PROGRAM, ANALYSIS SUPPORT DEVICE, ANALYSIS SUPPORT SYSTEM, AND ANALYSIS SUPPORT METHOD

Abstract

The program causes the computer to function as a feature data acquisition unit (103) that acquires feature data (205) indicating features of device log data (201) of a PLC or a controlled device or features of event log data (202) of the PLC or a controlled device; a similarity calculation unit (106) that calculates the similarity between the feature data (205) stored in the database (200) in association with analysis process data (204) indicating an analysis process and the feature data (205) acquired by the feature data acquisition unit (103); an extraction unit (107) that extracts, based on the similarity, analysis process data (204) associated with the feature data (205) similar to the feature data (205) acquired by the feature data acquisition unit (103); and a presentation unit (108) that presents the extracted analysis process data (204) to a user as analysis know-how.

Description

[Technical field]

[0001] The present disclosure relates to a program, an analysis support device, an analysis support system, and an analysis support method. [Background technology]

[0002] When a problem occurs in a wide variety of devices connected to a programmable logic controller (PLC), the PLC outputs log data necessary for analyzing the problem. A maintenance person who deals with the problem must first analyze the log data, but the analysis can take a lot of time. To solve this situation, various techniques are known for supporting the analysis of log data. For example, Patent Document 1 discloses a technique for extracting from a database the history of an analysis process in which the type of log data to be analyzed and the analysis tool used are similar, and providing the history as analysis support information. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2016-29516 A Summary of the Invention [Problem to be solved by the invention]

[0004] Although the history of the above-mentioned analysis process is useful as analysis know-how, in factory automation sites, even the same equipment or equipment of the same model number does not necessarily cause the same trouble due to the environment in which the equipment is installed, the conditions under which the equipment is used, etc. For this reason, analysis processes in which only the type of log data to be analyzed and the analysis tools are similar may not be useful for the log data that the maintenance personnel are trying to analyze.

[0005] The present disclosure has been made in consideration of the above circumstances, and aims to provide a program, an analysis support device, an analysis support system, and an analysis support method that are capable of presenting data indicating past analysis processes extracted based on characteristics of log data as analysis know-how. [Means for solving the problem]

[0006] In order to achieve the above object, the program according to the present disclosure comprises: Computer, A feature data acquisition means for acquiring feature data indicating features of device log data in which values ​​of devices used in a programmable logic controller or a controlled device of the programmable logic controller are recorded, or feature data indicating features of event log data in which values ​​indicating events occurring in the programmable logic controller or the controlled device are recorded; a similarity calculation means for calculating a similarity between feature data stored in a database in association with analysis process data indicating a process of analysis performed on the device log data or the event log data, and the feature data acquired by the feature data acquisition means; an extraction means for extracting, from the database, analysis process data associated with feature data similar to the feature data acquired by the feature data acquisition means, based on the similarity calculated by the similarity calculation means; a presentation means for presenting the analytical process data extracted by the extraction means as analytical know-how; Function as 、 The similarity calculation means corrects the similarity based on information indicating a role of the programmable logic controller or the controlled device in a system including the programmable logic controller and the controlled device. . Effect of the Invention

[0007] According to the present disclosure, it is possible to provide a program, an analysis support device, an analysis support system, and an analysis support method that are capable of presenting data indicating past analysis processes extracted based on characteristics of log data as analysis know-how. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 shows an analysis support system according to an embodiment. [Diagram 2] FIG. 1 is a block diagram showing a hardware configuration of an information processing apparatus according to an embodiment. [Diagram 3] FIG. 1 is a diagram showing details of the functional configuration of an analysis support device according to an embodiment and data stored in a database; [Figure 4] FIG. 13 is a diagram showing an example of device log data according to the embodiment; [Diagram 5] FIG. 13 is a diagram showing an example of event log data according to the embodiment; [Figure 6] FIG. 13 is a diagram showing an example of a graph display of device log data according to an embodiment; [Figure 7] FIG. 13 is a diagram showing an example of a graph display of correlations between device log data according to an embodiment; [Figure 8] Flowchart showing an analysis process according to an embodiment [Figure 9] Flowchart showing countermeasure steps according to an embodiment [Figure 10] FIG. 13 is a diagram showing another example of device log data according to the embodiment; [Figure 11] FIG. 13 is a diagram showing another example of event log data according to the embodiment; [Figure 12] FIG. 13 is a diagram showing another example of a graph display of device log data according to the embodiment; [Figure 13] FIG. 13 is a diagram showing another example of a graph display of correlations of device log data according to the embodiment; [Figure 14] A flowchart showing an accumulation process of analytical know-how according to an embodiment. [Figure 15] A flowchart showing a process for utilizing analytical know-how according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] (Embodiment) The analysis support system according to the embodiment is a system that presents analysis know-how to a user. Fig. 1 shows an analysis support system 1 according to the embodiment. The analysis support system 1 includes an analysis support device 100 and a database 200. The analysis support device 100 is communicatively connected to a PLC 300 via a wired or wireless communication network 500.

[0010] Analysis support device 100 is a device for analyzing log data of PLC 300 and controlled device 400. Analysis support device 100 is used by, for example, a person in charge of maintaining PLC 300 and controlled device 400, a person who designs a line layout including PLC 300 and controlled device 400, etc. Analysis support device 100 also presents analysis processes that have been performed in the past to a user as analysis know-how.

[0011] Database 200 is a device that stores data used in the analysis by analysis support device 100 and data indicating the steps of past analysis. The data used in the analysis by analysis support device 100 is, for example, log data including device log data and event log data described below, video data of a line, etc. Also, the data indicating the steps of past analysis is, for example, data indicating the steps of past analysis performed on log data by a veteran maintenance technician.

[0012] The PLC 300 is a device that controls the controlled device 400. When a problem occurs in the PLC 300 or the controlled device 400, the PLC 300 outputs log data of the PLC 300 and the controlled device 400.

