Abnormality estimation device

Abstract

To quickly specify the cause of a failure related to a controller and a system composed of a plurality of controllers on the basis of a log.SOLUTION: The map generation unit 103 generates, for each of the plurality of logs acquired by the log acquisition unit 102, a log map including the plurality of acquired logs, in which the type of the log and the code of the log are associated with the coordinates of the bitmap data to form a bit of the bitmap data, and the importance generated by the importance generation unit 101 is used as color information of the bit. The estimation unit 105 estimates an abnormality in control by the controller 121 based on the result of pattern matching between the log map generated by the map generation unit 103 and the error map stored in the error storage unit 104.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an abnormality estimation device. [Background technology]

[0002] Generally, operation monitoring systems for plants, factories, building air conditioning systems, etc., include an operation monitoring device and a controller. The operation monitoring device is configured to send and receive data with the controller and monitor the operating status of the plant factory or air conditioning. The controller receives signals from process equipment, air conditioning equipment, and various sensors installed on-site, performs predetermined calculations, and outputs the resulting signals to the process equipment, air conditioning equipment, etc., to control the process or air conditioning.

[0003] In such a system, if a malfunction occurs in the controller, it is important to quickly identify the cause of the abnormality and restore the system. The malfunction that occurred in the controller can be identified, for example, by checking the log (error log) output by the controller (Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-332030 Summary of the Invention [Problem to be solved by the invention]

[0005] However, analyzing the logs to identify the cause of the problem requires specialized knowledge and can take a lot of time, making it difficult to respond quickly.

[0006] The present invention has been made to solve the above problems, and aims to make it possible to quickly identify the cause of problems related to a controller and a system made up of multiple controllers based on logs. [Means for solving the problem]

[0007] The abnormality estimation device according to the present invention includes an importance generation unit configured to generate an importance for a log generated based on a defined type and a defined code for an event and an error that occurs in a control process in which a controller outputs control data to a controlled device and performs a control operation; a log acquisition unit configured to acquire the logs generated by the controller at set time intervals, associating the logs with the importance generated by the importance generation unit; a map generation unit configured to generate a log map from the acquired multiple logs for each of the multiple logs acquired by the log acquisition unit, by corresponding the log type and the log code to coordinates of bitmap data to form bits of the bitmap data, and by using the importance generated by the importance generation unit as color information of the bit; an error storage unit configured to store the log map as an error map when an error occurs in the control process by the controller; and an estimation unit configured to estimate an abnormality in control by the controller based on a result of pattern matching between the log map generated by the map generation unit and the error map stored in the error storage unit.

[0008] One example configuration of the abnormality estimation device includes a log map storage unit configured to store the log map generated by the map generation unit, and an update unit configured to update the log map stored in the log map storage unit with the log map newly generated by the map generation unit, and the estimation unit estimates an abnormality in control by the controller based on a result of pattern matching between the log map updated by the update unit and the error map stored in the error storage unit.

[0009] In one example configuration of the above-described anomaly estimation device, the importance generation unit generates an importance by combining a first importance based on the communication path with the device, a second importance based on the operation frequency of the device, a third importance based on the history of past anomalies and their recovery, and a fourth importance based on the type of error-related log and the code of the error-related log.

[0010] In one example configuration of the above-mentioned anomaly estimation device, the map generation unit determines an R value for each log generated by the controller based on the value obtained by multiplying other logs related to errors that occurred within a set time period by the first importance, second importance, and third importance generated by the importance generation unit and adding up all the results; determines a G value based on the value obtained by multiplying other logs related to events that are not errors that occurred within the set time period by the second importance generated by the importance generation unit and adding up all the results; and determines a B value based on the value obtained by multiplying the target log that occurred within the set time period by the first importance, second importance, third importance, and fourth importance generated by the importance generation unit and adding up all the results, and uses this as color information for the bit. [Effects of the Invention]

[0011] As described above, according to the present invention, a log map is generated in which the log type and the log code correspond to coordinates of bitmap data to form bits of the bitmap data, and the importance is represented by color information of the bits, so that the cause of a malfunction related to a controller or a system made up of multiple controllers can be quickly identified based on the log. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a configuration diagram showing the configuration of an abnormality estimation device according to an embodiment of the present invention. [Figure 2] FIG. 2 is an explanatory diagram illustrating an example of a log map. [Figure 3] FIG. 3 is a configuration diagram showing the hardware configuration of the abnormality estimation device according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0013] An abnormality inference device 100 according to an embodiment of the present invention will be described below with reference to Fig. 1. The abnormality inference device 100 includes an importance generation unit 101, a log acquisition unit 102, a map generation unit 103, an error storage unit 104, and an estimation unit 105.

