Monitoring control apparatus, and method of outputting log of monitoring control apparatus

Abstract

To generate a log in a display format which allows abnormality on software and hardware to be easily visualized.SOLUTION: A monitoring control apparatus 100 according to the present invention has a control unit 21 for processing data including data of target equipment 75 and handled by the monitoring control apparatus 100, a log buffer 28 for storing a plurality of logs lgi output from a control unit 21 and including an operation status of the monitoring control apparatus 100, and an analysis device 41 for analyzing the log lgi stored in the log buffer 28. The analysis device 41 has a data analysis unit 46 which, when predetermined or estimated attention information md is detected in the log lgi, generates a change log lgc with changed display format of the log lgi, and, when the attention information md is not detected in the log lgi, does not change the log lgi to output it.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a monitoring control device and a log output method for the monitoring control device. [Background technology]

[0002] A monitoring and control device that monitors and controls large-scale facilities such as social infrastructure is connected to a large number of devices to be monitored and controlled, i.e., target devices. Patent Document 1 discloses an embedded device that is installed in the monitoring and control device and stores progress information from when the monitoring and control device is powered on to when the OS (Operating System) starts up. The embedded device in Patent Document 1 is equipped with a CPU (Central Processing Unit), a control unit, and a storage unit, and when a failure occurs in the embedded device, by checking the console log, which is the saved progress information, it is possible to determine whether the cause of the failure is in the startup process. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-5586 Summary of the Invention [Problem to be solved by the invention]

[0004] The embedded device of Patent Document 1 allows the user to check stored historical information when a failure occurs in the embedded device, but does not describe how to handle logs that record the operating status, malfunction status, etc. of the monitoring and control device. Monitoring and control devices that monitor and control large-scale facilities such as social infrastructure record many logs, so if there is an abnormality in the monitoring and control device, there is a risk that software and hardware abnormalities will be overlooked if the on-site workers do not have sufficient skills. Even if the embedded device of Patent Document 1 is installed in the monitoring and control device, the problem of software and hardware abnormalities being overlooked if the on-site workers do not have sufficient skills cannot be solved.

[0005] The present disclosure aims to generate a log in a display format that allows software and hardware abnormalities to be easily visually recognized. [Means for solving the problem]

[0006] A monitoring control device according to the present disclosure is a monitoring control device that monitors and controls multiple target devices, and includes: a control unit that processes data handled by the monitoring control device, including data on the target devices; a log buffer that stores multiple logs including the operating status of the monitoring control device output from the control unit; and an analysis device that analyzes the logs stored in the log buffer. The analysis device includes a data analysis unit that, when predetermined or estimated information of interest is detected in the log, generates a modified log in which the display format of the log is modified, and, when information of interest is not detected in the log, outputs the log without modification. [Effects of the Invention]

[0007] According to the monitoring control device disclosed herein, the data analysis unit generates a modified log by changing the display format of the log in which the information of interest was detected, thereby generating a log in a display format that allows software and hardware abnormalities to be easily visually identified. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating a configuration of a monitoring and control device according to a first embodiment. [Figure 2] FIG. 2 is a diagram showing the configuration of a control unit board in FIG. [Figure 3] FIG. 3 is a diagram showing the configuration of software installed in the control unit of FIG. 2. [Figure 4] FIG. 3 is a diagram illustrating an example of a hardware configuration that realizes the functions of the analysis device in FIG. 2 by digital calculation. [Figure 5] FIG. 2 is a diagram illustrating a hardware configuration of a maintenance computer in FIG. [Figure 6] 4 is a flowchart showing the operation of the monitoring and control device according to the first embodiment. [Figure 7] FIG. 3 is a diagram illustrating the operation of the monitoring and control device according to the first embodiment. [Figure 8] FIG. 3 is a diagram showing a first example of a console output in FIG. 2. [Figure 9] 3 is a diagram showing an example of a log changed by the data analysis unit of FIG. 2. FIG. [Figure 10] FIG. 3 is a diagram showing a second example of the console output of FIG. 2. [Figure 11] FIG. 3 is a diagram showing a third example of the console output of FIG. 2. [Figure 12] FIG. 8 is a diagram showing an example of the detection pattern in FIG. 7. [Figure 13] FIG. 8 is a diagram illustrating another example of the data analysis unit in FIG. 7. [Figure 14] FIG. 14 is a diagram illustrating the configuration of a learning device that generates the analysis model of FIG. [Figure 15] 15 is a flowchart showing the learning process of the learning device of FIG. 14. [Figure 16] FIG. 10 is a diagram showing the configuration of a control unit board in a monitoring control device according to a second embodiment. [Figure 17] 10 is a flowchart showing the operation of the monitoring control device according to the second embodiment. [Figure 18] FIG. 10 is a diagram illustrating the operation of the monitoring and control device according to the second embodiment. [Figure 19] FIG. 19 is a diagram illustrating another example of the data analysis unit of FIG. DETAILED DESCRIPTION OF THE INVENTION

[0009] Embodiment 1 FIG. 1 is a diagram showing the configuration of a monitoring control device according to a first embodiment, and FIG. 2 is a diagram showing the configuration of a control unit board in FIG. 1. FIG. 3 is a diagram showing the configuration of software installed in the control unit in FIG. 2. FIG. 4 is a diagram showing an example of a hardware configuration that realizes the functions of the analysis device in FIG. 2 through digital calculations. FIG. 5 is a diagram showing the hardware configuration of a maintenance computer in FIG. 1. FIG. 6 is a flowchart showing the operation of the monitoring control device according to the first embodiment, and FIG. 7 is a diagram explaining the operation of the monitoring control device according to the first embodiment. FIG. 8 is a diagram showing a first example of the console output in FIG. 2, and FIG. 9 is a diagram showing an example of a log changed by the data analysis unit in FIG. 2. FIG. 10 is a diagram showing a second example of the console output in FIG. 2, and FIG. 11 is a diagram showing a third example of the console output in FIG. 2. FIG. 12 is a diagram showing an example of the detection pattern in FIG. 7. FIG. 13 is a diagram showing another example of the data analysis unit in FIG. 7. FIG. 14 is a diagram showing the configuration of a learning device that generates the analysis model in FIG. 13, and FIG. 15 is a flowchart showing the learning process of the learning device in FIG. 14. The monitoring control device 100 according to the first embodiment monitors and controls multiple target devices 75. The monitoring control device 100 includes, for example, a plurality of IO (Input Output) boards 11, 12, 13, and 14, a plurality of communication unit boards 15 and 16, a hub board 17, a control unit board 18, and a power supply board 19. Fig. 1 shows an example of the monitoring control device 100 including four IO boards 11, 12, 13, and 14, two communication unit boards 15 and 16, one hub board 17, one control unit board 18, and one power supply board 19.

[0010] The monitoring and control device 100 monitors and controls social infrastructure equipment such as river management equipment, road management equipment, disaster prevention and facility management equipment, etc. The target equipment 75 monitored and controlled by the monitoring and control device 100 is process equipment such as sensors such as water level gauges, pump control panels, rotating lights, information display boards, cameras, speakers, and microphones. Each of the IO boards 11, 12, 13, and 14 has an input / output interface 71 and is connected to the target equipment 75 via a signal line 73. Each of the communication unit boards 15 and 16 has a network interface 72 and is connected to the target equipment 75 via a network 74. The control unit board 18 processes data handled by the monitoring and control device 100, including data from the target equipment 75, and manages input and output of data to and from the maintenance computer 90. The data from the target equipment 75 is data output from the target equipment 75. The hub board 17 connects the communication unit boards 15 and 16 to the control unit board 18 via a LAN (Local Area Network). The power supply board 19 supplies power to the IO boards 11, 12, 13, and 14, the communication boards 15 and 16, the hub board 17, and the control board 18. The IO boards 11, 12, 13, and 14 are connected to the control board 18 by signal lines (not shown).

