Information processing device, information processing method, and program

Abstract

To provide a technique capable of performing abnormality analysis and / or recovery more quickly when an abnormality occurs in a control system connected in an industrial network.SOLUTION: There is provided an information processing device connected to a master and one or more slaves via an industrial network. The information processing device includes: a reception unit that receives frames repeatedly transmitted from the master within the industrial network; a first storage unit that stores log data of the frames; an extraction unit that, when the occurrence of an abnormality is detected in the master or the one or more slaves, extracts, from the first storage unit, the log data of the frames from when the occurrence of the abnormality was detected to a predetermined time before the detection; a second storage unit that stores the extracted log data of the frames as pre-failure log data; and a transmission unit that transmits the pre-failure log data to the master via the industrial network in response to a request from the master.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] This disclosure relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] In fields such as robotics and factory automation (FA), it is necessary to operate things like conveyor belts and arms exactly as intended. To achieve such movements, it is necessary to operate multiple controlled devices, such as servo motors and stepping motors, in high-precision synchronization. For example, Patent Document 1 discloses a motion control command system that can achieve smooth control while utilizing inexpensive and simple low-speed communication. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2010-170435 [Overview of the Initiative] [Problems that the invention aims to solve]

[0004] In a control system that includes a controller and controlled devices, the network connecting the controller and controlled devices is called an industrial network. If an abnormality occurs in the operation of a control system connected via an industrial network, it is desirable to investigate the cause of the abnormality and to restore it smoothly based on the investigation results.

[0005] Therefore, the purpose of this disclosure is to provide a technology that enables faster anomaly analysis and / or recovery when an anomaly occurs in a control system connected by an industrial network. [Means for solving the problem]

[0006] An information processing device according to one aspect of the present disclosure is an information processing device connected to a master and one or more slaves via an industrial network, and includes: a receiving unit that receives frames repeatedly transmitted from the master within the industrial network; a first storage unit that stores frame log data; an extraction unit that, when an abnormality is detected in the master or one or more slaves, extracts frame log data from the first storage unit from the time the abnormality was detected up to a predetermined time prior; a second storage unit that stores the extracted frame log data as pre-failure log data; and a transmission unit that, in response to a request from the master, transmits the pre-failure log data to the master via the industrial network. [Effects of the Invention]

[0007] This disclosure provides a technology that enables faster anomaly analysis and / or recovery when an anomaly occurs in a control system connected via an industrial network. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of the control system 1 according to this embodiment. [Figure 2] This figure shows an example of a frame structure used in industrial networks. [Figure 3] This is a diagram to explain the time synchronization process. [Figure 4] This diagram shows an example of a slave configuration. [Figure 5] This figure shows an example of the hardware configuration of a monitoring device. [Figure 6] This figure shows an example of the functional block configuration of a monitoring device. [Figure 7] This diagram shows the state when the synchronization process is working correctly. [Figure 8] This diagram illustrates what happens when a malfunction occurs in the master and frames can no longer be transmitted at equal intervals. [Figure 9]This is a diagram for explaining an event that occurs when an abnormality occurs in the local clock of the synchronous master-slave and a deviation occurs in the reference time. [Figure 10] This is a diagram for explaining an event that occurs when an abnormality occurs in the local clock of the monitoring device. [Figure 11] This is a diagram showing the relationship between combinations of synchronization processing abnormalities and the causes of synchronization processing abnormalities. [Figure 12] This is a flowchart showing an example of a processing procedure for detecting a synchronization processing abnormality. [Figure 13] This is a diagram showing a specific example of a synchronization abnormality detection process. [Figure 14] This is a diagram for explaining a modification example. [Figure 15] This is a diagram for explaining a modification example. [Figure 16] This is a sequence diagram showing an example of a processing procedure when extracting log data and transmitting it to the master when an abnormality occurs. [Figure 17] This is a diagram showing an example of the data of a frame stored in pre-failure log data.

Embodiments for Carrying Out the Invention

[0009] Embodiments of the present disclosure will be described with reference to the accompanying drawings. In each figure, those with the same reference numerals have the same or similar configurations.

[0010] <System Configuration> FIG. 1 is a diagram showing an example of a control system 1 according to the present embodiment. The control system 1 includes a master 10, one or more slaves 20, and a monitoring device 30. The master 10, one or more slaves 20, and the monitoring device 30 are connected via an industrial network.

[0011] Master 10 is a device that realizes predetermined functions in the control system 1 by controlling the slave 20. Master 10 may be, for example, a motion controller, a sequence controller, a robot controller, etc. Master 10 may also be called a controller and control device, etc. Master 10 may be a device realized using dedicated hardware, or it may be a general-purpose information processing device with a non-real-time OS and a real-time OS installed. Specific examples of non-real-time OSs include, for example, Windows® and macOS®. Specific examples of real-time OSs include, for example, RTX (Real Time Extension) and RTH (Real Time Hypervisor). Specific examples of general-purpose information processing devices include, for example, a PC (personal computer), a notebook PC, a server, etc.

[0012] The slave 20 is, for example, a servo motor (including a servo driver), a stepping motor, a sensor, etc., and is a device that performs various processes in the control system 1. Each slave is divided into a communication processing unit that processes communication protocols used in industrial networks and an application unit that performs processes such as motion control.

[0013] The monitoring device 30 is a device that monitors the operating status of the control system 1, continuously recording frames (which may also be called data or packets) flowing through the industrial network, and detecting when an abnormality occurs in the control system 1. The monitoring device 30 also operates as a slave 20 in the control system 1. In other words, the monitoring device 30 is recognized as a slave 20 by the master 10. The monitoring device 30 may be a device implemented using dedicated hardware, or it may be a general-purpose information processing device or computer with a non-real-time OS and a real-time OS installed.

[0014] Protocols used in industrial networks include, for example, EtherCAT (registered trademark) and Ethernet / IP (EtherNet / IP). In the following description, the industrial network will be described as EtherCAT, but this embodiment is not limited to this. Any communication protocol that communicates in a master-slave manner and has the synchronization function described later may be used.

[0015] In industrial networks, the master 10 and slaves 20 (including the monitoring device 30) communicate using an on-the-fly method. In the on-the-fly method, a fixed-length frame transmitted from the master 10 passes through each slave 20 in sequence and finally returns to the master 10. Each slave 20 can also read data addressed to itself from the frame as it passes through, and write data addressed to the master 10 or another slave 20 to the frame. In the example in Figure 1, the frame transmitted from the master 10 passes through each slave 20 and the monitoring device 30 in the order of S1 to S6 and returns to the master 10. Each slave 20 processes the frame when it first passes through the monitoring device 30, and does not process the frame when it returns from the monitoring device 30 to the master 10. For example, slave 20-1 processes the frame received in S1 (writing and / or reading data), but forwards the frame received in S5 directly to the master 10 without processing it. Similarly, slave 20-2 processes the frames received by S2 (writing and / or reading data), but forwards the frames received by S4 directly to slave 20-1 without processing them.

[0016] In this embodiment, the monitoring device 30 is connected after all slaves 20 in the industrial network to detect abnormalities occurring in the master 10 and slaves 20. In other words, the monitoring device 30 operates as the terminating slave 20. For example, suppose that the control system 1 has slaves 20-1 and 20-2. In this case, the monitoring device 30 is connected to the industrial network so that frames output from the master 10 pass through slave 20-1, slave 20-2, and then the monitoring device 30.

[0017] (Frame structure used in industrial networks) Figure 2 shows an example of the structure of a frame used in industrial networks. One frame includes an Ethernet header, Ethernet data, and a Frame Check Sequence (FCS). Ethernet data includes a header and a datagram.

[0018] A datagram is further divided into N datagram regions. Each datagram region contains a datagram header, data, and a working counter (WKC). The datagram header stores a command indicating how to process the data (e.g., writing a value, reading a value) and an address indicating the destination for processing the data.

[0019] In an industrial network, different datagrams are used when sending data from master 10 to slave 20 and when sending data from slave 20 to master 10. In other words, at least two datagrams are assigned to each slave 20 that sends and receives data to and from master 10.

[0020] In this scenario, for master 10 to write a value to or read a value from the memory (also called a register) of slave 20, master 10 must specify the address of the memory to which the value to be written or read is to be performed. In industrial networks, there are two ways to specify a memory address.