[0014] The importance generation unit 101 generates importance levels for logs generated by the controller 121. The controller 121 generates logs of events and errors that occur during the control process of outputting control data to a device to be controlled and performing a control operation, based on defined types and defined codes.

[0015] The importance generation unit 101 generates an importance by combining, for example, a first importance based on the communication path between the controller 121 and the equipment to be controlled, a second importance based on the frequency of operation of the equipment, a third importance based on the history of past abnormalities and their recovery, and a fourth importance based on the type of log related to the error and the code of the log related to the error.

[0016] The first importance level represents the impact of the communication network, and reflects the fact that the more devices that are passed through, the higher the risk of a malfunction (failure of network devices). For example, a device that is passed through a two-tier network hub will have a higher importance level than a device that is passed through the same network hub.

[0017] The second level of importance indicates the degree of necessity for maintenance of the facility equipment to be controlled, and is a value based on the deterioration status of the equipment, such as the number of times the equipment operates, the operating time, and the operating angle. For example, the number of times the equipment operates includes the number of times that an air conditioner, heat source machine, or other equipment is started and stopped, and the number of times that a motor damper or other device is opened and closed. The operating time includes the operating time of the equipment, and the operating angle includes the total stroke distance that a valve or other device has operated up to now.

[0018] The third importance may be a value based on the number of errors, including minor failures, that have occurred in the past, for example.

[0019] The log acquisition unit 102 acquires the logs generated by the controller 121 at set time intervals, in association with the importance generated by the importance generation unit 101. For example, the logs generated by the controller 121 can be collected via a network 131 in which the controller 121 is accommodated.

[0020] The map generation unit 103 generates a log map from the multiple logs acquired by the log acquisition unit 102 by corresponding the log type and log code to coordinates of the bitmap data to create bits of the bitmap data, and by using the importance generated by the importance generation unit 101 as color information for the bits (Figure 2).

[0021] The map generating unit 103 determines the R value, G value, and B value that make up the color information for each log generated by the controller 121 as follows, and sets the color information as color information.

[0022] For example, first, as shown in the following formula, the R value is determined based on the value obtained by multiplying other logs related to errors that occurred within the set time by the first importance, second importance, and third importance generated by the importance generation unit 101 and adding them all together.

[0023] R = 255 - {Σ {Error occurrence log of another code related to the log that occurred within the set N seconds (major failure, minor failure, alarm) × 1st importance × 2nd importance × 3rd importance} + reference value} (1)

[0024] In addition, as shown in the following formula, the G value is determined based on the value obtained by multiplying other logs related to non-error event occurrences that occurred within the set time by the importance of the second importance level generated by the importance generation unit 101 and adding them all together.

[0025] G = 255 - {Σ {Number of event logs (notifications, operations) with a different code related to the log that occurred within the set N seconds × Second importance} + Reference value} (2)

[0026] In addition, as shown in the following formula, the B value is determined based on the value obtained by multiplying the target logs generated within the set time by the first importance, second importance, third importance, and fourth importance generated by the importance generation unit 101 and adding them all together.

[0027] B = 255 - {Σ {target log code occurring within the set N seconds × 1st importance × 2nd importance × 3rd importance × 4th importance} + reference value} (3)

[0028] The error storage unit 104 stores, as an error map, a log map when an error occurs in the process of control by the controller 121. For example, a log map when a network abnormality occurs in the system and there is a possibility that a device with a duplicate IP address exists is stored as an error map in the error storage unit 104. Also, a log map when an abnormality occurs in the communication line of a sub-controller (not shown) to which the controller 121 is connected, and communication abnormalities and recovery are repeated is stored as an error map in the error storage unit 104. Also, a log map when a power supply abnormality occurs in the controller 121 and restarts are repeated is stored as an error map in the error storage unit 104.

[0029] The estimation unit 105 estimates an abnormality in the control by the controller 121 based on the result of pattern matching between the log map generated by the map generation unit 103 and the error map stored in the error storage unit 104. For example, the estimation unit 105 compares the log map generated by the map generation unit 103 with the error map, and if it determines that they match by a set threshold (%) or more, it predicts that an abnormality (failure) may occur. For example, the estimation result by the estimation unit 105 can be displayed on the display unit 106 by the map generation unit 103 together with the log map. Furthermore, the estimation result by the estimation unit 105 can be notified to a higher-level device (e.g., a monitoring device) not shown.

[0030] The abnormality estimation device 100 can also include a log map storage unit 107 and an update unit 108. The log map storage unit 107 stores the log map generated by the map generation unit 103. The update unit 108 updates the log map stored in the log map storage unit 107 with the log map newly generated by the map generation unit 103.

