JP7558735B2 - Programmable logic controller and analytical device - Google Patents

Description

The present invention relates to a programmable logic controller and an analytical device.

A programmable logic controller (PLC) is a controller that controls industrial machinery such as manufacturing equipment, conveying equipment, and inspection equipment in factory automation (Patent Documents 1 and 2). PLCs control various extension units and controlled devices by executing user programs such as ladder programs created by programmers.

Patent No. 5661222 JP 2018-097662 A

In order to monitor the operation of a PLC or the operation of industrial machinery controlled by a PLC, it is desirable to collect and utilize the data held by the PLC. A PLC has a base unit (CPU unit) and an expansion unit connected to it. The base unit controls the expansion unit by executing user programs such as ladder programs. The expansion unit controls the industrial machinery according to commands from the base unit and returns the control results to the base unit.

These control results and other data are used for troubleshooting and quality control. Therefore, it is required to accumulate and analyze these data and obtain analysis results early for recovery. However, if data on all devices related to the PLC is recorded, a huge amount of data will be stored, and in order to identify the abnormal device, it is necessary to analyze this huge amount of data (all devices), which is a time-consuming task. Conventionally, a specific device was analyzed as the analysis target, and an abnormality was automatically determined, and the analysis method used was also prepared in advance to match the data. Experience and knowledge are also required to select a specific device and determine the analysis method. Therefore, in addition to storing a huge amount of data appropriately, a mechanism is desired that efficiently identifies abnormal devices from the huge amount of data related to each device without requiring sufficient specialized knowledge or experience.

In view of the above problems, the present invention aims to analyze and classify characteristics such as periodicity and continuity of data related to each device, and efficiently identify abnormal devices.

The present invention relates to, for example, a programmable logic controller,
an execution engine for repeatedly executing a user program;
a device memory having a plurality of devices which are storage areas for storing data accessed by the execution engine according to the user program;
a collection means for collecting data held in a collection target device among the plurality of devices in accordance with a predetermined collection setting for each execution cycle of the user program;
A classification means for classifying each device into one of a plurality of types based on characteristics of the time-series data of each device collected by the collection means;
A determination means for determining a detection algorithm for identifying each device as an abnormal device according to the time-series data of the device collected by the collection means and the type into which the device is classified by the classification means;
a device identification unit that identifies an abnormal device by analyzing the time-series data of the device collected by the collection unit according to the type into which the device is classified by the classification unit, using the detection algorithm determined by the determination unit for the device ;
The types include at least two types among a bit device type having a constant value, a bit device type whose value changes in a steady pattern in synchronization with the operation cycle of the programmable logic controller, a bit device type whose value changes in a steady pattern in synchronization with a period different from the operation cycle, a bit device type whose value changes irregularly, an analog value type, and a type whose value monotonically increases or decreases .

The present invention also provides an analysis device communicably connected to a programmable logic controller, the analysis device comprising, for example, an execution engine that repeatedly executes a user program, a device memory having a plurality of devices that are storage areas for storing data accessed by the execution engine in accordance with the user program, and collection means that collects data held in a collection target device among the plurality of devices in accordance with a predetermined collection setting for each scan period of the user program,
an acquisition means for acquiring the time series data of each device collected by the collection means from the programmable logic controller;
A classification means for classifying each device into one of a plurality of types based on the characteristics of the time-series data of each device acquired by the collection means;
A determination means for determining a detection algorithm for identifying each device as an abnormal device according to the time-series data of the device collected by the collection means and the type into which the device is classified by the classification means;
an identification means for identifying an abnormal device by analyzing the time series data of the device collected by the collection means according to the type into which the device is classified by the classification means, using the detection algorithm determined by the determination means for the device;
an output unit that outputs a result of the determination by the determination unit ;
The types include at least two types among a bit device type having a constant value, a bit device type whose value changes in a steady pattern in synchronization with the operation cycle of the programmable logic controller, a bit device type whose value changes in a steady pattern in synchronization with a period different from the operation cycle, a bit device type whose value changes irregularly, an analog value type, and a type whose value monotonically increases or decreases .

According to the present invention, it is possible to analyze and classify characteristics such as periodicity and continuity of data related to each device, and efficiently identify abnormal devices.

Diagram showing a PLC system Diagram explaining a PC Diagram explaining a PC Diagram explaining PLC Diagram explaining the basic unit Diagram explaining the data utilization unit Diagram explaining the expansion unit Diagram explaining the data record format Diagram explaining transfer timing Diagram explaining data compression Flowchart showing the overall flow Diagram showing classification of collected data Flowchart showing the classification process Flowchart showing the classification process Data type diagram Flowchart showing the processing steps of the learning phase Flowchart showing the processing steps of the estimation phase Diagram explaining the method for determining anomalies A diagram showing an example of the results of a search FIG. 13 shows a modified example of collected data. Flowchart showing a process for outputting a monitoring start signal Flowchart showing the procedure for additional learning

The embodiments are described in detail below with reference to the attached drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of features described in the embodiments are necessarily essential to the invention. Any combination of two or more features among the multiple features described in the embodiments may be used. In addition, the same reference numbers are used for the same or similar configurations, and duplicate descriptions are omitted. Lowercase letters may be added to the end of reference numbers indicating the same or similar elements. When matters common to multiple elements are described, the lowercase letters are omitted.

First Embodiment
<System Configuration>
A first embodiment of the present invention will be described below. First, in order to allow those skilled in the art to better understand programmable logic controllers (PLCs, which may also be simply called programmable controllers), the configuration and operation of a typical PLC will be described.

Figure 1 is a conceptual diagram showing an example of the configuration of a programmable logic controller system according to an embodiment of the present invention. As shown in Figure 1, this system includes a PC 2a for editing user programs such as ladder programs, and a PLC (Programmable Logic Controller) 1 for comprehensively controlling various control devices installed in a factory or the like. PC is an abbreviation for personal computer. The user program may be created using a graphical programming language such as a ladder language or a motion program in a flow chart format such as SFC (Sequential Function Chart), or may be created using a high-level programming language such as C language. In the following, for convenience of explanation, the user program is referred to as a ladder program. The PLC 1 includes a basic unit 3 with a built-in CPU, and one or more expansion units 4. One or more expansion units 4 are detachable from the basic unit 3.

The basic unit (also called the CPU unit) 3 is equipped with a display unit 5 and an operation unit 6. The display unit 5 can display the operating status of each expansion unit 4 attached to the basic unit 3. The display unit 5 switches the display content according to the operation content of the operation unit 6. The display unit 5 usually displays the current value (device value) of the device in the PLC 1 and error information generated in the PLC 1. Here, the device includes various devices (relays, timers, counters, etc.) included in the basic unit 3 and the expansion unit 4, and also refers to an area on the memory provided to store the device value (device data), and may be called a device memory. The device memory is a non-volatile memory and may be composed of a rewritable non-volatile ROM, or a volatile RAM or the like may be made non-volatile by a battery backup or the like. ROM is an abbreviation for read-only memory. RAM is an abbreviation for random access memory. The device value is information indicating the input state from the input device, the output state to the output device, and the state of the internal relay (auxiliary relay), timer, counter, data memory, etc. set on the user program. Device values are classified into bit and word types. A bit device stores a one-bit device value, such as 0/1, ON/OFF, H/L, etc. A word device stores a one-word device value. A variable may be specified as a device to be collected by a data utilization program described in detail below. A variable is also a storage means for storing information, and is accessed by an execution engine according to a user program. Therefore, in the following description, a device also refers to a variable. A memory that stores a device may be called a device memory. A memory that stores collected data may be called a data memory.

The expansion unit 4 is provided to expand the functions of the PLC 1. A field device (controlled device) 10 corresponding to the function of each expansion unit 4 may be connected to each expansion unit 4, and each field device 10 is thereby connected to the basic unit 3 via the expansion unit 4. The field device 10 may be an input device such as a sensor or a camera, or an output device such as an actuator. In addition, multiple field devices may be connected to one expansion unit 4.

For example, the expansion unit 4b may be a positioning unit that drives a motor (field device 10) to position the workpiece, or it may be a counter unit. The counter unit counts signals from an encoder (field device 10) such as a manual pulsar.

The expansion unit 4a is a data utilization unit that collects data to be collected from the basic unit 3 and the expansion unit 4b, executes a user program (data utilization program) such as a flow, processes the collected data to create data to be displayed, and creates display data (source data) for displaying a dashboard on the display unit 7 or the PC 2. In this embodiment, an example in which the expansion unit 4a collects data from each device is described, but the collection unit may be provided in the basic unit 3 or in another expansion unit. The expansion unit 4a can also function as an analysis device that analyzes the collected data according to instructions from the basic unit 3 or a predetermined timing. In this embodiment, an example in which the expansion unit 4a operates as an analysis device is described, but this is not intended to limit the present invention, and the basic unit 3 may function as the analysis device, or an external device such as the PCs 2a and 2b may function as the analysis device. The flow (flow program) described below is merely one example of a data utilization program. The basic unit 3 may also be called a CPU unit. A system including the PLC 1 and the PC 2 may also be called a programmable logic controller system.

PC2a is a computer operated mainly by a programmer. On the other hand, PC2b is a computer operated mainly by a field staff. PC2a may be called a program creation support device (setting device). PC2 is, for example, a portable notebook type or tablet type personal computer or a smartphone, and is an external computer equipped with a display unit 7 and an operation unit 8. The external computer is a computer outside the PLC1. A ladder program, which is an example of a user program for controlling the PLC1, is created using PC2a. The created ladder program is converted into a mnemonic code in PC2a. PC2 is connected to the basic unit 3 of the PLC1 via a communication cable 9 such as a USB (Universal Serial Bus) cable. For example, PC2a sends the ladder program converted into the mnemonic code to the basic unit 3. The basic unit 3 converts the ladder program into a machine code and stores it in a memory provided in the basic unit 3. Note that, although the mnemonic code is transmitted to the basic unit 3 here, the present invention is not limited to this. For example, PC2a may convert the mnemonic code into an intermediate code and transmit the intermediate code to the basic unit 3.

Although not shown in FIG. 1, the operation unit 8 of the PC 2 may include a pointing device such as a mouse connected to the PC 2. The PC 2 may be configured to be detachably connected to the basic unit 3 of the PLC 1 via a communication cable 9 other than a USB cable. The PC 2 may be connected to the basic unit 3 of the PLC 1 by wireless communication without using the communication cable 9.

<Program creation support device>
Fig. 2 is a block diagram for explaining the electrical configuration of the PC 2a. As shown in Fig. 2, the PC 2a includes a CPU 11a, a display unit 7a, an operation unit 8a, a storage device 12a, and a communication unit 13a. The display unit 7a, the operation unit 8a, the storage device 12a, and the communication unit 13a are each electrically connected to the CPU 11a. The storage device 12a includes a RAM, a ROM, a HDD, and an SSD, and may further include a removable memory card. CPU is an abbreviation for central processing unit. HDD is an abbreviation for hard disk drive. SSD is an abbreviation for solid state drive.

