Information collection device, computer readable recording medium, and information collection method

Abstract

The present invention provides an information collection device, a computer-readable recording medium and an information collection method, which can effectively collect investigative information on the cause of an alarm indicating an abnormality related to a control station used in a factory. The information collection device includes: a receiving unit, which receives an alarm indicating an abnormality related to a control station used in a factory; and a collecting unit, which collects investigative information on the cause of the alarm from a location of the control station determined based on the alarm received by the receiving unit.

Description

Technical Field

[0001] Embodiments of the present invention relate to an information collection device, a computer-readable recording medium, and an information collection method. Background Art

[0002] For example, Patent Document 1 discloses a device for managing alarms indicating abnormalities related to a plant control station.

[0003] Prior art literature

[0004] Patent Document 1: Japanese Patent No. 6604455

[0005] Conventionally, when an alarm is received, an engineer goes to the site to collect information for investigation of the cause of the alarm. In this case, for example, since the movement of the engineer takes time, there are problems such as that appropriate information cannot be collected in time, or such movement is difficult due to environmental conditions, etc. Therefore, there is a demand for efficient information collection technology. Summary of the invention

[0006] An object of the present invention is to efficiently collect information for investigating the cause of an alarm indicating an abnormality related to a control station for a factory.

[0007] An information collection device according to one aspect includes: a receiving unit that receives an alarm indicating an abnormality related to a control station for a factory; and a collecting unit that collects investigative information on a cause of the alarm from a location of the control station specified based on the alarm received by the receiving unit.

[0008] In one aspect, a computer-readable recording medium records an information collection program, and a computer executes the information collection program to receive an alarm indicating an abnormality related to a control station for a plant, and collect information for investigating the cause of the alarm from a location of the control station specified based on the received alarm.

[0009] An information collection method according to one aspect includes: receiving, by an information collection device, an alarm indicating an abnormality related to a control station for a factory; and collecting, by the information collection device, investigative information on a cause of the alarm from a location of the control station specified based on the received alarm.

[0010] According to the present invention, it is possible to efficiently collect investigative information indicating the cause of an abnormal alarm related to a control station for a factory. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a diagram showing an example of a schematic configuration of an information collection device according to an embodiment.

[0012] Figure 2 This is a diagram showing an example of a schematic configuration of an operation monitoring terminal.

[0013] Figure 3 It is a diagram showing an example of arbitration.

[0014] Figure 4 This is a diagram showing an example of a monitoring object alarm table.

[0015] Figure 5 This is a diagram showing an example of an alarm management table.

[0016] Figure 6 This is a diagram showing an example of an abnormality corresponding step table.

[0017] Figure 7 It is a diagram showing an example of information collection based on countdown of the timer time.

[0018] Figure 8 It is a diagram showing an example of information collection based on countdown of the timer time.

[0019] Fig. 9 It is a diagram showing an example of information collection based on countdown of the timer time.

[0020] Fig.10 It is a diagram showing an example of information collection based on countdown of the timer time.

[0021] Fig.11 It is a diagram showing an example of information collection based on countdown of the timer time.

[0022] Fig.12 This is a flowchart showing an example of processing executed in the operation monitoring terminal.

[0023] Fig.13 This is a flowchart showing an example of processing executed in the operation monitoring terminal.

[0024] Fig.14 This is a flowchart showing an example of processing executed in the operation monitoring terminal.

[0025] Fig.15 It is a diagram showing an example of a schematic configuration of an operation monitoring terminal according to a modified example.

[0026] Fig.16 This is a diagram showing an example of a schematic configuration of a learning completion model.

[0027] Fig.17 It is a diagram showing an example of the hardware configuration of the operation monitoring terminal.

[0028] Description of Reference Numerals

[0029] 1 factory, 2 field equipment, 3 control station, 4 engineering terminal, 5 operation monitoring terminal, 51 receiving unit, 52 storage unit, 53 selection unit, 54 registration unit, 55 collection unit, 56 learning unit, 52a program, 53a monitoring object alarm table, 54a alarm management table, 55a abnormality corresponding step table, 55b learning completion model, 56a training data. DETAILED DESCRIPTION

[0030] Hereinafter, the embodiments will be described with reference to the drawings. The same reference numerals are given to the same elements, and repeated descriptions are omitted as appropriate.

[0031] Figure 1 1 is a diagram showing an example of a schematic configuration of an information collection device according to an embodiment. The information collection device according to the embodiment is referred to as an operation monitoring terminal 5 in the diagram. The operation monitoring terminal 5 is used for monitoring the factory 1 and the like.

[0032] The factory 1 is a factory including various facilities for obtaining products. Examples of products are LNG (liquefied natural gas), resins (plastics, nylon, etc.), chemical products, etc. Examples of facilities are factory facilities, machinery facilities, production facilities, power generation facilities, storage facilities, and facilities at wellheads for extracting oil, natural gas, etc.

[0033] Field devices 2 are provided at various locations of the factory 1. The field devices 2 are configured to be able to communicate with other devices such as the control station 3 by wireless communication and / or wired communication. The field devices 2 are generally divided into (classified into) sensor devices and operating devices, for example. Sensor devices are, for example, devices that obtain (detect, measure, etc.) physical quantities. Examples of sensor devices are pressure sensors, temperature sensors, flow sensors, pH sensors, speed sensors, acceleration sensors, etc. Operating devices are, for example, devices that operate physical quantities. Examples of operating devices are valves, pumps, fans, etc., which are driven by motors and actuators, etc.

[0034] The control station 3 is a factory control station for controlling the factory 1. An example of control is the operation control of the factory 1. Such a control station 3 is also called an operation control device, etc. For example, the control station 3 controls the operation of the factory 1 so that the factory 1 operates in a desired state.

[0035] An example of operation control is described. For example, the control station 3 controls the operation value MV so that the process value PV approaches the set value SV. The process value PV is data indicating the state of the process in the plant 1. The process value PV is obtained, for example, by the corresponding field device 2. Examples of the process value PV are pressure, temperature, flow rate, pH value, speed, acceleration, etc. The set value SV is data (target value) indicating the target of the process value PV in the plant 1. The set value SV is provided to the control station 3, for example, for the control of the plant 1. Examples of the set value SV are pressure, temperature, flow rate, pH value, speed, acceleration, etc., similar to the process value PV. The operation value MV is data indicating the operation in the plant 1. The operation value MV is obtained, for example, from the corresponding field device 2, or provided from the control station 3 to the corresponding field device 2. According to the provided operation value MV, the field device 2 operates. Examples of the operation value MV are valve operation amount (for example, valve opening), pump operation amount, fan operation amount, etc.

