than the predetermined value. When there is a change, the process proceeds to S28; otherwise, the process proceeds to S212.

[0098] In S28, the CPU 41a determines whether the value has changed at a predetermined cycle. If it has not changed at a predetermined cycle, the process proceeds to S29. If it has changed at a predetermined cycle, the process proceeds to S210. In S210, the CPU 41a determines whether the change value is monotonically increasing or monotonically decreasing. If the change value is monotonically increasing or monotonically decreasing, the process proceeds to S211; otherwise, the process proceeds to S29.

[0099] In S29, the CPU 41a classifies the device as a device with an analog value (1205) and ends the processing. There are various types of analog value devices, and separate correspondence is performed according to the type of device to be classified. On the other hand, in S211, the CPU 41a classifies the device as a device with a monotonically increasing or monotonically decreasing value (1206) and ends the processing. In S212, the CPU 41a classifies the device as other devices and ends the processing. When it is determined that the device is other devices, the features of the time series data to be classified cannot be extracted, and the feature operation during normal operation cannot be identified, so that the device is not used when identifying an abnormal device.

[0100] As described above, the CPU 41a automatically categorizes the devices to be classified based on the time-series data to be classified. However, in addition to this, the CPU 41a can also receive settings for the type of devices to be classified from the operator. The CPU 41a receives the settings for the type of devices to be classified based on the operator's designation. The CPU 41a then stores tag information indicating the classification type in association with the discrimination information indicating the device to be classified. The settings for the type of devices to be classified can be made before the CPU 41a performs classification. For example, when the type of a specific device among multiple devices to be classified is set based on the operator's designation, the CPU 41a does not need to perform classification based on the time-series data to be classified for the device whose type has been previously set. Alternatively, the CPU 41a can perform classification based on the time-series data to be classified for other devices among the multiple devices to be classified that have not yet been designated by the operator. In particular, if the type of a device has already been determined through previous learning and additional learning is performed, the device type can be fixed based on the operator's designation through the previous learning. For devices that require change, a device type different from the previously determined device type can be determined based on the operator's designation through the previous learning. For example, a type that is not used in identifying abnormal devices may be determined.

[0101] The type of device to be classified can be set after the CPU 41a has classified the device. For example, the CPU 41a automatically classifies multiple devices based on the time-series data to be classified. The CPU 41a can then update the automatically classified type of a device that has already been assigned a type by the operator to the type already set for the device to be classified based on the operator's designation. Therefore, even if the time period of the time-series data to be automatically classified is short or there is an imbalance within the time period, by combining it with information known to the operator, the device to be classified can be effectively brought closer to the desired category.

[0102] <Learning Stage>

[0103] Figure 15 The following illustrates the processing used when analyzing collected time series data, classifying the time series data based on the characteristics of each device, and determining a detection algorithm. The processing described below is implemented by the CPU 41a of the expansion unit 4a. However, this is not intended to limit the present invention, and some of the processing may be performed by the base unit 3 or other expansion units 4b, or by an external device (analyzer) communicatively connected to the programmable logic controller.

[0104] The timing for starting the learning phase is, for example, when a predetermined period of time has passed since the previous learning process, when a predetermined amount of time-series data has been collected, or when a user instruction is received. When the learning phase starts, the CPU 41a (collection unit 52c) collects time-series data from the device to be collected according to the set collection settings (S2).

[0105] In S31, the CPU 41a performs classification processing. For example, when a predetermined amount of collected data is stored in the memory card 44 of the basic unit 3, the extension unit 4a performs classification processing in response to an instruction from the basic unit 3. The basic unit 3 can detect that a predetermined amount of collected data has been saved in the memory card 44 and send an instruction to start classification to the extension unit. This start can be performed by the extension unit detecting that an amount of data sufficient for learning (time series data in a predetermined number of scanning cycles) has been accumulated in a storage unit such as a buffer memory or a memory card. Figure 13A and 13B The classification process is described in detail and therefore will not be described again here.

[0106] Subsequently, in S32, the CPU 41a determines the parameters used when identifying abnormal devices based on the time series data classified in S31, and ends the process. Here, the process is performed for each classification type, and the type and parameter of the device corresponding to the time series data are stored in association with each other. When there are already determined parameters, the parameters can be updated to the parameters determined this time to replace the already determined parameters, or the parameters already determined and the parameters determined this time can be used to calculate and update new parameters. Various methods such as average values ​​can be applied to the calculation method, and a method suitable for each time series data can be selected. The determined parameters can be changed by the operator. Therefore, even when determining extreme value parameters when the learning time period is short, adjustments can be made.

[0107] Here, the parameters determined in S32 will be described. Figure 12 For types 1201 and 1202 (each device whose value changes in a stable pattern in synchronization with a predetermined cycle), for example, the CPU 41a calculates the time between arbitrary change points in the waveform of each operating cycle of the device based on the change pattern of the waveform within the operating cycle of the device, and determines the threshold value of the time between the change points as a parameter based on the time distribution between the change points. In addition, the parameters in this case may include the timing of device value changes in the time series data during normal operation.

[0108] The threshold value for the time between change points as a parameter described above can be determined, for example, by calculating the standard deviation and average value based on the change during learning, setting the average value + 3 × the standard deviation as the upper threshold value, and the average value - 3 × the standard deviation as the lower threshold value. For a 1203 type (a device employing a constant value), the CPU 41a uses this constant value as a parameter. As described above, for a device whose value changes in a stable pattern in synchronization with a predetermined cycle, the time interval between change points, the timing of the change points, and the threshold value associated therewith are used as parameters.

[0109] For type 1205 (simulated value), for example, the value of the time series data during learning and a threshold value related to the distance from the time series data during learning can be used as parameters. The distance calculation method can be, for example, a method for obtaining the sum of the differences of each point. In this case, when evaluating, the distance between the time series data during learning and the time series data during evaluation is calculated, and it is determined whether the distance is within the range of the threshold. For type 1206 (monotonically increasing, monotonically decreasing), for example, the increase value during monotonically increasing during normal times and the decrease value during monotonically decreasing during normal times are determined as parameters.