[0011] The control unit board 18 includes a control unit 21 that processes data handled by the monitoring control device 100, including data on the target device 75; a log buffer 28 that stores multiple log IGIs containing the operating status of the monitoring control device 100 output from the control unit 21; an analysis device 41 that analyzes the log IGIs stored in the log buffer 28; and a maintenance port 20 that connects a maintenance computer 90 when maintaining the monitoring control device 100. The control unit board 18 is connected to the maintenance computer 90 via a serial signal line 98. Normally, during steady operation of the monitoring control device 100, the maintenance computer 90 used by a field worker performing maintenance, i.e., a maintenance technician, is not connected to the monitoring control device 100. The maintenance technician visits the site where the monitoring control device 100 is installed and performs maintenance work on the monitoring control device 100 and the target device 75, for periodic maintenance or when receiving an abnormality notification from a higher-level device, such as a higher-level monitoring control desk that manages the monitoring control device 100 or a terminal computer of the higher-level monitoring control device. The upper-level monitoring and control console, the terminal computer of the upper-level monitoring and control device, etc. are connected to the monitoring and control device 100 via, for example, a network 74, a wireless network, etc. The abnormality occurrence notification is sent when an abnormal phenomenon, such as a disconnection of the connection between the monitoring and control device 100 and the upper-level device, is detected.

[0012] The maintenance computer 90 includes, for example, a processor 91, a memory 92, a monitor 93, a serial interface 95, and a serial port 94, and various functions are realized by the processor 91 executing programs stored in the memory 92. The processor 91, memory 92, monitor 93, and serial interface 95 are all connected by bus signal lines 96, and the serial interface 95 is connected to the serial port 94 by a serial signal line 97. When the maintenance computer 90 is connected to the monitoring and control device 100, the serial port 94 of the maintenance computer 90 and the maintenance port 20 of the monitoring and control device 100 are connected by a serial signal line 98. The maintenance computer 90 also includes input devices such as a keyboard and a mouse (not shown).

[0013] The control unit 21 includes a processor 22, a memory 23, and a serial controller 24. The processor 22, memory 23, and serial controller 24 are connected to one another via a bus signal line 25. The processor 22 executes programs stored in the memory 23, thereby realizing various functions of the control unit 21. FIG. 3 shows an example of the software configuration installed in the control unit 21. The control unit 21 is equipped with basic software 32 including a driver 33, an OS 34, a boot loader 35, and applications 31. The log lgi output by the control unit 21 is stored in the log buffer 28 via the serial controller 24 and serial signal line 48a. The log buffer 28 is a ring buffer, and if the control unit 21 outputs log lgi that exceeds the capacity of the log buffer 28, the log buffer 28 overwrites the oldest log lgi first. The log buffer 28 and the analysis device 41 are connected via a signal line 39.

[0014] The analysis device 41 includes an anomaly detection circuit 42 having an input / output management unit 43, a connection detection unit 44, a log buffer management unit 45, and a data analysis unit 46, and a memory 47. The analysis device 41 is, for example, an FPGA (Field Programmable Gate Array) or a SOC (System on Chip). The input / output management unit 43 manages the flow of data between the maintenance port 20 and the data analysis unit 46. The connection detection unit 44 detects whether a maintenance computer 90 is connected to the maintenance port 20. The log buffer management unit 45 manages the acquisition of the log lgi from the log buffer 28. The data analysis unit 46 analyzes the log lgi stored in the log buffer 28. More specifically, when a detection pattern md, which is predetermined or estimated information of interest, is detected in the log lgi, the data analysis unit 46 generates a change log lgc in which the display format of the log lgi is changed, and when the detection pattern md, which is information of interest, is not detected in the log lgi, the data analysis unit 46 outputs the log lgi without changing it. The analysis device 41 is connected to the maintenance port 20 by a serial signal line 48b.

[0015] When the maintenance computer 90 is connected to the monitoring and control device 100, the analysis device 41 relays the log lgi output by the control unit 21 to the maintenance computer 90. The analysis device 41 also performs an anomaly detection process on the log lgi and generates a log lgo in a display format that allows for easy visual identification of software and hardware anomalies. The log lgo includes a change log lgc when a detection pattern md, which is the information of interest, is detected, i.e., when an anomaly is detected, and a log lgi when the detection pattern md, which is the information of interest, is not detected, i.e., when no anomaly is detected. When the maintenance computer 90 is connected to the monitoring and control device 100, the log lgo output to the maintenance computer 90 is in a display format that allows for easy visual identification of software and hardware anomalies. This allows even insufficient skills of on-site workers (maintenance workers) to easily recognize software and hardware anomalies without overlooking them. The log lgi includes information indicating anomalies in the software installed in the control unit 21, anomalies in some hardware of the monitoring and control device 100, and anomalies in the target device 75.

[0016] A maintenance worker connects the maintenance computer 90 to the monitoring and control device 100 and starts a terminal emulator when acquiring multiple logs lgi containing the operating status of the monitoring and control device 100 from the monitoring and control device 100. The terminal emulator is, for example, a VT100-compliant emulator. VT100 is a video display terminal manufactured by DEC (Digital Equipment Corporation). Here, the terminal emulator running on the maintenance computer 90 is called a console. The console output Lgco output by the monitoring and control device 100 via the serial signal line 98 is in a data format that can be sent and received by the terminal emulator. FIG. 2 shows an example in which multiple logs lgo are output as console output Lgco. Of the multiple logs lgo, the first log lgo1 and the Nth log lgoN are specifically shown.

[0017] The operation of the monitoring control device 100 will be described in detail. When the maintenance computer 90 is not connected to the monitoring control device 100, the log lgi output by the control unit 21 is stored in the log buffer 28 via the serial controller 24 and serial signal line 48a. When the maintenance computer 90 is not connected to the monitoring control device 100, the analysis device 41 stops acquiring the log lgi from the log buffer 28. When the maintenance computer 90 is connected to the monitoring control device 100, the log buffer management unit 45 acquires the logs lgi that have not been read out from the logs lgi stored in the log buffer 28, and outputs the result of the change made by the data analysis unit 46, i.e., the change log lgc or the log lgi, as a console output Lgco to the maintenance port 20 via the input / output management unit 43.

[0018] First, a first analysis device 41 will be described, which is an example of an analysis device 41 that performs anomaly detection processing using a detection pattern md, which is predetermined information of interest, and which is stored in a memory 47 in advance. Next, a second analysis device 41 will be described, which is another example of an analysis device 41 that performs anomaly detection processing using a detection pattern md, which is estimated information of interest. As shown in FIG. 7, the first analysis device 41 includes a data analysis unit 46 that includes an analysis unit 52 and a change unit 53. An example of a detection pattern md, which is predetermined information of interest, is shown in FIG. 12. Ten detection patterns md are shown in FIG. 12. The detection patterns md are collectively referred to as md, and md1 to md10 are used to distinguish them. Detection patterns md1 to md6 are detection patterns used to detect software anomalies. Detection patterns md7 and md8 are detection patterns for detecting hardware abnormalities, and detection patterns md9 and md10 are detection patterns for detecting software or hardware abnormalities according to the use and purpose of the installed application 31.

[0019] Detection pattern md1 is "not found" and is a pattern that detects when something necessary for processing does not exist or when no results are available. Detection pattern md2 is "LR:" and is a pattern that detects register LR, which stores important data. Detection pattern md3 is "Call trace:" and is a pattern that detects a function call history when an exception occurs in the OS 34 or application 31. Detection patterns md4 to md6 are "SErr", "SError", and "failed command:", respectively, and are patterns that detect hardware-related failures detected by a controller (not shown) built into the control unit 21. Detection patterns md7 and md8 are "voltage value exceeds threshold" and "voltage value is below threshold", respectively, and are patterns that detect abnormalities in hardware voltage values. Detection patterns md9 and md10 are "TEXT1" and "TEXT2", respectively, and are detection patterns that detect abnormalities in software or hardware depending on the use and purpose of the installed application 31. A specific example of "TEXT1" is "frozen", and in this case, "frozen" is a detection pattern that detects when a device external to the control unit 21 related to the execution of the application 31 does not respond due to an abnormal temperature. Figure 11 shows an example of a log lgo that has been detected by the detection pattern md9 in which "frozen" is "TEXT1" and whose display format has been changed.