[0013] The controlled device 400 is a Factory Automation (FA) device controlled by the PLC 300, and also includes an extension unit connected to the PLC 300. The controlled device 400 is, for example, a programmable display, a servo, an inverter, a robot, a motion unit, a camera linking function unit, or the like.

[0014] FIG. 2 shows an example of a hardware configuration of an information processing device 10 in which the analysis support device 100 is realized.

[0015] The information processing device 10 has a processor 11 that executes various processes, a main memory unit 12 used as a working area for the processor 11, an auxiliary memory unit 13 that stores various data used in the processes of the processor 11, a communication unit 14 for communicating with external devices, an input unit 15 that acquires input information, and an output unit 16 that presents various information. The main memory unit 12, the auxiliary memory unit 13, the communication unit 14, the input unit 15, and the output unit 16 are all connected to the processor 11 via a bus 17.

[0016] The processor 11 includes a CPU (Central Processing Unit). The processor 11 executes programs stored in the auxiliary storage unit 13 to realize various functions of the information processing device 10.

[0017] The main memory unit 12 includes a RAM (Random Access Memory). Programs are loaded into the main memory unit 12 from the auxiliary memory unit 13. The main memory unit 12 is used as a working area for the processor 11.

[0018] The auxiliary storage unit 13 includes a non-volatile memory such as an EEPROM (Electrically Erasable Programmable Read-Only Memory). In addition to programs, the auxiliary storage unit 13 stores various data used in the processing of the processor 11. In accordance with instructions from the processor 11, the auxiliary storage unit 13 supplies the processor 11 with data used by the processor 11 and stores the data supplied from the processor 11.

[0019] The communication unit 14 includes a network interface circuit for communicating with an external device. The communication unit 14 receives a signal from the external device and outputs data indicated by the signal to the processor 11. The communication unit 14 also transmits a signal indicating the data output from the processor 11 to the external device.

[0020] The input unit 15 includes input devices such as an input key, a pointing device, a microphone, a camera, etc. The input unit 15 acquires information input by a user of the information processing device 10, and notifies the processor 11 of the acquired information.

[0021] The output unit 16 includes output devices such as an LCD (Liquid Crystal Display) and a speaker. The output unit 16 may be configured as a touch screen integrally formed with a pointing device constituting the input unit 15. The output unit 16 presents various information to the user according to instructions from the processor 11.

[0022] FIG. 3 shows the functional configuration of analysis support device 100 and details of data stored in database 200 according to this embodiment.

[0023] The analysis support device 100 in FIG. 3 functionally comprises an analysis operation unit 101 that accepts operations for analysis by a user, an analysis step acquisition unit 102 that acquires analysis step data indicating the step of analysis by the user, a feature data acquisition unit 103 that acquires feature data of the log data to be analyzed, an analysis result acquisition unit 104 that acquires analysis result data indicating the result of the analysis, a countermeasure step acquisition unit 105 that acquires countermeasure step data indicating the step of countermeasures taken for the PLC 300 or the controlled device 400, a similarity calculation unit 106 that calculates the similarity between the feature data of the log data to be analyzed and the feature data of the log data stored in the database 200, an extraction unit 107 that extracts analysis step data from the database 200, a presentation unit 108 that presents the extracted analysis step data as analysis know-how, and an analysis application unit 109 that applies the analysis of the step indicated by the selected analysis step data to the log data to be analyzed.

[0024] The database 200 stores device log data 201 and event log data 202 output from the PLC 300, associated data 203 related to the analysis of the log data, analysis process data 204 indicating the analysis process, feature data 205 acquired by the feature data acquisition unit 103, analysis result data 206 indicating the result of the analysis, countermeasure process data 207 indicating the countermeasure process, and similarity calculation method data 208 indicating a method for calculating the similarity described later.

[0025] The analysis operation unit 101 provides the user with an analysis tool for performing analysis using the device log data 201, the event log data 202, and the related data 203, and accepts an analysis operation from the user. Then, the analysis operation unit 101 executes an analysis process based on the accepted operation. The analysis operation unit 101 is realized by the processor 11, the communication unit 14, the input unit 15, and the output unit 16.

[0026] The device log data 201 is data that records values ​​of devices used in the PLC 300 and the controlled device 400. For example, the device log data 201 is time-series data of values ​​of devices used in the control program of the PLC 300.

[0027] Fig. 4 shows an example of the device log data 201. In the device log data 201 in Fig. 4, values ​​of devices such as "sensor A", "sensor B", "device A" and "device B" are recorded in chronological order. Note that the device log data 201 in Fig. 4 is only an example, and depending on the PLC 300, values ​​of tens of thousands to hundreds of thousands of devices may be included, and further, the number of records may reach tens of millions.

[0028] The event log data 202 is data in which values ​​indicating events that have occurred in the PLC 300 and the controlled device 400 are recorded. For example, the event log data 202 is time-series data of events such as a change in an input value of the controlled device 400, writing of firmware, and an error notification from another unit.

[0029] Fig. 5 shows an example of the event log data 202. In the event log data 202 in Fig. 5, events that occurred for "sensor A" and "sensor B" are recorded in chronological order. Note that the event log data 202 in Fig. 5 is only an example, and depending on the PLC 300, a large number of event types and record numbers may be included.

[0030] The related data 203 is data related to the analysis of the device log data 201 and the event log data 202, and is useful for the analysis of the device log data 201 and the event log data 202. For example, the related data 203 is a video of a line including the PLC 300 or the controlled device 400 to which the device log data 201 and the event log data 202 are output, project data executed by the PLC 300, the device configuration of the system including the PLC 300 and the controlled device 400, a parts list, a device simulation, and the like. The video of the line is, for example, a device monitoring video for monitoring the device. The device configuration includes information indicating the roles of the PLC 300 and the controlled device 400 in the system including the PLC 300 and the controlled device 400. The information indicating the roles is, for example, information indicating that the PLC 300 is a PLC that performs I / O processing, and information indicating that the PLC is a PLC that integrates and controls other PLCs. The device simulation is data for simulating the movement of the PLC 300 and the controlled device 400, for example, project data of 3D simulator software.

