Analytical device, analytical system, and control method thereof

Abstract

To provide an analyzer capable of easily identifying a cause of abnormality without requiring a complicated user operation by providing a report capable of easily identifying the cause of the abnormality according to an analysis result of operation record data.SOLUTION: An analysis device includes: an execution engine for repeatedly executing a user program; acquisition means for acquiring operation record data including a plurality of device values in time series collected by executing the user program; model generation means for generating a model including an analysis parameter for each device based on the learning of the acquired operation record data at a normal time; analysis means for analyzing an abnormal device which does not satisfy a normal condition according to the model for the acquired operation record data of an analysis object; and report generation means which generates an analysis report including an expression corresponding to the analysis parameter based on an analysis result of each device detected as the abnormal device.SELECTED DRAWING: Figure 17

Description

Technical Field

[0001] The present invention relates to an analysis apparatus, an analysis system, and a control method thereof.

Background Art

[0002] A programmable logic controller (PLC) is a controller that controls industrial machines such as manufacturing equipment, conveying devices, and inspection devices in factory automation (Patent Documents 1 and 2). The PLC controls various expansion units and controlled devices by executing a user program such as a ladder program created by a programmer.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0004] By the way, in order to monitor the operation of the PLC and the operation of industrial machines controlled by the PLC, it is desired to collect and utilize the data held by the PLC. The PLC has a basic unit (CPU unit) and an expansion unit connected thereto. The basic unit controls the expansion unit by executing a user program such as a ladder program. The expansion unit controls the industrial machine according to an instruction from the basic unit and returns the control result to the basic unit.

[0005] Furthermore, this control result data is used for troubleshooting and quality control. Therefore, it is necessary to accumulate and analyze this data and obtain analysis results early for recovery. However, recording data from all devices related to the PLC would require storing a vast amount of data, and furthermore, analyzing this vast amount of data (from all devices) in order to identify faulty devices is a time-consuming task. In addition, experience and knowledge are required to identify faulty devices and recover the system from the vast amount of analysis results. Therefore, there is a need for a system that can efficiently analyze the vast amount of data related to each device and display the analysis results without requiring sufficient specialized knowledge or experience.

[0006] Therefore, in view of the above problems, the present invention aims to provide a report that allows for easy identification of the cause of an anomaly based on the analysis results of driving record data. Another objective is to provide a report that allows for easy identification of the cause of an anomaly without requiring complicated user operations. [Means for solving the problem]

[0007] The present invention is characterized by comprising, for example, an analysis device, which includes: an execution engine that repeatedly executes a user program; an acquisition means that acquires operation record data including a plurality of time-series device values ​​collected by the execution of the user program; a model generation means that generates a model including analysis parameters for each device based on learning of the acquired operation record data under normal conditions; an analysis means that analyzes abnormal devices that do not satisfy normal conditions according to the model with respect to the acquired operation record data to be analyzed; and a report generation means that generates an analysis report including an expression corresponding to the analysis parameters based on the analysis results of each device detected as an abnormal device. [Effects of the Invention]

[0008] According to the present invention, information about a device behaving differently than usual and the reasons for that behavior are provided to the user.

Brief Description of the Drawings

[0009] [Figure 1] Diagram for explaining the PLC system [Figure 2] Diagram for explaining the hardware of PC2a [Figure 3] Diagram for explaining the hardware of PC2b [Figure 4] Diagram for explaining the hardware of the PLC [Figure 5] Diagram for explaining the functions realized by the CPU of the PC [Figure 6] Diagram for explaining the functions realized by the CPU of the PLC [Figure 7] Flowchart showing the basic flow [Figure 8A] Diagram for explaining the result display screen [Figure 8B] Diagram for explaining the result display screen [Figure 9] Diagram for explaining the relation map [Figure 10] Diagram for explaining the details of the analysis comments [Figure 11] Flowchart showing the model generation flow [Figure 12] Diagram for explaining the discrimination control of the cycle pattern [Figure 13] Diagram showing the classification of the collected data [Figure 14] Flowchart showing the classification processing procedure [Figure 15] Flowchart showing the result display flow of the analysis unit [Figure 16] Flowchart showing the result display flow of the PC [Figure 17] Flowchart showing the analysis comment generation flow by natural language [Figure 18] Flowchart showing the analysis comment generation flow by graphics [Figure 19] Diagram showing the setting screen for defining the cycle [Figure 20] Diagram for explaining the warning in the case of no cycle setting [Figure 21]Figure for explaining the reliability of the model [Figure 22] Figure for explaining a modified example of the PLC system [Figure 23] Figure for explaining the processing flow of the cycle

Mode for Carrying Out the Invention

[0010] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of the features described in the embodiments are essential for the invention. Two or more of the features described in the embodiments may be arbitrarily combined. Also, the same or similar configurations are given the same reference numerals, and duplicate explanations are omitted. In order to distinguish between a plurality of configurations, a lowercase alphabet may be appended to the end of the reference numeral. When matters common to a plurality of configurations are described, the lowercase alphabet may be omitted.

[0011] <System Configuration> First, in order to enable those skilled in the art to better understand a programmable logic controller (PLC, which may also be simply called a programmable controller), the configuration and operation of a general PLC will be described.

[0012] Figure 1 is a conceptual diagram showing an example configuration of a PLC system according to an embodiment of the present invention. As shown in Figure 1, the PLC system comprises a PC2a for editing user programs such as ladder programs, a PC2b for displaying analysis results, a PLC1 for comprehensively controlling various industrial machines installed in factories, etc., and field devices 10 such as cameras connected to the PLC1. PC is an abbreviation for personal computer. In the following, when simply referred to as PC2, it refers to the configuration and control of PC2a and PC2b. User programs may be created using graphical programming languages ​​such as ladder language or flowchart-type motion programs such as SFC (Sequential Function Chart), or they may be created using high-level programming languages ​​such as C language. In the following, for the sake of explanation, it is assumed that the user program executed in the basic unit 3 is a ladder program. The PLC1 comprises a basic unit 3 with a built-in CPU and one or more expansion units 4. One or more expansion units 4 are detachable from the basic unit 3.

[0013] The basic unit 3 includes a display unit 5 and an operation unit 6. The display unit 5 can display the operating status of each expansion unit 4 attached to the basic unit 3. The display unit 5 switches the displayed content according to the operation of the operation unit 6. The display unit 5 usually displays the current value (device value) of devices in the PLC1 and error information that has occurred in the PLC1. Here, "device" includes various devices (relays, timers, counters, etc.) included in the basic unit 3 and expansion unit 4, and also refers to the memory area provided for storing device values ​​(device data), and may be called device memory. This device memory is non-volatile memory and may be composed of rewritable non-volatile ROM, or non-volatility may be achieved by battery backup of volatile RAM, etc. ROM is an abbreviation for read-only memory. RAM is an abbreviation for random access memory. Device values ​​are information that indicates the input status from input devices, the output status to output devices, and the status of internal relays (auxiliary relays), timers, counters, data memory, etc. set in the user program. Device value types include bit type and word type. A bit device stores a single-bit device value, such as 0 / 1, ON / OFF, H / L, etc. A word device stores a single-word device value. Variables may be specified as devices for the data utilization programs described in detail below. Variables are also means of holding information and are accessed by the execution engine according to the user program. Therefore, in the following description, a device also refers to a variable. The memory that holds devices may be called device memory. The memory that holds the collected data may be called data memory. PLC1 may be configured to handle variables in addition to devices. Devices and variables are called symbols, and the value that a symbol represents is called a symbol value.

[0014] The expansion unit 4 is provided to extend the functionality of the PLC1. Field devices (controlled devices) 10 corresponding to the functions of the expansion unit 4 may be connected to the expansion unit 4, thereby connecting each field device 10 to the basic unit 3 via the expansion unit 4. The field devices 10 may be input devices such as sensors or cameras, or output devices such as actuators. Furthermore, multiple field devices may be connected to a single expansion unit 4.

[0015] For example, the expansion unit 4b may be a positioning unit that drives a motor (field device 10) to position the workpiece, or it may be a counter unit. The counter unit counts signals from an encoder (field device 10), such as a manual pulser.

[0016] The analysis unit 4a collects symbol values ​​from symbols (devices, variables, etc.) in the basic unit 3, analyzes the symbol values, and creates an analysis report containing the analysis results. The analysis unit 4a may have a web server that provides the analysis report to an external PC 2b. The basic unit 3 is sometimes called the CPU unit. The system including the PLC 1 and PC 2 may be called a programmable logic controller system. In this embodiment, an example is described in which the analysis unit 4a collects data from each device, but this collection unit may be provided in the basic unit 3 or in other expansion units. Furthermore, the analysis unit 4a can also function as an analysis device that performs analysis according to instructions from the basic unit 3 or at predetermined timings. In this embodiment, an example is described in which the analysis unit 4a operates as an analysis device, but there is no intention to limit the present invention, and the basic unit 3 may function as an analysis device, or external devices such as PC 2a and 2b may function as analysis devices. The flow (flow program) described below is merely one example of a data utilization program. The basic unit 3 is sometimes called the CPU unit. The system including PLC1 and PC2 may also be called a programmable logic controller system.

[0017] PC2a is a computer primarily operated by programmers. On the other hand, PC2b is a computer primarily operated by field personnel. PC2b may be a programmable display whose screen can be configured by the user. In this case, the screen that displays analysis results, etc., may be configured by the user, and a web browser function may be pre-installed and the analysis results, etc., may be displayed using the web browser function. PC2a may also be called a program creation support device (setting device). PC2 is an external computer, such as a portable notebook or tablet type personal computer or smartphone, equipped with a display unit 7 and an operation unit 8. An external computer is a computer located outside of PLC1. A ladder program, which is an example of a user program for controlling PLC1, is created using PC2a. The created ladder program is converted into mnemonic code within PC2a. PC2 is connected to the basic unit 3 of PLC1 via a communication cable 9 such as a USB (Universal Serial Bus) cable. For example, PC2a sends the ladder program converted into mnemonic code to the basic unit 3. The basic unit 3 converts the ladder program into machine code and stores it in the memory provided in the basic unit 3. In this example, a mnemonic code is transmitted to the basic unit 3, but the present invention is not limited to this. For example, PC2a may convert the mnemonic code into an intermediate code and transmit the intermediate code to the basic unit 3.

[0018] Although not shown in Figure 1, the control panel 8 of the PC2 may include a pointing device such as a mouse connected to the PC2. Furthermore, the PC2 may be configured to be detachably connected to the PLC1's basic unit 3 via a communication cable other than a USB cable 9. Alternatively, the PC2 may be connected to the PLC1's basic unit 3 wirelessly without using the communication cable 9.

[0019] <Program creation support device> Figure 2 is a block diagram illustrating the electrical configuration of PC2a. As shown in Figure 2, PC2a comprises a CPU 11a, a display unit 7a, an operation unit 8a, a storage device 12a, and a communication unit 13a. The display unit 7a, the operation unit 8a, the storage device 12a, and the communication unit 13a are each electrically connected to the CPU 11a. The storage device 12a includes RAM, ROM, HDD, SSD, and may also include a removable memory card. CPU is an abbreviation for Central Processing Unit. HDD is an abbreviation for Hard Disk Drive. SSD is an abbreviation for Solid State Drive.

[0020] The user of PC2a has the CPU 11a execute the project editing program 14a stored in the storage device 12a, and edits the project data 15 through the operation unit 8a. In other words, PC2a functions as an engineering tool and a program creation support device. When the CPU 11a executes the project editing program 14a, the project creation unit 16 and the project transfer unit 17 are realized. The project creation unit 16 creates the project data 15 according to the user input. The project transfer unit 17 transfers the project data 15 to PLC1. The project data 15 includes one or more user programs (e.g., ladder programs, control programs, motion programs, data utilization programs), configuration information for the basic unit 3 and expansion unit 4, drawing data for WebHMI, and setting information for specific functions provided in the basic unit 3 and expansion unit 4. The configuration information includes connection locations and device assignment information for multiple expansion units 4 to the basic unit 3. The drawing data may include information indicating the functions provided in the basic unit 3 (e.g., data collection function, communication function, positioning function) and information indicating the functions of the expansion unit 4 (e.g., communication function, positioning function, shooting function). The drawing data is a group of display components for realizing WebHMI and is implemented by markup data describing the structure of the front end, such as HTML data, style data describing decorations, such as CSS data, and code describing dynamic processing, such as JavaScript® code. The style data describing decorations may be provided, for example, in file format, or may be called by a description that calls an external style data file within the markup data describing the structure. The code describing dynamic processing may be provided, for example, in file format, or may be called by a description that calls an external code file within the markup data describing the structure. A front end in a format that can call and use external style data files and external code files has high reusability and maintainability, and can utilize, for example, general-purpose front end components. Hereinafter, the drawing data will be referred to as display components.The data utilization program includes programs for collecting control data (device values, etc.) in PLC1, processing the data, and creating data to be passed to WebHMI. The setting information for specific functions includes setting information related to the functions provided in the basic unit 3 (e.g., data acquisition function, communication function, positioning function), for example, for the data acquisition function, setting information for data acquisition conditions and data acquisition targets, and setting information related to the functions of the expansion unit 4 (e.g., communication function, positioning function, data utilization function, shooting function). Here, editing the project data 15 includes creating and modifying (re-editing) the project data 15. The user can read the project data 15 stored in the storage device 12a as needed and modify the project data 15 using the project editing program 14a. The communication unit 13a communicates with the basic unit 3 via the communication cable 9a. The project transfer unit 17 transfers project data to the basic unit 3 via the communication unit 13a. The communication unit 13a communicates with the analysis unit 4a via the communication cable 9b.