[0020] The first analysis device 41 uses a detection pattern md, which is predetermined information of interest, to perform pattern matching of the detection pattern md with the log lgi to detect whether there is an abnormality in the log lgi. For example, when detecting an instruction address when an exception occurs as a software abnormality, it is desirable that the detection pattern md to be detected includes a pattern that detects an instruction address output location that should be focused on during debugging. Detection patterns md2 and md3 correspond to this.

[0021] For example, when detecting an abnormality in the power supply voltage value as a hardware abnormality, the detection pattern md can be determined as follows: For the power supply voltage value (targeting all power supplies of the monitoring control device 100) traced by the hardware, part of the message output by the OS34 when there is an abnormal fluctuation can be set as the detection pattern md. Detection patterns md7 and md8 correspond to this.

[0022] 6 to 9, the operation of the monitoring control device 100 equipped with the first analysis device 41 will be described. The connection detection unit 44 outputs a port detection signal sig1 indicating "connection" when the maintenance computer 90 is connected to the maintenance port 20, and outputs a port detection signal sig1 indicating "disconnection" when the maintenance computer 90 is not connected to the maintenance port 20. For example, when the port detection signal sig1 indicates that the maintenance computer 90 is "connected," it is at a high level, and when the port detection signal sig1 indicates that the maintenance computer 90 is "disconnected," it is at a low level. The port detection signal sig1 is output from the connection detection unit 44 to the input / output management unit 43, the log buffer management unit 45, and the data analysis unit 46.

[0023] When the port detection signal sig1 indicates "disconnected," the input / output management unit 43, the log buffer management unit 45, and the data analysis unit 46 do not operate. While the port detection signal sig1 indicates "disconnected," the control unit 21 stores the log lgi in the log buffer 28. For example, consider a case where the 14 log lgi shown in FIG. 8 are stored in the log buffer 28. The log stored in the log buffer 28 is log lgi. Therefore, logs lgo1 to lgo14 are interpreted as logs lgi1 to lgi14. Furthermore, lgo14 indicates the change log lgc, but the log lgi14 stored in the log buffer 28 is in the state before the display format was changed. FIG. 9 shows the log lgi corresponding to log lgi14 before the display format was changed. Three change log examples 51a, 51b, and 51c are shown in FIG. 9 as examples of the change log lgc whose display format has been changed. The change log example 51a is an example in which the color has been changed. In this case, the color display format has been changed. Change log examples 51b and 51c are examples in which the display format has been changed by adding a marker character Mk to the left of the timestamp ([Mon Apr 03 11:16:05 2023]) to the left of the log lgi. The marker character Mk in change log example 51b is an example of a "space," while the marker character Mk in change log example 51c is an example of a "QQ." Note that a single "space" is inserted between the marker character Mk and the timestamp. The difference between the change log lgc in change log example 51a and the log lgi before the change is the displayed color. The difference between the change log lgc in change log examples 51b and 51c and the log lgi before the change is the presence or absence of the marker character Mk.

[0024] When the maintenance computer 90 is connected to the maintenance port 20, the connection detection unit 44 detects that the maintenance computer 90 has been connected to the maintenance port 20 and outputs a port detection signal sig1 indicating "connection." In step ST1, the analysis device 41 acquires unread logs lgi from the log buffer 28 (log acquisition process). The log buffer management unit 45 manages the acquisition of the logs lgi from the log buffer 28 and includes an address memory 49 that stores previous final log address information Pad1, which is information on the address in the log buffer 28 from which the log lgi was last read in the previous log acquisition process, and past log address information Pad2, which is information on the last address to be acquired this time. If this log acquisition process is the first time, the log lgi is read from an initial setting address, which is the default address of the log buffer 28. In other words, the previous final log address information Pad1 in the first case is the initial setting address. The log buffer management unit 45 outputs the logs lgi and the data information signal sigp to the data analysis unit 46. The log lgi from the address next to the previous final log address information Pad1 to the address of the past log address information Pad2 is past data. The log lgi at an address different from the past log address information Pad2 is new data different from past data. For example, the data information signal sigp is at a low level when the log lgi indicates that it is past data, and at a high level when it indicates that it is new data. The previous final log address information Pad1 is rewritten, i.e., updated, to the past log address information Pad2 when acquisition of all past data has been completed. In addition, each time new data is acquired, the previous final log address information Pad1 is updated to information on the address in the log buffer 28 where the log lgi of the new data is saved.

[0025] The data analysis unit 46 determines whether each input log lgi is past data or new data based on the data information signal sigp. The data analysis unit 46 includes an analysis unit 52 that determines whether the log lgi contains a detection pattern md based on the detection pattern md, which is information of interest stored in the memory 47, and a modification unit 53 that generates a modified log lgc by modifying the display format of the log lgi when a predetermined detection pattern md is detected in the log lgi, and outputs the log lgi without modification when the detection pattern md is not detected in the log lgi.

[0026] In step ST2, the data analysis unit 46 performs pattern matching of the detection pattern md with the log lgi using the analysis unit 52 (pattern matching step). In step ST3, the data analysis unit 46 determines whether the detection pattern md is detected in the log lgi for which the pattern matching step is performed, i.e., whether an abnormality exists (determination step). The pattern matching step and the determination step constitute a log analysis step performed by the data analysis unit 46. If the data analysis unit 46 determines that an abnormality exists in the determination step, it executes step ST4. If the data analysis unit 46 determines that an abnormality does not exist, i.e., that an abnormality does not exist, it executes step ST5. In step ST4, the data analysis unit 46 changes the display format of the log lgi using the change unit 53 and generates a change log lgc (change log generation step). Furthermore, if the data analysis unit 46 determines that an abnormality does not exist in the determination step, it outputs the log lgi without changing it using the change unit 53. The data analysis unit 46 outputs the change log lgc or the log lgi as the log lgo to the input / output management unit 43. In step ST5, the input / output management unit 43 outputs the log lgo received from the data analysis unit 46 to the maintenance computer 90 as a console output Lgco via the maintenance port 20 (a console output output step).

[0027] The console output Lgco has multiple logs lgo. An example of a console output Lgco having 14 logs lgo is shown in FIG. 8. In FIG. 8, the logs lgo are numbered in order from top to bottom, and the following are listed: log lgo1, log lgo2, log lgo3, log lgo4, log lgo5, log lgo6, log lgo7, log lgo8, log lgo9, log lgo10, log lgo11, log lgo12, log lgo13, and log lgo14. The "N" in log lgoN shown in FIGS. 2 and 7 is a symbol added to distinguish each log lgo, and log lgo1 indicates a log lgo whose N is 1. For log lgo1, the log lgi obtained from the log buffer 28 was "no abnormality," meaning that the detection pattern md was not detected in the log lgi, so the display format was not changed and log lgi became log lgo. As with log lgo1, for logs lgo2 to lgo13, the log lgi obtained from the log buffer 28 is "no abnormality", meaning that the detection pattern md was not detected in the log lgi, so the display format is not changed and log lgi becomes log lgo.

[0028] For log lgo14, the log lgi obtained from the log buffer 28 indicates "abnormality exists," i.e., the detection pattern md was detected in the log lgi, so the change log lgc with a changed display format is the log lgo. Since the pre-change log lgi corresponding to this log lgo14 contains the detection pattern md1, the analysis unit 52 of the data analysis unit 46 determines that "abnormality exists," and the change unit 53 of the data analysis unit 46 generates a change log lgc by changing the display format of the pre-change log lgi. As described above, the pre-change log lgi corresponding to log lgo14 is the log lgi shown in FIG. 9. The log lgo14 shown in FIG. 8 is an example in which the change log lgc has become the change log example 51a. The console output Lgco is displayed on the monitor 93 of the maintenance computer 90 by a terminal emulator running on the maintenance computer 90. The console output Lgco shown in the box in FIG. 8 is displayed on the monitor 93 of the maintenance computer 90.