[0021] The first method involves directly specifying the physical address of the memory by combining an identifier that identifies the slave 20 (called the "configuration address" in EtherCat) with the address of the memory that the slave 20 possesses (meaning the actual address, called the "register address" in EtherCat). Alternatively, when writing or reading values ​​to or from the memory of the slave 20, an index and sub-index can be used instead of the register address. The index and sub-index are associated with the content of the data stored in memory, and by specifying the index and sub-index, values ​​can be written and read without being aware of the actual address. The correspondence between the index and sub-index and the memory address is predefined within the slave 20.

[0022] The second method involves treating the memory spaces of all slaves 20 present in the control system 1 as a single memory space, and representing the location within that memory space with a single logical address. Data indicating the correspondence between the logical address and the memory address (actual address) of each slave 20 is pre-configured in each slave 20. By using logical addresses, the master 10 can write and read data without being aware of which slave 20 it is accessing.

[0023] Master 10 performs operations such as writing values ​​to memory and reading values ​​from memory by specifying a memory address and a command. Examples of commands include FPWR (writing data to slave 20 and its physical address), FPRD (reading data to slave 20 and its physical address), LWR (writing data to a logical address), and LRD (reading data to a logical address).

[0024] (Overview of synchronization process) Figure 3 is a diagram illustrating the overview of the synchronization process. The industrial network is equipped with a mechanism for performing high-precision time synchronization (for example, a time synchronization deviation of less than 1 microsecond) between each slave 20. In the case of Ethercat, this synchronization process is called DC (Distributed Clocks) synchronization. When the synchronization process is executed, each slave 20 is synchronized to a predetermined reference time (hereinafter referred to as the "reference time"), and each slave 20 performs various processes according to the reference time. Note that the accuracy of the clock provided by the master 10 is often lower than the accuracy of the clock provided by the slave 20 in order to reduce costs. Therefore, in the synchronization process, the local clock held by the slave 20 capable of performing the synchronization process among the slaves 20 connected in series to the industrial network may be used as the reference time. In the following description, the slave 20 in which the local clock is used as the reference time will be referred to as the "synchronous master slave". In this embodiment, the synchronous master slave will be described as the first slave 20 capable of performing the synchronization process among the slaves 20 connected in series to the industrial network (slave 20-1 in the example of Figure 1). Furthermore, the reference time is called the Reference Clock in EtherCAT. Note that if Master 10 maintains a clock with the same high precision as Slave 20, Master 10's local clock may be used as the reference time.

[0025] The reference time is expressed as an absolute time with a starting point (zero). The reference time may also be expressed as a value of a predetermined number of bits. For example, in Ethercat, it is expressed as a 32-bit or 64-bit number with January 1, 2001, 00:00:00 as the starting point. The smallest unit of the reference time may also be 1 microsecond or 1 nanosecond.

[0026] Master 10, in order to achieve synchronization, pre-measures the frame propagation delay between the synchronous master-slave and each slave 20, as well as the difference (offset value) between the reference time and the local clock of each slave, in accordance with the EtherCAT specification, and writes this information to the memory of each slave 20. Each slave 20 other than the synchronous master-slave can calculate the reference time by adding the offset value to its own local clock.

[0027] Generally, there is a slight deviation (also called drift) in the time recorded by a clock, so if a long time has passed since synchronization was completed, the deviation from the reference time will also increase. Therefore, in order to suppress the deviation from the reference time (that is, to compensate for clock drift), master 10 periodically distributes the reference time.

[0028] Specifically, the synchronous master-slave, following instructions from the master 10, stores the reference time in the frame received from the master 10 and transmits the frame containing the reference time to the next slave 20. Each slave 20 retrieves the reference time from the received frame containing the reference time and writes the retrieved reference time frame to its own memory. In the following explanation, the frame used to distribute the reference time to each slave 20 is referred to as the "reference time frame". Note that all frames repeatedly transmitted from the master 10 may be reference time frames. Alternatively, there may be one reference time frame every N frames (where N is a natural number) of all frames repeatedly transmitted from the master 10. In the example in Figure 3, all frames are reference time frames, and the synchronous master-slave 20-1 is shown storing the reference time in frames A and B received from the master 10 and transmitting them to slave 20-2.

[0029] Each slave 20 other than the synchronous master-slave obtains the reference time from the received reference time frame. As described above, each slave 20 is aware of the propagation delay between itself and the synchronous master-slave, and can recognize the correct reference time by adding the propagation delay to the reference time included in the reference time frame. In other words, each slave 20 other than the synchronous master-slave can correct the reference time it recognizes to the correct reference time based on the reference time included in the reference time frame.

[0030] As described above, the synchronous master-slave stores the time of its own local clock as the reference time in the frame received from the master 10 and transmits it to the next slave 20. The value of the local clock that the synchronous master-slave stores as the reference time only needs to be the time between when the synchronous master-slave receives the frame and when it transmits the frame containing the reference time to the next slave 20.

[0031] Figure 4 shows an example of a slave configuration. The communication processing unit 20b in each slave refers to the reference time, propagation delay, offset, etc., written in the memory 20a of the communication processing unit and synchronizes with the reference time. Subsequently, each slave repeatedly generates a synchronization signal at a predetermined period according to the synchronized reference time and notifies the application unit 20c in each slave. In EtherCAT, the synchronization signal is called SYNC0 / SYNC1, etc. The time at which the synchronization signal is repeatedly generated (hereinafter referred to as the "synchronization signal start time") and the generation period of the synchronization signal (hereinafter referred to as the "synchronization signal period") are notified in advance from the master 10 to each slave 20. The synchronization signal start time is specified in absolute time according to the time axis of the reference time.

[0032] When synchronization is used, the master 10 repeatedly transmits frames at the same frequency as the generation period of the synchronization signals, so that one frame arrives at each slave 20 between two consecutive synchronization signals. However, as mentioned above, the accuracy of the clock in the master 10 is often lower than the accuracy of the clock in the slave 20. Therefore, the period at which frames arrive at each slave 20 may vary somewhat compared to the period at which the synchronization signals are generated at each slave 20.

[0033] The frames that the master 10 repeatedly transmits at predetermined intervals include a data storage area in addition to the reference time mentioned above. This area stores, for example, a command and value to write to the memory of each slave 20, and / or a command to read a value from the memory 20a of each slave 20. The communication processing unit 20b of the slave 20 reads a value from the received frame according to the command and writes it to the memory 20a. The application unit 20c of the slave 20 performs application processing (e.g., motion control) using the value written to the memory 20a when it receives a synchronization signal from the communication function unit. In other words, as long as the time synchronization function is working correctly and the master 10 continues to transmit frames at predetermined intervals, the timing at which the synchronization signal is generated in each slave 20 will coincide among the slaves 20, and the timing at which each slave 20 performs application processing will also coincide.

[0034] For example, as shown in Figure 3, the arrival time of frames will be delayed for slave 20-2 due to the transmission delay between synchronous master-slave 20-1 and slave 20-2. However, since application processing (AP processing) is triggered by the synchronization signal, the timing at which application processing starts on synchronous master-slave 20-1 and the timing at which application processing starts on slave 20-2 will coincide.

[0035] (Overview of the processes performed by the monitoring device) In this embodiment, the monitoring device 30 performs the following processing.

[0036] 1. Detection of synchronization processing abnormalities: The monitoring device 30 detects that an abnormality has occurred in the synchronization process and notifies the user or master 10 that manages the control system 1.

[0037] 2. Frame recording immediately before an anomaly occurs: The monitoring device 30 continuously records (captures) frames flowing through the industrial network and saves log data of one or more captured frames. Furthermore, if the control system 1 detects that an anomaly has occurred, it extracts log data of one or more frames that flowed through the industrial network during a predetermined period prior to the anomaly from the saved log data. In addition, if requested by the master 10, the monitoring device 30 transmits the extracted log data of one or more frames to the master 10 via the industrial network.

[0038] <Hardware Configuration> Figure 5 shows an example of the hardware configuration of the monitoring device 30. The monitoring device 30 has a processor 11 such as a CPU (Central Processing Unit) or GPU (Graphical Processing Unit), a storage device 12 such as memory (e.g., RAM (Random Access Memory) or ROM (Read Only Memory)), an HDD (Hard Disk Drive) and / or SSD (Solid State Drive), a network interface 13 for wired or wireless communication, an input device 14 for receiving input operations, and an output device 15 for outputting information. The input device 14 is, for example, a keyboard, touch panel, mouse and / or microphone. The output device 15 is, for example, a display, touch panel and / or speaker.