The user of the PC 2a executes the project editing program 14a stored in the storage device 12a on the CPU 11a, and edits the project data 15 through the operation unit 8a. The CPU 11a executes the project editing program 14a, thereby realizing the project creation unit 16 and the project transfer unit 17. The project creation unit 16 creates the project data 15 according to the user input. The project transfer unit 17 transfers the project data 15 to the PLC 1. The project data 15 includes one or more user programs (e.g., ladder program, control program, motion program, data utilization program), configuration information of the basic unit 3 and the expansion unit 4, setting information of specific functions provided in the basic unit 3 and the expansion unit 4, etc. The configuration information includes the connection positions of the multiple expansion units 4 relative to the basic unit 3 and device allocation information. It may also include information indicating the functions provided in the basic unit 3 (e.g., data collection function, communication function, positioning function), information indicating the functions of the expansion unit 4 (e.g., communication function, positioning function, shooting function), etc. The setting information of a specific function includes setting information on the functions (e.g., data collection function, communication function, positioning function) provided in the basic unit 3, for example, in the case of a data collection function, including setting information on data collection conditions and data collection targets, and setting information on the functions of the expansion unit 4 (e.g., communication function, positioning function, data utilization function, photography function). Here, editing the project data 15 includes creating and changing (re-editing) the project data 15. The user can read the project data 15 stored in the storage device 12a as necessary and change the project data 15 using the project editing program 14a. The communication unit 13a communicates with the basic unit 3 via the communication cable 9a. The project transfer unit 17 transfers the project data to the basic unit 3 via the communication unit 13a. The communication unit 13a communicates with the expansion unit 4a via the communication cable 9b.

<PC used to display the dashboard>
Fig. 3 is a block diagram for explaining the electrical configuration of the PC 2b. As shown in Fig. 3, the PC 2b includes a CPU 11b, a display unit 7b, an operation unit 8b, a storage device 12b, and a communication unit 13b. The display unit 7b, the operation unit 8b, the storage device 12b, and the communication unit 13b are each electrically connected to the CPU 11b. The storage device 12b includes a RAM, a ROM, a HDD, and an SSD, and may further include a removable memory card.

The CPU 11b executes the web browser program 14d to realize the web browser 18. The web browser 18 accesses the setting page of the data utilization application provided by the extension unit 4a and accesses the dashboard page via the communication unit 13b. The CPU 11b also displays the identification result (judgment result) on the display unit 7b according to the screen information indicating the identification result (judgment result) when an abnormality occurs, which is transmitted from the extension unit 4a.

<PLC>
FIG. 4 is a block diagram for explaining the electrical configuration of the PLC 1. As shown in FIG. 4, the basic unit 3 includes a CPU 31, a display unit 5, an operation unit 6, a storage device 32, a communication unit 33, and a memory card 44. The display unit 5, the operation unit 6, the storage device 32, and the communication unit 33 are each electrically connected to the CPU 31. The storage device 32 may include a RAM, a ROM, or the like. The storage device 32 has a plurality of storage areas such as a device unit 34, a project storage unit 35, and a first buffer 37a. The device unit 34 has a bit device, a word device, and the like, and each device stores a device value, and corresponds to a device memory. The project storage unit 35 stores project data input from the PC 2a. The first buffer 37a stores device values (time-series data) to be collected from the device unit 34 for each scan period. The first buffer will be described in detail later with reference to FIG. 5. When a storage condition is satisfied, the memory card 44 stores time-series data, which is control data from each device stored in the first buffer 37a. By temporarily storing the time series data in the memory card 44 in this way, for example, data to be classified or identified can be verified later by an external device, and important latest data can be stored as log information. In addition, in the present invention, data of all devices related to the PLC 1 is basically collected, so the collected data is huge, and the effect of reducing the processing load can be expected by storing the data to be processed in a separate memory. Furthermore, it is also possible to easily execute the collection process and the process related to the collected data (classification process and identification process) in parallel. Here, the storage condition is established when an abnormality occurs in the PLC, when a device that is a storage trigger is specified in advance by the user and a predetermined change occurs in the device, when an analysis command is issued by the user, when a periodic monitoring period has elapsed, when an analysis command is issued from an expansion unit connected to the basic unit 3, etc. The storage condition may be set in advance by the user and stored in the storage device 32 of the basic unit 3 as part of the project data. When the CPU 31 detects that the storage condition is satisfied, the CPU 31 issues a command to store the device value stored in the first buffer 37a in a memory card 44 such as an SD card, and notifies the expansion unit 4a that the data to be analyzed has been stored. The control program for the basic unit 3 is stored in the project storage unit 35 as part of the project data. The control program for the basic unit 3 may be stored in the storage device 32 separately from the project storage unit 35 or in addition to the project storage unit 35. As shown in FIG. 4, the basic unit 3 and the expansion unit 4 are connected via an expansion bus 90, which is a type of communication bus. In FIG. 4, a communication circuit related to the expansion bus 90 is implemented in the CPU 31, but may be implemented as part of the communication unit 33. The communication unit 33 may have a network communication circuit. The CPU 31 receives project data from the PC 2a via the communication unit 33.

Here, we will provide additional information about the expansion bus 90. This expansion bus 90 is a communication bus used for input/output refresh. Input/output refresh is a process in which, when a ladder program is repeatedly executed, input/output values are captured before each execution, and the ladder program is executed based on the captured input/output values, and the input/output values are not captured even if they change during each execution. The values captured by the input/output refresh are stored in the device memory as device values of the devices corresponding to each input/output. The input/output refresh sends and receives device values between the basic unit 3 and the expansion unit 4, and updates the device values of the corresponding devices in the device memory. The input/output refresh is executed for each scan period in which the ladder program is executed once (i.e., for each scan). Note that one scan period includes the execution period of the input/output refresh, the execution period of the ladder program, and the execution period of the end process.

The expansion unit 4 includes a CPU 41 and a memory 42. The expansion unit 4a may further include a memory card (e.g., an SD card) that is detachable from the expansion unit 4a and stores time-series data, which is control data from each device. The CPU 41b of the expansion unit 4b controls the field device 10 according to instructions (device values) from the basic unit 3 stored in the device. The CPU 41b also stores the control results of the field device 10 in a device called a buffer memory. The control results stored in the device are transferred to the basic unit 3 by input/output refresh. The control results stored in the device are also transferred to the basic unit 3 according to a read command from the basic unit 3, even at a timing different from the input/output refresh. The memory 42 includes a RAM, a ROM, and the like. In particular, a storage area used as a buffer memory is secured in the RAM. The memory 42 may include a buffer that temporarily holds data acquired by the field device 10 (e.g., device values, still image data, video data).

The CPU 41a of the expansion unit 4a, which functions as a data utilization unit, communicates with the PC 2b via the communication unit 43 and the cable 9b. The data utilization unit is an expansion unit that executes a data utilization application. The data utilization application includes a flow for collecting and processing control data (time series data) stored in the memory card 44 of the basic unit 3 or in the memory card of the expansion unit 4a, a flow for performing processing related to the collected data, a dashboard that displays the execution results of these flows, and a transmission unit that transmits the results of these flows to the outside. Note that the data utilization application does not issue a command to store data in the memory card 44 during abnormal device analysis, but refers to data stored when the above-mentioned storage conditions are met, and performs analysis using the data stored in the memory card 44.

The function of collecting control data may be realized by a user program other than the data utilization application. The function of performing processing related to the collected data includes a function of identifying an abnormal device when the programmable logic controller is abnormal, a function of analyzing deviations from normal time-series data and verifying device values that are different from usual, and a monitoring function of periodically performing the above analysis. The flow may have an operation block that collects data, an operation block that executes data processing, and an operation block that creates display data. The dashboard has a graph display component and a numerical display component. These display components may be realized by HTML data, CSS data, and JavaScript (registered trademark) code. The collection of HTML data, CSS data, and JavaScript (registered trademark) code may be called a Web application. In this embodiment, the flow is realized by a flow template. The flow template is prepared in advance for each application, and has one or more operation blocks in which flow template parameters specified by the user are set. The dashboard is also realized by a template. A dashboard template has one or more display components for which dashboard template parameters specified by the user are set. Dashboard template parameters are a wide variety of information, such as the name of the dashboard, device names, numerical values, and unit variable names. A unit variable is a variable that the extension unit 4a uses to hold the execution results of a flow.

<Functions realized by the CPU of the basic unit>
FIG. 5 shows the functions realized by the CPU 31 regarding data utilization. The execution engine 51 repeatedly executes a user program for each scan period, which is an execution period. The execution engine 51 may be realized by an ASIC or FPGA provided outside the CPU 31. ASIC is an abbreviation for application specific integrated circuit. FPGA is an abbreviation for field programmable gate array. These dedicated circuits can often execute specific data processing faster than a combination of a CPU and a program. The collection unit 52a collects device values to be collected from the device unit 34 for each scan period, which is an execution period, creates a data record, and stores the data record in the first buffer 37a. When the execution engine executes a ladder program as a user program, the scan period of the ladder program corresponds to the execution period, and when the execution engine executes a motion program as a user program, the control period of the motion program corresponds to the execution period. When collecting device values for each scan period of the ladder program, the device values to be collected may be collected from the device unit 34 during the end processing period of the scan period, and a data record may be created and stored in the first buffer 37a. It is not essential to collect data during the end processing period, and the user program executed by the execution engine 51 may include a description for collecting data (program code such as a trigger command). However, in the case of collecting data by end processing, there is an advantage that the user program does not need to be changed. The collection period is set by the user, transferred as part of the project data, and stored as the collection setting 36a in the storage device 32 of the basic unit 3. In addition to the collection period, the collection setting 36a includes devices to be collected. The collection period may be a period different from the scan period, which is the execution period, and the control period of the motion program. In this case, the device values to be collected may be collected from the device unit for each collection period specified by the collection setting 36a, and a data record may be created and stored in the first buffer 37a. Here, the basic unit 3 may analyze characteristics such as periodicity and continuity of each device value by its own device or by the expansion unit 4a when collecting data, and classify the devices according to the analysis results. On the other hand, such analysis may not be performed when collecting data, but may be performed by the device itself or by the expansion unit 4a when it is necessary to analyze the data, such as when time series data for a predetermined number of scan periods has been collected or when an abnormality occurs.

By providing the first buffer 37a, the execution engine 51 is less susceptible to the effects of extended scan time due to collection and transfer processes. The device values to be collected are specified by the collection settings 36a. The collection settings 36a can be stored in the basic unit 3 by the PC 2a or the expansion unit 4a. The transfer unit 53a stores one or more data records stored in the first buffer 37a in a memory card 44 provided in the basic unit 3, and transfers the data records saved in the memory card 44 to the expansion unit 4a. The transfer unit 53a executes the transfer process when communication traffic on the expansion bus 90 is free, but a dedicated expansion bus for sending data records to the expansion unit 4a may also be provided.

Alternatively, the transfer unit 53a may transfer one or more data records stored in the first buffer 37a to the expansion unit 4a via the expansion bus 90, and the transferred data may then be stored in a memory card provided in the expansion unit 4a. In this case, it is preferable to provide a dedicated expansion bus for transmitting the data records to the expansion unit 4a. As described above, the data records are stored in the memory card 44 only when the storage conditions are met. Therefore, since there is no need to transfer unnecessary data to the expansion unit 4a, it is possible to reduce communication traffic.

The transfer process may be executed to avoid periods when the execution engine 51a is performing an I/O refresh or when data is being read from the buffer memory of the expansion unit 4 in accordance with a read command written in the user program. The communication traffic of the expansion bus 90 is monitored by the monitoring unit 54a. In order to shorten the transfer time of the data records, the compression engine 55a may compress multiple data records. The compression engine 55a does not need to be realized by the CPU 31, and may be realized by an ASIC or FPGA, etc. In this way, by employing the first buffer 37a, it becomes possible to execute the transfer process and the user program asynchronously.

<Functions of the Data Utilization Unit>
FIG. 6 is a diagram for explaining the functions realized by the CPU 41a of the expansion unit 4a.