[0031] The analysis tool is a tool for analyzing the device log data 201, the event log data 202, and the related data 203. For example, the analysis tool is a tool capable of performing various numerical analyses such as correlation analysis, frequency analysis, clustering, and maximum value detection, a spreadsheet tool, a video playback tool, and the like.

[0032] For example, when the analysis operation unit 101 receives from the user a designation of a time range of the device log data 201 and the event log data 202 to be analyzed, the analysis operation unit 101 stores the device log data 201 and the event log data 202 within the designated time range as the device log data 201 and the event log data 202 to be analyzed in the database 200. When the analysis operation unit 101 receives from the user a designation of related data 203 to be analyzed, the analysis operation unit 101 associates the designated related data 203 with the device log data 201 and the event log data 202 to be analyzed and stores the associated data in the database 200. When the analysis operation unit 101 receives from the user an analysis operation such as graph display or display of correlation between data, the analysis operation unit 101 executes analysis processing such as graph display or display of correlation between data for the device log data 201 and the event log data 202 to be analyzed.

[0033] For example, when "user X" specifies a time range in response to the occurrence of a trouble in the system, the analysis operation unit 101 stores the device log data 201 and the event log data 202 in the specified time range in the database 200. In the following, it is assumed that "user X" specifies a time range from "08:00:00 on January 15, 2024" to "09:00:00 on January 15, 2024" for the device log data 201 in FIG. 4 and the event log data 202 in FIG. 5. In addition, when "user X" specifies related data 203 such as information indicating the device monitoring video, the PLC 300, and the role of the controlled device 400, the analysis operation unit 101 stores the specified related data 203 in the database 200 in association with the device log data 201 and the event log data 202 to be analyzed. Next, "user X" tried to check the device monitoring video of the related data 203, but the device monitoring video was long and he did not know which part to check. In this situation, an example will be described in which "user X" performs "analysis X" consisting of the following analysis steps (1) to (4).

[0034] "User X" used a spreadsheet tool to graph the portion of the device log data 201 in Fig. 4 for which a time range was specified (analysis step (1)). Fig. 6 shows an example of the device log data 201 graphed in the analysis step (1).

[0035] "User X" checked the graph display of the device log data 201 in Fig. 6, and focused on the relationship between "Device A" and "Device B," and used a spreadsheet tool to graph the correlation between "Device A" and "Device B" (analysis step (2)). Fig. 7 shows an example of the correlation graph displayed in the analysis step (2).

[0036] “User X” used a spreadsheet tool to display the event log data 202 in Figure 5 around the time when the correlation between the values ​​of “Device A” and “Device B” changed, i.e., around the time “January 15, 2024, 8:59:40” (analysis step (3)).

[0037] "User X" confirmed that there is a relationship between the values ​​of "Sensor A" and "Sensor B" and the values ​​of "Device A" and "Device B" because the relationship between the event values ​​of "Sensor A" and "Sensor B" changed at the time when the correlation between the values ​​of "Device A" and "Device B" changed in the event log data 202. Therefore, "User X" used a video playback tool to play the device monitoring video of "Sensor A" and "Sensor B" from around "8:59:40 on January 15, 2024," when the relationship between the event values ​​changed, and confirmed the operation (analysis step (4)). As a result, "User X" confirmed that the indicator of "Sensor B" had not changed from the time confirmed in the event log data 202.

[0038] The analysis process acquisition unit 102 acquires the operation accepted by the analysis operation unit 101 as analysis process data 204 indicating the analysis process. Then, the analysis process acquisition unit 102 stores the acquired analysis process data 204 in the database 200 in association with the device log data 201 and event log data 202 that are the analysis targets. The analysis process acquisition unit 102 is realized by the processor 11 and the communication unit 14.

[0039] The analysis process data 204 indicates the content of the analysis performed by the user, and includes information identifying the data that was the subject of the analysis, information identifying the analysis tool used in the analysis, the order of the analysis operations, and information indicating the time when the analysis was performed.

[0040] Fig. 8 shows an example of the analysis process data 204. The analysis process data 204 in Fig. 8 was acquired by the analysis process acquisition unit 102 for "analysis X" performed by "user X", and the analysis process is shown in the form of a flowchart. Steps S101 to S104 in the flowchart in Fig. 8 correspond to analysis processes (1) to (4).

[0041] For example, the analysis process acquisition unit 102 acquires analysis process data 204 for “analysis X” based on the analysis operation performed by “user X”, and stores the analysis process data 204 for “analysis X” in the database 200 in association with the device log data 201 and event log data 202 to be analyzed.

[0042] The feature data acquisition unit 103 acquires feature data 205 indicating features of the device log data 201 or the event log data 202 to be analyzed. Then, the feature data acquisition unit 103 associates the acquired feature data 205 with analysis process data 204 indicating the process of analysis performed on the device log data 201 and the event log data 202 to be analyzed, and stores the data in the database 200. The feature data acquisition unit 103 is realized by the processor 11. The feature data acquisition unit 103 is an example of a feature data acquisition means.

[0043] The feature data 205 is data indicating features of the device log data 201 or event log data 202 to be analyzed. For example, the feature data 205 includes at least one of data indicating the type of device, data indicating features of time-series changes in the value of the device, data indicating the association between the device and other devices, data indicating the type of event, data indicating time-series changes in the value indicating the event, data indicating the association between the occurrence time of the event and the occurrence time of other events, data indicating the association between the occurrence frequency of the event and the occurrence frequency of other events, and data indicating the association between the time-series changes in the value of the device and the time-series changes in the value indicating the event.