[0031] In a configuration including a log map storage unit 107 and an update unit 108, an estimation unit 105 estimates an abnormality in control by the controller 121 based on the result of pattern matching between the latest log map stored in the log map storage unit 107, which has been updated by the update unit 108, and the error map stored in the error storage unit 104.

[0032] In the above, for simplicity of explanation, the description has been given with respect to one controller 121, but this is not limited to this, and the abnormality estimation device 100 can target multiple controllers and perform similar operations for each of the controllers.

[0033] As described above, according to the embodiment, an abnormality in the control by the controller 121 is estimated based on the result of pattern matching between the log map and the error map, so that the occurrence of an abnormality can be estimated (determined) immediately and the cause of the malfunction of the controller can be quickly identified based on the log. Also, by preparing a log of the state a predetermined period before the occurrence of the abnormality as an error map and performing pattern matching with this error map, it is possible to predict the occurrence of an abnormality.

[0034] 3, the abnormality estimation device according to the above-described embodiment can be configured as a computer device including a CPU (Central Processing Unit) 301, a main storage device 302, an external storage device 303, a network connection device 304, etc., and the functions of importance generation unit 101, log acquisition unit 102, map generation unit 103, error storage unit 104, estimation unit 105, log map storage unit 107, and update unit 108 can be realized by CPU 301 operating (executing) a program deployed in main storage device 302. Network connection device 304 is connected to network 305.

[0035] Each function can also be distributed across multiple computer devices. For example, the estimation unit 105 can be implemented as an AI application hosted in the cloud. Furthermore, the controller can incorporate an anomaly estimation device, enabling the controller itself to predict and avoid anomalies. Even in this case, the error storage unit and log map storage unit can be located in an integrated management server installed on the network that houses the controller.

[0036] As described above, according to the embodiment of the present invention, a log map is generated in which the log type and the log code correspond to the coordinates of the bitmap data, as bits of the bitmap data, and the importance is represented by color information of the bits, so that the cause of a malfunction related to a controller or a system made up of multiple controllers can be quickly identified based on the log.

[0037] It should be noted that the present invention is not limited to the embodiments described above, and it is clear that many modifications and combinations can be made by a person having ordinary knowledge in the art within the technical concept of the present invention. [Explanation of symbols]

[0038] 100... Abnormality estimation device, 101... Importance generation unit, 102... Log acquisition unit, 103... Map generation unit, 104... Error storage unit, 105... Estimation unit, 106... Display unit, 107... Log map storage unit, 108... Update unit, 121... Controller, 131... Network.

Claims

1. an importance generation unit configured to generate an importance level for a log of events and errors that occur in a control process in which a controller outputs control data to a controlled device and performs a control operation, the event and error level being generated based on a defined type and a defined code; a log acquisition unit configured to acquire the log generated by the controller at set time intervals in association with the importance generated by the importance generation unit; a map generation unit configured to generate a log map from the plurality of acquired logs by associating a type of log and a code of the log with coordinates of bitmap data to generate bits of the bitmap data, and to generate a log map from the plurality of acquired logs by using the importance generated by the importance generation unit as color information of the bits; an error storage unit configured to store a log map as an error map when an error occurs during control by the controller; an estimation unit configured to estimate an abnormality in control by the controller based on a result of pattern matching between the log map generated by the map generation unit and the error map stored in the error storage unit; and An abnormality estimation device comprising:

2. 2. The abnormality estimation device according to claim 1, a log map storage unit configured to store the log map generated by the map generation unit; an updating unit configured to update the log map stored in the log map storage unit with the log map newly generated by the map generating unit; Equipped with The estimation unit estimates an abnormality in control by the controller based on a result of pattern matching between the log map updated by the update unit and the error map stored in the error storage unit.

3. 3. The abnormality estimation device according to claim 1, The anomaly estimation device generates an importance level by combining a first importance level based on the communication path with the device, a second importance level based on the operation frequency of the device, a third importance level based on past abnormality occurrences and recovery records, and a fourth importance level based on the type of error-related log and the code of the error-related log.

4. 4. The abnormality estimation device according to claim 3, The map generation unit generates, for each of the logs generated by the controller, determining an R value based on a value obtained by multiplying other logs related to errors that occurred within a set time period by the first importance, the second importance, and the third importance generated by the importance generation unit and adding the multiplied values ​​together; determining a G value based on a value obtained by multiplying other logs related to non-error events that occurred within the set time by the importance of the second importance generated by the importance generation unit and adding up all the results; A B value is determined based on a value obtained by multiplying the target log generated within a set time period by the first importance, the second importance, the third importance, and the fourth importance generated by the importance generation unit and adding up the multiplied values. An abnormality estimation device that uses color information from 1 bit.

Images