[0029] Figure 10 shows an example of console output Lgco in which the instruction address at the time of exception occurrence was detected. Figure 10 shows an example in which the console output Lgco has 11 logs lgo. The console output Lgco shown in the box in Figure 10 is displayed on the monitor 93 of the maintenance computer 90. Only the order of the logs lgo is shown on the left side of the box. For the third log lgo, detection pattern md2 was detected in the corresponding pre-change log lgi, so the change log lgc with the changed display format is the log lgo. For the eleventh log lgo, detection pattern md3 was detected in the corresponding pre-change log lgi, so the change log lgc with the changed display format is the log lgo.

[0030] The analysis device 41 also has a function for generating a log lgo that distinguishes whether the log lgi acquired from the log buffer 28 is past data or new data. FIG. 11 shows an example of a console output Lgco in which past data log lgo30 is displayed followed by new data logs lgo31 to lgo34. The example in FIG. 11 shows an example in which the display format is changed using color to distinguish between past data and new data. The upper part of FIG. 11 shows new data logs lgi31 to lgi34. The new data logs lgi31 to lgi34 are displayed in a first color, the new data log lgo31 is displayed in a first color, and the new data logs lgo32 to lgo34 are displayed in a second color. For example, the first color is black and the second color is red. The past data log lgo30 is displayed in a third color that is different from the first and second colors. For example, the third color is green. In Figure 11, the first color is displayed in thin text, the second color is displayed in bold text, and the third color is displayed in inclined text. When the display format is changed by color to distinguish between old and new data, up to four colors are used. Log lgo30 in Figure 11 is displayed in the third color when there is no abnormality, but when there is an abnormality, log lgo30 is displayed in the fourth color.

[0031] Changing the display format to distinguish between old and new data is not limited to color. For example, a display indicating new data, such as "<< NEW DATA >>," may be inserted after the old data lgo30, and the new data logs lgo31 to lgo34 may be displayed from the next line. In this case, the console output Lgco can be said to display the old and new data separately on the monitor 93. The display indicating new data is generated and output only at the beginning when the change unit 53 starts outputting the new data ~ log lgo. If the display format is not changed using color to distinguish between old and new data, even if the log lgi and the change log lgc are displayed using different colors, there is an effect that only two colors, a first color and a second color, can be used.

[0032] Log lgo31 remains as log lgi31. Log lgo32 has been changed to change log lgc32 with a changed display format because detection pattern md9 and detection pattern md4, which change "TEXT1" to "frozen," were detected in the corresponding pre-change log lgi32. Log lgo33 has been changed to change log lgc33 with a changed display format because detection pattern md5 was detected in the corresponding pre-change log lgi33. Log lgo34 has been changed to change log lgc34 with a changed display format because detection pattern md6 was detected in the corresponding pre-change log lgi34.

[0033] When the change in display format to distinguish between past data and new data is performed using color, the data analysis unit 46 changes the color in which the log lgi or change log lgc is displayed when a data information signal sigp indicating new data is input to a color different from the color of the log lgi and change log lgc output before the data information signal sigp indicating new data is input.

[0034] The input / output management unit 43, the connection detection unit 44, the log buffer management unit 45, and the data analysis unit 46, which are functional blocks of the abnormality detection circuit 42, may be realized by a processor 88 and a memory 89 shown in Fig. 4. In this case, the input / output management unit 43, the connection detection unit 44, the log buffer management unit 45, and the data analysis unit 46 are realized by the processor 88 executing a program stored in the memory 89. Furthermore, a plurality of processors 88 and a plurality of memories 89 may cooperate to execute each function.

[0035] The first analysis device 41 required the prior analysis of the log lgi and extraction of the detection pattern md. However, to shorten the time required for the prior analysis of the log lgi and extraction of the detection pattern md, the detection pattern md may be determined using artificial intelligence (AI). FIG. 13 shows an example of a data analysis unit 46 when pattern matching of the log lgi is performed using an analysis model Mas, which is a trained model that estimates the detection pattern md. The second analysis device 41 differs from the first analysis device 41 in that the analysis unit 52 of the data analysis unit 46 includes an estimation unit 54, a model memory 55, and a determination unit 56. The following mainly describes the differences from the first analysis device 41.

[0036] The log acquisition process by the second analysis device 41 is the same as that of the first analysis device 41. The data analysis unit 46 executes the pattern matching process as follows. The data analysis unit 46 estimates a detection pattern md from the log lgi for which the pattern matching process is performed using the analysis model Mas, and performs pattern matching of the detection pattern md with the log lgi based on the detection pattern md, which is information of interest estimated corresponding to the log lgi. The estimation unit 54 estimates the detection pattern md from the log lgi for which the pattern matching process is performed using the analysis model Mas, and outputs the estimated detection pattern md to the determination unit 56. As a determination process, the determination unit 56 determines whether the detection pattern md is detected in the log lgi for which the pattern matching process is performed, i.e., whether an abnormality exists. If the determination unit 56 detects the detection pattern md in the log lgi, i.e., if it determines that an abnormality exists, it outputs an analysis result signal sig2 indicating that an abnormality exists. Furthermore, if the determination unit 56 does not detect the detection pattern md in the log lgi, i.e., if it determines that "no abnormality is present," it outputs an analysis result signal sig2 indicating "no abnormality." The analysis result signal sig2 is, for example, at a high level when it indicates "abnormality is present" and at a low level when it indicates "no abnormality." As a change log generation step, the modification unit 53 changes the display format of the log lgi when it receives the analysis result signal sig2 indicating "abnormality is present" and generates a change log lgc. Furthermore, the modification unit 53 outputs the log lgi as is without modification when it receives the analysis result signal sig2 indicating "no abnormality." The data analysis unit 46 outputs the change log lgc or log lgi as log lgo to the input / output management unit 43.

[0037] Next, a trained model generation method for generating an analytical model Mas by machine learning and a detection pattern estimation method for estimating a detection pattern md using the trained analytical model Mas will be described.

[0038] <How to generate a trained model> 14 is a configuration diagram of a learning device that generates an analytical model Mas used by an estimation unit 54 that estimates a detection pattern md, which is information of interest, in an analysis unit 52 of a data analysis unit 46. The learning device 60 includes a data acquisition unit 61, a model generation unit 62, and a model storage unit 63 that stores a learned analytical model Mas.

[0039] The data acquisition unit 61 acquires a plurality of logs lgi containing an abnormality, i.e., a plurality of input data data1, as learning data. The model generation unit 62 learns a detection pattern md, which is information of interest, based on the learning data created based on the plurality of logs lgi containing an abnormality output from the data acquisition unit 61. That is, it generates an analysis model Mas, which is a trained model that estimates information of interest that should be noted as an abnormality, i.e., a detection pattern md that should be detected as an abnormality, from the plurality of logs lgi containing an abnormality input to the analysis unit 52 of the data analysis unit 46.

[0040] The learning algorithm used by the model generation unit 62 can be a known algorithm such as supervised learning, unsupervised learning, or reinforcement learning. As an example, we will explain the case where K-means (clustering), which is unsupervised learning, is applied. Unsupervised learning is a method of learning features in learning data by providing the learning device with learning data that does not contain results (labels).

[0041] The model generation unit 62 learns the detection pattern md, which is the information of interest, by so-called unsupervised learning, for example, in accordance with a grouping method using the K-means method. The K-means method is a non-hierarchical clustering algorithm that uses the cluster average to classify a given number of clusters into k.