[0039] <Functional Block Configuration> Figure 6 shows an example of the functional block configuration of the monitoring device 30. The monitoring device 30 has a non-real-time OS 100, a real-time OS 200, and a second storage unit 300. The non-real-time OS 100 includes a display unit 110, a data collection unit 120, a first detection unit 130, an extraction unit 140, and a first storage unit 150. The real-time OS 200 includes a slave processing unit 210. The slave processing unit 210 includes a communication module 220 and a fixed-period processing unit 230. The communication module 220 includes a third storage unit 221, and the fixed-period processing unit 230 includes a second detection unit 231.

[0040] The first storage unit 150, the second storage unit 300, and the third storage unit 221 can be implemented using the storage device 12 provided by the monitoring device 30. Furthermore, the display unit 110, the collection unit 120, the first detection unit 130, the extraction unit 140, and the slave processing unit 210 can be implemented by the processor 11 of the monitoring device 30 executing a program stored in the storage device 12. This program can be stored in a storage medium. The storage medium containing the program may be a non-transitory computer-readable medium. The non-transitory storage medium is not particularly limited, but may be, for example, a USB (Universal Serial Bus) memory or a CD-ROM (Compact Disc Read-Only Memory).

[0041] The first storage unit 150 is provided in the non-real-time OS and stores a log storage DB (DataBase) 151 and a configuration file 152. The log storage DB 151 is a database that stores frames flowing through the industrial network captured by the communication module 220 of the real-time OS 200. The configuration file 152 stores various data that define the operation of the monitoring device 30.

[0042] The second memory unit 300 is located in memory accessible from both the non-real-time OS 100 and the real-time OS.

[0043] The display unit 110 operates on a non-real-time OS and displays various screens on a display or the like. For example, the display unit 110 displays a screen on a display or the like that shows the details of the detected anomaly.

[0044] The data collection unit 120 operates on a non-real-time OS and acquires frames flowing through the industrial network from the real-time OS 200 via a FIFO (First In First Out) queue 310 contained in the second storage unit 300, and stores them in the log storage DB 151 of the first storage unit 150. In other words, the first storage unit 150 (log storage DB 151) stores log data for one or more received frames.

[0045] The first detection unit 130 operates on a non-real-time OS and analyzes frames received by the communication module 220 to detect whether or not there are any abnormalities in the synchronization process performed between the master 10 and one or more slaves 20, which is executed based on a reference time distributed within the industrial network.

[0046] The extraction unit 140 operates on a non-real-time OS, and when the first detection unit 130 detects that an abnormality has occurred in the master 10 or one or more slaves 20, it extracts log data from the log storage DB 151 for frames from the time the abnormality was detected up to a predetermined time prior (2 hours prior). The extraction unit 140 also stores the extracted log data of the frames as pre-failure log data 320 in the second storage unit 300. In other words, the second storage unit 300 stores the log data extracted by the extraction unit 140 as pre-failure log data 320.

[0047] The slave processing unit 210 performs various processes to enable the monitoring device 30 to operate as a slave 20.

[0048] The communication module 220 operates on the real-time OS 200, captures frames flowing through the industrial network, and stores them in the third storage unit 221. The communication module 220 also retrieves data addressed to itself according to the commands contained in the frames flowing through the industrial network and stores it in the third storage unit 221. Furthermore, it retrieves data to be sent to the master 10 from the third storage unit 221 and stores it in the frame, according to the commands contained in the frames flowing through the industrial network. As mentioned above, the monitoring device 30 operates as the terminal slave 20. In other words, the third storage unit 221 corresponds to the memory of the slave 20 as described in "(Frame structure used in industrial networks)". For example, if the command contained in the frame is FPWR and the address contained in the frame points to the monitoring device 30, the communication module 220 stores the value contained in the frame in the area of ​​the third storage unit 221 specified by the address contained in the frame. Furthermore, if the command included in the frame is an FPRD and the address included in the frame points to the monitoring device 30, the communication module 220 retrieves a value from the area specified by the address included in the frame in the third storage unit 221 and stores it in the frame.

[0049] The periodic processing unit 230 operates on the real-time OS 200. The periodic processing unit 230 repeatedly acquires frames flowing through the industrial network from the third storage unit 221 and stores them in the FIFO queue 310 at predetermined intervals (for example, the interval at which frames are transmitted from the master 10). The periodic processing unit 230 also acquires data to be stored in the frames from the pre-failure log data 320 and stores it in the third storage unit 221.

[0050] The second detection unit 231 analyzes frames captured by the communication module 220 to detect whether there are any abnormalities in the synchronization process performed between the master 10 and one or more slaves 20, which is executed based on a reference time distributed within the industrial network. The monitoring device 30 is provided with at least one of the first detection unit 130 and the second detection unit 231. In other words, the monitoring device 30 may be configured to detect the presence or absence of abnormalities in the synchronization process on the non-real-time OS 100 side (i.e., with the first detection unit 130), or on the real-time OS 200 side (i.e., with the second detection unit 231). The first detection unit 130 and the second detection unit 231 may also be called "abnormality detection units".

[0051] The communication module 220 may also be called the "transmitter" and the "receiver." The communication module 220 (receiver) receives frames that are repeatedly transmitted from the master 10 within the industrial network. The communication module 220 (transmitter) also transmits pre-fault log data 320 to the master 10 via the industrial network in response to a request from the master 10.

[0052] <Processing Procedure> (Detection of synchronization processing anomalies) Next, we will specifically explain the process by which the monitoring device 30 detects an abnormality in the synchronization process. In the following explanation, we will assume that the first detection unit 130 detects the abnormality in the synchronization process, but as mentioned above, it is also possible to detect the abnormality in the synchronization process using the second detection unit 231. Furthermore, in the following explanation, we will assume that the slave 20 and the monitoring device 30 are different devices.

[0053] The monitoring device 30 detects two patterns of synchronization processing abnormalities, synchronization abnormality A and synchronization abnormality B, as described below, and determines the cause of the synchronization processing abnormality based on the combination of these two patterns of synchronization processing abnormalities. Synchronization abnormality A and synchronization abnormality B may also be called "first abnormality" and "second abnormality," respectively.

[0054] Synchronization Anomaly A: When the reference time stored in the reference time frame is not present between the times when two consecutive synchronization signals are generated, and the reference time frame should be received. Synchronization Anomaly B: When there is a discrepancy between the difference in the reference time contained in each of two consecutive time synchronization frames and the difference in the time when the monitoring device 30 receives each of those two consecutive time synchronization frames.

[0055] Figure 7 shows the state when the synchronization process is working correctly. Using Figure 7, we will specifically explain the process for detecting synchronization anomalies A and B.

[0056] [Synchronization error A] In Figure 7, the horizontal axis t represents the time when the synchronization signal is generated. The time when the synchronization signal is generated can be expressed in any way, but for example, it may be expressed as a 32-bit or 64-bit number starting from January 1, 2000, at 00:00:00, with the smallest unit of time being 1 nanosecond.

[0057] In the example shown in Figure 7, the synchronization signal period is set to 1000 (for example, 1 ms), and each frame is assumed to be a reference time frame. Slave 20-1 is a synchronous master-slave and will be referred to as synchronous master-slave 20-1 in the following description. That is, synchronous master-slave 20-1 stores the reference time in the reference time frame received from master 10 and transmits it to slave 20-2. Slave 20-2 obtains the reference time from the received reference time frame and transmits the reference time frame to monitoring device 30. Monitoring device 30 also obtains the reference time from the received reference time frame and transmits the reference time frame to master 10.

[0058] The reference time frame is repeatedly transmitted from the master 10 at approximately the same period as the synchronization signal period. For example, reference time frame A is transmitted from the master 10 between the generation of synchronization signal Sy1 and the generation of synchronization signal Sy2, passes through slave 20-1, slave 20-2, and monitoring device 30, and returns to the master 10 before synchronization signal Sy2 is generated. Therefore, if the synchronization process is normal, slave 20 and monitoring device 30 will always receive one reference time frame between two consecutive synchronization signals.