The collection unit 52c is a function that collects (obtains) data from the first buffer of the basic unit 3 according to the collection setting 39. The collection setting 39 is set by the user, transferred as part of the project data, and stored in the memory 42a of the expansion unit 4a. The collection unit 52c can be realized by the CPU 41a executing a control program such as a user program. The collection unit 52c sets the basic unit 3 so that the basic unit 3 collects the device value specified by the collection setting 39 and transfers it to the second buffer 37b of the expansion unit 4a. The collection unit 52c may write the collection setting 36a of the basic unit 3 included in the collection setting 39 to the storage device 32 of the basic unit 3. It is desirable that the collection unit 52c and the data processing unit 73 can basically operate asynchronously. A buffer may be provided to achieve this. Here, an example is described in which the basic unit 3 collects the device value and temporarily stores it in a buffer, and then the collection unit 52c of the expansion unit 4a collects it at a predetermined timing. However, the present invention is not limited to this, and an analysis unit such as the extension unit 4a may directly acquire the device value and store the device value in a memory provided in the extension unit 4a.

The collection unit 52c may set the expansion unit 4b so that the expansion unit 4b collects the device value specified by the collection setting 39 and transfers it to the third buffer 37c of the expansion unit 4a. By providing the second buffer 37b and the third buffer 37c, even if the processing load of the data processing unit 73 fluctuates, data can be collected without missing. The collection unit 52c may write the collection setting 36b (FIG. 7) of the expansion unit 4b included in the collection setting 39 to the memory 42b of the expansion unit 4b. These setting functions may be realized by the setting unit 71. The setting unit 71 receives the collection setting 39, the processing setting 61, and the display setting 62 from the PC 2a or PC 2b and writes them to the memory 42a. The processing setting 61 includes information and a flow (program) that defines the data processing to be performed on the collected data by the data processing unit 73. The display settings 62 include dashboard templates (HTML data, CSS, JavaScript (registered trademark) code, etc.) that provide data processing results to the web browser 18 through the web server 70.

Furthermore, the CPU 41a of the expansion unit 4a realizes a classification unit 76, a determination unit 77, an identification unit 78, and a transmission unit 79 as functional configurations. The classification unit 76 analyzes the characteristics of the time series data of each device collected (acquired) from the first buffer of the basic unit 3 by the collection unit 52c, and classifies the time series data based on the characteristics. The classification method will be described later with reference to FIG. 12. The classification unit 76 executes the classification process at any timing, but basically executes the classification process at the timing when the operation of the system is started or when an instruction from the user is received. The determination unit 77 determines parameters for identifying an abnormal device according to the time series data classified by the classification unit 76, and stores the parameters in the memory 42a. The parameter determination process will be described later. When the classification process is executed by the classification unit 76, the determination unit 77 executes a parameter determination process, and updates the parameter if a parameter has already been determined for the same device. When updating, the parameter may be updated by overwriting, or a new parameter may be determined from two parameters, such as by taking an average value. In addition, the process at the time of update may be determined for each device. In this way, the classification unit 76 and the determination unit 77 are processing units that function in a learning phase in which the collected data is analyzed to learn what the data is like under normal conditions, and determine parameters for estimating an abnormal device. On the other hand, the identification unit 78 is a processing unit that functions in an estimation phase in which an abnormal device is estimated. The identification unit 78 uses the determined parameters to identify an abnormal device from the time-series data of each device collected by the collection unit 52c. Details of the identification process will be described later. Here, an abnormal device refers to a storage area of the device memory in which data different from that under normal conditions is stored. The identification unit 78 may start estimating an abnormal device when an abnormality occurs during operation of the programmable logic controller, periodically, or based on a monitoring instruction from a user. It may also start when a storage condition previously set by a user is satisfied.

The generating unit 74 creates display data for the dashboard by substituting the data processing results into the dashboard template according to the display settings 62 that define the display components of the dashboard. The generating unit 74 also creates display data (screen information) for displaying the identification results based on the identification results of the abnormal device by the identifying unit 78. The display data may be, for example, HTML data, image data, CSS (Cascading Style Sheets), or JavaScript (registered trademark) code. Examples of the display components include pie chart components, bar chart components, line graph components, and numerical display components. When the web page of the dashboard is accessed by the web browser 18, the web server 70 transmits the display data of the dashboard to the web browser 18. The web browser 18 receives the display data and displays the dashboard. The transmitting unit 79 also transmits the display data generated by the generating unit 74 to an external device. There are no particular limitations on the communication line and communication method used when transmitting. Also, the connection may be wireless or wired.

Note that multiple data utilization applications may be provided. In this case, the data and read timing required for each data utilization application may differ, and a sub-buffer may be secured in the memory 42a for each data utilization application. The collection unit 52c reads the data records stored in the second buffer 37b and stores the data for the first data utilization application in the first sub-buffer 38a. The collection unit 52c reads the data records stored in the second buffer 37b and stores the data for the second data utilization application in the second sub-buffer 38b. Note that the collection unit 52c may read the data records stored in the third buffer 37c and store the data for the first data utilization application in the first sub-buffer 38a. The collection unit 52c may read the data records stored in the third buffer 37c and store the data for the second data utilization application in the second sub-buffer 38b. The data processing unit 73 reads the data from the first sub-buffer 38a according to the first data utilization application, executes data processing, and generates a processing result. The data processing unit 73 reads the data from the second sub-buffer 38b according to the second data utilization application, executes data processing, and generates a processing result. The decompression engine 75 is a function paired with the compression engine 55a of the basic unit 3 and the compression engine 55b of the expansion unit 4b. The decompression engine 75 decompresses data compressed and transferred by the basic unit 3 and stores the data in the second buffer 37b. The decompression engine 75 decompresses data compressed and transferred by the expansion unit 4b and stores the data in the third buffer 37c. This will reduce congestion in communication traffic on the expansion bus 90. The decompression engine 75 may be realized by an ASIC or FPGA, etc. In this way, data transmission between the basic unit 3 and the expansion units 4a, 4b is performed via the expansion bus 90.

There may be multiple pieces of data required for each data utilization application. In that case, the chunks of data collected in each scan may be kept in the buffer, and multiple pieces of data required may be stored in the sub-buffer. Furthermore, even when distributing data to the sub-buffer, a timestamp or the like may be added to each record. As shown in FIG. 16, the second buffer 37b (or the third buffer 37c) holds chunks of collected data. One record includes a scan number, a timer value (timestamp), and collected data. In this example, the collected data includes relays RL1 to RL3, and devices Dev1 and Dev2. The first data utilization application 1601 requires relays RL1 to RL3 from the collected data. Therefore, the scan number, timer value, and relays RL1 to RL3 are read from the second buffer 37b and stored in the first sub-buffer 38a. The first data utilization application 1601 reads the scan number, timer value, and relays RL1 to RL3 from the first sub-buffer 38a to create a display screen (source data). The second data utilization application 1602 requires relay RL3, devices Dev1, and Dev2 from the collected data. Therefore, the scan number, timer value, relay RL3, devices Dev1, and Dev2 are read from the second buffer 37b and stored in the second sub-buffer 38b. The second data utilization application 1602 reads the scan number, timer value, relay RL3, devices Dev1, and Dev2 from the second sub-buffer 38b to create a display screen (source data). By utilizing the sub-buffer in this way, it is possible to maintain the original data in the buffer without changing it. The original data held in the buffer can be used for other purposes.

<Functions of the extension unit 4b related to data utilization>
FIG. 7 is a diagram for explaining the functions realized by the CPU 41b of the expansion unit 4b.

The execution engine 51b executes the basic functions of the expansion unit 4b (such as executing a motion flow if it is a motion unit). The collection unit 52b collects data specified by the collection setting 36 from the device unit 34b at the timing specified by the collection setting 36 and stores it in the fourth buffer 37d. The transfer unit 53b reads out the data records stored in the fourth buffer 37d at the timing specified by the collection setting 36 or at the timing when a transfer request is received by the expansion unit 4a, and transfers them to the third buffer 37c of the expansion unit 4a via the expansion bus 90. The transfer unit 53b may transfer the data records at a timing when the communication traffic of the expansion bus 90 monitored by the monitoring unit 54 is low. The compression engine 55b compresses the data records according to the collection setting 36. In other words, the transfer unit 53b may transfer the data records compressed by the compression engine 55b to the expansion unit 4a. The compression engine 55b may be implemented by the CPU 41b, but from the standpoint of high-speed processing and reducing the processing load on the CPU 41b, it may also be implemented by an ASIC or FPGA.

<Example of a data record>
FIG. 8 shows a data record 91 written by the collection unit 52a to the first buffer 37a. The multiple data records 91 are an example of time-series data. In this example, the collection unit 52a collects device values of device names Dev0, Dev1, and Dev10 from the device unit 34a for each scan period, and creates one data record by adding the collection count and time information obtained from the timer, and stores the data in the first buffer 37a. The collection target may be data stored in a buffer memory or device assigned to the expansion unit 4b. In this example, the first buffer 37a is a FIFO (first-in, first-out) type buffer. The collection count is a count value of a counter that is counted up by one each time a data record is collected. Since the collection count is a number that is assigned sequentially, it is useful for detecting missing or compressed data records.

Time information such as a timestamp is useful, for example, when displaying data acquired by the base unit 3 and data acquired by the expansion unit 4b on a dashboard for comparison. In general, the collection timing in the base unit 3 does not match the collection timing in the expansion unit 4b. Therefore, in order to compare the operation of the base unit 3 and the operation of the expansion unit 4b, information is required to link the data of the base unit 3 with the data of the expansion unit 4b. In general, the base unit 3 and the expansion units 4a and 4b can synchronize their time information by inter-unit synchronization or the like. Therefore, by adding the time information when the base unit 3 and the expansion unit 4b each collected the data record to the data record, the data processing unit 73 can align multiple data records acquired by different units on the time axis.

<Transfer timing>
FIG. 9 is a diagram for explaining the transfer timing of data records. As shown in FIG. 9, the PLC 1 repeatedly executes input/output refresh, user program execution, and end processing. In order to reduce the extension of the scan cycle, the transfer processing is executed while avoiding the input/output refresh period. Similarly, in order to reduce the extension of the scan cycle, the transfer processing is executed while avoiding the execution period of UREAD and UWRIT. UREAD is an instruction to read data from the buffer memory assigned to the expansion unit 4, and is described in the user program. Therefore, during the execution period of the user program, the basic unit 3 accesses the expansion unit 4 according to UREAD to obtain data from the buffer memory. UWRIT is an instruction to write data to the buffer memory assigned to the expansion unit 4, and is described in the user program. During the execution period of the user program, the basic unit 3 accesses the expansion unit 4 according to UWRIT to write data to the buffer memory.

As shown in FIG. 9, in the remaining transferable periods excluding I/O refresh, UREAD, and UWRIT, the transfer process is executed on the expansion bus 90. For example, assume that the collection setting 36a is set to execute the transfer process for five data records at a time. In this case, the transfer unit 53a executes the transfer process after the accumulation of five data records in the first buffer 37a is completed, during the first transferable period or when a transfer request is received by the expansion unit 4a.