[0042] Specifically, the K-means algorithm works as follows: First, each data item xi is randomly assigned to a cluster. Next, the center Vj of each cluster is calculated based on the assigned data. Next, the distance between each data item xi and each center Vj is calculated, and the data item xi is reassigned to the cluster with the closest center. If the cluster assignment for all data items xi remains unchanged through the above process, or if the amount of change falls below a preset threshold, it is determined that convergence has occurred and the process ends.

[0043] In the present disclosure, a detection pattern md, which is information of interest, is learned by so-called unsupervised learning in accordance with learning data created based on multiple pieces of input data data1 acquired by a data acquisition unit 61. A model generation unit 62 generates and outputs an analysis model Mas, which is a trained model, by executing the above-described learning. A model storage unit 63 stores the analysis model Mas, which is a trained model output from the model generation unit 62.

[0044] Next, the learning process of the learning device 60 will be described with reference to Fig. 15. Fig. 15 is a flowchart relating to the learning process of the learning device 60. In step ST21, the data acquisition unit 61 acquires a plurality of pieces of input data data1.

[0045] In step ST22, the model generation unit 62 learns the detection pattern md, which is information of interest, by so-called unsupervised learning in accordance with learning data created based on the plurality of input data data1 acquired by the data acquisition unit 61, and generates an analytical model Mas, which is a trained model. In step ST23, the model storage unit 63 stores the analytical model Mas, which is the trained model generated by the model generation unit 62.

[0046] <Detection pattern estimation method> FIG. 13 shows the analysis unit 52 of the data analysis unit 46, which includes an estimation unit 54 that estimates a detection pattern md, which is information of interest, using the analysis model Mas. The estimation unit 54 acquires the log lgi and estimates the detection pattern md, which is information of interest, obtained using the analysis model Mas, which is a trained model stored in the model memory 55. That is, by inputting the log lgi into the analysis model Mas, which is a trained model, it is possible to estimate to which cluster the log lgi belongs and output the estimation result as the detection pattern md, which is information of interest. In this way, the estimation unit 54 outputs the detection pattern md, which is information of interest obtained based on the log lgi, to the determination unit 56.

[0047] In this embodiment, the detection pattern md, which is the information of interest, is output using the analytical model Mas, which is a learned model learned by the model generation unit 62 of the learning device 60. However, it is also possible to acquire the analytical model Mas, which is a learned model installed in another monitoring control device, etc., and output the detection pattern md, which is the information of interest, based on the analytical model Mas, which is a learned model.

[0048] The learning algorithm used in the learning device 60 may be deep learning, which learns to extract the feature amount itself, or any other known method.

[0049] When realizing the unsupervised learning in this embodiment, the method is not limited to the non-hierarchical clustering using the K-means method as described above, but may be any other known method capable of clustering. For example, it may be a hierarchical clustering method such as a shortest distance method.

[0050] In this embodiment, the learning device 60 may be connected to the monitoring control device 100 via a network, for example, and may be a device separate from the monitoring control device 100. The learning device 60 may also be built into the monitoring control device 100. Furthermore, the learning device 60 may exist on a cloud server.

[0051] The model generation unit 62 may also learn the detection pattern md, which is the information of interest, according to learning data created for multiple monitoring control devices 100. The model generation unit 62 may acquire learning data from multiple monitoring control devices 100 used in the same area, or may learn the detection pattern md, which is the information of interest, using learning data collected from multiple monitoring control devices 100 operating independently in different areas. It is also possible to add or remove monitoring control devices 100 that collect learning data from the targets during the process. Furthermore, the learning device 60 that has learned the detection pattern md, which is the information of interest for a certain monitoring control device 100, may be applied to another monitoring control device 100, and the detection pattern md, which is the information of interest for the other monitoring control device 100, may be re-learned and updated.

[0052] The data analysis unit 46 of the second analysis device 41 includes an estimation unit 54 that estimates the detection pattern md, which is the information of interest, from the log lgi using an analysis model Mas for estimating the detection pattern md, which is the information of interest used when generating the change log lgc, and a determination unit 56 that determines whether the detection pattern md, which is the information of interest estimated by the estimation unit 54, is included in the log lgi. Therefore, the monitoring control device 100 equipped with the second analysis device 41 can shorten the work of analyzing the log lgi in advance and extracting the detection pattern md.

[0053] As described above, the monitoring control device 100 of the first embodiment is a monitoring control device that monitors and controls multiple target devices 75, and includes: a control unit 21 that processes data handled by the monitoring control device 100, including data on the target devices 75; a log buffer 28 that stores multiple logs lgi, including the operating status of the monitoring control device 100, output from the control unit 21; and an analysis device 41 that analyzes the logs lgi stored in the log buffer 28. The analysis device 41 includes a data analysis unit 46 that generates a change log lgc by changing the display format of the log lgi when predetermined or estimated information of interest (detection pattern md) is detected in the log lgi, and outputs the log lgi without changing it when the information of interest (detection pattern md) is not detected in the log lgi. With this configuration, the monitoring control device of the first embodiment can generate a change log lgc by changing the display format of the log lgi in which the information of interest (detection pattern md) is detected, thereby generating a log lgo in a display format that allows software and hardware abnormalities to be easily visually identified.

[0054] The log output method for the monitoring control device of the first embodiment outputs a log lgi in the monitoring control device 100 by an analysis device 41 mounted on the monitoring control device 100, which monitors and controls a plurality of target devices 75. The monitoring control device 100 includes a control unit 21 that processes data handled by the monitoring control device 100, including data on the target devices 75; a log buffer 28 that stores a plurality of log lgi including the operating status of the monitoring control device 100 output from the control unit 21; an analysis device 41 that analyzes the log lgi stored in the log buffer 28; and a maintenance port 20 to which a maintenance computer 90 is connected when maintaining the monitoring control device 100. The log output method for the monitoring control device of the first embodiment includes a log acquisition step of acquiring the log lgi from the log buffer 28 when the maintenance computer 90 is connected to the maintenance port 20, and a log analysis step of analyzing whether predetermined or estimated information of interest (detection pattern md) is present in the log lgi. Furthermore, the log output method for the monitoring control device of embodiment 1 includes a change log generation step of generating a change log lgc in which the display format of the log lgi is changed when noteworthy information (detection pattern md) is present in the log analysis step, and an output step of a console output Lgco of outputting the log lgi or the change log lgc as the console output Lgco to the maintenance computer 90 via the maintenance port 20 in the order of the logs lgi acquired in the log acquisition step. With this configuration, the log output method for the monitoring control device of embodiment 1 generates a change log lgc in which the display format of the log lgi is changed when noteworthy information (detection pattern md) is present in the log analysis step, and therefore can generate a log lgo in a display format that allows software and hardware abnormalities to be easily visually recognized.

[0055] Embodiment 2 Fig. 16 is a diagram showing the configuration of a control unit board in a monitoring control device according to embodiment 2, and Fig. 17 is a flowchart showing the operation of the monitoring control device according to embodiment 2. Fig. 18 is a diagram explaining the operation of the monitoring control device according to embodiment 2, and Fig. 19 is a diagram showing another example of the data analysis unit of Fig. 18. The monitoring control device 100 of embodiment 2 differs from the monitoring control device 100 of embodiment 1 in that it also detects abnormalities in the input information Inti from the maintenance computer 90 via the maintenance port 20. The following mainly describes the parts that differ from the monitoring control device 100 of embodiment 1.