[0110] As described above, according to this embodiment, each device is classified into one of multiple predetermined types based on the periodic characteristics of its time series data, and a detection algorithm suitable for abnormalities (variations from normal) in each classification type is applied. Specifically, in this embodiment, during the learning phase, devices are classified into one of multiple predetermined types based on their normal (learning) time series data. Furthermore, a detection algorithm is determined for each type, and evaluation variables and parameters corresponding to each detection algorithm are set. Meanwhile, during the evaluation phase, for each device for which a detection algorithm was determined during the learning phase, the detection algorithm, determined based on the type of device being evaluated, is applied to the device's time series data. Thus, abnormal devices are identified by analyzing the device's time series data using the detection algorithm for abnormal devices corresponding to the device type determined during the learning phase. Note that devices not classified into the predetermined types during learning are preferably not included in the collection of data during the evaluation phase, as no evaluation variables or parameters are set. In other words, the above is intended to prevent the following situation: even if such data is collected, the lack of a detection algorithm to identify whether the device is an abnormal device would unnecessarily increase processing load and memory resource consumption.

[0111] <Evaluation Phase>

[0112] Figure 16 4. It is a flowchart showing the processing procedure when identifying an abnormal device. The processing described below is implemented by the CPU 31 of the basic unit 3 and the CPU 41a of the expansion unit 4a. However, it is not intended to limit the present invention, and a part of the processing can be performed by the basic unit 3 or other units such as the expansion units 4a, 4b, etc., or can be performed by an external device (analyzer) communicatively connected to the programmable logic controller. Here, as a series of processing, the processing for obtaining a device value, saving the device value from a buffer memory to a memory card 44 when a save condition is met, and performing an identification process is described as a series of processing. Therefore, the processing of the basic unit 3 for obtaining a device value and storing the device value in the memory card 44 and the processing of the expansion unit 4a for obtaining a device value saved by the basic unit 3 to the memory card 44 and performing an identification process are shown as a series of processing. That is, the CPU 31 (collection section 52a) of the base unit 3 performs processing for saving the device value when the saving condition is satisfied (S41 to S46 below), and the CPU 41a of the expansion unit 4a performs processing for identifying an abnormality by using the device value saved in the memory card 44 (S47 and S48). Naturally, the processing in S41 to S48 or a part thereof may be executed by other units.

[0113] Here, the saving conditions for storing the device values ​​saved in the buffer memory (first buffer 37a) of the base unit 3 in the memory card 44 will be described. For example, the saving conditions are conditions that are satisfied when an abnormality occurs in the PLC, when a device as a saving trigger is previously specified by the user and the device value of the device has a predetermined change, when an analysis command is issued by the user, when a monitoring cycle for periodic monitoring has elapsed, and when an analysis command is issued from an expansion unit connected to the base unit 3. These saving conditions may be conditions set by the user, transmitted and stored as project data, conditions input by the user during operation of the PLC, conditions based on information generated from the expansion unit 4, or some other conditions.

[0114] In S41, the CPU 31 determines whether a collection condition has been satisfied. The collection condition is a condition that is satisfied, for example, when a previously determined collection cycle has elapsed or when each scan ends.

[0115] In S42, the CPU 31 of the base unit 3 obtains Figure 11 The device value collected in S4 is obtained, and in S43, it is determined whether the acquired device value is the same as the device value previously stored in the first buffer 37a. When the device value is the same value, the process returns to S41 to proceed to the process of the next device value. On the other hand, when the device value is different from the previously stored device value, the process proceeds to S44.

[0116] In S44, the CPU 31 stores the acquired device values ​​in the first buffer 37a and then proceeds to S45. In this manner, the collection unit 52a acquires device values ​​(and time information) for each collection cycle (e.g., scan cycle) set by the collection setting 36a and stores the device values ​​in the first buffer 37a. Note that a ring buffer is preferably used as the first buffer 37a. This is because, considering memory resources, not all data stored in the first buffer 37a is collected as log data (collected data).

[0117] In S45, the CPU 31 determines whether the saving conditions for saving the device value stored in the first buffer 37a to the memory card 44 of the base unit 3 are met. The saving conditions are set to be met, for example, when an abnormality occurs during the operation of the programmable logic controller. As described above, the saving conditions can be set to be met at times other than when a PLC abnormality occurs, and processing can be performed to identify whether the device value is abnormal. In other words, "device value abnormality" does not necessarily indicate a PLC abnormality, but can simply indicate a value that differs from the normal device value. Therefore, conceivable examples of satisfying the saving conditions other than when a PLC abnormality occurs include: the timing of generating a device value that differs from the normal value; the timing of receiving a monitoring instruction from the user; and a specified timing for determining an abnormality after receiving a monitoring instruction from the user, after a predetermined execution cycle has further elapsed, or periodically. These details will be described later in the second and third embodiments. Note that at least one of the functions described in the first to third embodiments may be provided.

[0118] If the save condition is met, in S46, the CPU 31 of the base unit 3 retrieves the time series data to be evaluated from the first buffer 37a of the base unit 3 to identify abnormal devices and saves the time series data to the memory card 44. The data to be evaluated is data for all devices by default, and can be selected according to the operator's instructions or according to the type of abnormality. The time series data may include time series data for the period from a point before the occurrence of the abnormality by a predetermined period of time to a point after the occurrence of the abnormality by a predetermined period of time. Alternatively, the data may be data for the predetermined period of time after the occurrence of the abnormality.