[0036] like Figure 1 As shown in the example, a plurality of control stations 3 may be provided in the factory 1. Each control station 3 is responsible for the operation control of a corresponding part of the factory 1. For example, each control station 3 obtains data from a corresponding field device 2, or sends data to a corresponding field device 2. The number of control stations 3 and the number of field devices 2 corresponding to each control station 3 may be determined arbitrarily. Each control station 3 may correspond to each field device 2 in a 1:1 manner. In addition, each control station 3 may be arranged in the factory 1.

[0037] The engineering terminal 4 and the operation monitoring terminal 5 are connected to the control station 3 in a communicable manner. In this example, the control station 3, the engineering terminal 4 and the operation monitoring terminal 5 are connected via a control bus. The control bus is a dedicated bus (also called a network, etc.) constructed for data transmission.

[0038] Some of the data transmitted via the control bus is used for the control of the plant 1. The control may also include real-time control. It is extremely important to prevent the loss of data transmission in the control bus and other undesirable situations. The control bus is constructed as a dedicated special network, for example, and is duplicated from the viewpoint of improving reliability (see also the following description). Figure 3 ). The dual control bus can send and receive the same data in parallel through two communication paths. Even if a fault occurs in one communication path, data transmission (sending and receiving) can be maintained. Examples of networks that constitute such a control bus are Vnet / IP (registered trademark) and the like.

[0039] A plurality of control stations 3 may be configured for each domain of the control bus. For example, one or more control stations 3 may be separately accommodated in each room corresponding to each domain of the control bus. Some of the domains of the control bus are illustrated as domain D1 and domain D2. In this example, domain D1 and domain D2 correspond to two or more control stations 3, respectively.

[0040] The engineering terminal 4 is used, for example, for setting up, maintaining, and operating the control station 3. For example, the engineering terminal 4 is used when setting up the control station 3, updating software (an example of an offline operation described later), and the like.

[0041] The operation monitoring terminal 5 monitors the plant 1 based on the data from the control station 3 and the user operation, etc. For example, the operation monitoring terminal 5 receives an alarm indicating an abnormality related to the control station 3 and notifies the user (operator, etc.) of the operation monitoring terminal 5. Hereinafter, an alarm indicating an abnormality related to the control station 3 may also be simply referred to as an "alarm".

[0042] In this embodiment, the operation monitoring terminal 5 has a function as an information collection device that collects (acquires, etc.) information that can be used for investigating the cause of the alarm (determining, analyzing, resolving, etc. the cause). Hereinafter, such information may also be referred to as "investigation information", "alarm investigation information", etc.

[0043] Figure 2 : is a diagram showing an example of the schematic structure of the operation monitoring terminal. The operation monitoring terminal 5 includes: a receiving unit 51, a storage unit 52, a selection unit 53, a registration unit 54 and a collection unit 55. In short, the receiving unit 51 receives an alarm from the control station 3. The storage unit 52 stores information required for processing in the operation monitoring terminal 5. The selection unit 53 selects the alarm received by the receiving unit 51. The registration unit 54 registers the alarm selected by the selection unit 53. The collection unit 55 collects the investigation information of the alarm registered by the registration unit 54. The alarm is received and the investigation information is collected using data transmission based on the control bus. The following describes each part in detail.

[0044] The receiving unit 51 receives an alarm. The alarm includes, for example, an alarm ID (No) and information content describing the alarm content. In one embodiment, the alarm is identified by a combination of location information and position information. The location information indicates the type of location of the control station 3. The position information indicates the location of the location of the control station 3. Hereinafter, the combination of location information and position information is referred to as "arbitration".

[0045] Figure 3 is a diagram showing an example of arbitration. Figure 3 The left side of exemplifies the appearance of the control station 3, and illustrates "CPU card", "I / O kit overall", "I / O module", and "control bus" in the part information indicating the type of each part.

[0046] The location information "CPU card" is information indicating the CPU card in the control station 3. In addition, hereinafter, the CPU card is sometimes referred to as "CPU". The CPU is responsible for the calculation processing required for the control of the factory 1. From the perspective of the importance of preventing adverse situations such as the loss of control of the factory 1, the control station 3 includes a plurality of CPUs in order to make the CPU redundant (for example, dual). One of the duplicated CPUs is running, and the other CPU is on standby. If an abnormality occurs in the CPU during operation, an alarm indicating the abnormality is generated, and the standby CPU is switched to the operating CPU.

[0047] The location information "I / O kit overall" is information indicating the I / O kit overall in the control station 3. The I / O kit is configured including a plurality of I / O modules.

[0048] The location information "I / O module" is information indicating an I / O module (I / O device unit) in the control station 3. The I / O module is responsible for inputting and outputting various data used for controlling the control station 3. Examples of input data are data from the field device 2, data from the control bus (from the operation monitoring terminal 5, etc.), etc. Examples of output data are data to the field device 2, data to the control bus (to the operation monitoring terminal 5, etc.), etc.

[0049] The location information "control bus" indicates the control bus to which the control station 3 is connected. The location information "control bus" may indicate the control bus (the entire control bus) or only the portion of the control bus to which the control station 3 is connected. Figure 3 The two communication paths of the duplicated control bus are schematically shown.

[0050] exist Figure 3 On the right side of , “domain”, “station”, “CPU control”, “I / O system”, “I / O node”, “I / O unit” and “I / O slot” in the location information representing the location of the parts of the control station 3 are illustrated.

[0051] The location information "domain" indicates the location of the domain of the control bus ( Figure 1 In this example, the location information "domain" is represented by a number (domain No).

[0052] The position information "station" is information indicating the position of the control station 3 within the domain. In this example, the position information "station" is represented by a number (station No).

[0053] The position information "CPU control" is information indicating the positions of the operating CPU and the standby CPU in the redundant CPUs in the control station 3. In this example, the position information "CPU control" is represented by either the operating (control execution) CPU or the standby CPU (control / standby of the redundant CPU).

[0054] The position information "I / O system" is information indicating the position of the I / O system in the control station 3. In this example, the position information "I / O system" is represented by a number (I / O interface system No).

[0055] The position information "I / O node" is information indicating the position of the I / O kit within the control station 3. In this example, the position information "I / O node" is represented by a number (I / O kit No).

[0056] The position information "I / O unit" is information indicating the position of the I / O device unit in the control station 3. In this example, the position information "I / O unit" is represented by a number (I / O device unit No).

[0057] The position information "I / O slot" is information indicating the slot of the I / O device unit in the control station 3. In this example, the position information "I / O slot" is represented by a number (Slot No of the I / O device unit).

[0058] For example, the above-described location information and position information are appropriately combined within the range of non-contradiction to form arbitration. Examples of arbitration are the combination of location information "CPU" and position information "CPU control", the combination of location information "I / O kit overall" and position information "domain", "station", and the combination of location information "I / O module" and position information "domain", "station", "I / O system", "I / O node", "I / O unit", "I / O slot", etc.