[0056] The analysis device 41 of the second embodiment, like the analysis device 41 of the first embodiment, includes an anomaly detection circuit 42 having an input / output management unit 43, a connection detection unit 44, a log buffer management unit 45, and a data analysis unit 46, and a memory 47. The analysis device 41 of the second embodiment also processes input information Inti in the same way as the analysis device 41 of the first embodiment processes log lgi. The analysis device 41 of the second embodiment analyzes the log lgi and the input information Inti input from the maintenance computer 90, and generates a change log lgc and changed input information Intc by changing the display format of the log lgi and the input information Inti in which an abnormality has been detected. Specifically, the data analysis unit 46 of the analysis device 41 of the second embodiment analyzes the log lgi stored in the log buffer 28 and the input information Inti input from the maintenance port 20. As described in the first embodiment, the data analysis unit 46 processes the log lgi by generating a modified log lgc in which the display format of the log lgi is changed when a detection pattern md, which is predetermined or estimated information of interest, is detected in the log lgi, and outputs the log lgi without changing it when the detection pattern md, which is information of interest, is not detected in the log lgi. Furthermore, as a process of the input information Inti, when the input information Inti is input from the maintenance computer 90 via the maintenance port 20 and the input / output management unit 43, the data analysis unit 46 generates modified input information Intc in which the display format of the input information Inti is changed and outputs the modified input information Intc to the input / output management unit 43 when a detection pattern md, which is predetermined or estimated information of interest, is detected in the input information Inti, and outputs the modified input information Inti to the input / output management unit 43 without changing it when the detection pattern md, which is information of interest, is not detected in the input information Inti. As part of processing the log lgi, the input / output management unit sequentially outputs the log lgi or change log lgc sequentially output from the data analysis unit 46 to the maintenance computer 90 as console output Lgco, and also outputs the input information Inti and change input information Intc sequentially output from the data analysis unit 46 to the maintenance computer 90 via the maintenance port 20 as input information output Into.

[0057] The monitoring control device 100 of the second embodiment also processes the input information Inti, and therefore the first analysis device 41 and the second analysis device 41 described in the first embodiment have additional functions corresponding to the processing of the input information Inti. The operation of the monitoring control device 100 equipped with the first analysis device 41 regarding the processing of the input information Inti will be described with reference to Figures 17 and 18. The memory 47 stores a detection pattern md that is information of interest for detecting the log lgi as an abnormality, as well as a detection pattern md that is information of interest for detecting the input information Inti as an abnormality.

[0058] The connection detection unit 44 outputs a port detection signal sig1 indicating "connected" when the maintenance computer 90 is connected to the maintenance port 20, and outputs a port detection signal sig1 indicating "disconnected" when the maintenance computer 90 is not connected to the maintenance port 20. When the maintenance computer 90 is connected to the maintenance port 20, the connection detection unit 44 detects that the maintenance computer 90 has been connected to the maintenance port 20 and outputs a port detection signal sig1 indicating "connected." In step ST11, the analysis device 41 acquires input information Inti from the maintenance computer 90, which is input to the maintenance port 20, using the input / output management unit 43 (input information acquisition step). In step ST12, the data analysis unit 46 of the analysis device 41 performs pattern matching of the detection pattern md with the input information Inti using the analysis unit 52 (pattern matching step). In step ST13, the data analysis unit 46 determines whether the detection pattern md is detected in the input information Inti for which the pattern matching step is performed, i.e., whether an abnormality exists (determination step). The pattern matching step and the determination step constitute an input information analysis step executed by the data analysis unit 46. If the data analysis unit 46 determines that "an abnormality is present" in the determination step, it executes step ST14, and if the data analysis unit 46 determines that "an abnormality is not present" in the determination step, that is, "no abnormality," it executes step ST15. In step ST14, the data analysis unit 46 changes the display format of the input information Inti using the change unit 53 to generate modified input information Intc (modified input information generation step). Furthermore, if the data analysis unit 46 determines that "no abnormality is present" in the determination step, it outputs the input information Inti without changing it using the change unit 53. The data analysis unit 46 outputs the modified input information Intc or the input information Inti to the input / output management unit 43 as input information output Into. In step ST15, the input / output management unit 43 outputs the input information output Into received from the data analysis unit 46 to the maintenance computer 90 via the maintenance port 20 (input information output output step).

[0059] The input information output Into is sequentially displayed on the monitor 93 of the maintenance computer 90, similar to the console output Lgco. At this time, for input information Inti in which an abnormality has been detected, changed input information Intc is displayed in a different color or with a marker character added, and this is displayed on the monitor 93 of the maintenance computer 90. The input information Inti is changed to changed input information Intc similar to the change log examples 51a, 51b, and 51c shown in FIG. 9. The first example of changed input information Intc is in a different color from the unchanged input information Inti. The other examples of changed input information Intc are examples in which the display format has been changed by adding a marker character Mk to the left of the unchanged input information Inti, i.e., before the input information Inti. An example in which a marker character Mk similar to that in change log example 51b has been added is a second example of changed input information Intc, and an example in which a marker character Mk similar to that in change log example 51c has been added is a third example of changed input information Intc.

[0060] The first analysis device 41 required the prior analysis of the input information Inti and the extraction of the detection pattern md. However, to shorten the time required for the prior analysis of the input information Inti and the extraction of the detection pattern md, the detection pattern md may be determined using artificial intelligence (AI). FIG. 19 shows an example of the data analysis unit 46 when pattern matching of the log lgi and the input information Inti is performed using an analysis model Mas, which is a trained model that estimates a detection pattern md for detecting anomalies in the log lgi and the input information Inti. The second analysis device 41 of the second embodiment differs from the first analysis device 41 in that, like the second analysis device 41 of the first embodiment, the analysis unit 52 of the data analysis unit 46 includes an estimation unit 54, a model memory 55, and a determination unit 56. The second analysis device 41 of the second embodiment differs from the second analysis device 41 of the first embodiment in that the estimation unit 54 estimates a detection pattern md for the input information Inti using the analysis model Mas, which is a trained model, in the same way as the log lgi, and outputs the estimated detection pattern md to the determination unit 56. The following mainly describes the differences between the first analysis device 41 of the second embodiment and the second analysis device 41 of the first embodiment.

[0061] Input data 65 having a log lgi and input information Inti is input to the data analysis unit 46 in the second analysis device 41 of the second embodiment, and output data 66 having a log lgo and input information output Into is output from the change unit 53. The learning of the input information Inti is similar to the learning of the log lgi, and is performed by the learning device 60. The learning device 60 also learns the input information Inti in the same way as the learning of the log lgi, and generates an analysis model Mas, which is a trained model that estimates a detection pattern md for detecting anomalies in the log lgi and the input information Inti. In the trained model generation method and detection pattern estimation method described in the first embodiment, if the log lgi and the changed log lgc are replaced with the input information Inti and the changed input information Intc, the learning of the input information Inti and the generation of the analysis model Mas can be understood, and therefore a description will not be repeated. Note that the analysis model Mas may be a trained model for the log lgi and a trained model for the input information Inti, which may be independent or integrated.

[0062] As described above, the monitoring control device 100 of the second embodiment is a monitoring control device that monitors and controls multiple target devices 75. The monitoring control device 100 includes a control unit 21 that processes data handled by the monitoring control device 100, including data on the target devices 75; a log buffer 28 that stores multiple logs IGI, each containing the operating status of the monitoring control device 100, output from the control unit 21; an analysis device 41 that analyzes the logs IGI stored in the log buffer 28; and a maintenance port 20 to which a maintenance computer 90 is connected when maintaining the monitoring control device 100. The analysis device 41 includes a data analysis unit 46 that generates a change log IGC by changing the display format of the log IGI when predetermined or estimated information of interest (detection pattern MD) is detected in the log IGI, and outputs the log IGI without changing it when the information of interest (detection pattern MD) is not detected in the log IGI. The analysis device 41 also includes an input / output management unit 43 that manages the flow of data between the maintenance port 20 and the data analysis unit 46. When the maintenance computer 90 is connected to the maintenance port 20, the analysis device 41 sequentially acquires the logs lgi stored in the log buffer 28 and sequentially outputs the logs lgi or the change logs lgc output from the data analysis unit 46 to the maintenance computer 90 as console outputs Lgco. When input information Inti from the maintenance computer 90 is input via the maintenance port 20 and the input / output management unit 43, the analysis device 41 generates changed input information Intc by changing the display format of the input information Inti if predetermined or estimated information of interest (detection pattern md) is detected in the input information Inti and outputs the changed input information Intc to the input / output management unit 43, and when the information of interest (detection pattern md) is not detected in the input information Inti, the analysis device 41 outputs the input information Inti to the input / output management unit 43 without changing it, and the input / output management unit 43 outputs the input information Inti and the changed input information Intc sequentially output from the data analysis unit 46 as input information outputs Into to the maintenance computer 90 via the maintenance port 20.With this configuration, the monitoring control device 100 of embodiment 2 has a data analysis unit 46 that generates a modified log lgc and modified input information Intc that change the display format of the log lgi in which the information of interest (detection pattern md) is detected and the input information Inti, so that it is possible to generate a log lgO in a display format that allows software and hardware abnormalities to be easily visually recognized, and an input information output Into in a display format that allows abnormalities in the input information Inti input from the maintenance port 20 to be easily visually recognized.