[0119] Next, in S47, the CPU 41a of the expansion unit 4a identifies abnormal devices based on the device types corresponding to the time-series data determined during learning, using the optimal detection method for each type and the evaluation variables and parameters corresponding to the detection method. As described above, according to this embodiment, during learning, the characteristics of device value changes are extracted, each device value is classified into a previously determined type, and a detection method suitable for abnormalities (variations that differ from normal) in each type of classified device is applied. That is, in this embodiment, during the learning phase, device values ​​are classified based on normal time-series data, a detection method is determined based on each type, and evaluation variables and parameters corresponding to each detection method are set. Meanwhile, during the evaluation phase, in S47, abnormalities are identified by applying evaluation variables and parameters to the device time-series data and analyzing the evaluation variables and parameters, where the evaluation variables and parameters are determined based on the detection algorithm for each device type classified during the learning phase. As described above, when classifying the time-series data type, the label information for that type and the discrimination information for the device corresponding to the time-series data are stored in association with each other. Therefore, in S47, the CPU 41a discriminates the corresponding type from the discrimination information of the device as the acquisition destination of the time series data to be evaluated, and identifies the abnormal device by using the evaluation variables and parameters of the detection algorithm corresponding to the type. The judgment method is performed by the above method according to each parameter.

[0120] Here, reference Figure 17 , the judgment method when identifying an abnormal device will be described. Reference numerals 1701 and 1702 represent data of abnormal devices of type 1201 and 1202 (devices whose values ​​change in a stable pattern in synchronization with a predetermined period). Reference numerals 1711 and 1712 represent abnormal parts. As described above, when there is a device in which the signal to be changed does not change, the change point is offset, or the pulse width is different compared to normal, the device can be identified as an abnormal device. CPU 41a can distinguish data that is different from the change in normal times by using the determined detection algorithm. Reference numeral 1703 represents data of an abnormal device of type 1203 (the device adopts a constant value). As shown in 1713, the signal that should adopt a constant value has changed, so the device can be identified as an abnormal device.

[0121] Reference numeral 1704 represents an algorithm for identifying abnormal devices using time series data from two devices of the same type (devices whose values ​​change in a stable pattern in synchronization with a predetermined cycle) classified as types 1201 and 1202. In this algorithm, the time intervals between the points at which the values ​​of the two devices change in synchronization with the predetermined cycle are examined. For example, suppose one device has two change points (a1, a2) in one cycle, while the other device has four change points (b1, b2, b3, b4) in one cycle. In this case, it is possible to determine whether the time difference between each change point is within a threshold value range. More specifically, the time difference between change point a1 and each of change points b1 to b4, as well as the time difference between change point a2 and each of change points b1 to b4, can be determined using respective threshold values ​​to determine whether the device is an abnormal device. The parameters in this case are the threshold value for the time difference between the change points, the timing of each change point, and the threshold value for the timing of each change point. When this determination method is used to identify abnormal devices, both devices are identified as abnormal devices.

[0122] Description Back to Figure 16 Then, in S49, the CPU 41a outputs the recognition result of S48 and ends the processing. Here, the generating unit 74 first generates display data for displaying the recognition result, and the display data is displayed on the display unit 5 of the base unit 3, or is sent to an external device and displayed on its display unit. Here, reference will be made later to Figure 18 Describes a display based on display data.

[0123] Figure 18 Shows a display example of the recognition result.

[0124] Screen 1800 shows time on the horizontal axis and the number of abnormal devices on the vertical axis. Generator 74 generates the display data for screen 1800 based on the identification results and the time series data at that time, from the devices identified as abnormal devices. When an abnormality occurs in a programmable logic controller, the facility stops, and the number of abnormal devices tends to increase. Therefore, as shown in screen 1800, by displaying the cumulative number of abnormal device occurrences for each time interval of a predetermined period (e.g., every five minutes), the operator can easily identify when the abnormality occurred.

[0125] Screen 1810 shows the status of each device identified as abnormal. For each device, the time the abnormality occurred and the details of the abnormality are displayed. The information that led to the abnormality is displayed as the details of the abnormality. For example, in device A, a device using a constant value, the normal value is 123, but this value changes to 127, thus identifying the device as abnormal. In device B, which changes synchronously with a predetermined cycle, the interval of change at which the abnormality occurred is displayed.

[0126] Screen 1820 shows the degree of abnormality of the device being evaluated. Generator 74 generates display data for ranking and displaying the degree of abnormality of the device being evaluated based on the identification results. Specifically, screen 1820 displays candidate devices with a high likelihood of abnormality, distinguishable by device name, etc. In addition to the degree of abnormality, details of the abnormality and the classification of the device can also be displayed. Here, for example, the degree of abnormality is determined by the number of abnormalities that have occurred and the size of the difference from a predetermined threshold. That is, the degree of abnormality indicates the magnitude of the abnormality. Screen 1820 shows an example of a display in descending order of the degree of abnormality, but the display can also be sorted based on conditions such as the order of occurrence time. Furthermore, sorting can be performed based on the classification method for the device, or only the details of the abnormality related to the classification method pre-selected by the user can be displayed. For example, the degree of abnormality can be obtained using the following equation using a predetermined threshold.

[0127] Abnormality degree = (current value - average value) / (threshold value - average value). That is, the abnormality degree is defined as follows based on the current value: when the current value exceeds the upper threshold value, the abnormality degree is 1 or greater. When the current value is equal to the upper threshold value, the abnormality degree is 1. When the current value is equal to the average value, the abnormality degree is 0. When the current value is equal to the lower threshold value, the abnormality degree is -1. When the current value is lower than the lower threshold value, the abnormality degree is -1. The abnormality degree can be an absolute value. In addition, when the current value is not equal to the predetermined value to be compared, the abnormality degree can be uniformly set to 1.

[0128] Screen 1830 is an example of displaying the signals of the device in normal and abnormal conditions so as to enable comparison. As shown in screen 1830, it is desirable to highlight the abnormal portion. Figure 18 In the example of , the vicinity of the signal at the abnormal portion is displayed as being surrounded by a dotted frame, but the signal at the abnormal portion may be displayed in a color different from other colors, or the portion may flash.