[0059] Apart from Figure 3 In addition to the exemplified location information and position information, various information indicating the type of the location of the control station 3 may be regarded as location information, and various information indicating the position of the location of the control station 3 may be regarded as position information.

[0060] An example of the use of arbitration is described. As described above, arbitration can be used to identify alarms. For example, the correspondence between alarms (alarm ID, information content, etc.) and arbitration is predetermined, and based on the correspondence, the alarm is identified by arbitration. In addition, arbitration can be used to determine the location of the control station 3. For example, by combining the location information "CPU" and the position information "CPU control", it is determined which CPU is the operating CPU and the standby CPU in the CPU of the control station 3.

[0061] Back to Figure 2 The storage unit 52 stores various information required for the processing executed in the operation monitoring terminal 5. As examples of the information stored in the storage unit 52, a program 52a, a monitoring object alarm table 53a, an alarm management table 54a, and an abnormality corresponding step table 55a are illustrated. The program 52a is a program (information collection program) that causes the computer to execute the processing of the operation monitoring terminal 5 (information collection device). The monitoring object alarm table 53a, the alarm management table 54a, and the abnormality corresponding step table 55a will be described later.

[0062] The selection unit 53 selects alarms of monitoring objects from the alarms received by the receiving unit 51. There are many cases where the alarms received by the receiving unit 51 include alarms for which the necessity of collecting information for investigation is extremely low. For example, in the factory 1, even if the opening and closing operation of the valve is performed within the allowable range of its operation control, information indicating this situation can be generated as an alarm. There is almost no necessity to collect information for investigation of such alarms. The selection unit 53 performs pre-selection (filtering) to eliminate such alarms. For example, the selection is performed by referring to the monitoring object alarm table 53a.

[0063] Figure 4 2 is a diagram showing an example of a monitoring target alarm table. In this example, the monitoring target alarm table 53a describes "alarm", "monitoring necessity", and "counting time" in association with each other.

[0064] "Alarm" is an alarm received by the receiving unit 51, and is schematically represented as "Alarm A" in the figure. "Whether to monitor" indicates whether the alarm should be a monitoring object, and more specifically, whether it should be a subject of information collection described later. An alarm whose "Yes" is a monitoring object is a monitoring object. An alarm whose "No" is a monitoring object is not a monitoring object. In this example, Alarm A and Alarm B are monitoring objects. Alarm C is excluded from the monitoring object.

[0065] "Timer time" is used to eliminate some alarms. The principle will be explained later. Figure 4 In the example, "delay time" and "dead time" are illustrated as the timing time. In this example, the timing time of alarm A is the delay time, and its length is 20 seconds. The timing time of alarm B is the dead time, and its length is 30 seconds. As described later, the correspondence between the timing time and the alarm and the specific length of the timing time are appropriately set.

[0066] The alarm exclusion based on the timing time is explained. Sometimes a group of identical or mutually related alarms are generated continuously. If the investigation information of all these alarms is collected, the amount of information increases, and the proportion of useless information (duplicate information, etc.) will also increase. If the useless information increases, it will be difficult to determine the cause of the alarm, etc. In addition, if the amount of information increases, the amount of data transmitted through the control bus increases accordingly, and the burden on the control bus increases. As mentioned above, since the control bus is required to have high reliability, it is necessary to suppress the burden on the control bus as much as possible. In this sense, it is preferable to exclude at least part of the above-mentioned group of alarms. Some examples of a group of alarms are explained.

[0067] An example of a group of alarms is an alarm generated due to a CPU failure. For example, if a running CPU fails, an alarm is generated, and the standby CPU is switched to a running CPU. Self-diagnosis is performed in the failed CPU. In the self-diagnosis, it is confirmed whether the CPU can recover from the failure, etc. If it can be recovered, the CPU becomes the standby CPU, maintaining the duplication of the CPU. Through this self-diagnosis, it is possible to generate oscillations in which the CPU repeatedly fails and recovers. Each time the failure and recovery are repeated, the same alarm is generated. The alarms repeatedly generated in the above manner are the same group of alarms generated due to a CPU failure. The same alarm can be identified with the same arbitration. In this example, the same arbitration is a combination of the location information "CPU" and the position information "CPU control".

[0068] For a group of alarms caused by the above-mentioned oscillation, it is effective to collect only the investigation information of one of these alarms and exclude the remaining alarms. In addition, the collection of the investigation information is preferably performed after the oscillation converges and the CPU operation stabilizes. For example, it is sufficient to start collecting the investigation information of the alarm after a certain period has passed since the receiving unit 51 received the alarm. The certain period can be determined based on the period until the oscillation converges. The delay time is used to exclude such alarms. The delay time is set as a timing time for delaying the collection of the investigation information of the corresponding alarm.

[0069] Another example of a group of alarms is an alarm generated due to an offline operation (offline engineering operation). An offline operation is, for example, an operation that accompanies the reset of the control station 3, and the operation control of the plant 1 performed by the control station 3, such as communication with the field device 2, is stopped. An example of an offline operation is a software update of the control station 3. Due to the offline operation, for example, various alarms indicating abnormalities in various parts of the control station 3 are generated. For example, regarding the I / O module, an alarm is generated indicating the start of downloading the information content of the database to the I / O module. Under this influence, an alarm indicating an abnormality of the I / O module is generated. Regarding the CPU, an alarm indicating the stop of the control station is generated. Under this influence, an alarm indicating a failure of the control station 3 is generated. These alarms are a group of alarms that are related to each other and are generated due to offline operations.

[0070] It is effective not to collect (exclude) the investigation information of a group of alarms that are related to each other and are caused by the above-mentioned offline operation. This is because it is known that the cause of the alarm is the offline operation. As described later, the exclusion of such alarms is achieved by dead time. Dead time is a timing time for ignoring alarms that are related to each other. The details of dead time are described later.

[0071] Another example of a group of alarms is an alarm caused by an abnormality in a specific part of the control station 3. More specifically, in the case where there are some parts (affected parts) that are affected by the abnormality of the specific part and cause abnormalities, the alarms generated for these affected parts are a group of alarms that are related to each other. For example, as a recovery alarm for a failure of the control station (caused by an abnormality of the CPU), alarms such as the reset start, automatic reset start, power-on initialization start, and power-on continuation start of the control station are generated. Under this influence, alarms indicating abnormalities of the bus connecting the I / O unit and the CPU, abnormalities of the I / O module, etc. are generated. These alarms are a group of alarms that are related to each other and are caused by offline operations. These alarms are a group of alarms that are related to each other about affected parts (such as I / O units, I / O modules, etc.) that are generated due to the abnormality of a specific part (such as the CPU).

[0072] It is also effective not to collect the investigation information of a group of alarms that are related to each other due to abnormalities in the affected parts. This is because it is sufficient to collect the investigation information of alarms in specific parts. As described later, the elimination of such alarms is also achieved by the dead time.