[0063] A log output method for a monitoring control device according to a second embodiment outputs a log lgi in the monitoring control device 100 by an analysis device 41 mounted on the monitoring control device 100, which monitors and controls a plurality of target devices 75. The monitoring control device 100 includes a control unit 21 that processes data handled by the monitoring control device 100, including data on the target devices 75; a log buffer 28 that stores a plurality of log lgi including the operating status of the monitoring control device 100 output from the control unit 21; an analysis device 41 that analyzes the log lgi stored in the log buffer 28; and a maintenance port 20 to which a maintenance computer 90 is connected when maintaining the monitoring control device 100. The log output method for a monitoring control device according to the second embodiment includes a log acquisition step of acquiring the log lgi from the log buffer 28 when the maintenance computer 90 is connected to the maintenance port 20, and a log analysis step of analyzing whether predetermined or estimated information of interest (detection pattern md) is present in the log lgi. The method further includes a change log generating step of generating a change log lgc in which the display format of the log lgi is changed if the log analysis step finds information of interest (detection pattern md), and an output step of a console output Lgco of outputting the log lgi or the change log lgc as console output Lgco to the maintenance computer 90 via the maintenance port 20 in the order of the logs lgi acquired in the log acquisition step. The log output method for the monitoring and control device of the second embodiment also includes an input information acquiring step of acquiring input information Inti from the maintenance computer 90 via the maintenance port 20, an input information analyzing step of analyzing whether predetermined or estimated information of interest (detection pattern md) is present in the input information Inti, a changed input information generating step of generating changed input information Intc in which the display format of the input information Inti is changed if the information of interest (detection pattern md) is present in the input information analyzing step, and an input information output output step of outputting the input information Inti or the changed input information Intc as input information output Into to the maintenance computer via the maintenance port in the order of the input information Inti acquired in the input information acquisition step.With this configuration, the log output method of the monitoring control device of embodiment 2 generates a change log lgc in which the display format of the log lgi is changed when noteworthy information (detection pattern md) is present in the log analysis process through a change log generation process, and generates changed input information Intc in which the display format of the input information Inti is changed when noteworthy information (detection pattern md) is present in the log analysis process through a change input information generation process.Therefore, it is possible to generate a log lgO in a display format that allows software and hardware abnormalities to be easily visually identified, and an input information output Into in a display format that allows abnormalities in the input information Inti input from the maintenance port 20 to be easily visually identified.

[0064] Although various exemplary embodiments and examples are described in this disclosure, the various features, aspects, and functions described in one or more embodiments are not limited to the application of a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless modifications not illustrated are contemplated within the scope of the technology disclosed in this specification. For example, this includes cases where at least one component is modified, added, or omitted, and even cases where at least one component is extracted and combined with components of other embodiments.

[0065] Although the preferred embodiments have been described in detail above, the present invention is not limited to the above-described embodiments, and various modifications and substitutions can be made to the above-described embodiments without departing from the scope of the claims.

[0066] Various aspects of the present disclosure are summarized below as appendices.

[0067] (Appendix 1) A monitoring and control device that monitors and controls a plurality of target devices, The system includes a control unit that processes data handled by the monitoring control device, including data on the target device; a log buffer that stores multiple logs including the operating status of the monitoring control device output from the control unit; and an analysis device that analyzes the logs stored in the log buffer, The analytical device a data analysis unit that generates a modified log in which the display format of the log is modified when predetermined or estimated information of interest is detected in the log, and that outputs the log without modification when the information of interest is not detected in the log; Monitoring and control equipment. (Appendix 2) a maintenance port for connecting a maintenance computer when maintaining the monitoring control device; When the maintenance computer is connected to the maintenance port, The analytical device sequentially acquiring the logs stored in the log buffer, and sequentially outputting the logs or the change logs output from the data analysis unit to the maintenance computer as console outputs; 10. The monitoring and control device of claim 1. (Appendix 3) The difference between the change log and the log before the change is the displayed color or the presence or absence of highlighted characters. 10. The monitoring and control device of claim 1. (Appendix 4) The difference between the change log and the log before the change is the displayed color or the presence or absence of highlighted characters. 3. The monitoring and control device according to claim 2. (Appendix 5) The analytical device a log buffer management unit that manages acquisition of the log from the log buffer; The log buffer management unit saves past log address information, which is information on the address where the log was saved in the log buffer when the maintenance computer was connected to the maintenance port, and when the log is acquired from an address different from the past log address information, outputs a data information signal to the data analysis unit indicating that the log is new data; The data analysis unit changing the color in which the log or the change log is displayed when the data information signal indicating the new data is input to a color different from the color of the log or the change log output before the data information signal indicating the new data is input; 5. The monitoring and control device according to claim 2 or 4. (Appendix 6) The analysis device includes a memory in which predetermined attention information is stored, The data analysis unit an analysis unit that determines whether the log contains the attention information based on the attention information stored in the memory; 6. The monitoring and control device according to any one of appendices 1 to 5. (Appendix 7) The data analysis unit of the analysis device an estimation unit that estimates the attention information from the log using an analysis model for estimating the attention information used when generating the change log; a determination unit that determines whether the attention information estimated by the estimation unit is included in the log; Equipped with 6. The monitoring and control device according to any one of appendices 1 to 5. (Appendix 8) the analysis device includes an input / output management unit that manages data flow between the maintenance port and the data analysis unit, The data analysis unit When input information is input from the maintenance computer via the maintenance port and the input / output management unit, When the predetermined or estimated attention information is detected in the input information, modified input information in which a display format of the input information is modified is generated and output to the input / output management unit, and when the attention information is not detected in the input information, the input information is output to the input / output management unit without being modified; the input / output management unit outputs the input information and the changed input information sequentially output from the data analysis unit as input information output to the maintenance computer via the maintenance port; 6. The monitoring and control device according to any one of appendixes 2, 4, and 5. (Appendix 9) The analysis device includes a memory in which predetermined attention information is stored, The data analysis unit an analysis unit that determines whether the attention information is included in the log and the input information based on the attention information stored in the memory; 9. The monitoring and control device of claim 8. (Appendix 10) The data analysis unit of the analysis device an estimation unit that estimates the attention information from the log and the input information using an analysis model for estimating the attention information used when generating the change log and the change input information; a determination unit that determines whether the attention information estimated by the estimation unit is included in the log and the input information; Equipped with 9. The monitoring and control device of claim 8. (Appendix 11) A log output method for a monitoring control device that monitors and controls a plurality of target devices, in which an analysis device mounted on the monitoring control device outputs a log in the monitoring control device, The monitoring and control device includes: The system comprises a control unit that processes data handled by the monitoring control device, including data on the target device; a log buffer that stores a plurality of logs including the operating status of the monitoring control device output from the control unit; an analysis device that analyzes the logs stored in the log buffer; and a maintenance port that connects a maintenance computer that is connected when maintaining the monitoring control device, When the maintenance computer is connected to the maintenance port, a log acquisition step of acquiring the log from the log buffer; a log analysis step of analyzing whether predetermined or estimated information of interest exists in the log; a change log generation step of generating a change log in which the display format of the log is changed when the target information is found in the log analysis step; a console output output step of outputting the logs or the change logs as console outputs to the maintenance computer via the maintenance port in the order of the logs acquired in the log acquisition step; A log output method for a monitoring control device including: (Appendix 12) an input information acquisition step of acquiring input information from the maintenance computer via the maintenance port; an input information analyzing step of analyzing whether predetermined or estimated information of interest exists in the input information; a modified input information generating step of generating modified input information in which a display format of the input information is modified when the target information is found in the input information analyzing step; an input information output output step of outputting the input information or the changed input information as input information output to the maintenance computer via the maintenance port in the order of the input information acquired in the input information acquisition step; 12. A log output method for a monitoring control device according to claim 11, including: [Explanation of symbols]