[0021] <PC used to display the dashboard> Figure 3 is a block diagram illustrating the electrical configuration of PC2b. As shown in Figure 3, PC2b comprises a CPU 11b, a display unit 7b, an operation unit 8b, a storage device 12b, and a communication unit 13b. The display unit 7b, the operation unit 8b, the storage device 12b, and the communication unit 13b are each electrically connected to the CPU 11b. The storage device 12b includes RAM, ROM, HDD, SSD, and may also include a removable memory card.

[0022] The CPU 11b implements a web browser 18 by executing a web browser program 14d. The web browser 18 accesses the settings page of the data utilization application provided by the analysis unit 4a, or accesses the dashboard page, via the communication unit 13b. The CPU 11b also displays the specific result (judgment result) on the display unit 7b according to the screen information indicating the specific result when an anomaly occurs, which is transmitted from the analysis unit 4a.

[0023] <plc> Figure 4 is a block diagram illustrating the electrical configuration of PLC1. As shown in Figure 4, the basic unit 3 comprises a CPU 31, a display unit 5, an operation unit 6, a memory 32, and a communication unit 33. The display unit 5, the operation unit 6, the memory 32, and the communication unit 33 are each electrically connected to the CPU 31. The memory 32 may include RAM, ROM, a memory card, etc. The memory 32 has multiple storage areas such as a device unit 34, a project storage unit 35, a ring buffer 36, and an operation record storage unit 37.

[0024] Here, the operation record refers to a record of the PLC1's operating state at the scan time level. For example, it records the symbol values ​​and collection times of all symbols related to the operation of PLC1 in chronological order for each scan. All symbols related to operation may include all symbols used in user programs such as ladder programs, or all symbols included in program units or unit units selected by the user. In this case, the symbols to be included in the operation record can be selected collectively in meaningful units such as program units or unit units, and symbols can also be added or deleted individually. This allows, for example, the generation of an operation record that records the symbol values ​​and collection times of all symbols related to the operation of PLC1 in chronological order for each scan before and after the time of the trouble, enabling accurate later understanding of what happened at the time of the trouble based on the operation record. The operation record contains a lot of information to recreate the situation at that time, but if there is a lot of information, the data size of the operation record will be large and difficult to handle, and the collection of the operation record will be burdensome. Therefore, the user can select the units to be collected in program units or unit units.

[0025] Furthermore, the operation record may include not only symbols but also time-series camera images along with the time they were captured. This allows for accurate retrospective tracking of what happened before and after a problem occurred, and by including camera images showing changes in the equipment's appearance in the operation record, the camera images can be recorded in conjunction with the time-series data of the user program. Write history from external devices such as HMIs (Human-Machine Interfaces) and PCs, as well as write history from PLCs, may also be included in the operation record as change point events. This allows for time-series tracking of what change point events occurred before and after a problem occurred.

[0026] The device unit 34 has bit devices, word devices, etc., and each device stores device values. The project storage unit 35 stores project data transferred from PC2a. The ring buffer 36 periodically collects and stores device values ​​from the device unit 34. When a predetermined event occurs, the operation record storage unit 37 stores an event record including the device values ​​collected around the time of the event (before, after, or around the time of the event) and the time of collection. An event refers to, for example, the fulfillment of an alarm condition or caution condition set for each device. An alarm condition refers to, for example, a condition that would cause the control operation of the manufacturing line by PLC1 to be stopped. A caution condition refers to, for example, a device value condition that would cause the administrator to pay attention to the control operation of the manufacturing line by PLC1. The CPU 31 sends the event record to PC2a in response to a request from PC2a. The CPU 31 may also provide device values ​​to PC2a in real time. The memory 32 also stores the control program executed by the CPU 31 of the basic unit 3. As shown in Figure 3, the basic unit 3 and the expansion unit 4 are connected via an internal unit bus 90, which is a type of expansion bus. The communication function related to the internal unit bus 90 is implemented in the CPU 31, but it may also be implemented as part of the communication unit 33. The communication unit 33 may have a serial communication circuit compliant with the USB standard or similar. The CPU 31 receives project data from the PC 2a via the communication unit 33.

[0027] Here, we will provide some additional explanation about the internal unit bus 90. This internal unit bus 90 is a communication bus used for input / output refresh. Input / output refresh is the process of updating device values ​​between the basic unit 3 and the expansion unit 4. Input / output refresh is performed each time the ladder program is executed (i.e., each scan).

[0028] The expansion unit 4 includes a CPU 41 and a memory 42. The CPU 41b of the expansion unit 4b controls the field device 10 according to instructions (device values) from the base unit 3 stored in the device. In this embodiment, the expansion unit 4b functions as a camera control unit. The CPU 41b also stores the control results of the field device 10, such as a camera, in a device called a buffer memory. The control results stored in the device are transferred to the base unit 3 by I / O refresh. The control results stored in the device may also be transferred to the base unit 3 at a timing different from I / O refresh, according to a read command from the base unit 3. The memory 42 includes RAM and ROM. In particular, the RAM has a storage area reserved for use as buffer memory. The memory 42 may have a buffer that temporarily holds data acquired by the field device 10 (e.g., still image data and video data).

[0029] The CPU 41a of the analysis unit 4a, which functions as a data utilization unit (analysis unit), communicates with the PC 2b via the communication unit 43 and the communication cable 9b. The communication unit 43 includes a communication circuit that performs network communication. The CPU 41a creates an analysis report including the analysis results by analyzing the device values ​​collected in the basic unit 3. For example, the CPU 41a executes a driving record analysis application as a data utilization application, and by analyzing the symbol values ​​contained in the driving record data, identifies abnormal symbols and the times when those symbols become abnormal, and creates an analysis report including the analysis results that associate abnormal symbols with the times when those symbols become abnormal. Since the driving record data contains information to reproduce the conditions around the time the driving record was saved and the event occurred, it may be managed in conjunction with the analysis report. Also, because the driving record data contains the symbol values ​​of many symbols in order to reproduce the conditions around the time the driving record was saved and the event occurred, the data size becomes large. For this reason, for example, the CPU 41a may read the data necessary for the analysis report from the driving record data and add it to the driving record data as data for the analysis report. The data for the analysis report can be either copied directly from the driving record data, tagged as data for the analysis report, and saved as additional data to the driving record data, or the data can be processed for the analysis report and then saved as additional data to the driving record data.

[0030] If camera images are included in the driving record data, the situation around the time the driving record was saved can be understood in more detail by playing back the camera images. The analysis report may also include a UI (user interface) for playing back the camera images. Since camera images have a large data size, only the necessary camera image data may be partially downloaded when click or scroll operations are accepted in the UI for playing back the camera images. For example, when creating the analysis report, the CPU 41a may process the camera images in accordance with the display order in the analysis report, or generate index information that shows the correspondence between time and the saved location of the camera image, enabling high-speed and partial downloading of camera images corresponding to the time.

[0031] Narrowly defined, an analysis report means the analysis results themselves, but broadly defined, it may mean a web application that displays the analysis results or its user interface. The CPU 41a determines, for example, whether the device value is within the normal range and whether the timing of the change in the device value is within the normal range. Whether the timing of the change in the device value is within the normal range may be, for example, whether the length of the period during which the device value is "1" (on) is within the normal range. Also, it may be determined whether the number of changes in the device value in a certain process or cycle is within the normal range. If the device value collected from a certain device does not meet the normal conditions, since the device behaves differently from usual, it may be called an abnormal device. The CPU 41a may create an analysis report in web format and provide the analysis report to the web browser of the PC 2b via the communication unit 43 and the communication cable 9b. If the CPU 31 has a protocol conversion function, the CPU 41a may transmit the analysis report to the PC 2a via the internal unit bus 90, the CPU 31, the communication unit 33, and the communication cable 9a. The analysis report may have graph display components, numerical display components, etc. These display components are realized by markup data that describes the front-end structure, style data that describes decoration, and code that describes dynamic processing, such as HTML data, CSS data, and JavaScript (registered trademark) code. HTML is an abbreviation for Hypertext Markup Language. CSS is an abbreviation for Cascading Style Sheets.

[0032] <Function of PC 2b> FIG. 5 is a diagram for explaining the functions realized by the CPU 11b of the PC 2b. The CPU 11b of the PC 2b executes the Web browser 18 by executing the Web browser program 14d. The Web browser 18 executes the Web application 61 to realize the functions of the communication processing unit 62, the data acquisition unit 63, the drawing unit 65, the reception unit 66, and the playback unit 67. Further, the Web browser 18 communicates with the Web server 82 of the analysis unit 4a described later according to the HTTP (Hypertext Transfer Protocol) to receive display components.

[0033] The Web browser 18 displays an analysis report on the display unit 7b by executing the Web application 61. The Web application 61 is composed of, for example, HTML data, CSS data, and Java (R) scripts. The Web application 61 may be provided from the analysis unit 4a. The communication processing unit 62 processes communication with the Web server 82. The data acquisition unit 63 acquires driving record data to be displayed in the analysis report from the analysis unit 4a. The driving record is downloaded and stored in the storage device 12b. The drawing unit 65 displays the analysis report on the display unit 7b. The cooperation unit 64 performs time management so that the playback time in the analysis report and the playback time of the driving record are synchronized.

[0034] The reception unit 66 receives operations on the result display screen of the analysis report. The playback unit 67, for example, causes the driving record data to be downloaded and stored in the storage device 12b in response to a playback request input from the reception unit 66 or the cooperation unit 64. The playback request may include, for example, identification information (e.g., unique identification information or the save path name in the PLC 1) that can identify the driving record. The playback unit 67 plays back the driving record stored in the storage device 12 and displays it on the display unit 7. The playback unit 67 may waveform-display the time-series device values acquired in real time from the PLC 1 or the time-series device values included in the driving record.

[0035] <Function of PLC1> Figure 6 shows the functions realized by the CPU 31 and CPU 41a executing control programs in PLC1. In CPU 31, the command processing unit 71 interprets commands received from PCs 2a and 2b and executes processing corresponding to the interpretation results. For example, when a request signal created by encapsulating an HTTP request is received, the command processing unit 71 forwards the request signal to CPU 41a. When a response signal to the request signal is received from CPU 41a, the command processing unit 71 forwards the response signal to PCs 2a and 2b. The command processing unit 71 may also be provided in the analysis unit 4a. In that case, the command processing unit 71 processes commands from PC 2a, and the command processing unit provided in the analysis unit 4a processes commands from PC 2b. The collection unit 72 collects symbol values ​​(device values ​​and values ​​stored in variables) from the basic unit 3 and expansion unit 4b and stores them in the ring buffer 36. The collection settings of the collection unit 72 can be set from at least one of the basic unit 3 and the analysis unit 4a. The logging unit 73 determines whether any error or trouble (abnormal event) has occurred in PLC1 based on the collected symbol values, etc. For example, the logging unit 73 may determine whether the collected symbol values ​​meet the recording conditions. If the collected symbol values ​​meet the recording conditions, the logging unit 73 saves the symbol values ​​as operation logs 76 in the operation record 74. The logging unit 73 also saves the project data 75 that was being executed when the operation record was created in the operation record 74. Furthermore, the logging unit 73 notifies the analysis unit 83 that the operation record 74 has been created. The setting unit 78 sets control cycles used for generating the learning model, analysis, and analysis report, as described later, according to the operator's input. Control cycles are set by specifying the timing that serves as the basis for the cycle, and the setting of control cycles is called cycle setting. For example, cycle setting includes a symbol name that defines the start timing of the cycle and rising / falling edge information of the symbol value.Furthermore, the cycle setting may include setting information for the cycle start timing, which is determined by a symbol name that defines the cycle start timing and the rising / falling edge information of the symbol value, and setting information for the cycle end timing, which is determined by a symbol name that defines the cycle end timing and the rising / falling edge information of the symbol value. The control cycle setting by the setting unit 78 is provided to the PLC1 in a file format such as CSV, and the setting unit 78 may read the CSV or other file and set the control cycle. For example, the control cycle set by the setting unit 78 is used to classify devices synchronized with the cycle and add the classification information to the model as attribute information, to narrow down the devices to be analyzed by the control cycle, or to generate an analysis report that is displayed in synchronization with the control cycle. Multiple control cycles may be set. The setting method will be described later. Also, it is not always necessary to set a control cycle; for example, if the possible values ​​of the symbol value under normal conditions are predetermined, it is possible to determine whether the symbol value is one of those predetermined possible values ​​and determine it to be an abnormal symbol.