[0129] <Additional Learning>

[0130] Figure 21 is a flowchart showing the processing procedure used when performing additional learning. Here, additional learning is performed in conjunction with reference Figure 15 The learning process described in the learning phase is additionally performed at different timings of the learning. For this timing, various timings are assumed, but as described later, it can be a situation where a predetermined device is normal but is identified as abnormal in the evaluation phase, a timing specified by the operator, and a regular timing for coping with changes in the system over time, etc. That is, additional learning is learning that is additionally performed at a timing when the learning model (such as the parameters for identifying abnormal devices determined in S32, etc.) needs to be updated. The processing described below is implemented by the CPU 41a of the expansion unit 4a. However, it is not intended to limit the present invention, and a part of the processing may be performed by the basic unit 3 or other expansion units 4b, or may be performed by an external device (analyzer) communicatively connected to the programmable logic controller.

[0131] In S201, the CPU 41a (collection unit 52c) collects time series data for devices targeted for collection when the device is operating normally, according to the set collection settings. The devices targeted for collection include multiple devices that were the subject of judgment in the evaluation phase. Furthermore, devices that were not the subject of judgment in the evaluation phase can be excluded from the devices targeted for collection. For example, devices classified as irregularly operating devices (1204) can be excluded from the devices targeted for collection.

[0132] Here, the time series data of the device that is the object of collection when the device is operating normally is the time series data of the device that is judged to be abnormal even if the judgment result in the evaluation phase should be judged to be normal. For example, when learning is insufficient in the learning phase, the judgment result in the evaluation phase may be abnormal. Therefore, when the judgment result of the time series data to be collected becomes abnormal despite the normal operation of the device, the CPU 41a can perform additional learning. Even if the judgment result in the evaluation phase is abnormal and the time series data when the abnormality (a state different from the usual) occurs is collected, in the case where the time series data includes time series data corresponding to the time period of normal operation, such time series data corresponding to the time period of normal operation also corresponds to the time series data of the device to be collected when the device is operating normally. At this time, when the judgment result of the time series data corresponding to the time period of normal operation is abnormal, this part can be used to perform additional learning.

[0133] Then, in S202, the CPU 41a determines whether the additional learning condition has been met, that is, whether the timing for additional learning has been reached. The timing for starting additional learning is, for example, the timing when a predetermined period of time has passed since the previous learning process, the timing when a predetermined amount of time series data has been collected, or the timing when an instruction from the user is received. In addition, the timing for starting additional learning may be a predetermined timing evaluated as normal operation of the device in the evaluation phase or a timing evaluated as abnormal operation of the device in the evaluation phase. There are situations where it may be effective to update (perform additional learning) instead of one learning after a certain period of time to improve accuracy, such as a situation where the operation of the device is sometimes slow but the slow operation is within the normal range or a situation where the operating time changes (changes over time) due to changes in air pressure when the power of the device is turned back on.

[0134] In S311, the CPU 41a determines whether each of the plurality of devices set as collection targets is a determination target in the evaluation phase. If the CPU 41a determines that the device is a determination target, the process proceeds to step S312 to perform additional learning on the device. If the CPU 41a determines that the device is not a determination target, the process proceeds to step S341 without performing additional learning on the device. For example, if the CPU 41a determines that a device classified as an irregularly operated device (1204) is not a determination target, the process proceeds to step S341 without performing additional learning.

[0135] In S312, CPU 41a performs classification processing. For example, when a predetermined amount of collected data is stored in the memory card 44 of the basic unit 3 after the power is turned on again, the extension unit 4a performs classification processing in response to an instruction from the basic unit 3. The stored predetermined amount of collected data is the time series data of each device collected during the target time period of the additional learning. The basic unit 3 can detect that a predetermined amount of collected data has been saved in the memory card 44, and sends an instruction to start classification to the extension unit. After the power is turned on again, the start can be performed by detecting that an amount of data sufficient for learning (time series data in a predetermined number of scanning cycles) has been accumulated in a storage unit such as a buffer memory (first buffer 37a) or a memory card 44.

[0136] Specifically, in S312, the CPU 41a automatically classifies the device to be classified based on the characteristic amount of the time series data of the type and device determined until the previous time and the time series data to be classified and collected this time. For example, through previous learning, the CPU 41a is classified as a device (1203) type that adopts a constant value, and when the time series data collected for the normal operation of the device this time includes a value different from the constant value, the classification is updated to a device (1204) that operates irregularly. Here, the characteristic amount of the device (1203) that adopts a constant value corresponds to the constant value. Similarly, when the device has been classified as a device (1201) that operates synchronously with the operating cycle of the device through previous learning and the time series data collected for the normal operation of the device this time includes a pattern different from the previous learning, the CPU 41a updates the classification to a device (1204) that operates irregularly. Here, the characteristic amount of the device (1201) that operates synchronously with the operating cycle of the device corresponds to the change pattern of the waveform within the operating cycle of the device, that is, the change pattern of the time series data. As the classification is updated, the detection algorithm determined according to the updated type is also updated. In addition, the corresponding parameters are updated according to the updated detection algorithm in S324 and S334 described later.

[0137] Note that the CPU 41a automatically classifies the devices to be classified based on the time-series data to be classified, but in addition to this, the CPU 41a can receive settings for the types of the devices to be classified. Among the devices to be classified, the types of many devices do not need to be changed, and even for types that need to be changed, the operator can know which device should be changed to which type. Therefore, the CPU 41a receives settings for the types of the devices to be classified based on the operator's designation and stores tag information indicating the classification type in association with the discrimination information indicating the device to be classified. Alternatively, a device can be classified as an irregularly operating device (1204) based on the operator's designation, and the device can be excluded from the judgment object in the evaluation phase. The type setting of the device to be classified can be performed before the CPU 41a classifies. For example, when the type setting is performed for a specific device among the multiple devices to be classified based on the operator's designation, the CPU 41a does not classify the device whose type was previously set based on the time-series data to be classified. On the other hand, the CPU 41a performs classification based on the time-series data to be classified for other devices among the multiple devices to be classified that are different from the specific device. In particular, if the device type has already been determined through previous learning and additional learning is performed, the device type can be fixed based on the operator's designation through the previous learning, and for a device that needs to be changed, a device type different from the device type can be determined based on the operator's designation through the previous learning. For example, a type that is not used when identifying abnormal devices can be determined.