[0059] The time when the first synchronization signal is generated is the time specified as the "start time of the synchronization signal," and subsequent synchronization signals are generated after each "synchronization signal period." In other words, the time when the Nth synchronization signal (where N is an integer greater than or equal to 1) is generated can be calculated using the formula "start time of the synchronization signal + ((N-1) × synchronization signal period)." Thus, the Nth frame transmitted after the synchronization process has started should be received by each slave 20 between "start time of the synchronization signal + (N-1) × synchronization signal period" and "start time of the synchronization signal + N × synchronization signal period."

[0060] Here, the synchronous master-slave 20-1 stores the time of its own local clock as the reference time in the reference time frame received from the master 10, and transmits it to the slave 20-2. As mentioned above, the value of the local clock that the synchronous master-slave 20-1 stores as the reference time only needs to be the time between when the synchronous master-slave 20-1 receives the frame and when it transmits the frame containing the reference time to the slave 20-2. Therefore, the first detection unit 130 detects whether or not a synchronization anomaly A is present by determining whether or not a reference time exists between the times when two consecutive synchronization signals are generated, in which the reference time frame should be received, for the reference time frame among the frames repeatedly transmitted from the master 10.

[0061] More specifically, the first detection unit 130 determines that no synchronization anomaly A has occurred if a reference time exists between the times when two consecutive synchronization signals, which should be received by one or more slaves 20 (or synchronization master-slave), are generated within one or more slaves 20 (or synchronization master-slave). Conversely, the first detection unit 130 determines that synchronization anomaly A has occurred if there is no reference time between the times when two consecutive synchronization signals, which should be received by one or more slaves 20 (or synchronization master-slave), are generated within one or more slaves 20 (or synchronization master-slave).

[0062] The first detection unit 130 may acquire the "start time of the synchronization signal" and the "synchronization signal period," and based on the acquired "start time of the synchronization signal" and "synchronization signal period," calculate (estimate) the times when two consecutive synchronization signals are generated for which the reference time frame should be received. For example, suppose the reference time frame is the Xth frame transmitted after the start time of the synchronization signal. In this case, the first detection unit 130 can calculate (estimate) the time when the first of two consecutive synchronization signals for which the reference time frame should be received is generated using the formula "start time of the synchronization signal + (X-1) × synchronization signal period." The first detection unit 130 can also calculate (estimate) the time when the second of two consecutive synchronization signals for which the reference time frame should be received is generated using the formula "start time of the synchronization signal + X × synchronization signal period."

[0063] As explained below, synchronization anomaly A is detected when the master 10 is unable to transmit frames at equal intervals due to a failure of the local clock within the master 10, or when the local clock of the synchronization master-slave fails and a discrepancy occurs in the reference time stored in the reference time frame.

[0064] Figure 8 illustrates the events that occur when an abnormality occurs in the master 10, making it impossible to transmit frames at equal intervals. Unless otherwise specified, the process is the same as in Figure 7. In the example in Figure 8, some abnormality occurs in the master 10, causing a delay in the timing of the transmission of the reference time frame C from the master 10. In this case, the reference time stored in the reference time frame C is the time (8600) when the synchronous master-slave 20-1 receives the reference time frame C. However, the time when the reference time frame C should be received by each slave 20 is between the time when the synchronization signal Sy3 is generated (7500) and the time when the synchronization signal Sy4 is generated (8500). Therefore, when the first detection unit 130 receives the reference time frame C, it determines that the reference time (8600) included in the reference time frame C does not exist during the period when the reference time frame C should be received (between the time when the synchronization signal Sy3 is generated (7500) and the time when the synchronization signal Sy4 is generated (8500)), and detects that a synchronization abnormality A has occurred.

[0065] Figure 9 illustrates the events that occur when an anomaly occurs in the local clock of a synchronous master-slave, causing a shift in the reference time. Unless otherwise specified, the process is the same as in Figure 7. In the example in Figure 9, as a result of the local clock of the synchronous master-slave 20-1 ticking faster than the actual time, the reference times stored in frames C and D are shifted to 8600 and 11500 instead of the actual times (7800 and 8800 shown in Figure 7). Therefore, when the first detection unit 130 receives the reference time frame C, it determines that the reference time (8600) included in the reference time frame C does not exist during the period in which the reference time frame C should be received (between the time when the synchronization signal Sy3 is generated (7500) and the time when the synchronization signal Sy4 is generated (8500)), and detects that a synchronization anomaly A has occurred.

[0066] [Synchronization error B] If the local clock of the synchronous master-slave 20-1 is normal (i.e., the reference time stored in the reference time frame by the synchronous master-slave 20-1 is normal), and the local clock of the monitoring device 30 is also normal, then the difference between the times when the monitoring device 30 receives two consecutive reference time frames and the difference between the reference times contained in those two reference time frames should be approximately the same value. For example, in the example in Figure 7, the difference (1000) between the time when the monitoring device 30 receives frame A (5950) and the time when the monitoring device 30 receives frame B (6950) is the same as the difference (1000) between the reference time of frame A and the reference time of frame B (6800) and the difference between the reference time of frame A and the reference time of frame A (5800).

[0067] Therefore, the first detection unit 130 detects whether or not there is an abnormality in the synchronization process based on the difference in the time when the monitoring device 30 receives each of two consecutive reference time frames, each containing the reference time, and the difference in the reference time contained in each of the two consecutive reference time frames. More specifically, the first detection unit 130 determines that no synchronization abnormality B has occurred if the "degree of deviation" between the difference in the time when each of the two consecutive reference time frames was received and the difference in the reference time contained in each of the two consecutive reference time frames is less than or equal to a predetermined value. Conversely, the first detection unit 130 determines that synchronization abnormality B has occurred if the "degree of deviation" between the difference in the time when each of the two consecutive reference time frames was received and the difference in the reference time contained in each of the two consecutive reference time frames exceeds a predetermined value. The method for calculating the degree of deviation will be described later.

[0068] As explained below, synchronization anomaly B is detected when the local clock of the synchronization master-slave 20-1 fails, causing a discrepancy in the reference time stored in the reference time frame, or when the monitoring device 30 is unable to correctly measure the time when it receives a frame due to a failure of the local clock of the monitoring device 30, etc.

[0069] In the example shown in Figure 9, the local clock of the synchronous master-slave 20-1 ticks earlier than the actual time. As a result, the reference times stored in frames C and D are shifted to 8600 instead of the actual time (7800 and 8800 shown in Figure 7). Therefore, the first detection unit 130 determines that the degree of the discrepancy between the difference (1000) between the time frame B was received (6950) and the time frame C was received (7950), and the difference (1800) between the reference time stored in frame B (6800) and the reference time stored in frame C (8600), exceeds a predetermined value (e.g., 0.1), and detects that a synchronization anomaly B has occurred.

[0070] Figure 10 is a diagram illustrating the events that occur when an abnormality occurs in the local clock of the monitoring device 30. Unless otherwise specified, it can be the same as in Figure 7. In the example in Figure 10, as a result of the local clock of the monitoring device 30 ticking slower than the actual time, the times when frames C and D were received are shifted to 7450 and 7950, rather than the actual times (7950 and 8950 shown in Figure 7). Therefore, the first detection unit 130 determines that the degree of deviation between the difference (500) between the time when frame B was received (6950) and the time when frame C was received (7450), and the difference (1000) between the reference time stored in frame B (6800) and the reference time stored in frame C (7800), exceeds a predetermined value (e.g., 0.1), and detects that a synchronization abnormality B has occurred.

[0071] As explained above, there are three possible causes for synchronization anomalies: when a malfunction occurs in the master 10, making it impossible to transmit frames at equal intervals; when the local clock of the synchronization master-slave 20-1 fails, causing a discrepancy in the reference time stored in the reference time frame; or when a malfunction occurs in the local clock of the monitoring device 30. Furthermore, depending on the cause, the pattern in which the anomaly is detected (synchronization anomaly A or synchronization anomaly B) will differ.