[0036] In CPU 41a, the protocol conversion unit 81 converts the HTTP request, which has been encapsulated and forwarded from PC 2b, into a protocol and extracts it from the request signal. The protocol conversion unit 81 encapsulates the response information sent from Web server 82 to the HTTP request and passes it to CPU 41a. The protocol conversion unit 81 may provide a transparent tunnel (e.g., TCP tunnel). Web server 82 provides the analysis report created by analysis unit 83 to PC 2b. The analysis unit 83 analyzes the operation log 76 in the operation record 74 using a model described later, creates an analysis result 77, and passes it to logging unit 73. When the analysis unit 83 creates the analysis result 77, the logging unit 73 adds the analysis result 77 to the operation record 74, in addition to the project data 75 and operation log 76. The operation record 74 is stored in the operation record storage unit 37. Alternatively, the analysis result 77 may be stored in the memory 42a of analysis unit 4a. When the analysis result 77 is issued, the notification issuing unit 84 issues a notification. This notification is sent to CPU11b.

[0037] For example, when a web browser 18 requests an analysis report via an HTTP request, the web server 82 passes the HTTP request to the protocol conversion unit 81. The HTTP request contains the URL (uniform resource locator) of the analysis unit 4a (web server) which is executed by the CPU 41a and provides the analysis report. The protocol conversion unit 81 encapsulates the HTTP request and converts it into a request signal (command) that can be sent using a predetermined communication protocol. This request signal is passed to the CPU 41a of the analysis unit 4a. The CPU 41a returns the analysis report to the CPU 11b. The CPU 11b passes the analysis report to the web browser 18. As a result, the web browser 18 displays the analysis report on the display unit 7b.

[0038] The model generation unit 86 creates a model that will later serve as master data for the analysis unit 83 to compare with the driving record data. The report generation unit 85 generates an analysis report, which is a display screen for showing the analysis results 77 on the web browser 18 of PC2b. The analysis report contains multiple analysis results, which are displayed synchronously on a time axis. Details of the analysis report will be described later using Figure 8A. The model generation unit 86 includes a classification unit 87 and a determination unit 88.

[0039] The classification unit 87 classifies each device into its category based on the time-series data of each device collected by the collection unit 72. The classification method will be described later using Figure 13. The classification unit 87 can perform the classification process at any time, but basically it performs the classification process when the system operation starts or when it receives instructions from the user. The determination unit 88 determines the analysis parameters to be used when detecting a device that is in an unusual state, according to the time-series data classified by the classification unit 87, and stores them in the memory 42a. When the classification process is performed by the classification unit 87, the determination unit 88 performs the classification parameter determination process and updates the analysis parameters if they have already been determined for the same device. When updating, the parameters may be updated by overwriting, or new analysis parameters may be determined from two analysis parameters, such as by taking the average. Alternatively, the update process may be determined for each device. In this way, the classification unit 87 and the determination unit 88 are processing units that function in the learning phase, where the collected driving record data is analyzed to learn what the data looks like under normal conditions, and they determine the analysis parameters to be used when estimating abnormal devices. On the other hand, the analysis unit 83 is a processing unit that functions in the estimation phase for estimating abnormal devices. The analysis unit 83 uses the determined analysis parameters to detect abnormal devices from the time-series data of each device collected by the collection unit 72. The analysis parameters include, for example, the ON time, OFF time, rising edge timing, falling edge timing, number of ON cycles, number of OFF cycles, and at least one of the steady-state values ​​of the device value.

[0040] <Basic Flow> Figure 7 shows the basic flow of model generation, analysis of driving record data, and result output according to this embodiment. The processes described below are described as processes executed by the CPU 31 of the basic unit 3 and the CPU 41a of the analysis unit (expansion unit) 4a. However, there is no intention to limit the present invention, and some of these processes may be executed by other units, all of these processes may be executed by a single unit, or they may be executed by an external device (analysis device) that is communicatively connected to the programmable logic controller.

[0041] In S1, the CPU 31 of the basic unit 3 sets the collection settings and analysis settings in the collection unit 72 according to the information input via PC 2a. For example, the CPU 31 can set the collection target, collection period, storage location, file name, etc., as collection settings. Analysis settings include, for example, setting the start and end of the cycle to be analyzed. Here, an example has been described in which the basic unit 3 performs the collection and analysis settings, but the CPU 41a of the analysis unit 4a may also perform the collection settings according to the information input via PC 2b. Furthermore, in S1, the CPU 31 of the basic unit 3 can set camera settings such as shooting conditions, image processing settings, and monitoring item settings according to the information input via the setting screens displayed on the display units 7a and 7b of PCs 2a and 2b, as analysis settings. Note that these analysis settings can also be executed by the CPU 41a of the analysis unit 4a. Subsequently, in S2, the CPU 31 collects the operation record data as model creation data according to the collection settings set in S1 and stores it in the operation record storage unit 37. More specifically, all device values ​​collected according to the collection settings are temporarily stored in the ring buffer 36, and the necessary data from the ring buffer 36 is stored in the operation record storage unit 37 as operation record data.

[0042] Next, in S3, the CPU 41a of the analysis unit 4a creates a model using the collected operating record data. This model may include information for each device, which classifies the patterns of each device based on features such as constants, bit patterns, and analog values, as well as information indicating the timing of changes in device values. In other words, the model learns the normal change patterns of each device. The detailed processing in S3 will be described later using Figure 11.

[0043] Subsequently, in S4, the CPU 31 of the basic unit 3 determines whether a trigger has occurred to analyze the operation record data. This trigger is basically triggered when an unusual anomaly occurs during operation, and its conditions for occurrence include, for example, when an error bit is set, when a predetermined event occurs from an application such as a monitoring application, or when a manual instruction is received from an operator. If a trigger occurs, the process proceeds to S5.

[0044] In S5, the CPU 31 of the basic unit 3 stores the operation record data in the operation record storage unit 37 for collecting and analyzing the values ​​of each device. Typically, a trigger occurs after some unusual change has occurred. Therefore, data before and after the trigger is acquired here to identify the cause of such a change. As mentioned above, the device values ​​of all devices during operation are stored in the ring buffer 36. Therefore, when the CPU 31 determines that a trigger has occurred, it stores the necessary device values ​​before and after the trigger from the ring buffer 36 to the operation record storage unit 37 according to the analysis settings set in S1. Also in S5, the CPU 41a of the analysis unit 4a acquires the operation record data for analysis from the basic unit 3. Here, in addition to the operation record data, camera image data, event occurrence history, and error history information may also be acquired.

[0045] Subsequently, in S6, the CPU 41a of the analysis unit 4a acquires the time-series data collected by the basic unit 3 and performs analysis processing by comparing it with the model generated in S2. In the analysis processing, for each device, the CPU 41a compares the model data, which is the master data generated in S3, with the operation record data of the device to be analyzed to determine whether the target device is in an unusual state. If the difference exceeds a predetermined value, it is determined that an unusual state has been detected. Furthermore, the CPU 41a stores the analysis results for each device in the analysis results 77 storage area of ​​the operation record storage unit 37 of the basic unit 3. Here, it is desirable that the analysis results 77 store the analysis results and their record data for devices in which an unusual state has been detected, along with time information. This makes it easy to create an analysis report that can be displayed in a synchronized manner using this information when a request for the generation of an analysis report is received from an operator or the like. Camera images obtained from the expansion unit 4b may also be linked and stored. Furthermore, in S7, the CPU 41a generates display data (analysis report) based on the analysis results, transmits the generated display data to the PC 2b or an external device via the communication unit 43, and terminates the process. For example, the analysis results are displayed to the operator on the PC 2b. Details of the result display screen showing the analysis report will be described later using Figure 8A.

[0046] The monitoring application is one of the data utilization applications executed by the CPU 41a of the analysis unit 4a. The analysis unit 4a may be an extension unit that executes data utilization applications. The data utilization application includes a data utilization program (e.g., a flow) that collects and processes control data, and a dashboard that displays the execution results of the data utilization program. Examples of data utilization applications include a monitoring application that monitors target devices and variables in real time, and an operation record analysis application that analyzes operation records to reproduce the operating state of PLC1 and generates an analysis report. Other examples of data utilization applications include calculation applications that calculate KPIs (Key Performance Indicators) such as availability, yield rate, or cycle time. The monitoring application is an application for continuous monitoring based on the symbol values ​​of PLC1 symbols. For example, it continuously collects the symbol values ​​of one or more symbols at the scan time level according to the settings of the monitoring application, and continuously displays information based on the collected symbol values ​​while updating it in real time. The one or more symbols to be continuously monitored are set in advance by the user. The monitoring application, for example, has a web server function and can be configured from a general-purpose browser via the communication unit 43. Because it can be configured from a general-purpose browser, it can be configured or monitored from a PC, smartphone, or tablet without the need for dedicated tools such as a program creation support device. The monitoring application also automatically sets thresholds for one or more symbols that are subject to continuous monitoring, based on the symbol values ​​of multiple cycles under normal conditions. For example, upon receiving a user instruction, the monitoring application automatically sets thresholds for monitoring the state of multiple symbols that are subject to continuous monitoring, based on the variation in symbol values ​​of multiple cycles under normal conditions. The thresholds are set to monitor unusual states, i.e., abnormal states, and the monitoring application issues an alarm if the symbol value of the monitored symbol exceeds the threshold.In this way, for example, PLC1 can detect signs before the equipment stops. PLC1 may use an alarm triggered when the symbol value of a monitored symbol exceeds a threshold, based on the results of sign monitoring by the monitoring application, as a condition for saving the operation record. PLC1 uses the alarm generated by the monitoring application as an event trigger to save the operation record data before and after the trigger. PLC1 turns on the save completion device when the saving of the operation record data is complete. The operation record analysis application may automatically analyze the operation record data upon confirmation that the saving of the operation record data is complete. For example, the operation record analysis application may analyze the operation record data in response to the turn on of the save completion device. The operation record analysis application analyzes the symbol value of the analyzed symbol (e.g., the device value of the all-bit device) and extracts symbols that are candidates for the cause of the alert. In this way, the operation record analysis application automatically analyzes the operation record data saved due to the alarm generation by the monitoring application and extracts symbols that are different from the usual from the operation record data. As a result, CPU41a constantly monitors the equipment status using the sign monitoring function of the monitoring application and issues alerts for changes. Furthermore, CPU41a automatically analyzes the triggers for alerts and extracts symbols that are different from the usual. In other words, PLC1 constantly monitors symbol values ​​to detect signs of malfunction in the controlled equipment, notifies of the signs before the controlled equipment stops via an alarm, and automatically analyzes the cause of the signs.

[0047] <Results display screen (analysis report)> Figure 8A shows the results display screen displayed on the display unit 7b when the Web browser 18 according to this embodiment executes the Web browser program 14d. Here, an example is described in which the results display screen 800 is displayed on the display unit 7b of the PC 2b, but there is no intention to limit the present invention, and it may be displayed on the display unit of other devices, or on the monitor of the PLC's expansion unit if it is possible to display it on such a monitor. For example, other devices may include programmable displays, tablets, and smartphones. Alternatively, the content of the results display screen described below may be sent to other devices as an analysis report via email, SNS, FTP transfer, etc. Comments may be added to the analysis report, for example, handwritten or typed comments may be added to the analysis report. In this case, the analysis report including the content of the results display screen with the added comments may be sent to other devices. This allows the recipient of the email to view the analysis report together with the on-site situation such as comments. Furthermore, when the analysis report is sent to other devices, the driving record data that is the subject of the analysis report may be sent along with the analysis report. This allows the recipient of the email to view the driving record and the analysis report together. Furthermore, if PC2b is a tablet or smartphone with a camera, it may also be possible to attach a photo of the device.

