PLC Event Log Visualization for Root Cause Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In networking and multi-functionalized control systems, identifying the root cause of abnormalities is challenging due to the generation of a large number of event logs from various devices and functional units, often resulting in overlapping and unrelated abnormality messages from the same underlying factor.
Innovation Solution
An information processing device and method that hierarchically expresses event logs, including content, generation time, and source, to facilitate the identification of common factors by collecting and extracting event logs from multiple sources, using configuration information to group and classify logs by generation time and network connections, and providing a user interface for visualizing physical and logical connections to correlate events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If event logs are collected from multiple devices and functional units in a networked control system, then the ability to investigate malfunctions is improved, but the complexity of analyzing and specifying the root cause deteriorates due to the large volume of overlapping logs
Solution Approach 1:
The patent segments the large volume of event logs by organizing them into hierarchical groups based on common factors. The extraction unit divides logs into multiple groups where each group shares a common underlying cause, and designates a representative log for each group. This segmentation transforms the analysis task from examining all individual logs to examining only the representative logs, significantly reducing analysis complexity while maintaining complete investigative capability.
2Loss of information
If all event logs are displayed to provide complete information about system abnormalities, then the completeness of fault information is improved, but the ease of identifying the root cause deteriorates due to information overload
Solution Approach 1:
The patent extracts and displays only the representative event logs from each group of logs sharing a common factor. The output unit is configured to output the representative log that characterizes each group, eliminating redundant duplicate information while preserving all unique fault scenarios. This extraction approach maintains complete fault information coverage while dramatically improving ease of root cause identification by presenting only the essential distinct logs.
3Reliability
If event logs from multiple sources are collected to ensure comprehensive monitoring, then the coverage of monitored abnormalities is improved, but the time required to specify the generating factor deteriorates due to the need to process large volumes of data
Solution Approach 1:
The patent segments logs into groups with common factors and identifies representative logs for each group, reducing the processing scope from all collected logs to only the representative subset. This segmentation maintains comprehensive monitoring coverage because all fault scenarios are still captured in the groups, while significantly reducing factor specification time by requiring analysis of only the representative logs rather than every individual log entry.
Solution Approach 2:
The patent extracts the essential representative logs that characterize each group of related events, removing redundant information that would otherwise require processing time. The extraction unit identifies and outputs only these key representative logs, preserving complete monitoring coverage while minimizing the time required to analyze and specify generating factors.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device and a method for monitoring a networked PLC system, wherein all the abnormalities (events) generated by the devices (100,150) of the system are collected in a central event log (241) on a user terminal (200), then grouped based on generation times (242), classified into main and secondary event logs (243) and the cause of the error is identified and displayed to the user together with various informations on the event logs. Advanced knowledge and a verification time are required to narrow the problem from a large amount of generated event logs to specify the cause. It is necessary to analyze the troubleshooting of the abnormality generated in the network with a combination of pieces of information such as the physical connection, the logical connection, and the generation time relationship. It is necessary for the user to consider various pieces of necessary information in addition to the content of the event log. The visualization is achieved such that both the physical connection and the logical connection can be understood and the detected event (event log) is visually displayed while correlated with the visualized physical connection and logical connection. The control system of the embodiment displays the whole or a part of the state or the generated event log of the control system extending over the plural devices.