[0073] The monitoring object alarm table 53a makes the delay time correspond to the same group of alarms as mentioned above (for example, alarms generated due to CPU failure). The specific contents such as what length of delay time corresponds to which alarm can be appropriately set according to the actual operation of alarm generation, etc. For example, the delay time is set to give the length of the period including the generation of a group of alarms generated due to CPU failure (such as the time required for oscillation convergence).

[0074] The monitoring object alarm table 53a makes the dead time correspond to a group of alarms that are related to each other as described above (for example, alarms caused by offline operations, abnormalities in specific parts, etc.). The specific contents such as what length of dead time corresponds to which alarm can be appropriately set according to the actual operation of alarm generation, etc. For example, the dead time is set to give the length of the period including the generation of each of a group of alarms caused by offline operations, and the length of the period including the generation of each of a group of alarms indicating abnormalities in the affected parts caused by abnormalities in specific parts, etc.

[0075] Back to Figure 2 The registering unit 54 registers the alarm selected by the selecting unit 53. More specifically, the registering unit 54 registers the alarm, arbitration, and timer time in the alarm management table 54a in correspondence with each other.

[0076] Figure 5 2 is a diagram showing an example of an alarm management table. In this example, the alarm management table 54a describes "alarm", "arbitration", "suppression", and "counter time" in association with each other. Alarm and arbitration are as described above.

[0077] "Suppression" indicates whether the timing time is the delay time or the dead time. "Suppression" "ON" indicates that the timing time is the dead time. "Suppression" "OFF" indicates that the timing time is the delay time.

[0078] "Countdown time" indicates the remaining time of the countdown time. In this example, the remaining time of the countdown time (delay time) of alarm A is 20 seconds, and the remaining time of the countdown time (dead time) of alarm B is 30 seconds.

[0079] Back to Figure 2, the registration unit 54 will register the same alarm as the alarm registered in the alarm management table 54a and whose delay time is in the countdown in the alarm management table 54a. By overwriting the registration, the registered alarm is deleted (excluded) from the alarm management table 54a. The delay time in the countdown is reset (for example, it returns to 20 seconds again). Here, the same alarm can be identified corresponding to the same arbitration. In this case, the registration unit 54 will register the same arbitration as the arbitration of the alarm registered in the alarm management table 54a and whose delay time is in the countdown in the alarm management table 54a.

[0080] The registering unit 54 does not register (excludes) in the alarm management table 54a an alarm associated with an alarm registered in the alarm management table 54a and in which the dead time is counted down. Here, alarms associated with each other can be identified corresponding to mutually associated arbitrations. In this case, the registering unit 54 does not register in the alarm management table 54a an alarm of arbitration associated with the arbitration of an alarm registered in the alarm management table 54a and in which the dead time is counted down.

[0081] The collecting unit 55 reads out the alarm received by the receiving unit 51 , more specifically, the alarm selected by the selecting unit 53 and registered in the alarm management table 54 a by the registering unit 54 , as necessary, and collects investigation information of the read alarm.

[0082] As described above, for the alarms registered in the alarm management table 54a, the countdown time is counted down. The collection unit 55 does not collect the investigation information of the alarms registered in the alarm management table 54a and whose countdown time is counted down. It can also be considered that the countdown time provides a period for holding back the collection of the investigation information of the alarm.

[0083] The collecting unit 55 collects the investigation information of the alarm for the completion of the countdown of the timing time as needed. Specifically, the collecting unit 55 collects the investigation information of the alarm for the completion of the countdown of the delay time. That is, the collecting unit 55 starts to collect the investigation information of the alarm received by the receiving unit 51 after a certain period of time has passed since the alarm was received. On the other hand, the collecting unit 55 does not collect the investigation information of the alarm for the completion of the countdown of the dead time.

[0084] The collection unit 55 collects the investigation information from the corresponding part of the control station 3. The corresponding part of the control station 3 is determined based on the alarm (e.g., the alarm ID and / or the information content), and specifically, for example, is determined in the collection step corresponding to the alarm in the abnormality corresponding step table 55a. The collection unit 55 collects the investigation information by referring to the abnormality corresponding step table 55a.

[0085] Figure 62 is a diagram showing an example of an abnormality-coping step table. In this example, the abnormality-coping step table 55a describes "alarm" and "collection step" in correspondence with each other.

[0086] "Collection step" is information describing the collection step of the investigation information, and is schematically represented as "Collection step A" in the figure. In this example, the collection step of the investigation information of alarm A is collection step A, and the collection step of the investigation information of alarm B is collection step B. The collection step includes, for example, the activation of an execution file for obtaining the desired investigation information from the part of the control station 3 that is the object of information collection. The collection step may include sequential activation of multiple different execution files (multiple steps). For example, the corresponding execution files are activated in the order from the large part (for example, the control bus) to the small part of the parts of the control station 3 to collect the investigation information.

[0087] For example, as described above, the investigation information of some of the alarms for which the countdown of the timer time has ended is collected. Figure 7 to Figure 11 Examples of some actions related to this are given below.

[0088] Figure 7 to Figure 11 is a diagram showing an example of information collection based on a countdown of a timer time. Figure 7 In the example shown, the same alarm is generated only once for the delay time (alarm of the same arbitration). At time t11, the first alarm is received (alarm first time) and registered with the delay time. The countdown of the delay time starts. At time t21, the countdown of the delay time ends and information collection starts.

[0089] exist Figure 8 In the example shown, two identical alarms are generated with respect to the delay time. At time t11, the first alarm (alarm first) is received and registered together with the delay time. The countdown of the delay time starts. At time t12 before the countdown of the delay time ends, the second alarm (alarm second) is received, and the delay time is reset. The first alarm is eliminated (canceled), and the second alarm is registered together with the delay time. At time t22, the countdown of the delay time ends, and the collection of information for investigation of the second alarm starts.

[0090] exist Fig. 9In the example shown, N identical alarms are generated regarding the delay time. N is an integer greater than or equal to 2. At time t11, the first alarm is received (alarm first time) and registered together with the delay time. The countdown for the delay time starts. At time t12 before the countdown for the delay time ends, the second alarm is received (alarm second time), and the delay time is reset. Excluding the first alarm, the second alarm is registered together with the delay time. At time t1N before the countdown for the delay time ends, the Nth alarm is received (alarm Nth time), and the delay time is reset. Excluding the second alarm, the Nth alarm is registered together with the delay time. At time t2N, the countdown for the delay time ends, and collection of information for investigation of the Nth alarm begins.