[0048] The results display screen 800 consists of filters 801 to 803 for filtering and displaying results, a filtered result 804, a detection map 810, a detection list 820, an image display area 830, and an analysis comment 840. Note that at least one of 810, 820, 830, and 840 may be displayed as the results. Filter 801 allows filtering the results display by selecting a control cycle. Here, a control cycle refers to the period from a start timing to an end timing accompanied by periodic changes in device values. When filter 801 is specified, the results are displayed only for devices operating within the selected control cycle. Filter 802 allows filtering the results display by selecting attribute information. Attribute information indicates information such as which unit or communication device a device is connected to, or whether or not it is an input device.

[0049] If, for example, "Unit Configuration Information" is specified in filter 802, the unit configuration will be displayed in a pop-up window, and one of the displayed units can be selected. Once a unit is selected, the results will be narrowed down to devices connected to that unit. Also, if "Input Device" is specified as attribute information, the results will be narrowed down to devices to which the attribute information of the input device has been added. Filter 802 is not limited to filtering that utilizes attribute information. For example, as a result of the analysis, the same symbol may be detected multiple times as an abnormal symbol. The earliest occurrence time is likely to be important in investigating the cause of the abnormality, so filter 802 may be configured to filter out all occurrence times of the same symbol that has been detected multiple times. Filter 802 may also be configured to filter out all occurrence times of the same symbol that have the same detection algorithm during analysis and the same type of anomaly (described later), except for the earliest occurrence time. Furthermore, filter 802 may be configured to filter out all occurrence times of the same symbol that have the same detection algorithm during analysis, the same type of anomaly (described later), and the same cycle settings (described later), except for the earliest occurrence time.

[0050] Filter 803 allows filtering of results by selecting events or errors. Specifying the type of event or error narrows the displayed results to only those related to the device. For example, if "Operation Record Saving Trigger" is selected as the event, the displayed results will be limited to the analysis results before and after that event. The results display screen 800 may also display events and errors in chronological order along with the analysis results. In this case, filter 803 can filter events and errors. This allows switching between a mixed display of analysis results and events / errors, and a display of analysis results only. Here, events may include, for example, power ON / OFF, device value rewriting, memory insertion / removal, etc., and filtering targets may be added or removed for each category. Errors may include, for example, communication errors, PLC calculation errors, scan time exceeding errors, etc., and filtering targets may be added or removed for each severity of the error.

[0051] The filter conditions for filters 801-803 are judged as a logical AND, and the corresponding analysis results are displayed. Therefore, filters 801-803 do not necessarily need to be selected, and the analysis results may be filtered when the operator selects the desired filter. Alternatively, the system may select a filter by default and display the analysis results before the operator specifies one. The devices displayed in these analysis results are devices in which an unusual state has been detected. An unusual state is, for example, when a device value deviates from the normal range, or when the timing or number of changes in the device value falls outside the normal range. In product manufacturing plants, the same product is mass-produced every day. In other words, the same process is repeated many times. Therefore, detecting and displaying unusual states is extremely useful for improving ladder programs and reviewing production equipment. The normal range (normal conditions) that defines the normal state may be defined by the user or by the learned results of the device values.

[0052] The detection map 810 displays the cycles, including the start and end timings, for each of the multiple processes executed in PLC1 along the time axis. In the detection map 810, the horizontally extending rectangles indicate the period (control cycle) during which a process is being executed. The circles within the rectangles indicate anomaly points, which are locations where abnormal conditions occurred within the cycle. The horizontal axis of the detection map 810 represents time, with the left end representing the start of data collection and the right end representing the end of data collection. The horizontal axis can be zoomed in or out by selecting the zoom in / out buttons at the top. In this case, the initial display may be with the data collection start point at the left end and the data collection end point at the right end. Alternatively, it may be determined by the time width of the cycle definition described later. For example, if the cycle times are 10 seconds, 10 seconds, 11 seconds, 9 seconds, 10 seconds, 10 seconds, and 20 seconds, the median value of 10 seconds may be taken, and the left end to the right end may be set to 30 seconds so that three cycles can be displayed at once. Here, the vertical axis is set to device units, but it may also be set to program module units, as described later. Furthermore, the detection map 810 may also display the feature values ​​of the camera image alongside the device values. Displaying them side by side makes it easy to recognize periodic changes in the image.

[0053] As shown in Figure 8A, the control cycle can be represented by a rectangular shape, with the left end indicating the start timing and the right end indicating the end timing. This allows for a quick visual confirmation of the control cycle, compared to displaying device values ​​as waveforms, and enables determination of whether or not the cycle is in operation. However, the present invention is not limited to this, and the cycle may be represented by any shape as long as the start and end timings can be identified. For example, instead of a rectangular shape, vertical lines indicating the start timing and vertical lines indicating the end timing may be displayed, and the inside of these lines may be colored differently from the background to represent the cycle. Also, if there is no record of the start or end timing in the operation record data, it is not necessary to draw vertical lines or the like on the detection map 810. Furthermore, as shown in Figure 8A, the location of an anomaly within the defined control cycle is shown. In the example in Figure 8A, the location where an anomaly occurred is displayed as an anomaly point. On the other hand, an anomaly has a section from the start to the end of the anomaly. Therefore, the anomaly location may be plotted as a section. This allows for the representation of how the anomaly sections of other devices overlap, enabling the operator to recognize the relationships between devices and providing important information for identifying errors. In this way, the anomaly locations of each device can be drawn in various ways.

[0054] In the detection map 810, the rectangles representing processes indicate that the left side is older and the right side is newer. The time bar 811 indicates the currently selected time. The time bar 812 indicates the timing when the trigger for saving the operation record data occurred. As mentioned above, the operation record data includes data before and after the save trigger occurred, so data is shown before and after the time bar 812. The distinguishability of the time bars 811 and 812 may be improved by drawing them in different colors or by using solid and dashed lines. Furthermore, the display of the analysis results can be updated by manipulating the time bar 811. In accordance with the operation of the time bar 811, the detection list 820, the image display area 830, and at least one of the analysis comments 840 (described later) may also be updated in conjunction, and the corresponding analysis results may be displayed.

[0055] The image display area 830 displays the camera image (hereinafter also referred to as camera video) acquired by PLC1. In Figure 8A, the camera image of the master data, which is data under normal conditions, and the current camera image are displayed side by side. Since the camera image is also time-series data, the seek bar 831 indicates the playback time of the camera image and moves from left to right as the playback time progresses. The time bar 832 indicates the timing when the detected device entered an unusual state and is linked to the time bar 811 described above. The time specification unit 833 is a control object for instructing the camera image playback time to be advanced, reversed, start playback, or stop playback. 834 can specify a control cycle, and the camera video is played back using the specified cycle as the reference cycle. For example, if the fast-forward button of the time specification unit 833 is operated, the video is controlled to skip to the next control cycle after the current control cycle. Alternatively, it may jump at the end of a cycle.

[0056] The camera footage may be stored as driving record data, but it may also be data stored on an external device with associated timestamps. For example, it may be camera footage recorded on a webcam connected to any of the expansion units, or inspection images recorded on an image inspection machine. The data stored on the external device may also be recording data from measuring instruments, such as numerical values ​​or measurement waveforms. On the results display screen 800, the playback time of the detection map 810, the playback time of the camera images, and the playback time of the detection list 820 are managed and displayed in a synchronized manner. Furthermore, as shown in the dotted line area of ​​Figure 8A, the detected abnormal areas may be highlighted in the video. This makes it even easier for the user to compare the current video with the video under normal conditions.

[0057] The detection list 820 shows devices that are in an unusual state and the time when that state occurred (the time when the device value was collected). The detection list 820 is a list of devices that are in an unusual state, listed in chronological order. When the CPU 11b detects a click on a device displayed in the detection list 820, it can synchronize the display of the detection map 810, the detection list 820, and the image display area 830 based on the identification information of the clicked device and the playback time information (the time when the device value was collected). The time bar 821 shows the selected time and is linked to the time bars 811 and 831, showing the same timing. The time bar 822 shows the timing when the trigger for saving the driving record data occurred.

[0058] Analysis comment 840 displays the comments included in the analysis results, the master data for the device selected in detection list 820, and the time-series data of the device value for this instance. Time bar 841 indicates the timing when the unusual condition occurred, and it is linked to time bars 811, 821, and 831, showing the same timing. The displayed comments indicate the nature of the abnormality of the device. Analysis comments can take various forms, which will be described later using Figure 10 for details.

[0059] When CPU 11b detects a click on a device displayed in detection list 820, it can synchronize the display of detection map 810, detection list 820, and analysis comment 840 based on the identification information of the clicked device and the cycle information that has entered an unusual state (cycle start and end times, or cycle start time and next cycle start time). Figure 8B shows how detection map 810, detection list 820, and analysis comment 840 are synchronized when any item in detection list 820 is selected. Analysis comment 840 displays time-series data of device values ​​for the time range corresponding to the cycle that has entered an unusual state. At this time, the detection map 810 displays a time range 852 corresponding to the time range 854 of the time-series data displayed in analysis comment 840. The time range 852 displayed on detection map 810 corresponds to the process among multiple processes that has entered an unusual state. For example, when an item 853 for a device that is different from the current state among the devices displayed in the detection list 820 is clicked, the system switches to time-series data of the device value for the clicked device for the time range corresponding to the cycle in which it entered an unusual state. At that time, the detection map 810 switches to a range that includes time range 852, which corresponds to time range 854 of the time-series data displayed in the analysis comment 840. Also, as shown by arrow 855, time range 852 is highlighted on the detection map 810 with dotted lines or colored solid lines, allowing the operator to confirm its correspondence with the section extracted in the analysis comment 840. This makes it easy for the operator to understand which section of the waveform on the detection map 810 the analysis comment 840 is extracting. Furthermore, as shown in 854, the analysis comment 840 also displays rectangles or anomaly points indicating the cycle corresponding to the extracted section at the bottom of the waveform, making it easy for the operator to understand the relationship between the start and end timings of the cycle and the waveform and anomalies. Furthermore, the detection map 810 may also display an enlarged view of the anomalies corresponding to the devices selected in the detection list 820, as shown in 851.Furthermore, if the time range of the time series data displayed in analysis comment 840 is the start time of one cycle and the start time of the next cycle, analysis comment 840 may also include a diagram indicating the end time of the cycle, corresponding to the time axis of the time series data.

[0060] Thus, the results display screen 800 is composed of multiple analysis results, including the display of a detection map 810, a detection list 820, an image display area 830, and analysis comments 840. However, these result displays are just examples, and other result displays may be included additionally or alternatively. For example, as shown in Figure 9, dependency information between devices (relation map) may be displayed as an analysis result. The basic unit 3 can understand the dependencies between devices and variables by analyzing the ladder program. For example, when a detected device is selected, the devices related to it can also be displayed side by side, presenting the operator with dependent devices. This helps the operator understand and identify anomalies.

[0061] <Relationship Map> Figure 9 shows the relation map 900. The relation map 900 is a graphical representation in a user program such as a ladder program that shows the relationship between a program module associated with a specific symbol and other symbols associated with that program module. For example, if a device that is in an unusual state (an abnormal device) used in a ladder program is selected as a specific symbol, the UI will display other devices that are related to that abnormal device in the ladder program via the program module. This UI may be a screen accessed by operating an unshown display button on the results display screen 800, or it may be displayed additionally on the results display screen 800. By displaying the relation map, the user can easily understand the dependencies between the abnormal device and other devices. Generally, the number of devices used in PLC1 ranges from several hundred to tens of thousands, so it is not easy for the user to identify the device that caused the abnormal state from a device that is in an unusual state. The CPU 11 searches the ladder program for the abnormal device, finds a description of the abnormal device, and identifies the related devices by analyzing that description. In this example, an abnormal device (e.g., R0004) is described in the output section of the ladder program, and related devices include MR000, MR001, and MR002.