[0044] The type of device is, for example, a bit device, a word device, etc. The association between a device and another device is, for example, a correlation between a time change of a device value and a time change of a value of another device. The type of event is, for example, a change of a value, a firmware update, a PLC program write, an error, etc. The association between the occurrence time of an event and the occurrence time of another event is, for example, a correlation between the occurrence time of an event and the occurrence frequency of another event. The association between the occurrence frequency of an event and the occurrence frequency of another event is, for example, a correlation between the occurrence frequency of an event and the occurrence frequency of another event. The association between the time series change of a device value and the time series change of a value indicating an event is, for example, a relationship indicating whether or not a change in a device value and a change in a value indicating an event are synchronized.

[0045] For example, the feature data acquisition unit 103 acquires feature data 205 of the device log data 201 or event log data 202 that was the subject of analysis by “user X,” and stores the acquired feature data 205 in the database 200 in association with the device log data 201 and event log data 202 that were the subject of analysis.

[0046] The analysis result acquisition unit 104 acquires analysis result data 206 indicating the results of the analysis. Then, the analysis result acquisition unit 104 stores the acquired analysis result data 206 in the database 200 in association with the analysis process data 204. The analysis result acquisition unit 104 is realized by the processor 11, the communication unit 14, and the input unit 15.

[0047] The analysis result data 206 is data indicating whether the analysis performed by the user was successful or not. Whether the analysis was successful or not is determined by the user who performed the analysis. For example, the user determines whether the analysis was successful or not based on whether the countermeasures taken against the trouble after the analysis were successful or not.

[0048] For example, when "user X" inputs data indicating that "analysis X" of analysis steps (1) to (4) was successful to analysis support device 100, analysis result acquisition unit 104 acquires analysis result data 206 indicating that "analysis X" was successful. Then, analysis result acquisition unit 104 stores analysis result data 206 indicating that "analysis X" was successful in database 200 in association with analysis step data 204 for "analysis X."

[0049] The countermeasure process acquisition unit 105 acquires countermeasure process data 207 indicating the process of the countermeasure taken by the user on the PLC 300 or the controlled device 400. Then, the countermeasure process acquisition unit 105 stores the acquired countermeasure process data 207 in the database 200 in association with the analysis process data 204. The countermeasure process acquisition unit 105 is realized by the processor 11, the communication unit 14, and the input unit 15.

[0050] The countermeasure process data 207 indicates the contents of the countermeasure that the user has taken for the PLC 300 or the controlled device 400. The countermeasures include, for example, stopping the PLC 300 or the controlled device 400, replacing the PLC 300 or the controlled device 400, test running the PLC 300 or the controlled device 400 after the replacement, checking the log data during the test run, updating the parts list, updating the firmware of the PLC 300, changing the device configuration, and the like.

[0051] In the following, an example will be described in which "user X" performs "analysis X" and then performs "measure X" consisting of measures (1) to (5).

[0052] “User X” stopped “sensor B” and the device related to “sensor B” in order to replace “sensor B” (countermeasure step (1)).

[0053] “User X” replaced “Sensor B” (countermeasure process (2)).

[0054] After replacing “Sensor B”, “User X” performed a test run of “Sensor B” and the equipment related to “Sensor B” to check whether the replaced “Sensor B” was working properly (countermeasure step (3)).

[0055] “User X” confirmed in the log data during the trial run that the replaced “sensor B” was working properly (countermeasure process (4)).

[0056] “User X” updated the information of “Sensor B” before the replacement to the information of “Sensor B” after the replacement in the parts list (countermeasure process (5)).

[0057] Fig. 9 shows an example of countermeasure process data 207. The countermeasure process data 207 in Fig. 9 was acquired by countermeasure process acquisition unit 105 for "countermeasure X" taken by "user X", and the countermeasure process is shown in the form of a flowchart. Steps S201 to S205 in the flowchart in Fig. 9 correspond to countermeasure processes (1) to (5).

[0058] For example, when "user X" inputs data indicating the contents of countermeasure steps (1) to (5) to analysis support device 100, countermeasure step acquisition unit 105 acquires countermeasure step data 207 for "countermeasure X." Then, countermeasure step acquisition unit 105 stores countermeasure step data 207 for "countermeasure X" in database 200 in association with analysis step data 204 for "analysis X."

[0059] The similarity calculation unit 106 calculates a similarity between feature data 205 stored in the database 200 in association with analysis step data 204 indicating a step of analysis performed on the device log data 201 or the event log data 202, and the feature data 205 acquired by the feature data acquisition unit 103. The similarity calculation unit 106 is realized by the processor 11, the communication unit 14, and the input unit 15. The similarity calculation unit 106 is an example of a similarity calculation means.

[0060] For example, when "user Y" specifies a time range from "February 25, 2024, 8:00:00" to "February 25, 2024, 9:00:00" in response to the occurrence of a trouble in the system, the analysis operation unit 101 stores the device log data 201 and event log data 202 in the specified time range in the database 200 as the device log data 201 and event log data 202 to be analyzed. FIG. 10 shows the device log data 201 in the time range specified by "user Y". FIG. 11 shows the event log data 202 in the time range specified by "user Y". When "user Y" specifies related data 203 such as the device monitoring video, information indicating the roles of the PLC 300 and the controlled device 400, the analysis operation unit 101 stores the specified related data 203 in the database 200 in association with the device log data 201 and event log data 202 to be analyzed.

[0061] Next, when "user Y" selects a button requesting the presentation of analytical know-how in the analysis support device 100, the feature data acquisition unit 103 acquires feature data 205 indicating the features of the device log data 201 and the features of the event log data 202 in the time range specified by "user Y". Then, the similarity calculation unit 106 calculates the similarity between the feature data 205 stored in the database 200 and the feature data 205 indicating the features of the device log data 201 or the features of the event log data 202 in the time range specified by "user Y" according to the method indicated in the similarity calculation method data 208.