[0138] In S321, the CPU 41a determines whether the type of the device determined by the previous learning is maintained in the reclassification of S312. When the CPU 41a determines that the type of the device determined by the previous learning is maintained, the processing enters S322 to determine the parameters. On the other hand, when it is determined that the type of the device determined by the previous learning is not maintained, that is, when it is determined that the type of the device has been reclassified and updated, the processing enters S323, and the CPU 41a determines whether the device is a judgment object in the evaluation phase based on the update result of the classification processing. When the CPU 41a determines that the device is a judgment object, the processing enters S324 to determine the parameters of the device, and when the CPU 41a determines that the device is not a judgment object, the processing enters S341. For example, the CPU 41a determines that the device classified as the device (1204) that does not operate regularly is not a judgment object and terminates the additional learning, and the processing enters step S341.

[0139] In S322, the CPU 41a calculates and updates a new parameter by using the parameter that has been determined for the target device and the time-series data of the normal operation time that is collected this time, and the process proceeds to S331. For example, when a device that operates in synchronization with the operation cycle of the equipment (1201) is determined through previous learning and the type of the device is maintained, the CPU 41a calculates and updates a new upper limit threshold value and a new lower limit threshold value based on an upper limit threshold value and a lower limit threshold value that indicate a time change between the time-series data determined through previous learning and an arbitrary change point between the time-series data of the normal operation time that is collected this time. Thus, the new upper limit threshold value and the new lower limit threshold value are calculated and updated based on the time between the arbitrary change points of the time-series data of the normal operation time that is collected this time and the upper limit threshold value and the lower limit threshold value, so that the width of the updated threshold value is widened or narrowed according to the time change between the arbitrary change points of the time-series data of the normal operation time that is collected this time and the degree of deviation from the threshold value.

[0140] In S324, the CPU 41a calculates and updates a parameter corresponding to the updated type by using the time-series data of the normal operation time that is collected this time, and the process proceeds to S331. The parameter calculated and determined here can be obtained by the same calculation method as the parameter determined in S32 of FIG. 12. For example, various methods such as an average value can be applied to the calculation method, and a method suitable for each time-series data is selected. The determined parameter can be changed by an operator. Thus, even if an extreme value parameter is determined in the case where the learning period is short, adjustment can be made. Figure 15

[0141] In S331, the CPU 41a determines whether a correction input for classification has been received from the operator for each device. For example, the CPU 41a can accept a setting of the type of the device to be classified and correct the classified type according to the designation of the operator, and the CPU 41a determines whether the classification has been corrected based on such a correction input from the operator. When the CPU 41a determines that a correction input for classification has not been received from the operator for each device, the process proceeds to S333.

[0142] ​On the other hand, when it is determined that a correction input for classification has been received from the operator, the process proceeds to S332, and the CPU 41a determines whether the correction is appropriate for the type of the device to be classified corresponding to the operator's designation, and when it is determined that the correction is appropriate, the CPU 41a reflects the correction to the type of classification set according to the operator's designation. That is, the CPU 41a determines whether the time series data collected during normal operation this time is appropriate for the type of classification set. In addition, when it is determined that the type of classification set according to the operator's designation is not appropriate, the CPU 41a can notify that the type is not appropriate, or can urge re-designation of the classification while notifying that the type is not appropriate. For example, when a device has been classified as a device (1203) type that uses a constant value according to the operator's designation and the time series data collected during normal operation this time includes a value different from the constant value, the CPU 41a can notify that the type set by the operator is not appropriate, or can reclassify the device as a device that operates irregularly (1204). Similarly, when the device is classified as a device operating in synchronization with the operating cycle of the equipment according to the operator's designation (1201) and the time series data collected during normal operation this time includes a different pattern, the CPU 41a can notify the operator that the type set by the operator is inappropriate, or can reclassify the device as a device operating irregularly (1204). When the processing of S332 ends, the CPU 41a returns the processing to S321 again to determine the parameters based on the corrected classification.

[0143] In S333, CPU 41a determines whether the operator has input parameter correction for each device. For example, CPU 41a can further adjust the parameters updated in S322 or S324 according to the operator's correction input. When it is determined that the operator's correction instruction for the parameter has not yet been received, the process enters S341. On the other hand, when the operator has made a correction instruction for the parameter, CPU 41a determines in S334 whether the time series data collected during normal operation this time is suitable for the setting parameters for the device to be classified corresponding to the operator's designation. When it is determined that the data is suitable, CPU 41a will reflect the correction to the parameters set according to the operator's designation. When it is determined that the correction of the parameters set according to the operator's designation is inappropriate, CPU 41a can notify that the correction is inappropriate, or can urge the re-designation of the parameters while notifying that the correction is inappropriate. Note that CPU 41a can calculate the parameters using the same calculation method as in S32.

[0144] Subsequently, in S341, the CPU 41a determines whether the additional learning processing is completed for all of the devices to be learned. When the additional learning processing is not completed for one of the devices to be learned, the CPU 41a returns the processing to S311 to perform the additional learning processing for the device for which the processing is not completed. On the other hand, when the additional learning processing is completed for all of the devices to be learned, the CPU 41a ends the additional learning processing.

[0145] <Modification>

[0146] The present application is not limited to the above-described embodiments, and various modifications are possible. For example, in the above-described embodiments, an example of analyzing and classifying the collected data of the bit device and the word device has been described, but the present application is not limited to only such device values. For example, the collected data is not limited to the example described in the above-described embodiments, but can be information such as a camera image or an event log.