[0062] CPU 11b displays the abnormal devices, related devices, and program modules identified from the ladder program in a tree-like structure. User programs (ladder, C language, flow language, scripts, etc.) are often written in several parts to improve readability and maintainability, and these units are called program modules. Within a single program module, programs for reading and writing to each device are written, and a single device may be read and written to by multiple modules, but usually only one module is primarily used. In the example in Figure 9, the devices input for calculations in the output section are displayed on the left, the program modules are displayed in the middle, and the abnormal devices are displayed to the right. As shown in Figure 9, when a program module is selected on the relation map 900, CPU 11b may display the corresponding program module in the program display area 910. Note that this explanation uses an example where the CPU 11b of PC2b controls the display process, but this is just one example, and it may also be performed by the CPU 11a of PC2a. Furthermore, the detection map 810 described above may also be displayed on a program module basis rather than on a device basis.

[0063] The CPU 11 identifies the program module associated with the symbol from the user program, based on the user's specification for identifying the symbol, and identifies other symbols associated with the identified program module to generate a relation map 1500. Based on the analysis results, the CPU 11 highlights the abnormal devices included in the relation map 1500. The analysis results also include the time when the abnormal device was determined to be different from normal, and the CPU 11 may choose to highlight only abnormal devices that occurred before the time of reproduction on the relation map 1500. This ensures that the abnormal device remains highlighted after the abnormal state occurs. The analysis results may also include information indicating which symbols were not included in the analysis. In this case, the CPU 11 distinguishes between the symbols not included in the analysis and other symbols on the relation map 1500 using color or other means based on the analysis results. This allows for distinction between symbols that were determined not to be abnormal through analysis and those that were not determined to be abnormal because they were not analyzed. Symbols excluded from analysis include, for example, symbols whose symbol value change patterns do not exhibit regularity in relation to cycles defined by control cycles or cycle settings, and symbols designated by the user as being excluded from analysis.

[0064] <Analysis Comments> Figure 10 shows various forms of analysis comments. The analysis comment 840 shown in Figure 8A can take various forms depending on the information of the analysis results, especially the nature of the anomaly. Note that the analysis comments are automatically generated by the analysis unit 4a and do not require any operation by the operator. Here, three examples of analysis comments 1000, 1010, and 1020 are shown, but these forms are also examples.

[0065] Analysis comment 1000 indicates an anomaly where the number of device changes is greater than that of the master data used for training. 1001 shows the analysis comment, which is expressed in natural language as indicating that a specified device has changed more than the master. 1002 shows the waveform of the master data, and 1003 shows the waveform of the driving record data acquired for analysis. 1004 shows the anomaly where there were many changes, and is highlighted, for example, by shading. Analysis comment 1010 indicates an anomaly in the ON time of the device. Analysis comment 1000 also shows the model confidence score 1030. Model confidence score indicates the confidence of the training model used for analysis, and details will be described later using Figure 21. 1011 shows the analysis comment, which is expressed in natural language as indicating that a specified device has turned OFF a predetermined time earlier than the master. As shown in Figure 10, the predetermined time is written as "297.86ms", 1012 shows the waveform of the master data, and 1013 shows the waveform of the driving record data acquired for analysis. Furthermore, as shown in 1012 and 1013, the strings "change point a1" and "change point b1" are displayed at the points in each waveform that indicate the timing of the change from ON to OFF. This allows the operator to easily grasp the change points and easily judge the differences by comparing the master waveform with the current waveform. Thus, the analysis comments according to this embodiment include an explanation of the abnormality in natural language, as shown in 1001 and 1011, and an explanation of the abnormality using graphics, as shown in 1002-1004, 1012, and 1013. Note that either the explanation of the abnormality in natural language or the explanation of the abnormality using graphics may be included alone. This may be changed according to the size of the drawing area on the results display screen that displays the analysis report.

[0066] Expressing abnormal information using natural language has the advantage of allowing users to easily analyze the abnormal information without needing to learn anything new, as natural language is similar to how people converse. Furthermore, it has the advantage of clearly explaining not only numerical values ​​and judgment results (OK / NG), but also how the judgment was made and what the abnormality was. On the other hand, expressing abnormal information using graphics allows for visual understanding, providing details such as the nature of the abnormality, the timing, and the degree of the abnormality. Additionally, while users may distrust the judgment results of difficult-to-understand, black-box-like judgment methods, making the results easier to understand through graphics can change users' perception of the reliability of the judgment method.

[0067] Furthermore, while analysis comments 1000 and 1010 show examples of analysis comments for bit devices, the PLC1 in this embodiment also includes word devices, and an example of an analysis comment for a word device is shown in 1020. Here, a graph plotting analog values ​​is shown to explain the abnormality using graphics. The horizontal axis corresponds to time, and the vertical axis shows the device value. Also, 1021 shows the operation record data of the predetermined device acquired this time, and 1022 shows the master data, which is the data under normal conditions. Instead of master data, an average value over several cycles may be used. Also, 1023 shows the lower threshold, and 1024 shows the upper threshold. An error occurs when the operation record data exceeds these thresholds. In addition, the rectangle in 1025 indicates the location where an unusual state was detected, and it shows the location where the operation record data acquired this time is a predetermined value away from the master data. Note that such highlighting with rectangles may be displayed only for locations that exceed the lower threshold 1023 or the upper threshold 1024.

[0068] <Model generation flow> Figure 11 shows the details of the model generation flow in S3 described above. Here, we describe the control for generating a model by classifying the device values ​​of the device as device attribute information. However, the present invention is not limited to this, and models may be generated based on other attribute information as described above. The processes described below are described as processes executed by the CPU 41a of the analysis unit (expansion unit) 4a. However, there is no intention to limit the present invention, and some of these processes may be executed by other units, all of these processes may be executed by a single unit, or they may be executed by an external device (analysis device) that is communicatively connected to the programmable logic controller.

[0069] First, in S31, the CPU 41a of the analysis unit 4a acquires normal operation record data for model creation from the basic unit 3. This operation record data is the data stored in the operation record storage unit 37 in S2. Next, in S32, the CPU 41a acquires cycle setting information from the basic unit 3 as information other than device values. The cycle setting information indicates, for example, the cycle pattern set by the operator via the PC 2a. For example, it indicates the start timing and end timing of the cycle. The information acquired here may also include information acquired by field devices 10 such as a camera connected to the expansion unit 4b, such as camera image data. This data may be acquired via the basic unit 3, but it may also be acquired directly from, for example, the expansion unit 4b. Furthermore, in this embodiment, the processing in S32 is not mandatory, and it is not necessary to acquire the cycle setting information.

[0070] Next, in S33, CPU 41a determines which cycle each device belongs to based on the cycle settings acquired in S32, and further classifies each device into a category according to the change pattern of each device value. Device classification will be described later using Figure 13. In addition, there are various patterns for the cycle patterns of each device, and here it is determined which pattern each device belongs to, as specified in the cycle settings. If the cycle settings include settings corresponding to multiple control cycles, it is also possible to determine which device belongs to each control cycle. In this case, there may be devices that are determined to belong to multiple control cycles. Figure 12 shows the control for determining the cycle pattern of each device. In Figure 12, rectangles indicate the period (cycle) during which a process is executed, from the start timing to the end timing, and one rectangle represents one cycle. A cycle pattern is the pattern in which this one cycle appears. 1201~1203 shows the processes with cycle settings. 1204~1206 shows the cycle patterns extracted from the collected data of devices A~C, respectively. The analysis unit 4a determines which cycle setting pattern each device belongs to. For example, it might determine that device A belongs to cycle setting 1, device B belongs to cycle setting 2, and device A does not belong to any of the set cycle settings. Specifically, it checks whether the value and the number of changes match from the start to the end of the cycle. It is acceptable for the start and end timings to be slightly different. In this way, the analysis unit 4a determines the correspondence between each cycle setting pattern and each device. The analysis unit 4a may also determine which device belongs to each cycle setting pattern.

[0071] When the analysis unit 4a determines the correspondence between each cycle setting pattern and each device, it makes the determination based on the pattern of each device value from the start to the end of each cycle setting. This allows it to determine that a device belongs to the pattern of that cycle setting, regardless of how the device value behaves from the end of one cycle to the start of the next. Alternatively, when the analysis unit 4a determines the correspondence between each cycle setting pattern and each device, it may also determine whether the device value and the number of changes match from the reference timing of one cycle to the reference timing of the next cycle, for example, from the start of one cycle to the start of the next cycle.

[0072] In PLC1, the control cycle is defined as the period during which a process is being executed, including the start and end timings for each of the multiple processes executed. However, the scope of cycle setting is not limited to this. Figure 23 shows the processing flow of a cycle when there are devices that change outside of the period from start to end timing. As shown in Figure 23, in order to execute a work process, there may be a confirmation phase 2301 to check whether the work start conditions are satisfied as preparation for executing the work process. Furthermore, after the execution of the work process, which consists of a work start phase 2302, a work phase 2303, and a work end phase 2304, there may be a preparation phase 2305 to prepare for the next process, a waiting phase 2306 to wait until the next process, etc. Therefore, there are devices that change even during periods other than when a work process is being executed, and these can provide clues to pinpoint the cause of an anomaly. For example, input devices related to the fulfillment of work start conditions in the confirmation phase, and devices that indicate control signals for the next preparation in the preparation phase, operate outside of the period from start to end timing. Therefore, the analysis results of these devices can provide clues to pinpoint the cause of an anomaly. In short, the cycle setting can cover the period from one reference timing to the next, allowing for seamless analysis. Furthermore, cycle settings allow the user to select the devices that define the start and end timings, or they can be automatically set by learning normal operation data. However, if the analysis period is limited to the start and end timings, it can be difficult to identify devices that define the start and end of a process if these are not precisely known. By setting the cycle setting to cover the period from one reference timing to the next, seamless analysis can be achieved simply by selecting devices synchronized with the process, even without strictly specifying the devices that define the start and end of a process.

[0073] Returning to the explanation of Figure 11, in S33, CPU 41a adds the extracted cycle patterns and the types of change patterns described later as attribute information (analysis parameters) to each device. Next, in S34, CPU 41a generates a model from the operation record data acquired in S31 based on the added attribute information and terminates the process. The generated model is the master data used during analysis and includes analysis parameters that show at least information on the cycle patterns and types of change patterns for each device. The analysis parameters include, for example, the ON time, OFF time, rise time, fall time, number of ON cycles, number of OFF cycles, and a threshold indicating at least one of the steady-state values ​​for the device values. Using these analysis parameters, analysis is performed in the estimation phase.

[0074] <Types of devices> Figure 13 shows an example of the types of time-series data to be collected. 1301-1306 show the device signals (time-series data) for each type. The device signals may include external signals. Note that the types described below are just examples, and there is no intention to limit the present invention; the present invention may also be applied to other types. Furthermore, in the present invention, it is desirable that the types to be classified include at least two of these multiple types in order to improve the classification effect. Note that the classification of time-series data during model generation is performed based on the repeatability of the device, by which the operator selects a device that determines the period (control cycle) for classification.

[0075] 1301 indicates the device signal of a device that operates in synchronization with the operating cycle of the device. 1310 indicates the operating cycle of the device. The type of 1301 is characterized by the occurrence of similar change patterns (steady change patterns) for each operating cycle of the device. In this type, for example, a detection method is assigned in which a steady change pattern is identified from time-series data acquired during a period that can be considered normal, and an abnormal device (a device in an unusual state) is identified based on the deviation of newly acquired time-series data from the identified steady change pattern. Specifically, for change patterns of time-series data over multiple periods that can be considered normal, the time variability around the change points is measured, and a threshold is set according to the measured variability. Subsequently, a detection algorithm is assigned in which an abnormal device is detected based on whether the change points of the acquired time-series data exceed the range of the threshold set corresponding to the change points. For example, multiple waveforms for each operating cycle of the device can be superimposed, and based on the variability of the point where the device changes from OFF to ON, a reference value and a threshold for the change point can be set, and an abnormal device can be identified using these parameters. Alternatively, in each period of 1301, the relative time indicating the rising edge timing of the first signal and the phase in each period may be used as evaluation variables, and parameters corresponding to these evaluation variables may be determined based on the variability of these evaluation variables. For example, if the phase in each period is used as an evaluation variable, the upper and lower threshold values ​​of the phase may be used as parameters, respectively.