[0062] The similarity calculation method data 208 indicates a method for calculating the similarity, and is set by a user of the analysis support device 100. For example, the similarity calculation method data 208 indicates a method in which, in the feature data 205 indicating the features of the device log data 201 or the event log data 202 to be analyzed by the user and the feature data 205 stored in the database 200, "1" is added each time there is data that is determined to be the same based on a criterion previously determined by the user among the data (1) indicating the type of device, the data (2) indicating the features of the time series change of the device value, the data (3) indicating the association between the device and other devices, the data (4) indicating the type of event, the data (5) indicating the time series change of the value indicating the event, the data (6) indicating the association between the occurrence time of the event and the occurrence time of other events, the data (7) indicating the association between the occurrence frequency of the event and the occurrence frequency of other events, and the data (8) indicating the association between the time series change of the device value and the time series change of the value indicating the event.

[0063] For example, when the similarity calculation unit 106 determines that all of the above data (1) to (8) in the feature data 205 associated with the device log data 201 and event log data 202 that the user is analyzing matches the feature data 205 stored in the database 200, it calculates the similarity to be “8”.

[0064] The similarity calculation unit 106 corrects the similarity based on information indicating the roles of the PLC 300 and the controlled device 400 in a system including the PLC 300 and the controlled device 400 .

[0065] For example, the similarity calculation method data 208 indicates a method of adding "1" when the same role is indicated in the information indicating the role included in the related data 203. For example, when the information indicating the role included in the related data 203 associated with the device log data 201 and event log data 202 to be analyzed and the information indicating the role included in the associated data 203 associated with the device log data 201 and event log data 202 for which the similarity "8" is obtained and stored in the database 200 indicate that both are a PLC that controls other PLCs in an integrated manner, the similarity calculation unit 106 adds "1" to the similarity "8" to obtain a similarity of "9".

[0066] The similarity calculation section 106 corrects the similarity based on the analysis result data 206 indicating whether the analysis of the process indicated by the analysis process data 204 was successful or not.

[0067] For example, the similarity calculation method data 208 further indicates a method of adding "1" when the analysis result data 206 indicates that the analysis was successful. For example, when the analysis result data 206 indicating that the analysis was successful corresponds to the analysis step data 204 of the device log data 201 and the event log data 202 for which the similarity "9" stored in the database 200 is found, the similarity calculation unit 106 adds "1" to the similarity "9" to find a similarity of "10."

[0068] The similarity calculation unit 106 corrects the similarity based on information indicating the time when the analysis of the process indicated by the analysis process data 204 was performed.

[0069] For example, the similarity calculation method data 208 indicates a method of adding "1" when the information indicating the time when the analysis was performed, which is included in the analysis process data 204, indicates the time closest to the present, that is, when the analysis of the analysis process data 204 is the most recent. For example, when the analysis process data 204 of the most recent analysis is associated with the device log data 201 and event log data 202 stored in the database 200 for which the similarity "10" was calculated, the similarity calculation unit 106 adds "1" to the similarity "10" to calculate a similarity of "11".

[0070] The extraction unit 107 extracts, based on the similarity calculated by the similarity calculation unit 106, analysis process data 204 associated with feature data similar to the feature data 205 acquired by the feature data acquisition unit 103 from the database 200. The extraction unit 107 is realized by the processor 11, the communication unit 14, and the input unit 15. The extraction unit 107 is an example of an extraction means.

[0071] For example, the extraction unit 107 extracts, from the database 200, analysis process data 204 associated with feature data 205 that is found to have a similarity equal to or greater than a predetermined threshold value with respect to feature data 205 of device log data 201 and event log data 202 that are the analysis targets of “user Y.” The threshold value is set by the user of the analysis support device 100.

[0072] The presentation unit 108 presents the analysis process data 204 extracted by the extraction unit 107 as analysis know-how. The presentation unit 108 is realized by the processor 11, the communication unit 14, the input unit 15, and the output unit 16. The presentation unit 108 is an example of a presentation means.

[0073] The analytical know-how is information that is useful when a user analyzes log data. In addition to the analytical process data 204 extracted by the extraction unit 107, the presentation unit 108 may present, as the analytical know-how, the device log data 201, the event log data 202, the related data 203, and the feature data 205 associated with the analytical process data 204. The data presented by the presentation unit 108 as the analytical know-how can be specified by the user.

[0074] Here, the presenting unit 108 displays the analytical know-how in a list in order of similarity.

[0075] For example, the extraction unit 107 extracts a plurality of analysis process data 204-1 to 204-10, and the similarities obtained for the feature data 205 associated with the device log data 201 and the event log data 202 of the analysis process data 204-1 to 204-10 are assumed to be “S1” to “S10.” In this case, the presentation unit 108 displays a list of the analysis know-how including the analysis process data 204-1 to 204-10 in descending order of the similarities “S1” to “S10”.

[0076] Moreover, the presentation unit 108 presents the countermeasure process data 207 associated with the analysis process data 204 extracted by the extraction unit 107 .

[0077] For example, when the analysis process data 204-1 is selected by the user from among the analysis process data 204-1 to 204-10 presented as the analysis know-how, the presentation unit 108 acquires the countermeasure process data 207-1 associated with the selected analysis process data 204-1 from the database 200 and presents the countermeasure process data 207-1 to the user.

[0078] The analysis application unit 109 applies the analysis of a process indicated by the analysis process data 204 selected by the user from among the analysis process data 204 presented as analytical know-how, to the device log data 201 or the event log data 202 from which the feature data 205 has been acquired by the feature data acquisition unit 103. The analysis application unit 109 is realized by the processor 11, the communication unit 14, the input unit 15, and the output unit 16. The analysis application unit 109 is an example of an analysis application means.