<Information compression>
FIG. 10 is a diagram for explaining information compression of data records. The data record group 92a shows data records before information compression. Values that have changed since the previous scan period are shaded. Here, four relay devices RL1, RL2, RL3, and RL4 are specified as collection targets. Also, the scan number is adopted as the collection count. The counter may be time information acquired by a timer or the like (e.g., a numerical value indicating the time interval from when a relay is turned on to when it is turned off). In the data record group 92a, there is no change point of the relay device between the data record with scan number "1" and the data record with scan number "2". In other words, the data record with scan number "2" can be compressed (discarded or deleted). However, the relay device RL1 of the data record with scan number "3" is different from the relay device RL1 of the data record with scan number "1". In this way, since the scan number "3" has a change point, the data record with scan number "3" is not compressed. Since there is no change point of the relay device between the data record with scan number "3" and the data record with scan number "4", the data record with scan number "4" can be compressed. Similarly, since there is no change point of the relay device between the data record with scan number "5" and the data record with scan number "6", the data record with scan number "6" can be compressed. By performing information compression focusing on such change points, a compressed data record group 92b is realized. Each data record constituting the compressed data record group 92b has a change point. Thus, in this embodiment, in one or more device groups (RL1 to RL4), if the value collected in the previous scan cycle and the value collected in the current scan cycle do not change for all devices in the group to be collected, the value collected in the current scan cycle is deleted and the collected time series data is compressed. Note that here, an example of managing in a group has been described, but this is not intended to limit the present invention, and data may be compressed by determining ON/OFF for each device without grouping. In the case of data that is not in an ON/OFF bit format (analog value), a change in device value from the previous time may be detected for each device, and if a change is detected, the data may be controlled to be retained.

<Overall flow>
11 shows the overall flow from data collection to abnormal device identification processing in the programmable logic controller according to this embodiment. The processing described below will be described as processing executed by the CPU 41a of the expansion unit 4a. However, this is not intended to limit the present invention, and some of these processes may be executed by the basic unit 3 or another expansion unit 4b, or may be executed by an external device (analysis device) communicatively connected to the programmable logic controller.

In S1, the CPU 41a (setting unit 71) sets the basic unit 3 and the expansion unit 4b. For example, the CPU 41a transfers the collection setting 36a for the basic unit 3 to the basic unit 3. The basic unit 3 stores the collection setting 36a in the storage device 32. The CPU 41a transfers the collection setting 36b for the basic unit 3 to the expansion unit 4b. The expansion unit 4b stores the collection setting 36b in memory 42b.

In S2, the CPU 41a (collection unit 52c) collects time series data of the device to be collected according to the collection settings that have been set. Here, the process may proceed to the next step when a predetermined amount of collected data has been stored. In other words, the timing to move to the learning phase is determined here, and the process proceeds to the next step when a sufficient amount of data for learning (time series data for a predetermined number of scan cycles) has been accumulated in a storage unit such as a buffer or memory card.

In S3, the CPU 41a (classification unit 76 and determination unit 77) analyzes the data collected in S2 and creates a learning model (parameters in this embodiment) for identifying an abnormal device. The processing of the learning phase will be described later with reference to FIG. 15.

In S4, the CPU 41a (collection unit 52c) collects time series data of the device to be collected according to the collection settings that have been set. The processing from S4 onwards is processing during actual system operation. The data collection here is basically the same as that in S2 above. The learning phase may be performed when the system starts operating, or may be started when an instruction from the user is received. It may also be performed periodically. That is, data collection is always performed during system operation, the learning phase is performed periodically, and the estimation phase is performed when the storage condition is satisfied. For example, when an abnormality occurs during operation of the programmable logic controller and the basic unit 3 detects that the storage condition is satisfied, the time series data collected in the first buffer 37a of the basic unit 3 is stored in the memory card 44. In S5, the CPU 41a (identification unit 78) acquires the time series data stored in the memory card 44 and applies the parameters determined in S3 to identify the abnormal device. That is, processing in the estimation phase is performed here, and details will be described later using FIG. 16. Further, the CPU 41a generates display data indicating the identification result by the generating unit 74 based on the identification result identified by the identifying unit 78, and displays the display data on the display unit 5 of the basic unit 3, or transmits the generated display data or the identification result to an external device by the transmitting unit 79 via the communication unit 43. In this case, the identification result is displayed to the operator in the external device. The operation of S5 may be a method in which, when an abnormality occurs during the operation of the programmable logic controller as described above, the basic unit 3 detects the establishment of the storage condition and identifies the abnormal device, or a method in which the device value is constantly collected and analyzed to see if there is an abnormality in the device value, a method in which the device value collected by the basic unit is analyzed when a device value predetermined by the user changes in a predetermined manner, or a method in which the device value is analyzed periodically or based on a monitoring instruction from the user. In these cases, "abnormality" indicates that the device value to be analyzed is different from the device value in the normal state, i.e., that it deviates from the data in the normal state, and does not necessarily indicate an abnormality occurring in the programmable logic controller. The processing steps of the estimation phase for identifying abnormal devices from data collection taking into account these collection timings will be described in detail later using FIG. 16.

<Classification of collected data>
FIG. 12 shows an example of the types of collected time series data. 1201 to 1206 indicate device signals (time series data) of each type. The device signals may include external signals. The types described below are only examples, and are not intended to limit the present invention, and the present invention may be applied to other types as well. In addition, in the present invention, it is desirable that the types to be classified include at least two of these multiple types in order to improve the classification effect. Note that the classification of time series data during learning is performed based on the repeatability of a device by the user selecting the device that determines the period (operation cycle) for classification.

1201 indicates a device signal of a device that operates in synchronization with the operation cycle of the device. 1210 indicates the operation cycle of the device. In the type 1201, a similar change pattern (stationary change pattern) occurs for each operation cycle of the device. In this type, for example, a detection method is assigned in which a stationary change pattern is identified from time series data acquired during a period that can be considered to be in a normal state, and an abnormal device (a device that is different from usual) is identified based on the deviation from the stationary change pattern identified for newly acquired time series data. Specifically, for the change pattern of multiple cycles of time series data that can be considered to be in a normal state, the time variation regarding the change point is measured, and a threshold value is set according to the measured variation. A detection algorithm is assigned to detect an abnormal device based on whether or not the change point of the time series data acquired thereafter exceeds the range of the threshold value set corresponding to the change point. For example, multiple waveforms for each operation cycle of the device are superimposed, and a reference value and a threshold value for the change point are set based on the variation of the point at which the device changes from OFF to ON, and an abnormal device can be identified using these parameters. In addition, in each cycle of 1201, the relative time indicating the timing of the first rising edge of the signal or the phase in each cycle may be used as an evaluation variable, and a parameter corresponding to the evaluation variable may be determined based on the variance of the evaluation variable. For example, if the phase in each cycle is used as the evaluation variable, the upper and lower thresholds of the phase may be used as parameters.

On the other hand, 1202 indicates a device signal of a device that does not synchronize with the scan cycle but operates in synchronization with a cycle other than the operation cycle of the device. For this type, a detection method is assigned, for example, to identify a stationary change pattern from time series data acquired during a period that can be considered to be in a normal state, and to identify an abnormal device (a device that is different from usual) based on the deviation from the stationary change pattern identified for newly acquired time series data. Specifically, for the change pattern of multiple cycles of time series data that can be considered to be in a normal state, the time variation regarding the change point is measured, and a threshold value is set according to the measured variation. A detection algorithm is assigned to detect an abnormal device based on whether or not the change point of the time series data acquired thereafter exceeds the range of the threshold value set corresponding to the change point. In addition, in each cycle of 1202, the relative time indicating the timing of the second signal rise or the phase in each cycle may be used as an evaluation variable, and a parameter corresponding to the evaluation variable may be determined based on the variation of the evaluation variable. For example, if the relative time in each cycle is used as the evaluation variable, the upper and lower thresholds of the relative time may be used as parameters.

1203 indicates a device signal of a device that has a constant value. In this type, for example, a detection method is assigned in which a normal value is identified from time series data acquired during a period that can be considered to be in a normal state, and a newly acquired time series data that is different from the identified normal value is identified as an abnormal device (a device that is different from usual). Specifically, a detection algorithm is assigned in which the value of the device in the time series data that can be considered to be in a normal state is set as a detection reference value, and an abnormal device is detected based on whether or not the value of the time series data acquired thereafter differs from the detection reference value set corresponding to the normal value. In other words, it can be determined that an abnormality exists when the value (constant value) changes. 1204 indicates a device signal of a device that operates irregularly. This type is excluded from the data used to identify an abnormal device. 1205 indicates a device signal of a device that has an analog value. In the case of a device that takes an analog value, as described later, the device value is not that of a bit device, so proceed to No in S21 in FIG. 13A (S27 in FIG. 13B), and as shown in FIG. 13B, the algorithm in the estimation phase differs depending on the way the data changes. As an algorithm in the estimation phase of a device that takes an analog value, various methods such as dynamic time warping and autoregressive models can be used. 1206 indicates a device signal of a device that increases or decreases monotonically. In this type, an abnormal device is identified using a differential value or an integrated value. In addition, a relative time indicating the timing of monotonous increase or decrease or a phase in each cycle may be used as an evaluation variable. Note that the type described here is an example, and devices classified into other types are also assumed, such as devices that can take multiple states (such as a stepped device signal). For devices that take multiple states, it is also possible to determine that an abnormality exists when the state changes from the normal state.

Now, referring to FIG. 14, the device types will be explained. As shown in FIG. 14, each device is classified into bit type devices of 0 and 1, word type devices that take analog values, and floating point type devices. Word devices are further classified into 1-word unsigned integers (0 to 65535), 1-word signed integers (-32768 to 32767), 2-word unsigned integers (0 to 4294967295), and 2-word signed integers (-214783648 to 214783647). Considering these types, for example, if the rate of change per scan period is equal to or greater than a predetermined value and the type is other than bit, it can be determined that the device takes analog values.

<Classification>
13A and 13B are flowcharts showing the processing procedure for classifying collected data. The processing described below is realized by the CPU 41a of the expansion unit 4a. However, this is not intended to limit the present invention, and some of the processing may be executed by the basic unit 3 or another expansion unit 4b, or may be executed by an external device (analysis device) communicatively connected to the programmable logic controller.

In S21, the CPU 41a determines whether the time series data to be classified is a device value of a bit device. If it is a device value of a bit device, the process proceeds to S22; if not, the process proceeds to S27 in FIG. 13B.

In S22, the CPU 41a judges whether or not there is a change in the value of the time series data to be classified. If there is a change, proceed to S24, and if there is no change and the value is constant, proceed to S23. In S23, the CPU 41a classifies the time series data to be classified as a device (1203) that has a constant value, and ends the process. Here, as classification information, information linked to the time series data, for example, flag information indicating the classified type, is linked to the time series data or the identification information indicating the device corresponding to the time series data and stored. In this way, by linking and storing the flag information of the type classified at the time of classification in the learning phase and the identification information of the device, in the estimation phase, according to which device the time series data to be verified is from, it is possible to easily select evaluation variables and parameters, which are the detection algorithm for abnormal devices, according to the type linked to the identification information of the device. In other words, in the estimation phase, the process of identifying which type the time series data to be verified corresponds to can be omitted. As the classification information, flag information indicating the classification type is shown as an example, but algorithm information indicating an algorithm for identifying an abnormal device may be used instead of flag information. Also, it goes without saying that, if the device corresponding to the time series data is a variable, the identification information stored as the classification information will be identification information indicating the variable.

In S24, if there is a change in the value of the time series data, the CPU 41a judges whether the change is a stationary change pattern in each cycle. If it is judged to be a stationary change pattern, the process proceeds to S25, and if it is judged not to be a stationary change pattern, the process proceeds to S26. Here, a stationary change pattern refers to a change in a similar pattern in each cycle. In this way, a stationary change pattern is a pattern in which the value of the time series data changes in each cycle, and since it is a fixed and similar pattern in each period, it is also called a fixed change pattern. In S25, the CPU 41a classifies the device as a device that operates in a predetermined cycle and ends the process. As described above, devices that operate in a predetermined cycle include devices (1201) that operate in synchronization with the operation cycle of the device and devices (1202) that operate in synchronization with a cycle other than the operation cycle of the device, and the CPU 41a classifies them into each type. On the other hand, in S26, the CPU 41a classifies the device as a device that operates irregularly (1204) and ends the process.