[0076] When analysis unit 4a determines which device belongs to each cycle setting pattern, the criteria may determine that a single device belongs to multiple cycle settings. Setting criteria to allow many devices to belong to any of the cycle settings increases the number of devices to be analyzed, which can lead to easier identification of contributing factors, but it may also include cycle settings that are not highly relevant to the device. Therefore, for devices that are determined to belong to multiple cycle settings, the number of cycle settings to which they belong may be narrowed. As an indicator for narrowing, a smaller evaluation variable may indicate a higher degree of relevance, and a lower evaluation variable may indicate a lower degree of relevance, and the device may be excluded from the cycle settings. In addition, devices whose device value changes between the start and end of the cycle may be judged as highly relevant, while devices whose device value changes during periods other than between the start and end of the cycle may be judged as less relevant. Furthermore, for devices whose device value changes during periods other than between the start and end of the cycle, the further the point in time of the device value change deviates from the start or end of the cycle, the lower the degree of relevance may be. In this way, for devices that are determined to belong to multiple cycle settings, the number of cycle settings to which they belong may be narrowed.

[0077] On the other hand, 1302 represents a device signal of a device that does not synchronize with the scan cycle but operates in synchronization with a cycle other than the operating cycle of the device in question. For this type as well, detection methods are assigned, for example, such as identifying a steady change pattern from time-series data acquired during a period that can be considered a normal state, and identifying an abnormal device (a device in an unusual state) based on the deviation of newly acquired time-series data from the identified steady change pattern. Specifically, for the change pattern of time-series data over multiple periods that can be considered a normal state, the time variability around the change points is measured, and a threshold is set according to the measured variability. A detection algorithm is then assigned that detects abnormal devices based on whether the change points in the subsequently acquired time-series data exceed the range of the threshold set corresponding to the change points. Alternatively, in each period of 1302, the relative time indicating the rising edge timing of the second signal or the phase in each period may be used as evaluation variables, and parameters corresponding to the evaluation variables may be determined based on the variability of these evaluation variables. For example, if the relative time in each period is used as the evaluation variable, the upper and lower threshold limits of the relative time may be used as parameters, respectively.

[0078] 1303 represents the device signal of a device that takes a constant value. In this type, for example, a detection method is assigned in which the normal value is identified from time-series data acquired during a period that can be considered a normal state, and any newly acquired time-series data that differs from the identified normal value is identified as an abnormal device (a device in an unusual state). Specifically, a detection algorithm is assigned in which the device value in time-series data that can be considered a normal state is set as a detection criterion value, and abnormal devices are detected based on whether the value of the time-series data acquired thereafter differs from the detection criterion value set in correspondence with the normal value. In other words, an abnormality can be determined when the value (constant value) changes. 1304 represents the device signal of a device that operates irregularly. This type is excluded from the data used when identifying abnormal devices. 1305 represents the device signal of a device that takes an analog value. For devices that take analog values, as will be described later, the device values ​​are not those of bit devices, so proceed to No. S91 in Figure 14 (S97 in Figure 14), and as shown in Figure 14, the algorithm in the estimation phase differs depending on how the data changes. Various methods can be used as algorithms in the estimation phase for devices that take analog values, such as dynamic time stretching and autoregressive models. 1306 shows the device signal of a monotonically increasing or monotonically decreasing device. In this type, abnormal devices are identified using differential or integrated values. Relative time indicating the timing of monotonically increasing or decreasing, or the phase in each period, may also be used as evaluation variables. Note that the types described here are just examples, and devices that fall into other categories are also conceivable, such as those that can take on multiple states (such as step-like device signals). For devices that can take on multiple states, an abnormality can be judged when the state changes to one different from the normal state.

[0079] Here, we will explain the types of devices. Each device can be a bit device (0 or 1), a word device that takes analog values, or a floating-point device. Word devices are further divided into one-word unsigned integers (0 to 65535), one-word signed integers (-32768 to 32767), two-word unsigned integers (0 to 4294967295), and two-word signed integers (-214783648 to 214783647). Considering these types, for example, if the rate of change per scan period is greater than or equal to a predetermined value and the type is not bit, it can be determined that the device takes analog values.

[0080] <Classification Processing Flow> Figure 14 is a flowchart showing the processing procedure for classifying the change patterns of the collected data. The processing described below is implemented by the CPU 41a of the expansion unit 4a. However, there is no intention to limit the present invention, and some of these processes may be performed by the basic unit 3 or other expansion units 4b, or by an external device (analytical device) that is communicatively connected to the programmable logic controller.

[0081] In S91, CPU41a determines whether the time-series data to be classified is a device value of a bit device. If it is a device value of a bit device, proceed to S92; otherwise, proceed to S97.

[0082] In S92, CPU 41a determines whether there is a change in the value of the time series data to be classified. If there is a change, the process proceeds to S94; if there is no change and the value remains constant, it proceeds to S93. In S93, CPU 41a classifies the time series data to be classified as a device (1303) that takes a constant value, and terminates the process. Here, as classification information, information associated with the time series data, such as flag information indicating the classified type, is stored linked to the identification information indicating the time series data or the device corresponding to the time series data. In this way, by linking the flag information of the classified type and the device identification information during the classification in the learning phase, in the estimation phase, evaluation variables and parameters of the abnormal device detection algorithm can be easily selected according to the type associated with the device identification information, depending on which device the time series data to be verified is from. In other words, in the estimation phase, the process of identifying which type the time series data to be verified corresponds to can be omitted. Note that while flag information indicating the classified type was shown as an example of classification information, algorithm information indicating the abnormal device identification algorithm may be used instead of flag information. Furthermore, it goes without saying that the identification information stored as classification information will be the identification information that identifies the variable if the device corresponding to the time-series data is a variable.

[0083] In S94, CPU41a determines whether a change in the time-series data is a steady change pattern in each period. If it determines that it is a steady change pattern, it proceeds to S95; otherwise, it proceeds to S96. Here, a steady change pattern refers to a pattern that changes in a similar manner in each period. In S95, CPU41a classifies the device as one that operates at a predetermined cycle and terminates processing. As mentioned above, devices that operate at a predetermined cycle include devices that operate in synchronization with the device's operating cycle (1301) and devices that operate in synchronization with a cycle other than the device's operating cycle (1302), and CPU41a classifies them accordingly. On the other hand, in S96, CPU41a classifies the device as one that operates irregularly (1304) and terminates processing.

[0084] On the other hand, if it is determined in S91 that it is not a bit device, the process proceeds to S97, where the CPU 41a determines whether there is a change of more than a predetermined value in the time-series data to be classified. Here, it determines whether the extreme value of the changing signal is greater than or equal to a predetermined value. If there is a change, the process proceeds to S98; otherwise, it proceeds to S912.

[0085] In S98, CPU41a determines whether the value is changing at a predetermined interval. If it is not changing at a predetermined interval, it proceeds to S99; otherwise, it proceeds to S910. In S910, CPU41a determines whether the changing value is monotonically increasing or decreasing. If it is monotonically increasing or decreasing, it proceeds to S911; otherwise, it proceeds to S99.

[0086] In S99, CPU41a classifies the device as an analog device (1305) and terminates processing. There are various types of analog devices, and each type is handled individually according to the type of device being classified. On the other hand, in S911, CPU41a classifies the device as a monotonically increasing or monotonically decreasing device (1306) and terminates processing. Also, in S912, CPU41a classifies the device as another type of device and terminates processing. When a device is determined to be another type of device, the characteristics of the time-series data of the device being classified cannot be extracted, and the characteristic operation of normal devices cannot be identified, so this classification is not used when identifying abnormal devices.

[0087] <Result Display Flow> Figure 15 shows the details of the result display flow by the analysis unit 4a in S7 described above. The processes described below are described as processes executed by the CPU 41a of the analysis unit (expansion unit) 4a. However, there is no intention to limit the present invention, and some of these processes may be executed by other units, all of these processes may be executed by a single unit, or they may be executed by an external device (analytical device) that is communicatively connected to the programmable logic controller.

[0088] First, in S71, the CPU 41a of the analysis unit 4a determines whether or not it has received a request for an analysis report. Requests for analysis reports include requests received by the operator via PC2a and PC2b, requests for periodic analysis report generation timing, and requests for analysis reports to be created when an error occurs. PLC1 may create an analysis report without a request from the operator if a device in an unusual state is detected, or it may only create an analysis report after a request from the operator. These controls can be switched in the settings. If a request for an analysis report has been received, the process proceeds to S72.

[0089] In S72, the CPU 41a acquires the analysis results 77 stored in the operation record storage unit 37 of the basic unit 3. Subsequently, in S73, the CPU 41a generates an analysis report that can be displayed on a web browser of a web client such as PC 2a or PC 2b, according to the acquired analysis results. The generated analysis report becomes screen information for displaying the results display screen 800 described above using Figure 8A. Synchronization information for displaying each analysis result in a synchronized manner is also added. Specifically, in addition to the screen information to be displayed in the detection map 810, detection list 820, image display area 830, and analysis comment 840, information indicating the display position of each analysis result is included. The information indicating the display position may be timing information of the defined control cycle, as described above, or it may simply be time information. In other words, it may be any information that can be synchronized. The CPU 41a also generates an analysis comment 840 and embeds it in the analysis report. The flow of generating the analysis comment will be described later using Figures 17 and 18.

[0090] Next, in S74, CPU41a sends the analysis report generated in S73 to the requesting PC2. The information sent here may include HTML data, CSS data, and JavaScript® code, or it may simply be a notification indicating that the generation of the analysis report is complete. If a notification is sent, CPU41a sends screen information once it receives a display request from PC2. Then, in S75, CPU41a determines whether or not it has received a request from the requesting party to update the analysis report. An update request is, for example, a change in display components, a change in the display target by selecting filters 801 to 803, or an update in the temporal display position of the analysis results by manipulating the time bar 811, etc. Note that the update of the display content by manipulating the time bar 811, etc., may be controlled only on the PC2 side. In this case, in addition to the information of the display component that is the target of the display, it is also necessary to provide PC2 with information about the analysis results of the device displayed on that display component. If an update request is received, the process proceeds to S76; otherwise, it proceeds to S77.

[0091] In S76, CPU41a updates the analysis report according to the instructions of the update request, returns to S74, and sends the updated analysis report to the requester. Meanwhile, in S77, CPU41a determines whether or not it has received a termination instruction to stop displaying the analysis report. If it has not received a termination instruction, it returns to S75; if it determines that it has received a termination instruction, it terminates the process.

[0092] Figure 16 shows the details of the result display flow on PC2b in S7 described above. The processes described below are described as processes executed by the CPU 11b of PC2b. However, there is no intention to limit the present invention, and some of these processes may be executed by a PLC unit, or by other external devices (such as PC2a) that are communicably connected to the programmable logic controller. If executed by a PLC unit, a monitor is provided in that unit. Furthermore, the process described here is the process of displaying the analysis report generated by the analysis unit 4a as a browser.

[0093] In S81, the CPU 11b determines whether it has received a request to display the analysis report via the operation unit 8b. If it has received the request, it proceeds to S82. In S82, the CPU 11b requests the analysis report from the analysis unit 4a. Then, in S83, the CPU 11b determines whether it has received a response (analysis report) from the analysis unit 4a corresponding to the request. The information received here may be a URL (IP address) for displaying the analysis report, or it may be information about the analysis report itself. The following process will be explained assuming that a URL has been received.

[0094] Upon receiving a response, in S84, CPU11b specifies the web browser 18 and displays the analysis report. Next, in S85, CPU11b determines whether or not it has received an update request to update the display of the analysis report. If it has received an update request, it proceeds to S86; otherwise, it proceeds to S87. In S86, if an update request has been received, CPU11b sends the update request to the analysis unit 4a, which is the web server, and returns processing to S83. On the other hand, if it is not an update request, in S87, CPU11b determines whether or not it has received a termination instruction to end the display of the analysis report. If it determines that a termination instruction has not been received, it returns processing to S85; if it determines that a termination instruction has been received, it terminates processing.

[0095] <Analysis Comment Generation Flow (Natural Language Representation)> Figure 17 shows the flow of generating analysis comments in natural language. The process described here is part of the process in S73 above that generates the analysis report (the process related to generating analysis comments). The process described below is described as being executed by the CPU 41a of the analysis unit (expansion unit) 4a. However, there is no intention to limit the present invention, and some of these processes may be executed by other units, or all of these processes may be executed by a single unit, or they may be executed by an external device (analysis device) that is communicatively connected to the programmable logic controller.