[0079] For example, when the analysis process data 204-1 is selected by "user Y" from among the analysis process data 204-1 to 204-10 included in the displayed analytical know-how, the analysis application unit 109 applies the analysis of the process of the analysis process data 204-1 to the device log data 201 and event log data 202 that are the analysis targets of "user Y". For example, if the analysis process of the analysis process data 204-1 is the analysis process (1) to analysis process (4) of "analysis X", the analysis application unit 109 applies the analysis process (1) of "analysis X" to the device log data 201 and event log data 202 that are the analysis targets of "user Y", and executes a graph display similar to that of FIG. 6, as shown in FIG. 12. In addition, the analysis application unit 109 applies the analysis process (2) of "analysis X" to the device log data 201 and event log data 202 that are the analysis targets of "user Y", and executes a graph display similar to that of FIG. 7, as shown in FIG. 13. The analysis application unit 109 also applies the analysis step (3) of "Analysis X" to the device log data 201 and event log data 202 that "User Y" is to analyze, and displays the event log data 202 in Fig. 11 using a spreadsheet tool. The analysis application unit 109 also applies the analysis step (4) of "Analysis X" to the device log data 201 and event log data 202 that "User Y" is to analyze, and puts the video playback tool on standby so that the device monitoring videos of "Sensor A" and "Sensor B" can be played from around "February 25, 2024, 8:59:40" when the relationship between the event values ​​changed.

[0080] Next, the analytical know-how accumulation process performed by analysis support device 100 according to this embodiment will be described with reference to the flowchart of Fig. 14. The accumulation process of Fig. 14 is executed, for example, when a user starts an analysis in analysis support device 100.

[0081] The analysis operation unit 101 associates the device log data 201 and event log data 202 in the time range specified by the user with the related data 203 specified by the user and stores them in the database 200 (step S301). Next, the analysis process acquisition unit 102 acquires the operation accepted by the analysis operation unit 101 from the user as analysis process data 204 indicating the analysis process, and stores the acquired analysis process data 204 in the database 200 in association with the device log data 201 and event log data 202 to be analyzed (step S302). In addition, the feature data acquisition unit 103 acquires feature data 205 indicating the feature of the device log data 201 or the feature of the event log data 202 to be analyzed, and stores the acquired feature data 205 in the database 200 in association with the device log data 201 and event log data 202 to be analyzed (step S303). Then, the analysis result acquiring unit 104 acquires analysis result data 206 indicating the result of the analysis, and stores the acquired analysis result data 206 in the database 200 in association with the analysis process data 204 (step S304). Furthermore, the countermeasure process acquiring unit 105 acquires countermeasure process data 207 indicating the process of the countermeasure taken by the user on the PLC 300 or the controlled device 400, and stores the acquired countermeasure process data 207 in the database 200 in association with the analysis process data 204 (step S305).

[0082] For example, the analysis operation unit 101 stores the device log data 201 and the event log data 202 from the time range "January 15, 2024, 8:00:00" to "January 15, 2024, 9:00:00" specified by "User X" and the specified related data 203 in the database 200. Next, the analysis process acquisition unit 102 acquires the analysis process data 204 of "Analysis X" based on the analysis operation performed by "User X", associates the analysis process data 204 of "Analysis X" with the device log data 201 and the event log data 202 to be analyzed, and stores the data in the database 200. In addition, the analysis operation unit 102 acquires the feature data 205 of the device log data 201 or the event log data 202 to be analyzed by "User X", and stores the acquired feature data 205 in the database 200 in association with the device log data 201 and the event log data 202 to be analyzed. The analysis result acquisition unit 104 acquires analysis result data 206 indicating that "analysis X" was successful based on the input of "user X", and stores the data in the database 200 in association with the analysis process data 204 of "analysis X". Furthermore, the countermeasure process acquisition unit 105 acquires countermeasure process data 207 indicating the contents of "countermeasure X" based on the input of "user X", and stores the acquired countermeasure process data 207 of "countermeasure X" in the database 200 in association with the analysis process data 204 of "analysis X".

[0083] Next, a process of utilizing analytical know-how executed by the analysis support device 100 according to this embodiment will be described with reference to the flowchart in Fig. 15. The process of utilizing analytical know-how in Fig. 15 is executed, for example, when a user stores the device log data 201 and event log data 202 to be analyzed and the related data 203, and selects a button for requesting the presentation of analytical know-how.

[0084] The feature data acquisition unit 103 acquires feature data 205 indicating the feature of the device log data 201 or the feature of the event log data 202 to be analyzed, and stores the acquired feature data 205 in the database 200 (step S401). The similarity calculation unit 106 calculates the similarity between the feature data 205 acquired in step S401 and the feature data 205 stored in the database 200 (step S402). The extraction unit 107 extracts, based on the similarity calculated in step S402, the analysis process data 204 associated with the feature data similar to the feature data 205 acquired in step S401 from the database 200 (step S403). The presentation unit 108 presents the analysis process data 204 extracted in step S403 as analysis know-how (step S404). The analysis application unit 109 applies the analysis of the process indicated by the analysis process data 204 selected by the user from among the analysis process data 204 presented as the analysis know-how in step S404 to the device log data 201 and the event log data 202 from which the feature data was acquired in step S401 (step S405). In addition, the presentation unit 108 presents the countermeasure process data 207 associated with the analysis process data 204 extracted in step S403 (step S406).

[0085] For example, the feature data acquisition unit 103 acquires feature data 205 indicating the features of the device log data 201 and the features of the event log data 202 in the time range from "February 25, 2024, 8:00:00" to "February 25, 2024, 9:00:00" specified by "User Y". The similarity calculation unit 106 calculates the similarity between the acquired feature data 205 and the feature data 205 stored in the database 200 according to the method indicated in the similarity calculation method data 208. The extraction unit 107 extracts, from the database 200, the analysis process data 204 associated with the feature data 205 for which a similarity equal to or greater than a predetermined threshold is calculated for the acquired feature data 205. Then, the presentation unit 108 displays a list of analysis know-how including the analysis process data 204-1 to 204-10 in descending order of similarity "S1" to "S10". Furthermore, when the analysis process data 204-1 is selected by "user Y" from among the analysis process data 204-1 to 204-10, the presentation unit 108 acquires the countermeasure process data 207-1 associated with the selected analysis process data 204-1 from the database 200, and presents the countermeasure process data 207-1. When the analysis know-how including the analysis process data 204-1 is selected by "user Y" from among the analysis know-how, the analysis application unit 109 applies the analysis of the process of the analysis process data 204-1 to the device log data 201 and the event log data 202 that are the analysis targets of "user Y".