[0147] Figure 19 A modification of the collected data will be shown. Here, a case where the collected data is a camera image (moving image) will be described. Reference numeral 1901 denotes a camera image to be collected. This is a captured image of a predetermined position in a factory facility. For example, the CPU 41a can divide these camera images 1901 into a plurality of regions, and determine the parameters by using the luminance values in the respective regions as the characteristic amounts. The camera image 1901 shows a state in which a belt conveyor 1904 conveys a plurality of products 1905 at equal intervals. In this case, as shown in 1902, it is possible to judge whether the normal operation is performed or not by utilizing the fact that the luminance values in a predetermined region 1903 change with time. For example, in the hatched portion of the camera image 1901, since the products pass at predetermined time intervals, the image (luminance value) of the products is periodically interrupted. By using such a change in the luminance value, it is possible to confirm whether the products are flowing normally or the products are skewed on the belt conveyor by monitoring a plurality of regions. In Figure 19 In the above-described embodiments, the case where the products are conveyed on the belt conveyor has been described as an example, but for example, when an image of a position of a driving robot is captured, and the image of the arm portion is periodically interrupted from a predetermined image region in accordance with the operation of the robot arm, it is possible to check whether the robot is operating normally. Note that the camera image can be classified as a device that employs an analog value.

[0148] <Second Embodiment>

[0149] A second embodiment of the present application will be described below. In the first embodiment, the processing flow in the case where the PLC basically shows an abnormality, that is, when the saved condition is an abnormality of the programmable logic controller, was mainly described. However, as described above, the present application is not limited to the recognition function for recognizing an abnormal device by using the occurrence of an abnormality in the PLC as a trigger, and can also be applied to the processing for analyzing the difference from the time series data at normal times (analysis function). Therefore, in the present embodiment, the processing for analyzing and verifying whether the collected device values are values deviating from the time series data at normal times (device values different from usual) will be described. In the following description, only the different parts from the first embodiment will be described.

[0150] Also in the present embodiment, the changed features in the device values are extracted and classified, and a detection algorithm for an abnormality (change different from usual) is applied, which is suitable for each classified feature. That is, also in the present embodiment, as in the first embodiment, in the learning phase, the device values are classified from the time series data at normal times, the detection algorithm is determined for each type, and the evaluation variable and the parameter corresponding to each detection algorithm are set. Also in the present embodiment, these learning phases are performed in advance before the evaluation phase is executed, and the flag information indicating the classified type and the discrimination information of the device corresponding to the time series data are stored. In the evaluation phase, the detection algorithm determined in accordance with the type of the time series data to be evaluated is applied to analyze and verify whether the device values are different from usual. That is, the classification processing is not performed again in the evaluation phase. In this case, the processing failure of the classification processing in operation or the unexpected update of the learning data can be avoided. Note that the classification processing can also be performed in the evaluation phase. In this case, the time series data that can be regarded as normal can also be extracted from the newly obtained time series data based on the already learned data at normal times, and the learning data can be updated in response to the change over time based on the newly extracted time series data and the already learned time series data. For example, for a device whose value changes in a stable pattern in synchronization with a predetermined period, the threshold included in the parameter can be updated based on the change of the newly extracted time series data and the already learned time series data.

[0151] Reference Figure 16 The processing procedure when verifying whether the device values are different from the usual device values, that is, whether the device values deviate from the device values at normal times, will be described. The processing described below is implemented by the CPU 31 of the basic unit 3 and the CPU 41a of the extension unit 4a. Note that only the processing different from that in the first embodiment (S45) will be described, and the other processing will not be described.

[0152] In S45, the CPU 31 determines whether the save condition for saving the device value stored in the first buffer 37a to the memory card 44 of the base unit 3 is satisfied. In the first embodiment, the save condition is described as being satisfied when an abnormality occurs in the programmable logic controller. However, in this embodiment, control is performed so that the save condition is satisfied in the following situations: when the user pre-designates a device to be used as a save trigger and a predetermined change occurs in the device; when the user issues an analysis command; when a period of regular monitoring has elapsed; when an analysis command is issued from an expansion unit connected to the base unit 3; and when the collected device value differs from normal. For example, if a device value different from the previous device value is generated in S43, it can be determined in S45 that the save condition has been satisfied, and the process can enter the recognition process. Alternatively, the save condition can be controlled so that it is satisfied based on the difference (degree of divergence) from the previous device value or the number of device values ​​that differ from normal conditions. The analysis instruction from the user can instruct real-time analysis and verification of a specific device, or it can instruct verification of past data for a specific device. In S47 , an abnormal device is not identified, but an abnormal state that deviates from the time series data of the normal state is analyzed and verified.

[0153] Next, refer to Figure 18 This section describes an example display of the analysis results according to this embodiment. Formally, the display is the same as the identification results of the first embodiment, but in this embodiment, instead of identifying abnormal devices, it identifies states where time series data deviates from normal (abnormal states) and changes the display accordingly.

[0154] Therefore, for example, screen 1800 does not indicate the number of device anomalies, but rather indicates the number of deviations from the normal time series data. In this embodiment, it is preferable to obtain the degree of abnormality by using the number of abnormal state occurrences (i.e., the number of deviations from the normal time series data) rather than the number of device anomalies.

[0155] <Third embodiment>

[0156] The third embodiment of the present invention will be described below. The first and second embodiments have already described the identification and analysis functions. This embodiment will describe a monitoring function for regularly collecting and monitoring device values. The following description will only cover the differences from the first and second embodiments.

[0157] Figure 20 1 is a flowchart showing a process of outputting a monitoring start signal for starting monitoring according to the present embodiment. The following process is executed by the CPU 31 of the base unit 3. However, this is not intended to limit the present invention, and the present invention may be executed by the CPU 41a of the extension unit 4a.

[0158] In S51, the CPU 31 determines whether the monitoring period has elapsed. The monitoring period is a value that can be set by the operator (administrator) of the programmable logic controller and can be set to any time period. This setting value is set, for example, in the collection setting 36a of the storage device 32. If the monitoring period has elapsed, the process proceeds to S53; otherwise, the process proceeds to S52.