[0096] First, in S731, the CPU 41a of the analysis unit 4a acquires the analysis results obtained in S72. The acquired analysis results 1700, as shown in Figure 17, contain information on the type of anomaly for each device, as well as more detailed information, device name, device comment, etc. Here, a device comment refers to a comment entered by the operator for a specific device on the user program editing screen, etc. Operators do not add comments to all devices, but usually only to the devices they use. Therefore, device comments are useful information for the operator. The types of anomalies include patterns where a device that remained unchanged changed, as shown in 1701; patterns where the number of ON / OFF changes is abnormal, as shown in 1702; and patterns where the ON / OFF time is abnormal, as shown in 1703. For each anomaly, detailed information is included, for example, the change patterns and time intervals, number of changes, threshold, and detailed information for normal and abnormal conditions. In other words, detailed information corresponds to the analysis parameters mentioned above.

[0097] Next, in S732, the CPU 41a selects and retrieves a pre-held message format from memory 42a according to the abnormality of each device. The pre-held message formats are shown in 1720. Message format 1720 defines the format for generating natural language analysis comments for each type of abnormality. The CPU 41a selects the appropriate message format according to the abnormality of the device. 1704 defines message format 1705 for patterns where an unchanging device has changed. 1706 defines message format 1707 for patterns where the number of ON / OFF changes is abnormal. 1708 defines message format 1709 for patterns where the ON / OFF time is abnormal.

[0098] Next, in S733, CPU41a selects and embeds numerical values ​​or natural language corresponding to the abnormality content (analysis results) of each device into the selected message format. More specifically, values ​​or natural language corresponding to the abnormality content (analysis results) of each device are embedded in the "{}" shown in message formats 1705, 1707, and 1709. Furthermore, in S734, CPU41a generates an analysis report that includes the generated analysis comments in addition to other analysis results, such as the detection map 810, the detection list 820, and the image display area 830, and then terminates processing.

[0099] <Analysis Comment Generation Flow (Graphical Representation)> Figure 18 shows the flow of generating analysis comments using diagrams. The process described here is part of the process in S73 above that generates the analysis report (the process related to generating analysis comments). The process described below is described as being executed by the CPU 41a of the analysis unit (expansion unit) 4a. However, there is no intention to limit the present invention, and some of these processes may be executed by other units, or all of these processes may be executed by a single unit, or they may be executed by an external device (analysis device) that is communicatively connected to the programmable logic controller.

[0100] First, in S736, the CPU 41a of the analysis unit 4a acquires the analysis results obtained in S72. The acquired analysis results 1800, as shown in Figure 18, contain information on the type of anomaly for each device, as well as more detailed information, device name, device comment, etc. The types of anomalies include patterns where the number of ON / OFF changes is abnormal, as shown in 1801, and patterns where the ON / OFF time is abnormal, as shown in 1802. Of course, other anomaly patterns may also be included. For each anomaly, detailed information is included, for example, the change patterns and time intervals during normal and abnormal states, the number of changes, thresholds, and other detailed information. In other words, detailed information corresponds to the analysis parameters mentioned above.

[0101] Next, in S737, CPU41a selects and retrieves a pre-held graphic format from memory42a according to the abnormality of each device. The pre-held graphic formats are shown in 1820. Graphic format 1820 defines the format for generating analytical comments using graphics for each type of abnormality. CPU41a selects the appropriate graphic format according to the abnormality of the device. 1803 defines graphic formats 1804 to 1808 for patterns where the number of ON / OFF changes is abnormal. 1809 defines graphic formats 1810 to 1816 for patterns where the ON / OFF time is abnormal.

[0102] Next, in S738, CPU41a selects and embeds shapes (including some text and numerical values) corresponding to the abnormality content (analysis results) of each device into the selected shape format. More specifically, shapes corresponding to the abnormality content (analysis results) of each device are embedded in the "?" areas shown in shape formats 1804-1808 and 1810-1816. Furthermore, in S739, CPU41a generates an analysis report that includes the generated analysis comments in addition to other analysis results, such as the detection map 810, detection list 820, and image display area 830, and then terminates processing.

[0103] Furthermore, as shown in analysis comment 840, the expression of abnormal content using natural language and the expression of abnormal content using graphics may be included simultaneously. In this case, this can be achieved by executing the flowcharts in Figure 17 and Figure 18 above, or by executing a flowchart that combines the two flowcharts.

[0104] <Cycle Settings> Figure 19 shows a setting screen 1900 that defines a cycle. The setting screen 1900 is a screen that is displayed on the display unit 7a of PC2a when a predetermined operation is performed from the UI 100 that is displayed on the display unit 7a of PC2a. As shown in Figure 19, it may be displayed superimposed on the program editor displayed on the UI 100, or it may be displayed as a screen to which the user transitions from the program editor displayed on the UI 100. The setting screen 1900 may also be displayed on the web browser 18 on PC2b.

[0105] The settings screen 1900 includes setting areas 1901 and 1902 for specifying the application and application name when performing operation record analysis. These setting areas 1901 and 1902 are for setting the analysis target. Figure 19 shows the default settings, and the operator does not need to make any specific settings. Furthermore, the settings screen 1900 has a basic settings area where the control cycle can be specified. 1903 sets the method for specifying the control cycle, 1904 sets the cycle name, 1905 sets the start trigger, and 1906 sets the end trigger. Also, by default, no control cycle is specified, and only the add button 1907 is displayed.

[0106] The example shown in Figure 19 shows a state where control cycles No. 0, 1, and 2 have already been specified. According to this embodiment, one or more control cycles can be specified as the control cycles to be analyzed. Therefore, if the operator wants to analyze a wide range of data, they can specify multiple control cycles to obtain a more accurate analysis report. The specification method 1903 allows selection between a start / end specification, which specifies the start timing and end timing of the control cycle, and a start specification, which specifies only the start timing. Therefore, the end trigger 1906 can only specify the end timing if the start / end specification is selected. Here, the devices to which each cycle definition belongs and the device groups are not set. Therefore, the analysis unit 4a, etc., will identify the devices corresponding to the defined control cycles and perform the analysis. Since multiple control cycles can be specified, it is possible that one device may correspond to multiple control cycles. In this case, the priority of the device to be analyzed may be set higher. If the priority is high, it may be displayed preferentially in the analysis report. Alternatively, it may be possible to set specific devices to be linked to each cycle definition.

[0107] The settings screen 1900 further includes a settings save button 1911, a settings load button 1912, an OK button 1913, and a cancel button 1914. The settings save button 1911 is for saving the settings made on the settings screen 1900. The settings load button 1912 is for loading a settings file that is pre-stored in the project storage unit 35 of the memory 32 of the basic unit 3. One or more control cycles are pre-specified in this settings file. It is also possible to add further control cycles after loading the settings file. The OK button 1913 is for activating the settings made on the settings screen 1900 and ending the settings process. The cancel button 1914 is for ending the settings process without applying the settings made on the settings screen 1900.

[0108] <Cycle not set> Figure 20 shows the detection map 810 for an analysis report with no cycle set. While analysis unit 4a can perform analysis even without a cycle set, the number of analyzable devices is extremely limited. Specifically, it is limited to devices without a cycle pattern. Devices without a cycle pattern are, for example, devices whose device values ​​are fixed and do not change. For instance, as shown in 2001 in Figure 20, devices that are always ON or always OFF can be analyzed even without a cycle set. On the other hand, devices with a predetermined cycle pattern cannot be analyzed if the cycle is not set. Thus, because the number of analyzable devices is limited, although analysis itself is possible even without a cycle set, the effectiveness of the analysis results is limited. Therefore, as shown in Figure 20, the analysis report may display a message 2002 indicating that the cycle is not set and prompting the operator to set the cycle. When "Set cycle and analyze" is selected, a cycle setting pop-up screen is displayed, allowing the operator to set the cycle.

[0109] <Model Confidence> Figure 21 illustrates model confidence. Here, we will explain in detail the model confidence shown at 1030 in Figure 10. The confidence of a generated model changes depending on the amount of data handled during generation. Therefore, the analysis unit 4a measures the confidence of the model during generation and adds it to the model as attribute information. Figure 21 shows how model generation and analysis are performed when 10 cycles of operation record data are acquired. For example, even if 10 cycles of operation record data are acquired, the data may be sufficient for model generation for simple devices, but it may be insufficient for asynchronous devices, etc. Therefore, it is difficult to estimate the confidence of the generated model based on the number of cycles alone. If the confidence of the model can be measured and presented, operators can judge whether a good model has been created during training, and they can judge whether the detected content is reliable when anomaly detection occurs.

[0110] Figures 2101-2103 show the training process, where normal data is trained one cycle at a time, followed by additional training, and then the data from the next cycle is analyzed. Figure 2101 shows the result of generating a model using 7 cycles and analyzing the 8th cycle. Figure 2102 shows the result of generating a model using 8 cycles and analyzing the 9th cycle. Figure 2103 shows the result of generating a model using 9 cycles and analyzing the 10th cycle. In the example shown in Figure 21, for example, the number of anomalies detected in each generated model is 8 for 2101, 3 for 2102, and 5 for 2103. Ideally, the number of detections should be 0 because the data is normal. However, if the amount of normal data is insufficient, the number will not be 0. These number of detected anomalies can be presented directly to the operator as the confidence score, or the number of detections can be normalized to the confidence score before being presented. For example, if the number of detections is 0, the confidence level may be set to the highest value of "3," if the number of detections is between 1 and 10, the confidence level may be set to "2," if the number of detections is between 11 and 20, the confidence level may be set to "1," and if the number of detections is 21 or more, the confidence level may be set to "0." For example, as shown in Figure 21, the confidence level may be obtained using the measurement value with the highest number of detections for 2101. At the point when learning is completed, the completion of learning and the confidence level of the generated model may be presented, and the operator may be given the option to perform further learning. Alternatively, learning may be repeated until a predetermined confidence level is reached.

[0111] <Variation> The present invention is not limited to the embodiments described above and can be modified in various ways. Various modifications will be described below with reference to the drawings.

[0112] <Variations in system configuration> Figure 22 shows a modified PLC system configuration. In the above embodiment, an example was described in which the PLC system consists of a PLC1 comprising a basic unit 3, an analysis unit 4a, and an expansion unit 4b such as a camera unit, a PC2a connected to the basic unit 3, and a PC2b connected to the analysis unit 4a for displaying analysis reports. However, these configurations are just examples, and the collection of operation record data, model generation, analysis, and display of analysis results described above may be performed by any device or unit, or may be implemented by other external devices or other expansion units. Here, we will describe modified configurations of such a system.

[0113] For example, as shown in Figure 22, the functions of the analysis unit 4a according to the above embodiment may be implemented by an analysis device (functioning as a data processing device) 2c located in a higher layer of the PLC1. Processing during the model learning phase, for example, is very computationally intensive and requires a significant processing time, so it may be possible to implement it externally depending on the processing capacity of the PLC unit. Furthermore, by providing analysis functions in a higher-layer device, it becomes possible to collect information from other PLCs as well, enabling the generation of more reliable models. The analysis device 2c has functions such as analysis of PLC-specific information, model generation, analysis, and creation of analysis reports. Since these functions involve the same processing as the analysis unit 4a, a detailed explanation is omitted.

[0114] Furthermore, in the above embodiment, the basic unit 3 collected the operation record data of all devices, but this may be done by other expansion units. For example, as shown in Figure 22, a recorder unit 4c may be provided as an expansion unit. The recorder unit 4c comprises a CPU 41c, a memory 42c, and a communication unit 43c. The memory 42c is provided with a storage area for the ring buffer 44c and the operation record storage unit 45c, which were provided in the basic unit 3 in the above embodiment. The collection of operation records is the same process as in the basic unit 3 of the above embodiment, so a detailed explanation will be omitted.

[0115] Thus, according to the present invention, the apparatus or unit that realizes the processing functions described in the above embodiments can be modified to the extent possible, and the present invention encompasses such modifications. In the above modified example, an example was described in which a recorder unit 4c for collecting operation record data is provided separately from the basic unit 3, but the unit may be equipped with collection and communication functions, and the storage destination may be a database connected via a network. This makes it possible to store a larger amount of data, perform analysis considerably earlier than when the trigger occurred, and also make it possible to use data from other PLC systems.

[0116] Furthermore, while the above modifications described examples where processing functions are implemented in a unit separate from the basic unit 3 or in an external device, it is also possible to integrate these processing functions into the basic unit 3. The advantage of such a configuration is that communication processing with other units or external devices can be omitted, thereby reducing the processing load due to communication and minimizing the impact on PLC control. However, in the case of integration, the performance will depend on the performance of the basic unit 3, so it will be necessary to improve the performance of the basic unit 3.