[0072] This relationship can be represented in a table as shown in Figure 11. Figure 11 is a diagram showing the relationship between combinations of synchronization processing anomalies and the causes of the synchronization processing anomalies. The first detection unit 130 determines the cause of the anomaly based on the relationship shown in Figure 11. Specifically, if synchronization anomaly A occurs but synchronization anomaly B does not, the first detection unit 130 determines that there is an anomaly in the transmission cycle of the frames repeatedly transmitted from the master 10. Also, if synchronization anomaly A does not occur but synchronization anomaly B occurs, the first detection unit 130 determines that there is an anomaly in the clock provided by the monitoring device 30. Furthermore, if both synchronization anomaly A and synchronization anomaly B occur, the first detection unit 130 determines that there is an anomaly in the clock of the synchronization master slave.

[0073] (Synchronization process anomaly detection procedure) Reference signal frame Figure 12 is a flowchart illustrating an example of a processing procedure for detecting a synchronization process anomaly. In the explanation of Figure 12, the master 10 is assumed to repeatedly transmit frames according to the synchronization signal period. Also, "frame" refers to both the reference time frame and frames other than the reference time frame (i.e., frames that do not include the reference time). Before starting operations that the control system 1 should perform, such as motion control, the control system 1 performs initialization processing, such as distributing settings for various data used for motion control, etc. Once the initialization processing is complete, the control system 1 transitions to a state where it can start operation (referred to as the "Operational State"). Also, the monitoring device 30 is assumed to have already acquired the "synchronization signal start time" and the "synchronization signal period" before transitioning to the operational state. In the following explanation, T-init refers to the "synchronization signal start time". The counter m is an integer of 1 or more and represents the cumulative number of times the monitoring device 30 has received the reference time frame. Counter n is an integer greater than or equal to 1 and represents the cumulative number of times the monitoring device 30 has received a frame (however, the first reference time frame is considered the first frame, and frames received before that reference time frame are not counted). Also, the initial values ​​of counters n and m are set to 0.

[0074] In step S20, the first detection unit 130 retrieves one frame from the log storage DB 151.

[0075] In step S21, if the first detection unit 130 finds that the frame is a reference time frame, it proceeds to the processing procedure in step S22. If the frame is not a reference time frame, it proceeds to the processing procedure in step S23.

[0076] In step S22, if counter m is 1 or greater, the first detection unit 130 adds 1 to counter n and proceeds to the processing procedure in step S37. If counter m is 0, the first detection unit 130 does nothing and proceeds to the processing procedure in step S37.

[0077] In step S23, the first detection unit 130 adds 1 to counters n and m.

[0078] In step S24, the first detection unit 130 stores the value of the reference time included in the reference time frame in the variable Rt[m].

[0079] In step S25, the first detection unit 130 stores the time the communication module 220 received the reference time frame (the clock value of the monitoring device 30) in the variable Nt[m].

[0080] In step S26, if m=1, proceed to the processing procedure in step S27; otherwise, proceed to the processing procedure in step S28.

[0081] In step S27, the first detection unit 130 calculates the time at which the monitoring device 30 starts the abnormality detection process (hereinafter referred to as the "abnormality detection start time") (T-start). The abnormality detection start time (T-start) can be calculated using the following formula (1), where X is a non-negative integer.

[0082] Equation (1): When T-start = T-init + (synchronization signal period × X), the largest T-start satisfying T-start < variable Rt[1] In step S28, the first detection unit 130 uses the following equation (2) to determine the variable T n Calculate.

[0083] Formula (2): T n = T-start + synchronization signal period × (n-1) In step S29, the first detection unit 130 uses the following equation (3) to determine the variable T n+1 Calculate.

[0084] Formula (3): T n+1 = T-start + synchronization signal period × (n) In step S30, the first detection unit 130 proceeds to the processing procedure of step S31 if the following equation (4) is satisfied, and proceeds to the processing procedure of step S32 if the following equation (4) is not satisfied.

[0085] Formula (4): T n < Rt[m] < T n+1 In step S31, the first detection unit 130 determines that it has detected a synchronization anomaly A.

[0086] In step S32, the first detection unit 130 proceeds to the processing procedure in step S33 if the counter m is 2 or greater, and proceeds to the processing procedure in step S37 if the counter m is 1.

[0087] In step S33, the first detection unit 130 calculates the variable E1 using the following equation (5).

[0088] Equation (5): E1 = Rt[m] - Rt[m-1] In step S34, the first detection unit 130 calculates the variable E2 using the following equation (6).

[0089] Equation (6): E2 = Nt[m] - Nt[m-1] In step S35, the first detection unit 130 calculates the degree of deviation using the following equation (7). If the degree of deviation exceeds a predetermined value, the process proceeds to step S36; if the degree of deviation is less than or equal to the predetermined value, the process proceeds to step S37. In equation (7), Abs means absolute value.

[0090] Equation (7): Degree of deviation = Abs(1.0-(E1 / E2)) In step S36, the first detection unit 130 determines that it has detected a synchronization anomaly B.

[0091] In step S37, if the first detection unit 130 does not terminate the abnormality detection process, it returns to step S20; if it terminates the abnormality detection process, it terminates the process shown in Figure 12.

[0092] Figure 13 illustrates a specific example of how the above-described processing procedure can detect a clock anomaly in the synchronous master-slave as one type of synchronization anomaly.

[0093] Figure 13 shows a specific example of the synchronization anomaly detection process. In the example in Figure 13, the start time of the synchronization signal (T-init) is assumed to be 5500 (the time when the starting point of the reference time is set to 0), and the synchronization signal period is assumed to be 1000 (for example, 1 ms). Also, the reference times stored in reference time frames B, D, E, and H are assumed to be 7000, 9000, 11000, and 14000, respectively.

[0094] The following describes the process by which the monitoring device 30 detects a synchronization anomaly, assuming that an anomaly occurs in the local clock of the synchronous master-slave, with reference to Figures 12 and 13. Note that the predetermined value in step S35 of Figure 12 is assumed to be 0.1.

[0095] First, the first detection unit 130 acquires frame A (S20, S21-NO, S22, S37-NO in FIG. 12). Subsequently, the first detection unit 130 acquires the reference time frame B and adds 1 to each of the counters n and m (S20, S21-YES, S23 in FIG. 12). Also, the first detection unit 130 stores the value 7000 of the reference time included in the reference time frame B in the variable Rt[1], stores the time 7200 when the communication module 220 received the reference time frame B in the variable Nt[1], and calculates the variable T-start according to equation (1) (S24, S25, S26-YES, S27 in FIG. 12).

[0096] Here, in equation (1), when X = 1, T-start is T-start = 5500 + 1000 = 6500, which satisfies T-start < 7000. Next, when X = 2, T-start is T-start = 5500 + 1000×2 = 7500, which does not satisfy T-start < 7000. Therefore, the value of T-start becomes 6500.

[0097] Subsequently, the first detection unit 130 n and the variable T n+1 are calculated according to equations (2) and (3) (S28, S29 in FIG. 12). At this point, since n = 1, T n becomes 6500 + 1000×(1 - 1) = 6500. Similarly, T n+1 becomes 6500 + 1000×1 = 7500.

[0098] The first detection unit 130 determines whether equation (4) is satisfied. At this point, since m = 1 and Rt[1] is 7000, it satisfies 6500 < Rt[1] < 7500 (S30 in FIG. 12). Therefore, the first detection unit 130 determines that synchronization anomaly A has not occurred. Subsequently, since m = 1, the first detection unit 130 skips the processing procedures of steps S33 to S36 in FIG. 12 (S32-NO).

[0099] Next, the first detection unit 130 receives frame C and adds 1 to n (S20, S21-NO, S22 in Figure 12). At this point, n=2 and m=1.

[0100] Next, the first detection unit 130 acquires the reference time frame D and adds 1 to counters n and m, respectively (S20, S21-YES, S23 in Figure 12). The first detection unit 130 also stores the value of the reference time included in the reference time frame D, 9000, in the variable Rt[2], and stores the time when the communication module 220 received the reference time frame D, 9200, in the variable Nt[2] (S24, S25 in Figure 12).

[0101] Next, the first detection unit 130 detects the variable T n and variable T n+1 This is calculated according to equations (2) and (3) (S28 and S29 in Figure 12). At this point, n=3, so T n This becomes 6500 + 1000 × (3 - 1) = 8500. Similarly, T n+1 The result is 6500 + 1000 × 3 = 9500.