[0159] In S52, the CPU 31 determines whether a monitoring instruction has been received from the user. The monitoring instruction may be received through the user input via the operating unit 6 of the PC 2a or the base unit 3. When a monitoring instruction is received from the user, the process proceeds to S53; otherwise, the process returns to S51.

[0160] In S53, the CPU 31 generates a monitoring start signal, outputs the monitoring start signal to the base unit 3, and ends the process. Figure 16 In S46, it is determined that the saving condition has been satisfied, and the processing of S47 and thereafter is executed to perform the analysis processing. Here, the saving condition in S46 is satisfied immediately after the monitoring start signal is received, and the time series data from the predetermined time period to the current storage in the memory card 44 is collected. The saving condition in S46 may be satisfied after a predetermined execution cycle has passed after the monitoring start signal is received, and the time series data stored in the memory card 44 may be collected during the predetermined time period after the monitoring start signal is received. Alternatively, the saving condition in S46 may be satisfied after a predetermined execution cycle has passed after the monitoring start signal is received, and the time series data stored in the memory card 44 may be collected during the predetermined time period before and after the monitoring start signal is received.

[0161] These monitoring data can be selected by the user. As in the second embodiment, in S48, no abnormal device is identified, but abnormal conditions that deviate from the normal time series data are analyzed and verified. For the analysis results, the same display as in the second embodiment is output.

[0162] Summary

[0163] As described above, the programmable logic controller according to this embodiment includes an execution engine that repeatedly executes a user program, and a device memory having multiple devices serving as storage areas for storing data accessed by the execution engine according to the user program. The programmable logic controller collects data held by a plurality of devices, targeted for collection, according to predetermined collection settings, for each scan cycle of the user program. Based on the characteristics of the collected time-series data for each device, the programmable logic controller classifies each device into one of multiple types. For each device, based on the time-series data collected by the collection unit and the type of device classified by the classification unit, the programmable logic controller determines a detection algorithm to be used when identifying the device as an abnormal device. Furthermore, the programmable logic controller analyzes the time-series data collected by the collection unit using the detection algorithm determined for the device based on the type of device classified by the classification unit, thereby identifying an abnormal device. As described above, the programmable logic controller according to this embodiment can effectively identify abnormal devices by analyzing and classifying characteristics such as the periodicity and continuity of data associated with each device.

[0164] The program controller also analyzes the deviation of the collected time series data of each device from the normal time series data by using the determined detection algorithm according to the user's instructions to verify whether an abnormality has occurred. This analysis function (monitoring function) can be performed regularly at a predetermined cycle.

[0165] When time series data for a predetermined number of scan cycles has been accumulated, the programmable logic controller classifies each time series data based on its characteristics and determines and updates the detection algorithm. Thus, as described, according to the present invention, the functions corresponding to the learning phase are periodically executed during operation of the programmable logic controller, and the accuracy of the abnormality identification process can be improved.

[0166] Furthermore, in a programmable logic controller, if there is no change between the values ​​collected in the previous scan cycle and the values ​​collected in the current scan cycle for all devices in the group targeted for collection, the values ​​collected in the current scan cycle are deleted and the collected time-series data is compressed. This allows for efficient use of memory resources.

[0167] The programmable logic controller categorizes multiple devices into at least the following: devices with constant values, devices whose values ​​change in a stable pattern in synchronization with the device's operating cycle, devices whose values ​​change in a stable pattern in synchronization with different periods of the device's operating cycle, devices whose values ​​change irregularly, devices with analog values, and devices whose values ​​increase or decrease monotonically. Furthermore, by determining a feature-based detection algorithm based on these categories, abnormal devices can be effectively identified in the event of an anomaly. Devices whose values ​​change irregularly are less likely to have features extracted, and therefore are not used to identify an anomaly.

[0168] When identifying an abnormal device, the programmable logic controller compares the determined detection algorithm with the characteristics of the time series data corresponding to the detection algorithm, and identifies the device as abnormal when the difference exceeds a predetermined threshold. Furthermore, the programmable logic controller can determine the time difference between the change points of the values ​​in two series of time series data as the detection algorithm used when identifying an abnormality, and when the time difference in the two series of time series data is not within a predetermined range, identify the two devices corresponding to the two series of time series data as abnormal devices. As described above, according to the present invention, the detection algorithm is determined based on each classified type, and in the event of an abnormality, the abnormal device is identified by using the detection algorithm using the method corresponding to each type.

[0169] The programmable logic controller generates display data indicating the recognition result and displays the display data on the display device of the programmable logic controller or transmits the display data to an external device. The recognition result can be displayed on a display screen ( Figure 18 ) on various display screens.

[0170] In the above embodiment, an example has been described in which the expansion unit 4a included in the programmable logic controller collects and classifies time series data, determines a detection algorithm based on this classification, and identifies abnormal devices when an abnormality occurs. However, the present invention is not limited to this, and at least some of the above functions can be implemented by the base unit or other expansion units. In addition, an analyzer (external device) communicatively connected to the programmable logic controller can also implement the above functions.

[0171] The present invention is not limited to the above embodiments, and various modifications and changes can be made within the scope of the spirit of the present invention.< / plc>

Claims

1. A programmable logic controller comprising: Execution engine, used to repeatedly execute user programs; a device memory having a plurality of devices serving as storage areas for storing data accessed by the execution engine in accordance with the user program; a collecting unit configured to collect data held by a device serving as a collection target among the plurality of devices according to a predetermined collection setting for each execution cycle of the user program; a classification unit configured to classify each device into one of a plurality of types based on features of the time series data of each device collected by the collection unit; a determination unit configured to determine, for each device, a detection algorithm to be used when identifying the device as an abnormal device based on the time series data of the device collected by the collection unit and the type of the device classified by the classification unit; as well as an identification unit configured to identify an abnormal device by analyzing the time series data of the device collected by the collection unit using the detection algorithm determined by the determination unit for the device according to the type of the device classified by the classification unit, Among them, the type includes at least two of the following types: a type that adopts a constant value, a type whose value changes in a stable mode in synchronization with the operating cycle of the programmable logic controller, a type whose value changes in a stable mode in synchronization with a cycle different from the operating cycle, a type whose value changes irregularly, a type with an analog value, and a type whose value increases monotonically or decreases monotonically.