The CPU 41a may specify the operation cycle of the device or a period other than the operation cycle of the device based on the change in the value of the time series data related to the specific device. For example, the device value of the specific device has one pulse in each operation cycle of the device and is collected as time series data having a change point that specifies the start timing of each operation cycle. In other words, the value of the specific device changes in synchronization with the operation cycle of the device, and the change point specifies the operation cycle. Such a specific device may be set by the selection of the operator. Similarly, a device that specifies a period other than the operation cycle may also be set by the selection of the operator. Of course, the operation cycle of the device may be automatically specified from the collected time series data, or may be adjustable by the operator after specification. This can provide more support to the operator, and an easy-to-use operation system can be provided even for inexperienced operators. A device that operates in a period other than the operation cycle may be defined as a device that operates irregularly based on the operation cycle. For example, if a device that specifies a period other than the operation cycle is not set, the CPU 41a classifies the device that operates in a period other than the operation cycle as a device that operates irregularly (1204).

On the other hand, if it is determined in S21 that the device is not a bit device, the process proceeds to S27 shown in FIG. 13B, where the CPU 41a determines whether or not there is a change of a predetermined value or more in the time series data to be classified. Here, it determines whether or not the extreme value of the changing signal is a predetermined value or more. If there is a change, the process proceeds to S28, and if not, the process proceeds to S212.

In S28, the CPU 41a determines whether the value is changing at a predetermined cycle, and if it is not changing at the predetermined cycle, proceeds to S29, and if it is changing, proceeds to S210. In S210, the CPU 41a determines whether the changing value is monotonically increasing or decreasing. If it is monotonically increasing or decreasing, proceeds to S211, and if not, proceeds to S29.

In S29, the CPU 41a classifies the device as an analog value device (1205) and ends the process. There are various types of analog value devices, and each type of device is dealt with individually. On the other hand, in S211, the CPU 41a classifies the device as a monotonically increasing or decreasing device (1206) and ends the process. In addition, in S212, the CPU 41a classifies the device as other devices and ends the process. If it is determined to be other devices, the characteristics of the time series data of the classification target cannot be extracted, and characteristic normal operation cannot be identified, so it is not used to identify abnormal devices.

As described above, the CPU 41a automatically classifies the devices to be classified based on the time series data of the devices to be classified. In addition, the CPU 41a may accept the setting of the type of the devices to be classified from the operator. The CPU 41a accepts the setting of the type of the devices to be classified according to the designation of the operator. Then, the CPU 41a stores flag information indicating the classified type in association with the identification information indicating the device to be classified. The setting of the type of the devices to be classified may be performed before classification by the CPU 41a. For example, when the type setting is performed for a specific device among the multiple devices to be classified based on the designation of the operator, the CPU 41a may not perform classification based on the time series data of the devices to be classified for the devices to which the type has been set in advance. On the other hand, the CPU 41a may perform classification based on the time series data of the devices to be classified for other devices among the multiple devices to be classified that have not been designated by the operator. In particular, when the device type has been determined by previous learning and additional learning is to be performed, the device type may be fixed to the previous learning type based on the operator's specification, or for devices that require a change, a different device type from the previous learning type may be determined based on the operator's specification. For example, a type that is not used when identifying an abnormal device may be determined.

Furthermore, the setting of a type for a device to be classified may be performed after classification by the CPU 41a. For example, for multiple devices to be classified, the CPU 41a automatically classifies the devices to be classified based on the time series data of the devices to be classified. Thereafter, the CPU 41a may update the automatically classified type for a device whose type has been set by the operator's designation to the type set for the device to be classified in accordance with the operator's designation. In this way, even if the time series data used for automatic classification has a short period or is biased in the period, the device to be classified can be efficiently brought closer to the desired classification by combining it with information already known by the operator.

<Learning Phase>
15 shows a process for analyzing collected time series data, classifying the data based on the characteristics of each device, and determining a detection algorithm. The process described below is realized by the CPU 41a of the expansion unit 4a. However, this is not intended to limit the present invention, and some of the processes may be executed by the basic unit 3 or another expansion unit 4b, or may be executed by an external device (analysis device) communicatively connected to the programmable logic controller.

The learning phase may start, for example, when a predetermined period of time has passed since the previous learning process, when a predetermined amount of time series data has been collected, or when an instruction is received from the user. When the learning phase starts, the CPU 41a (collection unit 52c) collects time series data of the devices to be collected in accordance with the collection settings that have been set (S2).

In S31, the CPU 41a executes a classification process. The classification process is performed by the expansion unit 4a in response to an instruction from the basic unit 3, for example, when a predetermined amount of collected data is stored in the memory card 44 of the basic unit 3. The basic unit 3 may detect that a predetermined amount of collected data has been stored in the memory card 44 and send an instruction to start classification to the expansion unit. The expansion unit may also start the classification process when it detects that a sufficient amount of data for learning (time series data for a predetermined number of scan cycles) has been accumulated in a storage unit such as a buffer memory or memory card. Details of the classification process have already been explained using Figures 13A and 13B, so they will not be repeated here.

Next, in S32, the CPU 41a determines parameters for identifying an abnormal device according to the time series data classified in S31, and ends the process. The process here is performed for each classified type, and the type of device corresponding to the time series data and the parameters are stored in association with each other. If there are already determined parameters, the previously determined parameters may be replaced with the currently determined parameters, or new parameters may be calculated and updated using the previously determined parameters and the currently determined parameters. Various methods, such as an average value, may be applied as a calculation method, and a method suitable for each time series data is selected. These determined parameters may be changeable by the operator. This makes it possible to adjust extreme parameters even if they are determined when the learning period is short.

Here, the parameters determined in S32 will be described. For the types 1201 and 1202 in FIG. 12 (devices whose values change in a stationary pattern in synchronization with a predetermined cycle), the CPU 41a calculates the time between any change points in the waveform for each operation cycle of the device from the change pattern of the waveform within the operation cycle of the device, and determines the threshold value of the time between the change points as a parameter based on the distribution of the time between the change points. Furthermore, the parameters in this case may include the timing at which the device value of the time series data in normal times changes. In addition, the threshold value of the time between the change points, which is the parameter, may be determined by calculating, for example, the standard deviation and the average value from the variation during learning, and setting the average value + 3 x standard deviation as the upper threshold value and the average value - 3 x standard deviation as the lower threshold value. In addition, for the type 1203 (devices whose values take a constant value), the CPU 41a sets the constant value as a parameter. In this way, for devices whose values change in a stationary pattern in synchronization with a predetermined cycle, the time interval between the change points, the timing of the change points, and threshold values related to these are used as parameters.

For the type 1205 (analog value), the parameters may be, for example, the value of the time series data at the time of learning and a threshold value related to the distance from the time series data at the time of learning. The distance may be calculated, for example, by finding the sum of the differences at each point. In this case, at the time of estimation, the distance between the time series data at the time of learning and the time series data at the time of estimation is calculated, and it is determined whether the distance is within the threshold value. Also, for the type 1206 (monotonically increasing, monotonically decreasing), for example, the increase value during monotonically increasing under normal conditions and the decrease value during monotonically decreasing are determined as parameters.

In this way, according to this embodiment, each device is classified into one of a plurality of predetermined types based on the characteristics related to the periodicity of the time series data of each device, and an appropriate detection algorithm for abnormalities (changes that are different from usual) is applied to each classified type. That is, in this embodiment, in the learning phase, the device is classified into one of a plurality of predetermined types from the time series data in normal times (during learning). Furthermore, a detection algorithm is determined according to each type, and evaluation variables and parameters according to each detection algorithm are set. On the other hand, in the estimation phase, for each device for which a detection algorithm was determined in the learning phase, a detection algorithm determined according to the type of device to be estimated is applied to the time series data of the device according to the type of device to be estimated determined. In this way, an abnormal device is identified by analyzing the time series data of the device using the type of device determined in the learning phase and the detection algorithm for the abnormal device corresponding to the device type. Note that, for devices that were not classified into a predetermined type during learning, no evaluation variables or parameters are set, so it is desirable that they are not collected during estimation. In other words, even if such data were collected, there would be no detection algorithm set up to identify whether or not the device is abnormal, which would unnecessarily increase processing load and memory resource consumption, and this is to prevent this from happening.

<Estimated Phase>
FIG. 16 is a flowchart showing the processing procedure when identifying an abnormal device. The processing described below is realized by the CPU 31 of the basic unit 3 and the CPU 41a of the expansion unit 4a. However, this is not intended to limit the present invention, and some of these processes may be executed by other units such as the basic unit 3 or the expansion units 4a and 4b, or may be executed by an external device (analysis device) communicatively connected to the programmable logic controller. Here, a process of acquiring a device value and storing it from the buffer memory to the memory card 44 when a storage condition is satisfied and executing a specific process will be described as a series of processes. Therefore, the process of the basic unit 3 that acquires the device value and stores it in the memory card 44 and the process of the expansion unit 4a that acquires the device value stored in the memory card 44 by the basic unit 3 and executes a specific process are shown as a series of processes. In other words, the process of storing the device value when the storage condition is satisfied (S41 to S46 below) is performed by the CPU 31 (collection unit 52a) of the basic unit 3, and the process of identifying an abnormality using the device value stored in the memory card 44 (S47 and S48) is executed by the CPU 41a of the expansion unit 4a. Of course, the processes in steps S41 to S48 or a part of them may be executed by another unit.

Here, the storage conditions for storing the device values saved in the buffer memory (first buffer 37a) of the basic unit 3 in the memory card 44 will be described. For example, the storage conditions are conditions that are met when an abnormality occurs in the PLC, when a device that will be a storage trigger is specified in advance by the user and a specified change occurs in the device value of that device, when an analysis command is issued by the user, when the periodic monitoring period has elapsed, when an analysis command is issued from the expansion unit connected to the basic unit 3, etc. These storage conditions may be set by the user and transferred and stored as project data, input by the user while the PLC is operating, or based on information generated by the expansion unit 4.

In S41, the CPU 31 determines whether the collection condition is met. The collection condition is, for example, a condition that is met when a predetermined collection period has elapsed or when the end processing of each scan is completed.

In S42, the CPU 31 of the basic unit 3 acquires the device value collected in S4 of FIG. 11 above, and in S43, determines whether the acquired device value is the same as the device value previously stored in the first buffer 37a. If the values are the same, the process returns to S41 to move on to processing the next device value. On the other hand, if the device value is different from the previously stored device value, the process proceeds to S44.

In S44, the CPU 31 saves the acquired device values in the first buffer 37a and proceeds to S45. In this way, the collection unit 52a acquires the device values (and time information) for each collection period (e.g., scan period) set by the collection setting 36a and stores them in the first buffer 37a. It is preferable to use a ring buffer for the first buffer 37a. This is because, taking memory resources into consideration, not all of the data stored in the first buffer 37a is collected as log data (collected data).

In S45, the CPU 31 judges whether the storage condition for storing the device value stored in the first buffer 37a in the memory card 44 of the basic unit 3 is satisfied. The storage condition here is set to be satisfied, for example, when an abnormality occurs during operation of the programmable logic controller. As described above, the storage condition may be set to be satisfied when an abnormality occurs other than when the PLC is abnormal, and a process for identifying whether the device value is abnormal may be executed. In other words, "abnormal device value" does not necessarily indicate an abnormality in the PLC, but may simply indicate a value different from the usual device value. Therefore, examples of the storage condition being satisfied other than when the PLC is abnormal include the timing when an unusual device value occurs, the timing when a monitoring instruction is received from the user, after a predetermined execution period has elapsed after a monitoring instruction is received from the user, or a specified timing for periodically determining an abnormality. A detailed description of these will be given later in the second and third embodiments. At least one of the functions described in the first to third embodiments can be provided.