[0117] <Summary> [Perspective 1] The present invention relates to an analysis device comprising: an execution engine that repeatedly executes a user program; an acquisition means that acquires driving record data including multiple time-series device values ​​collected by the execution of the user program; a model generation means that generates a model including analysis parameters for each device based on learning of the acquired driving record data under normal conditions; an analysis means that analyzes abnormal devices that do not satisfy normal conditions according to the model with respect to the acquired driving record data to be analyzed; and a report generation means that generates an analysis report including an expression corresponding to the analysis parameters based on the analysis results of each device detected as an abnormal device. According to this embodiment, it is possible to provide a report that makes it easy to identify the cause of an abnormality according to the analysis results of the driving record data. Furthermore, it is possible to provide a report that makes it easy to identify the cause of an abnormality without requiring complicated user operations.

[0118] [Perspective 2] In the above embodiment, the representation corresponding to the analysis parameters includes at least one of a natural language representation and a graphic representation that shows the analysis results according to the analysis parameters. According to this embodiment, because the representation of abnormal content is in natural language, which is similar to human conversation, the user has less to learn and can easily analyze the abnormal content without requiring specialized knowledge. On the other hand, the representation of abnormal content using graphics allows for visual understanding, and it is possible to learn details such as what kind of abnormality it was, the timing, and the degree of the abnormality.

[0119] [Perspective 3] In the above embodiment, the natural language expression and the graphic expression each have a predefined format corresponding to the abnormality content, and the report generation means selects the format according to the abnormality content for each device and generates an expression according to the analysis parameters. According to this embodiment, the natural language expression and graphic expression in the analysis comment can be automatically created using a pre-held database, so it can be implemented without requiring complicated operations by the operator.

[0120] [Perspective 4] In the above embodiment, the report generation means generates the natural language expression by selecting and embedding natural language or figures based on the analysis results into a format corresponding to the abnormality. With this embodiment, the same effect as in the above embodiment can be obtained by simple processing such as embedding natural language or figures into a format corresponding to the abnormality.

[0121] [Perspective 5] In the above embodiment, the graphical representation includes, in a comparative manner, the waveform of the device under normal conditions and the waveform detected as abnormal. According to this embodiment, it is possible to compare and confirm the operation under normal conditions with the operation of the device under analysis, making it easier to understand unusual operation.

[0122] [Perspective 6] In the above embodiment, the abnormal location is highlighted in the waveform detected as an abnormal device. According to this embodiment, it is easy to confirm where in the detected waveform the abnormality is occurring.

[0123] [perspective 7] In the above embodiment, the model generation means classifies each device into one of several types representing change patterns based on the multiple device values ​​in the time series for each device, and determines the analysis parameters to be used by the analysis means to detect abnormal devices according to the classified type. According to this embodiment, appropriate analysis can be performed for each type of device change pattern, and more accurate analysis results can be obtained.

[0124] [Perspective 8] In the above embodiment, the analysis parameters include at least one of the device value's ON time, OFF time, rise time, fall time, number of ON cycles, number of OFF cycles, and steady-state value. According to this embodiment, it is possible to analyze various change patterns and obtain more accurate analysis results.

[0125] [Perspective 9] In the above embodiment, the system further includes a transmission means for transmitting screen information of a results display screen showing the contents of the analysis report output from the report generation means to an external device, wherein the results display screen is displayed on the display unit of the external device in an operable manner. According to this embodiment, the analysis report can be transmitted to an external device, allowing the analysis report to be analyzed on, for example, a higher-performance PC, enabling more detailed analysis and the display of a results display screen with a richer operating system.

[0126] [Perspective 10] In the above embodiment, the results display screen further includes a filter setting area where conditions can be specified to narrow down the display items of the analysis report. According to this embodiment, unnecessary display items can be excluded from the results display screen, making it easier to analyze anomalies.

[0127] [Perspective 11] In the above embodiment, the filter setting area can be configured by specifying the device control cycle, specifying attribute information, and specifying events and errors, at least one of these. According to this embodiment, various options can be provided when the operator narrows down the displayed items.

[0128] [Perspective 12] In the above embodiment, the system further includes a display means for displaying the editing screen of the user program, and the editing screen can display the analysis report synchronized with the time axis of the editing screen. According to this embodiment, the analysis report can be displayed in conjunction with the user program, and analysis can be performed taking the user program into account.

[0129] [Perspective 13] In the above embodiment, the system further includes a receiving means for receiving a request to generate the analysis report, and a notification means for notifying the requester that the generation of the analysis report has been completed when the analysis report has been generated in response to the generation request by the report generation means. According to this embodiment, the operator can be notified that the generation of the analysis report has been completed, thereby realizing a more user-friendly operating system.

[0130] [Perspective 14] In the above embodiment, the system further includes setting means for defining one or more control cycles. The model generation means learns the acquired driving record data based on the set definitions of the one or more control cycles, and the report generation means generates an analysis report that displays the analysis results of each device detected as an abnormal device, synchronized on a time axis according to the set definitions of the one or more control cycles. According to this embodiment, the learning phase and estimation phase can be processed according to the control cycle, simplifying the processing and enabling accurate analysis and synchronization.

[0131] [Perspective 15] In the above embodiment, when a control cycle is not defined by the setting means, the analysis means analyzes the operation record data with a device that does not have a control cycle pattern as the target of analysis. According to this embodiment, an analysis report can be easily output without requiring the operator to perform a cycle pattern setting operation. Therefore, the operator can generate an analysis report on a trial basis without setting a cycle pattern, and can also perform analysis methods such as setting a cycle pattern to analyze the generated analysis report in more detail.

[0132] [Perspective 16] In the above embodiment, the report generation means generates an analysis report of the analysis results of a device that does not have a control cycle pattern. The analysis report includes a message indicating that the control cycle has not been set and prompting the user to set the control cycle using the setting means. According to this embodiment, the user can be prompted to set the cycle if they forget to set it, providing a more user-friendly operating system.

[0133] [Perspective 17] The present invention relates to an analysis system in which a data processing device and a programmable logic controller can communicate, comprising: an execution engine that repeatedly executes a user program; acquisition means for acquiring driving record data including multiple time-series device values ​​collected by the execution of the user program; model generation means for generating a model for each device based on learning of the acquired normal driving record data; analysis means for analyzing abnormal devices that do not satisfy normal conditions according to the model, based on the acquired driving record data to be analyzed; and report generation means for generating an analysis report that displays the analysis results of each device detected as an abnormal device in a synchronized manner on a time axis. According to this embodiment, a report can be provided that allows for easy identification of the cause of an abnormality according to the analysis results of the driving record data. Furthermore, a report can be provided that allows for easy identification of the cause of an abnormality without requiring complicated user operations.

[0134] [Perspective 18] In the above embodiment, at least one of the acquisition means, the model generation means, the analysis means, and the report generation means is provided in the data processing device. According to this embodiment, it is possible to flexibly incorporate the configuration for realizing the present invention into appropriate components according to the development cost of the PLC, the performance of the data processing device, etc., thereby improving the degree of freedom in system design.

[0135] [Perspective 19] In the above embodiment, the programmable logic controller is The data processing device comprises a CPU unit equipped with the execution engine and a recorder unit provided in the programmable logic controller that implements the acquisition means, and includes the model generation means, analysis means, and report generation means. According to this embodiment, it is possible to flexibly incorporate the configuration for realizing the present invention into appropriate components according to the development cost of the PLC, the performance of the data processing device, etc., thereby improving the degree of freedom in system design.

[0136] The invention is not limited to the embodiments described above, and various modifications and changes are possible within the scope of the gist of the invention.< / plc>

Claims

1. An analytical device, comprising: an execution engine that repeatedly executes a user program; an acquisition means for acquiring driving record data including a plurality of time-series device values ​​collected by execution of the user program; a model generation means for generating a model including analysis parameters for each device based on learning of the acquired normal driving record data; analysis means for analyzing abnormal devices that do not satisfy normal conditions in accordance with the model for the acquired driving record data to be analyzed; a report generation means for generating an analysis report including expressions according to the analysis parameters based on the analysis results of each device detected as an abnormal device; An analytical device comprising:

2. 2. The analysis device according to claim 1, wherein the expression according to the analysis parameters includes at least one of an expression in natural language and a graphic expression showing the analysis result according to the analysis parameters.

3. a format corresponding to the abnormality content is predefined for each of the natural language expression and the graphic expression; 3. The analysis device according to claim 2, wherein the report generation means selects the format in accordance with the abnormality content of each device and generates a representation in accordance with the analysis parameters.

4. 4. The analysis device according to claim 3, wherein the report generation means generates the natural language expression by selecting and embedding natural language or graphics based on the analysis results in a format corresponding to the abnormality content.

5. 5. The analysis device according to claim 2, wherein the graphical representation includes a waveform of a device in a normal state and a waveform of a device detected as being abnormal, so that they can be compared.

6. The analyzer according to claim 5, wherein an abnormal portion is highlighted in the waveform detected as the abnormal device.

7. The model generation means classifying each device into one of a plurality of types indicating a change pattern based on the plurality of time-series device values ​​of each device; 7. The analysis apparatus according to claim 1, wherein the analysis parameters used when the analysis means detects abnormal devices are determined according to the classified type.

8. The analysis device according to claim 7, wherein the analysis parameters include at least one of device value ON time, OFF time, rising timing, falling timing, number of ON times, number of OFF times, and steady value.

9. a transmitting means for transmitting screen information of a result display screen showing the content of the analysis report output from the report generating means to an external device; 9. The analyzer according to claim 1, wherein the external device displays the result display screen on a display unit in an operable manner.

10. 10. The analysis device according to claim 9, wherein the result display screen further includes a filter setting area in which conditions for narrowing down the display items of the analysis report can be specified.

11. 11. The analyzer according to claim 10, wherein the filter setting area allows a filter to be specified by at least one of specifying a control cycle of a device, specifying attribute information, and specifying an event or an error.

12. further comprising a display means for displaying an editing screen of the user program; 12. The analysis device according to claim 10, wherein the analysis report can be displayed on the editing screen in synchronization with a time axis of the editing screen.

13. a receiving means for receiving a request to generate the analysis report; a notification means for notifying a requester that generation of the analysis report has been completed when the analysis report is generated by the report generation means in response to the generation request; The analytical device according to claim 12, further comprising:

14. further comprising a setting means for setting definitions of one or more control cycles; the model generation means performs learning of the acquired driving record data based on the definition of the one or more set control cycles; The analysis device according to any one of claims 1 to 13, characterized in that the report generation means generates an analysis report that displays the analysis results of each device detected as the abnormal device in synchronization on a time axis in accordance with the definition of the one or more set control cycles.

15. The analysis device according to claim 14, characterized in that, when a control cycle is not defined by the setting means, the analysis means analyzes the driving record data by analyzing devices that do not have a cycle pattern of the control cycle.

16. the report generation means generates an analysis report of an analysis result of a device that does not have a cycle pattern of a control cycle; 16. The analyzer according to claim 15, wherein the analysis report includes a message indicating that a control cycle has not been set and prompting the user to set a control cycle using the setting means.

17. An analytical system in communication with a data processing device and a programmable logic controller, an execution engine that repeatedly executes a user program; an acquisition means for acquiring driving record data including a plurality of time-series device values ​​collected by execution of the user program; a model generation means for generating a model for each device based on learning of the acquired normal driving record data; analysis means for analyzing abnormal devices that do not satisfy normal conditions in accordance with the model for the acquired driving record data to be analyzed; a report generation means for generating an analysis report that displays the analysis results of each device detected as an abnormal device in synchronization on a time axis; An analysis system comprising:

18. 18. The analysis system of claim 17, wherein at least one of the acquisition means, the model generation means, the analysis means, and the report generation means is provided in the data processing device.

19. The programmable logic controller a CPU unit including the execution engine; a recorder unit provided in the programmable logic controller that realizes the acquisition means; Equipped with The data processing device includes:

18. The analysis system of claim 17, comprising the model generation means, the analysis means, and the report generation means.

20. 1. A method for controlling a system in which a data processing device and a programmable logic controller can communicate, comprising: repeatedly executing a user program; an acquisition step of acquiring driving record data including a plurality of time-series device values ​​collected by execution of the user program; a model generation step of generating a model for each device based on learning of the acquired normal driving record data; an analysis step of analyzing the acquired driving record data to be analyzed for abnormal devices that do not satisfy normal conditions according to the model; a report generation step of generating an analysis report that displays the analysis results of each device detected as an abnormal device in synchronization on a time axis; A method for controlling a system, comprising:

Images