[0086] According to this embodiment, the user can check the analysis steps performed in the past as analysis know-how. As a result, for example, a novice maintenance person can perform an analysis and deal with a problem by referring to the analysis steps performed in the past by a veteran maintenance person, thereby shortening the time required for solving the problem.

[0087] Furthermore, according to the present embodiment, the analysis process performed on log data having characteristics similar to those of the log data that the user is to analyze is presented to the user, thereby allowing the user to confirm analytical know-how that is useful for the analysis that the user is to perform.

[0088] According to the present embodiment, the similarity used to extract the analysis process data is corrected based on the role of the programmable logic controller or the controlled device, so that, for example, analysis know-how performed on the programmable logic controller or the controlled device having the same role in the system can be presented preferentially.

[0089] According to the present embodiment, the similarity used to extract the analysis process data is corrected based on whether the analysis performed in the past was successful or not. This makes it possible to preferentially present analytical know-how that has been successfully analyzed on a programmable logic controller or a controlled device, for example.

[0090] According to the present embodiment, the similarity used to extract the analysis process data is corrected based on the time when the analysis was performed, which allows the analysis know-how based on the more recent analysis performed on the programmable logic controller or the controlled device to be presented preferentially.

[0091] Furthermore, according to this embodiment, analytical know-how is displayed in a list in order of similarity, which allows the user to easily confirm and compare a plurality of analytical know-how.

[0092] Furthermore, according to this embodiment, the analytical know-how selected by the user is applied to new log data, thereby making it possible to automate the analysis.

[0093] Furthermore, according to the present embodiment, measures taken based on past analyses are presented to the user, allowing the user to easily check measures taken in the past and shortening the time it takes to consider measures that the user should take.

[0094] (Modification) Although the embodiment of the present disclosure has been described above, various modifications and applications are possible in implementing the present disclosure.

[0095] In the above embodiment, the analysis support system 1 shown in FIG. 1 is described as having the analysis support device 100 and the database 200 as separate devices, but they may be configured as a single device.

[0096] In the above embodiment, the related data 203 is stored in the database 200 in response to a user's designation, but this is not limited to the above. The related data 203 may be automatically acquired and stored in the database 200 when the analysis operation unit 101 receives a designation of a time range for the device log data 201 and the event log data 202.

[0097] In the above embodiment, the flowchart of the accumulation process executed by analysis support device 100 is shown in Fig. 14, but the order of the processes of the steps is not limited to this. For example, the order of steps S302 and S303 in Fig. 14 may be interchanged. Also, the order of steps S304 and S305 in Fig. 14 may be interchanged.

[0098] In the above embodiment, the flowchart of the utilization process executed by analysis support device 100 is shown in Fig. 15, but the order of the processes of the steps is not limited to this. For example, the order of steps S405 and S406 in Fig. 15 may be interchanged.

[0099] In addition, by applying an operating program that specifies the operation of the analysis support device 100 according to the above embodiment to an existing personal computer or information terminal device, it is also possible to cause the personal computer or information terminal device to function as the analysis support device 100 according to the embodiment.

[0100] Furthermore, the method of distribution of such a program is arbitrary; for example, the program may be stored on a computer-readable recording medium such as a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), or a memory card and distributed, or the program may be distributed via a communications network such as the Internet.

[0101] Various embodiments and modifications of the present disclosure are possible without departing from the broad spirit and scope of the present disclosure. The above-described embodiments are for explaining the present disclosure and do not limit the scope of the present disclosure. In other words, the scope of the present disclosure is indicated by the claims, not the embodiments. Various modifications made within the scope of the claims and the scope of the disclosure equivalent thereto are considered to be within the scope of the present disclosure. [Industrial Applicability]

[0102] According to the present disclosure, it is possible to provide a program, an analysis support device, an analysis support system, and an analysis support method that are capable of presenting data indicating past analysis processes extracted based on characteristics of log data as analysis know-how. [Explanation of symbols]

[0103] 1 Analysis support system, 10 Information processing device, 11 Processor, 12 Main memory unit, 13 Auxiliary memory unit, 14 Communication unit, 15 Input unit, 16 Output unit, 17 Bus, 100 Analysis support device, 101 Analysis operation unit, 102 Analysis process acquisition unit, 103 Feature data acquisition unit, 104 Analysis result acquisition unit, 105 Countermeasure process acquisition unit, 106 Similarity calculation unit, 107 Extraction unit, 108 Presentation unit, 109 Analysis application unit, 200 Database, 201 Device log data, 202 Event log data, 203 Related data, 204 Analysis process data, 205 Feature data, 206 Analysis result data, 207 Countermeasure process data, 208 Similarity calculation method data, 300 PLC, 400 Controlled device, 500 Communication network.

Claims

1. Computers, Feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded. Similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. A presentation means that presents the analysis process data extracted by the extraction means as analysis know-how. To make it function as, The similarity calculation means corrects the similarity based on information indicating the role of the programmable logic controller or the controlled device in a system including the programmable logic controller and the controlled device. program.

2. A computer, Feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded. Similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. A presentation means that presents the analysis process data extracted by the extraction means as analysis know-how. To make it function as, The similarity calculation means corrects the similarity based on analysis result data indicating whether the analysis of the process shown in the analysis process data was successful or not. program.