[0102] The first detection unit 130 determines whether or not equation (4) is satisfied. At this point, m=2 and Rt[2] is 9000, so 8500 < Rt[2] < 9500 is satisfied (S30-YES in Figure 12). Therefore, the first detection unit 130 determines that no synchronization anomaly A has occurred. The first detection unit 130 also calculates E1 and E2 according to equations (5) and (6) (S32-YES, S33, S34 in Figure 12). E1 is Rt[2]-Rt[1]=9000-7000=2000, and E2 is Nt[2]-Nt[1]=9200-7200=2000. The first detection unit 130 determines whether or not equation (7) is satisfied (S35 in Figure 12). Since Abs(1.0-E2 / E1)=1.0-2000 / 2000=0, and is less than or equal to the predetermined value of 100, the first detection unit 130 determines that no synchronization anomaly B has occurred (S35-YES in Figure 12).

[0103] Next, the first detection unit 130 receives frame E and adds 1 to n (S20, S21-NO, S22 in Figure 9). At this point, n=4 and m=2.

[0104] Next, the first detection unit 130 acquires the reference time frame F, adds 1 to counters n and m, stores the value of the reference time included in the reference time frame F, 11000, in the variable Rt[3], stores the time, 11200, when the communication module 220 received the reference time frame F, in the variable Nt[3], and stores the variable T n and variable T n+1 This is calculated according to equations (2) and (3) (S23, S24, S25, S26-NO, S28, S29 in Figure 12). At this point, n=5, so T n This becomes 6500 + 1000 × (5 - 1) = 10500. Similarly, T n+1 This becomes 6500 + 1000 × 5 = 11500.

[0105] The first detection unit 130 determines whether or not equation (4) is satisfied. At this point, m=3 and Rt[3] is 11000, so 10500 < Rt[3] < 11500 is satisfied (S30-NO in Figure 12). Therefore, the first detection unit 130 determines that no synchronization anomaly A has occurred. The first detection unit 130 also calculates E1 and E2 according to equations (5) and (6) (S33, S34 in Figure 12). E1 is Rt[3]-Rt[3]=11000-9000=2000, and E2 is Nt[3]-Nt[2]=11200-9200=2000. The first detection unit 130 determines whether or not equation (7) is satisfied (S35 in Figure 12). Since Abs(1.0-E2 / E1)=1.0-2000 / 2000=0, and is less than or equal to the predetermined value of 100, the first detection unit 130 determines that no synchronization abnormality B has occurred (S35-NO in Figure 12).

[0106] Next, the first detection unit 130 receives frame G and adds 1 to n (S22 in Figure 12). At this point, n=6 and m=3.

[0107] Next, the first detection unit 130 acquires the reference time frame H and adds 1 to counters n and m (S20, S21-YES, S23 in Figure 12). The first detection unit 130 also stores the value of the reference time included in the reference time frame H, 14000, in the variable Rt[4], and stores the time 13200, when the communication module 220 received the reference time frame H, in the variable Nt[4], and the variable T n and variable T n+1 This is calculated according to equations (2) and (3) (S24, S25, S26-NO, S28, S29 in Figure 12). At this point, n=7, so T n This becomes 6500 + 1000 × (7 - 1) = 12500. Similarly, T n+1 This becomes 6500 + 1000 × 7 = 13500.

[0108] The first detection unit 130 determines whether or not equation (4) is satisfied. At this point, m=4 and Rt[4] is 14000, so 12500 < Rt[4] < 13500 is not satisfied (S30-NO in Figure 12). Therefore, the first detection unit 130 determines that a synchronization anomaly A has occurred (S31 in Figure 12). The first detection unit 130 also calculates E1 and E2 according to equations (5) and (6) (S33, S34 in Figure 12). E1 is Rt[4]-Rt[3]=14000-11000=3000, and E2 is Nt[4]-Nt[3]=13200-11200=2000. The first detection unit 130 determines whether or not equation (7) is satisfied (S35 in Figure 12). Since Abs(1.0-E2 / E1)=Abs(1.0-3000 / 2000)=0.5, which is not less than the predetermined value of 0.1, the first detection unit 130 determines that a synchronization anomaly B has occurred (S35-NO, S36 in Figure 12).

[0109] As explained above, the first detection unit 130 detects synchronization anomalies A and B, and determines that the clock of the synchronization master-slave 20-1 is abnormal, according to the table in Figure 11.

[0110] [Examples of detecting synchronization processing anomalies] (Variation 1) In detecting synchronization abnormalities as described above, the monitoring device 30 may perform only one of the detections: either synchronization abnormality A or synchronization abnormality B.

[0111] (Modification 2) The log storage DB 151 sequentially stores the contents of the latest frames captured by the communication module 220, with each frame associated with the time it was received by the monitoring device 30 (more specifically, the communication module 220). The first detection unit 130 may then quickly detect the occurrence of a synchronization anomaly by sequentially analyzing the frames stored in the log storage DB 151 according to the flowchart shown in Figure 12. Alternatively, the first detection unit 130 may retrospectively detect the occurrence of a synchronization anomaly by analyzing frames previously stored in the log storage DB 151 in batch processing according to the flowchart shown in Figure 12.

[0112] (Variation 3) The clock of the monitoring device 30 does not necessarily have to operate on the same time axis as the reference time. The clock of the monitoring device 30 may operate on a different time axis than the reference time.

[0113] (Modification 4) Figures 14 and 15 illustrate modified examples. Since industrial networks process frames on the fly, there is a time lag due to propagation delay between the arrival of a frame at the synchronous master-slave and the arrival of the frame at the slave 20, which is the last to process the frame. In addition, it is thought that some time lag is required between the arrival of the frame at the slave 20 and the time it becomes available for processing in the application unit.

[0114] For example, in the example shown in Figure 14, frame A arrives at slave 20-2 just before time t2 when synchronization signal 2 is generated. Therefore, even if slave 20-2 receives frame A at this time, it is likely that it will be difficult to start AP processing in accordance with time t2. In this case, the first detection unit 130 may take this time lag into consideration when detecting whether or not there is a synchronization anomaly A.

[0115] For example, the first detection unit 130 may detect the presence or absence of a synchronization anomaly A by determining whether a reference time exists between the time when the first synchronization signal 1 of two consecutive synchronization signals, which should receive the reference time frame, is generated (t1 in Figure 15), and a predetermined time (third time) before the time when the second synchronization signal 2 is generated (t2 in Figure 15) (t2-a in Figure 15). The predetermined time (third time) may be set to a time longer than the sum of the propagation delay D between the synchronization master slave and the slave 20 that last processes the frame and the processing delay time within the slave 20.

[0116] More specifically, the first detection unit 130 may determine that no synchronization anomaly A has occurred if a reference time exists between the time when the first of two consecutive synchronization signals, which should be received by one or more slaves 20 (or synchronization master-slave) with a reference time frame, is generated within one or more slaves (or synchronization master-slave), and the time when the second synchronization signal is generated within one or more slaves, and a predetermined time (third time) before that time. Alternatively, the first detection unit 130 may determine that a synchronization anomaly A has occurred if there is no reference time between the time when the first of two consecutive synchronization signals, which should be received by one or more slaves 20 (or synchronization master-slave) with a reference time frame, is generated within one or more slaves (or synchronization master-slave), and the time when the second synchronization signal is generated within one or more slaves (or synchronization master-slave), and a predetermined time (third time) before that time.

[0117] (Frame recording immediately before the anomaly occurred) Next, we will explain the process by which, in the event of an abnormality occurring in control system 1, log data of frames that were flowing through the industrial network before the abnormality occurred is extracted, and the extracted log data is sent to master 10.

[0118] Here, we will explain the contents of the data stored in the log storage DB 151. The log storage DB 151 stores frames that flow through the industrial network, captured by the communication module 220 of the real-time OS 200. In this case, the frame data stored in the log storage DB 151 may include an identifier (first identifier) ​​that uniquely identifies frames that are repeatedly transmitted from the master 10. The identifier that uniquely identifies a frame is called the "cycle number". The cycle number is a number managed by the master 10 and the monitoring device 30 and is not included in the frame. For example, the master 10 sets the cycle number of the first frame it transmits after transitioning to the operational state to 0, and increments the cycle number by one each time it transmits a frame. Similarly, the monitoring device 30 sets the cycle number of the first frame it receives after transitioning to the operational state to 0, and increments the cycle number by one each time it receives a frame.