When the storage conditions are met, in S46 the CPU 31 of the basic unit 3 acquires the time series data of the estimation target from the first buffer 37a of the basic unit 3 in order to identify the abnormal device, and stores it in the memory card 44. The data of the estimation target is data of all devices by default, and may be selected according to an operator's specification, or may be selected according to the type of abnormality. Furthermore, this time series data may include time series data from a specified period before the occurrence of the abnormality to a specified time after the occurrence of the abnormality. Alternatively, it may be data within a specified period after the occurrence of the abnormality.

Next, in S47, the CPU 41a of the expansion unit 4a identifies an abnormal device using the detection method optimal for each type of time series data stored in the memory card 44 in S46 based on the type of device corresponding to the time series data determined during learning, and the evaluation variables and parameters corresponding to the detection method. As described above, according to this embodiment, the characteristics of the change in the device value are extracted during learning, and each device value is classified into a predetermined type, and an appropriate detection method for an abnormality (unusual change) is applied to each type of classified device. That is, in this embodiment, in the learning phase, the device value is classified from the time series data in the normal state, a detection method is determined according to each type, and evaluation variables and parameters corresponding to each detection method are set. On the other hand, in the above S47 of the estimation phase, the evaluation variables and parameters, which are detection algorithms determined according to the type of each device classified in the learning phase, are applied to the time series data of the device and analyzed to identify an abnormality. As described above, regarding the type of time series data, at the time of classification, the flag information of the type and the identification information of the device corresponding to the time series data are linked and stored. Therefore, in S47, the CPU 41a determines the corresponding type from the identification information of the device from which the time-series data of the estimation target was obtained, and identifies the abnormal device using the evaluation variables and parameters that are the detection algorithm corresponding to the type. The determination method is performed according to the method described above for each parameter.

Now, referring to FIG. 17, a method of determining whether a device is abnormal will be described. 1701 and 1702 indicate data of an abnormal device in the 1201 and 1202 types (devices whose values change in a steady pattern in synchronization with a predetermined cycle). 1711 and 1712 indicate the abnormal location. In this way, when a device exists in which a signal that should change does not change, the change point is shifted, or the pulse width is different compared to the normal state, the device can be identified as an abnormal device. By using the determined detection algorithm, the CPU 41a can distinguish different data from the normal state. Also, 1703 indicates data of an abnormal device in the 1203 type (devices whose values are constant). As shown in 1713, a signal that should be a constant value has changed, so the device can be identified as an abnormal device.

1704 shows an algorithm for identifying an abnormal device using time series data of two devices classified into the same type, such as types 1201 and 1202 (devices whose values change in a steady pattern in synchronization with a predetermined cycle). In this algorithm, the time interval between the change points of the values of the two devices is checked for devices that change in synchronization with a predetermined cycle. For example, one device has two change points (a1, a2) in one cycle, and the other device has four change points (b1, b2, b3, b4) in one cycle. In this case, it may be determined whether the time difference between each change point is within a threshold value. In detail, it may be determined whether the device is abnormal by determining the time difference between the change point a1 and each of the change points b1 to b4 and the time difference between the change point a2 and each of the change points b1 to b4 as the respective threshold values. In this case, the parameters are the threshold value for each time difference between the change points, the timing of each change point, and the threshold value for the timing of each change point. When using this determination method to identify abnormal devices, two devices are identified as abnormal devices.

Returning to the explanation of FIG. 16, next, in S49, the CPU 41a outputs the identification result of S48 and ends the process. Here, the generation unit 74 first generates display data for displaying the identification result, and transmits the display data to the display unit 5 of the basic unit 3 or an external device to display it on the display unit. Here, the display screen based on the display data will be described later with reference to FIG. 18.

Figure 18 shows an example of the display of the identification results.

Screen 1800 shows time on the horizontal axis and the number of abnormal devices on the vertical axis. The generation unit 74 generates the display data for screen 1800 from devices identified as abnormal devices according to the identification results and the time series data at that time. When an abnormality occurs in a programmable logic controller, the equipment tends to stop and the number of abnormal devices tends to increase. Therefore, by displaying the cumulative number of abnormal device occurrences for each specified time interval (e.g., every 5 minutes) as in screen 1800, the operator can easily recognize when the abnormality began to occur.

Screen 1810 displays the status of each device identified as an abnormal device. For each device, the time when the abnormality occurred and the details of the abnormality are displayed. The details of the abnormality include the information that led to the determination that there was an abnormality. For example, in device A, a device that takes a constant value, the normal value is 123, but it can be seen that the value has changed to 127, and therefore it has been determined to be abnormal. In addition, in device B, a device that changes in sync with a specified period has an abnormality in the interval of the change.

The screen 1820 is a display showing the degree of abnormality of the device to be estimated. The generating unit 74 generates display data for displaying the degree of abnormality of the estimated device in a ranking based on the identification result. That is, on the screen 1820, candidate devices with a high possibility of abnormality are displayed in an identifiable manner by device name or the like. In addition to the degree of abnormality, the display may also show the abnormality content and the classification of the device. Here, the degree of abnormality is determined, for example, by the number of abnormalities that have occurred or the magnitude of the difference from a predetermined threshold value. In other words, the degree of abnormality indicates the magnitude of the abnormality. The screen 1820 shows an example in which the degree of abnormality is displayed in descending order, but the abnormalities may be sorted and displayed according to conditions such as the order of occurrence time. In addition, the device may be sorted according to the classification method, or only the contents of the abnormality related to the classification method selected in advance by the user may be displayed. For example, the degree of abnormality may be calculated using a predetermined threshold value according to the following formula:
Anomaly level = (current value - average value) / (threshold value - average value)
That is, the degree of abnormality is defined according to the current value as follows: If the current value is above the upper threshold, the degree of abnormality is 1 or more. If the current value is equal to the upper threshold, the degree of abnormality is 1. If the current value is equal to the average value, the degree of abnormality is 0. If the current value is equal to the lower threshold, the degree of abnormality is -1. If the current value is below the lower threshold, the degree of abnormality is -1. The degree of abnormality may be an absolute value. Also, if there is a mismatch with a specified value to be compared, the degree of abnormality may be uniformly set to 1.

Screen 1830 is an example of a display that allows a comparison of the device's signals when normal and when abnormal. As shown in screen 1830, it is desirable to highlight the abnormal part. In the example of FIG. 18, the area around the signal of the abnormal part is displayed surrounded by a dotted frame, but the signal of that part may be displayed in a color different from the other parts, or that part may be displayed by flashing.

<Additional learning>
FIG. 21 is a flowchart showing a processing procedure for additional learning. Here, the additional learning is a learning process that is performed additionally at a timing different from the learning in the learning phase described with reference to FIG. 15. Various timings are assumed for the timing, but as described later, it is a case where a specific device is identified as abnormal in the estimation phase despite being normal, a timing specified by an operator, a regular timing to respond to changes over time in the system, etc. In other words, the additional learning is learning that is additionally performed at a timing when it is necessary to update the learning model of parameters, etc. for identifying the abnormal device determined in S32. The processing described below is realized by the CPU 41a of the expansion unit 4a. However, it is not intended to limit the present invention, and some of the processing may be executed by the basic unit 3 or another expansion unit 4b, or may be executed by an external device (analysis device) communicably connected to the programmable logic controller.

In S201, the CPU 41a (collection unit 52c) collects time series data of devices to be collected when the apparatus is operating normally, according to the collection settings that have been set. The devices to be collected include multiple devices that are to be judged in the estimation phase. In addition, devices that are not to be judged in the estimation phase may be excluded from the devices to be collected. For example, devices classified as devices that operate irregularly (1204) may be excluded from the devices to be collected.

Here, the time series data of the device to be collected when the device is operating normally is time series data of the device that is judged to be abnormal even though the judgment result in the estimation phase should be judged to be normal. For example, if learning is insufficient in the learning phase, the judgment result in the estimation phase may be abnormal. Therefore, the CPU 41a may perform additional learning when the judgment result of the time series data to be collected is abnormal even though the device is operating normally. Also, even if the judgment result in the estimation phase is abnormal and time series data at the time of the abnormality (unusual state) is collected, if the time series data includes time series data corresponding to a period of normal operation, the time series data corresponding to such a period of normal operation also corresponds to the time series data of the device to be collected when the device is operating normally. In this case, if the judgment result for the time series data corresponding to the period of normal operation is abnormal, additional learning may be performed using that part.

Next, in S202, the CPU 41a determines whether the conditions for additional learning are satisfied, that is, whether the timing for additional learning has arrived. Examples of the timing for starting additional learning include the timing when a predetermined period has passed since the previous learning process, the timing when a predetermined amount of time-series data has been collected, and the timing when an instruction from an operator is received. The timing for starting additional learning may also be a predetermined timing when it is estimated that the device is operating normally in the estimation phase, or the timing when it is estimated that the device is operating abnormally in the estimation phase. For example, in cases where the device occasionally operates slowly but the slowness of the operation is within the normal range, or when the air pressure changes and the operating time changes when the device is powered on again (changes over time), it may be effective to update (additional learning) after a period of time has elapsed rather than learning once, in order to improve accuracy.

In S311, the CPU 41a determines whether each of the multiple devices set as collection targets is a target for judgment in the estimation phase. If the CPU 41a determines that a device is a target for judgment, it proceeds to step S312 to perform additional learning for that device, and if it determines that the device is not a target for judgment, it proceeds to step S341 without performing additional learning for that device. For example, the CPU 41a determines that a device classified as a device that operates irregularly (1204) is not a target for judgment, and proceeds to step S341 without performing additional learning.

In S312, the CPU 41a executes the classification process. The classification process is performed by the expansion unit 4a in response to an instruction from the basic unit 3, for example, when a predetermined amount of collected data is stored in the memory card 44 of the basic unit 3 after the power is turned back on. The stored predetermined amount of collected data becomes the time series data of each device collected during the target period for additional learning. The basic unit 3 may detect that a predetermined amount of collected data has been saved in the memory card 44 and send an instruction to start classification to the expansion unit. In addition, the expansion unit 4a may detect that a sufficient amount of data for learning (time series data for a predetermined number of scan periods) has been accumulated in a memory unit such as a buffer memory (first buffer 37a) or memory card 44 after the power is turned back on and start the classification process.

Specifically, in S312, the CPU 41a automatically classifies the device to be classified based on the type determined up to the last time, the feature amount of the time series data for the device, and the time series data of the classification target collected this time. For example, if the device is classified into the type of device (1203) that takes a constant value by learning up to the last time, and the time series data during normal operation collected this time for the device contains a value different from the constant value, the CPU 41a updates the classification to a device that operates irregularly (1204). Here, the feature amount of the device that takes a constant value (1203) corresponds to the constant value. Similarly, if the device is classified into the type of device (1201) that operates in synchronization with the operation cycle of the device by learning up to the last time, and the time series data during normal operation collected this time for the device contains a pattern different from that of the previous learning, the CPU 41a updates the classification to a device that operates irregularly (1204). Here, the feature amount of the device that operates in synchronization with the operation cycle of the device (1201) corresponds to the change pattern of the waveform within the operation cycle of the device, that is, the change pattern of the time series data. Note that when the classification is updated, the detection algorithm determined according to the updated type is also updated. Furthermore, the parameters corresponding to S324 and S334 described below are also updated according to the updated detection algorithm.