[0068] 20...maintenance port, 21...control unit, 28...log buffer, 41...analysis device, 43...input / output management unit, 45...log buffer management unit, 46...data analysis unit, 47...memory, 52...analysis unit, 54...estimation unit, 56...determination unit, 75...target equipment, 90...maintenance computer, 100...monitoring control device, Intc...change input information, Inti...input information, Into...input information output, lgc...change log, lgc32, lgc33, lgc34...change log, lgi...log, lgi31, lgi32, lgi33, lgi34...log, lgo ...log, lgo1, lgoN...log, lgo2, lgo3, lgo4, lgo5, lgo6, lgo7, lgo8, lgo9, lgo11, lgo12, lgo13, lgo14...log, lgo31, lgo32, lgo33, lgo34...log, Lgco...console output, md...detected pattern (attention information), md1, md2, md3, md4, md5, md6, md7, md8, md9, md10...detected pattern (attention information), Mk...marker character, Pad2...past log address information, sigp...data information signal

Claims

1. A monitoring and control device that monitors and controls a plurality of target devices, The system includes a control unit that processes data handled by the monitoring control device, including data on the target device; a log buffer that stores multiple logs including the operating status of the monitoring control device output from the control unit; and an analysis device that analyzes the logs stored in the log buffer, The analytical device a data analysis unit that generates a modified log in which the display format of the log is modified when predetermined or estimated information of interest is detected in the log, and that outputs the log without modification when the information of interest is not detected in the log; Monitoring and control equipment.

2. a maintenance port for connecting a maintenance computer when maintaining the monitoring control device; When the maintenance computer is connected to the maintenance port, The analytical device sequentially acquiring the logs stored in the log buffer, and sequentially outputting the logs or the change logs output from the data analysis unit to the maintenance computer as console outputs; The monitoring and control device according to claim 1.

3. The difference between the change log and the log before the change is the displayed color or the presence or absence of highlighted characters. The monitoring and control device according to claim 1.

4. The difference between the change log and the log before the change is the displayed color or the presence or absence of highlighted characters. The monitoring and control device according to claim 2.

5. The analytical device a log buffer management unit that manages acquisition of the log from the log buffer; The log buffer management unit saves past log address information, which is information on the address where the log was saved in the log buffer when the maintenance computer was connected to the maintenance port, and when the log is acquired from an address different from the past log address information, outputs a data information signal to the data analysis unit indicating that the log is new data; The data analysis unit changing the color in which the log or the change log is displayed when the data information signal indicating the new data is input to a color different from the color of the log or the change log output before the data information signal indicating the new data is input; The monitoring and control device according to claim 2 or 4.

6. The analysis device includes a memory in which predetermined attention information is stored, The data analysis unit an analysis unit that determines whether the log contains the attention information based on the attention information stored in the memory; The monitoring and control device according to any one of claims 1 to 4.

7. The analysis device includes a memory in which predetermined attention information is stored, The data analysis unit an analysis unit that determines whether the log contains the attention information based on the attention information stored in the memory; The monitoring and control device according to claim 5.

8. The data analysis unit of the analysis device an estimation unit that estimates the attention information from the log using an analysis model for estimating the attention information used when generating the change log; a determination unit that determines whether the attention information estimated by the estimation unit is included in the log; Equipped with The monitoring and control device according to any one of claims 1 to 4.

9. The data analysis unit of the analysis device an estimation unit that estimates the attention information from the log using an analysis model for estimating the attention information used when generating the change log; a determination unit that determines whether the attention information estimated by the estimation unit is included in the log; Equipped with The monitoring and control device according to claim 5.

10. the analysis device includes an input / output management unit that manages data flow between the maintenance port and the data analysis unit, The data analysis unit When input information is input from the maintenance computer via the maintenance port and the input / output management unit, When the predetermined or estimated attention information is detected in the input information, modified input information in which a display format of the input information is modified is generated and output to the input / output management unit, and when the attention information is not detected in the input information, the input information is output to the input / output management unit without being modified; the input / output management unit outputs the input information and the changed input information sequentially output from the data analysis unit as input information output to the maintenance computer via the maintenance port; The monitoring and control device according to claim 2 or 4.

11. the analysis device includes an input / output management unit that manages data flow between the maintenance port and the data analysis unit, The data analysis unit When input information is input from the maintenance computer via the maintenance port and the input / output management unit, When the predetermined or estimated attention information is detected in the input information, modified input information in which a display format of the input information is modified is generated and output to the input / output management unit, and when the attention information is not detected in the input information, the input information is output to the input / output management unit without being modified; the input / output management unit outputs the input information and the changed input information sequentially output from the data analysis unit as input information output to the maintenance computer via the maintenance port; The monitoring and control device according to claim 5.

12. The analysis device includes a memory in which predetermined attention information is stored, The data analysis unit an analysis unit that determines whether the attention information is included in the log and the input information based on the attention information stored in the memory; The monitoring and control device according to claim 10.

13. The analysis device includes a memory in which predetermined attention information is stored, The data analysis unit an analysis unit that determines whether the attention information is included in the log and the input information based on the attention information stored in the memory; The monitoring and control device according to claim 11.

14. The data analysis unit of the analysis device an estimation unit that estimates the attention information from the log and the input information using an analysis model for estimating the attention information used when generating the change log and the change input information; a determination unit that determines whether the attention information estimated by the estimation unit is included in the log and the input information; Equipped with The monitoring and control device according to claim 10.

15. The data analysis unit of the analysis device an estimation unit that estimates the attention information from the log and the input information using an analysis model for estimating the attention information used when generating the change log and the change input information; a determination unit that determines whether the attention information estimated by the estimation unit is included in the log and the input information; Equipped with The monitoring and control device according to claim 11.

16. A log output method for a monitoring control device that monitors and controls a plurality of target devices, in which an analysis device mounted on the monitoring control device outputs a log in the monitoring control device, The monitoring and control device includes: The system comprises a control unit that processes data handled by the monitoring control device, including data on the target device; a log buffer that stores a plurality of logs including the operating status of the monitoring control device output from the control unit; an analysis device that analyzes the logs stored in the log buffer; and a maintenance port that connects a maintenance computer that is connected when maintaining the monitoring control device, When the maintenance computer is connected to the maintenance port, a log acquisition step of acquiring the log from the log buffer; a log analysis step of analyzing whether predetermined or estimated information of interest exists in the log; a change log generation step of generating a change log in which the display format of the log is changed when the target information is found in the log analysis step; a console output output step of outputting the logs or the change logs as console outputs to the maintenance computer via the maintenance port in the order of the logs acquired in the log acquisition step; A log output method for a monitoring control device including:

17. an input information acquisition step of acquiring input information from the maintenance computer via the maintenance port; an input information analyzing step of analyzing whether predetermined or estimated information of interest exists in the input information; a modified input information generating step of generating modified input information in which a display format of the input information is modified when the target information is found in the input information analyzing step; an input information output output step of outputting the input information or the changed input information as input information output to the maintenance computer via the maintenance port in the order of the input information acquired in the input information acquisition step; The log output method for a monitoring control device according to claim 16, further comprising:

Images