[0119] Furthermore, the data in the frames stored in the log storage DB151 may include an identifier (second identifier) ​​that indicates the memory location where data (also called an object) is written to or read from in the frames repeatedly transmitted from the master 10. This identifier indicating the memory location may be a combination of an identifier (configuration address) that identifies the slave 20, an index, and a sub-index.

[0120] Similarly, the pre-failure log data 320, which stores log data extracted from the log storage DB 151, may also include a cycle number and an identifier (second identifier) ​​indicating the memory location.

[0121] In other words, the monitoring device 30 can obtain data from the pre-failure log data 320 that was transmitted from the master with the specified cycle number, by specifying the cycle number. Furthermore, the monitoring device 30 can obtain data from the pre-failure log data 320 that was transmitted from the master with the specified cycle number, and is destined for a specific memory on a specific slave 20, or data that has been read from a specific memory on a specific slave 20 and stored in a frame, by specifying the cycle number and an identifier indicating the memory location.

[0122] When the extraction unit 140 is notified that an abnormality has occurred in the master 10 or one or more slaves 20, it extracts log data from the log storage DB 151 from the time the abnormality was detected up to a predetermined time prior (1 hour prior). The time the abnormality was detected may be the time when the monitoring device 30 detected the abnormality, or the time when the monitoring device 30 received the frame in which the abnormality was detected. The extraction unit 140 then stores the extracted log data as pre-failure log data 320 in the second storage unit 300, which is accessible from the real-time OS 200.

[0123] Here, the predetermined time (first time) may be specified by the master 10, or it may be stored in the setting file 152 in advance. The predetermined time may be expressed in terms of the number of cycles (e.g., 1000 cycles) or in terms of a specific time length (e.g., 1 second). When expressed in terms of the number of cycles, the predetermined time may be called the "specified number of cycles". Since the time length of one cycle is the same as the synchronization signal period, the number of cycles and the time length can be converted to each other. Therefore, expressing the predetermined time in terms of a specific time length is equivalent to expressing it in terms of the number of cycles.

[0124] The second detection unit 231 may determine that an abnormality has occurred in the master 10 if it fails to receive frames repeatedly transmitted from the master 10 for a certain period of time (second period). This certain period of time may be called the "WD (Watchdog) timer". The WD timer may be specified by the master 10 or may be stored in the configuration file 152 in advance. The monitoring device 30 may also determine that an abnormality has occurred in the master 10 or one or more slaves 20 if it detects the synchronization abnormality A or synchronization abnormality B described above. The WD timer may be expressed in terms of cycle count (e.g., 100 cycles) or in terms of a specific time length (e.g., 0.1 seconds). As mentioned above, since cycle count and time length can be converted to each other, expressing the WD timer in terms of a specific time length and expressing it in terms of cycle count are synonymous.

[0125] The communication module 220 transmits the log data stored in the pre-failure log data 320 to the master 10 via the industrial network in response to a request from the master 10. Specifically, the communication module 220 (receiving unit) receives a request from the master 10 to transmit the pre-failure log data, which includes a cycle number (first identifier). When the communication module 220 (transmitting unit) receives this transmission request, it transmits the data of the frame specified by the cycle number from the pre-failure log data to the master 10.

[0126] Furthermore, the communication module 220 (receiving unit) may receive a request from the master 10 to transmit pre-failure log data, which includes a cycle number (first identifier) ​​and an identifier indicating a memory location (second identifier). The communication module 220 (transmitting unit), upon receiving such a transmission request, may transmit to the master 10 the data corresponding to the identifier indicating a memory location in the frame specified by the cycle number from the pre-failure log data (i.e., data written to the memory indicated by the identifier or data read from the memory indicated by the identifier).

[0127] Furthermore, the slave processing unit 210 may delete the pre-failure log data 320 when it receives instructions from the master 10. Specifically, the communication module 220 (receiving unit) may receive a request from the master 10 to delete the pre-failure log data 320, and the second detection unit 231 may delete the pre-failure log data 320 when it receives the deletion request. The second detection unit 231 may also be called the "deletion processing unit".

[0128] Figure 16 is a sequence diagram showing an example of the processing procedure for extracting log data and sending it to the master 10 when an anomaly occurs.

[0129] In step S100, the master 10 writes the WD timer and the specified number of cycles to a predetermined memory area in the third storage unit 221 of the monitoring device 30 by transmitting a frame containing the WD timer and the specified number of cycles. The second detection unit 231 of the monitoring device 30 recognizes the value of the WD timer and the specified number of cycles by acquiring the WD timer and the specified number of cycles written to the third storage unit 221.

[0130] After the processing procedure in step S100 is completed, the control system 1 transitions to an operational state, and the master 10 begins transmitting frames.

[0131] In step S101, the second detection unit 231 detects an abnormality. For example, the second detection unit 231 may detect an abnormality if it is unable to receive frames from the master 10 for a period set by the WD timer. When the second detection unit 231 detects an abnormality, it stores an "abnormality detection flag" indicating that an abnormality has been detected, and an "abnormality detection cycle number" indicating the cycle number of the last frame received when the abnormality was detected, in the third storage unit 221. The reason for storing the abnormality detection flag and the abnormality detection cycle number in the third storage unit 221 is to enable the master 10 to recognize that an abnormality has occurred in the industrial network. The second detection unit 231 also notifies the extraction unit 140 that an abnormality has occurred. For example, the second detection unit 231 may store the abnormality detection flag and the abnormality detection cycle number in the second storage unit 300, and the extraction unit 140 may periodically refer to the second storage unit 300 to obtain the abnormality detection flag and the abnormality detection cycle number.

[0132] In step S102, if the extraction unit 140 is notified by the second detection unit 231 that an anomaly has occurred, it extracts log data from the log storage DB 151 for frames from the cycle number at the time the anomaly was detected up to a specified number of cycles prior, and stores it in the pre-failure log data 320. The extraction unit 140 also notifies the second detection unit 231 that it has stored the pre-failure log data 320. For example, the extraction unit 140 may store information in the second storage unit 300 indicating that the storage of the pre-failure log data 320 is complete, and the extraction unit 140 may periodically refer to the second storage unit 300 to check for the presence or absence of such information, thereby recognizing that the pre-failure log data 320 has been stored in the second storage unit 300.

[0133] When the pre-failure log data 320 is stored in the second storage unit 300, the second detection unit 231 stores an extraction completion flag in the third storage unit 221. The extraction completion flag indicates that the extraction of the pre-failure log data 320 is complete and that the pre-failure log data 320 can now be read from the master 10.

[0134] In step S103, the communication module 220 receives instructions from the master 10 and stores the anomaly detection flag, the cycle number at the time of anomaly detection, and the extraction completion flag in a frame and sends it to the master 10. The master 10 reads the anomaly detection flag, the cycle number at the time of anomaly detection, and the extraction completion flag from the received frame and recognizes that an anomaly has been detected by the monitoring device 30, the cycle number at the time the anomaly occurred, and that it is now possible to read the pre-failure log data 320 from the monitoring device 30. Note that the processing procedure in step S103 may also be performed, for example, by an administrator managing the master 10 operating the screen of the master 10.

[0135] In step S104, the master 10 determines from the monitoring device 30 which cycle number frame to read from the cycles up to a specified number of cycles prior to the cycle number at the time of anomaly detection, which frame destined for which slave 20 to read, and which index and sub-index values ​​to read. This determination may also be made by an administrator or other person managing the master 10 specifying the cycle number, etc.

[0136] In step S105, the master 10 transmits a frame containing an identifier indicating the monitoring device 30, the cycle number of the frame to be read, the identifier (configured address) of the slave 20 from which the data will be read, and the index and sub-index corresponding to the value to be read, in order to read the data of the frame with the cycle number determined in the processing procedure of step S104. Note that the identifier of the slave 20 from which the data will be read, and the index and sub-index corresponding to the value to be read may be omitted. For example, if it is desired to obtain all the data of a frame with a certain cycle number, the master 10 may specify only the cycle number and omit the identifier of the slave 20 from which the data will be read, the index and sub-index.

[0137] In step S106, the communication module 220 stores the data of the frame with the cycle number instructed by the master 10 in the processing procedure of step S105 into the frame received from the master 10 in the processing procedure of step S105 and transmits it to the master 10. The master 10 retrieves the data of the frame with the specified cycle number from the received frame. If the master 10 reads data from frames of multiple cycles, it repeats the processing procedures of steps S105 and S106.