2. The programmable logic controller according to claim 1, wherein: The identification unit further identifies abnormal devices by analyzing deviations between the time series data of each device collected by the collection unit and the normal time series data using the detection algorithm determined by the determination unit in accordance with a user instruction or periodically.

3. The programmable logic controller according to claim 1, wherein: When the collecting section accumulates a series of time series data of a predetermined number of scanning cycles, the classifying section classifies each of the time series data based on a feature of each of the time series data, and The determination unit determines and updates a detection algorithm used when identifying anomalies based on a series of time series data classified by the classification unit.

4. The programmable logic controller according to claim 1, wherein: When receiving a user instruction for any device, the classification unit classifies the device according to the user instruction.

5. The programmable logic controller according to claim 1, wherein: When the values ​​collected in the previous scanning cycle and the values ​​collected in the current scanning cycle in a group of one or more devices do not change in all devices in the group that are collection objects, the collection unit deletes the values ​​collected in the current scanning cycle and compresses the collected time series data.

6. The programmable logic controller according to claim 1, wherein: The determination unit excludes the time series data of the device classified by the classification unit as having irregularly changing values, to determine the detection algorithm used when identifying an abnormality.

7. The programmable logic controller according to claim 1, wherein: The identification section identifies an abnormal device by performing analysis using, as a detection algorithm, an evaluation variable for analyzing an abnormal device based on the type of the time series data classified by the classification section and a parameter corresponding to the evaluation variable.

8. The programmable logic controller according to claim 7, further comprising: The additional learning judgment unit is used to judge whether the additional learning conditions are met. When the additional learning determination unit determines that the additional learning condition is satisfied, the classifying section reclassifies each device into one of a plurality of types based on the current type of each device and features of the time series data of each device collected by the collecting section during the target time period for additional learning, and The determination unit re-determines the detection algorithm used when identifying a device as an abnormal device based on the time series data of the device collected by the collection unit for each device during the target time period for additional learning and the type of the device reclassified by the classification unit or the current detection algorithm of each device.

9. The programmable logic controller according to claim 1, wherein: The identification unit compares the detection algorithm determined by the determination unit with features of the time series data corresponding to the detection algorithm, and identifies the device as abnormal if the difference exceeds a predetermined threshold.

10. The programmable logic controller according to claim 1, wherein: The determining section determines the time difference between the change points of the respective values ​​in the two series of time series data as a detection algorithm used when identifying anomalies, and The identification section identifies two devices corresponding to the two series of time series data as abnormal devices when a time difference in the two series of time series data is outside a predetermined range.

11. The programmable logic controller according to claim 1 , further comprising: The output unit is configured to output the candidate device having a high probability of being abnormal as the recognition result in a distinguishable manner.

12. The programmable logic controller according to claim 11, wherein: The output unit displays the devices on the display unit as the recognition result in the order of abnormality degree indicating the size of the abnormality or in the order of the time of occurrence of the abnormality.

13. The programmable logic controller according to claim 11, wherein: The output unit displays the normal time series data and the abnormal time series data of the device identified as the abnormal device on the display unit in a comparable manner as the identification result.

14. The programmable logic controller according to claim 1, wherein: The time series data collected by the collection unit includes image data.

15. The programmable logic controller according to claim 1, wherein: The characteristics of the time series data are characteristics related to periodicity or continuity.

16. The programmable logic controller of claim 1 , further comprising: Basic unit; as well as an expansion unit, which is connected to the base unit, The basic unit includes the execution engine, the device memory and the collection unit, and The expansion unit includes the classification section, the determination section, and the recognition section.

17. The programmable logic controller of claim 1 , further comprising: a setting unit, configured to set a monitoring period of the device; a generating unit configured to generate a monitoring start signal for starting monitoring for each monitoring period set by the setting unit; as well as An analyzing unit is configured to analyze the time series data to be analyzed in the device collected by the collecting unit and the detection algorithm determined by the determining unit according to the monitoring start signal generated by the generating unit, and output the analysis result to the display unit.

18. The programmable logic controller of claim 1 , further comprising: A memory card is configured to temporarily store the time series data of the devices collected by the collecting unit before the time series data is used by the classifying unit and the identifying unit.

19. An analyzer communicatively connected to a programmable logic controller, the programmable logic controller comprising: Execution engine, used to repeatedly execute user programs, a device memory having a plurality of devices as storage areas for storing data accessed by the execution engine according to the user program, and a collecting unit configured to collect data held by a device as a collection target among the plurality of devices according to a predetermined collection setting for each execution cycle of the user program; The analyzer comprises: an acquiring unit, configured to acquire, from the programmable logic controller, the time series data of each device collected by the collecting unit; a classification unit configured to classify each device into one of a plurality of types based on features of the time series data of each device acquired by the collection unit; a determination unit configured to determine, for each device, a detection algorithm to be used when identifying the device as an abnormal device based on the time series data of the device collected by the collection unit and the type of the device classified by the classification unit; an identification unit configured to identify an abnormal device by analyzing the time series data of the device collected by the collection unit using the detection algorithm determined by the determination unit for the device according to the type of the device classified by the classification unit; and an output unit, configured to output the recognition result of the recognition unit, Among them, the type includes at least two of the following types: a type that adopts a constant value, a type whose value changes in a stable mode in synchronization with the operating cycle of the programmable logic controller, a type whose value changes in a stable mode in synchronization with a cycle different from the operating cycle, a type whose value changes irregularly, a type with an analog value, and a type whose value increases monotonically or decreases monotonically.

Images