In addition, the CPU 41a automatically classifies the devices to be classified based on the time series data of the devices to be classified, but in addition to this, the CPU 41a may accept the setting of the type of the devices to be classified. Many of the devices to be classified do not require a change in type, and for the types that require a change, the operator may recognize which devices should be changed to which type. Therefore, the CPU 41a accepts the setting of the type of the devices to be classified according to the operator's designation, and stores flag information indicating the classified type in association with the identification information indicating the device to be classified. Alternatively, according to the operator's designation, the device may be classified as a device that operates irregularly (1204) and excluded from the judgment target in the estimation phase. The setting of the type of the devices to be classified may be performed before classification by the CPU 41a. For example, when the type setting is performed for a specific device among multiple devices to be classified based on the operator's designation, the classification based on the time series data of the devices to be classified by the CPU 41a is not performed for the devices to which the type has been set in advance. On the other hand, for devices other than the specific device among the multiple devices to be classified, the CPU 41a performs classification based on the time-series data of the devices to be classified. In particular, when the type of the device has been determined by previous learning and additional learning is to be performed, the type of the device may be fixed to the type determined by previous learning based on the operator's specification, or for devices that require a change, a type different from the type of the device determined by previous learning may be determined based on the operator's specification. For example, a type that is not used when identifying an abnormal device may be determined.

In S321, the CPU 41a judges whether or not the type of device determined by the previous learning has been maintained in the reclassification in S312. If the CPU 41a judges that the type of device determined by the previous learning has been maintained, the process proceeds to S322 to determine parameters. On the other hand, if the CPU 41a judges that the type of device determined by the previous learning has not been maintained, that is, if the CPU 41a judges that the type of device has been reclassified and updated, the process proceeds to S323, where the CPU 41a judges whether or not the device is a judgment target in the estimation phase based on the update result of the classification process. If the CPU 41a judges that the device is a judgment target, the process proceeds to S324 to determine parameters for the device, and if the CPU 41a judges that the device is not a judgment target, the process proceeds to S341. For example, the CPU 41a judges that a device classified as a device that operates irregularly (1204) is not a judgment target, interrupts additional learning, and proceeds to S341.

In S322, the CPU 41a calculates and updates new parameters using the parameters already determined for the target device and the currently collected time series data for the target device during normal operation, and proceeds to S331. For example, if a device (1201) that operates in synchronization with the operation cycle of the device is determined by the previous learning, and the type of the device is maintained, the CPU 41a calculates and updates new upper and lower thresholds based on the upper and lower thresholds indicating the time variation between any change points of the time series data determined by the previous learning, and the currently collected time series data during normal operation. In this way, the new upper and lower thresholds are calculated and updated based on the time between any change points of the currently collected time series data during normal operation, and the upper and lower thresholds, and the width of the updated thresholds is widened or narrowed depending on the time variation between any change points of the currently collected time series data during normal operation and the degree of deviation from the threshold.

In S324, the CPU 41a calculates and updates parameters corresponding to the updated type using the currently collected time series data during normal operation, and proceeds to S331. The parameters calculated and determined here may be calculated using the same method as the parameters determined in S32 of FIG. 15. For example, various calculation methods such as average value can be applied, and a method suitable for each time series data is selected. Furthermore, these determined parameters may be changeable by the operator. This makes it possible to make adjustments possible even if extreme parameters are determined when the learning period is short.

In S331, the CPU 41a determines whether or not correction input for the classification of each device has been received from the operator. For example, the CPU 41a can accept a type setting for the device to be classified according to the operator's designation and correct the classified type, and the CPU 41a determines whether or not the classification has been corrected based on such correction input from the operator. If the CPU 41a determines that correction input for the classification of each device has not been received from the operator, it proceeds to S333.

On the other hand, if it is determined that a correction input for the classification has been received from the operator, the process proceeds to S332, where the CPU 41a determines whether or not the correction is appropriate for the type of the device to be classified according to the operator's designation, and if it is determined that the correction is appropriate, the correction is reflected in the type of the classification set according to the operator's designation. In other words, the CPU 41a determines whether or not the time series data collected this time during normal operation is appropriate for the type of the classification set according to the operator's designation. Also, if the CPU 41a determines that the type of classification set according to the operator's designation is not appropriate, it may notify the user that the type is not appropriate, or may notify the user that the type is not appropriate and prompt the user to re-designate the classification. For example, if the device is classified into a type of device (1203) that takes a constant value according to the operator's designation, and the time series data collected this time during normal operation includes a value different from the constant value, the CPU 41a may notify the user that the type set by the operator is not appropriate, and may reclassify the device into a device that operates irregularly (1204). Similarly, if the device is classified as a device (1201) that operates in synchronization with the operation cycle of the device according to the operator's designation, and the time series data collected this time during normal operation contains a different pattern, the CPU 41a may notify the operator that the type set by the operator does not match, and may reclassify the device as a device (1204) that operates irregularly. After completing the process of S332, the CPU 41a returns the process to S321 again to determine parameters according to the revised classification.

In S333, the CPU 41a judges whether or not the operator has input a correction to the parameters for each device. For example, the CPU 41a can further adjust the parameters updated in S322 or S324 in response to the correction input from the operator. If it is determined that the parameter correction instruction from the operator has not been received, the process proceeds to S341. On the other hand, if the parameter correction instruction from the operator has been received, in S334, the CPU 41a judges whether or not the time-series data collected this time during normal operation matches the parameters for the device to be classified according to the operator's designation. If the CPU 41a judges that the parameters are suitable, it reflects the correction to the parameters set according to the operator's designation. If the CPU 41a judges that the correction to the parameters set according to the operator's designation is not suitable, it may notify the user that the correction is not suitable, or may notify the user that the correction is not suitable and prompt the user to re-designate the parameters. The CPU 41a may calculate the parameters using the same calculation method as in S32.

Next, in S341, the CPU 41a determines whether the additional learning process has been completed for all devices to be learned. If the additional learning process has not been completed for any of the devices to be learned, the CPU 41a returns the process to S311 to perform additional learning process for the incomplete devices. On the other hand, when the additional learning process has been completed for all devices to be learned, the CPU 41a ends the additional learning process.

<Modification>
The present invention is not limited to the above embodiment and can be modified in various ways. For example, in the above embodiment, an example of analyzing and classifying collected data from bit devices and word devices is described, but the present invention is not limited to such device values. For example, the collected data is not limited to the examples described in the above embodiment, and may be information such as camera images and event logs.

Figure 19 shows a modified example of collected data. Here, the case where the collected data is a camera image (moving image) will be described. 1901 shows the camera image to be collected. It is an image captured at a specified location in a factory facility. For example, the CPU 41a may divide these camera images 1901 into multiple regions and determine parameters using the brightness values in the regions as feature quantities. The camera images 1901 show a state in which multiple products 1905 are transported at equal intervals on a belt conveyor 1904. In such a case, as shown in 1902, it is possible to determine whether the system is operating normally by utilizing the change in brightness value in a specified region 1903 over time. For example, in the shaded portion of the camera image 1901, a product passes through at a specified time interval, so that the image (brightness value) of the product periodically interrupts. By utilizing such a change in brightness value, it is possible to check whether the product is flowing normally or whether the product is not moving obliquely on the belt conveyor by monitoring multiple regions. Also, while FIG. 19 shows an example of a product transport path, it is also possible to check whether the robot is operating normally by, for example, photographing the area where the robot is moving and periodically inserting an image of the arm part into a specified image area in accordance with the movement of the robot's arm. Note that the camera image may be classified as a device that obtains analog values.

Second Embodiment
The second embodiment of the present invention will be described below. In the first embodiment, the process flow when the PLC basically indicates an abnormality, that is, when the storage condition is an abnormality of the programmable logic controller, has been mainly described. However, as already described, the present invention is not limited to the identification function of identifying an abnormal device by triggering the occurrence of an abnormality in the PLC, but can also be applied to a process (analysis function) of analyzing the difference from normal time series data. Therefore, in this embodiment, a process of analyzing and verifying whether the collected device value is a value that deviates from the normal time series data (a device value that is different from usual) will be described. Note that only the parts different from the first embodiment will be described below.

In this embodiment, the characteristics of the changes in the device values are extracted and classified, and an appropriate detection algorithm for abnormalities (changes that are different from usual) is applied to each of the classified characteristics. That is, in this embodiment, as in the first embodiment, in the learning phase, the device values are classified from the time series data in normal times, a detection algorithm is determined according to each type, and evaluation variables and parameters according to each detection algorithm are set. In this embodiment, these learning phases are also performed in advance before the estimation phase is executed, and flag information indicating the classified type and identification information of the device corresponding to the time series data are stored. In addition, in the estimation phase, a detection algorithm determined according to the type of the time series data to be estimated is applied and analyzed to analyze and verify whether the device value is different from usual. In other words, the classification process is not performed again in the estimation phase. In this case, it is possible to avoid the inability to process the classification process during operation and the unintended updating of the learning data. Note that the classification process may also be performed in the estimation phase. In this case, the newly obtained time series data that can be considered normal may be extracted based on the normal data that has already been learned, and the learning data may be updated in response to changes over time based on the newly extracted time series data and the already learned time series data. For example, for a device whose values change in a steady pattern in sync with a specified cycle, the thresholds included in the parameters may be updated based on the variance between newly extracted time series data and previously learned time series data.

The processing procedure for verifying whether a device value is different from usual, i.e., whether it deviates from the normal device value, will be described with reference to FIG. 16. The processing described below is realized by the CPU 31 of the basic unit 3 and the CPU 41a of the expansion unit 4a. Note that only the processing (S45) that differs from the first embodiment will be described, and the other processing will be omitted.

In S45, the CPU 31 determines whether the storage condition for storing the device value stored in the first buffer 37a in the memory card 44 of the basic unit 3 is satisfied. Here, in the first embodiment, the storage condition is satisfied when an abnormality occurs in the programmable logic controller. However, in this embodiment, the user designates a device that will be a storage trigger in advance, and the storage condition is controlled to be satisfied when a predetermined change occurs in the device, when an analysis command is issued by the user, when a periodic monitoring period has elapsed, when an analysis command is issued from an expansion unit connected to the basic unit 3, when the collected device value is a device value that is different from usual, etc. For example, if a device value different from the previous time occurs in S43, it may be determined that the storage condition is satisfied in S45, and the process may proceed to specific processing. In addition, the storage condition may be controlled to be satisfied depending on the difference (degree of deviation) from the previous device value or the number of occurrences of device values that are different from normal. Regarding the analysis instruction from the user, it is possible to instruct to analyze and verify a specific device in real time, but it may also be an instruction to verify past data of a specific device. Furthermore, in S47, rather than identifying abnormal devices, the abnormal state that deviates from normal time series data will be analyzed and verified.

Next, a display example of the analysis results according to this embodiment will be described with reference to FIG. 18. Formally, the display is similar to the identification results of the first embodiment described above, but in this embodiment, abnormal devices are not identified, but rather a state (abnormal state) in which a deviation from normal time-series data occurs is identified, and the display content is changed accordingly.

Therefore, for example, screen 1800 shows the number of times that deviations from normal time series data occurred, rather than the number of device abnormalities. It is also preferable to determine the degree of abnormality not using the number of times that device abnormalities occurred, but using the number of times that the abnormal state in this embodiment occurred, i.e., the number of times that deviations from normal time series data occurred.

Third Embodiment
The third embodiment of the present invention will be described below. In the above first and second embodiments, the identification function and the analysis function have been described, respectively. In this embodiment, a monitoring function for periodically collecting and monitoring device values will be further described. Note that only the parts that are different from the above first and second embodiments will be described below.

Figure 20 shows a flowchart showing the processing procedure for outputting a monitoring start signal to start monitoring according to this embodiment. The processing described below is executed by the CPU 31 of the base unit 3. However, this is not intended to limit the present invention, and may also be executed by the CPU 41a of the expansion unit 4a.