[0091] exist Fig.10 In the example shown, regarding the dead time, some alarms are generated due to offline operations, but the investigation information of these alarms is not collected (alarms are excluded). At time t31, the alarm generated by the offline operation (offline operation information) is received and registered. The countdown of the dead time starts. At time t32 before the countdown of the dead time ends, an alarm caused by (related to) the previous offline operation is received, but it is ignored (excluded). That is, the alarm is not registered in the alarm management table 54a. At time t41, the countdown of the dead time ends, and the alarm generated at the previous time t31 is also excluded. The alarms generated thereafter (alarms after the dead time) are explained in the same way as before. In this example, at time t51, the alarm is received and registered. At time t61, the countdown of the delay time starts. The countdown of the delay time ends, and the collection of investigation information of the alarm begins.

[0092] exist Fig.11 In the example shown, regarding the dead time, some alarms of the affected parts are generated due to the alarm of the specific part of the control station 3, but the investigation information of the alarms of these affected parts is not collected (the alarms are excluded). At time t71, the alarm of the specific part is received and registered together with the delay time. The countdown of the delay time starts. At time t72, the alarm of the affected part is received and registered together with the dead time. At time t73 before the end of the dead time, the alarm of the affected part is received, but it is ignored (excluded). At time t74, the countdown of the delay time ends, and the collection of investigation information of the alarm of the specific part starts. At time t75, the countdown of the dead time ends, and the alarm generated at the previous time t72 is also excluded. The alarm generated after that (the alarm after the dead time) is explained in the same way as before. In this example, at time t81, an alarm about another part is received and registered. At time t91, the countdown of the delay time starts. The countdown of the delay time ends, and the collection of investigation information of the alarm starts.

[0093] For example, as described above, by utilizing the delay time or the dead time, at least a part of a group of alarms that are the same or related to each other can be excluded. The collection unit 55 can efficiently collect useful information for investigation.

[0094] Back to Figure 2 The collection unit 55 may include a GUI (Graphical User Interface) for prompting (displaying, etc.) the collected survey information to the user. For example, the collected survey information can be narrowed down and prompted according to the user operation. Examples of narrowing down are narrowing down according to each alarm type, according to each arbitration, etc. In addition, the GUI can also be used to prompt information about alarms received by the receiving unit 51, more specifically, alarms selected by the selection unit 53 and registered by the registration unit 54, which are not collected by the collection unit 55 and are excluded. The information prompted in the above manner can be used, for example, to study the appropriateness of excluding alarms.

[0095] Figure 12 to Figure 14 This is a flowchart showing an example of processing (operation monitoring method (information collection method)) executed in the operation monitoring terminal.

[0096] Fig.12 This section shows some examples of processing from receiving an alarm to collecting information for investigation. The detailed processing is as described above, so it will not be repeated.

[0097] In step S1, the operation monitoring terminal receives an alarm. As described above, the receiving unit 51 of the operation monitoring terminal 5 receives an alarm.

[0098] In step S2, the operation monitoring terminal selects the alarm to be monitored. As described above, the selection unit 53 of the operation monitoring terminal 5 refers to the alarm table 53a to select the alarm to be monitored from the alarms received by the receiving unit 51 in the previous step S1. The timer time and the like are also matched.

[0099] In step S3, the operation monitoring terminal registers the alarm. As described above, the registering unit 54 of the operation monitoring terminal 5 registers the alarm selected by the selecting unit 53 in the previous step S2 in the alarm management table 54a. The arbitration and timer time are also registered.

[0100] In step S4, the operation monitoring terminal collects necessary information for investigating the alarm. As described above, the collecting unit 55 of the operation monitoring terminal 5 collects the information for investigating the specific alarm (e.g., the alarm at the end of the countdown of the delay time) among the alarms registered in the alarm management table 54a from the location of the control station 3 determined based on the alarm.

[0101] After the processing of step S4 is completed, the processing of the flowchart ends.

[0102] Fig.13 An example of the alarm registration process by the registering unit 54 is shown. This process is executed when the alarm is received by the receiving unit 51 and selected by the selecting unit 53. Hereinafter, the alarm received by the receiving unit 51 and selected by the selecting unit 53 is referred to as "this alarm".

[0103] In step S11, the same arbitration is searched. The registration unit 54 refers to the alarm management table 54a and searches for an alarm of arbitration that is the same as or related to the arbitration of the current alarm.

[0104] In step S12, it is determined whether there are identical records, etc. If there is an alarm for arbitration that is identical to or related to the arbitration of this alarm in the alarm management table 54a, the registration unit 54 determines that there are identical records, etc. If there are identical records, etc. (step S12: Yes), the process proceeds to step S14. If not (step S12: No), the process proceeds to step S13.

[0105] In step S13, a new record is registered. The registering unit 54 additionally registers the current alarm in the alarm management table 54a.

[0106] In step S14, it is determined whether suppression is on. The registering unit 54 determines whether suppression of an alarm for arbitration that is the same as or related to the arbitration of this alarm is on. As described above, when suppression is on, the timed time is the dead time. Otherwise, the timed time is the delay time. When suppression is on (step S14: yes), the process proceeds to step S16. Otherwise (step S14: no), the process proceeds to step S15.

[0107] In step S15, the existing record is overwritten. The registering unit 54 registers the current alarm together with the delay time in the alarm management table 54a instead of the alarm registered in the alarm management table 54a. The previously registered alarm is deleted (excluded) from the alarm management table 54a, and the delay time is reset.

[0108] In step S16, the registration is terminated. The registration unit 54 does not register (excludes) the current alarm.

[0109] After the processing of step S13, step S15, or step S16 is completed, the processing of the flowchart ends.

[0110] Fig.14 An example of the reading process of the alarm registered in the alarm management table 54a is shown. This process is repeatedly executed as needed.

[0111] In step S21, the delay / dead zone column value is counted down. That is, the alarm timing time (delay time, dead zone time) registered in the alarm management table 54a is counted down. This process is performed by the storage unit 52, the registration unit 54 or the collection unit 55, for example.

[0112] In step S22, it is determined whether the column value is less than 0. It is determined whether the count time after the countdown in the previous step S21 has become 0. For example, this process is performed by the storage unit 52, the registration unit 54, or the collection unit 55. If the column value is less than 0 (step S22: Yes), the process proceeds to step S23. If not (step S22: No), the process proceeds to step S24.

[0113] In step S23, the record is retrieved or deleted. The collection unit 55 retrieves the alarm for which the countdown of the delay time has been completed from the alarm management table 54a, and collects the investigation information of the alarm. The collection unit 55 deletes (excludes) the alarm for which the countdown of the dead time has been completed from the registration unit 54, and does not collect the investigation information of the alarm. The deletion process can be performed by the storage unit 52 or the registration unit 54.

[0114] In step S24, it is determined whether there is an alarm registration record. It is determined whether there is an alarm registered in the alarm management table 54a. For example, this process is performed by the storage unit 52, the registration unit 54, or the collection unit 55. If there is an alarm registration record (step S24: Yes), the process returns to step S21. If not (step S24: No), the process of the flowchart ends.