[0138] In step S107, the master 10 stores the data of the acquired frame.

[0139] Figure 17 shows an example of frame data stored in the pre-failure log data 320. The recorded value index is an identifier used to uniquely identify the records recorded in the pre-failure log data 320. For example, if you want to obtain all values ​​in frames with cycle counts from 1000 to 1049, the master 10 specifies a cycle count of 1000 in the processing procedure of step S105, and then repeats the procedure of obtaining data for frames with a cycle count of 1000 in the processing procedure of step S106 50 times, increasing the cycle count by 1 each time. Return to Figure 16 and continue the explanation.

[0140] The frames used in the processing procedures of steps S105 and S106 may be frames, or they may be frames that are transmitted aperiodically, independently of the synchronization process.

[0141] In step S108, the master 10 writes the reset command flag to a predetermined memory area in the third storage unit 221 of the monitoring device 30 by transmitting a frame containing the identifier of the monitoring device 30, an index and sub-index indicating the memory area where the reset command flag is stored, and the value of the reset command flag, in order to erase the pre-failure log data 320 stored in the monitoring device 30.

[0142] In step S109, if the second detection unit 231 of the monitoring device 30 detects that a reset command flag has been written to the third storage unit 221, it deletes the pre-failure log data 320. The second detection unit 231 also deletes the abnormality detection flag, the abnormality detection cycle number, and the extraction completion flag stored in the third storage unit 221.

[0143] <Summary> According to the embodiments described above, it becomes possible to detect abnormalities occurring in control systems connected via an industrial network at an earlier stage. Furthermore, when an abnormality occurs in a control system connected via an industrial network, it becomes possible to perform abnormality analysis and / or recovery more quickly.

[0144] Furthermore, since the monitoring device 30 analyzes the frames transmitted from the master 10 at each synchronization signal generation cycle, it becomes possible to quickly detect the occurrence of a synchronization anomaly before the next synchronization signal generation cycle arrives.

[0145] Furthermore, the monitoring device 30 is designed to detect two patterns of synchronous anomalies: synchronous anomaly A and synchronous anomaly B. This allows the monitoring device 30 to specifically identify the cause of a synchronous anomaly in the control system 1. Specifically, it can determine whether the monitoring device 30's own clock is abnormal, whether there is an abnormality in the transmission period of the frames transmitted by the master 10, or whether there is an abnormality in the local clock of the synchronous master-slave.

[0146] Without the monitoring device 30, it would be difficult to determine whether a synchronization anomaly occurred in the master 10's local clock or in the synchronization master-slave's local clock. In contrast, in this embodiment, the monitoring device 30 monitors for synchronization anomalies separately from the master 10, making it possible to specifically identify the cause of the synchronization anomaly.

[0147] Furthermore, the monitoring device 30 captures frames transmitted from the master 10 and stores them in the log storage DB 151 on the non-real-time OS 100. By storing the log storage DB 151 on the non-real-time OS side, which can handle large amounts of data, the monitoring device 30 becomes capable of capturing and storing large amounts of frame data.

[0148] Furthermore, when the monitoring device 30 detects an anomaly, it extracts the data of the frame immediately preceding the anomaly from the log storage DB 151 and stores the extracted pre-failure log data 320 in memory accessible from the real-time OS 200. Non-real-time operating systems have difficulty performing real-time processing, making it impossible to acquire the pre-failure log data 320 according to the frame cycle and write it to the frame. However, by making the pre-failure log data 320 accessible from the real-time OS 200, the monitoring device 30 can acquire the pre-failure log data 320 according to the synchronization signal cycle and write it to the frame. In other words, the master 10 can read the pre-failure log data 320 using frames that are repeatedly transmitted according to the synchronization signal cycle.

[0149] Furthermore, by reading the pre-fault log data 320, the master 10 can identify the position where the motion control stopped, and after the abnormality is resolved, it becomes possible to resume motion control from that position.

[0150] Furthermore, the monitoring device 30 is configured to transmit pre-fault log data 320 via an industrial network. This allows the monitoring device 30 to easily transmit pre-fault log data 320 to the master 10 used in the control system 1, even if external inputs such as USB are difficult to access.

[0151] The embodiments described above are provided to facilitate understanding of this disclosure and are not intended to limit it. The flowcharts, sequences, elements, and their arrangement, materials, conditions, shapes, and sizes described in the embodiments are not limited to those exemplified and can be modified as appropriate. Furthermore, configurations shown in different embodiments can be partially substituted or combined. [Explanation of Symbols]

[0152] 1 Control system, 10 Master, 11 Processor, 12 Storage device, 13 Network interface, 14 Input device, 15 Output device, 20 Slave, 30 Monitoring device, 110 Display unit, 120 Collection unit, 130 First detection unit, 140 Extraction unit, 150 First storage unit, 151 Log storage DB, 152 Configuration file, 210 Slave processing unit, 220 Communication module, 221 Third storage unit, 230 Periodic processing unit, 231 Second detection unit, 300 Second storage unit, 310 FIFO queue, 320 Pre-failure log data

Claims

1. An information processing device connected to a master and one or more slaves via an industrial network in which frames are repeatedly flowed at a predetermined period by an on-the-fly method, A receiving unit that receives frames repeatedly transmitted from the master within the industrial network, A first storage unit that stores the log data of the frame, If an abnormality is detected in the master or one or more slaves, an extraction unit extracts log data of the frames from the first storage unit up to a predetermined time before the time the abnormality was detected, A second storage unit stores the extracted log data of the frame as pre-failure log data, A transmission unit that, in response to a request from the master, transmits the pre-failure log data to the master via the industrial network, An information processing device having

2. The aforementioned information processing device has a non-real-time OS and a real-time OS. The receiving unit operates on the real-time OS, The first storage unit is provided in the non-real-time OS, The extraction unit operates on the non-real-time OS, The second storage unit is provided in the real-time OS and in a memory accessible from the real-time OS. The transmission unit operates on the real-time OS, The information processing apparatus according to claim 1.

3. The log data of the frame includes a first identifier that uniquely identifies the frame repeatedly transmitted from the master. The receiving unit receives a request from the master to transmit the pre-failure log data, which includes the first identifier. When the transmission unit receives the transmission request, it transmits the data of the frame specified by the first identifier from the pre-failure log data to the master. The information processing apparatus according to claim 1.

4. The log data of the frame further includes a second identifier indicating a memory location associated with data stored in the frame repeatedly transmitted from the master, The receiving unit receives a request from the master to transmit the pre-failure log data, which includes the first identifier and the second identifier. When the transmission unit receives the transmission request, it transmits to the master the data corresponding to the second identifier of the frame specified by the first identifier from the pre-failure log data. The information processing apparatus according to claim 3.

5. The receiving unit receives a request from the master to delete the pre-failure log data. The system includes a deletion processing unit that deletes the pre-failure log data upon receiving the aforementioned deletion request. The information processing apparatus according to claim 1.

6. An information processing method performed by an information processing device connected to a master and one or more slaves via an industrial network in which frames are repeatedly flowed at a predetermined period in an on-the-fly manner, The steps include receiving frames repeatedly transmitted from the master within the industrial network, The steps include storing the log data of the frame in the first storage unit, If an abnormality is detected in the master or one or more slaves, the first storage unit extracts log data of the frames from the time the abnormality was detected up to a predetermined time prior to that time. The steps include storing the extracted log data of the frame in the second storage unit as pre-failure log data, The steps include: transmitting the pre-failure log data to the master via the industrial network in response to a request from the master; Information processing methods, including those mentioned above.

7. A computer connected to a master and one or more slaves via an industrial network in which frames are repeatedly flowed at a predetermined period using an on-the-fly method, The steps include receiving frames repeatedly transmitted from the master within the industrial network, The steps include storing the log data of the frame in the first storage unit, If an abnormality is detected in the master or one or more slaves, the first storage unit extracts log data of the frames from the time the abnormality was detected up to a predetermined time prior to that time. The steps include storing the extracted log data of the frame in the second storage unit as pre-failure log data, The steps include: transmitting the pre-failure log data to the master via the industrial network in response to a request from the master; A program to execute.

Images