In S51, the CPU 31 determines whether the monitoring period has elapsed. The monitoring period is a value that can be set by the operator (administrator) of the programmable logic controller, and any period can be set. The set value is set, for example, in the collection setting 36a of the storage device 32. If the monitoring period has elapsed, the process proceeds to S53, and if not, the process proceeds to S52.

In S52, the CPU 31 determines whether or not a monitoring instruction has been received from the user. The monitoring instruction can be received through user input via the PC 2a or the operation unit 6 of the basic unit 3. If a monitoring instruction has been received from the user, the process proceeds to S53; if not, the process returns to S51.

In S53, the CPU 31 generates a monitoring start signal, outputs it to the basic unit 3, and ends the process. When the basic unit 3 receives the monitoring start signal, it determines that the storage condition is met in S46 of FIG. 16, and executes the process from S47 onwards to execute the analysis process. Here, the storage condition in S46 is met immediately after receiving the monitoring start signal, and collects the time series data stored in the memory card 44 from a predetermined period before to the present. The storage condition in S46 may also be met after a predetermined execution cycle has elapsed after receiving the monitoring start signal, and collects the time series data stored in the memory card 44 during the predetermined period after receiving the monitoring start signal. Alternatively, the storage condition in S46 may be met after a predetermined execution cycle has elapsed after receiving the monitoring start signal, and collects the time series data stored in the memory card 44 during the predetermined period before and after receiving the monitoring start signal.

The data to be monitored can be selected by user settings. As in the second embodiment, in S48, abnormal devices are not identified, but abnormal states that deviate from normal time-series data are analyzed and verified. The analysis results are displayed in the same manner as in the second embodiment.

<Summary>
As described above, the programmable logic controller according to the present embodiment includes an execution engine that repeatedly executes a user program, and a device memory having a plurality of devices that is a storage area for storing data accessed by the execution engine according to the user program. The programmable logic controller also collects data held in a device to be collected among a plurality of devices according to a predetermined collection setting for each scan period of the user program, classifies each device into one of a plurality of types based on the characteristics of the collected time-series data of each device, and determines a detection algorithm for identifying an abnormal device according to the time-series data of the device collected by the collection means and the type into which the device is classified by the classification means. An abnormal device is identified by analyzing the time-series data of the device collected by the collection means using the detection algorithm determined for the device by the determination means according to the type into which the device is classified by the classification means. In this way, the programmable logic controller according to the present embodiment can analyze and classify characteristics such as periodicity and continuity of data related to each device, and efficiently identify an abnormal device.

Furthermore, in response to user instructions, the program controller further uses a determined detection algorithm to analyze the deviation of the collected time series data of each device from normal time series data to verify whether any abnormalities have occurred. Note that this analysis function may be performed periodically at a specified interval (monitoring function).

In addition, when time series data for a predetermined number of scan cycles is accumulated, the programmable logic controller classifies each piece of time series data based on the characteristics of the time series data, and determines and updates the detection algorithm. Thus, according to the present invention, a function corresponding to the learning phase is periodically executed while the programmable logic controller is in operation, thereby improving the accuracy of identification processing in the event of an abnormality.

In addition, for one or more device groups, if the values collected in the previous scan cycle and the values collected in the current scan cycle have not changed for all devices in the group, the programmable logic controller deletes the values collected in the current scan cycle and compresses the collected time series data. This allows memory resources to be used efficiently.

Furthermore, this programmable logic controller classifies a plurality of devices into at least devices that have a constant value, devices whose values change in a steady pattern in sync with the operation cycle of the device, devices whose values change in a steady pattern in sync with a different period of the operation cycle of the device, devices whose values change irregularly, devices whose values are analog, and devices whose values increase or decrease monotonically. Furthermore, by determining a detection algorithm based on these classifications and using features, it is possible to efficiently identify abnormal devices when an abnormality occurs. Note that devices whose values change irregularly are not used to identify abnormalities because their features cannot be extracted.

When identifying an abnormal device, the programmable logic controller compares the determined detection algorithm with the characteristics of the time series data corresponding to the detection algorithm, and identifies the device as abnormal if the difference exceeds a predetermined threshold. The programmable logic controller may also determine the time difference between the change points of the values in the two time series data as the detection algorithm when identifying an abnormality, and identify the two devices corresponding to the two time series data as abnormal devices if the time difference in the two time series data is not within a predetermined range. In this way, according to the present invention, a detection algorithm is determined according to each classified type, and when an abnormality occurs, the detection algorithm is used to identify the abnormal device using a method appropriate for each type.

The programmable logic controller also creates display data showing the identification results and displays the data on the display device of the programmable logic controller or transmits the data to an external device. The identification results can be displayed on a variety of different display screens (Figure 18).

In the above embodiment, an example was described in which the expansion unit 4a included in the programmable logic controller collects and classifies time-series data, determines a detection algorithm according to the classification, and identifies an abnormal device when an abnormality occurs. However, the present invention is not limited to this, and at least some of the above-mentioned functions may be realized by a basic unit or another expansion unit. Furthermore, the above-mentioned functions may be realized by an analysis device (external device) communicatively connected to the programmable logic controller.

The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the invention.

Claims (19)

1. A programmable logic controller, comprising:
an execution engine for repeatedly executing a user program;
a device memory having a plurality of devices which are storage areas for storing data accessed by the execution engine according to the user program;
a collection means for collecting data held in a collection target device among the plurality of devices in accordance with a predetermined collection setting for each execution cycle of the user program;
A classification means for classifying each device into one of a plurality of types based on characteristics of the time-series data of each device collected by the collection means;
A determination means for determining a detection algorithm for identifying each device as an abnormal device according to the time-series data of the device collected by the collection means and the type into which the device is classified by the classification means;
a device identification unit that identifies an abnormal device by analyzing the time-series data of the device collected by the collection unit according to the type into which the device is classified by the classification unit, using the detection algorithm determined by the determination unit for the device ;
A programmable logic controller characterized in that the types include at least two of the following types: a type of bit device that has a constant value, a type of bit device whose value changes in a steady pattern in synchronization with the operation cycle of the programmable logic controller, a type of bit device whose value changes in a steady pattern in synchronization with a period different from the operation cycle, a type of bit device whose value changes irregularly, a type of analog value, and a type whose value monotonically increases or decreases . The programmable logic controller according to claim 1, characterized in that the identification means further identifies an abnormal device by analyzing the deviation between the time series data of each device collected by the collection means and the normal time series data using the detection algorithm determined by the determination means in response to a user instruction or periodically. the classification means, when the collection means accumulates time series data for a predetermined number of scan periods, classifies each of the time series data based on characteristics of the time series data;
3. The programmable logic controller according to claim 1, wherein the determining means determines and updates the detection algorithm for identifying an abnormality in accordance with the time-series data classified by the classifying means. The programmable logic controller according to any one of claims 1 to 3, characterized in that, when the classification means receives a user instruction for any device, it classifies the device in accordance with the user instruction. 5. The programmable logic controller according to claim 1, wherein the collection means compresses the collected time series data by deleting the value collected in the current scan cycle if the value collected in the previous scan cycle and the value collected in the current scan cycle have not changed for all devices in the group that are the subject of collection, in one or more device groups.
6. The programmable logic controller according to claim 5 , wherein the determination means excludes time series data classified by the classification means as a device whose values change irregularly, and determines a detection algorithm for identifying an abnormality. 7. The programmable logic controller according to claim 1, wherein the identification means identifies an abnormal device by analyzing the abnormal device using, as the detection algorithm, an evaluation variable used for analyzing the abnormal device and a parameter corresponding to the evaluation variable, based on the type of the time - series data classified by the classification means. Further, an additional learning determination means is provided for determining whether or not a condition for additional learning is satisfied,
The programmable logic controller of claim 7, characterized in that when the additional learning determination means determines that the conditions for additional learning are met, the classification means reclassifies each device into one of a plurality of types based on the current type of each device and the characteristics of the time series data of each device collected by the collection means during the period targeted for additional learning, and the determination means re-determines the detection algorithm to be used when identifying the device as an abnormal device in accordance with the time series data of each device collected by the collection means during the period targeted for additional learning and the type into which the device was reclassified by the classification means or the detection algorithm of each current device. 9. The programmable logic controller according to claim 1, wherein the identification means compares the detection algorithm determined by the determination means with characteristics of time-series data corresponding to the detection algorithm, and identifies the device as an abnormal device if a difference therebetween exceeds a predetermined threshold value. The determining means determines a time difference between change points of values in the two pieces of time-series data as a detection algorithm for identifying an anomaly,
10. The programmable logic controller according to claim 1, wherein the identification means identifies two devices corresponding to the two time series data as abnormal devices when the time difference between the two time series data is not within a predetermined range. 11. The programmable logic controller according to claim 1, further comprising an output unit that outputs, as a result of the identification, a candidate device that is highly likely to be abnormal so that the candidate device can be identified. The programmable logic controller according to claim 11 , characterized in that the output means displays, as the identification result, each device on a display unit in order of increasing degree of abnormality indicating the magnitude of the abnormality or in order of earliest occurrence time of the abnormality. The programmable logic controller according to claim 11 or 12, characterized in that the output means displays, on a display unit, as the identification result , time series data of a device identified as an abnormal device under normal conditions and time series data of the device under abnormal conditions in a manner that allows comparison . 14. The programmable logic controller according to claim 1, wherein the time series data collected by said collecting means includes image data. 15. The programmable logic controller according to claim 1, wherein the characteristics of the time series data are characteristics related to periodicity or continuity. Further comprising a base unit and an expansion unit connected to the base unit,
The basic unit comprises:
a device including the execution engine, the device memory, and the collection means;
The expansion unit includes:
16. A programmable logic controller as claimed in any preceding claim, comprising said classifying means, said determining means and said identifying means. A setting means for setting a monitoring period of the device;
a generating means for generating a monitoring start signal for starting monitoring at each of the monitoring cycles set by the setting means;
The programmable logic controller according to any one of claims 1 to 16, further comprising an analysis means for analyzing the time series data to be analyzed from each device collected by the collection means in response to the monitoring start signal generated by the generation means, using the detection algorithm determined by the determination means , and outputting the analysis result to a display unit . 18. A programmable logic controller as claimed in any one of claims 1 to 17 , further comprising a memory card for temporarily storing the device time series data collected by the collection means before it is used by the classification means and the identification means. An analysis device communicatively connected to a programmable logic controller, the analysis device comprising: an execution engine that repeatedly executes a user program; a device memory having a plurality of devices that are storage areas for storing data accessed by the execution engine in accordance with the user program; and a collection means that collects data held in a collection target device among the plurality of devices in accordance with a predetermined collection setting for each scan period of the user program, the analysis device comprising:
an acquisition means for acquiring the time series data of each device collected by the collection means from the programmable logic controller;
A classification means for classifying each device into one of a plurality of types based on the characteristics of the time-series data of each device acquired by the collection means;
A determination means for determining a detection algorithm for identifying each device as an abnormal device according to the time-series data of the device collected by the collection means and the type into which the device is classified by the classification means;
an identification means for identifying an abnormal device by analyzing the time series data of the device collected by the collection means according to the type into which the device is classified by the classification means, using the detection algorithm determined by the determination means for the device;
an output unit that outputs a result of the determination by the determination unit ;
The analysis device is characterized in that the types include at least two of the following types: a type of bit device that has a constant value, a type of bit device whose value changes in a steady pattern in synchronization with the operation cycle of the programmable logic controller, a type of bit device whose value changes in a steady pattern in synchronization with a cycle different from the operation cycle, a type of bit device whose value changes irregularly, a type of analog value, and a type whose value monotonically increases or decreases .

Images