[0115] For example, as described above, by operating the monitoring terminal 5, the investigative information is automatically collected based on the alarm from the control station 3. It is not necessary for an engineer to go to the site to collect the investigative information as in the past, so the investigative information can be collected efficiently. In addition, if the countdown of the timing time (delay time, dead time) is used, at least part of a group of alarms that are the same or related to each other can be excluded. Accordingly, the efficiency of collecting the investigative information is further improved.

[0116] An embodiment of the present invention has been described above. The technology of the present invention is not limited to the above-described embodiment. Some modified examples will be described below.

[0117] In the above embodiment, the alarms are described as examples of alarms caused by failures in the control station 3, offline operations, etc. However, this is not limited to these examples, and alarms caused by various events can also be handled. Other examples of alarms are alarms (A&E (Alarm and Event) etc.) in PLC (Programmable Logic Controller) for PA (also called Process Automation). Such PLC alarms can also be applied to the previously referenced Figure 3 Since the identification based on arbitration is described above, the alarm received from this part can also be a collection target of the investigation information of the operation monitoring terminal 5.

[0118] In the above embodiment, an example of making the alarm and the timer time correspond to each other through the monitoring object alarm table 53a is described. However, the timer time and the alarm can also be made to correspond to each other in various ways. The timer time can correspond to the alarm by operating any function block in the monitoring terminal 5 at any time until the alarm is registered in the alarm management table 54a.

[0119] In the above-mentioned embodiment, an example is described in which the collection unit 55 collects the investigation information of the alarms selected by the selection unit 53 and registered by the registration unit 54 among the alarms received by the receiving unit 51. However, the selection by the selection unit 53 and / or the registration by the registration unit 54 are not necessary. For example, the operation monitoring terminal 5 may not include the selection unit 53. In this case, the collection unit 55 collects the investigation information of the alarms received by the receiving unit 51 and registered by the registration unit 54. The operation monitoring terminal 5 may not include the registration unit 54. In this case, the collection unit 55 collects the investigation information of the alarms received by the receiving unit 51 and selected by the selection unit 53. The operation monitoring terminal 5 may not include the selection unit 53 and the registration unit 54. In this case, the collection unit 55 collects the investigation information of the alarms received by the receiving unit 51.

[0120] In the above embodiment, an example of using the timing time (delay time and dead time) to eliminate at least part of a group of alarms that are the same or related to each other is described. However, the method of eliminating alarms is not limited to this. Fig.15 and Fig.16 , describing this variation.

[0121] Fig.15 1 is a diagram showing an example of a schematic configuration of an operation monitoring terminal according to a modified example. The operation monitoring terminal 5A shown in the example is the same as the operation monitoring terminal 5 ( Figure 2) is different from the above in that the selection unit 53 and the registration unit 54 are not included; a storage unit 52A and a collection unit 55A are included instead of the storage unit 52 and the collection unit 55; and a learning unit 56 is included.

[0122] The storage unit 52A and the storage unit 52 ( Figure 2 ) is different from the above in that it does not include the monitoring object alarm table 53a and the alarm management table 54a; it includes a program 52aA instead of the program 52a; and it includes a learning completion model 55b and training data 56a. The program 52aA is a program that causes the computer to execute the processing of the operation monitoring terminal 5A.

[0123] For example, if data (input data) corresponding to an alarm received by the receiving unit 51 is input, the learning completion model 55b outputs data (output data) for determining an alarm that is to be the object of the collection unit 55 to collect information for investigation. "Data corresponding to an alarm" may be, for example, data obtained by converting an alarm ID / information content, etc. into a data format suitable for input to the learning completion model 55b. "Data for determining an alarm" may be, for example, data indicating a probability value for each alarm. The alarm with the highest probability may be determined as the alarm that is to be the object of the collection unit 55 to collect information for investigation. Also refer to Fig.16 The learning completion model 55b is described.

[0124] Fig.16 5 is a diagram showing an example of a schematic structure of a learning completion model. In this example, the learning completion model 55b is a neural network including an input layer, multiple intermediate layers and an output layer. Input data is input to the input layer. The output layer is, for example, a fully connected layer, which outputs the output data. The intermediate layer is arranged between the input layer and the output layer. Some neurons in each layer are schematically represented by white circles. An example of a neural network is DQN (Deep Q-Network Deep Reinforcement Learning). The principle of a learning completion model of this structure is well known, so it is not described in detail.

[0125] If data corresponding to the same set of alarms as described above is input, the learning completion model 55b can output data that identifies only one alarm in the set of alarms. The input data can be time series data of alarms received within a certain period. The learning completion model 55b can learn including the setting of a certain period. The certain period corresponds to the delay time described above. That is, the same function as the alarm elimination function based on the delay time is realized by the learning completion model 55b.

[0126] If data corresponding to a group of alarms having correlations as described above is input, the learning completion model 55b can output data that does not confirm any of the group of alarms. The input data can be time series data of alarms received within a certain period. The learning completion model 55b can also learn including the setting of a certain period. The certain period corresponds to the dead time as described above. That is, the same function as the alarm elimination function based on the dead time is realized by the learning completion model 55b.

[0127] The learning model 55b is generated by training (machine learning, etc.) using the training data 56a so that if the input data is input, the output data is output. An example of the training data is a data set that combines the input data and the output data. Such a data set can be prepared by the user using past alarms received in the operation monitoring terminal 5 and stored in the storage unit 52A, for example.

[0128] Back to Fig.15 The collecting unit 55A collects the investigation information of the alarms determined by using the multiple alarms received by the receiving unit 51 and the learning completion model 55b. Specifically, the collecting unit 55A inputs the data corresponding to the multiple alarms received by the receiving unit 51 (which may be time series data as described above) into the learning completion model 55b. The learning completion model 55b outputs data that specifies the alarms that should be collected as the investigation information among the multiple alarms. The collecting unit 55A collects the investigation information of the alarms determined by the learning completion model 55b, for example, by referring to the abnormality corresponding step table 55a in the manner described above.

[0129] According to the above-mentioned operation monitoring terminal 5A, the function of eliminating alarms based on the timing time (delay time and dead time) is realized by learning the completion model 55b. Therefore, for example, the selection unit 53, the monitoring object alarm table 53a, the registration unit 54, and the alarm management table 54a of the operation monitoring terminal 5 are not required. The configuration of the operation monitoring terminal 5A can be simplified accordingly, and the design cost of setting the timing time can be reduced.