3. A computer, Feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded. Similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. A presentation means that presents the analysis process data extracted by the extraction means as analysis know-how. To make it function as, The similarity calculation means corrects the similarity based on information indicating when the analysis of the process shown in the analysis process data was performed. program.

4. The characteristic data includes at least one of the following: data indicating the type of device, data indicating the characteristics of the time-series change in the value of the device, data indicating the relationship between the device and other devices, data indicating the type of event, data indicating the time-series change in the value representing the event, data indicating the relationship between the occurrence time of the event and the occurrence time of other events, data indicating the relationship between the occurrence frequency of the event and the occurrence frequency of other events, and data indicating the relationship between the time-series change in the value of the device and the time-series change in the value representing the event. The program according to any one of claims 1 to 3.

5. The aforementioned display means displays the analysis know-how in a list in order of similarity. The program according to any one of claims 1 to 3.

6. The aforementioned computer, An analysis application means that applies the analysis of the process indicated by the analysis process data selected by the user from among the analysis process data presented as the aforementioned analysis know-how to the device log data or event log data from which feature data has been acquired by the feature data acquisition means. A program according to any one of claims 1 to 3 that functions as such.

7. The database stores countermeasure process data that indicates the steps of countermeasures taken by the user against the programmable logic controller or the controlled device, in correspondence with the analysis process data. The presentation means presents the countermeasure process data associated with the analysis process data extracted by the extraction means. The program according to any one of claims 1 to 3.

8. A feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded, A similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. The system includes a presentation means that presents the analysis process data extracted by the extraction means as analysis know-how, The similarity calculation means corrects the similarity based on information indicating the role of the programmable logic controller or the controlled device in a system including the programmable logic controller and the controlled device. Analysis support equipment.

9. A feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used as a control device of the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the control device are recorded, A similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. The system includes a presentation means that presents the analysis process data extracted by the extraction means as analysis know-how, The similarity calculation means corrects the similarity based on analysis result data indicating whether the analysis of the process shown in the analysis process data was successful or not. Analysis support equipment.

10. A feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used as a control device of the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the control device are recorded, A similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. The system includes a presentation means that presents the analysis process data extracted by the extraction means as analysis know-how, The similarity calculation means corrects the similarity based on information indicating when the analysis of the process shown in the analysis process data was performed. Analysis support equipment.

11. A feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded, A similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. A presentation means that presents the analysis process data extracted by the extraction means as analysis know-how, The system comprises a database that stores the device log data, the event log data, the analysis process data, and the feature data in association with each other as analysis know-how, The similarity calculation means corrects the similarity based on information indicating the role of the programmable logic controller or the controlled device in a system including the programmable logic controller and the controlled device. Analysis support system.

12. A feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used as a control device of the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the control device are recorded, A similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. A presentation means that presents the analysis process data extracted by the extraction means as analysis know-how, The system comprises a database that stores the device log data, the event log data, the analysis process data, and the feature data in association with each other as analysis know-how, The similarity calculation means corrects the similarity based on analysis result data indicating whether the analysis of the process shown in the analysis process data was successful or not. Analysis support system.

13. A feature data acquisition means for acquiring feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used as a control device of the programmable logic controller are recorded, or the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the control device are recorded, A similarity calculation means for determining the similarity between feature data stored in a database in association with analysis process data indicating the steps of the analysis performed on the device log data or the event log data, and feature data acquired by the feature data acquisition means. Based on the similarity calculated by the similarity calculation means, an extraction means extracts analysis process data from the database that is associated with feature data similar to the feature data acquired by the feature data acquisition means. A presentation means that presents the analysis process data extracted by the extraction means as analysis know-how, The system comprises a database that stores the device log data, the event log data, the analysis process data, and the feature data in association with each other as analysis know-how, The similarity calculation means corrects the similarity based on information indicating when the analysis of the process shown in the analysis process data was performed. Analysis support system.

14. An analytical support method performed by an analytical support device, The aforementioned analysis support device The programmable logic controller acquires feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or feature data that indicates the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded. The similarity between the feature data stored in the database, which is associated with the analysis process data showing the steps taken to analyze the device log data or the event log data, and the acquired feature data is calculated. Based on information indicating the role of the programmable logic controller or the controlled device in a system including the programmable logic controller and the controlled device, the similarity is corrected. Analysis process data, which is associated with feature data similar to the feature data obtained based on the similarity, is extracted from the database. The extracted analysis process data is presented as analytical know-how. Analysis support method.

15. An analytical support method performed by an analytical support device, The aforementioned analysis support device The programmable logic controller acquires feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or feature data that indicates the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded. The similarity between the feature data stored in the database, which is associated with the analysis process data showing the steps taken to analyze the device log data or the event log data, and the acquired feature data is calculated. Based on the analysis result data indicating whether the analysis of the process shown in the aforementioned analysis process data was successful or not, the similarity is corrected. Analysis process data, which is associated with feature data similar to the feature data obtained based on the similarity, is extracted from the database. The extracted analysis process data is presented as analytical know-how. Analysis support method.

16. An analytical support method performed by an analytical support device, The aforementioned analysis support device The programmable logic controller acquires feature data that indicates the characteristics of device log data in which values ​​of a programmable logic controller or a device used to control the programmable logic controller are recorded, or feature data that indicates the characteristics of event log data in which values ​​indicating an event that occurred in the programmable logic controller or the device to be controlled are recorded. The similarity between the feature data stored in the database, which is associated with the analysis process data showing the steps taken to analyze the device log data or the event log data, and the acquired feature data is calculated. Based on the information indicating when the analysis of the process shown in the aforementioned analysis process data was performed, the similarity is corrected. Analysis process data, which is associated with feature data similar to the feature data obtained based on the similarity, is extracted from the database. The extracted analysis process data is presented as analytical know-how. Analysis support method.

Images