[0130] The learning unit 56 uses the training data 56a stored in the storage unit 52A to learn the learning completion model 55b. In this way, the learning completion model 55b can be generated. In addition, for example, each time the latest training data 56a based on the latest received alarm is prepared and stored in the storage unit 52A, the learning completion model 55b can be updated by learning using the latest training data 56a. In addition, the learning unit 56 and the training data 56a can also be set outside the operation monitoring terminal 5A (for example, an information processing device not shown in the figure). In this case, the trained learning completion model 55b (for example, the adjusted DQN) generated outside the operation monitoring terminal 5A is provided to the operation monitoring terminal 5A for use.

[0131] Fig.17 1 is a diagram showing an example of the hardware configuration of the operation monitoring terminal. A computer or the like including the illustrated hardware configuration functions as the above-described operation monitoring terminal 5. The illustrated hardware configuration includes a communication device 5a, a display device 5b, a HDD (Hard Disk Drive) 5c, a memory 5d, and a processor 5e, which are interconnected via a bus or the like.

[0132] The communication device 5a is a network interface card or the like, and can communicate with other devices. The display device 5b is, for example, a touch panel, a display, etc. The HDD 5c functions as a storage unit 52, and stores, for example, a program 52a (operation monitoring program, information collection program).

[0133] The processor 5e reads the program 52a from the HDD 5c or the like and expands it in the memory 5d, thereby causing the computer to function as the operation monitoring terminal 5. The functions include the functions of the selection unit 53, the registration unit 54, and the collection unit 55 as described above.

[0134] The program 52a can be distributed via a network such as the Internet. In addition, the program 52a can be recorded on a computer-readable recording medium such as a hard disk, a floppy disk (FD), a CD-ROM, an MO (Magneto-Optical disk), or a DVD (Digital Versatile Disc), and can be read out from the recording medium by a computer and executed.

[0135] Devices other than the operation monitoring terminal 5, such as the engineering terminal 4, etc., may also include the same hardware configuration as described above.

[0136] The operation monitoring terminal 5 (an example of an information processing device) described above is determined, for example, in the following manner. Figure 1 and Figure 2As described above, the operation monitoring terminal 5 includes: a receiving unit 51 that receives an alarm indicating an abnormality related to the control station 3 used in the factory 1; and a collecting unit 55 that collects investigation information on the cause of the alarm from the location of the control station 3 determined based on the alarm received by the receiving unit 51.

[0137] According to the above-mentioned operation, the monitoring terminal 5 automatically collects the investigation information based on the alarm from the control station 3. Therefore, the investigation information can be collected efficiently.

[0138] As reference Figure 2 and Figure 6 As described in the above, the collection unit 55 can collect the investigation information by referring to the abnormality corresponding procedure table 55a which associates the alarm with the collection procedure of the investigation information. For example, thereby, the investigation information can be collected through an appropriate collection procedure.

[0139] The collection unit 55 may start collecting the investigation information of the alarm received by the receiving unit 51 after a certain period of time has passed since the alarm was received. This can avoid collecting information when there is a possibility of unstable operation (e.g., oscillation) of a part of the control station 3, such as immediately after an alarm is generated, and can collect investigation information at an appropriate time when the operation of the part is stable.

[0140] As reference Figure 3 As described in, for example, the alarm can be identified in accordance with arbitration that combines the location information indicating the type of the location of the control station 3 and the location information indicating the location of the location. The location information can include at least one of information indicating the control bus to which the control station 3 is connected, information indicating the CPU card in the control station 3, information indicating the entire I / O kit in the control station 3, and information indicating the I / O module in the control station 3. The location information can include at least one of information indicating the location of the domain of the control bus that divides the plurality of control stations 3 into each domain (domain D1, etc.), information indicating the location of the control station 3 in the domain (domain D1, etc.), information indicating the location of the operating CPU or the standby CPU in the redundant CPU (CPU card) in the control station 3, information indicating the location of the I / O system in the control station 3, information indicating the location of the I / O kit in the control station 3, information indicating the location of the I / O device unit in the I / O kit, and information indicating the location of the slot in the I / O device unit. The collecting unit 55 can collect the information for investigation from the location of the control station 3 determined by arbitration based on the alarm received by the receiving unit 51. For example, by identifying the alarm by arbitration in the above-described manner, it is possible to collect information for investigating the appropriately identified alarm.

[0141] As reference Figure 2 and Figure 5As described in the above, the operation monitoring terminal 5 may include a registering unit 54 that registers the alarms, arbitrations, and timed times received by the receiving unit 51 in the alarm management table 54a in correspondence, and the collecting unit 55 may not collect the investigation information of the alarms registered in the alarm management table 54a and whose timed times are counted down. For example, thereby, the investigation information can be collected at the above appropriate timing.

[0142] As reference Figure 4 , Figure 5 and Figure 7 to Figure 9 As described in the above, the timing time may be a delay time for delaying the collection of the investigation information of the corresponding alarm, and the registering unit 54 may register the same alarm as the alarm registered in the alarm management table 54a and whose delay time is counted down in the alarm management table 54a, and the overwriting registration includes resetting the delay time in the countdown, and the collecting unit 55 may collect the investigation information of the alarm whose countdown of the delay time ends. The same alarm may be identified corresponding to the same arbitration, and the registering unit 54 may register the same arbitration as the arbitration of the alarm registered in the alarm management table 54a and whose delay time is counted down in the alarm management table 54a. For example, by using such a delay time, a part of the same group of alarms can be excluded, and the collection efficiency of the investigation information can be further improved accordingly.

[0143] As reference Figure 4 , Figure 5 , Fig.10 and Fig.11 As described in the examples, the timing time may be a dead time for ignoring alarms that are related to each other, and the registering unit 54 may not register an alarm that is related to an alarm registered in the alarm management table 54a and whose dead time is in the countdown, and the collecting unit 55 may not collect the investigation information of the alarm whose countdown of the dead time has ended. Alarms that are related to each other may be identified corresponding to the arbitration that is related to each other, and the registering unit 54 may not register the arbitration alarm associated with the arbitration of the alarm registered in the alarm management table 54a and whose dead time is in the countdown, in the alarm management table 54a. For example, by utilizing such a dead time, a group of alarms that are related to each other can be excluded, and the collection efficiency of the investigation information can be further improved accordingly.

[0144] As reference Figure 2 As described in the above, the operation monitoring terminal 5 may include a selection unit 53 for selecting an alarm to be monitored from the alarms received by the receiving unit 51, and the registration unit 54 may register the alarm selected by the selection unit 53 in the alarm management table 54a. Thus, for example, it is possible to perform pre-selection (filtering) to eliminate alarms for which the need to collect information for investigation is extremely low.

[0145] As reference Fig.15 and Fig.16 As described in the above, the collection unit 55A may collect the investigation information of the alarms determined by using the multiple alarms received by the receiving unit 51 and the learning model 55b, and when the data corresponding to the multiple alarms are input, the learning model 55b outputs the data of the alarms that should be collected as the investigation information. By using such a learning model 55b, for example, a function of eliminating alarms based on the timing time (delay time and dead time) can also be realized.

[0146] Reference Figure 2 and Fig.17 The program 52a described in the above is also one aspect of the present invention. The computer executes the program 52a to perform the following processing: receiving an alarm indicating an abnormality related to the control station 3 used in the factory 1, and collecting the investigation information of the cause of the alarm from the part of the control station 3 determined based on the received alarm. By using this program 52a, the investigation information can also be effectively collected as described above. In addition, as shown in FIG. Fig.17 As described above, a recording medium recording the program 52a is also one aspect of the present invention.

[0147] Reference Fig.12 The information collection method described in the above is also one aspect of the present invention. The information collection method includes: the operation monitoring terminal 5 (an example of the information collection device) receives an alarm indicating an abnormality related to the control station 3 used in the factory 1 (step S1); the operation monitoring terminal 5 collects the investigation information of the cause of the alarm from the part of the control station 3 determined based on the received alarm (step S4). By this information collection method, it is also possible to effectively collect the investigation information as described above.

Claims

1. An information collection device, characterized in that include: a receiving unit that receives an alarm indicating an abnormality associated with a control station used in a factory; as well as a collecting unit that collects information for investigating the cause of the alarm from a location of a control station specified based on the alarm received by the receiving unit, The alarm is identified in correspondence with arbitration, the arbitration combining location information indicating the type of location of the control station and position information indicating the position of the location, The location information includes Information indicating the control bus to which the control station is connected, Indicates the information of the CPU card in the control station, Indicates the overall information of the I / O kit in the control station, and Indicates information about the I / O modules in the control station At least one of The location information includes Information indicating the position of a domain of a control bus into which a plurality of control stations are divided for each domain, information indicating the location of a control station within a domain, Information indicating the position of the operating CPU or standby CPU among the redundant CPUs in the control station, Information indicating the location of the I / O system within the control station, Information indicating the location of the I / O kit within the control station, Information indicating the location of the I / O device unit within the I / O kit, and Information indicating the location of the slot in the I / O device unit At least one of The collecting unit collects the investigation information from a location of a control station determined by arbitration based on the alarm received by the receiving unit.

2. The information collection device according to claim 1, characterized in that: The collecting unit collects the investigative information by referring to an abnormality corresponding step table that associates an alarm with a collection step of the investigative information.

3. The information collection device according to claim 1 or 2, characterized in that: The collection unit starts collecting the investigation information of the alarm received by the receiving unit after a certain period of time has passed since the alarm was received.

4. The information collection device according to claim 1, characterized in that: A registering unit is included for registering the alarm, arbitration and timing time received by the receiving unit in an alarm management table in correspondence with each other, The collecting unit does not collect the investigation information of an alarm registered in the alarm management table and whose time is in the countdown.

5. The information collection device according to claim 4, characterized in that: The timer time is a delay time for delaying the collection of the investigation information corresponding to the alarm. The registering unit registers, in the alarm management table, an alarm identical to the alarm registered in the alarm management table and having a delay time that is currently counted down, overwriting the alarm. The overwriting registration includes resetting the delay time in the countdown, The collecting unit collects the investigation information of the alarm for which the countdown of the delay time has been completed.

6. The information collection device according to claim 5, characterized in that: The same alarm is identified corresponding to the same arbitration, The registration unit registers, in the alarm management table, an alarm of the same arbitration as the alarm registered in the alarm management table and having a delay time that is currently counted down, overwriting the alarm.

7. The information collection device according to claim 4, characterized in that: The timing time is a dead time for ignoring alarms that are related to each other. The registration unit does not register, in the alarm management table, an alarm related to an alarm registered in the alarm management table and having a dead time countdown, The collecting unit does not collect the investigation information of an alarm for which a countdown of a dead time has been completed.

8. The information collection device according to claim 7, characterized in that: The mutually related alarms and mutually related arbitrations are identified accordingly, The registration unit does not register, in the alarm management table, an arbitrated alarm associated with the arbitration of an alarm registered in the alarm management table and having a dead time that is currently counting down.

9. The information collection device according to any one of claims 4 to 8, characterized in that: comprising a selecting unit for selecting an alarm of a monitoring target from the alarms received by the receiving unit, The registration unit registers the alarm selected by the selection unit in the alarm management table.

10. The information collection device according to claim 1 or 2, characterized in that: The collecting unit collects the investigation information of the alarm specified by using the plurality of alarms received by the receiving unit and the learning completion model, When data corresponding to a plurality of alarms is input, the learned model outputs data identifying an alarm that is to be collected as the investigation information.

11. A computer-readable recording medium having an information collection program recorded thereon, characterized in that: The computer executes the following processing by executing the information collection program: receiving an alarm indicating an abnormality associated with a control station used in the plant; as well as Collecting information for investigating the cause of the alarm from the location of the control station identified based on the received alarm, The alarm is identified in correspondence with arbitration, the arbitration combining location information indicating the type of location of the control station and position information indicating the position of the location, The location information includes Information indicating the control bus to which the control station is connected, Indicates the information of the CPU card in the control station, Indicates the overall information of the I / O kit in the control station, and Indicates information about the I / O modules in the control station At least one of The location information includes Information indicating the position of a domain of a control bus into which a plurality of control stations are divided for each domain, information indicating the location of a control station within a domain, Information indicating the position of the operating CPU or standby CPU among the redundant CPUs in the control station, Information indicating the location of the I / O system within the control station, Information indicating the location of the I / O kit within the control station, Information indicating the location of the I / O device unit within the I / O kit, and Information indicating the location of the slot in the I / O device unit At least one of The collecting process collects the investigation information from a location of a control station determined by arbitration based on the received alarm.

12. An information collection method, characterized in that include: The information collecting device receives an alarm indicating an abnormality associated with a control station used in the plant; as well as The information collecting device collects information for investigating the cause of the alarm from the location of the control station determined based on the received alarm, The alarm is identified in correspondence with arbitration, the arbitration combining location information indicating the type of location of the control station and position information indicating the position of the location, The location information includes Information indicating the control bus to which the control station is connected, Indicates the information of the CPU card in the control station, Indicates the overall information of the I / O kit in the control station, and Indicates information about the I / O modules in the control station At least one of The location information includes Information indicating the position of a domain of a control bus into which a plurality of control stations are divided for each domain, information indicating the location of a control station within a domain, Information indicating the position of the operating CPU or standby CPU among the redundant CPUs in the control station, Information indicating the location of the I / O system within the control station, Information indicating the location of the I / O kit within the control station, Information indicating the location of the I / O device unit within the I / O kit, and Information indicating the location of the slot in the I / O device unit At least one of Collecting the investigative information includes collecting the investigative information from a location of a control station determined by arbitration based on the received alarm.

Images